FF you first start by looking at their long guide for version control/build instructions http://mozilla-version-control-tools.readthedocs.io/en/lates...

Then you make a custom mozconfig file to disable or enable features, or to add your own extensions (ie: windows): https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

  ac_add_options --disable-activex  
  ac_add_options --disable-activex-scripting
  ac_add_options --disable-installer
  ac_add_options --disable-crashreporter

You can further abstract this with a mozconfig wrapper https://github.com/ahal/mozconfigwrapper

But I agree, I can't find any documentation what exactly every feature is and why you would not want to disable/enable them. The Chromium build process is much more straight forward, or you could just use 3rd party sandbox and regular release FF.

Your first link is misleading because it's targeted toward onboarding new Firefox contributors and includes a Mercurial tutorial and development workflow guide in addition to build instructions. Simple build instructions are here:

https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

On Linux I clone the source and run "./mach build".

Forgot to add there's a really good page around by the Chrome security team detailing all kinds of functions somebody might wish to remove such as dns lookups that expose your IP (the tails/torbrowser design document also has this list)

do you have a link?

The suggestion is that you compile it with a flag to disable the feature. No need to change any lines of code.

I think their point is that they don't know enough about the innerworkings (read: code) to be sure that turning off one feature doesn't enable far more security vulnerabilities than existed when the feature was on...

They aren't suggesting using compile flags requires code changes...