Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Profilemaker

ffprofile.com

Post reply on HN
Print view View original

81–89 of 89 posts

Re: Firefox Profilemaker

#81

Post by Semaphor »

AnaniasAnanas wrote: post #56
mrmr1993 wrote: post #48

Earlier quoted context omitted.

This seems to be by design: when these things are available, spyware -- especially on Windows -- will be quick to make malicious changes in all these if they can. It's a pain, but I can see the compromise. If it makes the average Firefox user more vulnerable, there's definitely a case to protect them, even at the expense of its more capable users.

I doubt that nowadays many of the average Firefox users are really average computer users.

Our (German) site has mostly photographers who are not very (computer) technically inclined. Yet we have 20% FF users.

Re: Firefox Profilemaker

#82

Post by StillBored »

tahnmozbus wrote: post #73
xte wrote: post #41

Earlier quoted context omitted.

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same f…

I'd also like to point out how many times "this might void your warranty" appears on the following page. https://support.mozilla.org/en-US/kb/how-stop-firefox-making... which is a perfectly reasonable and legitimate user request that, the browser not talk to the internet before the user agrees it may.

Which is crazy for a browser that claims to be "privacy focused" that those settings aren't all in the "privacy tab" with the _two_ that are...

Re: Firefox Profilemaker

#83

Post by toastal »

Semaphor wrote: post #81
AnaniasAnanas wrote: post #56

Earlier quoted context omitted.

I doubt that nowadays many of the average Firefox users are really average computer users.

Our (German) site has mostly photographers who are not very (computer) technically inclined. Yet we have 20% FF users.

Firefox​ had color management and color profiles support years before the other browsers. I'd venture to guess this is why it's favorite among photographers.

Re: Firefox Profilemaker

#84

Post by ksala »

xte wrote: post #41
papayawhip wrote: post #6

I feel the strong need to point out some of these settings will break Firefox in subtle and hard to understand ways. There’s a reason you “void the warranty” when tweaking the about:config preferences. No rule against it, but just watch out. (Mozilla employee)

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same f…

about:config preferences can be customized using the user.js files. See https://github.com/pyllyukko/user.js/#installation for some examples.

For addons and other options you can use policies.json file, see https://github.com/mozilla/policy-templates/blob/master/READ...

Re: Firefox Profilemaker

#85

Post by tinus_hn »

jolmg wrote: post #70
tinus_hn wrote: post #68

Earlier quoted context omitted.

The name is random so pages on the web can’t reference files in it using the file:// urls.

If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.

It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.

Re: Firefox Profilemaker

#86

Post by xte »

mrmr1993 wrote: post #61
xte wrote: post #54

Earlier quoted context omitted.

No software trick can fix OS unsafe design. Also "protecting users" limiting their power means jails them, not really protecting. End users are adult, not child, and developers are others adults with ZERO right on their software's user. If people want safer systems better learn to avoid commercial software, nothing else can help them.

I can agree in general, but, for now, disabling a firefox --install maliciousaddon.xpi and firefox --setconfig keyyoudontwant=valueyoudontlike is enough barrier to stop a majority of bad actors. None of us want users to click yes through install screens, having toolbars and spyware installed for the average user, but that has been the reality of those APIs thus far. Perhaps a more fine-grained permission model is nee…

Having a simple text-based config with a repo, like

[AddOns]

ensure-ffpkg AddonName

[Themes]

set-default ThemeName

install ThemeA, ThemeB

[Settings]

key:val

...

and have the AddonName downloaded with GNUPG signature check from an official Mozilla repo is by far more save that demand using interactive GUIs. Simply ask at startup to accept "potentially dangerous" extensions if you specify a local .xpi file it the same.

What you describe is the classic Windows approach that have proved enough to be ineffective and only useful for commercial practice. Mozilla is formally a foundation and Firefox is formally a FOSS project...

Re: Firefox Profilemaker

#87

Post by xte »

mrmr1993 wrote: post #62
rhizome wrote: post #52

Earlier quoted context omitted.

if spyware has permissions to change ".firefox-prefs" doesn't it have permission to change about:config items, too?

Yes, this leads Firefox to be fairly conservative with its permissions. In general, blocking userspace from installing extensions and otherwise running malicious code stops FF from being exploited. Blocking all of these options blocks the OS from bad behaviour, especially where the user may expect a new computer/phone to have the default behaviour. The vendors of phones and personal computers seem to have an interest…

Actually homeManager can manage Firefox, installing extensions etc... Only it's a hack-ish and not much reliable way.

So no, actual Mozilla strategy does NOT work to stop malware's on Windows nor commercial OEMs customization, as a matter of fact made only life of pro users and admin harder and open the door for less safe setup (for instance extensions added via homeManager may not get updated by FF).

Re: Firefox Profilemaker

#88

Post by xte »

jolmg wrote: post #70
tinus_hn wrote: post #68

Earlier quoted context omitted.

The name is random so pages on the web can’t reference files in it using the file:// urls.

If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.

Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them.

Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.

Re: Firefox Profilemaker

#89

Post by mrmr1993 »

xte wrote: post #87
mrmr1993 wrote: post #62

Earlier quoted context omitted.

Yes, this leads Firefox to be fairly conservative with its permissions. In general, blocking userspace from installing extensions and otherwise running malicious code stops FF from being exploited. Blocking all of these options blocks the OS from bad behaviour, especially where the user may expect a new computer/phone to have the default behaviour. The vendors of phones and personal computers seem to have an interest…

Actually homeManager can manage Firefox, installing extensions etc... Only it's a hack-ish and not much reliable way. So no, actual Mozilla strategy does NOT work to stop malware's on Windows nor commercial OEMs customization, as a matter of fact made only life of pro users and admin harder and open the door for less safe setup (for instance extensions added via homeManager may not get updated by FF).

We would and should expect that it is be possible: unless Firefox signs configuration changes per-user, server-side (violating their privacy intentions), the whole configuration code is open source, and can easily be easily used or reverse engineered to make an external editor.

This doesn't change that a sanctioned API invites abuse far more readily than reverse-engineering, especially when spyware is less frequently updated than Firefox itself. That there isn't a sanctioned API, and that the de facto API can and does change every version, is an advantage for Firefox against potential attackers.

If this is something you are sorely lacking, Firefox has also been straightforward to modify and compile, in my experience. You can always share a patch and enjoy these features as part of a smaller community, without compromising the userbase as a whole.

Post reply on HN