4 ms·

> FF security out of the box has also been inferior to Chrome’s. Privacy with Firefox out of the box isn't that much better than Chrome’s either, but what sets

> FF security out of the box has also been inferior to Chrome’s. Privacy with Firefox out of the box isn't that much better than Chrome’s either, but what sets Firefox apart is that it can be very effectively hardened. At work I deal with all kinds of compromised and malicious websites and nothing beats Firefox once you've got it locked down. > I’ve used FF since maybe 2008 and in my experience it’s never been worse than it is now in terms of performance, its interface customisability, and its benefits vs its largest competitor. It's gotten more difficult to customize firefox over the years for sure, but what competitor offers better interface customizability? What can you customize in Chrome that you can't in firefox? What's chrome's equivalent to userChrome.css? Check out https://old.reddit.com/r/FirefoxCSS/ https://old.reddit.com/r/FirefoxCSS/ for examples of what you can accomplish.

avazhi 3y ago
You are absolutely correct that Firefox is more customisable than Chrome, but my point wasn’t to compare the two on that front, but to make the point that the original comment - which spoke of FF’s ‘commitment’ to ‘customisability’ - is nonsensical. That commitment may have been a real thing a decade ago, but it hasn’t been around for awhile.
- autoexec 3y ago
  I do wish they'd lean into it a bit more these days. Updates tend to break a lot things for people who have taken the time to set things up how they like them. I know that can't always be avoided, but it'd be good if they tried and kept the ability to make such customizations in mind as they add new features.
deleted 3y ago
[deleted]
huytersd 3y ago
You can’t leave it at that. What do you do to lock down FF?
- autoexec 3y ago
  We've got a document that outlines easily over 100 changes in about:config that need to be changed and locked (new ones are being added all the time), Nearly everything with a URL gets pulled out of the settings. Pocket is disabled, default plugins and the extensions that get installed for you automatically like screenshots@mozilla.org.xpi and pictureinpicture@mozilla.org.xpi get deleted, and we add noscript/ublock origin The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc. There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled. There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made. In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article. Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.
  - huytersd 3y ago
    Thanks for the reply!

avazhi 3y ago

You are absolutely correct that Firefox is more customisable than Chrome, but my point wasn’t to compare the two on that front, but to make the point that the original comment - which spoke of FF’s ‘commitment’ to ‘customisability’ - is nonsensical. That commitment may have been a real thing a decade ago, but it hasn’t been around for awhile.

autoexec 3y ago
I do wish they'd lean into it a bit more these days. Updates tend to break a lot things for people who have taken the time to set things up how they like them. I know that can't always be avoided, but it'd be good if they tried and kept the ability to make such customizations in mind as they add new features.

deleted 3y ago

[deleted]

huytersd 3y ago

You can’t leave it at that. What do you do to lock down FF?

autoexec 3y ago
We've got a document that outlines easily over 100 changes in about:config that need to be changed and locked (new ones are being added all the time), Nearly everything with a URL gets pulled out of the settings. Pocket is disabled, default plugins and the extensions that get installed for you automatically like screenshots@mozilla.org.xpi and pictureinpicture@mozilla.org.xpi get deleted, and we add noscript/ublock origin The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc. There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled. There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made. In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article. Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.
- huytersd 3y ago
  Thanks for the reply!