3 ms·

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited to) profitability and ease-of-use, two things you left off your list of what you think Mozilla optimizes for. That blind trust and invalid set of optimization metrics shouldn't be perpetuated. Granted blind trust in this list is unwise too.

singularity2001 8y ago
Mozilla is optimizing for a weighted sum of privacy and revenues from Google (who still account for >90% of Mozillas income). Therefore manually removing all Google partner tracking features in about:config is a very sane choice.
- nextos 8y ago
  I agree. I also try to keep it simple to avoid too much maintenance hassle. Sadly about:config is too imperative, so you need to explicitly undo changes. I wish it was like regular dotfiles. In any case this is in my user.js: user_pref("datareporting.policy.dataSubmissionEnabled", false); user_pref("privacy.trackingprotection.enabled", true); user_pref("media.autoplay.enabled", false); Along with ublocko and httpseverywhere, that covers a lot without breaking mostly anything. A quite famous user.js hardening project is https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js. But I've found that keeping such a complex configuration functional requires a lot of constant effort.
- boomboomsubban 8y ago
  >who still account for >90% of Mozillas income). You say still, but this will be the first time in a few years that will probably be true. The details of the Google deal aren't public, but I doubt it forced them to spend the past few months secretly hiding Google tracking into the browser.
Ar-Curunir 8y ago
This list is dangerous for the average user, because it disables safe browsing. 95% of people are going to suffer more from being phished than from being tracked.
- kodablah 8y ago
  > for the average user Well when you add that condition, sure.
phyzome 8y ago
When I said they'd optimized it "as much as they've felt comfortable doing" I was referring to things like profitability and ease of use as limiting factors. If you understand that changing one of the defaults only affects ease-of-use, and you're a power user, more power to you! If you want to turn off analytics, cool! But it gets trickier when it gets to the safebrowsing feature. The gist says to turn off all of those components, rather than just the ones that send hashed or partial file and address metadata to Google. That's not helping anybody. (To be fair, I'd actually reword my original comment to change "worthless or dangerous" to something milder at this point, but HN won't let me do it. Oh well.)
- kodablah 8y ago
  > you're a power user, more power to you Exactly. > That's not helping anybody. It helps the people that optimize for privacy above their own security in this case. From my understanding of the algorithm, you can't really leverage safe browsing properly without being willing to check the full hash via an internet call at some point. So might as well have it off or on. An extremely paranoid user might not want a safe-browsing download to occur at all, informing Google when their computer is on. These are paranoid stances, but it is a list of settings for that. I use a Chromium-based browser that doesn't use safe browsing lists and I accept the risks.

singularity2001 8y ago

Mozilla is optimizing for a weighted sum of privacy and revenues from Google (who still account for >90% of Mozillas income). Therefore manually removing all Google partner tracking features in about:config is a very sane choice.

nextos 8y ago
I agree. I also try to keep it simple to avoid too much maintenance hassle. Sadly about:config is too imperative, so you need to explicitly undo changes. I wish it was like regular dotfiles. In any case this is in my user.js: user_pref("datareporting.policy.dataSubmissionEnabled", false); user_pref("privacy.trackingprotection.enabled", true); user_pref("media.autoplay.enabled", false); Along with ublocko and httpseverywhere, that covers a lot without breaking mostly anything. A quite famous user.js hardening project is https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js. But I've found that keeping such a complex configuration functional requires a lot of constant effort.
boomboomsubban 8y ago
>who still account for >90% of Mozillas income). You say still, but this will be the first time in a few years that will probably be true. The details of the Google deal aren't public, but I doubt it forced them to spend the past few months secretly hiding Google tracking into the browser.

Ar-Curunir 8y ago

This list is dangerous for the average user, because it disables safe browsing. 95% of people are going to suffer more from being phished than from being tracked.

kodablah 8y ago
> for the average user Well when you add that condition, sure.

phyzome 8y ago

When I said they'd optimized it "as much as they've felt comfortable doing" I was referring to things like profitability and ease of use as limiting factors. If you understand that changing one of the defaults only affects ease-of-use, and you're a power user, more power to you! If you want to turn off analytics, cool! But it gets trickier when it gets to the safebrowsing feature. The gist says to turn off all of those components, rather than just the ones that send hashed or partial file and address metadata to Google. That's not helping anybody. (To be fair, I'd actually reword my original comment to change "worthless or dangerous" to something milder at this point, but HN won't let me do it. Oh well.)

kodablah 8y ago
> you're a power user, more power to you Exactly. > That's not helping anybody. It helps the people that optimize for privacy above their own security in this case. From my understanding of the algorithm, you can't really leverage safe browsing properly without being willing to check the full hash via an internet call at some point. So might as well have it off or on. An extremely paranoid user might not want a safe-browsing download to occur at all, informing Google when their computer is on. These are paranoid stances, but it is a list of settings for that. I use a Chromium-based browser that doesn't use safe browsing lists and I accept the risks.