4 ms·

Why did the schools remove Firefox rather than enforcing no-DoH in the Firefox config files (not about:config)?

est31 8y ago
Of course you can lock stuff via enterprise settings so that about:config entries can't be modified by local users, but that takes time to find out and test, while removing the weird non-Chrome browser that's still present mostly for inertia reasons but nowadays only gets used for evil porn is much easier.
- close04 8y ago
  Saving time by applying a non-solution 9like removing one browser instead of treating the root cause) is not actually saving anything. You just kick the problem further down the road. Firefox prefs are documented even if not in the most user friendly way [0][1][2][3]. For the most part performing some basic hardening and other useful config on the browser takes less than a day. A person with some IT background shouldn't have too much problems doing it and it's more or less a one time thing. [0] https://dxr.mozilla.org/mozilla-release/source/modules/libpref/init/all.js https://dxr.mozilla.org/mozilla-release/source/modules/libpr... [1] https://dxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js https://dxr.mozilla.org/mozilla-release/source/browser/app/p... [2] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Enterprise_deployment_before_60 https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Ent... [3] https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise https://support.mozilla.org/en-US/products/firefox-enterpris...
  - simondedalus 8y ago
    no, using the nuclear option of removing the browser outright when others work is the smart, efficient option that someone who actually works in IT with limited resources would (and should) use. this stuff about finding all the right config files during "basic hardening" and having it just work is the stuff of armchair commenters and people who do IT/security on a well funded, sufficiently redundant team. assuming the latter would be the people in charge of school IT is hopelessly naive.
    - isostatic 8y ago
      Yes, we should stick with IE6 on all machines, no need for any other browsers
      - simondedalus 8y ago
        firefox messes up their DNS filtering, chrome doesn't. so they remove firefox and enforce chrome. if you see that as a slippery slope, you're imagining it. they probably 1) have a decent app like ninite to remove and install apps, 2) don't have anything but their production environment, 3) don't have a homogenous environment in terms of patching (maybe they do), 4) don't have people to go around and make sure the config changes they push (however they would push them) took, worked, etc. so they block the app. maybe eventually they reinstall it. welcome to IT. ...which reinforces my point about how people actually doing this and people speculating about it tend to respond to issues like this.
        close04 8y ago
        > firefox messes up their DNS filtering, chrome doesn't I take it you assume students are not creative enough to get the exact same result with Chrome? Because it is perfectly possible to do it. Unless of course you take steps to prevent that in Chrome. One way or another you either put in the work or the users will end up doing whatever they please. After configuring the OS doing the same for the browser is a relatively small step.
        simondedalus 8y ago
        of course it's possible to do so. but DNS filtering works for most users, and is much easier to centrally manage on a budget (in terms of time / people / money) than browser settings. i'm belaboring this point now, but people who actually do this stuff know that you can't just throw up a GPO to fiddle with chrome settings and expect everything to work. this culture of "power users" thinking they know the best course of action for every situation in IT (and it's always "that thing i Put In The Work to do when i was tailoring my own system") is really silly.

Of course you can lock stuff via enterprise settings so that about:config entries can't be modified by local users, but that takes time to find out and test, while removing the weird non-Chrome browser that's still present mostly for inertia reasons but nowadays only gets used for evil porn is much easier.

close04 8y ago
Saving time by applying a non-solution 9like removing one browser instead of treating the root cause) is not actually saving anything. You just kick the problem further down the road. Firefox prefs are documented even if not in the most user friendly way [0][1][2][3]. For the most part performing some basic hardening and other useful config on the browser takes less than a day. A person with some IT background shouldn't have too much problems doing it and it's more or less a one time thing. [0] https://dxr.mozilla.org/mozilla-release/source/modules/libpref/init/all.js https://dxr.mozilla.org/mozilla-release/source/modules/libpr... [1] https://dxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js https://dxr.mozilla.org/mozilla-release/source/browser/app/p... [2] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Enterprise_deployment_before_60 https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Ent... [3] https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise https://support.mozilla.org/en-US/products/firefox-enterpris...
- simondedalus 8y ago
  no, using the nuclear option of removing the browser outright when others work is the smart, efficient option that someone who actually works in IT with limited resources would (and should) use. this stuff about finding all the right config files during "basic hardening" and having it just work is the stuff of armchair commenters and people who do IT/security on a well funded, sufficiently redundant team. assuming the latter would be the people in charge of school IT is hopelessly naive.
  - isostatic 8y ago
    Yes, we should stick with IE6 on all machines, no need for any other browsers
    - simondedalus 8y ago
      firefox messes up their DNS filtering, chrome doesn't. so they remove firefox and enforce chrome. if you see that as a slippery slope, you're imagining it. they probably 1) have a decent app like ninite to remove and install apps, 2) don't have anything but their production environment, 3) don't have a homogenous environment in terms of patching (maybe they do), 4) don't have people to go around and make sure the config changes they push (however they would push them) took, worked, etc. so they block the app. maybe eventually they reinstall it. welcome to IT. ...which reinforces my point about how people actually doing this and people speculating about it tend to respond to issues like this.
      - close04 8y ago
        > firefox messes up their DNS filtering, chrome doesn't I take it you assume students are not creative enough to get the exact same result with Chrome? Because it is perfectly possible to do it. Unless of course you take steps to prevent that in Chrome. One way or another you either put in the work or the users will end up doing whatever they please. After configuring the OS doing the same for the browser is a relatively small step.
        simondedalus 8y ago
        of course it's possible to do so. but DNS filtering works for most users, and is much easier to centrally manage on a budget (in terms of time / people / money) than browser settings. i'm belaboring this point now, but people who actually do this stuff know that you can't just throw up a GPO to fiddle with chrome settings and expect everything to work. this culture of "power users" thinking they know the best course of action for every situation in IT (and it's always "that thing i Put In The Work to do when i was tailoring my own system") is really silly.