Hacker News Reader

Comment by bugmen0t | Hacker News Reader

This is a "chrome script" extension, which downgrades some of the built-in Firefox security features. Use at your own risk.

View on HN

"Downgrades built-in Firefox security features" is a gross mischaracterization, bordering on FUD.

Chrome scripts require careful security analysis, just like software that runs with root privileges.

Firefox ships with zillions of lines of chrome script, and none of those zillions of lines "downgrade" any security features. Software isn't automatically secure simply because it came from Mozilla. Microsoft tried the same nonsense to scare people out of using Linux at one point... you'd have to be nuts to run kernel code that didn't come from Redmond!

There are security checks for detecting userChrome.js. My understanding is that Firefox is going to let people customize as before but just not enable some security enhancements for those users. https://searchfox.org/mozilla-central/rev/02bd3e02b72d431f2c...

What are the "security enhancements" that those users are missing out on?

First one I found was blocking of eval()

https://searchfox.org/mozilla-central/source/dom/security/ns...

Essentially, it allows calling eval[1] and executing "privileged loads"[0] in some elevated contexts (the System Principal, which is responsible for the browser UI[2]).

Those are useful mitigations, but disabling them for some custom user-chrome is unlikely to have a meaningful impact on your browser's security.

[0] https://searchfox.org/mozilla-central/source/dom/security/ns...

[1] https://searchfox.org/mozilla-central/source/dom/security/ns...

[2]: https://blog.mozilla.org/attack-and-defense/2020/06/10/under...

As pointed out by sibling-comments, this seems to be in the context of making sandbox escapes harder.

Someone posted downthread to use this instead:

https://github.com/mozilla/policy-templates

It's from Mozilla.

Reply on news.ycombinator.com