←back to thread

Hardening Firefox – a checklist for improved browser privacy

(andrewmarder.net)
263 points amarder | 6 comments | 30 Aug 25 11:26 UTC | HN request time: 0s | source | bottom
Show context
userbinator ◴[30 Aug 25 20:32 UTC] No.45077766[source]▶
If the first item isn't "whitelist JS", you're doing it wrong. So many problems arise from letting any site run programs on your computer that it's best to reserve the privilege to the most trusted of sites.
replies(3): >>45077846 #>>45078131 #>>45083362 #
stusmall ◴[30 Aug 25 20:43 UTC] No.45077846[source]▶
Meanwhile if I see that I just move on. It just isn't practical to have a workable browser with JS whitelisting for the general case. I doubt people who do this actually do any kind of thoughtful review before hitting "accept". It just adds manual toil with limited benefit.

If they are doing meaningful review, I question how much they actually get done in life.

replies(4): >>45078402 #>>45078915 #>>45079253 #>>45080838 #
1. braiamp ◴[30 Aug 25 22:07 UTC] No.45078402[source]▶
I have NoScript by default set to no run. Some sites work better without it.
replies(4): >>45079140 #>>45082594 #>>45083343 #>>45090526 #
2. userbinator ◴[31 Aug 25 00:07 UTC] No.45079140[source]▶
I very clearly remember, many years ago, a site (which was otherwise perfectly usable) nagging me to "enable JS for a better experience"; curious, I did and was immediately assaulted with all manner of hostile and irritating crap like popups, text selection hijacking, and even attempts to disable the right-click menu. Hurriedly disabled JS again to regain sanity. Nope. I'm never falling for that again... Of course the problem these days is with sites that don't work at all without JS even if they're just static content, and I suspect part of the reason is to force-feed you the crap along with the real content.
replies(1): >>45083683 #
3. memcg ◴[31 Aug 25 12:15 UTC] No.45082594[source]▶
NoScript also allows you to select which scripts you want to allow. It's not all or none. You can also view the source before you decide to let it run.
4. ◴[31 Aug 25 14:20 UTC] No.45083343[source]▶
5. integralid ◴[31 Aug 25 15:00 UTC] No.45083683[source]▶
>and I suspect part of the reason is to force-feed you the crap along with the real content.

Insert the quote about being malicious and incompetent. Modern frontend frameworks like react make sure that your site won't work without js at all, unless you intentionally put some work for that 0.1% of internet users who browse with js disabled

6. ◴[01 Sep 25 07:53 UTC] No.45090526[source]▶