7 ms·

I feel the strong need to point out some of these settings will break Firefox in subtle and hard to understand ways. There’s a reason you “void the warranty” wh

I feel the strong need to point out some of these settings will break Firefox in subtle and hard to understand ways. There’s a reason you “void the warranty” when tweaking the about:config preferences. No rule against it, but just watch out. (Mozilla employee)

unethical_ban 8y ago
I won't ask for a complete audit, but is there one example from the wizard that could break stuff, that is NOT called out by the wizard itself?
- gruez 8y ago
  That might be true for a technical user, but is the average user going to know that discord is broken because they disabled webrtc? Also, resistfingerprinting is going to significantly increase the difficulty of recaptcha challenges you encounter.
  - cpeterso 8y ago
    ResistFingerprinting is currently known to break Google's Recaptcha v3. Here is the Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1503872 https://bugzilla.mozilla.org/show_bug.cgi?id=1503872
    - jammygit 8y ago
      I wonder just how much security relies on tracking. I know my VPN makes captchas an absolute nightmare.
    - lambda 8y ago
      I always have a hard time using some services when in incognito mode; I get the captchas, and either they are wrong or are really hard, and it can take several tries to get through them.
  - gsich 8y ago
    Because an error message should be displayed then.
- buzzy_hacker 8y ago
  I used to run Firefox with resist fingerprinting enabled. I believe it was causing chat time stamps on websites like WhatsApp to be incorrect, which was annoying but I don’t know if you consider that broken.
  - amaccuish 8y ago
    Yes I discovered that when viewing the TV guide on plex. Everything was an hour out (UK). I think with resist fingerprinting the timezone is set to UTC0. In the end I had to turn that setting off.
    - currysausage 8y ago
      Ironically, checking for UTC+0 JavaScript time from an obviously-not-UTC+0 IP geolocation might give additional hints for fingerprinting, as does everything else that looks non-default, like odd language preferences or even a DNT header.
      - garrettr_ 8y ago
        Good point. I'm pretty sure this component of resistFingerprinting is derived from Project Fusion, which uplifts privacy/anonymity-related changes from Tor Browser into Firefox. In the Tor Browser threat model, the idea is that you can't avoid looking like a Tor user, so the goal is to make all Tor users indistinguishable from each other. Flipping this pref as a regular Firefox user is incompatible with its primary intent/threat model, so it fails to deliver and may even make you _more_ identifiable in some circumstances. This is a great example of why I'm generally skeptical of these scattershot approaches to making users more secure by changing default settings in mainstream browsers. Security and privacy features always entail tradeoffs and should be designed and implemented holistically for best results.
        moosingin3space 8y ago
        > should be designed and implemented holistically for best results This is why I, a privacy-conscious individual, don't follow any of these guides in my Firefox. If you follow the discussion on Bugzilla, the weekly team meeting notes, and occasionally ask respectful questions on Mozilla IRC, you come to a similar conclusion to me in that the Firefox development community is doing the right thing in not enabling this by default.
throwaway2048 8y ago
Maybe Mozilla should remove about:config, so users can't hurt themselves on it. I'm sure the telemetry shows its rarely used, and when it is, it often breaks the browser in ways that are unfixable for the average user. Malware is also able to modify these advanced settings to hijack the browser in nasty ways, and slow down Firefox, and make people switch to Chrome faster. If they don't remove it Firefox is going to continue its user count slide into irrelevance. (This is in fact sarcasm before you get too eager with that down arrow)
- 0xffff2 8y ago
  >(This is in fact sarcasm before you get too eager with that down arrow) I see this defense quite a lot on the internet, and I think it's misplaced. Even without your comment, I would have downvoted you, not because I though you were in earnest, but because your sarcastic comment doesn't add anything to the conversation.
  - CaptSpify 8y ago
    I think it adds a lot to the conversation. It's an obviously poor argument, which points out how poor it is when Mozilla uses it to make obviously poor choices.
  - huhtenberg 8y ago
    Technically, your comment doesn't add much to the conversation either.
    - albertgoeswoof 8y ago
      If you believe that your comment adds value, then so must the parent comment. If that’s true then your comment is false and adds no value. Quite paradoxical.
    - 0xffff2 8y ago
      I agree that my comment is of extremely limited value. Usually I just down vote and move on for that very reason. Today I chose to explain why instead. The difference is that I believe that my comment has a very small positive value, while I believe that the comment I responded to has a small to moderate negative value.
Spooky23 8y ago
Does Mozilla have a sanctioned way to pre-configure a browser with standard configurations? This used to be impossible, and essentially made my employer banish Firefox in most cases.
- shawnz 8y ago
  You could use group policy. https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy https://support.mozilla.org/en-US/kb/customizing-firefox-usi...
- forapurpose 8y ago
  Look up Mike Kaply's blog; he covers it extensively and, AFAIK, knows the topic as well as anyone.
xte 8y ago
As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same for GuixSD, same for services etc in nearly all unices. On FF however I found no damn simple way to do basic things like: - install extensions via CLI/wrappers (for instance homeManager), there are some hack but they are not reliable and Mozilla seems to try avoiding supporting such a thing; - configure preferences, like about:config, outside firefox; - customize ff themes in a simple manner. Modern browsers seems to mimic the most closed commercial OSes I know of instead of mimic classic FOSS model and that's a big problem. Today I can easily automate my entire desktop, but browsers and they demand more and more settings and third parties tools/extensions to be "at least less unsafe" for us users (from firejail/capsicum to cookies deleters, adblockers etc. That's a horrific mess.
- adminu 8y ago
  That is not entirely true, there is a prefs.js in my Profile folder that contains the changes done to my about:config page, if I interpret it correctly.
  - xte 8y ago
    True but certainly not friendly to edit with a big // DO NOT EDIT THIS FILE. and an optional user.js separate preference I do not know how reliable...
    - bzbarsky 8y ago
      user.js is the supported and reliable way to set preferences that should just be set no matter what the default configuration is or what about:config says. prefs.js is the storage for the current non-default pref values. At runtime, default pref values are loaded, then prefs.js, then user.js. You _can_ edit prefs.js and the effect will be the same as if you changed the pref in about:config, as long as you do it while Firefox is not running against that profile. If you do it while Firefox is running, your changes will be overwritten at shutdown when Firefox writes out then-current in-memory pref values.
rikkus 8y ago
Yep I took the defaults here then installed 1PasswordX and couldn’t open its settings. That’s a vital extension for me.
tahnmozbus 8y ago
I feel a strong need to point out the bad faith Mozilla seem to have for Firefox users and their privacy, eg Pocket, Mr Robot, DRM & binary blobs, dark pattern configs, etc. As much as I loved the browser in the past, nobody should consider running it today, without being informed of the implications. The ffprofile.com site is something I have been waiting for, but stuff like this should not be necessary and IMO Mozilla Corp. has won. Nobody celebrates a new version of FF anymore. Also useful resources: https://github.com/amq/firefox-debloat https://github.com/amq/firefox-debloat https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... https://spyware.neocities.org/articles/firefox.html https://spyware.neocities.org/articles/firefox.html https://browserleaks.com/ https://browserleaks.com/ https://www.howsmyssl.com/ https://www.howsmyssl.com/

unethical_ban 8y ago

I won't ask for a complete audit, but is there one example from the wizard that could break stuff, that is NOT called out by the wizard itself?

gruez 8y ago
That might be true for a technical user, but is the average user going to know that discord is broken because they disabled webrtc? Also, resistfingerprinting is going to significantly increase the difficulty of recaptcha challenges you encounter.
- cpeterso 8y ago
  ResistFingerprinting is currently known to break Google's Recaptcha v3. Here is the Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1503872 https://bugzilla.mozilla.org/show_bug.cgi?id=1503872
  - jammygit 8y ago
    I wonder just how much security relies on tracking. I know my VPN makes captchas an absolute nightmare.
  - lambda 8y ago
    I always have a hard time using some services when in incognito mode; I get the captchas, and either they are wrong or are really hard, and it can take several tries to get through them.
- gsich 8y ago
  Because an error message should be displayed then.
buzzy_hacker 8y ago
I used to run Firefox with resist fingerprinting enabled. I believe it was causing chat time stamps on websites like WhatsApp to be incorrect, which was annoying but I don’t know if you consider that broken.
- amaccuish 8y ago
  Yes I discovered that when viewing the TV guide on plex. Everything was an hour out (UK). I think with resist fingerprinting the timezone is set to UTC0. In the end I had to turn that setting off.
  - currysausage 8y ago
    Ironically, checking for UTC+0 JavaScript time from an obviously-not-UTC+0 IP geolocation might give additional hints for fingerprinting, as does everything else that looks non-default, like odd language preferences or even a DNT header.
    - garrettr_ 8y ago
      Good point. I'm pretty sure this component of resistFingerprinting is derived from Project Fusion, which uplifts privacy/anonymity-related changes from Tor Browser into Firefox. In the Tor Browser threat model, the idea is that you can't avoid looking like a Tor user, so the goal is to make all Tor users indistinguishable from each other. Flipping this pref as a regular Firefox user is incompatible with its primary intent/threat model, so it fails to deliver and may even make you _more_ identifiable in some circumstances. This is a great example of why I'm generally skeptical of these scattershot approaches to making users more secure by changing default settings in mainstream browsers. Security and privacy features always entail tradeoffs and should be designed and implemented holistically for best results.
      - moosingin3space 8y ago
        > should be designed and implemented holistically for best results This is why I, a privacy-conscious individual, don't follow any of these guides in my Firefox. If you follow the discussion on Bugzilla, the weekly team meeting notes, and occasionally ask respectful questions on Mozilla IRC, you come to a similar conclusion to me in that the Firefox development community is doing the right thing in not enabling this by default.

throwaway2048 8y ago

Maybe Mozilla should remove about:config, so users can't hurt themselves on it. I'm sure the telemetry shows its rarely used, and when it is, it often breaks the browser in ways that are unfixable for the average user. Malware is also able to modify these advanced settings to hijack the browser in nasty ways, and slow down Firefox, and make people switch to Chrome faster. If they don't remove it Firefox is going to continue its user count slide into irrelevance. (This is in fact sarcasm before you get too eager with that down arrow)

0xffff2 8y ago
>(This is in fact sarcasm before you get too eager with that down arrow) I see this defense quite a lot on the internet, and I think it's misplaced. Even without your comment, I would have downvoted you, not because I though you were in earnest, but because your sarcastic comment doesn't add anything to the conversation.
- CaptSpify 8y ago
  I think it adds a lot to the conversation. It's an obviously poor argument, which points out how poor it is when Mozilla uses it to make obviously poor choices.
- huhtenberg 8y ago
  Technically, your comment doesn't add much to the conversation either.
  - albertgoeswoof 8y ago
    If you believe that your comment adds value, then so must the parent comment. If that’s true then your comment is false and adds no value. Quite paradoxical.
  - 0xffff2 8y ago
    I agree that my comment is of extremely limited value. Usually I just down vote and move on for that very reason. Today I chose to explain why instead. The difference is that I believe that my comment has a very small positive value, while I believe that the comment I responded to has a small to moderate negative value.

Spooky23 8y ago

Does Mozilla have a sanctioned way to pre-configure a browser with standard configurations? This used to be impossible, and essentially made my employer banish Firefox in most cases.

shawnz 8y ago
You could use group policy. https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy https://support.mozilla.org/en-US/kb/customizing-firefox-usi...
forapurpose 8y ago
Look up Mike Kaply's blog; he covers it extensively and, AFAIK, knows the topic as well as anyone.

xte 8y ago

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same for GuixSD, same for services etc in nearly all unices. On FF however I found no damn simple way to do basic things like: - install extensions via CLI/wrappers (for instance homeManager), there are some hack but they are not reliable and Mozilla seems to try avoiding supporting such a thing; - configure preferences, like about:config, outside firefox; - customize ff themes in a simple manner. Modern browsers seems to mimic the most closed commercial OSes I know of instead of mimic classic FOSS model and that's a big problem. Today I can easily automate my entire desktop, but browsers and they demand more and more settings and third parties tools/extensions to be "at least less unsafe" for us users (from firejail/capsicum to cookies deleters, adblockers etc. That's a horrific mess.

adminu 8y ago
That is not entirely true, there is a prefs.js in my Profile folder that contains the changes done to my about:config page, if I interpret it correctly.
- xte 8y ago
  True but certainly not friendly to edit with a big // DO NOT EDIT THIS FILE. and an optional user.js separate preference I do not know how reliable...
  - bzbarsky 8y ago
    user.js is the supported and reliable way to set preferences that should just be set no matter what the default configuration is or what about:config says. prefs.js is the storage for the current non-default pref values. At runtime, default pref values are loaded, then prefs.js, then user.js. You _can_ edit prefs.js and the effect will be the same as if you changed the pref in about:config, as long as you do it while Firefox is not running against that profile. If you do it while Firefox is running, your changes will be overwritten at shutdown when Firefox writes out then-current in-memory pref values.

rikkus 8y ago

Yep I took the defaults here then installed 1PasswordX and couldn’t open its settings. That’s a vital extension for me.

tahnmozbus 8y ago

I feel a strong need to point out the bad faith Mozilla seem to have for Firefox users and their privacy, eg Pocket, Mr Robot, DRM & binary blobs, dark pattern configs, etc. As much as I loved the browser in the past, nobody should consider running it today, without being informed of the implications. The ffprofile.com site is something I have been waiting for, but stuff like this should not be necessary and IMO Mozilla Corp. has won. Nobody celebrates a new version of FF anymore. Also useful resources: https://github.com/amq/firefox-debloat https://github.com/amq/firefox-debloat https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... https://spyware.neocities.org/articles/firefox.html https://spyware.neocities.org/articles/firefox.html https://browserleaks.com/ https://browserleaks.com/ https://www.howsmyssl.com/ https://www.howsmyssl.com/