I found I had better results with D2, sadly not as ubiquitous as Mermaid.

We host a website in Canada (physical server hosting VMs in a Canadian DC) and with the ongoing trade-war we do whatever we can to avoid anything US-based tech such as Cloudflare. So far we use Anubis to protect our services from scraping and it's been a decent experience.

And it does 1/10 of it.

> locks you into a single vendor

You can allow multiple attestations GUIDs (AAGUIDs) if you want, you're not limited to the larger hardware providers (ie: Yubico).

So far the only place I encountered this is within our Microsoft Entra setup, where we have to option to allow all types of Passkeys (hardware-backed, cloud synced, non-attested, etc).

Also in some scenarios you might be required to limit the enrollment of Passkeys on hardware devices that are FIPS-compliant. Having a list of AAGUIDs to enforce this makes sense.

There are already some controls in place available, but they are often platform-specific (GPOs on Windows, Configuration Profiles on macOS) than can be pushed through Active Directory, Intune, Ivanti, etc, but this does remove some friction and configuration gaps where you can centrally manage those policies in a single location.

You'll still likely need to push something like an enrollment token for Chrome (ex: https://support.google.com/chrome/a/answer/9301891 ), but then the rest is done through the Firefox Enterprise console.

I thought you could push a non user writable config that could control pretty much everything since... Forever?

Along with that, push extensions to add DLP bits, etc

There is, but the configuration and deployment methods are platform-specific, so you'd need to maintain one set of GPOs, another set of .mobileconfig, etc

Then if you need to change something, you need to change those individally per platform.

With this you can set it up and centrally manage them from a single dashboard, the only thing you need to do is to do the platform-specific enrollment once.

I'm glad Mozilla is trying to find a way to monetize the platform in exchange of providing a tool to better manage the browser at the enterprise level.

You used to be able to also do a .conf or .js file and iirc the only thing different between platforms was the path.

I think it's policies.json and mozilla.cfg

Yes, Firefox was already configurable through enterprise policies that an admin could deploy.

Firefox Enterprise tries to remove as much friction there as possible, and adds a pile of features like deployment monitoring, policy changes while running, device posture checks, various security features like SIEM logging, etc.

The other part is that you get the option to run all supporting services entirely on premise, so the browser never has to "phone home" to us, but you still have working updates, sync support, and so on.

One really nice thing I've never seen anyone do is some kind of admin triggered internet test for remote workers. Could be a very basic extension even that did a quick test for latency, throughout, packet loss, etc. Would be especially great if it could test normal internet (WAN) and direct access to the enterprise network (on prem or some cloud resource over whatever protocol is in use)

Noted! Thanks for the suggestion.

Cloudflare Access does that. I suspect other SASE/zero trust solutions probably also do (iirc it does everything you've named)

As an extension ?

Definitely would be doable, since PleasantPassword uses a modified KeePass client that's able to talk with their server.

EDIT: Apparently they're rebranding to KeePass Hub.

I'm happy enough with my GL.iNet router.

Guess I'll just stick to .local

I think at this point the issue is between the buyer and the reseller. If I bought a CPU and I wasn't able to play a game, I'd ask for a refund and ship back the CPU to them at their expense.

We'll eventually need something like CarFax where you can look for hardware bans for multiple softwares and games before you purchase a part..