5 ms·

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any comple

by xte 8y ago

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same for GuixSD, same for services etc in nearly all unices. On FF however I found no damn simple way to do basic things like: - install extensions via CLI/wrappers (for instance homeManager), there are some hack but they are not reliable and Mozilla seems to try avoiding supporting such a thing; - configure preferences, like about:config, outside firefox; - customize ff themes in a simple manner. Modern browsers seems to mimic the most closed commercial OSes I know of instead of mimic classic FOSS model and that's a big problem. Today I can easily automate my entire desktop, but browsers and they demand more and more settings and third parties tools/extensions to be "at least less unsafe" for us users (from firejail/capsicum to cookies deleters, adblockers etc. That's a horrific mess.

adminu 8y ago
That is not entirely true, there is a prefs.js in my Profile folder that contains the changes done to my about:config page, if I interpret it correctly.
- xte 8y ago
  True but certainly not friendly to edit with a big // DO NOT EDIT THIS FILE. and an optional user.js separate preference I do not know how reliable...
  - bzbarsky 8y ago
    user.js is the supported and reliable way to set preferences that should just be set no matter what the default configuration is or what about:config says. prefs.js is the storage for the current non-default pref values. At runtime, default pref values are loaded, then prefs.js, then user.js. You _can_ edit prefs.js and the effect will be the same as if you changed the pref in about:config, as long as you do it while Firefox is not running against that profile. If you do it while Firefox is running, your changes will be overwritten at shutdown when Firefox writes out then-current in-memory pref values.
mrmr1993 8y ago
This seems to be by design: when these things are available, spyware -- especially on Windows -- will be quick to make malicious changes in all these if they can. It's a pain, but I can see the compromise. If it makes the average Firefox user more vulnerable, there's definitely a case to protect them, even at the expense of its more capable users.
- rhizome 8y ago
  if spyware has permissions to change ".firefox-prefs" doesn't it have permission to change about:config items, too?
  - mrmr1993 8y ago
    Yes, this leads Firefox to be fairly conservative with its permissions. In general, blocking userspace from installing extensions and otherwise running malicious code stops FF from being exploited. Blocking all of these options blocks the OS from bad behaviour, especially where the user may expect a new computer/phone to have the default behaviour. The vendors of phones and personal computers seem to have an interest in interfering with users' internet access; perhaps it is a good decision that Firefox does not let them.
    - xte 8y ago
      Actually homeManager can manage Firefox, installing extensions etc... Only it's a hack-ish and not much reliable way. So no, actual Mozilla strategy does NOT work to stop malware's on Windows nor commercial OEMs customization, as a matter of fact made only life of pro users and admin harder and open the door for less safe setup (for instance extensions added via homeManager may not get updated by FF).
      - mrmr1993 8y ago
        We would and should expect that it is be possible: unless Firefox signs configuration changes per-user, server-side (violating their privacy intentions), the whole configuration code is open source, and can easily be easily used or reverse engineered to make an external editor. This doesn't change that a sanctioned API invites abuse far more readily than reverse-engineering, especially when spyware is less frequently updated than Firefox itself. That there isn't a sanctioned API, and that the de facto API can and does change every version, is an advantage for Firefox against potential attackers. If this is something you are sorely lacking, Firefox has also been straightforward to modify and compile, in my experience. You can always share a patch and enjoy these features as part of a smaller community, without compromising the userbase as a whole.
jolmg 8y ago
> ... Mozilla seems to try avoiding supporting such a thing Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anything other than to annoy people trying to manage its configuration with tools different from their own. I've since found a way to make the profile directory not have a random prefix, but it still requires doing the change through Firefox's GUI profile manager.
- tinus_hn 8y ago
  The name is random so pages on the web can’t reference files in it using the file:// urls.
  - jolmg 8y ago
    If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
    - tinus_hn 8y ago
      It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.
    - xte 8y ago
      Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them. Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.
- bzbarsky 8y ago
tahnmozbus 8y ago
I'd also like to point out how many times "this might void your warranty" appears on the following page. https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... which is a perfectly reasonable and legitimate user request that, the browser not talk to the internet before the user agrees it may.
- StillBored 8y ago
  Which is crazy for a browser that claims to be "privacy focused" that those settings aren't all in the "privacy tab" with the _two_ that are...
ksala 8y ago
about:config preferences can be customized using the user.js files. See https://github.com/pyllyukko/user.js/#installation https://github.com/pyllyukko/user.js/#installation for some examples. For addons and other options you can use policies.json file, see https://github.com/mozilla/policy-templates/blob/master/README.md https://github.com/mozilla/policy-templates/blob/master/READ...

by xte 8y ago

adminu 8y ago

That is not entirely true, there is a prefs.js in my Profile folder that contains the changes done to my about:config page, if I interpret it correctly.

xte 8y ago
True but certainly not friendly to edit with a big // DO NOT EDIT THIS FILE. and an optional user.js separate preference I do not know how reliable...
- bzbarsky 8y ago
  user.js is the supported and reliable way to set preferences that should just be set no matter what the default configuration is or what about:config says. prefs.js is the storage for the current non-default pref values. At runtime, default pref values are loaded, then prefs.js, then user.js. You _can_ edit prefs.js and the effect will be the same as if you changed the pref in about:config, as long as you do it while Firefox is not running against that profile. If you do it while Firefox is running, your changes will be overwritten at shutdown when Firefox writes out then-current in-memory pref values.

mrmr1993 8y ago

This seems to be by design: when these things are available, spyware -- especially on Windows -- will be quick to make malicious changes in all these if they can. It's a pain, but I can see the compromise. If it makes the average Firefox user more vulnerable, there's definitely a case to protect them, even at the expense of its more capable users.

rhizome 8y ago
if spyware has permissions to change ".firefox-prefs" doesn't it have permission to change about:config items, too?
- mrmr1993 8y ago
  Yes, this leads Firefox to be fairly conservative with its permissions. In general, blocking userspace from installing extensions and otherwise running malicious code stops FF from being exploited. Blocking all of these options blocks the OS from bad behaviour, especially where the user may expect a new computer/phone to have the default behaviour. The vendors of phones and personal computers seem to have an interest in interfering with users' internet access; perhaps it is a good decision that Firefox does not let them.
  - xte 8y ago
    Actually homeManager can manage Firefox, installing extensions etc... Only it's a hack-ish and not much reliable way. So no, actual Mozilla strategy does NOT work to stop malware's on Windows nor commercial OEMs customization, as a matter of fact made only life of pro users and admin harder and open the door for less safe setup (for instance extensions added via homeManager may not get updated by FF).
    - mrmr1993 8y ago
      We would and should expect that it is be possible: unless Firefox signs configuration changes per-user, server-side (violating their privacy intentions), the whole configuration code is open source, and can easily be easily used or reverse engineered to make an external editor. This doesn't change that a sanctioned API invites abuse far more readily than reverse-engineering, especially when spyware is less frequently updated than Firefox itself. That there isn't a sanctioned API, and that the de facto API can and does change every version, is an advantage for Firefox against potential attackers. If this is something you are sorely lacking, Firefox has also been straightforward to modify and compile, in my experience. You can always share a patch and enjoy these features as part of a smaller community, without compromising the userbase as a whole.

jolmg 8y ago

> ... Mozilla seems to try avoiding supporting such a thing Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anything other than to annoy people trying to manage its configuration with tools different from their own. I've since found a way to make the profile directory not have a random prefix, but it still requires doing the change through Firefox's GUI profile manager.

tinus_hn 8y ago
The name is random so pages on the web can’t reference files in it using the file:// urls.
- jolmg 8y ago
  If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
  - tinus_hn 8y ago
    It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.
  - xte 8y ago
    Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them. Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.
bzbarsky 8y ago

tahnmozbus 8y ago

I'd also like to point out how many times "this might void your warranty" appears on the following page. https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... which is a perfectly reasonable and legitimate user request that, the browser not talk to the internet before the user agrees it may.

StillBored 8y ago
Which is crazy for a browser that claims to be "privacy focused" that those settings aren't all in the "privacy tab" with the _two_ that are...

ksala 8y ago

about:config preferences can be customized using the user.js files. See https://github.com/pyllyukko/user.js/#installation https://github.com/pyllyukko/user.js/#installation for some examples. For addons and other options you can use policies.json file, see https://github.com/mozilla/policy-templates/blob/master/README.md https://github.com/mozilla/policy-templates/blob/master/READ...