"Allegedly, these policies are also supported on Windows via Group Policy and MacOS using plist files. I wouldn’t know, since I use a real operating system."
Real 2006 Slashdot energy here. Very rare to see in the wild these days.
If you go from using Linux for years to having to use an OS like macOS or especially Windows, it really does feel like using a computer with padded walls and safety scissors so you don't hurt yourself. You do get used to the limitations eventually, but for technical users it's a pretty noticeable step down in terms of how you may use and configure your own system. Calling them "not real operating systems" is definitely a little cheeky, but it resonates, and isn't out of character for a blog post about configuring your browser with JSON overrides.
> … for technical users it's a pretty noticeable step down in terms of how you may use and configure your own system
It’s such a frustrating experience on both ends—I use macOS for most of my work because I like the hardware it ships on, but it is so annoying to not be able to, like, use a different window manager (hacky accessibility API systems notwithstanding).
On the other hand I’ve probably burnt weeks troubleshooting and configuring different compositors/window managers on Arch (and STILL don’t have the setup of my dreams), so it’s frustrating on that end too.
It's funny, I use OSX as my daily driver, and going over to Windows is painful - probably as painful as it is for OP to go from whatever they're using to OSX.
I've been daily-driving desktop Linux for close to 15 years, hadn't touched Windows in about 10 years, and then got a job a few months back that requires Microsoft-everything.
"Primitive" is the word that comes to mind every day. There's a steady drum-beat of aggravation and missing features and bad design decisions. I lose probably close to thirty minutes of daily productivity to the Microsoft tax.
I don't understand your sentiment - not sure about MacOS, but I'd definitely argue that Windows was much more of a real OS in 2006. These days, it's basically indefensible.
It's an intellectually lazy "No true Scotsman." I personally clicked away from the page as soon as I read that line because the author lost my trust in that moment.
It's really not that intellectually lazy. When you're stuck in the quagmire of daily driving (modern) Windows you almost don't even notice how bad it is, but after being away from it you can come to see how truly patronizing, obnoxious, and asinine the whole OS has become. You get to a point where you see people getting screwed by Windows and complaining about it, and you just think "you're doing this to yourself."
I run a local DNS server that has its own blocklists, internal DNS records, etc. I imagine most people who might bother to deploy an enterprise browser policy do something similar.
Unless you're running your own local DoH server, it's just privacy theater, and not even good theater. It's the same bogus argument made in favor of retail VPNs. "Encrypt your traffic so your ISP can't spy on you!" Meanwhile failing to recognize that you're just moving the spying agency to some free service owned by--oh, let's look at the top providers... Cloudflare (not great), Brave (advertising company), Google (Bad)... Need I go on?
Perhaps you've forgotten that old adage: if you're not the customer, you're the product.
Security theatre is far too strong. It’s not perfect but it does solve real world, actively exploited privacy flaws, such as ISPs monitoring and selling insights from DNS, NXDOMAIN hijacking, etc.
Your internet traffic is all MITMd by Cloudflare anyway. Using their DNS barely moves the needle.
I use user.js to harden the browser settings but this is local to the user's account. It's good that someone is describing using policies.
I ended up a bunch of trial and error while looking at copies of the prefs.js file in the browser profile folder to determine what settings correlate to settings in the browser, when I couldn't search for the feature.
With DNS-over-HTTPS, your DNS queries are sent to Cloudflare (by default; it is configurable). Without it, your DNS queries are sent to your ISP. The question is which company you trust more with your DNS queries.
Given how often ISPs and/or countries do stupid things with DNS, I think DNS-over-HTTPS is a reasonable default. But some people don't trust Cloudflare with that info, so they use the ISP option instead.
I think most people use an enterprise MDM like JAMF or Intune, but manually creating the file at /Library/Managed Preferences/com.google.Chrome.plist might also work.
If you have write permission to the folder, you can do this on a corporate machine, but your IT department probably has a preferred configuration that will overwrite your changes.
I concur with the misuse of the word "slop". But this is almost exactly how i setup my browser anyway and since I only do that on once i am nor sure how useful this is actually... maybe for setting up systems for others?
Yeah, I was gonna say. These are reasonable defaults for a technical user and I do much of the same, but it's also reasonable for many users to want the features that are being disabled here. It's not slop just because the author personally does not want them.
Slop. "I use a real operating system" but lists Chrome, as if that was any better in its own category; mentioning policies that are long dead (Cloud Print? Pocket? Really?) or harmless (DoH). Ironic.
"Allegedly, these policies are also supported on Windows via Group Policy and MacOS using plist files. I wouldn’t know, since I use a real operating system."
Real 2006 Slashdot energy here. Very rare to see in the wild these days.
There are some wandering sages who still practice the old ways.
If you go from using Linux for years to having to use an OS like macOS or especially Windows, it really does feel like using a computer with padded walls and safety scissors so you don't hurt yourself. You do get used to the limitations eventually, but for technical users it's a pretty noticeable step down in terms of how you may use and configure your own system. Calling them "not real operating systems" is definitely a little cheeky, but it resonates, and isn't out of character for a blog post about configuring your browser with JSON overrides.
> … for technical users it's a pretty noticeable step down in terms of how you may use and configure your own system
It’s such a frustrating experience on both ends—I use macOS for most of my work because I like the hardware it ships on, but it is so annoying to not be able to, like, use a different window manager (hacky accessibility API systems notwithstanding).
On the other hand I’ve probably burnt weeks troubleshooting and configuring different compositors/window managers on Arch (and STILL don’t have the setup of my dreams), so it’s frustrating on that end too.
I have to use macOS for work. The window manager is so bad it makes me feel like a crazy person. They actually ship it like this on purpose?
It's funny, I use OSX as my daily driver, and going over to Windows is painful - probably as painful as it is for OP to go from whatever they're using to OSX.
I've been daily-driving desktop Linux for close to 15 years, hadn't touched Windows in about 10 years, and then got a job a few months back that requires Microsoft-everything.
"Primitive" is the word that comes to mind every day. There's a steady drum-beat of aggravation and missing features and bad design decisions. I lose probably close to thirty minutes of daily productivity to the Microsoft tax.
I've been sincerely surprised at how bad it is.
I don't understand your sentiment - not sure about MacOS, but I'd definitely argue that Windows was much more of a real OS in 2006. These days, it's basically indefensible.
It's an intellectually lazy "No true Scotsman." I personally clicked away from the page as soon as I read that line because the author lost my trust in that moment.
It's really not that intellectually lazy. When you're stuck in the quagmire of daily driving (modern) Windows you almost don't even notice how bad it is, but after being away from it you can come to see how truly patronizing, obnoxious, and asinine the whole OS has become. You get to a point where you see people getting screwed by Windows and complaining about it, and you just think "you're doing this to yourself."
Don't use regular Firefox. Use Waterfox or LibreWolf which rip all this out with prejudice. Not worth the endless rat chase of disabling settings.
As for Chromium browsers, none of them are safe.
Most of these are not good choices for most people.
And "I use a real operating system" alongside a list of seven different non-obvious and seemingly arbitrary config locations is pretty funny.
Why DNS over HTTPS?
Not sure if i'm missing something, but i don't consider privacy protection slopware.
I run a local DNS server that has its own blocklists, internal DNS records, etc. I imagine most people who might bother to deploy an enterprise browser policy do something similar.
Unless you're running your own local DoH server, it's just privacy theater, and not even good theater. It's the same bogus argument made in favor of retail VPNs. "Encrypt your traffic so your ISP can't spy on you!" Meanwhile failing to recognize that you're just moving the spying agency to some free service owned by--oh, let's look at the top providers... Cloudflare (not great), Brave (advertising company), Google (Bad)... Need I go on?
Perhaps you've forgotten that old adage: if you're not the customer, you're the product.
Security theatre is far too strong. It’s not perfect but it does solve real world, actively exploited privacy flaws, such as ISPs monitoring and selling insights from DNS, NXDOMAIN hijacking, etc.
Your internet traffic is all MITMd by Cloudflare anyway. Using their DNS barely moves the needle.
> Disables all extra functionality (Pocket
Wasn't Pocket discontinued and no longer exists?
Or just use LibreWolf. I've been using it for quite a while now and it has been great.
Librewolf is Firefox with user-respecting default settings. It even includes and enables uBlock Origin.
Presumably the Google money is what keeps Firefox from doing the same.
I use user.js to harden the browser settings but this is local to the user's account. It's good that someone is describing using policies.
I ended up a bunch of trial and error while looking at copies of the prefs.js file in the browser profile folder to determine what settings correlate to settings in the browser, when I couldn't search for the feature.
The firefox bit has these:
> Disables native privacy and anti-tracking features
> Disables DNS-over-HTTPS
Why?
I prefer to let uBlock handle all the blocking. Also I run my own DNS server where I have my own blocklists and internal records etc.
With DNS-over-HTTPS, your DNS queries are sent to Cloudflare (by default; it is configurable). Without it, your DNS queries are sent to your ISP. The question is which company you trust more with your DNS queries.
Given how often ISPs and/or countries do stupid things with DNS, I think DNS-over-HTTPS is a reasonable default. But some people don't trust Cloudflare with that info, so they use the ISP option instead.
Both are reasonable choices.
With DNS-over-HTTPS, that is only for Firefox. Chrome doesn't do that.
Interesting! More reading here: https://blog.chromium.org/2020/05/a-safer-and-more-private-b... Looks like they try to choose a D-o-H provider that is associated with your plain DNS provider, instead of just jumping straight to Cloudflare.
Yup, iirc Mozilla made a deal with Cloudflare to... not do that.
My guess for privacy and anti-tracking is that trying to resist fingerprinting is, ironically, very fingerprintable.
I have been using https://helium.computer/ as a sane default of ungoogled chromium and I like it a lot
Anyone know where to put the policy file on MacOS? And can you do this even on a corporate machine?
I think most people use an enterprise MDM like JAMF or Intune, but manually creating the file at /Library/Managed Preferences/com.google.Chrome.plist might also work.
If you have write permission to the folder, you can do this on a corporate machine, but your IT department probably has a preferred configuration that will overwrite your changes.
In short: Ask your system administrator.
I concur with the misuse of the word "slop". But this is almost exactly how i setup my browser anyway and since I only do that on once i am nor sure how useful this is actually... maybe for setting up systems for others?
I find it most useful for a shared family computer with multiple users, but I also appreciate any type of config-as-code where possible
Yeah, I was gonna say. These are reasonable defaults for a technical user and I do much of the same, but it's also reasonable for many users to want the features that are being disabled here. It's not slop just because the author personally does not want them.
Multiple machines, multiple instances or profiles
> Disables DNS-over-HTTPS
Why though?
One man's bloat is another man's feature.
(Sidenote: Over/misuse of the word "slop")
Slop. "I use a real operating system" but lists Chrome, as if that was any better in its own category; mentioning policies that are long dead (Cloud Print? Pocket? Really?) or harmless (DoH). Ironic.
“I wouldn’t know, since I use a real operating system.” aaaand stop reading there. No thanks.