The networking and UI things are a valiant effort. Mixing them with non-mainstream security concerns are a bad idea. You may feel that safe-browsing is tracking by the man, but advising newbies to turn it off is borderline irresponsible. Similar argument for ipv6 (wtf), error reporting (congrats: your bugs will never be fixed cause firefox doesn't know about them), and geolocation ("why doesn't google maps ever know where I am?").
If you apply these, some caveat emptor: when firefox upgrades it usually wont change these settings for you. So if firefox makes things awesome, you'll be left behind. You may want that, you may not. Personally, I'd advise against.
> Remove "(site) is now fullscreen" nag message and make it faster
For a list that want to make the browser more secure, why do they want to remove the only line of defense against sites using fullscreen mode for phishing?
> Disable PDF reader
PDF.js has fewer security vulnerabilities than desktop PDF readers.
> Disable 'safe browsing' aka. Google tracking/logging
> PDF.js has fewer security vulnerabilities than desktop PDF readers.
You can limit desktop readers with something like AppArmor (no network access, only allowed to read files, only allowed to open *.pdf files, etc). You can't (AFAIK) do that with PDF.js.
AppArmor can't do a *.pdf restriction. Even if it could, you still let through access to every pdf on your system.
The point here is that the sandboxing needs to be watertight, or it's simply not effective. pdf.js runs in the JS sandbox, but here the file origin checking failed. Placing an OS-level sandbox around it doesn't help unless it is just as tight.
The warning is a bit annoying, but without it attacks like this would be harder to spot: http://feross.org/html5-fullscreen-api-attack/ (it's just a proof-of-concept, no malicious payload)
Who are all these people who apparently run their browser maximized? Web pages generally get worse as the window gets wider. (Unless, of course, they control their own width, but that's its own obvious prompt to stop wasting all your screen space.)
No, it would still have to be a small squarish display. Fixing the aspect ratio won't fix the problem that you have way more space than the website will take.
It used to be issue - in your local network, you had IPv6 automatically with Vista and newer (the same for Linux distributions). So your browser resolved AAAA records, trued o open connection to the the host, after few seconds found out that it is going nowhere, resolved the A records, the site worked.
So it became popular to manually disable IPv6 to speed up the browsing.
It's the only UI change to firefox that I've come to appreciate.
I can't think of a single UI change since the introduction of Australis that hasn't caused me pain, frustration and forced me to spend considerable time and effort to look for workarounds or fixes. Since almost all of my UI interaction is muscle memory - changing, removing things and adding completely unwanted elements has been an unpleasant and grating experience for me and I come to dread every new feature introduced to firefox.
Reader is the only positive one for me. My eyesight isn't the best and the modern design trend for low contrast and small text makes many sites unreadable. Reader fixes that for me ina simple way, it's straightforward and doesn't have any unnecessary features.
Ugh, it has "disable webgl" because it's a "debatable" security concern? And disable ipv6? I hope people know what these settings are for before they apply these.
The type of person who is adding these settings probably wants this. That is, a web browser that does one thing very well: browse the web. The title of the repo is kind of misleading in that regard, since it makes it sound like something the average user might like.
The tweaks under appearance and bloatware are good, although I'd probably leave error reporting on (I'm on the nightly channel for a reason), as well as WebGL although it would be nice if it could be changed to "click-to-run" style launching. The rest of the tweaks seems fairly reasonable privacy-wise.
Well it was added recently, during the same time as things like pocket and hello are being added. A lot of people will never use it, so it's fair for them to put it in the same bloatware category. I use it a lot on mobile, not so much on desktop. I didn't want to disable it.
I'm not the biggest fan of hello in firefox, but I've gotten some light mileage out of it, so I guess I can't be too upset. Pocket though just really shouldn't be in the browser.
Nice. That's a useful guide for writing an add-on to manage all those settings, some of which are documented only in very obscure places. Whether or not you turn them on or off is your business, but they need a user interface.
TBH I don't care if there's a user interface; what I want is to be able to store my browser's config in git along with the rest of my config. Every other program I use regularly is configured through sane dotfiles; if I check them out on a fresh OS install it's all like I want, except Firefox. I have to go through this insane song and dance of hunting down all my extensions and remembering obscure about:config settings every time.
In fact, it's a bit cringeworthy that this whole list is presented as a thing you're supposed to manually enter while using the about:config search.
Doesn't everybody know about user.js? Keep that updated and store that in git. If that file is present in the .../Profiles/<whatever>.default then Firefox automatically uses it. And Firefox doesn't rewrite it, as opposed to prefs.js.
It's still a hassle, but it's far easier than manually entering things into about:config. Here are a few of the things currently in my user.js:
I've got more in there but I'm too lazy to look all of them up to make sure they still apply to the current version of Firefox. The ones I pasted seemed relevant based on their name.
Sure, but you can't check the profile directory into git, and you can't know the path of the profile directory ahead of time to make a symlink either. The way they randomize the path makes it seem like they're going out of their way to make it automation-resistant.
When you have to do something like that to disable unwanted intrusive and commercial features in Firefox, you know that the Mozilla Foundation is not your friend.
There is a massive bias for change aversion in this list. Basically anything that Firefox has added in the last couple of years he doesn't like. Not advised.
Even thus the changes arent all great many of them are definitely in the "why isnt this default?" category for me.
For ex webrtc should def. prompt instead of leaking by default, full screen animation is slow as fuck, pocket is adware, loop and safe-browsing should be turnable-off in the main prefs, social is adware, yada yada.
The networking and UI things are a valiant effort. Mixing them with non-mainstream security concerns are a bad idea. You may feel that safe-browsing is tracking by the man, but advising newbies to turn it off is borderline irresponsible. Similar argument for ipv6 (wtf), error reporting (congrats: your bugs will never be fixed cause firefox doesn't know about them), and geolocation ("why doesn't google maps ever know where I am?").
If you apply these, some caveat emptor: when firefox upgrades it usually wont change these settings for you. So if firefox makes things awesome, you'll be left behind. You may want that, you may not. Personally, I'd advise against.