5 ms·

First, FF is less secure than Chromium-based browsers so not sure what you meant there. Just have a look at the results of the various browser hacking competiti

by avazhi 3y ago

First, FF is less secure than Chromium-based browsers so not sure what you meant there. Just have a look at the results of the various browser hacking competitions. This has been a consistent result for decades. FF security out of the box has also been inferior to Chrome’s. In some cases it’s been more readily exploited than Safari, which is saying something. And as for customisation, that’s actually been eroded over the past 3-5 years in FF compared to, say, 10 or 15 years ago. For example, I can remember a time when the interface itself had the option (a checkbox) that miniaturised the icons of the entire search bar UI - this has been gone for years and there is now no way to change that without installing an entire theme. Now every user is stuck with the same general interface/UI spacing. I’ve used FF since maybe 2008 and in my experience it’s never been worse than it is now in terms of performance, its interface customisability, and its benefits vs its largest competitor. If I end up using it as my primary browser it will be because of Google’s insanity with adblockers, not because FF itself is a good alternative (indeed it’s just that FF is the ONLY alternative).

autoexec 3y ago
> FF security out of the box has also been inferior to Chrome’s. Privacy with Firefox out of the box isn't that much better than Chrome’s either, but what sets Firefox apart is that it can be very effectively hardened. At work I deal with all kinds of compromised and malicious websites and nothing beats Firefox once you've got it locked down. > I’ve used FF since maybe 2008 and in my experience it’s never been worse than it is now in terms of performance, its interface customisability, and its benefits vs its largest competitor. It's gotten more difficult to customize firefox over the years for sure, but what competitor offers better interface customizability? What can you customize in Chrome that you can't in firefox? What's chrome's equivalent to userChrome.css? Check out https://old.reddit.com/r/FirefoxCSS/ https://old.reddit.com/r/FirefoxCSS/ for examples of what you can accomplish.
- avazhi 3y ago
  You are absolutely correct that Firefox is more customisable than Chrome, but my point wasn’t to compare the two on that front, but to make the point that the original comment - which spoke of FF’s ‘commitment’ to ‘customisability’ - is nonsensical. That commitment may have been a real thing a decade ago, but it hasn’t been around for awhile.
  - autoexec 3y ago
    I do wish they'd lean into it a bit more these days. Updates tend to break a lot things for people who have taken the time to set things up how they like them. I know that can't always be avoided, but it'd be good if they tried and kept the ability to make such customizations in mind as they add new features.
- deleted 3y ago
  [deleted]
- huytersd 3y ago
  You can’t leave it at that. What do you do to lock down FF?
  - autoexec 3y ago
    We've got a document that outlines easily over 100 changes in about:config that need to be changed and locked (new ones are being added all the time), Nearly everything with a URL gets pulled out of the settings. Pocket is disabled, default plugins and the extensions that get installed for you automatically like screenshots@mozilla.org.xpi and pictureinpicture@mozilla.org.xpi get deleted, and we add noscript/ublock origin The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc. There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled. There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made. In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article. Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.
    - huytersd 3y ago
      Thanks for the reply!
soraminazuki 3y ago
Chromium is the only browser that has security and privacy nightmares including Web USB [1], Web Bluetooth [2], and the Battery Status API [3]. I'd rather stick with Safari or Firefox. [1]: https://caniuse.com/webusb https://caniuse.com/webusb [2]: https://caniuse.com/web-bluetooth https://caniuse.com/web-bluetooth [3]: https://caniuse.com/battery-status https://caniuse.com/battery-status
- avazhi 3y ago
  You just quoted 3 purely hypothetical exploitable features vs, say, Chrome consistently being the last browser standing at PWN2OWN over the past 10+ years (and Firefox is usually the first to fall). I’ll take real world practical protection over theoretical attack surfaces every time.
  - autoexec 3y ago
    Chrome serves you up on a platter to Google and advertisers while admittedly being pretty good at protecting you from everybody else.
    - avazhi 3y ago
      Advertising has nothing to do with security exploits. Clearly we’re talking about browser exploits in this particular line of comments, not privacy, and with exploits so defined Chrome is far superior to FF. Most people here who use a Chrome based browser would almost certainly use a Chromium derivative anyway, like Brave.
      - soraminazuki 3y ago
        > Clearly we’re talking about browser exploits in this particular line of comments, not privacy You could've re-read the thread before posting such an obviously false comment. Here's the first mention of privacy and security in this thread: > I think firefox focusing on performance, customization, and security/privacy is smart. I also heavily disagree with your view that spyware has nothing to do with security, and your extremely narrow view of what counts as security exploits. The Chromium specific APIs are riddled with security issues as I mentioned in my other reply.

by avazhi 3y ago

autoexec 3y ago

> FF security out of the box has also been inferior to Chrome’s. Privacy with Firefox out of the box isn't that much better than Chrome’s either, but what sets Firefox apart is that it can be very effectively hardened. At work I deal with all kinds of compromised and malicious websites and nothing beats Firefox once you've got it locked down. > I’ve used FF since maybe 2008 and in my experience it’s never been worse than it is now in terms of performance, its interface customisability, and its benefits vs its largest competitor. It's gotten more difficult to customize firefox over the years for sure, but what competitor offers better interface customizability? What can you customize in Chrome that you can't in firefox? What's chrome's equivalent to userChrome.css? Check out https://old.reddit.com/r/FirefoxCSS/ https://old.reddit.com/r/FirefoxCSS/ for examples of what you can accomplish.

avazhi 3y ago
You are absolutely correct that Firefox is more customisable than Chrome, but my point wasn’t to compare the two on that front, but to make the point that the original comment - which spoke of FF’s ‘commitment’ to ‘customisability’ - is nonsensical. That commitment may have been a real thing a decade ago, but it hasn’t been around for awhile.
- autoexec 3y ago
  I do wish they'd lean into it a bit more these days. Updates tend to break a lot things for people who have taken the time to set things up how they like them. I know that can't always be avoided, but it'd be good if they tried and kept the ability to make such customizations in mind as they add new features.
deleted 3y ago
[deleted]
huytersd 3y ago
You can’t leave it at that. What do you do to lock down FF?
- autoexec 3y ago
  We've got a document that outlines easily over 100 changes in about:config that need to be changed and locked (new ones are being added all the time), Nearly everything with a URL gets pulled out of the settings. Pocket is disabled, default plugins and the extensions that get installed for you automatically like screenshots@mozilla.org.xpi and pictureinpicture@mozilla.org.xpi get deleted, and we add noscript/ublock origin The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc. There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled. There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made. In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article. Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.
  - huytersd 3y ago
    Thanks for the reply!

soraminazuki 3y ago

Chromium is the only browser that has security and privacy nightmares including Web USB [1], Web Bluetooth [2], and the Battery Status API [3]. I'd rather stick with Safari or Firefox. [1]: https://caniuse.com/webusb https://caniuse.com/webusb [2]: https://caniuse.com/web-bluetooth https://caniuse.com/web-bluetooth [3]: https://caniuse.com/battery-status https://caniuse.com/battery-status

avazhi 3y ago
You just quoted 3 purely hypothetical exploitable features vs, say, Chrome consistently being the last browser standing at PWN2OWN over the past 10+ years (and Firefox is usually the first to fall). I’ll take real world practical protection over theoretical attack surfaces every time.
- autoexec 3y ago
  Chrome serves you up on a platter to Google and advertisers while admittedly being pretty good at protecting you from everybody else.
  - avazhi 3y ago
    Advertising has nothing to do with security exploits. Clearly we’re talking about browser exploits in this particular line of comments, not privacy, and with exploits so defined Chrome is far superior to FF. Most people here who use a Chrome based browser would almost certainly use a Chromium derivative anyway, like Brave.
    - soraminazuki 3y ago
      > Clearly we’re talking about browser exploits in this particular line of comments, not privacy You could've re-read the thread before posting such an obviously false comment. Here's the first mention of privacy and security in this thread: > I think firefox focusing on performance, customization, and security/privacy is smart. I also heavily disagree with your view that spyware has nothing to do with security, and your extremely narrow view of what counts as security exploits. The Chromium specific APIs are riddled with security issues as I mentioned in my other reply.