I have it selectively whitelisted via NoScript, rather than just disabled. I only enable it for a domain when there's a compelling reason (i.e. it's not just f

I have it selectively whitelisted via NoScript, rather than just disabled. I only enable it for a domain when there's a compelling reason (i.e. it's not just for ads/trackers) and even then, the permissions will be temporary unless it's a site I frequent. Most of the time browser security flaws rely on JavaScript in some way, so this makes me more secure by default at the expense of usability. It has a happy side-effect of disabling other random annoying things as well.