NoScript is unnecessary because browsers can block/allow Javascript natively (without any extension) per-site. Using similar “privacy/security-enhancing extensions” is a wrong approach and is a so-called badness enumeration.
Yeah, that person is clearly oversaturated on security and their priorities are shifted towards security exclusively. They also mentioned disabling JIT. Like, tell me: among the general population, who the f*** would deliberately degrade their browser UX by disabling JIT, which heavily slows down browser’s performance (especially on Android, as per my tests)? The most annoying aspect of disabling JIT for most people would be the page loading delay. Or, simply put: with JIT disabled, users will have to wait much more until their page gets rendered.
Disabling JIT for most users = a giant degradation of browser experience, and a very tiny, maybe even impalpable security benefit, because the chance of an average user getting exploited via a JIT compiler vulnerability is very low. We shouldn’t say “I only recommend Edge due to MDAG, also disable JIT cuz sekuritee! ”, but we should take into consideration in what environments/under what circumstances we should use MDAG and disable JIT. Both MDAG for Edge and JIT are not applicable for casual/general web-browsing.
We shouldn’t get too security-frenzied here and just ignore all the privacy- and telemetry-related concerns (by ‘telemetry’ I mean the bad kind of telemetry, that which is not used for the benefit of the user). We should instead find ‘the golden mean’ between privacy and security. MDAG does nothing for most user’s security. For it to be doing something, one should configure a whitelist of trusted websites for themselves, which will run without MDAG, and all other websites, in turn, will run in an untrusted mode — in MDAG, and this all is extremely bothersome and ridiculously unnecessary. Otherwise there’s no use for it for the overwhelming majority, except for an enterprise environment, where it can really be necessary.