Post by @dalias@hachyderm.io

RE: https://hachyderm.io/@dalias/113417575172813417

I had to manually remove the bad certs from Firefox today, which is what I expected but I was unclear why. Finally dug it up: my defense against Mozilla's backdoors in /etc/hosts:

Cassandrich

@dalias@hachyderm.io 2 yr. ago

Finally achieved empty tcpdump starting Firefox. Had to find and clear location.services.mozilla.com and push.services.mozilla.com from show-all in about:config. Then there were the following that are hard-coded, not appearing in about:config, for which /etc/hosts needed to be invoked:

firefox.settings.services.mozilla.com content-signature-2.cdn.mozilla.net prod.remote-settings.prod.webservices.mozgcp.net content-signature-chains.prod.autograph.services.mozaws.net

FFS do better.

1 Boost

1 Like

Cassandrich

@dalias@hachyderm.io 8 hr. ago

For folks who think getting bad root CAs removed is worth it and I made a mistake, here is a nice list of all the malicious things Firefox can deliver via RemoteSettings, which seemingly have no way to turn them off:

https://mozilla.github.io/remote-settings-permissions/

Cassandrich

@dalias@hachyderm.io 8 hr. ago

I'm not sure how LibreWolf and other forks handle this. Do they remove the Mozilla RemoteSettings backdoor?

Cassandrich

@dalias@hachyderm.io 8 hr. ago

And is there any more reasonable way to remove RemoteSettings than via blocking the domain in /etc/hosts?

khm

@khm@hj.9fs.net 7 hr. ago

yes. in policies.json, add "DisableRemoteSettingsAndAcceptSecurityConsequences": true to the policies: block

( for win/mac see the actual docs )

Cassandrich

@dalias@hachyderm.io 7 min. ago

@khm Thanks, I'd been meaning to setup policies.json.

Unfortunately, https://github.com/mozilla/policy-templates/issues/709

GitHub

Firefox mobile: Where to put policies.json · Issue #709 · mozilla/policy-templates

To what directory do I have to put it at android? Or isn't it supported yet? When will it be?