4 ms·

But I am not familiar enough with the firefox code to do this. I might unknowingly create a whole new set of security issues by changing a few lines in a projec

by pawadu 10y ago

But I am not familiar enough with the firefox code to do this. I might unknowingly create a whole new set of security issues by changing a few lines in a project of this complexity.

daveFNbuck 10y ago
The suggestion is that you compile it with a flag to disable the feature. No need to change any lines of code.
- roninb 10y ago
  I think their point is that they don't know enough about the innerworkings (read: code) to be sure that turning off one feature doesn't enable far more security vulnerabilities than existed when the feature was on... They aren't suggesting using compile flags requires code changes...
hackermailman 10y ago
FF you first start by looking at their long guide for version control/build instructions http://mozilla-version-control-tools.readthedocs.io/en/latest/hgmozilla/index.html http://mozilla-version-control-tools.readthedocs.io/en/lates... Then you make a custom mozconfig file to disable or enable features, or to add your own extensions (ie: windows): https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... ac_add_options --disable-activex ac_add_options --disable-activex-scripting ac_add_options --disable-installer ac_add_options --disable-crashreporter You can further abstract this with a mozconfig wrapper https://github.com/ahal/mozconfigwrapper https://github.com/ahal/mozconfigwrapper But I agree, I can't find any documentation what exactly every feature is and why you would not want to disable/enable them. The Chromium build process is much more straight forward, or you could just use 3rd party sandbox and regular release FF.
- mintplant 10y ago
  Your first link is misleading because it's targeted toward onboarding new Firefox contributors and includes a Mercurial tutorial and development workflow guide in addition to build instructions. Simple build instructions are here: https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Simple_Firefox_build https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... On Linux I clone the source and run "./mach build".
- hackermailman 10y ago
  Forgot to add there's a really good page around by the Chrome security team detailing all kinds of functions somebody might wish to remove such as dns lookups that expose your IP (the tails/torbrowser design document also has this list)
  - putsteadywere 10y ago
    do you have a link?
deleted 10y ago
[deleted]

by pawadu 10y ago

But I am not familiar enough with the firefox code to do this. I might unknowingly create a whole new set of security issues by changing a few lines in a project of this complexity.

daveFNbuck 10y ago

The suggestion is that you compile it with a flag to disable the feature. No need to change any lines of code.

roninb 10y ago
I think their point is that they don't know enough about the innerworkings (read: code) to be sure that turning off one feature doesn't enable far more security vulnerabilities than existed when the feature was on... They aren't suggesting using compile flags requires code changes...

hackermailman 10y ago

FF you first start by looking at their long guide for version control/build instructions http://mozilla-version-control-tools.readthedocs.io/en/latest/hgmozilla/index.html http://mozilla-version-control-tools.readthedocs.io/en/lates... Then you make a custom mozconfig file to disable or enable features, or to add your own extensions (ie: windows): https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... ac_add_options --disable-activex ac_add_options --disable-activex-scripting ac_add_options --disable-installer ac_add_options --disable-crashreporter You can further abstract this with a mozconfig wrapper https://github.com/ahal/mozconfigwrapper https://github.com/ahal/mozconfigwrapper But I agree, I can't find any documentation what exactly every feature is and why you would not want to disable/enable them. The Chromium build process is much more straight forward, or you could just use 3rd party sandbox and regular release FF.

mintplant 10y ago
Your first link is misleading because it's targeted toward onboarding new Firefox contributors and includes a Mercurial tutorial and development workflow guide in addition to build instructions. Simple build instructions are here: https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Simple_Firefox_build https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... On Linux I clone the source and run "./mach build".
hackermailman 10y ago
Forgot to add there's a really good page around by the Chrome security team detailing all kinds of functions somebody might wish to remove such as dns lookups that expose your IP (the tails/torbrowser design document also has this list)
- putsteadywere 10y ago
  do you have a link?

deleted 10y ago

[deleted]