Hacker News Reader

Comment by cedex12 | Hacker News Reader

Something I'd like to see instead of a modified version of ff is some sort of meta-extension that I could install on vanilla ff. It would essentially be a bundle of

* add blocker (say ublock)

* js disabler (noscript)

* https stuff

* anti tracker

* url cleaner

* user agent spoofer

* cookie cleaner

* whatever decentraleyes does

* enable the right settings in about:config

* …?

All the extensions are there already, but it would guarantee them working well together and you wouldn't have to look for each extension and wonder if it's actually the one you want, but just install "the one".

View on HN

The problem I find with Firefox is that options in about:config are too stateful.

You can't use user.js as a regular dotfile such as .emacs, .vimrc or .muttrc. That is, once you set an option you need to manually unset it. I wished they introduced a more sane mechanism.

Besides, there is no way to programmatically declare you want to use some addons.

IMHO, all this makes maintaining relatively complex user configurations very costly.

Yes, I find the about:config option stickiness behaviour isn't intuitive. I am guessing that a lot of people don't realize that if you set options in user.js they stay set until you manually unset them, even if you remove the user.js file.

I don't understand, what would you want, exactly?

Options that can be set only for the duration of the current session?

Yes. In Emacs, if I setq some variable it doesn't stay set forever. In particular, not after I remove the setq statement.

A hack around this would be to remove things by specifically unsetting them in the user.js file, much as one would do to remove a previously installed package using configuration management software.

You can't use user.js that way. You can use about:config that way. In about:config, resetting to default is easier than editing.

I use https://yadm.io to manage my dotfiles.

What I did was created a fork, ie https://github.com/dngray/ghacks-user.js/tree/fx-desktop

Then I added it as a submodule, ie "yadm submodule add ..." as they mention here https://stackoverflow.com/a/18797720

Yadm allows for a bootstrap[0], so I simply do:

   ln -sf ~/.config/firefox/chrome/userChrome.css ~/.mozilla/firefox/$FIREFOX_PROFILE.default/chrome/userChrome.css
   git --git-dir=/home/{{ YADM_USER }}/.config/firefox/ghacks-user.js/.git --work-tree=/home/{{ YADM_USER }}/.config/firefox/ghacks-user.js checkout fx-desktop
   cp ~/.config/firefox/ghacks-user.js/user.js ~/.mozilla/firefox/$FIREFOX_PROFILE.default/user.js

Note the Jinja2[1] syntax there.

[0]: https://yadm.io/docs/bootstrap [1]: https://yadm.io/docs/alternates

> anti tracker

That's built in to Firefox already, just go to privacy settings and set it to work in all windows.

> user agent spoofer

Same. privacy.resistFingerprinting will set the UA to something like the latest stable Firefox on Windows.

> https stuff

Is it that necessary anymore? The HSTS Preload list covers the big and important sites, and most links you see are https already.

resistFingerprinting does a lot of weird stuff that can't be individually toggled, though.

> "* whatever decentraleyes does"

ha, yes, it's hard to keep track of all these little modules sometimes.

decentraleyes caches bundles (like jquery) from cdn's so the cdn's can't track you as easily.

Does it still have weird bugs versus CSP that require it to be disabled on some sites when it breaks?

I'd like to see these kinds of features upstreamed into TBB, then eventually make their way into mainline Firefox. I know HTTPS Everywhere and NoScript already exist in TBB, I'm trying to think of what other extensions would do well for it...

TBB?

tor browser bundle

Somewhere I remember reading that the Tor Project refers to it now just as "Tor Browser" (the bundle part got dropped).

If you look at their website https://www.torproject.org they refer to it as "Tor Browser".

I just want something that gives me maximum privacy without compatibility issues. I run into websites every week that just don't render elements or clickable links in firefox with my current extensions (looking at you, barclays).

The only privacy extensions I use are cookie autodelete, decentraleyes, and ublock origin with default settings (the super private settings broke more websites than not, and I gave up making dozens of exceptions), and google and FB containers.

I'm considering dropping google container too, very annoying clicking a link opens a tab in the default container and closes the google one, so I have to shift cmd tab through all my recently closed tabs or dig through history instead of hitting back to return to the results.

It's like either you let your guard down or make navigating around the web insufferable.

Would it be sufficient to be able to bulk install add-ons from say a text file that lists them all?

That's also a feature that I want. Something like a dotfile for Firefox that I can use to set it up automatically with the rest of the system.

However what bothers me about privacy add-ons is that each one that I install is giving permissions in my browser to another person. It would be better if there was a single add-on that was audited by someone trustworthy.

A single all-in-one add-on could also work on making each of its users fingerprint the same, which is something that can't happen when each person is using a different combination of privacy enhancements.

> Something like a dotfile for Firefox that I can use to set it up automatically with the rest of the system.

I've not yet tried it, but I think user.js might be helpful for this: http://kb.mozillazine.org/User.js_file

That's exactly what I did.

* https://github.com/dngray/ghacks-user.js/tree/fx-desktop

* https://github.com/dngray/ghacks-user.js/tree/fx-android

Chrome makes addon installation via Group Policy in Windows very easy. I've not attempted with Firefox but it seems similarly easy. The docs are here: https://support.mozilla.org/en-US/kb/deploying-firefox-with-...

If you use Windows, you can use local group policy (if you're not part of a domain) and it's not too difficult to export/import for new machines.

As the sibling comment says, the "extension bundle" thing would allow for: less people to trust when installing the extension and guaranteed uniform behaviour without extensions stepping on each other toes, plus the fingerprinting thing which I actually didn't think about!

AMO lets you make "collections" of addons, but I think you still have to visit the pages and install each individually. e.g. https://addons.mozilla.org/en-US/firefox/collections/1241315...

umatrix and decentraleyes are wonderful. They don't quite work together (I think you have to unblock some sites in umatrix before decentraleyes will be able to emulate them)

What is URL cleaning and what tools do you use now?

URLs often have lots of referral and tracking information in them (see anything with UTM parameters: https://en.wikipedia.org/wiki/UTM_parameters ). I use the Neat URL extension and it's been great.

Right, I hate that, and suspected this addresses the practice.

I installed link cleaner¹ at some point, but can't vouch for it.

¹ https://github.com/idlewan/link_cleaner

These days I like https://addons.mozilla.org/en-US/firefox/addon/neat-url/ , it's pretty sane and exhaustive by default

How does that compare to CleanURLs https://addons.mozilla.org/en-US/firefox/addon/clearurls/ I only ever used CleanURLs, but I have seen Neat URL mentioned.

I rather like Clean URLs (seems more maintained) and can pull a set of rules (regxp) from https://gitlab.com/KevinRoebert/ClearUrls/raw/master/data/da...

Reply on news.ycombinator.com