arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.96k stars 511 forks source link

troubleshooter.js: clean up prefs list #339

Closed Thorin-Oakenpants closed 6 years ago

Thorin-Oakenpants commented 6 years ago
earthlng commented 6 years ago

Good work on that list mate, thanks! I've gone over it and removed most of them: https://github.com/ghacksuserjs/ghacks-user.js/commit/a3bffb83bd2e34dc0881692559c28b2e120f95d2 Down to 79. Some of the ones I didn't remove can't break pages but they are standalone prefs and there's no harm to leave them in the list IMO.

I've also removed ...

earthlng commented 6 years ago

I kinda disagree with some of the stuff kept

yeah but it's kinda neat that the script can also help someone narrow down on those things as well. And since we are most likely not gonna get it down to below 64, it doesn't really matter that they're in the list too.

do we have a list of inactive at non-default?

based on the master user.js and compared against FF57.0.4 default values:

inactive prefs by category

```js // hidden, future-proofing and whatnot: pref("browser.cache.memory.capacity", 0); pref("browser.tabs.remote.autostart.2", true); pref("browser.tabs.remote.force-enable", true); pref("font.system.whitelist", ""); pref("general.appname.override", "Netscape"); pref("general.appversion.override", "5.0 (Windows)"); pref("general.buildID.override", "20100101"); pref("general.oscpu.override", "Windows NT 6.1"); pref("general.platform.override", "Win32"); pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0"); pref("geo.wifi.logging.enabled", true); pref("permissions.memory_only", true); pref("privacy.resistFingerprinting.block_mozAddonManager", true); pref("privacy.window.maxInnerHeight", 900); pref("privacy.window.maxInnerWidth", 1600); pref("security.insecure_connection_icon.pbmode.enabled", true); pref("security.nocertdb", true); // non-default: pref("accessibility.typeaheadfind", true); pref("app.update.enabled", false); pref("browser.cache.memory.enable", false); pref("browser.chrome.favicons", false); pref("browser.chrome.site_icons", false); pref("browser.download.autohideButton", false); pref("browser.privatebrowsing.autostart", true); pref("browser.safebrowsing.allowOverride", false); pref("browser.safebrowsing.blockedURIs.enabled", false); pref("browser.safebrowsing.downloads.enabled", false); pref("browser.safebrowsing.downloads.remote.block_dangerous", false); pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false); pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); pref("browser.safebrowsing.downloads.remote.block_uncommon", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); pref("browser.safebrowsing.provider.google.gethashURL", ""); pref("browser.safebrowsing.provider.google.updateURL", ""); pref("browser.safebrowsing.provider.google4.gethashURL", ""); pref("browser.safebrowsing.provider.google4.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.sessionhistory.max_total_viewers", 0); pref("browser.startup.homepage", "https://www.example.com/"); pref("browser.startup.page", 0); pref("browser.tabs.loadBookmarksInTabs", true); pref("browser.tabs.remote.autostart", true); pref("browser.urlbar.maxRichResults", 0); pref("dom.event.contextmenu.enabled", false); pref("dom.indexedDB.enabled", false); pref("dom.ipc.plugins.sandbox-level.default", "donotuse"); pref("dom.ipc.plugins.sandbox-level.flash", "donotuse"); pref("dom.ipc.processCount", 4); pref("dom.storage.enabled", false); pref("dom.vr.enabled", false); pref("extensions.e10sBlocksEnabling", false); pref("extensions.screenshots.disabled", true); pref("extensions.systemAddon.update.url", ""); pref("extensions.update.enabled", false); pref("font.name.monospace.x-unicode", "Lucida Console"); pref("font.name.monospace.x-western", "Lucida Console"); pref("font.name.sans-serif.x-unicode", "Arial"); pref("font.name.sans-serif.x-western", "Arial"); pref("font.name.serif.x-unicode", "Georgia"); pref("font.name.serif.x-western", "Georgia"); pref("full-screen-api.warning.delay", 0); pref("full-screen-api.warning.timeout", 0); pref("general.autoScroll", false); pref("gfx.direct2d.disabled", true); pref("javascript.options.baselinejit", false); pref("javascript.options.ion", false); pref("media.flac.enabled", false); pref("media.mediasource.enabled", false); pref("media.mediasource.mp4.enabled", false); pref("media.mediasource.webm.audio.enabled", false); pref("media.mp4.enabled", false); pref("media.ogg.enabled", false); pref("media.ogg.flac.enabled", false); pref("media.opus.enabled", false); pref("media.raw.enabled", false); pref("media.wave.enabled", false); pref("media.webm.enabled", false); pref("media.wmf.enabled", false); pref("media.wmf.vp9.enabled", false); pref("network.dns.disableIPv6", true); pref("places.history.enabled", false); pref("plugin.state.flash", 0); pref("privacy.clearOnShutdown.openWindows", true); pref("privacy.cpd.openWindows", true); pref("privacy.trackingprotection.annotate_channels", false); pref("privacy.trackingprotection.enabled", true); pref("privacy.usercontext.about_newtab_segregation.enabled", true); pref("privacy.userContext.enabled", true); pref("privacy.userContext.longPressBehavior", 2); pref("privacy.userContext.ui.enabled", true); pref("reader.parse-on-load.enabled", false); pref("security.sandbox.content.level", "donotuse"); pref("security.sandbox.logging.enabled", true); pref("security.ssl.require_safe_negotiation", true); pref("security.ssl3.dhe_rsa_aes_128_sha", false); pref("security.ssl3.dhe_rsa_aes_256_sha", false); pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); pref("security.ssl3.rsa_aes_128_sha", false); pref("security.ssl3.rsa_aes_256_sha", false); pref("security.ssl3.rsa_des_ede3_sha", false); pref("services.blocklist.addons.collection", ""); pref("services.blocklist.gfx.collection", ""); pref("services.blocklist.onecrl.collection", ""); pref("services.blocklist.plugins.collection", ""); pref("signon.rememberSignons", false); pref("svg.disabled", true); pref("toolkit.cosmeticAnimations.enabled", false); pref("urlclassifier.trackingTable", "test-track-simple,base-track-digest256,content-track-digest256"); pref("xpinstall.signatures.required", false); // matching default value: pref("browser.stopReloadAnimation.enabled", true); pref("clipboard.autocopy", false); pref("dom.ipc.processCount.extension", 1); pref("dom.ipc.processCount.file", 1); pref("dom.presentation.controller.enabled", false); pref("dom.presentation.discoverable", false); pref("dom.presentation.discovery.enabled", false); pref("dom.presentation.enabled", false); pref("dom.presentation.receiver.enabled", false); pref("dom.presentation.session_transport.data_channel.enable", false); pref("extensions.webextensions.remote", true); pref("media.mediasource.webm.enabled", false); pref("media.wmf.amd.vp9.enabled", true); pref("network.cookie.lifetime.days", 90); pref("network.cookie.lifetimePolicy", 0); pref("network.dnsCacheEntries", 400); pref("network.dnsCacheExpiration", 60); pref("network.http.fast-fallback-to-IPv4", true); pref("offline-apps.quota.warn", 51200); pref("privacy.cpd.downloads", true); pref("privacy.trackingprotection.lower_network_priority", false); pref("privacy.trackingprotection.pbmode.enabled", true); ```

earthlng commented 6 years ago

Sure why not, it's easy to implement.

earthlng commented 6 years ago

Note: we should also update the troubleshooting wiki page with link to the video (is that going to stay there forever?) and script

Absolutely. You're the wiki wizard - what are you waiting for? :smile: "is that going to stay there forever" - IDK but probably not

// hidden, future-proofing and whatnot: // these three are problematic

I agree. It's possible that they require a restart but regardless of that ...

// non-default: I agree with most of it except for these:

earthlng commented 6 years ago

I'll add these: 'dom.event.contextmenu.enabled' 'dom.indexedDB.enabled' 'dom.storage.enabled' 'dom.vr.enabled' 'media.flac.enabled' 'media.mp4.enabled' 'media.ogg.enabled' 'media.opus.enabled' 'media.raw.enabled' 'media.wave.enabled' 'media.webm.enabled' 'media.wmf.enabled' 'plugin.state.flash' 'security.ssl.require_safe_negotiation' 'security.ssl3.dhe_rsa_aes_128_sha' 'security.ssl3.dhe_rsa_aes_256_sha' 'security.ssl3.ecdhe_ecdsa_aes_128_sha' 'security.ssl3.ecdhe_rsa_aes_128_sha' 'security.ssl3.rsa_aes_128_sha' 'security.ssl3.rsa_aes_256_sha' 'security.ssl3.rsa_des_ede3_sha' 'svg.disabled'

and remove these: 'media.getusermedia.screensharing.allowed_domains', // webrtc, right? 'media.getusermedia.screensharing.enabled', // webrtc, right? 'permissions.manager.defaultsUrl', // only affects addons.mozilla.org and only in a minor way

ran it in my ESR with these changes and with the new code that reduces the list to non-default values and it detects 66 prefs. Damn sooo close! what else can we get rid of?? :smile:

earthlng commented 6 years ago

yeah fuck altsvc + vibrator. thx :smile: how about webchannel.allowObject.urlWhitelist that's some shit that only a few mozilla domains are allowed to use anyway. and the 3 dom.push.* also rely on each other.

earthlng commented 6 years ago

I say remove it from the list

removed. https://github.com/ghacksuserjs/ghacks-user.js/commit/d1ab8fd10cec818c3def5dbe06b114fcb17c654f

earthlng commented 6 years ago

we haven't looked at the hidden and default ones from the active list. Still have that file I sent you?

crssi commented 6 years ago

FYI: I have 'dom.event.contextmenu.enabled' 'dom.serviceWorkers.enabled' set to false and Outlook, maps, street view works flawlessly. IDK for twitter, since I am not using it.

crssi commented 6 years ago

But I had breakage when 'security.mixed_content.block_active_content' was set to true. Same goes for 'security.mixed_content.block_display_content'.

crssi commented 6 years ago

OMG... wrong copy paste 2 posts back.

I meant 'dom.serviceWorkers.enabled' instead of 'dom.event.contextmenu.enabled'. Edited that post now.

earthlng commented 6 years ago

new version is up. It can now somewhat narrow down on more than 1 troublemaker. To help with that I reorganized the list and created groups. It's now also better when the problem is fixed more often during the test runs and therefore the list is ordered from most to least likely culprits.

removed from the list:

[1] https://dxr.mozilla.org/mozilla-release/search?q=face_detection [2] https://dxr.mozilla.org/mozilla-esr52/search?q=face_detection [3] Bug 1416703 - Part 7: Remove some dead prefs in all.js

earthlng commented 6 years ago
earthlng commented 6 years ago

I wondered why you had it back to front

I explained why, here

network.cookie.thirdparty.sessionOnly makes all 3rd party cookies session only ie they get deleted when you close FF. This pref can't break sites at all, I'll remove it from the list.

earthlng commented 6 years ago

why you would want fixes over failures

because it makes a difference when we try to narrow down on more than 1 culprit.

Lets say there are 100 detected prefs. For the first test the 1st 50 prefs are reset to their default values. If the problem re-appears now, we only know for sure that at least ONE problematic pref is within the 2nd half. While looking for a single culprit the script will now set the array to the 2nd half and continue the halfing. But to find all culprits the script can only narrow down the list whenever the problem does not happen, because only then can it be sure that all problematic prefs are within the group that just got reset for this testrun.

earthlng commented 6 years ago

network.cookie.thirdparty.sessionOnly - apparently sessionOnly can mess with service workers. FFS!

https://github.com/ghacksuserjs/ghacks-user.js/issues/326#issuecomment-357291615

let's just keep it for now.

earthlng commented 6 years ago

https://anonfile.com/faq - "How long will my files be online?"

earthlng commented 6 years ago

A lot could be written about it but I think we can keep it relatively short.

Before you go on to the laborious task of manual troubleshooting we recommend to try the script first. In many cases it should be able to either directly identify the culprit or at least narrow it down to a more manageable number of prefs for the manual troubleshooting. You can just run the script and follow the instructions but we strongly recommend to watch the demo video first.

edit:

put the scratchpad section before the manual section

yes