Replacing Firefox to improve user privacy...

grahamperrin

vimanuelt Normandy

Shield Recipe Client — Firefox Source Docs documentation

vimanuelt

grahamperrin
The Firefox Source Docs page you referenced provides detailed technical documentation on Normandy, also known as the Shield Recipe Client. Normandy is a targeted change control system that allows Mozilla to make small changes within a release of Firefox, such as studies. firefox-source-docs.mozilla.org

Key Components of Normandy

1. Recipes and Actions
Normandy operates using "recipes," which are instructions that define specific actions to be performed on the client side. Each recipe includes:

Action: The operation to perform (e.g., changing a preference, installing an add-on).
Arguments: Configuration data required for the action.
Filter Expression: Criteria determining which clients should execute the recipe, written in a language called JEXL. firefox-source-docs.mozilla.org+6firefox-source-docs.mozilla.org+6Mozilla GitHub+6 Mozilla GitHub+1firefox-source-docs.mozilla.org+1

2. Execution Model
The Normandy Client periodically fetches active recipes from Remote Settings. Upon retrieval, it:

Verifies the recipe's signature to ensure authenticity.
Evaluates the filter expression to determine applicability.
Executes the action if the client matches the criteria. Mozilla GitHub+6firefox-source-docs.mozilla.org+6firefox-source-docs.mozilla.org+6 firefox-source-docs.mozilla.org+2Mozilla GitHub+2firefox-source-docs.mozilla.org+2 Mozilla GitHub+3firefox-source-docs.mozilla.org+3firefox-source-docs.mozilla.org+3

3. Remote Settings Integration
Recipes are distributed via Remote Settings, which keeps the local list of recipes up to date and notifies the Normandy Client of any changes. This system ensures that updates can be rolled out or rolled back without requiring a full browser update. firefox-source-docs.mozilla.org

4. Suitability Checks
Before executing a recipe, the Normandy Client performs several checks:

Signature Verification: Ensures the recipe is from a trusted source.
Capabilities Matching: Confirms the client supports the required capabilities for the recipe.
Filter Evaluation: Determines if the client meets the specified criteria. Searchfox+7firefox-source-docs.mozilla.org+7Mozilla GitHub+7

5. Data Collection
Normandy reports the execution status of recipes to Telemetry, providing insights into successful and failed runs. This data helps Mozilla assess the impact and effectiveness of deployed changes. Searchfox+7firefox-source-docs.mozilla.org+7

vimanuelt

Yes, regarding simplicity, what has been discussed in the past is to have an ISO that just installs the OS, then after reboot, the user would login and a welcome screen would appear. There could be 7 task selections for the user.

1. System Setup
☑️ Set system language and keyboard layout
☑️ Configure date, time, and timezone
☑️ Enable automatic system updates
☑️ Check for and apply available updates

2. Network and Connectivity
📶 Connect to a wireless network
🔌 Configure wired or static IP networking
🔐 Enable or disable SSH service

3. Software Selection
🌐 Choose your preferred web browser (e.g., LibreWolf, Falkon, Firefox, Ungoogled Chromium)
📝 Choose an office suite (e.g., LibreOffice, OnlyOffice, None)
🎵 Choose multimedia tools (e.g., VLC, Audacity)
📦 Launch Software Station to browse and install applications

4. User Preferences
👤 Create or manage user accounts
🎨 Choose a desktop theme and appearance settings
🖱 Set up mouse or touchpad preferences

5. Filesystem and Storage
💽 Set up additional disks or partitions
🛡 Configure ZFS features (snapshots, RAIDZ, compression)

6. Optional Tools and Services
🖨 Add printers or configure printing
🎧 Set up Bluetooth devices
📡 Enable network services (e.g., NFS, Samba)

7. Documentation and Help
📖 View the user manual
❓ Read the FAQ
💬 Join the community (Telegram, Forum, GitHub)

Separating operating system installation from application setup and configuration significantly reduces complexity. By isolating these problem spaces, we create clearer workflows and more predictable outcomes. When the ISO is dedicated solely to installing the base system, it becomes feasible to introduce new tooling for hardware identification and setup; capabilities that go beyond what FreeBSD currently provides. For instance, it would be advantageous to resolve device-related issues, such as Bluetooth support, before the initial reboot.

At present, ISO size constraints discourage the inclusion of additional setup tools. However, if application and device configuration were deferred to a post-installation phase, these limitations would no longer apply. This separation not only facilitates future enhancements but also mitigates the risk of memory exhaustion on systems with limited RAM, such as those with 4 GiB. Bundling too many applications into the ISO can lead to out-of-memory conditions and force users into a rescue shell, a poor experience, particularly for newcomers.

Letting the user decide which browser to install is nicer than giving an unwanted browser by default.

grahamperrin

vimanuelt … installs the OS, then … could be 7 task selections for the user. …

Many people hate to be interrupted – repeatedly – when they simply want to begin browsing.

Consider the readiness of Kubuntu (on Ubuntu). What does the pinning of a browser icon, alongside a file manager, tell us?

Also, the readiness before installing GhostBSD – live mode:

grahamperrin

vimanuelt … an unwanted browser …

More than nine million users of uBlock Origin, I should assume that a significant proportion (on any platform) do want a browser that can use the extension.

vimanuelt

grahamperrin
The page you referenced, About Studies, provides an overview of Firefox's "Shield Studies." These studies are part of Mozilla's initiative to test new features and ideas before their general release. By collecting user feedback, Mozilla aims to make informed decisions that align with user needs.Mozilla Support+5Mozilla Support+5Mozilla Support+5 Mozilla Support+1Mozilla Support+1

Participation in Shield Studies

To participate in these studies, ensure that the setting "Allow Firefox to install and run studies" is enabled. When a study becomes available, eligible users are automatically enrolled. In cases where additional data collection is required beyond the default policy, Firefox will prompt users for explicit consent, detailing the data to be collected.

Viewing and Managing Studies

You can view your current and past study participation by typing about:studies into the Firefox address bar. This page lists all studies, allowing you to review their status.Mozilla Support+6Mozilla Support+6Mozilla Support+6 wiki.mozilla.org+7Mozilla Support+7Mozilla Support+7

Opting Out of Studies

To opt out of a specific study:

Navigate to about:studies.
Locate the study you wish to leave and click the Remove button next to it.

To opt out of all studies:

Click the menu button and select Settings.
Select the Privacy & Security panel.
Scroll down to the Firefox Data Collection and Use section.
Uncheck the box next to "Allow Firefox to install and run studies."

For enterprise environments, administrators can disable Shield Studies across all installations using the DisableFirefoxStudies policy via the Policy Engine.

grahamperrin

vimanuelt LibreWolf and Ungoogled-Chromium appear to be the most suitable alternatives to Firefox …

Are we to ignore the PDF-related bug?

vimanuelt

I must have overlooked that point. Firefox’s built-in PDF viewer, PDF.js, prioritizes security and web compatibility over full PDF feature parity.

As an aside, I rarely read PDFs in a browser. I prefer to download them and use dedicated applications that support annotation.

vimanuelt

Dedicated applications like Okular or Xournal++ provide a much better experience.

Robin

Choosing a browser sounds good for those of us who are informed about browsers - which I imagine that most newcomers to GhostBSD might well be. But @grahamperrin makes a good point: You want a ready-to-go desktop, even if you're just "trying it out" in a Live or Virtual environment before installation. You read something and need to do a search of it before you opt for it and install the OS, you need some browser installed in order to do that.

Another thing I found irksome was after following instructions to install Brave on GhostBSD, I watched all this "Linuxy stuff" scroll by in the terminal window - including the dreaded systemd! I aborted it immediately and felt like I had irretrievably polluted my OS. So I re-installed and chose a browser strictly from the repositories so as to avoid all the "Linuxy stuff." The list of browsers to choose from should include only ones that are packaged for GhostBSD, whether Firefox, Librewolf, ungoogled-chromium, etc.

grahamperrin

From https://forums.ghostbsd.org/d/340/9:

try https://dagrs.berkeley.edu/sites/default/files/2020-01/sample.pdf and https://www.adobe.com/support/products/enterprise/knowledgecenter/media/c4611_sample_explain.pdf.

I did try those two at the time (Monday 2025-05-05 18:27) in Ungoogled Chromium in GhostBSD, I'm almost certain that there was – with GhostBSD – the slowness that I saw with FreeBSD-CURRENT.

Now, touch wood, no problem. Maybe it was fixed through the hundreds of package upgrades that came later in the day:

Re: https://pkg-status.freebsd.org/beefy18/build.html?mastername=main-amd64-default&build=p641386d44e51_s2a042fab4f9 it'll be some time before I can retest properly with an upgrade to port packages on CURRENT. (The previous upgrade was badly bugged.)

vimanuelt

Opting for Ungoogled-Chromium as the default browser appears to be a sensible decision.

I have implemented a dual-approach system comprising an installation ISO that includes only the base operating system, accompanied by a post-installation "Hello" application. This is the method currently employed in PolarisBSD. Unlike traditional installers, it functions as a network-based setup. While not especially fast, it affords users the flexibility to customize their desktop environment, should they wish to include one. Users transitioning from Linux may find this installation method somewhat inconvenient. However, I hoped the four-minute installation process would mitigate this issue. (For users who opt out of installing a desktop environment, the installation time is closer to two minutes.)

This approach also enables installation of GhostBSD on machines with as little as 1 GiB of RAM, although most modern web browsers do not perform well with such limited memory.

If users prefer a complete desktop experience with applications preinstalled, we will eventually need to raise the recommended RAM requirement to 8 GiB or more. I understand that some have requested a richer default application set. This does not personally affect me, as my systems typically have 32 GiB of RAM or more. Nevertheless, I maintain a laptop with 4 GiB of RAM to ensure that the latest ISOs remain bootable on older hardware. To support continued use of such machines, trimming the default application set remains essential.

grahamperrin

Thanks,

vimanuelt … trimming the default application set …

I'd expect a reduction in the size of the disk image, not necessarily a reduction in the minimum memory requirement for an installed system.

grahamperrin

vimanuelt Opting for Ungoogled-Chromium as the default browser …

"It's missing containers and overall has less privacy features available than firefox. …"

Firefox Multi-Account Containers is not the only extension that uses the technology …

vimanuelt

Your feedback has been valuable and is greatly appreciated. Maintaining GhostBSD on its current path as an out of the box, ready to use system appears to be the path of least astonishment for users.

vimanuelt

Eric approved the move from firefox to ungoogle-chromium as the default browser. I'll submit a patch.

grahamperrin

vimanuelt

Disappointing.

I would have preferred a decision based on logic and evidence.

grahamperrin

ericbsd thanks, I understand that it's not in code.

vimanuelt Eric approved the move from firefox to ungoogle-chromium as the default browser. …

That seems decisive. I gained the impression that you had approved ungoogled-chromium as the replacement for Firefox.

ericbsd … I have not tried UG Chromium …

Was the move, to something that you have not tried, approved by you, or not?

Robin

The other option, akin to Debian's "netinstall" is what I would try first, choosing Xfce, ungoogled-chromium, Geary or Evolution, libreoffice, and a very minimal set of applications for school and work.

vimanuelt

Robin
We have a netinstall available, but it's not publicly accessible. I prefer to keep certain things private, especially when Eric isn't fond of them. I genuinely want to contribute to the project, but not all of my ideas align with its direction, so I often explore them in other distributions. :-)

vimanuelt

grahamperrin
Ah yes, you were advocating Pale Moon earlier. ;-)

The good news is that users can easily install and remove applications to meet their preferences. :-)

vimanuelt

grahamperrin
Ungoogled-Chromium goes to greater lengths than LibreWolf to remove upstream telemetry, but both projects face limitations from their respective upstream codebases (Mozilla Firefox and Google Chromium). Neither can promise absolute isolation from all data transmission, though they are among the best options for privacy-conscious users today. :-)

grahamperrin

vimanuelt Ah yes, you were advocating Pale Moon earlier. ;-)

Please, don't mislead people.

grahamperrin

vimanuelt users can easily install and remove applications

Users can easily install Ungoogled Chromium.

« Previous Page Next Page »