5 ms·

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

pcwalton 8y ago
Correct, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.
- hnaccy 8y ago
  There's little drawback to turning off Pocket unless you find the new tab content(and paid advertisements) compelling.
  - jvehent 8y ago
    Actually, I do.
  - kiriakasis 8y ago
    I find it is an amazing service that suggest worthwhile readings, at least a few of the best articles I read in the last month came from pocket
- subsection1h 8y ago
  I've changed dozens of settings in about:config without issue ever since 2004 when about:config started being documented at MozillaZine: http://kb.mozillazine.org/About:config_entries http://kb.mozillazine.org/About:config_entries
- reitanqild 8y ago
  I guess there's a reason they're out of reach for most users - and a reason they're still available for people in crowds like hacker news* readers etc.
deleted 8y ago
[deleted]
hnaccy 8y ago
Mozilla's incentives may not align with yours, e.g., https://github.com/mozilla-services/screenshots/issues/3503 https://github.com/mozilla-services/screenshots/issues/3503.
- kbenson 8y ago
  Am I supposed to intuit from that discussion that they have different incentives and/or goals, or that they haven't found time to get it done? Because even though I think it is somewhat poor wording, I think it's the latter. Also, although I also think the proposed "upload" is poor wording, as many people seeing that will be confused because buttons that say that usually then request what to upload (e.g. "hmm, maybe it's asking for a local image to upload to the cloud for storage?"). You actually are saveing in both cases, in one case to the cloud, inthe other case to the disk. Thus, "Save to cloud" and "Save to disk" (or "Save locally") are much better options in my mind.
  - hnaccy 8y ago
    It's been a year and it's a relatively small UI change to at very least make the local save button the primary colored one. I assume they have some metric for success of the experiment tracking daily uploads to FF screenshots and they're unwilling to sacrifice that.
    - Vinnl 8y ago
      > It's been a year and it's a relatively small UI change to at very least make the local save button the primary colored one. That doesn't really make a lot of sense though - the experiment was specifically launched with the goal of trying to solve the problem of sharing screenshots with others; a problem they identified as common through user research. So while I think there's a lot to say for changing the wording, the primary action will always be sharing it.
saiya-jin 8y ago
Yeah right, because me being forbidden to right click on the site is really in my best interest. I might, you know, inspect DOM and block annoying permanent menus or ads that ublock origin doesn't filter out. And being able to do copy&paste of the content should send me straight to prison.
- DangerousPie 8y ago
  Well, that is a good example actually. Of course you don't want to lose the ability to right-click, but there are also various web apps that override the right-click menu for legitimate reasons. Two examples that come to mind are Jupyter Lab and Outlook 365, both of which use a custom context menu. Disabling the context menu setting presumably breaks this functionality.
  - andreareina 8y ago
    My idiot bank disables right-clicking, and I'd be all over the option to disable right-click hijacking, but yup I also use a web app that overloads right-clicks in a sane and appropriate manner.
  - dingaling 8y ago
    It isn't actually disabled in that instance; just right-click twice and the Firefox context-menu will disappear and present the web page's menu.
- sammoth 8y ago
  You can hold shift while right clicking to get the normal menu anywhere that it is disabled/replaced
kodablah 8y ago
Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited to) profitability and ease-of-use, two things you left off your list of what you think Mozilla optimizes for. That blind trust and invalid set of optimization metrics shouldn't be perpetuated. Granted blind trust in this list is unwise too.
- singularity2001 8y ago
  Mozilla is optimizing for a weighted sum of privacy and revenues from Google (who still account for >90% of Mozillas income). Therefore manually removing all Google partner tracking features in about:config is a very sane choice.
  - nextos 8y ago
    I agree. I also try to keep it simple to avoid too much maintenance hassle. Sadly about:config is too imperative, so you need to explicitly undo changes. I wish it was like regular dotfiles. In any case this is in my user.js: user_pref("datareporting.policy.dataSubmissionEnabled", false); user_pref("privacy.trackingprotection.enabled", true); user_pref("media.autoplay.enabled", false); Along with ublocko and httpseverywhere, that covers a lot without breaking mostly anything. A quite famous user.js hardening project is https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js. But I've found that keeping such a complex configuration functional requires a lot of constant effort.
  - boomboomsubban 8y ago
    >who still account for >90% of Mozillas income). You say still, but this will be the first time in a few years that will probably be true. The details of the Google deal aren't public, but I doubt it forced them to spend the past few months secretly hiding Google tracking into the browser.
- 8y ago
krn 8y ago
What Mozilla did in the default Firefox configuration, is made the trade-offs on behalf of an average browser user. It's neither worthless, nor dangerous for a savvy browser user to make the trade-offs for himself. That's exactly what software configurations are for.
- Someone1234 8y ago
  That might be a good argument if the link was to an article with a large amount of discussion about the pros and cons of each configuration change, instead of just a list of changes with a brief overview of what they do.
  - krn 8y ago
    As the one who posted this link here, I found the list to be a great starting point for my research. Instead of switching to something like Waterfox or Brave, I can now remain with a major web browser by just enabling the features I need.
ECrownofFire 8y ago
Good example of this: the referer header is the only way to verify the source of a request to prevent CSRF unless it the request uses the POST method or it's a CORS request. Firefox doesn't currently send the Origin header unless it's one of those two, meaning disabling the referer header will break any PUT, DELETE, etc requests on any website that has reasonable CSRF protection (which is basically essential for all non-static sites).
dsr_ 8y ago
Chesterton's Fence is about a technology somewhere between thousands and tens of thousands years old. Fences are extremely well understood. All of software has been around less than a century; the concept of personal computers running software that an end-user might adjust settings on is about sixty years old; thinking about Internet security is roughly thirty years old; the modern web ecosystem is no older than JavaScript, 22 years old. You're still right that blindly changing settings is not a great idea, but the Chesterton's Fence analogy is misplaced.

pcwalton 8y ago

Correct, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.

hnaccy 8y ago
There's little drawback to turning off Pocket unless you find the new tab content(and paid advertisements) compelling.
- jvehent 8y ago
  Actually, I do.
- kiriakasis 8y ago
  I find it is an amazing service that suggest worthwhile readings, at least a few of the best articles I read in the last month came from pocket
subsection1h 8y ago
I've changed dozens of settings in about:config without issue ever since 2004 when about:config started being documented at MozillaZine: http://kb.mozillazine.org/About:config_entries http://kb.mozillazine.org/About:config_entries
reitanqild 8y ago
I guess there's a reason they're out of reach for most users - and a reason they're still available for people in crowds like hacker news* readers etc.

deleted 8y ago

[deleted]

hnaccy 8y ago

Mozilla's incentives may not align with yours, e.g., https://github.com/mozilla-services/screenshots/issues/3503 https://github.com/mozilla-services/screenshots/issues/3503.

kbenson 8y ago
Am I supposed to intuit from that discussion that they have different incentives and/or goals, or that they haven't found time to get it done? Because even though I think it is somewhat poor wording, I think it's the latter. Also, although I also think the proposed "upload" is poor wording, as many people seeing that will be confused because buttons that say that usually then request what to upload (e.g. "hmm, maybe it's asking for a local image to upload to the cloud for storage?"). You actually are saveing in both cases, in one case to the cloud, inthe other case to the disk. Thus, "Save to cloud" and "Save to disk" (or "Save locally") are much better options in my mind.
- hnaccy 8y ago
  It's been a year and it's a relatively small UI change to at very least make the local save button the primary colored one. I assume they have some metric for success of the experiment tracking daily uploads to FF screenshots and they're unwilling to sacrifice that.
  - Vinnl 8y ago
    > It's been a year and it's a relatively small UI change to at very least make the local save button the primary colored one. That doesn't really make a lot of sense though - the experiment was specifically launched with the goal of trying to solve the problem of sharing screenshots with others; a problem they identified as common through user research. So while I think there's a lot to say for changing the wording, the primary action will always be sharing it.

saiya-jin 8y ago

Yeah right, because me being forbidden to right click on the site is really in my best interest. I might, you know, inspect DOM and block annoying permanent menus or ads that ublock origin doesn't filter out. And being able to do copy&paste of the content should send me straight to prison.

DangerousPie 8y ago
Well, that is a good example actually. Of course you don't want to lose the ability to right-click, but there are also various web apps that override the right-click menu for legitimate reasons. Two examples that come to mind are Jupyter Lab and Outlook 365, both of which use a custom context menu. Disabling the context menu setting presumably breaks this functionality.
- andreareina 8y ago
  My idiot bank disables right-clicking, and I'd be all over the option to disable right-click hijacking, but yup I also use a web app that overloads right-clicks in a sane and appropriate manner.
- dingaling 8y ago
  It isn't actually disabled in that instance; just right-click twice and the Firefox context-menu will disappear and present the web page's menu.
sammoth 8y ago
You can hold shift while right clicking to get the normal menu anywhere that it is disabled/replaced

kodablah 8y ago

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited to) profitability and ease-of-use, two things you left off your list of what you think Mozilla optimizes for. That blind trust and invalid set of optimization metrics shouldn't be perpetuated. Granted blind trust in this list is unwise too.

singularity2001 8y ago
Mozilla is optimizing for a weighted sum of privacy and revenues from Google (who still account for >90% of Mozillas income). Therefore manually removing all Google partner tracking features in about:config is a very sane choice.
- nextos 8y ago
  I agree. I also try to keep it simple to avoid too much maintenance hassle. Sadly about:config is too imperative, so you need to explicitly undo changes. I wish it was like regular dotfiles. In any case this is in my user.js: user_pref("datareporting.policy.dataSubmissionEnabled", false); user_pref("privacy.trackingprotection.enabled", true); user_pref("media.autoplay.enabled", false); Along with ublocko and httpseverywhere, that covers a lot without breaking mostly anything. A quite famous user.js hardening project is https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js. But I've found that keeping such a complex configuration functional requires a lot of constant effort.
- boomboomsubban 8y ago
  >who still account for >90% of Mozillas income). You say still, but this will be the first time in a few years that will probably be true. The details of the Google deal aren't public, but I doubt it forced them to spend the past few months secretly hiding Google tracking into the browser.
8y ago

krn 8y ago

What Mozilla did in the default Firefox configuration, is made the trade-offs on behalf of an average browser user. It's neither worthless, nor dangerous for a savvy browser user to make the trade-offs for himself. That's exactly what software configurations are for.

Someone1234 8y ago
That might be a good argument if the link was to an article with a large amount of discussion about the pros and cons of each configuration change, instead of just a list of changes with a brief overview of what they do.
- krn 8y ago
  As the one who posted this link here, I found the list to be a great starting point for my research. Instead of switching to something like Waterfox or Brave, I can now remain with a major web browser by just enabling the features I need.

ECrownofFire 8y ago

Good example of this: the referer header is the only way to verify the source of a request to prevent CSRF unless it the request uses the POST method or it's a CORS request. Firefox doesn't currently send the Origin header unless it's one of those two, meaning disabling the referer header will break any PUT, DELETE, etc requests on any website that has reasonable CSRF protection (which is basically essential for all non-static sites).

dsr_ 8y ago

Chesterton's Fence is about a technology somewhere between thousands and tens of thousands years old. Fences are extremely well understood. All of software has been around less than a century; the concept of personal computers running software that an end-user might adjust settings on is about sixty years old; thinking about Internet security is roughly thirty years old; the modern web ecosystem is no older than JavaScript, 22 years old. You're still right that blindly changing settings is not a great idea, but the Chesterton's Fence analogy is misplaced.