"making firefox less insecure": http://marc.info/?t=141616714600001&r=1&w=2

and for those who think lynx is a more secure alternative, read this thread: http://marc.info/?l=openbsd-tech&m=140516601718662&w=2

sudo unshare -m bash -c "mount --make-rslave /home ; mount -n --make-rprivate -o bind /tmp/empty /home ; sudo -u $(whoami) firefox -ProfileManager -no-remote"

- creates an empty directory,

- fork the mount table for the new bash process and its children (requires privileges),

- unshare /home (required if / is mounted in shared mode [1]),

- hide /home by mount-binding the empty directory,

- start firefox in unprivilegied mode, without being able to access to user's files.

[1] https://www.kernel.org/doc/Documentation/filesystems/shareds...

Subuser solves the X11 problem with the secure X11 bridge: http://subuser.org/news/0.3.html

The Firefox nightlies can run in Wayland without any form of X11 server present.

Search the OpenBSD mailing list archives. Someone there got it working but ran into some problems.

Or just run it in a docker container with your X11 session mounted. That works great for me.