UK Government's documentation on Firefox security

The UK government's National Technical Authority for Information
Assurance (CESG), which is part of GCHQ, publishes[0] documentation on
how to configure and secure each of the major browsers, and what
security shortcomings it considers them to have. The document (called
"End User Devices Platform Security Guidance") for Firefox is here:

https://www.gov.uk/government/publications/browser-security-guidance-mozilla-firefox/browser-security-guidance-mozilla-firefox

It was published at the end of November last year, so parts are out of
date, but it gives the following Significant Risks when using Firefox in
a government/enterprise context. Perhaps these are things we should
consider fixing, as they are likely to be issues for other governments
and enterprises as well, and some seem easy to add a pref for?


1) Mixed content blocking can be overridden on a per-page basis

-- Can we add a pref to disable this?

2) No support for certificate pinning

-- This was https://bugzilla.mozilla.org/show_bug.cgi?id=787133,
   checked in before they published the document, but it hadn't
   made it to production. So this one's done.

3) No sandboxing (for web content or plugins)

-- This is e10s

4) Can't disable addon installation, and addons can be silently evil

-- Can we add a pref to disable this?

5) Safe Browsing warnings are bypassable

-- Can we add a pref to disable this?

6) Can't disable Basic/Digest Auth over HTTP

-- UNCO bug about warning:
     https://bugzilla.mozilla.org/show_bug.cgi?id=1185145
   UNCO bug about turning off altogether:
     https://bugzilla.mozilla.org/show_bug.cgi?id=966754

7) No notification if browser updates fail

8) No separation between Internet and Intranet pages

8b) no built-in XSS protection

8c) old and vulnerable plugins needed in an Intranet can be invoked by
    Internet content

-- My understanding is that making this distinction accurately is Hard.
   Is that true? What does IE do?

9) No security event logging


Gerv

[0] https://www.gov.uk/government/collections/browser-security-guidance