4 ms·

They do modify the attack surface, but since these prefs cover code that ships in the release version of Firefox, they should be reasonably well tested. Most o

by ygjb 3y ago

They do modify the attack surface, but since these prefs cover code that ships in the release version of Firefox, they should be reasonably well tested. Most of the preferences in this will actually reduce the target-able attack surface, and disable some features that could be footguns, but at the same time disable some optimizations that aim to reduce cognitive load on users (which in turns reduces the likelihood that mistakes will be made).

bzmrgonz 3y ago
Additionally, do keep in mind that browser dev's, in addition to their ulterior harvesting agenda, have the burden of universal appeal/usability, which makes niche installs impossible. If this is a NixOS-type of configure-your-own-browser, I'm all for it. This is the reason why Consumer wireless-Router configuration sucks, because manufacturers are trying to appeal to the masses and don't want to generate a call-for-support nightmare. So yeah, if we can *nixify(I'm claiming coinage here) all things produced in bulk and for the masses, by all means!!!
mattstir 3y ago
> Most of the preferences in this will actually reduce the target-able attack surface Can you point to anything specific that reduces the attack surface? When looking at the "securefox" config, it does a bunch of strange things, like enabling embedded TikTok links (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L60 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) and disabling UITour (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L158 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) which Firefox uses to highlight menus and is only accessible by approved Mozilla domains (https://searchfox.org/mozilla-central/source/browser/app/permissions https://searchfox.org/mozilla-central/source/browser/app/per...). It's a very strange mix of configs.
- autoexec 3y ago
  > Can you point to anything specific that reduces the attack surface? I haven't had a chance to dig though those configs yet, but disabling things like service workers, webgl, normandy/experiments, pocket, and webrtc would be a good start at reducing attack surface
  - throwaway290 3y ago
    All of that also makes you easier to fingerprint. How many people disable WebGL?
    - Beldin 3y ago
      Enabling WebGL makes you a lot more fingerprintable than having it disabled. See e.g. How gullible are web measurement tools? A case study analysing and strengthening OpenWPM’s reliability. B. Krumnow, H. Jonker and S. Karsch. In Proc. 18th International Conference on emerging Networking EXperiments and Technologies (CoNEXT’22). ACM, pp. 171–186, 2022. (Table 3).
- yokoffing 3y ago
  The section "Securefox" should probably be renamed "Privatefox", but labels are misleading. It's best to read the project files to understand the balance taken with security, privacy, and functionality. Let's make it simple: Want a mix of speed and privacy, while retaining functionality? Use Betterfox user.js. Want more privacy and security at the expense of site functionality? Use Arkenfox user.js. Want Tor prefs but without using its nodes/relays? Use Mullvad Browser. Want anonymity? Use Tor Browser.

by ygjb 3y ago

bzmrgonz 3y ago

Additionally, do keep in mind that browser dev's, in addition to their ulterior harvesting agenda, have the burden of universal appeal/usability, which makes niche installs impossible. If this is a NixOS-type of configure-your-own-browser, I'm all for it. This is the reason why Consumer wireless-Router configuration sucks, because manufacturers are trying to appeal to the masses and don't want to generate a call-for-support nightmare. So yeah, if we can *nixify(I'm claiming coinage here) all things produced in bulk and for the masses, by all means!!!

mattstir 3y ago

> Most of the preferences in this will actually reduce the target-able attack surface Can you point to anything specific that reduces the attack surface? When looking at the "securefox" config, it does a bunch of strange things, like enabling embedded TikTok links (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L60 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) and disabling UITour (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L158 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) which Firefox uses to highlight menus and is only accessible by approved Mozilla domains (https://searchfox.org/mozilla-central/source/browser/app/permissions https://searchfox.org/mozilla-central/source/browser/app/per...). It's a very strange mix of configs.

autoexec 3y ago
> Can you point to anything specific that reduces the attack surface? I haven't had a chance to dig though those configs yet, but disabling things like service workers, webgl, normandy/experiments, pocket, and webrtc would be a good start at reducing attack surface
- throwaway290 3y ago
  All of that also makes you easier to fingerprint. How many people disable WebGL?
  - Beldin 3y ago
    Enabling WebGL makes you a lot more fingerprintable than having it disabled. See e.g. How gullible are web measurement tools? A case study analysing and strengthening OpenWPM’s reliability. B. Krumnow, H. Jonker and S. Karsch. In Proc. 18th International Conference on emerging Networking EXperiments and Technologies (CoNEXT’22). ACM, pp. 171–186, 2022. (Table 3).
yokoffing 3y ago
The section "Securefox" should probably be renamed "Privatefox", but labels are misleading. It's best to read the project files to understand the balance taken with security, privacy, and functionality. Let's make it simple: Want a mix of speed and privacy, while retaining functionality? Use Betterfox user.js. Want more privacy and security at the expense of site functionality? Use Arkenfox user.js. Want Tor prefs but without using its nodes/relays? Use Mullvad Browser. Want anonymity? Use Tor Browser.