In a recent Tor security advisory, Roger Dingledine writes:
Consider disabling JavaScript (click the blue "S" beside the green onion, and select "Forbid Scripts Globally"). Disabling JavaScript will reduce your vulnerability to other attacks like this one, but disabling JavaScript will make some websites not work like you expect. A future version of Tor Browser Bundle will have an easier interface for letting you configure your JavaScript settings [11]. You might also like Request Policy [12]. And you might want to randomize your MAC address, install various firewalls, etc.
He makes a few other suggestions, like not using Windows and switching to a LiveCD such as Tails. My question, though, relates to the "etc." in Roger's statement that "you might want to randomize your MAC address, install various firewalls, etc." Besides disabling Javascript, installing RequestPolicy, and following Roger's other recommendations, what else can/should I do to harden Firefox?
As Roger states, "JavaScript is one big vector for attack, but many other big vectors exist, like css, svg, xml, the renderer, etc." Okay, so I should probably disable images and CSS then? Short of using a text-based browser like Lynx, what can I do?
I am less concerned with linkability/fingerprinting than I am with security, i.e. maintaining the anonymity of my IP address by not getting owned.
The security advisory quoted above also touches on stuff Tor users can do at the OS level to increase security. This could involve using Tails or possibly a VM-based approach (examples are Qubes or Whonix). There are plenty of other OS options, like OpenBSD, Hardened Gentoo, and so on, each with its pros and cons.
Let's just focus on Firefox, though - regardless of OS.
Even then, this is a pretty broad question. Maybe it should be split into more than one question?