I’ve found that the easiest way to live debug userChrome.css is to:

1. Open the browser toolbox,
2. Go to the style editor tab,
3. Write userChrome in the search box to find it,
4. Write CSS directly into the browser toolbox integrated editor.

The integrated editor reloads CSS changes as you write, even without saving.

Been using it for a couple of months now at work. It’s good.

I also appreciate how intuitively it works. I wasn’t aware of this feature when it first landed in developer edition, but after I accidentally created a group with drag and drop, the feature just clicked.

Alas, Firefox doesn’t allow changing any keybindings without modifying the source code. The bugzilla ticket about this is already 2 decades old.

Isn’t it already game over if malware can write into your hostfile? At least on Windows you need some elevated access for it, which means such malware could just read/write the target program’s memory directly instead of resorting to clunky MitM.