Earlier quoted context omitted.
It's off by default. To enable it you have to go into about:config. I'm saying it should be on by default, or at least exposed in the Settings for people to find. The concern about doing that was that some sites would break, but their definition of break included things which should break because they were previously abusing the lack of FPI. I have been browsing with FPI on for a while and nothing has broken. Protect…
I have it enabled and I can attest that it breaks a fair amount of sites. I think it’s fair to expose that as an expert level setting. It could benefit from a bit of advertising though.
Exception: gitea uses Github oauth
Exception: unbury.me uses Google login
etc
Default: Full FPI