search

pyllyukko / user.js

user.js -- Firefox configuration hardening
MIT License
2.75k stars 232 forks source link

Disable WebIDE? #142

Closed nodiscc closed 8 years ago

nodiscc commented 8 years ago

See https://github.com/amq/firefox-debloat/pull/24/files

Does it make sense disabling the Web IDE in this user.js? (I think yes. It is likely not in use for most users and increases attack surface)

Gitoffthelawn commented 8 years ago

@CHEF-KOCH Just a correction: I don't think there are any settings in Firefox that send every page visited to Google.

If Google Safebrowsing is enabled, it definitely does periodically send some information to Google: IP address, browser, browser version, OS version, other UA string information, other header information.

Also if the file detection "feature" of Google's Safebrowsing is enabled, it also sends Google a hash of some of the files the user downloads.

ghost commented 8 years ago

would disabling the webide increase the performance/responsiveness of firefox?

pyllyukko commented 8 years ago

Does it make sense disabling the Web IDE in this user.js? (I think yes. It is likely not in use for most users and increases attack surface)

Hmm. Not sure. This WebIDE stuff seems to relate more to Firefox OS. I already disabled some Firefox (the browser) remote debuggin stuff with 9715f3cc7e85da807f3872bb29d2bbc79615387f & 4798bf855ca9f243f0b74c077bd3a896a10c213c though.

We have the tendency of disabling unneeded features, so in that sense yes.

@CHEF-KOCH @Gitoffthelawn: How exactly this WebIDE relates to Google?

Gitoffthelawn commented 8 years ago

@pyllyukko It's only related in that Google was brought into the discussion in regards to some questionable default features integrated by Mozilla into Firefox.

nodiscc commented 8 years ago

How exactly this WebIDE relates to Google?

I did not understand why this was brought up either. I guess it's unrelated.

We have the tendency of disabling unneeded features, so in that sense yes.

My point exactly.

pyllyukko commented 8 years ago

Done. Thanks, @nodiscc.