Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox about:config privacy settings

gist.github.com

Post reply on HN
Print view View original

111–120 of 154 posts

Re: Firefox about:config privacy settings

#111

Post by agumonkey »

pcwalton wrote: post #8

I don't like encouraging mucking around in about:config, but I might as well mention this one. If you don't mind your window losing vibrancy and rounded corners, you should be able to significantly improve battery life on macOS by setting "gfx.compositor.glcontext.opaque" to true. This makes WindowServer stop drawing whatever is behind the Firefox window. This bug tracks the proper solution: https://bugzilla.mozilla.…

I'd love a list of all tricks of this kind. I don't give a damn about visual acrobatics. Battery life and cpu usage on the other hand..

Re: Firefox about:config privacy settings

#113

Post by Ar-Curunir »

kodablah wrote: post #69
phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited t…

This list is dangerous for the average user, because it disables safe browsing. 95% of people are going to suffer more from being phished than from being tracked.

Re: Firefox about:config privacy settings

#114

Post by phyzome »

kodablah wrote: post #69
phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited t…

When I said they'd optimized it "as much as they've felt comfortable doing" I was referring to things like profitability and ease of use as limiting factors.

If you understand that changing one of the defaults only affects ease-of-use, and you're a power user, more power to you! If you want to turn off analytics, cool!

But it gets trickier when it gets to the safebrowsing feature. The gist says to turn off all of those components, rather than just the ones that send hashed or partial file and address metadata to Google. That's not helping anybody.

(To be fair, I'd actually reword my original comment to change "worthless or dangerous" to something milder at this point, but HN won't let me do it. Oh well.)

Re: Firefox about:config privacy settings

#115

Post by dao- »

nerdponx wrote: post #107
dao- wrote: post #28

Earlier quoted context omitted.

Hysteria or ignorance, as with other items in this list. Safe browsing is designed not to compromise privacy.

What other items do you think fall into this category?

For instance, disabling geolocation. You need to explicitly approve geolocation requests anyway. If you're sure you'll never ever want to share your location with a site, sure, disable it globally. But recommending this to others as a way to protect their privacy is a bit silly.

Re: Firefox about:config privacy settings

#116

Post by magicalist »

kodablah wrote: post #67

> Disable Google Safe Browsing and malware and phishing protection. Stop sending links and downloading lists from google. To be clearer here, lists of partial hashes are downloaded and entire links are only sent after partial match. Still worth disabling for privacy reasons if you care more about that than safe browsing protection, but worth clarifying how it works lest one thinks all links are sent.

> and entire links are only sent after partial match.

Only part of a hash of the url is sent to get an update for all the URLs in the partial match block. The actual url is never sent.

The exception is when download malware protection is on. In that case, when downloading a file the actual URL is sent. That's a regular preference, though ("Block dangerous downloads"), doesn't need about:config changes, and is well described in the help docs.

https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...

Re: Firefox about:config privacy settings

#117

Post by ECrownofFire »

phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Good example of this: the referer header is the only way to verify the source of a request to prevent CSRF unless it the request uses the POST method or it's a CORS request. Firefox doesn't currently send the Origin header unless it's one of those two, meaning disabling the referer header will break any PUT, DELETE, etc requests on any website that has reasonable CSRF protection (which is basically essential for all non-static sites).

Re: Firefox about:config privacy settings

#118

Post by satysin »

While talking about Firefox I have a quick question I am hoping someone here can help answer.

One feature of Chrome I like a lot is the super simple per-site settings options. I use this to disable JS on a number of sites without impacting any other sites. As far as I can tell there is no option built into Firefox that allows me to do this. Does anyone know of a simple way to get per-site JS blocking?

I have looked at a few extensions which works but I was wondering (hoping) for a hidden Firefox option to do such a thing. I hacve tried to get Firefox policies to work but they appear broken?

Can anyone help?

Re: Firefox about:config privacy settings

#119

Post by SSLy »

satysin wrote: post #118

While talking about Firefox I have a quick question I am hoping someone here can help answer. One feature of Chrome I like a lot is the super simple per-site settings options. I use this to disable JS on a number of sites without impacting any other sites. As far as I can tell there is no option built into Firefox that allows me to do this. Does anyone know of a simple way to get per-site JS blocking? I have looked a…

This is superfically not a simple way, but if you get uMatrix and spend 1 minute to change the default config to allow all, you can use it to block js on per site (and per origin) basis.

Re: Firefox about:config privacy settings

#120

Post by magicalist »

xenophonf wrote: post #14

If you're interested in hardening your Firefox profile, check out this repository of user.js settings: https://github.com/pyllyukko/user.js This does things like blocking analytics and browser fingerprinting, and it's a simple to install or revert---just drop the user.js file in your Firefox profile directory.

Before anyone tries this, I really really really encourage you to read the `Known problems and limitations`. eg it'll erase all your saved passwords, bullet point 23 (at least it's in bold :/)

https://github.com/pyllyukko/user.js/issues/27#issuecomment-...

Post reply on HN