tomosandb wrote:Hi again,
Will setting the security.sandbox to 0 and browser.tabs.remote.autostart.2 to FALSE seriously impact the security of firefox if I run it OUTSIDE of sandboxie?
I'm asking the question, cause I use firefox a lot exactly in that way and I wouldn't want to change settings permanently if it means compromising security in a serious way.
security.sandbox = 0 will definitely
decrease security without Sandboxie (possibly to a significant degree), as it disables Firefox's own somewhat-sandbox-like features and
possibly other
mitigations as well (ASLR, DEP, etc.). At least this can be inferred from the FFX wiki:
https://wiki.mozilla.org/Security/Sandbox
They haven't implemented a full sandbox yet, the maximum recommended level for this setting is 1 at this time, but Firefox's own Sandbox will become stronger and more restrictive over time,
leading to the levels 2 and 3 in the foreseeable future.
browser.tabs.remote.autostart = FALSE & browser.tabs.remote.autostart.2 = FALSE will not directly lower your security in my opinion. They only enable/disable the multiprocess architecture
(separate processes for web content, main program ans so on). So I would recommend trying to set these two variables to FALSE first, and
NOT to touch the sandbox level
if not absolutely necessary. For me, disabling multiprocess is enough for FFX 51 to work with sandboxie, I did not have to touch the sandbox level!
I think that over time, with Firefox's own sandbox evolving, its sandbox-like features and the multiprocess architecture will become completely dependent on one another (i.e. you won't be able to
have sandbox-like features in FFX without the multiprocess architecture also being enabled).
Bottom line: This whole issue will have to be looked at thoroughly by Sandboxie's developers and fixed with care.
It might be a bit tricky. So give them some time... 