1460569 - Ability to opt out of group policy enforcement

Status: RESOLVED WONTFIX

(Firefox :: Enterprise Policies, enhancement)

Description

[Marti Raudsepp]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180503152818

Steps to reproduce:

I found out by surprise that Firefox 60 has implemented support to enforce group policies. I appreciate that Firefox should make it easy for administrators to manage configuration for many workstations easily. But there's the flip-side that in larger corporations, administrators like to restrict users "just because they can", regardless of whether such restrictions actually end up benefiting security.

In environments like libraries, where users are extremely restricted to begin with, that is perfectly fine.

But *if* a user has sufficient permissions on the computer to install a custom build of Firefox (they could circumvent the policy anyway), I believe Firefox should allow the user to opt out of administrator policies. Otherwise it's just a silly broken by design DRM-like antifeature implemented by Firefox.

In case people need reminding, Mozilla has a mission statement:
> An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent.

Note how it does not say "enforcing corporate interests and empowering administrator control".

Comment 1

[Sylvestre Ledru [:Sylvestre]]

I am not sure to understand the point of this bug.

Administrators have been doing such things for a very long time with Firefox with tools like https://mike.kaply.com/cck2/ or directly with autoconfig https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig)
GPO being a de-facto standard on Windows, this will just make the life of sysadmin either (and providing a better experience to users).

Comment 2

[Marti Raudsepp]

Correct me if I'm wrong, but the point is that even if I install Firefox myself, to a nonstandard location, with no administrator-provided files, it will still be restricted by Windows group policy, with no way to avoid it, other than using a custom build?

I agree that supporting group policy out of the box is a good idea, but there should be a way to override it if necessary for people who are power users.

Comment 3

[Mike Kaply [:mkaply]]

The scenario you have described is exactly why group policy exists; so that users can't install another copy of the application and not be managed. 

If you are a power user, you should ask your administrator to put you in a different group so you aren't as restricted.