As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same for GuixSD, same for services etc in nearly all unices.

On FF however I found no damn simple way to do basic things like:

- install extensions via CLI/wrappers (for instance homeManager), there are some hack but they are not reliable and Mozilla seems to try avoiding supporting such a thing;

- configure preferences, like about:config, outside firefox;

- customize ff themes in a simple manner.

Modern browsers seems to mimic the most closed commercial OSes I know of instead of mimic classic FOSS model and that's a big problem.

Today I can easily automate my entire desktop, but browsers and they demand more and more settings and third parties tools/extensions to be "at least less unsafe" for us users (from firejail/capsicum to cookies deleters, adblockers etc.

That's a horrific mess.

This seems to be by design: when these things are available, spyware -- especially on Windows -- will be quick to make malicious changes in all these if they can.

It's a pain, but I can see the compromise. If it makes the average Firefox user more vulnerable, there's definitely a case to protect them, even at the expense of its more capable users.

if spyware has permissions to change ".firefox-prefs" doesn't it have permission to change about:config items, too?

Yes, this leads Firefox to be fairly conservative with its permissions.

In general, blocking userspace from installing extensions and otherwise running malicious code stops FF from being exploited. Blocking all of these options blocks the OS from bad behaviour, especially where the user may expect a new computer/phone to have the default behaviour.

The vendors of phones and personal computers seem to have an interest in interfering with users' internet access; perhaps it is a good decision that Firefox does not let them.

Actually homeManager can manage Firefox, installing extensions etc... Only it's a hack-ish and not much reliable way.

So no, actual Mozilla strategy does NOT work to stop malware's on Windows nor commercial OEMs customization, as a matter of fact made only life of pro users and admin harder and open the door for less safe setup (for instance extensions added via homeManager may not get updated by FF).

We would and should expect that it is be possible: unless Firefox signs configuration changes per-user, server-side (violating their privacy intentions), the whole configuration code is open source, and can easily be easily used or reverse engineered to make an external editor.

This doesn't change that a sanctioned API invites abuse far more readily than reverse-engineering, especially when spyware is less frequently updated than Firefox itself. That there isn't a sanctioned API, and that the de facto API can and does change every version, is an advantage for Firefox against potential attackers.

If this is something you are sorely lacking, Firefox has also been straightforward to modify and compile, in my experience. You can always share a patch and enjoy these features as part of a smaller community, without compromising the userbase as a whole.

No software trick can fix OS unsafe design. Also "protecting users" limiting their power means jails them, not really protecting.

End users are adult, not child, and developers are others adults with ZERO right on their software's user.

If people want safer systems better learn to avoid commercial software, nothing else can help them.

I can agree in general, but, for now, disabling a firefox --install maliciousaddon.xpi and firefox --setconfig keyyoudontwant=valueyoudontlike is enough barrier to stop a majority of bad actors. None of us want users to click yes through install screens, having toolbars and spyware installed for the average user, but that has been the reality of those APIs thus far.

Perhaps a more fine-grained permission model is needed for cross-application changes, but I can't think of anybody actively working on it in an OS.

Having a simple text-based config with a repo, like

[AddOns]

ensure-ffpkg AddonName

[Themes]

set-default ThemeName

install ThemeA, ThemeB

[Settings]

key:val

...

and have the AddonName downloaded with GNUPG signature check from an official Mozilla repo is by far more save that demand using interactive GUIs. Simply ask at startup to accept "potentially dangerous" extensions if you specify a local .xpi file it the same.

What you describe is the classic Windows approach that have proved enough to be ineffective and only useful for commercial practice. Mozilla is formally a foundation and Firefox is formally a FOSS project...

I doubt that nowadays many of the average Firefox users are really average computer users.

Our (German) site has mostly photographers who are not very (computer) technically inclined. Yet we have 20% FF users.

Firefox​ had color management and color profiles support years before the other browsers. I'd venture to guess this is why it's favorite among photographers.

I'd also like to point out how many times "this might void your warranty" appears on the following page.

https://support.mozilla.org/en-US/kb/how-stop-firefox-making...

which is a perfectly reasonable and legitimate user request that, the browser not talk to the internet before the user agrees it may.

Which is crazy for a browser that claims to be "privacy focused" that those settings aren't all in the "privacy tab" with the _two_ that are...

> ... Mozilla seems to try avoiding supporting such a thing

Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anything other than to annoy people trying to manage its configuration with tools different from their own.

I've since found a way to make the profile directory not have a random prefix, but it still requires doing the change through Firefox's GUI profile manager.

> Why would it make it random?

https://bugzilla.mozilla.org/show_bug.cgi?id=56002 has the long discussion about it, but briefly: the profile directory name randomization was introduced to prevent web sites from being able to place data they control in known locations on your hard drive (via the browser cache) and then use that as a stepping-stone in a privilege escalation.

The name is random so pages on the web can’t reference files in it using the file:// urls.

If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.

It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.

Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them.

Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.

about:config preferences can be customized using the user.js files. See https://github.com/pyllyukko/user.js/#installation for some examples.

For addons and other options you can use policies.json file, see https://github.com/mozilla/policy-templates/blob/master/READ...

That is not entirely true, there is a prefs.js in my Profile folder that contains the changes done to my about:config page, if I interpret it correctly.

True but certainly not friendly to edit with a big

// DO NOT EDIT THIS FILE.

and an optional user.js separate preference I do not know how reliable...

user.js is the supported and reliable way to set preferences that should just be set no matter what the default configuration is or what about:config says.

prefs.js is the storage for the current non-default pref values. At runtime, default pref values are loaded, then prefs.js, then user.js.

You _can_ edit prefs.js and the effect will be the same as if you changed the pref in about:config, as long as you do it while Firefox is not running against that profile. If you do it while Firefox is running, your changes will be overwritten at shutdown when Firefox writes out then-current in-memory pref values.

I won't ask for a complete audit, but is there one example from the wizard that could break stuff, that is NOT called out by the wizard itself?

That might be true for a technical user, but is the average user going to know that discord is broken because they disabled webrtc? Also, resistfingerprinting is going to significantly increase the difficulty of recaptcha challenges you encounter.

ResistFingerprinting is currently known to break Google's Recaptcha v3. Here is the Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1503872

I wonder just how much security relies on tracking. I know my VPN makes captchas an absolute nightmare.

I always have a hard time using some services when in incognito mode; I get the captchas, and either they are wrong or are really hard, and it can take several tries to get through them.

Because an error message should be displayed then.

I used to run Firefox with resist fingerprinting enabled. I believe it was causing chat time stamps on websites like WhatsApp to be incorrect, which was annoying but I don’t know if you consider that broken.

Yes I discovered that when viewing the TV guide on plex. Everything was an hour out (UK). I think with resist fingerprinting the timezone is set to UTC0. In the end I had to turn that setting off.

Ironically, checking for UTC+0 JavaScript time from an obviously-not-UTC+0 IP geolocation might give additional hints for fingerprinting, as does everything else that looks non-default, like odd language preferences or even a DNT header.

Good point. I'm pretty sure this component of resistFingerprinting is derived from Project Fusion, which uplifts privacy/anonymity-related changes from Tor Browser into Firefox. In the Tor Browser threat model, the idea is that you can't avoid looking like a Tor user, so the goal is to make all Tor users indistinguishable from each other. Flipping this pref as a regular Firefox user is incompatible with its primary intent/threat model, so it fails to deliver and may even make you _more_ identifiable in some circumstances.

This is a great example of why I'm generally skeptical of these scattershot approaches to making users more secure by changing default settings in mainstream browsers. Security and privacy features always entail tradeoffs and should be designed and implemented holistically for best results.

> should be designed and implemented holistically for best results

This is why I, a privacy-conscious individual, don't follow any of these guides in my Firefox. If you follow the discussion on Bugzilla, the weekly team meeting notes, and occasionally ask respectful questions on Mozilla IRC, you come to a similar conclusion to me in that the Firefox development community is doing the right thing in not enabling this by default.

It also breaks add-on compatibility because it sets your user agent to the last ESR version of Firefox, which may be several versions behind the version you're actually running.

That is resolved with 60.x ESR. First released in the early summer and has been the default since September. 52 had no support for webextensions

That's the compatibility issues for webextensions at all, but the bug still exists for extensions that declare compatibility ranges between the latest version and the previous ESR: https://bugzilla.mozilla.org/show_bug.cgi?id=1394448

I feel a strong need to point out the bad faith Mozilla seem to have for Firefox users and their privacy, eg Pocket, Mr Robot, DRM & binary blobs, dark pattern configs, etc.

As much as I loved the browser in the past, nobody should consider running it today, without being informed of the implications. The ffprofile.com site is something I have been waiting for, but stuff like this should not be necessary and IMO Mozilla Corp. has won. Nobody celebrates a new version of FF anymore.

Also useful resources: https://github.com/amq/firefox-debloat https://support.mozilla.org/en-US/kb/how-stop-firefox-making... https://spyware.neocities.org/articles/firefox.html https://browserleaks.com/ https://www.howsmyssl.com/

Does Mozilla have a sanctioned way to pre-configure a browser with standard configurations?

This used to be impossible, and essentially made my employer banish Firefox in most cases.

You could use group policy.

https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

Look up Mike Kaply's blog; he covers it extensively and, AFAIK, knows the topic as well as anyone.

Yep I took the defaults here then installed 1PasswordX and couldn’t open its settings. That’s a vital extension for me.

>(This is in fact sarcasm before you get too eager with that down arrow)

I see this defense quite a lot on the internet, and I think it's misplaced. Even without your comment, I would have downvoted you, not because I though you were in earnest, but because your sarcastic comment doesn't add anything to the conversation.

I think it adds a lot to the conversation. It's an obviously poor argument, which points out how poor it is when Mozilla uses it to make obviously poor choices.

Technically, your comment doesn't add much to the conversation either.

I agree that my comment is of extremely limited value. Usually I just down vote and move on for that very reason. Today I chose to explain why instead.

The difference is that I believe that my comment has a very small positive value, while I believe that the comment I responded to has a small to moderate negative value.

If you believe that your comment adds value, then so must the parent comment. If that’s true then your comment is false and adds no value.

Quite paradoxical.

IMO, without sarcasm, people, not browsers makers, should ditch modern "web" to came back to local application with networking enabled.

We need to regain control of our systems and data before being all slave (without even the need of a strong power) of few corporations...

and yet here you are

Yep, since most people forget nntp... But I'm here not elsewhere and I'm receive HN updates via mail (RSS2Email) and planning to try my first Emacs serious work with a modification of HN plugin to allow posts not only view...