4 ms·

> ... Mozilla seems to try avoiding supporting such a thing Back when I was trying to manage the configuration of my machines by having a git repository in my

by jolmg 8y ago

> ... Mozilla seems to try avoiding supporting such a thing Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anything other than to annoy people trying to manage its configuration with tools different from their own. I've since found a way to make the profile directory not have a random prefix, but it still requires doing the change through Firefox's GUI profile manager.

tinus_hn 8y ago
The name is random so pages on the web can’t reference files in it using the file:// urls.
- jolmg 8y ago
  If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
  - tinus_hn 8y ago
    It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.
  - xte 8y ago
    Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them. Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.
bzbarsky 8y ago
> Why would it make it random? https://bugzilla.mozilla.org/show_bug.cgi?id=56002 https://bugzilla.mozilla.org/show_bug.cgi?id=56002 has the long discussion about it, but briefly: the profile directory name randomization was introduced to prevent web sites from being able to place data they control in known locations on your hard drive (via the browser cache) and then use that as a stepping-stone in a privilege escalation.

by jolmg 8y ago

tinus_hn 8y ago

The name is random so pages on the web can’t reference files in it using the file:// urls.

jolmg 8y ago
If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
- tinus_hn 8y ago
  It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.
- xte 8y ago
  Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them. Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.

bzbarsky 8y ago

> Why would it make it random? https://bugzilla.mozilla.org/show_bug.cgi?id=56002 https://bugzilla.mozilla.org/show_bug.cgi?id=56002 has the long discussion about it, but briefly: the profile directory name randomization was introduced to prevent web sites from being able to place data they control in known locations on your hard drive (via the browser cache) and then use that as a stepping-stone in a privilege escalation.