Unless you have some reason not to use it, it's much easier than changing about:config on each computer, you just copy over the user.js file.

Here's a hardened option (no affiliation): https://github.com/pyllyukko/user.js

And a relaxed version: https://github.com/pyllyukko/user.js/tree/relaxed

See here: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...

> I don't want the administrative workload coming with donations. I don't want the project to become in need of funding in any way: no dedicated home page + no forum = no cost = no need for funding. I want to be free to move onto something else if ever I get tired working on these projects (no donations = no expectations).

> Have a thought for the maintainers of the various lists. These lists are everything. This can't be emphasized enough.

[1] - https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...

If there is no money involved the project cannot be bribed by ad tech. The only acceptable ads are the ones the user white lists.

Don't know how it would be for an opensource project. Mentioning something like "open source browser extension uBlock Origin" probably...

Interesting how people report their donations, patreons, etc.

https://support.patreon.com/hc/en-us/articles/207099566-Will...

Many stuff is disabled by default, but it’s a moving target. There are some tutorials online to read.

It depends on what the browser is used for. Some hardening breaks certain sites.

Some stuff to look at:

- dns-prefetch - geo - cookie - dom (disable, breaks sites) - browser.cache.disk - clipboard.events - media.peerconnection - healthreport - spoofRefererHeader

Chrome doesn’t remove history when closed is a big issue.

https://gist.github.com/0XDE57/fbd302cef7693e62c769

I had some problems with sendRefererHeader, so it can definitely break some websites

Also, the DNS cache size explanation is a bit backwards. "Number of cached DNS entries. Lower number = More requests but less data stored." Where do you think that data is stored? Bigger cache size means fewer requests that inform a third-party (your DNS server) of which sites you're visiting. (Information leaks from the speed of resolving a query might be a concern, but I'm not sure how doable this is from a webpage.)

And then it disables all caches (including in-memory) for... what reason, exactly? You can configure firefox to clear all your browser data when you close it.

But then they force-enable WebGL, which enables quite a few tracking techniques. This list is weird.

I guess all I want to say is don't blindly apply settings from this list. The author traded a lot of convenience, speed, and security for some perceived privacy.

I am not a security expert, but I tend to agree with this. I took a look at the script and noticed a few of the things you pointed out, and I have had horrible experiences running random scripts I found on Github before from claimed-to-be "experts", so I'll stick with the defaults (and UBlock).

Unfortunately, there is no real documentation of the various about:config parameters. So one has to trust doubtful sources on what settings would be useful, or spend many hours reading the source code of Firefox.

I don't understand why each setting is not documented on the about:config page. It would bind the documentation to the release, providing the info suitable for the FF version. I can't see any drawback, except that developers would have to provide a small description of every setting they introduce, which I hope they already do somewhere.

Here is my own frustrating experience with about:config. I sometimes hit Ctrl-q when I meant Ctrl-w. So instead of closing a tab in FF, I close the application and loose my input on some pages. I tried to restore the (previously default) behavior of asking for confirmation before quitting. I had 2 settings in "about:config" named "browser.warnOnQuit" and "browser.showQuitWarning". Only the former one is documented in the mozillaZine wiki. It seems the latter was the old name of this setting, which FF updates never migrated.

So I changed the config, and nothing happened. After several variations, I headed for the source code of FF, and saw this setting was ignored when "restoring sessions" was active. There is no way to ask for confirmation in modern FF.

There are efforts to prevent this in the future but for now disabling or limiting DNS cache seems the only viable option.

That makes sense. Checking the Referer header is a quick and dirty way to implement cross-site request forgery (CSRF) protection.

https://ffprofile.com/

As expected it will increase any font that doesn't meet your minimum size.

If you're fine with per-site settings, just use the zoom option.

https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-de...

Just curious. I am on a similar boat but sometimes find some sites to be unreadable after having UBO and some other privacy adjustments through about:config.

Thanks!

Is there an example of a site that is unreadable after a default install of UBO for you? I'd be curious to check it out..

Never had this issue. Even in Slack, where UBO blocks 778 elements atm.

On the otherhand I also run NoScript temp-whitelist only so all sites that rely on javascript are broken by default for me until I figure out which CDN/etc to temp whitelist.

You can use ungoogled-chrome.