Firefox about:config privacy settings • Hacker News Board

Re: Firefox about:config privacy settings

#61

Post by pcwalton » Fri, Sep 07, 2018, 4:21 PM UTC

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Correct, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.

Re: Firefox about:config privacy settings

#62

Post by [deleted] » Fri, Sep 07, 2018, 4:21 PM UTC

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

[deleted]

Re: Firefox about:config privacy settings

#63

Post by gsnedders » Fri, Sep 07, 2018, 4:23 PM UTC

bobthedino wrote: post #52

Am pleased to discover the "network.IDN_show_punycode" option and wonder why it doesn't default to true, given the way other browsers seem to handle this.

Other browsers vary their behaviour depending on locale, if I'm not mistaken, so that people in countries where IDNs are common don't constantly see meaningless punycode.

Re: Firefox about:config privacy settings

#64

Post by hnaccy » Fri, Sep 07, 2018, 4:25 PM UTC

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Mozilla's incentives may not align with yours, e.g., https://github.com/mozilla-services/screenshots/issues/3503.

Re: Firefox about:config privacy settings

#65

Post by Zooper » Fri, Sep 07, 2018, 4:26 PM UTC

Plugin fingerprint protection was removed 3 years ago by a poorly-reasoned patch, favoring the large bug of unimpeded surveillance over the very tiny bug of sites looping through non-existent lists if and only if they need to interact with a plugin. Seeing the conversation, I'm looking for a different browser.

"remove_plugins-enumerable_names.patch

Bug 757726 hid most plugins from navigator.plugins enumeration to reduce fingerprinting. Plugin detection scripts could ask for a plugin or MIME type by name, but they couldn't get a list of all installed plugins. Unfortunately, the feature had to be disabled because it broke pretty much all plugin detection scripts because they naively search for the desired plugin using an O(n) loop instead of a O(1) query.

This patch removes the disabled code because it is unlikely we could ever re-enable it. In addition to removing the obsolete navigator.plugin tests for detecting hidden plugins, it adds tests for detecting click-to-play and disabled plugins."

Re: Firefox about:config privacy settings

#66

Post by saiya-jin » Fri, Sep 07, 2018, 4:29 PM UTC

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Yeah right, because me being forbidden to right click on the site is really in my best interest. I might, you know, inspect DOM and block annoying permanent menus or ads that ublock origin doesn't filter out. And being able to do copy&paste of the content should send me straight to prison.

Re: Firefox about:config privacy settings

#67

Post by kodablah » Fri, Sep 07, 2018, 4:33 PM UTC

> Disable Google Safe Browsing and malware and phishing protection. Stop sending links and downloading lists from google.

To be clearer here, lists of partial hashes are downloaded and entire links are only sent after partial match. Still worth disabling for privacy reasons if you care more about that than safe browsing protection, but worth clarifying how it works lest one thinks all links are sent.

Re: Firefox about:config privacy settings

#68

Post by hnaccy » Fri, Sep 07, 2018, 4:35 PM UTC

pcwalton wrote: post #61

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Correct, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.

There's little drawback to turning off Pocket unless you find the new tab content(and paid advertisements) compelling.

Re: Firefox about:config privacy settings

#69

Post by kodablah » Fri, Sep 07, 2018, 4:37 PM UTC

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for.

What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited to) profitability and ease-of-use, two things you left off your list of what you think Mozilla optimizes for. That blind trust and invalid set of optimization metrics shouldn't be perpetuated. Granted blind trust in this list is unwise too.

Re: Firefox about:config privacy settings

#70

Post by DangerousPie » Fri, Sep 07, 2018, 4:39 PM UTC

saiya-jin wrote: post #66

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Yeah right, because me being forbidden to right click on the site is really in my best interest. I might, you know, inspect DOM and block annoying permanent menus or ads that ublock origin doesn't filter out. And being able to do copy&paste of the content should send me straight to prison.

Well, that is a good example actually. Of course you don't want to lose the ability to right-click, but there are also various web apps that override the right-click menu for legitimate reasons. Two examples that come to mind are Jupyter Lab and Outlook 365, both of which use a custom context menu. Disabling the context menu setting presumably breaks this functionality.