Firefox [ Edit ]

Mozilla's web browser. Advertised as privacy-focused, but still doing privacy-compromising things out of the box. I strongly recommend that you tweak and sandbox it.

Note: Making Firefox more privacy friendly (either yourself or using some other already tweaked fork) will break some pages. My recommendation is to create a separate profile (type about:profiles in the address bar or start Firefox with firefox -P command), which you'll use for untrusted browsing. For "more trusted" websites, you can use a separate, less-restricted profile/browser.

Tweaking

Arkenfox user.js template is the best starting point for tweaking Firefox.

For a quick-start, you can just download latest version into your new profile directory: wget -O ~/.mozilla/firefox/PROFILE_DIR/user.js https://raw.githubusercontent.com/arkenfox/user.js/master/user.js

Sandboxing

You should sandbox any application which you don't trust completely, especially web browsers, especially Firefox and especially if you plan to leave JavaScript enabled by default.

Even simple forms of sandboxing are better than nothing, check Sandboxing for more info.

As an example starting point for bubblewrap, you can use this wrapper:

bwrap \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/share /usr/share \
--ro-bind /etc/fonts /etc/fonts \
--ro-bind /etc/machine-id /etc/machine-id \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--dev /dev \
--dev-bind /dev/dri /dev/dri \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
--proc /proc \
--tmpfs /tmp \
--unshare-all \
--share-net \
--hostname SANDBOX \
--setenv HOME /home/example \
--setenv GTK_THEME Adwaita:dark \
--setenv MOZ_ENABLE_WAYLAND 1 \
--setenv PATH /usr/bin \
--die-with-parent \
--new-session \
--ro-bind /opt/firefox /opt/firefox \
--bind $HOME/.mozilla $HOME/.mozilla \
--bind $HOME/Downloads $HOME/Downloads \
--dir /run/user/"$(id -u)" \
--ro-bind /run/user/"$(id -u)"/pulse /run/user/"$(id -u)"/pulse \
--ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0
/opt/firefox/firefox "[email protected]"

See also: