> Why would it make it random?
https://bugzilla.mozilla.org/show_bug.cgi?id=56002 has the long discussion about it, but briefly: the profile directory name randomization was introduced to prevent web sites from being able to place data they control in known locations on your hard drive (via the browser cache) and then use that as a stepping-stone in a privilege escalation.
The name is random so pages on the web can’t reference files in it using the file:// urls.
If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.
Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them.
Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.
Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anything other than to annoy people trying to manage its configuration with tools different from their own.
I've since found a way to make the profile directory not have a random prefix, but it still requires doing the change through Firefox's GUI profile manager.