Replacing Firefox to improve user privacy...

vpx

I'd suggest staying with Firefox and just adding the user.js from arkenfox + the extensions uBlock Origin and CanvasBlocker.

Later it could be replaced by the new browser Ladybird.
https://ladybird.org/

vimanuelt

vpx
Good idea. We would also need to include a firewall rule. Here is a hardening script for testing.

#!/bin/sh

# Harden Firefox on GhostBSD using Arkenfox, uBlock Origin, CanvasBlocker,
# and ipfw firewall rules to block Mozilla telemetry.

set -e

# Color support
if [ -t 1 ]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    NC='\033[0m'
else
    RED=''; GREEN=''; YELLOW=''; NC=''
fi

# Variables
ARKENFOX_URL="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
PROFILE_NAME="arkenfox"
MOZILLA_TELEMETRY_IP="63.245.208.0/20"
FIREWALL_FILE="/etc/rc.firewall"
BACKUP_DIR="$HOME/firefox-privacy-backup-$(date +%Y%m%d-%H%M%S)"

# Require user
if [ "$(id -u)" -eq 0 ]; then
    printf "%sDo not run this script as root. Use your regular user account.%s\n" "$RED" "$NC"
    exit 1
fi

# Install Firefox if needed
if ! command -v firefox >/dev/null 2>&1; then
    printf "%sFirefox not found. Installing...%s\n" "$YELLOW" "$NC"
    sudo pkg install -y firefox || {
        printf "%sInstallation failed. Install Firefox manually.%s\n" "$RED" "$NC"
        exit 1
    }
fi

# Backup files
backup_files() {
    printf "%sBacking up Firefox config and firewall rules...%s\n" "$YELLOW" "$NC"
    mkdir -p "$BACKUP_DIR"
    [ -d "$HOME/.mozilla/firefox" ] && cp -r "$HOME/.mozilla/firefox" "$BACKUP_DIR/firefox"
    [ -f "$FIREWALL_FILE" ] && sudo cp "$FIREWALL_FILE" "$BACKUP_DIR/rc.firewall"
    printf "%sBackups saved to %s.%s\n" "$GREEN" "$BACKUP_DIR" "$NC"
}

# Setup Firefox profile and Arkenfox config
setup_firefox_profile() {
    printf "%sCreating new Firefox profile...%s\n" "$YELLOW" "$NC"
    TIMESTAMP=$(date +%s)
    PROFILE_BASE="${PROFILE_NAME}.${TIMESTAMP}"
    firefox -CreateProfile "$PROFILE_NAME $PROFILE_BASE"
    PROFILE_DIR="$HOME/.mozilla/firefox/$PROFILE_BASE"

    printf "%sDownloading Arkenfox user.js...%s\n" "$YELLOW" "$NC"
    fetch -q -o "$PROFILE_DIR/user.js" "$ARKENFOX_URL" || {
        printf "%sDownload failed. Check your network connection.%s\n" "$RED" "$NC"
        exit 1
    }

    touch "$PROFILE_DIR/user-overrides.js"
    printf "%suser.js and user-overrides.js installed to %s.%s\n" "$GREEN" "$PROFILE_DIR" "$NC"
}

# Guide for manual extension installation
guide_extensions() {
    printf "%sPlease install extensions manually:%s\n" "$YELLOW" "$NC"
    printf "1. Open Firefox and go to about:profiles\n"
    printf "2. Launch the '%s' profile and set as default\n" "$PROFILE_NAME"
    printf "3. Install uBlock Origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/\n"
    printf "4. Install CanvasBlocker: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/\n"
    printf "5. Configure and test: https://privacytests.org/ and https://browserleaks.com/canvas\n"
}

# Setup firewall to block Mozilla telemetry
setup_firewall() {
    printf "%sConfiguring ipfw to block telemetry...%s\n" "$YELLOW" "$NC"

    # Ensure firewall is enabled
    CURRENT_FW_ENABLE=$(sysrc -n firewall_enable 2>/dev/null || echo "NO")
    if [ "$CURRENT_FW_ENABLE" != "YES" ]; then
        printf "%sSetting firewall_enable=\"YES\" in /etc/rc.conf...%s\n" "$YELLOW" "$NC"
        sudo sysrc firewall_enable="YES"
    else
        printf "%sfirewall_enable=\"YES\" already set.%s\n" "$GREEN" "$NC"
    fi

    # Ensure firewall_type is set
    CURRENT_FW_TYPE=$(sysrc -n firewall_type 2>/dev/null || echo "")
    if [ "$CURRENT_FW_TYPE" != "workstation" ]; then
        printf "%sSetting firewall_type=\"workstation\" in /etc/rc.conf...%s\n" "$YELLOW" "$NC"
        sudo sysrc firewall_type="workstation"
    else
        printf "%sfirewall_type=\"workstation\" already set.%s\n" "$GREEN" "$NC"
    fi

    # Create firewall file if missing
    if [ ! -f "$FIREWALL_FILE" ]; then
        printf "%sCreating basic %s...%s\n" "$YELLOW" "$FIREWALL_FILE" "$NC"
        sudo sh -c "echo '#!/bin/sh\nfwcmd=\"/sbin/ipfw\"\n\${fwcmd} -f flush' > $FIREWALL_FILE"
        sudo chmod 600 "$FIREWALL_FILE"
    fi

    # Ensure fwcmd is defined
    if ! grep -q '^fwcmd=' "$FIREWALL_FILE"; then
        printf "%sInserting fwcmd definition...%s\n" "$YELLOW" "$NC"
        sudo sed -i '' '1i\
fwcmd="/sbin/ipfw"
' "$FIREWALL_FILE"
    fi

    # Add telemetry blocking rule
    if grep -q "$MOZILLA_TELEMETRY_IP" "$FIREWALL_FILE"; then
        printf "%sTelemetry block already in %s.%s\n" "$GREEN" "$FIREWALL_FILE" "$NC"
    else
        printf "%sAdding telemetry block rule...%s\n" "$YELLOW" "$NC"
        sudo sh -c "echo '\n# Block Mozilla telemetry\n\${fwcmd} add 600 deny ip from any to $MOZILLA_TELEMETRY_IP' >> $FIREWALL_FILE"
    fi

    # Restart firewall and verify
    printf "%sRestarting ipfw...%s\n" "$YELLOW" "$NC"
    sudo service ipfw restart

    if sudo ipfw list | grep -q "00600 deny ip from any to $MOZILLA_TELEMETRY_IP"; then
        printf "%sFirewall rule active. Telemetry blocked.%s\n" "$GREEN" "$NC"
    else
        printf "%sFirewall rule missing. Check %s.%s\n" "$RED" "$FIREWALL_FILE" "$NC"
        exit 1
    fi
}

# Run all
main() {
    printf "%sStarting Firefox hardening on GhostBSD...%s\n" "$GREEN" "$NC"
    backup_files
    setup_firefox_profile
    guide_extensions
    setup_firewall
    printf "%sAll tasks completed.%s\n" "$GREEN" "$NC"
    printf "%sNext steps:%s\n" "$YELLOW" "$NC"
    printf "1. Launch Firefox, go to about:profiles, select '%s', and set as default.\n" "$PROFILE_NAME"
    printf "2. Install the privacy extensions as instructed above.\n"
    printf "3. Edit %s/user-overrides.js to customize Arkenfox settings.\n" "$PROFILE_DIR"
    printf "4. Enable logging with: sudo sysrc firewall_logdeny=YES\n"
    printf "5. Monitor telemetry blocks: tail -f /var/log/security\n"
}

main

Robin

This site has comparisons of browsers based on privacy / spyware, and it's very enlightening. Firefox rates very high on the "spyware" index, as does Brave, much to my surprise.

I'm currently running two of the recommended browsers according to the site, ungoogled-chromium and Librewolf. Both are excellent, very fast browsers. One is chromium-based and the other is a fork of Firefox. I would probably be running Seamonkey with some mitigations if it was packaged for GhostBSD.

Perhaps some people come here from Linux or Windows to GhostBSD for the same reasons I did - to escape the corporate / spyware /advertising games and political software silliness. It wouldn't make sense to default to a well-known-for-spying web browser like either Firefox or Brave.

Giskard

I'm trying Ugoogled Chromium and found some workaround for common issues. If you are interested, I wrote about it here: https://forums.ghostbsd.org/d/437-some-tips-for-ungoogled-chromium

Still, it is less user friendly to start with it, when compared to the Firefox forks, but could be a good alternative if packaged with some user friendly defaults like:

workaround for the File dialog crash
preinstalled Chroumium Web Store addon
pre set default Search Engine

ericbsd

Giskard We can probably modify the ports to have everything set up so it is usable, then Chromium. I sure want to be able to install add-ons by default.

Robin

Since @ericbsd wanted to know about Brave as the default browser, I would say yes - except for all the "Linux stuff" that has to be installed to make it work. Since the last update Brave has been crashing frequently. And Evolution takes 28 seconds to load!, and some of the games quit working. I assume it's some conflict between earlier and later versions of Xorg, Xfce, GTK, or something. I also believe the next release will probably fix those little issues.

But I would vote with heart and soul for Brave as default - again, if it was ported to FreeBSD and didn't require all that "Linux stuff."

ericbsd

Robin I am not interested in the Linux hack for that. I want it native, and the Linux hack will cause issues.

stonedenali

vimanuelt
I have been running Librewolf as my primary browser. I do have concerns regarding the politics, but am willing to make accommodations for privacy sake.

vimanuelt

In a prototype, I created a "Featured" application button to allow you to easily select your favorite browser.

hank2121

Robin agree with You on Brave! a lot of Linux stuff, and it doesn t even work stable on Linux itself.
We use(d) (in company) Linux Mint, now the Debian based LMDE distribution with Chrome, Firefox, Edge and Brave ( for several login reasons) and Brave developed into a piece of s*** over the years, unstabilities, crashes on several portals, no good TAB management and now even unable to update itself, off my list as well.
Ungoogled-Chromium, good idea, but only if I don t have to go thru that complicated DRM (content) enabling process with almost every bigger update/upgrade on GBSD again and again.
I just left Seamonkey in fave of Thunderbird (for mail), cause there was no installable package for GhostBSD for long time!?
I still use Firefox - privacy back n force considering - for compatibility reasons with, for ex. online banking, streaming other than DRM based streamers etc.
Trying Waterfox as well now, but still at the beginning...
So, not to change again, i d love to keep Thunderbird for Email, but would consider a shift to something other than Firefox, if easily to be updated and with ONE browser, easily to handle DRM content without adjusting all the time...

Robin

Our friend @RoboNuggie made a video on how to get the latest version of Seamonkey on GhostBSD! Clickly here to watch it on youtube. It does require some "Linux stuff" to work (Linux compatibility layer), but it's a nice workaround until our friends at FreeBSD learn that Seamonkey is not "abandonware."

hank2121

Robin I guess, I even tried this but was not able to start Seamonkey. There was just no reaction..That s when I switched to Thunderbird and learned new use of this with email and printing... ;-)

« Previous Page