arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.43k stars 508 forks source link

ToDo: diffs FF123-FF124 #1820

Closed earthlng closed 2 months ago

earthlng commented 3 months ago

FF124 release date: Mar. 19th 2024

FF124 release notes FF124 for developers FF124 security advisories FF124.0.1 security advisories


58 diffs ( 36 new, 14 gone, 8 different )

new in v124.0:


ignore

click me for details

==NEW ```js pref("browser.newtabpage.activity-stream.discoverystream.ctaButtonSponsors", ""); pref("browser.newtabpage.activity-stream.discoverystream.ctaButtonVariant", ""); pref("browser.search.widget.removeAfterDaysUnused", 120); pref("browser.urlbar.yelp.minKeywordLength", 5); pref("browser.urlbar.yelp.priority", false); pref("browser.urlbar.yelp.suggestedIndex", 0); pref("devtools.debugger.features.codemirror-next", false); pref("dom.domrequest.enabled", false); pref("dom.element.blocking.enabled", false); pref("dom.events.mouse-pointer-boundary.keep-enter-targets-after-over-target-removed", false); pref("extensions.formautofill.addresses.experiments.enabled", false); pref("gfx.offscreencanvas.shared-provider", true); pref("identity.fxaccounts.toolbar.pxiToolbarEnabled.monitorEnabled", true); pref("identity.fxaccounts.toolbar.pxiToolbarEnabled.relayEnabled", true); pref("identity.fxaccounts.toolbar.pxiToolbarEnabled.vpnEnabled", true); pref("javascript.options.tests.uint32-pref", 1); pref("javascript.options.use_emulates_undefined_fuse", true); pref("javascript.options.wasm_exnref", false); pref("layout.tables.scrollable-cells", false); pref("media.getusermedia.microphone.prefer_voice_stream_with_processing.enabled", true); pref("memory.phc.avg_delay.first", 65536); pref("memory.phc.avg_delay.normal", 16384); pref("memory.phc.avg_delay.page_reuse", 262144); pref("network.cache.purgebyfrecency_minprogress_disk", 0); pref("network.cache.purgebyfrecency_minprogress_memory", 0); pref("network.dns.native_https_query_in_automation", false); pref("network.http_index_format.allowed_schemes", "file,moz-gio"); pref("pdfjs.enableML", false); pref("privacy.sanitize.sanitizeOnShutdown.hasMigratedToNewPrefs", false); pref("privacy.webrtc.showIndicatorsOnMacos14AndAbove", true); pref("ui.key.layout.load_when_first_needed", false); pref("ui.mouse.right_click.move_caret.stop_if_in_focused_editable_node", false); pref("widget.disable_file_pickers", false); pref("widget.gtk.titlebar-action-middle-click-enabled", false); ``` ==REMOVED, RENAMED or HIDDEN ```js pref("browser.opaqueResponseBlocking.syntheticBrowsingContext", true); pref("browser.opaqueResponseBlocking.syntheticBrowsingContext.filter", true); pref("browser.tabs.remote.autostart", true); pref("dom.animations-api.getAnimations.enabled", true); pref("dom.animations.mainthread-synchronization-with-geometric-animations", false); pref("dom.event.default_to_passive_wheel_listeners", true); pref("dom.events.phases.correctOrderOnTarget", true); pref("dom.screenwakelock.testing", false); pref("extensions.formautofill.addresses.capture.v2.enabled", false); pref("layout.css.more_color_4.enabled", true); pref("layout.css.overflow-overlay.enabled", true); pref("layout.cursor.block.enabled", true); pref("layout.use-plugin-fallback", false); pref("plugin.default.state", 1); ``` ==CHANGED ```js pref("browser.taskbar.lists.legacyBackend", false); // prev: true pref("browser.urlbar.quicksuggest.rustEnabled", true); // prev: false pref("dom.forms.always_allow_pointer_events.enabled", true); // prev: false pref("extensions.formautofill.heuristics.captureOnFormRemoval", true); // prev: false pref("extensions.formautofill.heuristics.captureOnPageNavigation", true); // prev: false pref("javascript.options.mem.gc_parallel_marking", true); // prev: false pref("media.allow-audio-non-utility", false); // prev: true pref("network.http.http2.move_to_pending_list_after_network_change", true); // prev: false ```

earthlng commented 3 months ago
some bugzilla tickets

* browser.contentanalysis.default_allow Bug [1879182](https://bugzilla.mozilla.org/show_bug.cgi?id=1879182) - add a pref to make Content Analysis allow by default * browser.newtabpage.activity-stream.discoverystream.ctaButtonSponsors Bug [1878086](https://bugzilla.mozilla.org/show_bug.cgi?id=1878086) - Home and newtab sponsored topsites phase 2 UI updates * browser.newtabpage.activity-stream.discoverystream.ctaButtonVariant Bug [1878086](https://bugzilla.mozilla.org/show_bug.cgi?id=1878086) - Home and newtab sponsored topsites phase 2 UI updates * browser.opaqueResponseBlocking.syntheticBrowsingContext Bug [1875466](https://bugzilla.mozilla.org/show_bug.cgi?id=1875466) - Remove browser.opaqueResponseBlocking.syntheticBrowsingContext pref. Bug [1875466](https://bugzilla.mozilla.org/show_bug.cgi?id=1875466) - Remove nsContentUtils::ShouldHideObjectOrEmbedImageDocument. * browser.opaqueResponseBlocking.syntheticBrowsingContext.filter Bug [1875466](https://bugzilla.mozilla.org/show_bug.cgi?id=1875466) - Remove nsContentUtils::ShouldHideObjectOrEmbedImageDocument. * browser.search.widget.removeAfterDaysUnused Bug [1852051](https://bugzilla.mozilla.org/show_bug.cgi?id=1852051) - Remove the Search Bar from the toolbar for users who haven't used it in 120 days. * browser.tabs.remote.autostart Bug [1724089](https://bugzilla.mozilla.org/show_bug.cgi?id=1724089) - Remove browser.tabs.remote.autostart pref * browser.taskbar.lists.legacyBackend Bug [1880082](https://bugzilla.mozilla.org/show_bug.cgi?id=1880082) - Let the off-main-thread WindowsJumpList backend ride the trains. Bug [1867340](https://bugzilla.mozilla.org/show_bug.cgi?id=1867340) - Enable the new Windows Jump List backend on Nightly only. Bug [1529276](https://bugzilla.mozilla.org/show_bug.cgi?id=1529276) - Update WindowsJumpList module to select the jump list backend via a pref. * browser.urlbar.quicksuggest.rustEnabled Bug [1880144](https://bugzilla.mozilla.org/show_bug.cgi?id=1880144) - Enable Rust Suggest by default. Bug [1854059](https://bugzilla.mozilla.org/show_bug.cgi?id=1854059) - Convert Suggest remote settings component to a BaseFeature. * browser.urlbar.yelp.featureGate Bug [1879642](https://bugzilla.mozilla.org/show_bug.cgi?id=1879642) - Update Yelp suggestion desktop integration for changes in Rust prefix matching. * browser.urlbar.yelp.minKeywordLength Bug [1881071](https://bugzilla.mozilla.org/show_bug.cgi?id=1881071): Stop suggest if the query length is less than length of when clicking 'Show less frequently' * browser.urlbar.yelp.priority Bug [1881606](https://bugzilla.mozilla.org/show_bug.cgi?id=1881606) - Add a Nimbus variable and pref for configuring Yelp suggestion index/position. * browser.urlbar.yelp.suggestedIndex Bug [1881606](https://bugzilla.mozilla.org/show_bug.cgi?id=1881606) - Add a Nimbus variable and pref for configuring Yelp suggestion index/position. * dom.animations.mainthread-synchronization-with-geometric-animations Bug [1876321](https://bugzilla.mozilla.org/show_bug.cgi?id=1876321) - Remove mainthread sync with geometric animations pref. * dom.animations-api.getAnimations.enabled Bug [1873137](https://bugzilla.mozilla.org/show_bug.cgi?id=1873137) - Remove dom.animations-api.getAnimations.enabled pref * dom.domrequest.enabled Bug [1880615](https://bugzilla.mozilla.org/show_bug.cgi?id=1880615) - Disable DOMRequest * dom.element.blocking.enabled Bug [1878888](https://bugzilla.mozilla.org/show_bug.cgi?id=1878888) - Add the runtime flag and parsing for the blocking attribute, * dom.event.default_to_passive_wheel_listeners Bug [1842980](https://bugzilla.mozilla.org/show_bug.cgi?id=1842980) - Remove dom.event.default_to_passive_wheel_listeners pref * dom.events.mouse-pointer-boundary.keep-enter-targets-after-over-target-removed Bug [1875424](https://bugzilla.mozilla.org/show_bug.cgi?id=1875424) - Disable the new mouse/pointer boundary behavior in the late beta builds and the release builds * dom.events.phases.correctOrderOnTarget Bug [1874881](https://bugzilla.mozilla.org/show_bug.cgi?id=1874881) - Remove pref dom.events.phases.correctOrderOnTarget. * dom.forms.always_allow_pointer_events.enabled Bug [1861366](https://bugzilla.mozilla.org/show_bug.cgi?id=1861366) - Enable `dom.forms.always_allow_key_and_focus_events.enabled` on early beta. Bug [1653882](https://bugzilla.mozilla.org/show_bug.cgi?id=1653882) - Ship dom.forms.always_allow_pointer_events.enabled by default * dom.screenwakelock.testing Bug [1875257](https://bugzilla.mozilla.org/show_bug.cgi?id=1875257) - Part 3: Remove dom.screenwakelock.testing Bug [1589554](https://bugzilla.mozilla.org/show_bug.cgi?id=1589554) - Part 6: Screen Wake Lock testing. * extensions.formautofill.addresses.capture.v2.enabled Bug [1875253](https://bugzilla.mozilla.org/show_bug.cgi?id=1875253) - Enable Address Capture for US and CA regions in Nightly Bug [1812294](https://bugzilla.mozilla.org/show_bug.cgi?id=1812294) - Implement a framework to detect duplicated address entry * extensions.formautofill.addresses.experiments.enabled Bug [1879596](https://bugzilla.mozilla.org/show_bug.cgi?id=1879596) - Set extensions.formautofill.addresses.experiments.enabled to true for android. Bug [1865705](https://bugzilla.mozilla.org/show_bug.cgi?id=1865705) - Use nimbus flag to control address autofill. * extensions.formautofill.heuristics.captureOnFormRemoval Bug [1874661](https://bugzilla.mozilla.org/show_bug.cgi?id=1874661) - Turn on formautofill page navigation and form removal after fetch heuristics Bug [1863801](https://bugzilla.mozilla.org/show_bug.cgi?id=1863801) - P4. Add preference extensions.formautofill.heuristics.captureOnFormRemoval * extensions.formautofill.heuristics.captureOnPageNavigation Bug [1874661](https://bugzilla.mozilla.org/show_bug.cgi?id=1874661) - Turn on formautofill page navigation and form removal after fetch heuristics Bug [1870718](https://bugzilla.mozilla.org/show_bug.cgi?id=1870718) - P1. Add heuristic to capture address fields on page navigation * gfx.offscreencanvas.shared-provider Bug [1877429](https://bugzilla.mozilla.org/show_bug.cgi?id=1877429) - Prevent offscreen canvas2d updates from racing with compositing. * identity.fxaccounts.toolbar.pxiToolbarEnabled.monitorEnabled Bug [1880556](https://bugzilla.mozilla.org/show_bug.cgi?id=1880556): Add toggles for FxA products a=diannaS * identity.fxaccounts.toolbar.pxiToolbarEnabled.relayEnabled Bug [1880556](https://bugzilla.mozilla.org/show_bug.cgi?id=1880556): Add toggles for FxA products a=diannaS * identity.fxaccounts.toolbar.pxiToolbarEnabled.vpnEnabled Bug [1880556](https://bugzilla.mozilla.org/show_bug.cgi?id=1880556): Add toggles for FxA products a=diannaS * javascript.options.mem.gc_parallel_marking Bug [1875117](https://bugzilla.mozilla.org/show_bug.cgi?id=1875117) - Ship GC parallel marking Bug [1868530](https://bugzilla.mozilla.org/show_bug.cgi?id=1868530) - Lower parallel marking thresholds following recent improvements Bug [1854072](https://bugzilla.mozilla.org/show_bug.cgi?id=1854072) - Change parallel marking threshold pref to use MB instead of KB Bug [1847567](https://bugzilla.mozilla.org/show_bug.cgi?id=1847567) - Add a browser pref for JSGC_PARALLEL_MARKING_THRESHOLD_KB and set it per platform * javascript.options.tests.uint32-pref Bug [1877193](https://bugzilla.mozilla.org/show_bug.cgi?id=1877193) part 17 - Add a jit-test. * javascript.options.use_emulates_undefined_fuse Bug [1877824](https://bugzilla.mozilla.org/show_bug.cgi?id=1877824) - Enable EmulatesUndefined Fuse Bug [1877824](https://bugzilla.mozilla.org/show_bug.cgi?id=1877824) - Switch Emulates Undefined Fuse to JS::Pref Bug [1866158](https://bugzilla.mozilla.org/show_bug.cgi?id=1866158) - Add a pref for emulates undefined fuse * javascript.options.wasm_exnref Bug [1873776](https://bugzilla.mozilla.org/show_bug.cgi?id=1873776) - wasm: Let 'exnref' ride trains to beta. * layout.css.more_color_4.enabled Bug [1812629](https://bugzilla.mozilla.org/show_bug.cgi?id=1812629) - Remove more_color_4 pref * layout.css.overflow-overlay.enabled Bug [1876713](https://bugzilla.mozilla.org/show_bug.cgi?id=1876713) - Remove layout.css.overflow-overlay.enabled pref. * layout.cursor.block.enabled Bug [1874953](https://bugzilla.mozilla.org/show_bug.cgi?id=1874953) - Remove layout.cursor.block.enabled pref * layout.tables.scrollable-cells Bug [1877719](https://bugzilla.mozilla.org/show_bug.cgi?id=1877719) - Turn off overflow support on table cells in beta for now. Bug [1877591](https://bugzilla.mozilla.org/show_bug.cgi?id=1877591) - Suppress scrollable table cells when printing. * layout.use-plugin-fallback Bug [1876702](https://bugzilla.mozilla.org/show_bug.cgi?id=1876702) - Remove unnecessary distinction between TYPE_FALLBACK and TYPE_NULL. * media.allow-audio-non-utility Bug [1863873](https://bugzilla.mozilla.org/show_bug.cgi?id=1863873) - Block ability to perform audio decoding outside of Utility on release * media.getusermedia.microphone.prefer_voice_stream_with_processing.enabled Bug [1874789](https://bugzilla.mozilla.org/show_bug.cgi?id=1874789) - Make the new pref atomic., a=dsmith Bug [1874789](https://bugzilla.mozilla.org/show_bug.cgi?id=1874789) - Add a pref to allow disabling VOICE in cubeb. a=diannaS * memory.phc.avg_delay.first Bug [1867190](https://bugzilla.mozilla.org/show_bug.cgi?id=1867190) - Add prefs for PHC probablities * memory.phc.avg_delay.normal Bug [1867190](https://bugzilla.mozilla.org/show_bug.cgi?id=1867190) - Add prefs for PHC probablities * memory.phc.avg_delay.page_reuse Bug [1867190](https://bugzilla.mozilla.org/show_bug.cgi?id=1867190) - Add prefs for PHC probablities * network.cache.purgebyfrecency_minprogress_disk Bug [1875859](https://bugzilla.mozilla.org/show_bug.cgi?id=1875859) - Refactor MemoryPool::PurgeExpired and PurgeByFrecency to reduce overhead and protect against races while sorting. * network.cache.purgebyfrecency_minprogress_memory Bug [1875859](https://bugzilla.mozilla.org/show_bug.cgi?id=1875859) - Refactor MemoryPool::PurgeExpired and PurgeByFrecency to reduce overhead and protect against races while sorting. * network.dns.native_https_query_in_automation Bug [1878506](https://bugzilla.mozilla.org/show_bug.cgi?id=1878506) - Add pref to make native HTTPS resolution exit early in automation * network.http.http2.move_to_pending_list_after_network_change Bug [1876045](https://bugzilla.mozilla.org/show_bug.cgi?id=1876045) - Enable network.http.http2.move_to_pending_list_after_network_change, * network.http_index_format.allowed_schemes Bug [1824325](https://bugzilla.mozilla.org/show_bug.cgi?id=1824325) - Remove support for application/http-index-format Content-Type * plugin.default.state Bug [1875822](https://bugzilla.mozilla.org/show_bug.cgi?id=1875822) - Remove a bunch of dead JS plugin code. * privacy.sanitize.sanitizeOnShutdown.hasMigratedToNewPrefs Bug [1876097](https://bugzilla.mozilla.org/show_bug.cgi?id=1876097) - Migrate old prefs to the new prefs for clear on shutdown in the new clear history dialog. * privacy.webrtc.showIndicatorsOnMacos14AndAbove Bug [1878147](https://bugzilla.mozilla.org/show_bug.cgi?id=1878147) - Flip pref to allow users to see sharing webrtc icons in MacOS 14 and above. Bug [1857254](https://bugzilla.mozilla.org/show_bug.cgi?id=1857254) - temporarily disabled the firefox webRTC indicators for mic, camera and ss on MacOS 14 and above. * ui.key.layout.load_when_first_needed Bug [1878224](https://bugzilla.mozilla.org/show_bug.cgi?id=1878224) - Put it off to load keyboard layout when first needed * ui.mouse.right_click.move_caret.stop_if_in_focused_editable_node Bug [1875690](https://bugzilla.mozilla.org/show_bug.cgi?id=1875690) - Add a pref to prevent caret move when right click in editable content * widget.disable_file_pickers Bug [1708289](https://bugzilla.mozilla.org/show_bug.cgi?id=1708289) - Implement AllowFileSelectionDialogs policy * widget.gtk.titlebar-action-middle-click-enabled Bug [1539998](https://bugzilla.mozilla.org/show_bug.cgi?id=1539998) [Linux] Create widget.gtk.titlebar-action-middle-click-enabled pref

Thorin-Oakenpants commented 3 months ago

NEW

wtf is ML ... https://bugzilla.mozilla.org/show_bug.cgi?id=1883605 ....

edit: ok, I think it's a MiterLimit .. seems legit

Jee-Hex commented 3 months ago

...or Machine Learning?

edit: nvm why did I link to the same bug you just posted

Jee-Hex commented 1 week ago

Addendum:

https://hacks.mozilla.org/2024/05/experimenting-with-local-alt-text-generation-in-firefox-nightly/

Firefox 130 will introduce an experimental new capability to automatically generate alt-text for images using a fully private on-device AI model. The feature will be available as part of Firefox’s built-in PDF editor,

https://github.com/mozilla/pdf.js/commit/72b8b29147c3a19ccacc9db111df4925efcbe1bf#diff-3a887818aab376b1dfc186c1520f28329f9c55a0076ed178e5c58ab38fbe6843R48-R51

[Editor] Add the possibility to query some ML stuff to guess an alt text for an image

Yep definitely machine learning... case closed.