Aren't we in an era when you literally can build your own browser with everything just you need?
I have no knowledge in browsers developement. But in my field it became often easier to make your own tool\app then trying to use third party and make it work for you
We're exactly in that era of insanity that someone will use agent drivel development to cobble together a browser from existing browser sources in exchange for thousands of dollars of compute. Will it be standards conformant? No. Will it have security issues? Yes.
I mean you might be able to if you squint hard enough but the experience of using it would be absolitely piss poor so no. Realistically speaking AI is not even nearly that good yet and buildong a browser is an absolutely huge undertaking
My practical approach is to have a microvm for firefox and a bubblewrap “jail” for a firefox instance that runs on the host. Of course, the config options mentioned here are good too.
Knowing some folks that work on "major-browser-vendor" security in the era of Mythos-found-and-exploited vulnerabilities everywhere, the thought of running completely random untrusted Javascript on my machine has freaked me out to the point that I run NoScript on all of my machines now.
I've found NoScript actually very usable, as long as you allow yourself to be fairly liberal in marking domains "trusted." I only truly routinely visit a core 10-20 domains that require Javascript, and they're from "reputable" organizations (my bank, employer, etc.) so those all get marked "trusted" quickly and I don't worry about them going forward.
In the "long tail" of random things I click on from HN links, seeing a "You need to enable Javascript to view this app" message is actually a fairly good signal that I don't want to view that app (though you might be surprised how many websites are browsable comfortably---or even more comfortably!---without JS enabled).
One thing I wish NoScript supported was the ability to mark a domain as a "trusted page domain" in the sense of: "HTML served from this domain can load scripts from any domain" (rather than trust being assigned to the domain serving the script itself). Perhaps it has this feature and I just haven't found it.
The AdminVM is based on Fedora and has systemd, but it has no network and you you shouldn't run anything there. Unless you think that systemd is actively malicious and specifically targets Qubes, any vulnerabilities in it are not exploitable.
I do the same exact thing, except I disable JavaScript for all sites by default in uBlock Origin.
Same experience as you, also: many sites actually work well enough without JavaScript, and the ones that do require it to display anything make me pause and ask if I truly want to give that site the privilege of running code on my computer. Majority of the time the answer is no.
> also: many sites actually work well enough without JavaScript
Some work better without JS. The most common are information-based sites with a paywall or signup or whatever. The JS loads some huge wall over the content. Bonus, no cookie popups or another annoyances, and most ads are loaded with JS. Popups are getting ridiculous.
> Knowing some folks that work on "major-browser-vendor" security in the era of Mythos-found-and-exploited vulnerabilities everywhere
Is this a thing now? I hadn't seen any big browser vulnerabilities recently. Did I miss something? Or are the vendors not releasing horrifying bugs they found internally with AI fuzzing?
It's never clear what's "real" vs. marketing for the LLM companies, but Mozilla at least has made a big deal publicly about the "unprecedented" number of "latent security bugs" they've found using tools like Mythos:
To be honest, I'm not sure how many (if any) of them have actually been exploited, but in any case, it seems like the cost to at least find a vulnerability anymore has really dropped dramatically.
For a while, I used a firefox extension called "Temporary Containers" which would, as the name implies, create a temporary container for each site you visit. Combined with specifying some custom rules for ones you want to open in a specific container, that was a very convenient setup. But the extension at some point corrupted my firefox profile and has been unmaintained for a while so I didn't try again. I am not sure what happened and it may have been the combination of extensions that was the cause of that. Sadly, the author passed away, if I remember correctly, and it's been difficult to find maintainers for the project so I gave up on that.
You can still install that extension but from the reported issues the functionality and bugs were increasing with every new firefox version. And obviously that setup only helped with the cookie aspects and not necessarily any security issues from javascript and so on.
I would disable javascript JIT, pdf renderer, graphical acceleration, svg...
And use chromium based browser (I preffer Brave Origin). Using firefox for "secure browsing" does not make much sense in 2026! Mozilla has different priorities! Firefox development is under financed for several years now, and Firefox has weaker security model!
I have a handy little script called `chrome-new` which I use whenever I want to browse one of those few sites that struggles with Firefox. It just starts a clean Chromium with a throw-away profile, then deletes it when I close the browser.
Not sure - I have never used that flag! I like the idea of managing the profile dir myself, because then I know nothing will leak. For example, HSTS state persists across incognito, allowing fingerprinting. I don't know if --guest handles that differently (probably?) but this way, I can be sure.
I don't understand why author complains about Firefox performance. I use it everyday on laptop and mobile and I don't see the difference to the Chrome or Brave when I visit all my regular sites and all other I find on HN.
She has to play HTML 5 games or something to observe such difference
Interesting. From the response at bugzilla it seems that the feature is built on top of "FF accounts" (which I'll have to look into) and that the browser communicates directly with the Firefox sync servers. Meaning that only Mozilla would know your sync identity across containers. Did I get that right? Whether that's a privacy concern is something that I'll have to think about. What's your take?
For Firefox I recommend Cookie AutoDelete 3.8.2 addon. It is possible to configure it to erase all storage (cookies, indexeddb, localSorage and others) after chosen time (default 15s) after changing/leaving domain. It has many other useful options.
Another good addon is ClearURLs 1.27.3 which clears suspicious parameters of query strings on everything what's loaded by page. It sometimes break sites.
47 comments
[ 0.21 ms ] story [ 17.4 ms ] threadMullvad Browser is an example of just that, ready to go.
I've found NoScript actually very usable, as long as you allow yourself to be fairly liberal in marking domains "trusted." I only truly routinely visit a core 10-20 domains that require Javascript, and they're from "reputable" organizations (my bank, employer, etc.) so those all get marked "trusted" quickly and I don't worry about them going forward.
In the "long tail" of random things I click on from HN links, seeing a "You need to enable Javascript to view this app" message is actually a fairly good signal that I don't want to view that app (though you might be surprised how many websites are browsable comfortably---or even more comfortably!---without JS enabled).
One thing I wish NoScript supported was the ability to mark a domain as a "trusted page domain" in the sense of: "HTML served from this domain can load scripts from any domain" (rather than trust being assigned to the domain serving the script itself). Perhaps it has this feature and I just haven't found it.
https://noscript.net/
See also: https://forum.qubes-os.org/t/ultra-minimal-systemd-free-qube...
https://forum.qubes-os.org/t/alpine-linux-template-non-offic...
https://forum.qubes-os.org/t/systemd-inclusion-in-qubesos/22...
The AdminVM is based on Fedora and has systemd, but it has no network and you you shouldn't run anything there. Unless you think that systemd is actively malicious and specifically targets Qubes, any vulnerabilities in it are not exploitable.
Same experience as you, also: many sites actually work well enough without JavaScript, and the ones that do require it to display anything make me pause and ask if I truly want to give that site the privilege of running code on my computer. Majority of the time the answer is no.
Some work better without JS. The most common are information-based sites with a paywall or signup or whatever. The JS loads some huge wall over the content. Bonus, no cookie popups or another annoyances, and most ads are loaded with JS. Popups are getting ridiculous.
Is this a thing now? I hadn't seen any big browser vulnerabilities recently. Did I miss something? Or are the vendors not releasing horrifying bugs they found internally with AI fuzzing?
https://blog.mozilla.org/en/firefox/privacy-security/ai-secu...
https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...
To be honest, I'm not sure how many (if any) of them have actually been exploited, but in any case, it seems like the cost to at least find a vulnerability anymore has really dropped dramatically.
You can still install that extension but from the reported issues the functionality and bugs were increasing with every new firefox version. And obviously that setup only helped with the cookie aspects and not necessarily any security issues from javascript and so on.
And use chromium based browser (I preffer Brave Origin). Using firefox for "secure browsing" does not make much sense in 2026! Mozilla has different priorities! Firefox development is under financed for several years now, and Firefox has weaker security model!
This makes you identifiable across containers and subverts the whole idea.
So don't use sync.
Interesting. From the response at bugzilla it seems that the feature is built on top of "FF accounts" (which I'll have to look into) and that the browser communicates directly with the Firefox sync servers. Meaning that only Mozilla would know your sync identity across containers. Did I get that right? Whether that's a privacy concern is something that I'll have to think about. What's your take?
Another good addon is ClearURLs 1.27.3 which clears suspicious parameters of query strings on everything what's loaded by page. It sometimes break sites.
Why?
isn't firefox like far less secure than chromium? its sandbox pales in comparison, for one thing.
configuring trivalent on fedora-based distros is a good way to get the security benefits of chromium without all the adtech slop.
anybody using firefox should consider the patches by celenity at https://codeberg.org/celenity/Phoenix