5 ms·

I like it design wise, but like a lot of these "de-clutter" tools it defaults to disabling security features without warning and will break some sites while mak

I like it design wise, but like a lot of these "de-clutter" tools it defaults to disabling security features without warning and will break some sites while making most sites slower. Plus it ironically installs a bunch of browser addons. So if you hit next, next, next you'll lose: Google Safebrowsing (security), malware scan (security), DNS over HTTPS (security and sometimes functionality), Automatic Browser Updates, access to content that requires Widevine, all third-party cookies-based authentication, anything that relies on referers, anything that relies on IndexDB, anything that relies on extended session info, anything that uses WebGL or WebRTC or WebAudio, et al. As I said, I like the design, but the current defaults get 0/10 from me. Simply awful. If use the default profile here your browsing experience will be objectively worse and less secure.

TonyTrapp 5y ago
And on the other hand one of the biggest annoyances of the web - autoplaying videos - is enabled by default! Clearly shows that you cannot please everyone with your defaults, no matter how hard you try.
- atoav 5y ago
  Afaik the way autoplay works is that if it is on, it does only autoplay videos without sound. This can be useful for looping video backgrounds, memes and such. If they want audio too, autoplay does not work (not even if you try to manually trigger it via js). In my eyes (browser-configurable) autoplay without sound is an acceptable use case. Autoplay with sound is not.
  - TonyTrapp 5y ago
    I would have agreed with that until news sites started popping videos into view as soon as you start reading their news articles. Since that became a way too common thing, I don't care enough for the other valid uses cases anymore and right away disable any sort of autoplay. :(
    - GekkePrutser 5y ago
      Yeah this is why we can't have nice things. And why I run two adblockers. If you give them a finger they'll take the hand
    - atoav 5y ago
      Yeah that is shit, but they could also pop blinking text in your face — should we now ban text for that reason?
      - 3np 5y ago
        The <blink> tag is now legacy for reasons.
  - franga2000 5y ago
    Autoplay with sound is a perfectly legitimate use case, but I agree with the status quo that it should not be allowed by default. In general, the "not an acceptable use case" argument is almost always a harmful distraction - it angers people with legitimate use cases and that in turn gives fuel to those supporting it only for their own harmful use-cases. Call it what it is - a useful feature that happens to be commonly abused. s/autoplay/cookies/g, etc.
    - atoav 5y ago
      I thought about this a lot, but did not find a single case where I would like to have a website suddenly play audio without me specifically clicking "play" or "unmute" somewhere.
      - franga2000 5y ago
        - media sites like YouTube (some people prefer that when they click on a new video, it actually starts playing) - notification sounds - playlists of any sort (music or video) Most of this can be worked around by prompting the user on load and then never reloading the page (SPA fetch-and-replace pattern), but even big sites screw this up (like YouTube, where the memory usage increases with every "fake reload"). Again, I wouldn't want just any site to do this unexpectedly, but the ones where I want those features should be able to do it.
yjftsjthsd-h 5y ago
It's making trade-offs, and differently than the Mozilla defaults. Google Safebrowsing reduces privacy (not because of the content, but because it says "hi Google, I'm running Firefox at this IP address"), DNS over HTTPS happily sends all your DNS queries to Cloudflare (and since we're arguing over functionality, breaks some split-horizon DNS), Widevine is blatantly anti-user, third-party cookies are a privacy problem, referers are a privacy problem, ... oh, actually the rest of your list from there is all privacy issues. Anyways, the people who made this would say that Mozilla's current defaults get 0/10 from them and are simply awful, and that using them means your browsing experience will be objectively worse and less private.
- azalemeth 5y ago
  Quite. My FF looks a lot like this provides. I refuse to use Widevine and explicitly disable it and DRM on principle, and I want websites to know that this is something that is perfectly legitimate to do -- unlike Chrome where they've removed the ability to turn it off without deleting the horrible library itself. I understand that some might hate this choice. Mozilla defaults to their preferences. These defaults are pleasingly made for people like me.
- easrng 5y ago
  I'd rather Cloudflare get my DNS queries than a broken network middlebox.
  - yjftsjthsd-h 5y ago
    And I'd like my local pihole equivalent to get them. Most defaults fail for someone.
    - rhtgrg 5y ago
      What is your pihole equivalent/alternative?
      - yjftsjthsd-h 5y ago
cobertos 5y ago
Most of these defaults are what I have mine set to. I wouldn't say it's "simply awful", just different priorities. Having a tool like this allows the choice to be made in the first place, versus installing a browser and not being able to pick these without exploring.
- KennyBlanken 5y ago
  It also explains the risks of most option pretty candidly. The takeaway from this wizard is that firefox has a fuckton of not-very-privacy-friendly stuff. Why does Firefox support Beacons, which have zero user benefit and only exist to track users? Why is the battery API still present, when it's been known for years that it is used for fingerprinting and tracking? Why is Punycode allowed when it's known to be used for phishing? Why is a hidden DRM extension from Google allowed to download arbitrary code? (Mmmmm, tasty tasty sponsorship dollars!) "User privacy" doesn't actually seem to be much of a priority for Firefox these days. Gotta pay for that skyrocketing CEO pay somehow...
howdydoo 5y ago
For tools like this, I'm a big fan of Shutup10's design: Nothing is changed by default. Settings are sorted by risk. It's one click to apply "recommended" settings. It's simple and beautiful. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10

TonyTrapp 5y ago

And on the other hand one of the biggest annoyances of the web - autoplaying videos - is enabled by default! Clearly shows that you cannot please everyone with your defaults, no matter how hard you try.

atoav 5y ago
Afaik the way autoplay works is that if it is on, it does only autoplay videos without sound. This can be useful for looping video backgrounds, memes and such. If they want audio too, autoplay does not work (not even if you try to manually trigger it via js). In my eyes (browser-configurable) autoplay without sound is an acceptable use case. Autoplay with sound is not.
- TonyTrapp 5y ago
  I would have agreed with that until news sites started popping videos into view as soon as you start reading their news articles. Since that became a way too common thing, I don't care enough for the other valid uses cases anymore and right away disable any sort of autoplay. :(
  - GekkePrutser 5y ago
    Yeah this is why we can't have nice things. And why I run two adblockers. If you give them a finger they'll take the hand
  - atoav 5y ago
    Yeah that is shit, but they could also pop blinking text in your face — should we now ban text for that reason?
    - 3np 5y ago
      The <blink> tag is now legacy for reasons.
- franga2000 5y ago
  Autoplay with sound is a perfectly legitimate use case, but I agree with the status quo that it should not be allowed by default. In general, the "not an acceptable use case" argument is almost always a harmful distraction - it angers people with legitimate use cases and that in turn gives fuel to those supporting it only for their own harmful use-cases. Call it what it is - a useful feature that happens to be commonly abused. s/autoplay/cookies/g, etc.
  - atoav 5y ago
    I thought about this a lot, but did not find a single case where I would like to have a website suddenly play audio without me specifically clicking "play" or "unmute" somewhere.
    - franga2000 5y ago
      - media sites like YouTube (some people prefer that when they click on a new video, it actually starts playing) - notification sounds - playlists of any sort (music or video) Most of this can be worked around by prompting the user on load and then never reloading the page (SPA fetch-and-replace pattern), but even big sites screw this up (like YouTube, where the memory usage increases with every "fake reload"). Again, I wouldn't want just any site to do this unexpectedly, but the ones where I want those features should be able to do it.

yjftsjthsd-h 5y ago

It's making trade-offs, and differently than the Mozilla defaults. Google Safebrowsing reduces privacy (not because of the content, but because it says "hi Google, I'm running Firefox at this IP address"), DNS over HTTPS happily sends all your DNS queries to Cloudflare (and since we're arguing over functionality, breaks some split-horizon DNS), Widevine is blatantly anti-user, third-party cookies are a privacy problem, referers are a privacy problem, ... oh, actually the rest of your list from there is all privacy issues. Anyways, the people who made this would say that Mozilla's current defaults get 0/10 from them and are simply awful, and that using them means your browsing experience will be objectively worse and less private.

azalemeth 5y ago
Quite. My FF looks a lot like this provides. I refuse to use Widevine and explicitly disable it and DRM on principle, and I want websites to know that this is something that is perfectly legitimate to do -- unlike Chrome where they've removed the ability to turn it off without deleting the horrible library itself. I understand that some might hate this choice. Mozilla defaults to their preferences. These defaults are pleasingly made for people like me.
easrng 5y ago
I'd rather Cloudflare get my DNS queries than a broken network middlebox.
- yjftsjthsd-h 5y ago
  And I'd like my local pihole equivalent to get them. Most defaults fail for someone.
  - rhtgrg 5y ago
    What is your pihole equivalent/alternative?
    - yjftsjthsd-h 5y ago

cobertos 5y ago

Most of these defaults are what I have mine set to. I wouldn't say it's "simply awful", just different priorities. Having a tool like this allows the choice to be made in the first place, versus installing a browser and not being able to pick these without exploring.

KennyBlanken 5y ago
It also explains the risks of most option pretty candidly. The takeaway from this wizard is that firefox has a fuckton of not-very-privacy-friendly stuff. Why does Firefox support Beacons, which have zero user benefit and only exist to track users? Why is the battery API still present, when it's been known for years that it is used for fingerprinting and tracking? Why is Punycode allowed when it's known to be used for phishing? Why is a hidden DRM extension from Google allowed to download arbitrary code? (Mmmmm, tasty tasty sponsorship dollars!) "User privacy" doesn't actually seem to be much of a priority for Firefox these days. Gotta pay for that skyrocketing CEO pay somehow...

howdydoo 5y ago

For tools like this, I'm a big fan of Shutup10's design: Nothing is changed by default. Settings are sorted by risk. It's one click to apply "recommended" settings. It's simple and beautiful. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10