This is nonsense

I regularly set up Firefox because I distro hop and like to buy cheap thinkpads. It takes like 30 seconds to do some quick toggles in the settings. Half of them are regular shit like tab behavior because I don’t like the defaults, and that’s okay. 15 seconds to install ublock. Couple minutes in about:config

Would it be kinda nice if all the defaults just happened to align with my specific wants and needs? Sure, I guess. But I’m an adult with agency and am happy to click some toggles.

If maintaining and updating a codebase didn’t take so much labor then it’d be cool to use obscure single-maintainer forks. But up-to-date security and non-google alternatives are orders of magnitude more important to me than having to click a few toggles once.

On my end no downvotes are showing at all. Probably something to do with federation or piefed’s spaghetti code

It’s been a few years since I was invested in this topic, but I think the “meta” for reconciling the tension between blocking tracking and unique fingerprinting was to, in some cases, spoof information rather than outright block it.

Tor browser does that by default, though a few years ago when I tried to use it as a daily driver it was too tedious thanks to cloudflare.

Most of my research regarding browsers was focused on computers. Now that Firefox mobile can run extensions some of this might be mitigated that way.

Blocking JavaScript unfortunately makes you super unique but the tradeoff is probably worth it imo. I don’t want every random site I visit to immediately run a bunch of code, especially third party nonsense. Even if it makes my traffic stand out.

For most threat models I suspect unrestricted JavaScript is more dangerous than the potential for fingerprint-based tracking. Or at least JavaScript is very likely to leak multiple unique data points, whereas a “blocks JavaScript flag” is just a single unique identifier.

Sandboxing and siloing can also mitigate some of the risk, and is relatively painless once implemented.

All of it comes down to threat model and motivation. You can probably get like 70% better privacy/security for 20% of the work, which is a good standard for a typical usecase/person. Install ublock, disable some of the higher risk and less useful tracking (websites don’t need my fucking battery and gyroscope).

Diminishing returns start to hit hard, in part due to the passive fingerprinting / active tracking tension, due to cloudflare, due to everyone around you that doesn’t give a shit. Anything on the other end of the risk spectrum should just be done without a smartphone in the vicinity, if possible.