ghacks user.js monster diff #208

pyllyukko · 2017-02-20T16:09:42Z

Based on @Roman-Nopantski's diff: https://gist.github.com/pyllyukko/f5184fbb51b5e340f5637adee582c4d9

STARTUP

0101: disable "slow startup" options
- WONTFIX: Doesn't seem that relevant
0102: set start page (0=blank, 1=home, 2=last visited page, 3=resume previous session)
- Commented out in the ghacks version
- Some aspects considered in document startup.homepage* prefs #218

GEOLOCATION

0201: disable location-aware browsing
- Should be covered by geo.enabled
- Also Mozilla bug's 689252 & 692927 talk that geo.wifi.* settings are not used anymore.
0202: disable GeoIP-based search results
- 00b102e
0203: disable using OS locale, force APP locale
0204: set APP local
0206: disable geographically specific results/search engines eg: "browser.search.*.US"
0207: set language to match
- d80e674
0208: enforce US English locale regardless of the system locale

QUIET FOX [PART 1]

QUIET FOX [PART 2]

BLOCK IMPLICIT OUTBOUND [not explicitly asked for - eg clicked on]

0603a: disable more Necko/Captive Portal
0607: stop links launching Windows Store on Windows 8/8.1/10
0608: disable predictor / prefetching (FF48+)
- WONTFIX: Should be handled by the network.predictor.enabled master switch

LOCATION BAR / SEARCH / AUTO SUGGESTIONS / HISTORY / FORMS etc

0808: disable history suggestions - PRIVACY (shoulder surfers, forensics/unattended browser)
- Should be covered by browser.urlbar.maxRichResults
0809: limit history leaks via enumeration (PER TAB: back/forward) - PRIVACY
- WONTFIX
0813: disable saving form data on secure websites - PRIVACY (shoulder surfers etc)
- Commented out in the ghacks version
0815: disable live search suggestions in the urlbar and toggle off the Opt-In prompt (FF41+)
- Shouldn't have any effect because of browser.urlbar.suggest.searches
0817: disable Jumplist (Windows7+)
- WONTFIX
0818: disable taskbar preview
- WONTFIX
0819: disable one-off searches from the addressbar (FF51+)
- Covered by browser.urlbar.autocomplete.enabled
- https://wiki.mozilla.org/QA/One-off_Searches_From_Awesomebar
- https://bugzilla.mozilla.org/show_bug.cgi?id=1180944
- https://people-mozilla.org/~shorlander/mockups/AwesomeResults/AwesomeResults-01.html
- https://people-mozilla.org/~shorlander/Flare/
0820: disable search reset (about:searchreset) (FF51+)
- WONTFIX

PASSWORDS

0904: how often in minutes Mozilla should ask for the master password (see pref above)
- Set security.password_lifetime = 5 #215
0906: ignore websites' autocomplete="off" (FF30+)
- 5e2e577 -> opposite :)
0907: force warnings for logins on non-secure (non HTTPS) pages
- 66f5ea1
0908: When attempting to fix an entered URL, do not fix an entered password along with it
0909: disabling for now (FF51+)

CACHE

1001: disable disk cache
- disk cache: add 2 commented out prefs for reference #214
1006: disable pages being stored in memory. This is not the same as memory cache.
1007: disable the Session Restore service completely
1008: IF you use session restore (see 1007 above), increasing the minimal interval between
1009: DNS cache and expiration time (default 400 and 60 - same as TBB)
1010: disable randomized FF HTTP cache decay experiments
1011: disable permissions manager from writing to disk (requires restart)
1012: disable resuming session from crash

SSL / OCSP / CERTS / ENCRYPTION / HSTS/HPKP/HTTPS

1215: disable Microsoft Family Safety cert (Windows 8.1)
1218: disable HSTS Priming (FF51+)
1220: disable intermediate certificate caching (fingerprinting attack vector)
- Commented out in the ghacks version
- WONTFIX: This is the single most important feature to keep the internets working, because people don't know how to configure their servers with proper certificate chains :(
- Fingerprinting Firefox users with cached intermediate CA certificates #219

FONTS

1402: allow icon fonts (glyphs) (FF41+)
1404: use more legible default fonts
1405: disable woff2
1406: disable CSS Font Loading API
1407: remove special underline handling for a few fonts which you will probably never use.
1408: disable graphite which FF49 turned back on by default

HEADERS / REFERERS

1601: disable referer from an SSL Website
- Remove network.http.sendSecureXSiteReferrer #190
- Tweaking Referrers For Privacy in Firefox
1602: DNT HTTP header - essentially USELESS - default is off. I recommend off.
- Commented out in the ghacks version
1605: referer, HOW to handle cross origins
- Commented out in the ghacks version
1606: referer, WHAT to send (limit the information)
- Commented out in the ghacks version

PLUGINS

MEDIA / CAMERA / MIKE

UI MEDDLING

2202: UI SPOOFING: disable scripts hiding or disabling the following on new windows
2203: POPUP windows - prevent or allow javascript UI meddling
2204: disable links opening in a new window

SERVICE WORKERS

2301: disable workers API and service workers API
- c65632f
2302: disable service workers cache and cache storage
2303: disable push notifications (FF44+) [requires serviceWorkers to be enabled]
- Disable WebPush? #111
- Disable Dom Push #154
2304: disable web/push notifications
- Disable WebPush? #111

DOM & JAVASCRIPT

HARDWARE FINGERPRINTING

2504: disable virtual reality devices
- WONTFIX: Should be handled by the dom.vr.enabled master switch
2507: disable keyboard fingerprinting (FF38+) (physical keyboards)
- Keyboard fingerprinting #159
2509: disable touch events
2511: disable MediaDevices change detection (FF51+) (enabled by default starting FF52+)

MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY

FIRST PARTY ISOLATION (PFI)

These are commented out in the ghacks version

2698a: enable first party isolation pref and OriginAttribute (FF51+)
2698b: this also isolates OCSP requests by first party domain

COOKIES & DOM STORAGE

2704: set cookie lifetime in days (see above pref) - default is 90 days
2706: disable Storage API (FF51+) which gives sites' code the ability to find out how much space
2707: clear localStorage and UUID when a WebExtension is uninstalled

SHUTDOWN

2803a: include all open windows/tabs when you shutdown
2804: (to match above) - auto selection of items to delete with Ctrl-Shift-Del
2804a: include all open windows/tabs when you run clear recent history
2805: reset default 'Time range to clear' for 'clear recent history' (see 2804 above)

PERSONAL SETTINGS

26.2.2017: Disabled the rest of these as these are just personal preferences and have no security/privacy impact

Deprecated

Not checking...

The text was updated successfully, but these errors were encountered:

Thorin-Oakenpants · 2017-02-20T16:54:25Z

I know its a list of each numbered items, but a quite a few are inactive for a reason (I hope people don't get the impression these are all on!). You could probably tick or look at those off straight away (I only have them in mine for completeness and to deter people turning them on from bad advice, or they don;t fit our purpose yet). Then again .. it's like a Lolly Scramble, isn't it (the link: I mean the NZ/Aussie game, not that slang definition which sounds painful )

here's two I quickly spotted

1006: no need to disable rendered pages in memory (achieves nothing AFAIK)
2621: disable IPv6 (which is a bad idea)

Here's mine: arkenfox/user.js#10 (comment) :) I'm 8 done out of 18. How are you doing :) have fun

Hopefully this would also mitigate against ASLR^Cache (AnC) See: http://www.cs.vu.nl//~herbertb/download/papers/anc_ndss17.pdf

pyllyukko · 2017-02-20T18:33:23Z

Just indent with two more spaces below, e.g.:

* [x] Issue
  * Note

This is the default value

publicarray · 2017-02-20T22:46:05Z

@pyllyukko just letting you know that your last few commits are "unverified" because GitHub does not know about your new key.

pyllyukko · 2017-02-21T05:58:36Z

@pyllyukko just letting you know that your last few commits are "unverified" because GitHub does not know about your new key.

I know :/ It's because I created new subkey with ED25519 curves, and it's only supported by the very latest versions of GnuPG. Last time I tried, GitHub refused to update the key with that particular subkey. Need to try it again.

pyllyukko · 2017-02-21T16:55:20Z

Small update on the PGP issue. So in here it even states "EdDSA, except Ed25519". I queried GitHub on the issue and they sayd: "Ed25519 keys are likely to be supported in the future, but we don't have a timeline of when that may be."

In the meanwhile, you can check my signatures from the command line with recent enough GnuPG:

$ git log --show-signature
commit e6592f9b8c304eead1595b978f7663fcfa373532 (HEAD -> master, origin/master, origin/HEAD)
gpg: Signature made Tue 21 Feb 2017 12:17:27 AM EET
gpg:                using EDDSA key 6760F995F5DD2C1A5805744C8043380FC109A370
gpg: Good signature from "pyllyukko <pyllyukko@maimed.org>" [ultimate]
Primary key fingerprint: B284 21D6 03DE 0A1D 17AE  4415 78C2 DF2D 1A17 0CC6
     Subkey fingerprint: 6760 F995 F5DD 2C1A 5805  744C 8043 380F C109 A370
Author: pyllyukko <pyllyukko@maimed.org>
Date:   Tue Feb 21 00:17:11 2017 +0200

    security.dialog_enable_delay -> 1000
    
    This is the default value

Add additional documentation links Fixes item 2021 of #208

Thorin-Oakenpants · 2017-02-27T17:11:07Z

nvm, no one listens to me anyway

pyllyukko · 2017-02-27T17:30:30Z

I see you;'re dragging the chain on the monster diff :)

Where's the rush?

pref("browser.aboutHomeSnippets.updateUrl", ""); // ghacks: "https://127.0.0.1"
    pyllyukko should match .. use HTTPS re MiTM re as per TBB and discussions there over this in tor tickets

? I don't get it.

And you are inconsistent with data plain text thingie - see comment arkenfox/user.js#18 (comment) - I just matched TBB. I don't think it;s all that important

True.

but I think they were used as a null/zero-length string causes issues in linux? IDK

Not that I know of.

pyllyukko · 2017-04-03T20:23:18Z

@nodiscc: I tried to mark everything from #255 as done. It would be good to double check, that I didn't miss anything.

nodiscc · 2017-04-04T12:46:50Z

0340: disable experiments can also be marked as done. Other than that, everything looks fine. thanks

Thorin-Oakenpants · 2017-04-04T18:44:33Z

It's the line 7805 of the test output: Deprecated : browser.urlbar.maxRichResults.

Ahh .. had to fiddle with NS, uBo & uMatrix to get that part to load (I just looked at the commit listed at the top)

I assume this is your internal list of items to ignore, because clearly there are many items marked as "deprecated" that aren't, including ones in your js. I'm just pointing out that browser.urlbar.maxRichResults is actually deprecated so you can correct your js, not to ignore it (although I am not sure if it is still in ESR). At least you now know for the future.

nodiscc · 2017-04-04T18:57:15Z

What does that commit have to do with maxRichResults? ;)
I assume this is your internal list of items to ignore

Sorry, linking directly to line 7805 of the travis log did not work. The build script compares prefs found in user.js against prefs present in Firefox source. In latest firefox revisions this pref is no longer present (hence on line 7805 of https://travis-ci.org/pyllyukko/user.js#L7805 the script outputs Deprecated : browser.urlbar.maxRichResults)

clearly there are many items marked as "deprecated" that aren't, including ones in your js

Are there? Which ones? Note that this is an automated comparison of user.js with the latest known Firefox source code revision (unreleased FF version), so they might still be present in a specific version. These are the URLs we use to compare against. You can set SOURCEVERSION to something else (tag names found at https://hg.mozilla.org/mozilla-central/tags) to compare with a fixed version (eg. FIREFOX_AURORA_50_BASE for Firefox 50). Maybe we are missing a Firefox source file to compare against?

nodiscc · 2017-04-04T19:01:14Z

browser.urlbar.suggest.openpage = true

I'd rather set it to false as per policy to enforce the most hardened settings (in this case against shoulder surfing), but with a NOTICE: breaks tab switching from the URL bar. Then it will be easier to spot/change when wanting to tweak things for convenience. (Question/discussion: relaxed settings variant/branch #231)

Thorin-Oakenpants · 2017-04-04T19:15:37Z

Are there? Which ones?

Deprecated : browser.crashReports.unsubmittedCheck.enabled
Deprecated : privacy.clearOnShutdown.cache
Deprecated : privacy.clearOnShutdown.cookies
Deprecated : privacy.clearOnShutdown.downloads
Deprecated : privacy.clearOnShutdown.formdata
Deprecated : privacy.clearOnShutdown.history
Deprecated : privacy.clearOnShutdown.offlineApps
Deprecated : privacy.clearOnShutdown.passwords
Deprecated : privacy.clearOnShutdown.sessions
Deprecated : privacy.cpd.cache
Deprecated : privacy.cpd.cookies
Deprecated : privacy.cpd.downloads
Deprecated : privacy.cpd.formdata
Deprecated : privacy.cpd.history
Deprecated : privacy.cpd.offlineApps
Deprecated : privacy.cpd.sessions
Deprecated : privacy.resistFingerprinting
Deprecated : privacy.sanitize.sanitizeOnShutdown
Deprecated : privacy.sanitize.timeSpan

Do I need to list more? Something is clearly wrong if these are marked as actually deprecated by your script

ALSO: you are not taking into account hidden prefs which are not listed in these js files

nodiscc · 2017-04-04T19:46:18Z

Something is clearly wrong if these are marked as actually deprecated by your script

Thanks, it appears we are missing https://hg.mozilla.org/mozilla-central/raw-file/tip/browser/app/profile/firefox.js where these prefs are located.

add https://hg.mozilla.org/mozilla-central/raw-file/$$SOURCEVERSION/browser/app/profile/firefox.js to list of source files.

you are not taking into account hidden prefs which are not listed in these js files

Yes, some prefs are created at runtime by Firefox itself. Fortunatefely most of these are covered in Mozilla unit tests prefs files, which the script also considers; but it's possible we are still missing some of them. Do you have an example of a missing preference?

Thorin-Oakenpants · 2017-04-04T19:48:50Z

I don't know of any hidden prefs that aren't in tests - all the hidden ones we're using are maked as "(hidden pref)" in the ghacks js, so you could scrape that

EDIT: 29 of them (1 in the deprecated section)

PS: this also doesn't account for legacy code: eg, yup, I'll say it again :) .. browser.urlbar.maxRichResults because its still in the js :) .. seriously, test it (FF52+, not sure about earlier). It has no effect on the dropdown whatsoever.

nodiscc · 2017-04-04T20:01:30Z

Indeed preferences that are marked (hidden pref) in ghacks user.js can not be found in our copies of Firefox source files:

$ make downloadffprefs 
2017-04-04 21:54:28 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/toolkit/components/telemetry/datareporting-prefs.js [717/717] -> "-" [1]
2017-04-04 21:54:30 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/toolkit/components/telemetry/healthreport-prefs.js [547/547] -> "-" [1]
2017-04-04 21:54:32 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/security/manager/ssl/security-prefs.js [5802/5802] -> "-" [1]
2017-04-04 21:54:38 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/modules/libpref/init/all.js [245079/245079] -> "-" [1]
2017-04-04 21:54:42 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/testing/profiles/prefs_general.js [19377/19377] -> "-" [1]
2017-04-04 21:54:46 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-preferences.js [6579/6579] -> "-" [1]
2017-04-04 21:54:48 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/js/src/tests/user.js [1912/1912] -> "-" [1]
2017-04-04 21:54:53 URL:https://hg.mozilla.org/mozilla-central/raw-file/tip/browser/app/profile/firefox.js [77214/77214] -> "-" [1]


$ curl --silent 'https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/user.js' | grep 'hidden pref' | awk -F'"' '{print $2}' > ghacks-hidden.js

$ for line in $(cat ghacks-hidden.js); do grep "$line" sourceprefs.js >/dev/null || echo "hidden pref $line not found in Firefox source"; done

hidden pref browser.search.region not found in Firefox source
hidden pref javascript.use_us_english_locale not found in Firefox source
hidden pref toolkit.telemetry.unifiedIsOptIn not found in Firefox source
hidden pref datareporting.healthreport.service.enabled not found in Firefox source
hidden pref browser.selfsupport.enabled not found in Firefox source
hidden pref social.enabled not found in Firefox source
hidden pref services.sync.enabled not found in Firefox source
hidden pref network.dns.disablePrefetchFromHTTPS not found in Firefox source
hidden pref permissions.memory_only not found in Firefox source
hidden pref security.ssl.disable_session_identifiers not found in Firefox source
hidden pref security.nocertdb not found in Firefox source
hidden pref font.system.whitelist not found in Firefox source
hidden pref media.gmp-gmpopenh264.enabled not found in Firefox source
hidden pref dom.allow_cut_copy not found in Firefox source
hidden pref browser.tabs.remote.force-enable not found in Firefox source
hidden pref general.useragent.override not found in Firefox source
hidden pref general.buildID.override not found in Firefox source
hidden pref general.appname.override not found in Firefox source
hidden pref general.appversion.override not found in Firefox source
hidden pref general.platform.override not found in Firefox source
hidden pref general.oscpu.override not found in Firefox source
hidden pref ui.submenuDelay not found in Firefox source
hidden pref privacy.donottrackheader.value not found in Firefox source

identify where in Firefox source these preferences are created, whether they are still in use, and adapt the Makefile to detect them

Thorin-Oakenpants · 2017-04-04T20:14:54Z

So I guess I'm not useless after all :) You owe me a 🍺

That last one hidden pref privacy.donottrackheader.value not found in Firefox source is legacy. Francois told me.

nodiscc · 2017-04-04T21:51:50Z

Regarding privacy.donottrackheader.value: Searching for this string on DXR reveals that:

it is deprecated in recent revisions and replaced with privacy.donottrackheader.enabled, there's a check at https://dxr.mozilla.org/mozilla-central/source/browser/components/nsBrowserGlue.js#1735 which converts the legacy setting (3 possible values: don't decide, do not track me, please track me) to the new setting (2 values: don't decide, do not track me).
The Blame link on DXR shows that this was added in https://hg.mozilla.org/mozilla-central/rev/9a16137bc7b4 Tue, 28 Jan 2014 09:26:16 -0800 -- Change three-state DNT back to two state and update text. (https://bugzilla.mozilla.org/show_bug.cgi?id=1042135).
The commit milestone and bug target indicate Firefox 36.0a1. Since this user.js does not target Firefox <45, I suggest that we don't specify this setting.
However it can be stored in ignore.list to clear any possible confusion -> ignore.list: add deprecated privacy.donottrackheader.value #262

// Deprecated Do Not Track setting, Firefox <36, https://hg.mozilla.org/mozilla-central/rev/9a16137bc7b4
"privacy.donottrackheader.value"

So I guess I'm not useless after all :) You owe me a 🍺

Never said you were (I think? Sorry if I sounded rude in any way, English is not my native language). Have some. 🍺🍺🍺☕🍺🍺🍺☕🍺🍺🍺☕🍺🍺

Same investigation method can be applied to other prefs if needed. Eg. https://dxr.mozilla.org/mozilla-central/search?q=browser.search.region&redirect=false... There are definitely some prefs that are created/checked randomly through the code (eg https://dxr.mozilla.org/mozilla-central/source/dom/base/Navigator.cpp?q=general.oscpu.override&redirect_type=single#479). We can move this to a new issue. -> Moved #261

Edit: (Note that you can run make checknotcovered to see all detected Firefox prefs that are not covered by user.js. Outdated log for reference)

nodiscc · 2017-04-04T22:48:56Z

Re: browser.urlbar.maxRichResults, it seems we are also missing many prefs files in https://dxr.mozilla.org/mozilla-central/source/obj-x86_64-pc-linux-gnu/dist/bin/browser/defaults/preferences/ and https://dxr.mozilla.org/mozilla-central/source/browser/app/profile. Thanks!

add https://dxr.mozilla.org/mozilla-central/source/obj-x86_64-pc-linux-gnu/dist/bin/browser/defaults/preferences/debugger.js https://dxr.mozilla.org/mozilla-central/source/obj-x86_64-pc-linux-gnu/dist/bin/browser/defaults/preferences/devtools.js https://dxr.mozilla.org/mozilla-central/source/browser/branding/unofficial/pref/firefox-branding.js https://dxr.mozilla.org/mozilla-central/source/obj-x86_64-pc-linux-gnu/dist/bin/browser/defaults/preferences/firefox-l10n.js https://dxr.mozilla.org/mozilla-central/source/obj-x86_64-pc-linux-gnu/dist/bin/browser/defaults/preferences/firefox.js https://dxr.mozilla.org/mozilla-central/source/obj-x86_64-pc-linux-gnu/dist/bin/browser/defaults/preferences/webide-prefs.js https://dxr.mozilla.org/mozilla-central/source/browser/app/profile/channel-prefs.js those files are generated from:

nodiscc · 2017-04-05T00:08:37Z

More possibly "hidden" prefs sources to consider (requires some more research, move to other issue) -> Moved to Not all Firefox default preferences are detected by 'make tests' #261

Makefile: downloadffprefs: add Firefox source reference files from #208

As discussed in #208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

This is already disabled by default Relates to #208

As discussed in #208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

This is already disabled by default Relates to #208

TODO: offline-apps.allow_by_default Relates to #208

pyllyukko · 2017-10-08T09:40:19Z

@pyllyukko just letting you know that your last few commits are "unverified" because GitHub does not know about your new key.

FYI: It's working again.

claustromaniac · 2018-06-30T06:32:30Z

I don't mean to go off-topic, but I want to share with the folks here this tool I made for comparing user.js files, before [insert random asshole's name here] plagiarises it.

That's all. Keep up the good fight 👍

pyllyukko · 2018-06-30T07:57:52Z

I don't mean to go off-topic, but I want to share with the folks here this tool I made for comparing user.js files

Thanks!

As discussed in pyllyukko#208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

Gitoffthelawn · 2022-10-17T00:00:36Z

In the event that the link that @claustromaniac provided becomes invalid, here is the new official link to their Compare-UserJS tool:
https://github.com/claustromaniac/Compare-UserJS

pyllyukko mentioned this issue Feb 20, 2017

ghacks user.js #205

Closed

pyllyukko referenced this issue Feb 20, 2017

dom.disable_beforeunload -> true

fca0827

pyllyukko referenced this issue Feb 20, 2017

dom.enable_user_timing -> false

f37fceb

Hopefully this would also mitigate against ASLR^Cache (AnC) See: http://www.cs.vu.nl//~herbertb/download/papers/anc_ndss17.pdf

pyllyukko referenced this issue Feb 20, 2017

security.dialog_enable_delay -> 1000

e6592f9

This is the default value

Thorin-Oakenpants mentioned this issue Feb 21, 2017

ToDo: compare active values ghacks vs pyllyukko user.js arkenfox/user.js#18

Closed

15 tasks

pyllyukko referenced this issue Feb 21, 2017

Respect when sites state autocomplete=off

5e2e577

pyllyukko referenced this issue Feb 22, 2017

security.insecure_password.ui.enabled -> true

66f5ea1

pyllyukko referenced this issue Feb 22, 2017

media.getusermedia.audiocapture.enabled -> false

bdd9b15

pyllyukko referenced this issue Feb 23, 2017

Few more WebGL settings

b530c2f

pyllyukko referenced this issue Feb 23, 2017

dom.serviceWorkers.enabled -> false

c65632f

This was referenced Feb 25, 2017

disk cache: add 2 commented out prefs for reference #214

Closed

Set security.password_lifetime = 5 #215

Merged

Disable speech synthesis #216

Merged

pyllyukko pushed a commit that referenced this issue Feb 25, 2017

Disable speech synthesis

4459532

Add additional documentation links Fixes item 2021 of #208

pyllyukko referenced this issue Feb 26, 2017

GeoIP-based search -> "US"

00b102e

pyllyukko referenced this issue Feb 26, 2017

intl.accept_languages -> "en-US"

d80e674

nodiscc mentioned this issue Feb 28, 2017

Move the wiki to user.js comments or README #220

Closed

17 tasks

earthlng mentioned this issue Mar 9, 2017

discussion: redo 0800s location bar etc arkenfox/user.js#32

Closed

nodiscc mentioned this issue Mar 26, 2017

README: refactor addons section; other fixes; fix GEOLOCATION/QUIET FOX sections of #208 #255

Merged

pyllyukko assigned pyllyukko and unassigned pyllyukko Apr 3, 2017

pyllyukko added a commit that referenced this issue Apr 9, 2017

Merge pull request #257 from nodiscc/more-sourceprefs

1138174

Makefile: downloadffprefs: add Firefox source reference files from #208

This was referenced Apr 12, 2017

Not all Firefox default preferences are detected by 'make tests' #261

Closed

ignore.list: add deprecated privacy.donottrackheader.value #262

Merged

nodiscc mentioned this issue Apr 24, 2017

add various preferences to user.js/ignore.list: #267

Closed

pyllyukko added a commit that referenced this issue May 21, 2017

Removed browser.urlbar.maxRichResults

116d986

As discussed in #208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

pyllyukko added a commit that referenced this issue May 21, 2017

Disable Archive API

e629cda

This is already disabled by default Relates to #208

pyllyukko added a commit that referenced this issue May 21, 2017

Removed browser.urlbar.maxRichResults

ff9cbee

As discussed in #208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

pyllyukko added a commit that referenced this issue May 21, 2017

Disable Archive API

6e49ce4

This is already disabled by default Relates to #208

pyllyukko added a commit that referenced this issue May 26, 2017

browser.offline-apps.notify -> true

a6199e1

TODO: offline-apps.allow_by_default Relates to #208

pyllyukko referenced this issue Jun 27, 2017

Disable resource timing API

cd544fc

nodiscc mentioned this issue Dec 18, 2017

Improve the makefile #256

Open

7 tasks

ranisalt pushed a commit to ranisalt/user.js that referenced this issue Jul 18, 2018

Removed browser.urlbar.maxRichResults

1aa9362

As discussed in pyllyukko#208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

ranisalt pushed a commit to ranisalt/user.js that referenced this issue Jul 18, 2018

Removed browser.urlbar.maxRichResults

0d51f89

As discussed in pyllyukko#208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

ranisalt pushed a commit to ranisalt/user.js that referenced this issue Jan 21, 2019

Removed browser.urlbar.maxRichResults

4d299a3

As discussed in pyllyukko#208 The URL suggestion is controlled by browser.urlbar.autocomplete.enabled

pyllyukko closed this as completed Oct 15, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ghacks user.js monster diff #208

ghacks user.js monster diff #208

pyllyukko commented Feb 20, 2017 •

edited

Loading

Thorin-Oakenpants commented Feb 20, 2017

pyllyukko commented Feb 20, 2017

publicarray commented Feb 20, 2017

pyllyukko commented Feb 21, 2017

pyllyukko commented Feb 21, 2017 •

edited

Loading

Thorin-Oakenpants commented Feb 27, 2017 •

edited

Loading

pyllyukko commented Feb 27, 2017 •

edited

Loading

pyllyukko commented Apr 3, 2017

nodiscc commented Apr 4, 2017

Thorin-Oakenpants commented Apr 4, 2017

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

Thorin-Oakenpants commented Apr 4, 2017

nodiscc commented Apr 4, 2017 •

edited

Loading

Thorin-Oakenpants commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

Thorin-Oakenpants commented Apr 4, 2017

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 5, 2017 •

edited

Loading

pyllyukko commented Oct 8, 2017

claustromaniac commented Jun 30, 2018 •

edited

Loading

pyllyukko commented Jun 30, 2018

Gitoffthelawn commented Oct 17, 2022 •

edited

Loading

ghacks user.js monster diff #208

ghacks user.js monster diff #208

Comments

pyllyukko commented Feb 20, 2017 • edited Loading

STARTUP

GEOLOCATION

QUIET FOX [PART 1]

QUIET FOX [PART 2]

BLOCK IMPLICIT OUTBOUND [not explicitly asked for - eg clicked on]

LOCATION BAR / SEARCH / AUTO SUGGESTIONS / HISTORY / FORMS etc

PASSWORDS

CACHE

SSL / OCSP / CERTS / ENCRYPTION / HSTS/HPKP/HTTPS

FONTS

HEADERS / REFERERS

PLUGINS

MEDIA / CAMERA / MIKE

UI MEDDLING

SERVICE WORKERS

DOM & JAVASCRIPT

HARDWARE FINGERPRINTING

MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY

FIRST PARTY ISOLATION (PFI)

COOKIES & DOM STORAGE

SHUTDOWN

PERSONAL SETTINGS

Deprecated

Thorin-Oakenpants commented Feb 20, 2017

pyllyukko commented Feb 20, 2017

publicarray commented Feb 20, 2017

pyllyukko commented Feb 21, 2017

pyllyukko commented Feb 21, 2017 • edited Loading

Thorin-Oakenpants commented Feb 27, 2017 • edited Loading

pyllyukko commented Feb 27, 2017 • edited Loading

pyllyukko commented Apr 3, 2017

nodiscc commented Apr 4, 2017

Thorin-Oakenpants commented Apr 4, 2017

nodiscc commented Apr 4, 2017 • edited Loading

nodiscc commented Apr 4, 2017 • edited Loading

Thorin-Oakenpants commented Apr 4, 2017

nodiscc commented Apr 4, 2017 • edited Loading

Thorin-Oakenpants commented Apr 4, 2017 • edited Loading

nodiscc commented Apr 4, 2017 • edited Loading

Thorin-Oakenpants commented Apr 4, 2017

nodiscc commented Apr 4, 2017 • edited Loading

nodiscc commented Apr 4, 2017 • edited Loading

nodiscc commented Apr 5, 2017 • edited Loading

pyllyukko commented Oct 8, 2017

claustromaniac commented Jun 30, 2018 • edited Loading

pyllyukko commented Jun 30, 2018

Gitoffthelawn commented Oct 17, 2022 • edited Loading

pyllyukko commented Feb 20, 2017 •

edited

Loading

pyllyukko commented Feb 21, 2017 •

edited

Loading

Thorin-Oakenpants commented Feb 27, 2017 •

edited

Loading

pyllyukko commented Feb 27, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

Thorin-Oakenpants commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 4, 2017 •

edited

Loading

nodiscc commented Apr 5, 2017 •

edited

Loading

claustromaniac commented Jun 30, 2018 •

edited

Loading

Gitoffthelawn commented Oct 17, 2022 •

edited

Loading