Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox about:config privacy settings

gist.github.com

Post reply on HN
Print view View original

121–130 of 154 posts

Re: Firefox about:config privacy settings

#121

Post by bzbarsky »

Zooper wrote: post #65

Plugin fingerprint protection was removed 3 years ago by a poorly-reasoned patch, favoring the large bug of unimpeded surveillance over the very tiny bug of sites looping through non-existent lists if and only if they need to interact with a plugin. Seeing the conversation, I'm looking for a different browser. "remove_plugins-enumerable_names.patch Bug 757726 hid most plugins from navigator.plugins enumeration to red…

The site bug wasn't "sites looping through non-existent lists if and only if they need to interact with a plugin". It was sites trying to detect whether Flash is installed by looping over the list, deciding it's not installed, and not trying to play the video (or the game or whatever), instead pointing the user to a "Download Flash" page.

This affected enough sites that it was a serious problem for users, not a "very tiny bug".

In any case, at this point Firefox supports exactly one plug-in, so all enumeration can tell you is whether Flash is installed or not. That's still one bit of data, of course, but that bit could be extracted even with the "no enumeration" patch by explicitly querying whether Flash is supported.

Re: Firefox about:config privacy settings

#122

Post by kodablah »

phyzome wrote: post #114
kodablah wrote: post #69

Earlier quoted context omitted.

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited t…

When I said they'd optimized it "as much as they've felt comfortable doing" I was referring to things like profitability and ease of use as limiting factors. If you understand that changing one of the defaults only affects ease-of-use, and you're a power user, more power to you! If you want to turn off analytics, cool! But it gets trickier when it gets to the safebrowsing feature. The gist says to turn off all of tho…

> you're a power user, more power to you

Exactly.

> That's not helping anybody.

It helps the people that optimize for privacy above their own security in this case. From my understanding of the algorithm, you can't really leverage safe browsing properly without being willing to check the full hash via an internet call at some point. So might as well have it off or on. An extremely paranoid user might not want a safe-browsing download to occur at all, informing Google when their computer is on. These are paranoid stances, but it is a list of settings for that. I use a Chromium-based browser that doesn't use safe browsing lists and I accept the risks.

Re: Firefox about:config privacy settings

#123

Post by reitanqild »

pcwalton wrote: post #61
phyzome wrote: post #60

This list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.

Correct, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.

I guess there's a reason they're out of reach for most users

- and a reason they're still available for people in crowds like hacker news* readers etc.

Re: Firefox about:config privacy settings

#124

Post by kodablah »

magicalist wrote: post #116
kodablah wrote: post #67

> Disable Google Safe Browsing and malware and phishing protection. Stop sending links and downloading lists from google. To be clearer here, lists of partial hashes are downloaded and entire links are only sent after partial match. Still worth disabling for privacy reasons if you care more about that than safe browsing protection, but worth clarifying how it works lest one thinks all links are sent.

> and entire links are only sent after partial match. Only part of a hash of the url is sent to get an update for all the URLs in the partial match block. The actual url is never sent. The exception is when download malware protection is on. In that case, when downloading a file the actual URL is sent. That's a regular preference, though ("Block dangerous downloads"), doesn't need about:config changes, and is well de…

Yes, my mistake, I should correct to "only checked". Still makes an internet call to a third party (as does the original hash list download) which I think the OP is wanting to avoid w/ the settings updates, but yes, URL not sent to list maintainer.

Re: Firefox about:config privacy settings

#125

Post by kodablah »

Ar-Curunir wrote: post #113
kodablah wrote: post #69

Earlier quoted context omitted.

Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for. What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited t…

This list is dangerous for the average user, because it disables safe browsing. 95% of people are going to suffer more from being phished than from being tracked.

> for the average user

Well when you add that condition, sure.

Re: Firefox about:config privacy settings

#126

Post by chias »

pcwalton wrote: post #8

I don't like encouraging mucking around in about:config, but I might as well mention this one. If you don't mind your window losing vibrancy and rounded corners, you should be able to significantly improve battery life on macOS by setting "gfx.compositor.glcontext.opaque" to true. This makes WindowServer stop drawing whatever is behind the Firefox window. This bug tracks the proper solution: https://bugzilla.mozilla.…

I'm surprised this isn't enabled by default. Under what circumstances would you not want to enable this flag?

Re: Firefox about:config privacy settings

#127

Post by pcwalton »

agumonkey wrote: post #111
pcwalton wrote: post #8

I don't like encouraging mucking around in about:config, but I might as well mention this one. If you don't mind your window losing vibrancy and rounded corners, you should be able to significantly improve battery life on macOS by setting "gfx.compositor.glcontext.opaque" to true. This makes WindowServer stop drawing whatever is behind the Firefox window. This bug tracks the proper solution: https://bugzilla.mozilla.…

I'd love a list of all tricks of this kind. I don't give a damn about visual acrobatics. Battery life and cpu usage on the other hand..

There deliberately aren't many tricks like this (I don't know of any others, in fact), because having to choose between aesthetics and performance is a terrible tradeoff.

Re: Firefox about:config privacy settings

#128

Post by Drdrdrq »

kodablah wrote: post #124
magicalist wrote: post #116

Earlier quoted context omitted.

> and entire links are only sent after partial match. Only part of a hash of the url is sent to get an update for all the URLs in the partial match block. The actual url is never sent. The exception is when download malware protection is on. In that case, when downloading a file the actual URL is sent. That's a regular preference, though ("Block dangerous downloads"), doesn't need about:config changes, and is well de…

Yes, my mistake, I should correct to "only checked". Still makes an internet call to a third party (as does the original hash list download) which I think the OP is wanting to avoid w/ the settings updates, but yes, URL not sent to list maintainer.

Still - it is unsettling that the only browser available that somewhat respects privacy, sends anything to some 3rd party, and completely unacceptable that they send it to Google.

Re: Firefox about:config privacy settings

#129

Post by Drdrdrq »

satysin wrote: post #118

While talking about Firefox I have a quick question I am hoping someone here can help answer. One feature of Chrome I like a lot is the super simple per-site settings options. I use this to disable JS on a number of sites without impacting any other sites. As far as I can tell there is no option built into Firefox that allows me to do this. Does anyone know of a simple way to get per-site JS blocking? I have looked a…

uMatrix lets you set policies per domain / subdomain, while being very easy to use (for someone who knows web technologies). Highly recommend it.

Re: Firefox about:config privacy settings

#130

Post by Drdrdrq »

dao- wrote: post #28
nerdponx wrote: post #24

I frequently see recommendations to disable "safe browsing" features. Why?

Hysteria or ignorance, as with other items in this list. Safe browsing is designed not to compromise privacy.

Ha! Says Google, right? Anything that gets sent to them is too much.
Post reply on HN