Pretty sure I've been using firejail ever since you (fig) told me about it.

isnt that hilarious? i thought i heard about it from you! but youre probably right though. i wonder who recommended it to me... probably the guy from my forum. (no, no, old forum. not up anymore.)

well, whichever one of us started that, i still think firejail is a great idea. what would be bad is letting people think they have some kind of bulletproof shield when the weaknesses are known. like it probably will stop bullets-- but only up to a certain caliber.

when they sell/promote security solutions, they often focus on just the capabilities. when you look for/need security solutions, you really need to be told both the capabilities and the limitations. this disparity is partly why users know so little about whats safe. (also, its probably true that most dont care, thats not really unfair to say.)

There's also sandboxy, which I know even less about and have never tried. Has anyone here used it?

im not dissing the kernel i use daily either, but im aware of the advantages (and the downsides) of the bsd kernel. (downsides: convenience. only one i know of, s'why i use the linux one.)

i wouldnt tell people "dont use firejail" and i dont think anybodys said that yet, simply use it and know what its good for (and not good for.) fsr is an advocate of it from what i can tell, and i figure his reasons are good enough. pointing out the limitations is good too, like when you download tor and it says "and this is what tor does not do..." a very important side of things when you do stuff for security reasons.

In terms of Palemoon tips, while I'm using it a lot less these days (solely because of webkit limitations), the biggest asset is researching, trying new plugins, and if they break, research any alternatives.  One of the best plugins is Palemoon Commander, which gives you access to an incredible amount of security and privacy options.  You can also make most of the same tweaks as you could with firefox in about:config.

Unfortunately, don't expect too much, because mainstream Firefox is completely changing, and it's disincentivizing past addons' developers from continuing backward compatibility; uMatrix, which offers script-blocking utilities, no longer works, and I'm getting the sense that noscript compatibility has died as well -- all of which is a shame.  That coupled along with trivial disputes between Moonchild Studios and other distributions, including openbsd, and I'm not sure I see much light at the end of Palemoon's tunnel.  There's another thread here about different browsers, if you'd like to see a comparison: https://dev1galaxy.org/viewtopic.php?id=1697

and if you throw in a good hosts file like the thread says, its even better because now youre totally blocking the worse known offenders who serve the scripts that do the naughty things that noscript could block and firejail may prevent from touching your computer. not bad!

heres the stuff that people miss though, when they run firejail and/or use a good hosts file but dont use noscript (or use yesscript instead):

* cross site vulnerabilities-- you have a rogue script or rogue site that is exploiting vulnerabilities between tabs-- hosts file helps some, firejail maybe none.

* firejailbreakers-- probably very rare if they exist, but noscript may prevent scripts from ever running that theoretically could break through firejail if they ran

* sites with random/dynamic subdomains-- these can totally circumvent host files in some instances. dfskndfcn-zckf95jn.adserver-bs.com

* sites that use ip addresses instead of dns, obviously. noscript will protect you and hosts wont.

you can use hosts.allow and/or hosts.deny (its been too long since ive tried this) to create a hosts whitelist instead of a scripts whitelist. no one is crazy enough to do that, but credit where credit is due to the hosts list-- its a powerful thing if you want it to be, but the resolution isnt very high on it.

tl;dr: firejail is not a noscript replacement; but it is still awesome.

Where to turn, when pm starts slowing down & gets bloated?

xkill works a treat and when you reopen PM, the killed browser session pops up and asks if you want to restore.

I just download the .deb and dpkg it manually, works fine, no need for updater or any hoo-ha.

I used gdebi, figured it be updated since going that route. But I'm still on 27.8.1 with the latest at 27.9 so upgrading is
manual I guess.

Playing around with my anonsurf hobby, and checking to confirm ip changes - I kept seeing the same ol` user agent.
Grabbed the addon: User Agent Overrider: 'Override browser User-Agent string'. (latest updated pkg)
and that changs now to.
Where to turn, when pm starts slowing down & gets bloated?

ok, glad to hear someone else also noticed this. I had mixed thoughts on the noticeably lax default settings. On one hand, seemed like a sellout, a dumbing-down, catering toward "one-click install (and done)" users. On the other hand, if the dev doesn't cater to those users, the project winds up with "bad press word-of-mouth" from casual users who've tried it, and discovered that "it broke stuff" so uninstalled it without bothering to learn about adjusting profile settings.

There is also "containers"  like lxc which may interest you

Firejail does the same thing on firefox.  It is a feature not a bug.  Since information can pass both ways, it prevents access to your personal information.  It took me a while to adjust to it.

Indeed the sandbox only lets you access downloads. So if you want to upload something into your browser (e.g an email attachment) just drop it in downloads first. If you want to add more append whitelist <directory path> to /etc/firejail/palemoon.profile.

It's worth noting about Firejail that Steve Pusser also offers a newer version of firejail that's compatible with Palemoon (which releases quickly and has no LTS), so it's best to use his builds.

however when i download foo from www.foo.bar it ends up in my ~/Downloads

dont know what to make out of this

I use steve blacks hosts file as well, fantastic resource. Ive not heard of yhonay adblocks hosts, will have to check that out.

I also use a customized user.js and ublockO.

There was a good conversation @StevenBlack/hosts for this host.
Also updated frequently. I was there and caught it. Since then, i regularly use them

Of course they do not have the ability to block host on real time like proper ad-block with menu (right/left-click "block it!"),
But we can do pretty much blockages manually @hosts with IP aswell. Also this technique i find lighter for my browser or system resources.

Pale Moon for Linux release binaries
http://linux.palemoon.org/download/mainline/
I use ^this host for my copy, of course by choosing the architecture. Extract and run from a $HOME directory.

https://github.com/StevenBlack/hosts
https://github.com/Yhonay/antipopads
StevenBlack & Yhonay adblocks by using hosts@etc. Efficient enough for my purposes.

about:config?filter=/^javascript.enable/

Block javascript with double-click, enough to create a shortcut-link to Bookmar Toolbar.
Navigating with JavaScript disabled by set the value "false".

I use steve blacks hosts file as well, fantastic resource. Ive not heard of yhonay adblocks hosts, will have to check that out.

I also use a customized user.js and ublockO.