38 ms·

I am sure there are people who would love a browser that can control their car or pacemaker and report their bank balance on the welcome page. But I personally

by pawadu 10y ago

I am sure there are people who would love a browser that can control their car or pacemaker and report their bank balance on the welcome page. But I personally would feel far more secure if there was a firefox-lite where no sensitive stuff (access camera, share screen) were included to start with. And I don't mean turned off by default, I want it removed at compile time.

mido22 10y ago
I disagree, I trust WebRTC enough for camera and screen access, the one real issue might be, it exposes your local ip
- Noseshine 10y ago
  It seems uBlock Origin has a setting (right on the main settings page) that can prevent the local IP to be leaked: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l... You can test it here: https://browserleaks.com/webrtc https://browserleaks.com/webrtc I tried that test page with the mentioned setting 1) enabled and 2) disabled. I did not see my local IP on 1), I did get see it reported with 2) - so it seems the block works. NOTE: Whether uBlock Origin was enabled for the specific page did not matter, the WebRTC block setting seems to be global and independent of whether the extension blocks anything else on the site.
sp332 10y ago
As mido22 said, the alternative right now is a closed plugin (Flash) or installing software on your computer completely outside of the sandbox. Putting these features in the browser in a controllable way is a step forward. If you don't need them, Firefox is open source and I'm not just saying that to be glib. You can easily grab the source https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... and compile it with --disable-webrtc https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...
- pawadu 10y ago
  But I am not familiar enough with the firefox code to do this. I might unknowingly create a whole new set of security issues by changing a few lines in a project of this complexity.
  - daveFNbuck 10y ago
    The suggestion is that you compile it with a flag to disable the feature. No need to change any lines of code.
    - roninb 10y ago
      I think their point is that they don't know enough about the innerworkings (read: code) to be sure that turning off one feature doesn't enable far more security vulnerabilities than existed when the feature was on... They aren't suggesting using compile flags requires code changes...
  - hackermailman 10y ago
    FF you first start by looking at their long guide for version control/build instructions http://mozilla-version-control-tools.readthedocs.io/en/latest/hgmozilla/index.html http://mozilla-version-control-tools.readthedocs.io/en/lates... Then you make a custom mozconfig file to disable or enable features, or to add your own extensions (ie: windows): https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... ac_add_options --disable-activex ac_add_options --disable-activex-scripting ac_add_options --disable-installer ac_add_options --disable-crashreporter You can further abstract this with a mozconfig wrapper https://github.com/ahal/mozconfigwrapper https://github.com/ahal/mozconfigwrapper But I agree, I can't find any documentation what exactly every feature is and why you would not want to disable/enable them. The Chromium build process is much more straight forward, or you could just use 3rd party sandbox and regular release FF.
    - mintplant 10y ago
mhurron 10y ago
So get Firefox back to where it was, just a browser that supported extensions. Everything beyond core browsing should be an extension or plugin. I have no use for WebRTC, so I would not install the addon/plugin. You may want it, so you would. When there was a problem with Mozilla's implementation, I wouldn't have to care, and neither would anyone else who didn't use or want it. Only those that chose to have the functionality would need to be concerned, and even then it could be updated without a full browser update.
- superkuh 10y ago
  If you want that you can use the Pale Moon browser. It's a very fast, non-bloated, fork of Firefox that has significantly diverged from FF. See https://www.palemoon.org/technical.shtml https://www.palemoon.org/technical.shtml for details and in particular why they don't support WebRTC.
  - problems 10y ago
    The catch using something like this - while great from many perspectives is that you risk vulnerabilities just due to it not being as popular and as commonly attacked. So if your threat model includes targeted attacks, where an attacker might invest some (even a small) level of effort to find a 0-day vulnerability, I don't think I'd use it.
    - superkuh 10y ago
      At that point you should basically only be using the hardened tor browser based off (currently) Firefox 38. https://blog.torproject.org/blog/tor-browser-65a6-hardened-released https://blog.torproject.org/blog/tor-browser-65a6-hardened-r...
    - gcp 10y ago
      With Pale Moon the largest risk is that as far as I know the ESR branch they forked away from no longer gets security patches from Mozilla. So you probably don't need to do effort to find a 0-day, just browse old Mozilla CVE disclosures.
ape4 10y ago
This is a good point. Is there just a global variable? allowCameraAccess = false;
- sp332 10y ago
  Yup, there are instructions on this test page: https://browserleaks.com/webrtc#webrtc-disable https://browserleaks.com/webrtc#webrtc-disable
agumonkey 10y ago
Let's patch dillo and make it an HTTP static document reader, and embed lua for everything else.
- agumonkey 10y ago
  Don't downvote or I'll do it out of spite :)
niftich 10y ago
This ship has sailed, because pushing the Web Platform (which every year exposes more and more of this platform functionality in JS) is a vested interest of Google and Mozilla, for different but related-enough reasons to where they rapidly achieve parity. You're going to have to dig up a browser whose authors don't subscribe to this vision, or browsers that may intend to do this down the road but haven't caught up yet. For the time being, out of graphical browsers, Dillo and Netsurf are in this category.
the8472 10y ago
> And I don't mean turned off by default, I want it removed at compile time. Many features can be turned off globally in about:config in a way that will not result in an opt-in prompt and will also reduce the javascript API surface. Is that not good enough?
gcp 10y ago
I feel far more secure doing a video call with Firefox and WebRTC than I do with the alternatives.
Groxx 10y ago
I'd imagine that the closest we have right now would be something like the Tor browser bundle. IIRC some things are outright removed, but many others are just disabled by default.

by pawadu 10y ago

mido22 10y ago

I disagree, I trust WebRTC enough for camera and screen access, the one real issue might be, it exposes your local ip

Noseshine 10y ago
It seems uBlock Origin has a setting (right on the main settings page) that can prevent the local IP to be leaked: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l... You can test it here: https://browserleaks.com/webrtc https://browserleaks.com/webrtc I tried that test page with the mentioned setting 1) enabled and 2) disabled. I did not see my local IP on 1), I did get see it reported with 2) - so it seems the block works. NOTE: Whether uBlock Origin was enabled for the specific page did not matter, the WebRTC block setting seems to be global and independent of whether the extension blocks anything else on the site.

sp332 10y ago

As mido22 said, the alternative right now is a closed plugin (Flash) or installing software on your computer completely outside of the sandbox. Putting these features in the browser in a controllable way is a step forward. If you don't need them, Firefox is open source and I'm not just saying that to be glib. You can easily grab the source https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... and compile it with --disable-webrtc https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

pawadu 10y ago
But I am not familiar enough with the firefox code to do this. I might unknowingly create a whole new set of security issues by changing a few lines in a project of this complexity.
- daveFNbuck 10y ago
  The suggestion is that you compile it with a flag to disable the feature. No need to change any lines of code.
  - roninb 10y ago
    I think their point is that they don't know enough about the innerworkings (read: code) to be sure that turning off one feature doesn't enable far more security vulnerabilities than existed when the feature was on... They aren't suggesting using compile flags requires code changes...
- hackermailman 10y ago
  FF you first start by looking at their long guide for version control/build instructions http://mozilla-version-control-tools.readthedocs.io/en/latest/hgmozilla/index.html http://mozilla-version-control-tools.readthedocs.io/en/lates... Then you make a custom mozconfig file to disable or enable features, or to add your own extensions (ie: windows): https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... ac_add_options --disable-activex ac_add_options --disable-activex-scripting ac_add_options --disable-installer ac_add_options --disable-crashreporter You can further abstract this with a mozconfig wrapper https://github.com/ahal/mozconfigwrapper https://github.com/ahal/mozconfigwrapper But I agree, I can't find any documentation what exactly every feature is and why you would not want to disable/enable them. The Chromium build process is much more straight forward, or you could just use 3rd party sandbox and regular release FF.
  - mintplant 10y ago

mhurron 10y ago

So get Firefox back to where it was, just a browser that supported extensions. Everything beyond core browsing should be an extension or plugin. I have no use for WebRTC, so I would not install the addon/plugin. You may want it, so you would. When there was a problem with Mozilla's implementation, I wouldn't have to care, and neither would anyone else who didn't use or want it. Only those that chose to have the functionality would need to be concerned, and even then it could be updated without a full browser update.

superkuh 10y ago
If you want that you can use the Pale Moon browser. It's a very fast, non-bloated, fork of Firefox that has significantly diverged from FF. See https://www.palemoon.org/technical.shtml https://www.palemoon.org/technical.shtml for details and in particular why they don't support WebRTC.
- problems 10y ago
  The catch using something like this - while great from many perspectives is that you risk vulnerabilities just due to it not being as popular and as commonly attacked. So if your threat model includes targeted attacks, where an attacker might invest some (even a small) level of effort to find a 0-day vulnerability, I don't think I'd use it.
  - superkuh 10y ago
    At that point you should basically only be using the hardened tor browser based off (currently) Firefox 38. https://blog.torproject.org/blog/tor-browser-65a6-hardened-released https://blog.torproject.org/blog/tor-browser-65a6-hardened-r...
  - gcp 10y ago
    With Pale Moon the largest risk is that as far as I know the ESR branch they forked away from no longer gets security patches from Mozilla. So you probably don't need to do effort to find a 0-day, just browse old Mozilla CVE disclosures.

ape4 10y ago

This is a good point. Is there just a global variable? allowCameraAccess = false;

sp332 10y ago
Yup, there are instructions on this test page: https://browserleaks.com/webrtc#webrtc-disable https://browserleaks.com/webrtc#webrtc-disable

agumonkey 10y ago

Let's patch dillo and make it an HTTP static document reader, and embed lua for everything else.

agumonkey 10y ago
Don't downvote or I'll do it out of spite :)

niftich 10y ago

This ship has sailed, because pushing the Web Platform (which every year exposes more and more of this platform functionality in JS) is a vested interest of Google and Mozilla, for different but related-enough reasons to where they rapidly achieve parity. You're going to have to dig up a browser whose authors don't subscribe to this vision, or browsers that may intend to do this down the road but haven't caught up yet. For the time being, out of graphical browsers, Dillo and Netsurf are in this category.

the8472 10y ago

> And I don't mean turned off by default, I want it removed at compile time. Many features can be turned off globally in about:config in a way that will not result in an opt-in prompt and will also reduce the javascript API surface. Is that not good enough?

gcp 10y ago

I feel far more secure doing a video call with Firefox and WebRTC than I do with the alternatives.

Groxx 10y ago

I'd imagine that the closest we have right now would be something like the Tor browser bundle. IIRC some things are outright removed, but many others are just disabled by default.