search

arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.93k stars 513 forks source link

ToDo: diffs FF55-FF56 #204

Closed earthlng closed 6 years ago

earthlng commented 7 years ago

v55.0 vs v56.0

150 diffs ( 91 new, 28 gone, 31 different )

Firefox 56 stable lands 2017-09-28

new in v56.0:

removed, renamed or hidden in v56.0:

ALL DONE - https://github.com/ghacksuserjs/ghacks-user.js/commit/12f80bdf65910f039445eb9243c4f59434da5f77

changed in v56.0:

redundant in 56 due to RFP privacy.resistFingerprinting

ignore

==NEW

pref("accessibility.handler.enabled", true);
 // ^^ related: https://bugzilla.mozilla.org/show_bug.cgi?id=1363221
pref("app.productInfo.baseURL", "https://www.mozilla.org/firefox/features/");
pref("apz.autoscroll.enabled", false);
pref("apz.frame_delay.enabled", false);
pref("apz.keyboard.enabled", false);
pref("apz.popups.enabled", false);
pref("apz.second_tap_tolerance", "0.5");
pref("browser.onboarding.hidden", false);
pref("browser.onboarding.newtour", "private,addons,customize,search,default,sync");
pref("browser.onboarding.notification.finished", false);
pref("browser.onboarding.notification.max-life-time-per-tour-ms", 432000000);
pref("browser.onboarding.notification.max-prompt-count-per-tour", 8);
pref("browser.onboarding.notification.mute-duration-on-first-session-ms", 300000);
pref("browser.onboarding.tourset-version", 1);
pref("browser.onboarding.updatetour", "");
pref("browser.places.useAsyncTransactions", false);
pref("browser.safebrowsing.provider.google.advisoryName", "Google Safe Browsing.");
pref("browser.safebrowsing.provider.google.advisoryURL", "https://developers.google.com/safe-browsing/v4/advisory");
pref("browser.safebrowsing.provider.google4.advisoryName", "Google Safe Browsing.");
pref("browser.safebrowsing.provider.google4.advisoryURL", "https://developers.google.com/safe-browsing/v4/advisory");
pref("browser.tabs.restorebutton", 0);
pref("browser.touchmode.auto", false);
  // ^^ 1355771 touch mode in Windows tablet mode - covered by RFP
pref("devtools.gridinspector.gridOutlineMaxColumns", 50);
pref("devtools.gridinspector.gridOutlineMaxRows", 50);
pref("devtools.gridinspector.showNegativeLineNumbers", false);
pref("devtools.inspector.shapesHighlighter.enabled", false);
pref("devtools.netmonitor.visibleColumns", "[\"status\",\"method\",\"file\",\"domain\",\"cause\",\"type\",\"transferred\",\"contentSize\",\"waterfall\"]");
pref("devtools.promote.layoutview", 1);
pref("devtools.promote.layoutview.showPromoteBar", true);
pref("dom.disable_window_showModalDialog", true);
pref("dom.forms.autocomplete.formautofill", false);
  // ^^ https://bugzilla.mozilla.org/show_bug.cgi?id=1362290
pref("dom.gamepad.haptic_feedback.enabled", true);
pref("dom.noopener.newprocess.enabled", true);
pref("dom.performance.time_to_non_blank_paint.enabled", false);
pref("dom.timeout.background_budget_regeneration_rate", 100);
pref("dom.timeout.background_throttling_max_budget", 50);
pref("dom.timeout.budget_throttling_max_delay", 15000);
pref("dom.timeout.enable_budget_timer_throttling", false);
pref("dom.timeout.foreground_budget_regeneration_rate", 1);
pref("dom.timeout.foreground_throttling_max_budget", -1);
pref("dom.timeout.throttling_delay", 30000);
pref("extensions.formautofill.firstTimeUse", true);
 // ^^ we already kill this extension and who cares about FirstTimeUse triggers
pref("extensions.webextensions.protocol.remote", true);
pref("gfx.direct3d11.break-on-error", false);
pref("gfx.direct3d11.enable-debug-layer", false);
pref("gfx.webrender.highlight-painted-layers", false);
pref("gfx.webrender.layers-free", false);
pref("gl.use-tls-is-current", 0);
pref("image.layout_network_priority", true);
pref("javascript.options.mem.nursery.max_kb", -1);
pref("javascript.options.streams", false);
pref("layers.gpu-process.allow-software", true);
pref("layers.mlgpu.dev-enabled", false);
pref("layers.mlgpu.enable-on-windows7", false);
pref("media.cubeb.logging_level", "");
pref("media.decoder.skip-to-next-key-frame.enabled", true);
pref("media.getusermedia.channels", 0);
pref("media.memory_cache_max_size", 8192);
pref("media.memory_caches_combined_limit_kb", 524288);
pref("media.memory_caches_combined_limit_pc_sysmem", 5);
pref("media.navigator.mediadatadecoder_enabled", false);
pref("media.peerconnection.video.denoising", false);
pref("media.resume-bkgnd-video-on-tabhover", true);
pref("media.windows-media-foundation.use-nv12-format", false);
pref("network.http.active_tab_priority", true);
pref("network.http.on_click_priority", true);
pref("network.http.rcwn.max_wait_before_racing_ms", 500);
pref("network.http.throttle.time-window", 3000);
pref("network.preload", true);
  // ^^ https://bugzilla.mozilla.org/show_bug.cgi?id=1222633
pref("network.standard-url.punycode-host", false);
pref("preferences.allow.omt-write", false);
  // ^^ related: https://bugzilla.mozilla.org/show_bug.cgi?id=1360214#c9
pref("services.sync.engine.addresses", false);
pref("services.sync.engine.addresses.available", false);
pref("services.sync.engine.creditcards", false);
pref("services.sync.engine.creditcards.available", false);
pref("services.sync.log.logger.engine.addresses", "Debug");
pref("services.sync.log.logger.engine.creditcards", "Debug");
pref("toolkit.crashreporter.include_context_heap", false);
pref("toolkit.datacollection.infoURL", "https://www.mozilla.org/legal/privacy/firefox.html");
pref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false);
pref("webgl.perf.max-acceptable-fb-status-invals", 0);
pref("webgl.perf.max-warnings", 0);
pref("webgl.perf.spew-frame-allocs", true);
pref("widget.window-transforms.disabled", false);

==REMOVED or HIDDEN

pref("apz.highlight_checkerboarded_areas", false);
pref("browser.safebrowsing.temporary.take_v4_completion_result", false);
pref("browser.urlbar.match.title", "#");
pref("browser.urlbar.match.url", "@");
pref("browser.urlbar.restrict.bookmark", "*");
pref("browser.urlbar.restrict.history", "^");
pref("browser.urlbar.restrict.openpage", "%");
pref("browser.urlbar.restrict.searches", "$");
pref("browser.urlbar.restrict.tag", "+");
pref("browser.urlbar.restrict.typed", "~");
pref("devtools.gridinspector.showGridOutline", false);
pref("devtools.layoutview.enabled", false);
pref("devtools.netmonitor.hiddenColumns", "[\"cookies\",\"duration\",\"endTime\",\"latency\",\"protocol\",\"remoteip\",\"responseTime\",\"scheme\",\"setCookies\",\"startTime\"]");
pref("dom.forms.autocomplete.experimental", false);
pref("dom.ipc.plugins.asyncInit.enabled", false);
pref("dom.timeout.tracking_throttling_delay", 30000);
pref("intl.tsf.hack.easy_changjei.do_not_return_no_layout_error", true);
pref("intl.tsf.hack.ms_japanese_ime.do_not_associate_imc_on_win10", false);
pref("layers.gpu-process.max_restarts", 3);
pref("layers.popups.compositing.enabled", false);
pref("media.cubeb.log_level", "");
pref("services.sync.registerEngines", "Bookmarks,Form,History,Password,Prefs,Tab,Addons,ExtensionStorage");
pref("services.sync.sendTabToDevice.enabled", true);
pref("webgl.max-acceptable-fb-status-invals", 0);
pref("webgl.max-perf-warnings", 0);
pref("webrender.highlight-painted-layers", false);

==CHANGED

pref("apz.one_touch_pinch.enabled", true); // prev: false
pref("apz.touch_move_tolerance", "0.1"); // prev: "0.03"
pref("browser.preferences.search", true); // prev: false
pref("browser.preferences.useOldOrganization", false); // prev: true
pref("browser.safebrowsing.provider.mozilla.lists.content.description", "mozfullDesc2"); // prev: "mozfullDesc"
pref("browser.slowStartup.timeThreshold", 30000); // prev: 40000
pref("devtools.debugger.file-search-case-sensitive", false); // prev: true
pref("devtools.debugger.file-search-whole-word", false); // prev: false 
pref("devtools.debugger.new-debugger-frontend", true); // prev: false
pref("devtools.debugger.pending-breakpoints", "{}"); // prev: "[]"
pref("media.decoder-doctor.decode-errors-allowed", ""); // prev: "NS_ERROR_DOM_MEDIA_DEMUXER_ERR, NS_ERROR_DOM_MEDIA_METADATA_ERR"
pref("media.decoder-doctor.decode-warnings-allowed", ""); // prev: "NS_ERROR_DOM_MEDIA_DEMUXER_ERR, NS_ERROR_DOM_MEDIA_METADATA_ERR"
pref("media.eme.chromium-api.video-shmems", 6); // prev: 4
pref("media.seekToNextFrame.enabled", true); // prev: false
pref("network.http.originextension", true); // prev: false
pref("network.http.throttle.enable", true); // prev: false
pref("security.mixed_content.hsts_priming_request_timeout", 2000); // prev: 3000
pref("urlclassifier.disallow_completions", "<long-string>"); // prev: "<long-string"
pref("urlclassifier.flashAllowExceptTable", "except-flashallow-digest256"); // prev: "testexcept-flashallow-simple,except-flashallow-digest256"
pref("urlclassifier.flashAllowTable", "allow-flashallow-digest256"); // prev: "test-flashallow-simple,allow-flashallow-digest256"
pref("urlclassifier.flashExceptTable", "except-flash-digest256"); // prev: "testexcept-flash-simple,except-flash-digest256"
pref("urlclassifier.flashSubDocExceptTable", "except-flashsubdoc-digest256"); // prev: "testexcept-flashsubdoc-simple,except-flashsubdoc-digest256"
pref("urlclassifier.flashSubDocTable", "block-flashsubdoc-digest256"); // prev: "test-flashsubdoc-simple,block-flashsubdoc-digest256"
pref("urlclassifier.flashTable", "block-flash-digest256"); // prev: "test-flash-simple,block-flash-digest256"
pref("urlclassifier.update.response_timeout_ms", 30000); // prev: 15000
pref("urlclassifier.update.timeout_ms", 90000); // prev: 60000
Atavic commented 7 years ago

Onboarding seems a first welcome BS:

pref("browser.onboarding.hidden", true);
pref("browser.onboarding.newtour", "");
pref("browser.onboarding.notification.finished", true);
pref("browser.onboarding.notification.max-life-time-per-tour-ms", 432000000);
pref("browser.onboarding.notification.max-prompt-count-per-tour", 1);
pref("browser.onboarding.notification.mute-duration-on-first-session-ms", 100);
pref("browser.onboarding.tourset-version", 1);
pref("browser.onboarding.updatetour", "");
Atavic commented 7 years ago

dom.timeout.tracking_throttling_delay: 30000

See here

Atavic commented 7 years ago

Race Cache With Network pref("network.http.rcwn.max_wait_before_racing_ms", 500); is child of network.http.rcwn.enabled

This is good: pref("security.data_uri.block_toplevel_data_uri_navigations", true);

And I set logging at minimum: pref("services.sync.log.logger.engine.addresses", "Error");

AdKiller commented 7 years ago

I would if I knew what to do

2glops commented 7 years ago

pref("apz.autoscroll.enabled", false); pref("apz.frame_delay.enabled", false); pref("apz.keyboard.enabled", false); pref("apz.popups.enabled", false);

Safe to ignore : https://dxr.mozilla.org/mozilla-central/source/gfx/layers/apz/src/AsyncPanZoomController.cpp#125 ...138 ...281 ...288 ...356

2glops commented 7 years ago

pref("intl.regional_prefs.use_os_locales", false); Should be make inactive ? https://dxr.mozilla.org/mozilla-central/source/modules/libpref/init/all.js#2307 1364789

Atavic commented 7 years ago

this pref allows user to request that all internationalization formatters like date/time formatting, unit formatting, calendars etc. should use OS locale set instead of the app locale set.

2glops commented 7 years ago

pref("network.preload", true); Safe to ignore : https://developer.mozilla.org/en-US/docs/Web/HTML/Preloading_content 1222633

IMO, there is no privacy concern here.

Theemim commented 7 years ago 
// enables the preloading (i.e., preloading of <link rel="preload"> URLs).
pref("network.preload", true);

Is there a speculative aspect to that? Could there be cases where a web developer assumes a resource will be needed, but that resource isn't needed because of how the user interacts with the page or has their browser configured?

Could that interfere with any addons (create network traffic before they have the context they need to decide whether to block it)?

I don't see it included in network.networkPredictionEnabled:

// Add settings objects for supported APIs to the preferences manager.
ExtensionPreferencesManager.addSetting("network.networkPredictionEnabled", {
  prefNames: [
    "network.predictor.enabled",
    "network.prefetch-next",
    "network.http.speculative-parallel-limit",
    "network.dns.disablePrefetch",
  ],

My first impression is that none of those would disable it. I need some caffeine, and your eyes may be better, so: https://dxr.mozilla.org/mozilla-central/source/uriloader/prefetch/nsPrefetchService.cpp. Followup: Quick tests in beta and nightly were consistent with my first impression.

Atavic commented 7 years ago

Is there a speculative aspect to that?

Yes. On twitter 176 occurences are found, as:

<link rel="preload" href="https://abs.twimg.com/k/en/init.en.8aa0e9077608f68c80d3.js" as="script">

earthlng commented 7 years ago

Is there a speculative aspect to that?

not per se afaik. Preload is used to load certain resources with a higher priority than it normally would. That can be used for SEO (=better pagerank for example) Of course it could also be used in a speculative way but that would defeat the purpose and would be kinda silly and counter-productive. The main problems that I could see are (1) with GM userscripts, (2) perhaps potential problems with CSP or certain origin attributes not being applied correctly in all cases, and (3) potential type-confusion problems/attacks.

earthlng commented 7 years ago

https://developer.mozilla.org/en-US/Firefox/Releases/56#DOM:

The Window.showModalDialog() method has been removed (bug 981796).

=> disabled with this pref in 56 and fully removed in 57 with 1374460 (they forgot to remove the prefs again though) => moved to 'ignored => new'

Atavic commented 6 years ago

It's a recent feature: http://caniuse.com/#feat=link-rel-preload

What types of content can be preloaded?

Answer here.

I see it as a placebo to optimize hogged sites. Currently I'm on the opposite field, as keeping a local copy of some needed scripts for sites to load, while ignoring most of other resources.

If interested, see here.

earthlng commented 6 years ago

56b12 changes since 56b1

new

pref("apz.second_tap_tolerance", "0.5"); pref("browser.tabs.restorebutton", 0); // new with value 'false' in Beta 1 pref("browser.urlbar.speculativeConnect.enabled", false); // new with value 'true' in Beta 1 pref("media.windows-media-foundation.use-nv12-format", false); pref("network.http.throttle.time-window", 3000); pref("services.sync.engine.bookmarks.validation.enabled", true);

removed, renamed or hidden

pref("extensions.screenshots.system-disabled", true); pref("geo.provider.ms-windows-location", false);

changed

pref("apz.touch_move_tolerance", "0.1"); // prev: "0.03" pref("browser.crashReports.unsubmittedCheck.enabled", true); // prev: false pref("devtools.debugger.prefs-schema-version", "1.0.2"); // prev: "1.0.0" pref("editor.use_div_for_default_newlines", true); // prev: false pref("font.name-list.monospace.ja", "MS Gothic,..."); pref("font.name-list.sans-serif.ja", "Meiryo,..."); pref("font.name-list.serif.ja", "Yu Mincho,..."); pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); // prev: "https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_API_KEY%" pref("network.predictor.enable-prefetch", false); // prev: true // this was already changed in 55.0.1 pref("security.mixed_content.send_hsts_priming", true); // prev: false pref("security.mixed_content.use_hsts", true); // prev: false

since the beta branch should have already been merged to release yesterday, I've update the first post with these latest changes.

earthlng commented 6 years ago

moved to 'ignore' from 'new':

=> not messing with memory cache integer values

moved to 'ignore' from 'changed':

=> throttle is fine, and touch move tolerance ... who cares

update:

network.standard-url.punycode-host - will be set to true in 57. This will be a pretty big change in how FF handles urls internally and we should definitely not mess with it. No need to enforce either - the pref will likely get removed again when they are satisfied that everything works as expected.

earthlng commented 6 years ago

done or moved to tasks - see first post

pending

moved to ignore:new

earthlng commented 6 years ago

https://bugzilla.mozilla.org/show_bug.cgi?id=1390346#c25

Yes, extensions.webextensions.protocol.remote=true is required for extensions to work now that file system read access sandboxing is enabled for content processes and the extension process. Setting it to false will require also setting sandboxing prefs to disable read access sandboxing.

The pref extensions.webextensions.protocol.remote was only added to aid debugging and provide a fallback shortly after moz-extension remoting was landed. If it's causing confusion, we could remove it. It has been helpful for debugging in a few instances.

https://bugzilla.mozilla.org/show_bug.cgi?id=1390346#c33

Does this pref serve a purpose? maybe we should get rid of it?

My preference would be to keep it for now because it's useful for debugging. Beyond debugging, it doesn't serve a purpose. And now that we've landed filesystem read access sandboxing, setting the pref to false requires flipping some sandbox prefs to get working extensions. That said, I've found it useful a few times while debugging extension issues.

https://bugzilla.mozilla.org/show_bug.cgi?id=1334550#c25

its expected lifetime is approximately the same as security.sandbox.content.level and I'd hope this can be removed once our sandbox is stabilized.

conclusion: best to ignore this

earthlng commented 6 years ago

Last three all look like we can ignore them - agreed?

Yes

earthlng commented 6 years ago

security.data_uri.block_toplevel_data_uri_navigations - if there are still some issues wouldn't it be better to wait then? I'm on ESR so I don't really care - up to you.

btw please check if the prefs that we haven't ignored were actually set to the value the diff says, because I just noticed that they changed something with the omni.ja creation, and the order in which the default preferences files are loaded might have changed. Meaning that if a certain pref exists in 2 or more pref-files and with different values then the output of my diffs-script could be wrong for those prefs.

I'll adjust my scripts to detect the preferences files and their load-order automatically rather than hardcoded, which will also guarantee that I won't miss a new or split-out preferences file.

fmarier commented 6 years ago

My only concern, because I am not an expert, would be that this could used on eg hyperlinks to 3rd party eg tracker)? IDK <a href = www.evil.com?blahblah preload = true whatever (scuse my shitty code example)

If trackers can get around extension-based blockers (or the built-in tracking protection) that way, then it's a bug that needs to be fixed :)

earthlng commented 6 years ago

unless you meant that the first post should be accurate?

this. I was also wondering if maybe they messed something up which could result in the preferences files being loaded in an unintended order. But somehow it manages to load firefox-l10n.js after firefox.js even though as I understand the code it shouldn't. No idea why. Loading the files in a hardcoded order in my scripts seems to produce correct results though. I'll check with @Theemim once 57 is released to see if we get the same results.

it's all over my head mate, just askin' :)

https://developer.mozilla.org/en-US/docs/Web/HTML/Preloading_content

The preload value of the <link> element's rel attribute allows you to write declarative fetch requests in your HTML <head>

<a> tags cannot use preload!

earthlng commented 6 years ago

Need a test site.

<body>
<script>console.log(navigator.connection);</script>
</body>

FF56 Desktop on Windows: dom.netinfo.enabled;false (default) : undefined dom.netinfo.enabled;true : NetworkInformation { type: "none", ontypechange: null } dom.netinfo.enabled;true + RFP : NetworkInformation { type: "unknown", ontypechange: null }

fmarier commented 6 years ago

The transition to SBv4 will be gradual and done via a Shield add-on, which is disabled by user.js. So if you want to switch to it now, you can flip the prefs that the add-on will change:

https://github.com/mozilla/sbv4-gradual-rollout/blob/master/bootstrap.js#L16-L20

Otherwise you'll stay on V2 until either a 56 point release flips the prefs permanently, or 57 is released.

earthlng commented 6 years ago
  1. yes
  2. geo.enabled only
  3. it's false by default and IMO we can ignore it. Or you can add it to the autofill item, idc.