This list is somewhere between worthless and dangerous.
Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so.
Without listing the tradeoffs for each one, this list cannot be relied upon.
Dangerous is assuming Mozilla optimized only for privacy and performance. Why would you assume that and discourage people trying to optimize for that? This list wouldn't exist if Mozilla offered an equivalent, optimizing for only those two metrics, and explaining the tradeoffs you're asking for.
What you'll find, as has been the case for Mozilla in some recent decisions, is the tradeoff includes (but is not limited to) profitability and ease-of-use, two things you left off your list of what you think Mozilla optimizes for. That blind trust and invalid set of optimization metrics shouldn't be perpetuated. Granted blind trust in this list is unwise too.
You say still, but this will be the first time in a few years that will probably be true. The details of the Google deal aren't public, but I doubt it forced them to spend the past few months secretly hiding Google tracking into the browser.
I agree. I also try to keep it simple to avoid too much maintenance hassle. Sadly about:config is too imperative, so you need to explicitly undo changes. I wish it was like regular dotfiles.
Along with ublocko and httpseverywhere, that covers a lot without breaking mostly anything.
A quite famous user.js hardening project is https://github.com/pyllyukko/user.js. But I've found that keeping such a complex configuration functional requires a lot of constant effort.
This list is dangerous for the average user, because it disables safe browsing. 95% of people are going to suffer more from being phished than from being tracked.
When I said they'd optimized it "as much as they've felt comfortable doing" I was referring to things like profitability and ease of use as limiting factors.
If you understand that changing one of the defaults only affects ease-of-use, and you're a power user, more power to you! If you want to turn off analytics, cool!
But it gets trickier when it gets to the safebrowsing feature. The gist says to turn off all of those components, rather than just the ones that send hashed or partial file and address metadata to Google. That's not helping anybody.
(To be fair, I'd actually reword my original comment to change "worthless or dangerous" to something milder at this point, but HN won't let me do it. Oh well.)
It helps the people that optimize for privacy above their own security in this case. From my understanding of the algorithm, you can't really leverage safe browsing properly without being willing to check the full hash via an internet call at some point. So might as well have it off or on. An extremely paranoid user might not want a safe-browsing download to occur at all, informing Google when their computer is on. These are paranoid stances, but it is a list of settings for that. I use a Chromium-based browser that doesn't use safe browsing lists and I accept the risks.
Am I supposed to intuit from that discussion that they have different incentives and/or goals, or that they haven't found time to get it done? Because even though I think it is somewhat poor wording, I think it's the latter.
Also, although I also think the proposed "upload" is poor wording, as many people seeing that will be confused because buttons that say that usually then request what to upload (e.g. "hmm, maybe it's asking for a local image to upload to the cloud for storage?"). You actually are saveing in both cases, in one case to the cloud, inthe other case to the disk. Thus, "Save to cloud" and "Save to disk" (or "Save locally") are much better options in my mind.
> It's been a year and it's a relatively small UI change to at very least make the local save button the primary colored one.
That doesn't really make a lot of sense though - the experiment was specifically launched with the goal of trying to solve the problem of sharing screenshots with others; a problem they identified as common through user research. So while I think there's a lot to say for changing the wording, the primary action will always be sharing it.
Correct, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.
What Mozilla did in the default Firefox configuration, is made the trade-offs on behalf of an average browser user. It's neither worthless, nor dangerous for a savvy browser user to make the trade-offs for himself. That's exactly what software configurations are for.
That might be a good argument if the link was to an article with a large amount of discussion about the pros and cons of each configuration change, instead of just a list of changes with a brief overview of what they do.
As the one who posted this link here, I found the list to be a great starting point for my research. Instead of switching to something like Waterfox or Brave, I can now remain with a major web browser by just enabling the features I need.
Yeah right, because me being forbidden to right click on the site is really in my best interest. I might, you know, inspect DOM and block annoying permanent menus or ads that ublock origin doesn't filter out. And being able to do copy&paste of the content should send me straight to prison.
Well, that is a good example actually. Of course you don't want to lose the ability to right-click, but there are also various web apps that override the right-click menu for legitimate reasons. Two examples that come to mind are Jupyter Lab and Outlook 365, both of which use a custom context menu. Disabling the context menu setting presumably breaks this functionality.
My idiot bank disables right-clicking, and I'd be all over the option to disable right-click hijacking, but yup I also use a web app that overloads right-clicks in a sane and appropriate manner.
Chesterton's Fence is about a technology somewhere between thousands and tens of thousands years old. Fences are extremely well understood.
All of software has been around less than a century; the concept of personal computers running software that an end-user might adjust settings on is about sixty years old; thinking about Internet security is roughly thirty years old; the modern web ecosystem is no older than JavaScript, 22 years old.
You're still right that blindly changing settings is not a great idea, but the Chesterton's Fence analogy is misplaced.
Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so.
Without listing the tradeoffs for each one, this list cannot be relied upon.