arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.92k stars 510 forks source link

ToDo: diffs FF107-FF108 #1605

Closed earthlng closed 1 year ago

earthlng commented 1 year ago

FF108 is scheduled for release Dec. 13th

FF108 release notes FF108 for developers FF108 security advisories


84 diffs ( 51 new, 21 gone, 12 different )

new in v108.0:

changed in v108.0:


ignore

click me for details

==NEW ```js pref("apz.scrollend-event.content.delay_ms", 100); pref("browser.cache.shutdown_io_time_between_cancellations_ms", 5); pref("browser.migrate.brave.enabled", true); pref("browser.migrate.canary.enabled", true); pref("browser.migrate.chrome-beta.enabled", true); pref("browser.migrate.chrome-dev.enabled", true); pref("browser.migrate.chrome.enabled", true); pref("browser.migrate.chromium-360se.enabled", true); pref("browser.migrate.chromium-edge-beta.enabled", true); pref("browser.migrate.chromium-edge.enabled", true); pref("browser.migrate.chromium.enabled", true); pref("browser.migrate.edge.enabled", true); pref("browser.migrate.firefox.enabled", true); pref("browser.migrate.ie.enabled", true); pref("browser.migrate.opera.enabled", false); pref("browser.migrate.safari.enabled", true); pref("browser.newtabpage.activity-stream.discoverystream.spocTopsitesAdTypes", ""); pref("browser.newtabpage.activity-stream.discoverystream.spocTopsitesZoneIds", ""); pref("devtools.styleeditor.atRulesSidebarWidth", 238); pref("devtools.styleeditor.showAtRulesSidebar", true); pref("dom.events.dataTransfer.mozFile.enabled", false); pref("dom.fs.main_thread_writable_file_stream", false); pref("dom.input_event_queue.duration.max", 8); pref("dom.ipc.processPriorityManager.backgroundUsesEcoQoS", true); pref("dom.security.credentialmanagement.identity.select_first_in_ui_lists", false); pref("editor.word_select.delete_space_after_doubleclick_selection", false); pref("extensions.openPopupWithoutUserGesture.enabled", false); pref("gfx.canvas.accelerated.gpu-path-size", 4); pref("gfx.display.max-frame-rate", 0); pref("intl.tsf.enabled", true); pref("layout.css.font-variant-emoji.enabled", false); pref("layout.css.round.enabled", false); pref("media.seamless-looping-video", false); pref("media.utility-process.max-crashes", 2); pref("network.url.strip-data-url-whitespace", false); pref("nimbus.qa.pref-1", "default"); pref("nimbus.qa.pref-2", "default"); pref("security.csp.unsafe-hashes.enabled", false); pref("toolkit.background_tasks.remove_directory.testing.sleep_ms", 0); pref("toolkit.telemetry.dap.logLevel", "Warn"); pref("toolkit.telemetry.dap_enabled", false); pref("toolkit.telemetry.dap_helper", "https://helper1.dap.cloudflareresearch.com/v01"); pref("toolkit.telemetry.dap_helper_owner", "Cloudflare"); pref("toolkit.telemetry.dap_leader", "https://interop-00.api.divviup.org"); pref("toolkit.telemetry.dap_leader_owner", "ISRG"); ``` ==REMOVED, RENAMED or HIDDEN ```js pref("browser.urlbar.showSearchTerms", false); pref("clipboard.plainTextOnly", false); pref("devtools.styleeditor.mediaSidebarWidth", 238); pref("devtools.styleeditor.showMediaSidebar", true); pref("dom.input_events.strict_input_vsync_alignment", true); pref("dom.mozCurrentTransform.enabled", false); pref("dom.origin-trials.offscreen-canvas.state", 0); pref("gfx.offscreencanvas.domain-allowlist", "*.zoom.us,zoom.us"); pref("gfx.offscreencanvas.domain-enabled", true); pref("input_event_queue.count_for_prediction", 9); pref("input_event_queue.default_duration_per_event", 1); pref("input_event_queue.duration.max", 8); pref("input_event_queue.duration.min", 1); pref("intl.tsf.associate_imc_only_when_imm_ime_is_active", false); pref("intl.tsf.enable", true); pref("javascript.options.experimental.class_static_blocks", true); pref("javascript.options.experimental.ergonomic_brand_checks", true); pref("javascript.options.experimental.private_fields", true); pref("javascript.options.experimental.private_methods", true); pref("javascript.options.experimental.top_level_await", true); pref("xul.panel-animations.enabled", true); ``` ==CHANGED ```js pref("browser.pdfjs.feature-tour", "{\"screen\":\"FEATURE_CALLOUT_1\",\"complete\":false}"); // prev: "{\"message\":\"PDF_JS_FEATURE_TOUR\",\"screen\":\"\",\"complete\":false}" pref("cookiebanners.bannerClicking.enabled", true); // prev: false pref("dom.importMaps.enabled", true); // prev: false pref("dom.picture_source_dimension_attributes.enabled", true); // prev: false pref("dom.sitepermsaddon-provider.enabled", true); // prev: false pref("dom.webmidi.enabled", true); // prev: false pref("gfx.color_management.enablev4", true); // prev: false pref("gfx.webrender.wait-gpu-finished.disabled", true); // prev: false pref("layout.css.trig.enabled", true); // prev: false pref("security.csp.script-src-attr-elem.enabled", true); // prev: false pref("security.csp.style-src-attr-elem.enabled", true); // prev: false ```

earthlng commented 1 year ago
some bugzilla tickets

* apz.scrollend-event.content.delay_ms Bug [1794457](https://bugzilla.mozilla.org/show_bug.cgi?id=1794457) - Fire one scrollend event for a pan gesture. * browser.cache.shutdown_io_time_between_cancellations_ms Bug [1794376](https://bugzilla.mozilla.org/show_bug.cgi?id=1794376) - Use SpinEventLoopUntil to await for CacheFileIOManager shutdown * browser.migrate.brave.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.canary.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chrome.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chrome-beta.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chrome-dev.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chromium.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chromium-360se.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chromium-edge.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.chromium-edge-beta.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.edge.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.firefox.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.ie.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.migrate.opera.enabled Bug [1284106](https://bugzilla.mozilla.org/show_bug.cgi?id=1284106) Make Possible import data from (new) Opera * browser.migrate.safari.enabled Bug [1795780](https://bugzilla.mozilla.org/show_bug.cgi?id=1795780) - Add the ability to disable a browser migrator at runtime via a pref. * browser.newtabpage.activity-stream.discoverystream.spocTopsitesAdTypes Bug [1794020](https://bugzilla.mozilla.org/show_bug.cgi?id=1794020) - topsite promo tiles * browser.newtabpage.activity-stream.discoverystream.spocTopsitesZoneIds Bug [1794020](https://bugzilla.mozilla.org/show_bug.cgi?id=1794020) - topsite promo tiles * browser.pdfjs.feature-tour Bug [1793657](https://bugzilla.mozilla.org/show_bug.cgi?id=1793657) - Created messages for Feature Callout tour in pdf.js Bug [1793655](https://bugzilla.mozilla.org/show_bug.cgi?id=1793655) - Add progress and device syncing prefs for pdf.js feature callout tour * browser.urlbar.showSearchTerms Bug [1779470](https://bugzilla.mozilla.org/show_bug.cgi?id=1779470) - Part 1: Add Nimbus variable, feature gate preference, and rename showSearchTerms prefs - Bug [1779471](https://bugzilla.mozilla.org/show_bug.cgi?id=1779471) - Rename pref and add telemetry for persistent search term searches - Bug [1779465](https://bugzilla.mozilla.org/show_bug.cgi?id=1779465) - Part 1: Show search term on default SERP - * browser.urlbar.showSearchTerms.enabled Bug [1779470](https://bugzilla.mozilla.org/show_bug.cgi?id=1779470) - Part 1: Add Nimbus variable, feature gate preference, and rename showSearchTerms prefs - * browser.urlbar.showSearchTerms.featureGate Bug [1779470](https://bugzilla.mozilla.org/show_bug.cgi?id=1779470) - Part 1: Add Nimbus variable, feature gate preference, and rename showSearchTerms prefs - * browser.urlbar.suggest.weather Bug [1799363](https://bugzilla.mozilla.org/show_bug.cgi?id=1799363) - Add weather suggestions to quick suggest. * browser.urlbar.weather.featureGate Bug [1799363](https://bugzilla.mozilla.org/show_bug.cgi?id=1799363) - Add weather suggestions to quick suggest. * clipboard.plainTextOnly Bug [1798508](https://bugzilla.mozilla.org/show_bug.cgi?id=1798508) - Remove references to the dead pref clipboard.plainTextOnly. * cookiebanners.bannerClicking.enabled Bug [1797142](https://bugzilla.mozilla.org/show_bug.cgi?id=1797142) - Enable cookiebanners.bannerClicking.enabled by default and rely on the global service pref instead. Bug [1783045](https://bugzilla.mozilla.org/show_bug.cgi?id=1783045) - Part 3: Implementing CookieBanner JSWindowActor to handle the cookie banner. Bug [1790100](https://bugzilla.mozilla.org/show_bug.cgi?id=1790100) - Enable cookie banner handling by default in Nightly in private browsing mode. * cookiebanners.ui.desktop.enabled Bug [1798868](https://bugzilla.mozilla.org/show_bug.cgi?id=1798868) - Default cookiebanners.ui.desktop.enabled to false. Bug [1795041](https://bugzilla.mozilla.org/show_bug.cgi?id=1795041) - Add a cookie banner handling per-site toggle to the protection panel. * devtools.styleeditor.atRulesSidebarWidth Bug [1788033](https://bugzilla.mozilla.org/show_bug.cgi?id=1788033) - [devtools] Rename StyleEditor media sidebar to at-rules sidebar. * devtools.styleeditor.mediaSidebarWidth Bug [1788033](https://bugzilla.mozilla.org/show_bug.cgi?id=1788033) - [devtools] Rename StyleEditor media sidebar to at-rules sidebar. * devtools.styleeditor.showAtRulesSidebar Bug [1788033](https://bugzilla.mozilla.org/show_bug.cgi?id=1788033) - [devtools] Rename StyleEditor media sidebar to at-rules sidebar. * devtools.styleeditor.showMediaSidebar Bug [1788033](https://bugzilla.mozilla.org/show_bug.cgi?id=1788033) - [devtools] Rename StyleEditor media sidebar to at-rules sidebar. * dom.events.dataTransfer.mozFile.enabled Bug [1308007](https://bugzilla.mozilla.org/show_bug.cgi?id=1308007) - Add a pref to allow files in DataTransfer from paste again. * dom.fs.main_thread_writable_file_stream Bug [1798459](https://bugzilla.mozilla.org/show_bug.cgi?id=1798459) - Disable WritableFileStream on the main thread; * dom.importMaps.enabled Bug [1795647](https://bugzilla.mozilla.org/show_bug.cgi?id=1795647) - Enable Import-maps by default. * dom.input_event_queue.duration.max Bug [1795624](https://bugzilla.mozilla.org/show_bug.cgi?id=1795624) - remove dom.input_events.strict_input_vsync_alignment, * dom.input_events.strict_input_vsync_alignment Bug [1795624](https://bugzilla.mozilla.org/show_bug.cgi?id=1795624) - remove dom.input_events.strict_input_vsync_alignment, * dom.ipc.processPriorityManager.backgroundUsesEcoQoS Bug [1800412](https://bugzilla.mozilla.org/show_bug.cgi?id=1800412) - Add a preference to control whether the EcoQoS is used for background content processes, * dom.mozCurrentTransform.enabled Bug [1294360](https://bugzilla.mozilla.org/show_bug.cgi?id=1294360) - Remove mozCurrentTransform. Bug [1782651](https://bugzilla.mozilla.org/show_bug.cgi?id=1782651) - Disable mozCurrentTransform by default. * dom.origin-trials.offscreen-canvas.state Bug [1796819](https://bugzilla.mozilla.org/show_bug.cgi?id=1796819) - Remove OffscreenCanvas origin trial / domain allowlist. * dom.picture_source_dimension_attributes.enabled Bug [1795953](https://bugzilla.mozilla.org/show_bug.cgi?id=1795953) - Ship width/height attributes on source elements. Bug [1694741](https://bugzilla.mozilla.org/show_bug.cgi?id=1694741) - Part 9: Enable the preference on Nightly. Bug [1694741](https://bugzilla.mozilla.org/show_bug.cgi?id=1694741) - Part 1: Support width and height attributes in HTMLSourceElement's webidl. * dom.security.credentialmanagement.identity.select_first_in_ui_lists Bug [1782088](https://bugzilla.mozilla.org/show_bug.cgi?id=1782088), part 4 - Add preference to choose the first option in the account and provider choosers, * dom.sitepermsaddon-provider.enabled Bug [1790621](https://bugzilla.mozilla.org/show_bug.cgi?id=1790621) - Enable dom.sitepermsaddon-provider.enabled everywhere. Bug [1788578](https://bugzilla.mozilla.org/show_bug.cgi?id=1788578) - Add preference for enabling SitePermsAddonProvider. Bug [1790620](https://bugzilla.mozilla.org/show_bug.cgi?id=1790620) - Enable dom.sitepermsaddon-provider.enabled on Nightly only. * dom.sitepermsaddon-provider.separatedBlocklistedDomains Bug [1795927](https://bugzilla.mozilla.org/show_bug.cgi?id=1795927) - Add SitePermsAddon blocklist. * dom.webmidi.enabled Bug [1795025](https://bugzilla.mozilla.org/show_bug.cgi?id=1795025) - Remove early-beta gate from WebMIDI. * editor.word_select.delete_space_after_doubleclick_selection Bug [1783641](https://bugzilla.mozilla.org/show_bug.cgi?id=1783641): Deleting a selected word deletes surrounding whitespace on MacOS. * extensions.openPopupWithoutUserGesture.enabled Bug [1755763](https://bugzilla.mozilla.org/show_bug.cgi?id=1755763) - Update browserAction.openPopup API * gfx.canvas.accelerated.gpu-path-size Bug [1799402](https://bugzilla.mozilla.org/show_bug.cgi?id=1799402) - Use WGR to rasterize paths in DrawTargetWebgl. * gfx.color_management.enablev4 Bug [488800](https://bugzilla.mozilla.org/show_bug.cgi?id=488800). Let ICCv4 support ride out to release. * gfx.display.max-frame-rate Bug [1797814](https://bugzilla.mozilla.org/show_bug.cgi?id=1797814) - Allow setting a maximum frame rate frequency in Hz, * gfx.offscreencanvas.domain-allowlist Bug [1796819](https://bugzilla.mozilla.org/show_bug.cgi?id=1796819) - Remove OffscreenCanvas origin trial / domain allowlist. * gfx.offscreencanvas.domain-enabled Bug [1796819](https://bugzilla.mozilla.org/show_bug.cgi?id=1796819) - Remove OffscreenCanvas origin trial / domain allowlist. * gfx.webrender.wait-gpu-finished.disabled Bug [1796598](https://bugzilla.mozilla.org/show_bug.cgi?id=1796598) - Disable wait at RenderCompositorANGLE::WaitForGPU() on Windows until release Bug [1793388](https://bugzilla.mozilla.org/show_bug.cgi?id=1793388) - Disable wait at RenderCompositorANGLE::WaitForGPU() on Windows nightly * input_event_queue.duration.max Bug [1795624](https://bugzilla.mozilla.org/show_bug.cgi?id=1795624) - remove dom.input_events.strict_input_vsync_alignment, * intl.tsf.associate_imc_only_when_imm_ime_is_active Bug [1796044](https://bugzilla.mozilla.org/show_bug.cgi?id=1796044) - part 14: Get rid of `intl.tsf.associate_imc_only_when_imm_ime_is_active` * intl.tsf.enable Bug [1796044](https://bugzilla.mozilla.org/show_bug.cgi?id=1796044) - part 16: Make `intl.tsf.enable` a static pref and rename it * intl.tsf.enabled Bug [1796044](https://bugzilla.mozilla.org/show_bug.cgi?id=1796044) - part 16: Make `intl.tsf.enable` a static pref and rename it * javascript.options.experimental.class_static_blocks Bug [1765357](https://bugzilla.mozilla.org/show_bug.cgi?id=1765357) - Part 1: Remove class_static_blocks preference. * javascript.options.experimental.ergonomic_brand_checks Bug [1765357](https://bugzilla.mozilla.org/show_bug.cgi?id=1765357) - Part 4: Remove ergonomic_brand_checks preference. * javascript.options.experimental.private_fields Bug [1765357](https://bugzilla.mozilla.org/show_bug.cgi?id=1765357) - Part 2: Remove private_fields preference. * javascript.options.experimental.private_methods Bug [1765357](https://bugzilla.mozilla.org/show_bug.cgi?id=1765357) - Part 3: Remove private_methods preference. * javascript.options.experimental.top_level_await Bug [1765357](https://bugzilla.mozilla.org/show_bug.cgi?id=1765357) - Part 5: Remove top_level_await preference. * layout.css.font-variant-emoji.enabled Bug [1461589](https://bugzilla.mozilla.org/show_bug.cgi?id=1461589) - Add support for the CSS font-variant-emoji property to the style system. * layout.css.round.enabled Bug [1764850](https://bugzilla.mozilla.org/show_bug.cgi?id=1764850) Implement CSS round() function. * layout.css.trig.enabled Bug [1787070](https://bugzilla.mozilla.org/show_bug.cgi?id=1787070) - Enable calc() trigonometric functions / constants everywhere. Bug [1774589](https://bugzilla.mozilla.org/show_bug.cgi?id=1774589) - Implement atan2(), and enable calc() trigonometric functions by default on nightly. * media.seamless-looping-video Bug [1262276](https://bugzilla.mozilla.org/show_bug.cgi?id=1262276) - part18 : add a pref to control video seamless looping. * media.utility-process.max-crashes Bug [1792636](https://bugzilla.mozilla.org/show_bug.cgi?id=1792636) - Make Utility process crash a non fatal error * network.url.strip-data-url-whitespace Bug [1104311](https://bugzilla.mozilla.org/show_bug.cgi?id=1104311) - Stop stripping spaces from data URLs * nimbus.qa.pref-1 Bug [1798045](https://bugzilla.mozilla.org/show_bug.cgi?id=1798045) - Add features for QA-ing pref flip experiments * nimbus.qa.pref-2 Bug [1798045](https://bugzilla.mozilla.org/show_bug.cgi?id=1798045) - Add features for QA-ing pref flip experiments * security.csp.script-src-attr-elem.enabled Bug [1782513](https://bugzilla.mozilla.org/show_bug.cgi?id=1782513) - Ship script-src-attr, script-src-elem, style-src-attr and style-src-elem. * security.csp.style-src-attr-elem.enabled Bug [1782513](https://bugzilla.mozilla.org/show_bug.cgi?id=1782513) - Ship script-src-attr, script-src-elem, style-src-attr and style-src-elem. * security.csp.unsafe-hashes.enabled Bug [1797070](https://bugzilla.mozilla.org/show_bug.cgi?id=1797070) - CSP: Add a basic implementation of unsafe-hashes behind a flag. * toolkit.background_tasks.remove_directory.testing.sleep_ms Bug [1791675](https://bugzilla.mozilla.org/show_bug.cgi?id=1791675) - Part 4: Make sure purgeHTTPCache runs after shutdown * toolkit.telemetry.dap.logLevel Bug [1791394](https://bugzilla.mozilla.org/show_bug.cgi?id=1791394) - Add DAP frontend which handles sending/receiving of data. * toolkit.telemetry.dap_enabled Bug [1791394](https://bugzilla.mozilla.org/show_bug.cgi?id=1791394) - Add DAP frontend which handles sending/receiving of data. * toolkit.telemetry.dap_helper Bug [1791394](https://bugzilla.mozilla.org/show_bug.cgi?id=1791394) - Add DAP frontend which handles sending/receiving of data. * toolkit.telemetry.dap_helper_owner Bug [1791394](https://bugzilla.mozilla.org/show_bug.cgi?id=1791394) - Add DAP frontend which handles sending/receiving of data. * toolkit.telemetry.dap_leader Bug [1791394](https://bugzilla.mozilla.org/show_bug.cgi?id=1791394) - Add DAP frontend which handles sending/receiving of data. * toolkit.telemetry.dap_leader_owner Bug [1791394](https://bugzilla.mozilla.org/show_bug.cgi?id=1791394) - Add DAP frontend which handles sending/receiving of data. * webchannel.allowObject.urlWhitelist Bug [1798808](https://bugzilla.mozilla.org/show_bug.cgi?id=1798808) - Remove https://support.mozilla.org from webchannel object whitelist. * xul.panel-animations.enabled Bug [1799901](https://bugzilla.mozilla.org/show_bug.cgi?id=1799901) - Make panel animations a LookAndFeel int.

Thorin-Oakenpants commented 1 year ago

searchTerms

personally I do not use the urlbar other than anything except a dead static form field (no distracting drop downs, suggestions, nothing - it is dead to me). That said I can search from it.

info

What does it do? I replaces the URL in the address bar with the search term. It's not a big deal to me. You know the search engine you landed on, but it does obscure information, and you can't copy the URL even when clicking it in. I get the simplicity of it for users, and the space in adroid, but this is not necessary on desktop. I do not see it as a privacy issue TBH

without: https://www.google.com/search?client=firefox-b-d&q=banana with banana

Thorin-Oakenpants commented 1 year ago

^ https://bugzilla.mozilla.org/show_bug.cgi?id=1809551 browser.urlbar.showSearchTerms.featureGate in EARLY_BETA_OR_EARLIER