search

arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.96k stars 511 forks source link

ToDo: diffs FF63-FF64 #535

Closed earthlng closed 5 years ago

earthlng commented 5 years ago

FF64 is scheduled for release 11th Dec

FF64 release notes [when ready] FF64 for developers FF64 compatibility FF64 security advisories

140 diffs ( 63 new, 45 gone, 32 different )

misc:

Added here for visibility

new in v64.0:

▼ these three, if required (unlikely), will be covered in #528 

pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"id\":\"cfr\",\"enabled\":false,\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"frequency\":{\"custom\":[{\"period\":\"daily\",\"cap\":1}]}}");
pref("browser.newtabpage.activity-stream.asrouter.providers.onboarding", "{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":true}");
pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{\"id\":\"snippets\",\"enabled\":false,\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000}");

removed, renamed or hidden in v64.0:

ALL DONE - https://github.com/ghacksuserjs/ghacks-user.js/commit/61be5ae563e0e7e3427885a16e6f920437797966

changed in v64.0:

everything moved to ignore

ignore

click me for details

==NEW ```js pref("browser.contentblocking.originlog.length", 32); pref("browser.fission.simulate", false); pref("browser.urlbar.ctrlCanonizesURLs", true); pref("browser.urlbar.quantumbar", false); pref("devtools.gridinspector.maxHighlighters", 3); pref("devtools.inspector.changes.enabled", false); pref("devtools.performance.recording.ui-base-url", "https://perf-html.io"); pref("devtools.recordreplay.mvp.enabled", false); pref("devtools.remote.adb.extensionURL", "https://ftp.mozilla.org/pub/mozilla.org/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi"); pref("devtools.responsive.showUserAgentInput", false); pref("devtools.responsive.touchSimulation.enabled", false); pref("devtools.responsive.userAgent", ""); pref("devtools.responsive.viewport.height", 480); pref("devtools.responsive.viewport.pixelRatio", 0); pref("devtools.responsive.viewport.width", 320); pref("devtools.webconsole.jsterm.reverse-search", false); pref("dom.caches.testing.enabled", false); pref("dom.event.returnValue.enabled", false); pref("dom.fetchObserver.enabled", false); pref("dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value", false); pref("dom.payments.request.user_interaction_required", true); pref("dom.performance.children_results_ipc_timeout", 1000); pref("dom.performance.time_to_first_interactive.enabled", false); pref("dom.security.featurePolicy.enabled", false); pref("dom.serviceWorkers.testing.enabled", false); pref("dom.testing.structuredclonetester.enabled", false); pref("dom.vr.external.notdetected.timeout", 60000); pref("dom.vr.external.quit.timeout", 10000); pref("dom.worker.canceling.timeoutMilliseconds", 30000); pref("dom.xhr.standard_content_type_normalization", false); pref("extensions.webextensions.performanceCountersMaxAge", 1000); pref("extensions.webextensions.userScripts.enabled", false); pref("gfx.font_ahem_antialias_none", false); pref("gfx.webrender.blob.paint-flashing", false); pref("identity.fxaccounts.commands.missed.fetch_interval", 86400); pref("image.animated.generate-full-frames", false); pref("image.cache.max-rasterized-svg-threshold-kb", 92160); pref("image.mem.debug-reporting", false); pref("intl.multilingual.downloadEnabled", true); pref("javascript.options.baselinejit.threshold", 10); pref("javascript.options.ion.frequent_bailout_threshold", 10); pref("javascript.options.ion.threshold", 1000); pref("layout.css.clip-path-path.enabled", false); pref("layout.css.scrollbar-color.enabled", true); pref("layout.css.supports-selector.enabled", false); pref("media.navigator.mediadatadecoder_h264_enabled", false); pref("media.wmf.force.allow-p010-format", false); pref("network.security.esni.enabled", false); pref("pdfjs.eventBusDispatchToDOM", false); pref("privacy.userInteraction.document.interval", 1800); pref("privacy.userInteraction.expiration", 2592000); pref("security.certerrors.recordEventTelemetry", true); pref("security.identitypopup.recordEventElemetry", true); pref("security.sandbox.plugin.tempDirSuffix", ""); pref("security.tls.hello_downgrade_check", false); pref("toolkit.aboutPerformance.showInternals", false); pref("toolkit.coverage.enabled", false); pref("toolkit.coverage.endpoint.base", "**h**ttps://coverage.mozilla.org"); ``` ==REMOVED or HIDDEN ```js pref("browser.audioFeeds.handler", "ask"); pref("browser.feeds.handler", "ask"); pref("browser.migrate.automigrate.daysToOfferUndo", 4); pref("browser.migrate.automigrate.enabled", false); pref("browser.migrate.automigrate.inpage.ui.enabled", false); pref("browser.migrate.automigrate.ui.enabled", true); pref("browser.onboarding.newtour", "performance,private,screenshots,addons,customize,default"); pref("browser.onboarding.notification.finished", false); pref("browser.onboarding.notification.max-life-time-all-tours-ms", 1209600000); pref("browser.onboarding.notification.max-life-time-per-tour-ms", 432000000); pref("browser.onboarding.notification.max-prompt-count-per-tour", 8); pref("browser.onboarding.notification.mute-duration-on-first-session-ms", 300000); pref("browser.onboarding.state", "default"); pref("browser.onboarding.tourset-version", 2); pref("browser.onboarding.updatetour", "performance,library,screenshots,singlesearch,customize,sync"); pref("browser.videoFeeds.handler", "ask"); pref("devtools.commands.dir", ""); pref("devtools.debugger.features.replay", false); pref("devtools.gcli.eagerHelper", 2); pref("devtools.gcli.hideIntro", false); pref("devtools.gcli.imgurClientID", "0df414e888d7240"); pref("devtools.gcli.imgurUploadURL", "https://api.imgur.com/3/image"); pref("devtools.gcli.jquerySrc", "https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.1/jquery.min.js"); pref("devtools.gcli.lodashSrc", "https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.6.1/lodash.min.js"); pref("devtools.gcli.underscoreSrc", "https://cdnjs.cloudflare.com/ajax/libs/underscore.js/1.8.3/underscore-min.js"); pref("devtools.inspector.show-three-pane-tooltip", true); pref("devtools.inspector.three-pane-first-run", true); pref("devtools.new-animationinspector.enabled", true); pref("devtools.promote.accessibility", 1); pref("devtools.webide.adbAddonID", "adbhelper@mozilla.org"); pref("devtools.webide.adbAddonURL", "https://ftp.mozilla.org/pub/mozilla.org/labs/fxos-simulator/adb-helper/#OS#/adbhelper-#OS#-latest.xpi"); pref("dom.streams.enabled", false); pref("extensions.getAddons.themes.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/themes/?src=firefox"); pref("extensions.webcompat.perform_injections", true); pref("extensions.webcompat.perform_ua_overrides", true); pref("layout.css.filters.enabled", true); pref("layout.css.scrollbar-colors.enabled", false); pref("network.cookie.ipc.sync", false); pref("plugins.remember_infobar_dismissal", true); pref("webgl.restore-context-when-visible", true); pref("xpinstall.customConfirmationUI", true); ``` ==CHANGED ```js pref("alerts.useSystemBackend", false); // prev: true pref("app.update.url", "https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml"); // prev: "https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%(noBug1296630v1)(nowebsense)/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml" pref("browser.fastblock.limit", 20000); // prev: 0 pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"model_keys\":[\"nmf_model_animals\",\"nmf_model_business\",\"nmf_model_career\",\"nmf_model_datascience\",\"nmf_model_design\",\"nmf_model_education\",\"nmf_model_entertainment\",\"nmf_model_environment\",\"nmf_model_fashion\",\"nmf_model_finance\",\"nmf_model_food\",\"nmf_model_health\",\"nmf_model_home\",\"nmf_model_life\",\"nmf_model_marketing\",\"nmf_model_politics\",\"nmf_model_programming\",\"nmf_model_science\",\"nmf_model_shopping\",\"nmf_model_sports\",\"nmf_model_tech\",\"nmf_model_travel\",\"nb_model_animals\",\"nb_model_books\",\"nb_model_business\",\"nb_model_career\",\"nb_model_datascience\",\"nb_model_design\",\"nb_model_economics\",\"nb_model_education\",\"nb_model_entertainment\",\"nb_model_environment\",\"nb_model_fashion\",\"nb_model_finance\",\"nb_model_food\",\"nb_model_game\",\"nb_model_health\",\"nb_model_history\",\"nb_model_home\",\"nb_model_life\",\"nb_model_marketing\",\"nb_model_military\",\"nb_model_philosophy\",\"nb_model_photography\",\"nb_model_politics\",\"nb_model_productivity\",\"nb_model_programming\",\"nb_model_psychology\",\"nb_model_science\",\"nb_model_shopping\",\"nb_model_society\",\"nb_model_space\",\"nb_model_sports\",\"nb_model_tech\",\"nb_model_travel\",\"nb_model_writing\"],\"show_spocs\":false,\"personalized\":true,\"version\":1}"); // prev: "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}" pref("browser.safebrowsing.downloads.remote.timeout_ms", 15000); // prev: 10000 pref("browser.tabs.multiselect", true); // prev: false pref("devtools.debugger.features.map-await-expression", true); // prev: false pref("devtools.inspector.activeSidebar", "layoutview"); // prev: "ruleview" pref("devtools.webconsole.inputHistoryCount", 300); // prev: 50 pref("devtools.webconsole.jsterm.codeMirror", true); // prev: false pref("dom.performance.enable_scheduler_timing", true); // prev: false pref("dom.vr.service.enabled", true); // prev: false pref("dom.xhr.lowercase_header.enabled", true); // prev: false pref("editor.inline_table_editing.enabled_by_default", false); // prev: true pref("editor.positioning.enabled_by_default", false); // prev: true pref("editor.resizing.enabled_by_default", false); // prev: true pref("extensions.geckoProfiler.acceptedExtensionIds", "geckoprofiler@mozilla.com,quantum-foxfooding@mozilla.com,raptor@mozilla.org"); // prev: "geckoprofiler@mozilla.com,quantum-foxfooding@mozilla.com" pref("extensions.webextensions.enablePerformanceCounters", true); // prev: false pref("extensions.webextensions.restrictedDomains", "accounts-static.cdn.mozilla.net,accounts.firefox.com,addons.cdn.mozilla.net,addons.mozilla.org,api.accounts.firefox.com,content.cdn.mozilla.net,discovery.addons.mozilla.org,input.mozilla.org,install.mozilla.org,oauth.accounts.firefox.com,profile.accounts.firefox.com,support.mozilla.org,sync.services.mozilla.com,testpilot.firefox.com"); // prev: "accounts-static.cdn.mozilla.net,accounts.firefox.com,addons.cdn.mozilla.net,addons.mozilla.org,api.accounts.firefox.com,content.cdn.mozilla.net,content.cdn.mozilla.net,discovery.addons.mozilla.org,input.mozilla.org,install.mozilla.org,oauth.accounts.firefox.com,profile.accounts.firefox.com,support.mozilla.org,sync.services.mozilla.com,testpilot.firefox.com" pref("font.name-list.sans-serif.zh-TW", "Arial, Microsoft JhengHei, PMingLiU, MingLiU, MingLiU-ExtB"); // prev: "Arial, PMingLiU, MingLiU, MingLiU-ExtB" pref("full-screen-api.unprefix.enabled", true); // prev: false pref("identity.fxaccounts.commands.enabled", true); // prev: false pref("layout.accessiblecaret.height", "36"); // prev: "36.0" pref("layout.accessiblecaret.width", "34"); // prev: "34.0" pref("layout.css.scrollbar-width.enabled", true); // prev: false pref("layout.css.unknown-webkit-pseudo-element", true); // prev: false pref("layout.css.xul-box-display-values.content.enabled", false); // prev: true pref("layout.css.xul-tree-pseudos.content.enabled", false); // prev: true pref("layout.scroll.root-frame-containers", 0); // prev: false pref("media.getusermedia.agc_enabled", true); // prev: false pref("network.http.throttle.enable", false); // prev: true pref("security.pki.distrust_ca_policy", 2); // prev: 1 ```

earthlng commented 5 years ago
some bugzilla tickets

* alerts.useSystemBackend Bug [1155505](https://bugzilla.mozilla.org/show_bug.cgi?id=1155505) - Part 3. Use native Windows Toast backend on Nightly only. * browser.audioFeeds.handler Bug [1477669](https://bugzilla.mozilla.org/show_bug.cgi?id=1477669) - remove feed preview code and associated files/code, * browser.contentblocking.originlog.length Bug [1493563](https://bugzilla.mozilla.org/show_bug.cgi?id=1493563) - Part 7: Store the log more compactly, and cap the size of the origin log at a maximum limit adjustable by a pref; * browser.fastblock.limit Bug [1500208](https://bugzilla.mozilla.org/show_bug.cgi?id=1500208) - Disable FastBlock, hide FastBlock UI everywhere. Bug [1488951](https://bugzilla.mozilla.org/show_bug.cgi?id=1488951) - Put a limit on how long FastBlock runs. * browser.feeds.handler Bug [1477669](https://bugzilla.mozilla.org/show_bug.cgi?id=1477669) - remove feed preview code and associated files/code, * browser.fission.simulate Bug [1490810](https://bugzilla.mozilla.org/show_bug.cgi?id=1490810) - Simulate Fission for browser actors by blocking them from receiving sub-frame events. * browser.migrate.automigrate.daysToOfferUndo Bug [1488926](https://bugzilla.mozilla.org/show_bug.cgi?id=1488926) - remove automigration code (already preffed off), * browser.migrate.automigrate.enabled Bug [1488926](https://bugzilla.mozilla.org/show_bug.cgi?id=1488926) - remove automigration code (already preffed off), * browser.migrate.automigrate.inpage.ui.enabled Bug [1488926](https://bugzilla.mozilla.org/show_bug.cgi?id=1488926) - remove automigration code (already preffed off), * browser.migrate.automigrate.ui.enabled Bug [1488926](https://bugzilla.mozilla.org/show_bug.cgi?id=1488926) - remove automigration code (already preffed off), * browser.onboarding.enabled Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.newtour Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.notification.finished Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.notification.max-life-time-all-tours-ms Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.notification.max-life-time-per-tour-ms Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.notification.max-prompt-count-per-tour Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.notification.mute-duration-on-first-session-ms Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.state Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.tourset-version Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.onboarding.updatetour Bug [1462415](https://bugzilla.mozilla.org/show_bug.cgi?id=1462415) - Delete onboarding system add-on * browser.safebrowsing.downloads.remote.timeout_ms Bug [1479898](https://bugzilla.mozilla.org/show_bug.cgi?id=1479898) - P3. Increase the application reputation remote lookup timeout to 15sec * browser.tabs.multiselect Bug [1474938](https://bugzilla.mozilla.org/show_bug.cgi?id=1474938) - Enable the multiselect tabs feature by default for release and beta builds Bug [1458010](https://bugzilla.mozilla.org/show_bug.cgi?id=1458010) - Add ability to select multiple tabs using Ctrl/Cmd * browser.urlbar.ctrlCanonizesURLs Bug [237027](https://bugzilla.mozilla.org/show_bug.cgi?id=237027) - allow turning off URL canonization, remove shift support, and move the remainder from 'cmd' to 'ctrl' on mac * browser.urlbar.quantumbar Bug [1477985](https://bugzilla.mozilla.org/show_bug.cgi?id=1477985) - Implement basic UrlbarInput and UrlbarView classes and a hidden pref for using them. * browser.videoFeeds.handler Bug [1477669](https://bugzilla.mozilla.org/show_bug.cgi?id=1477669) - remove feed preview code and associated files/code, * devtools.debugger.features.map-await-expression Bug [1499614](https://bugzilla.mozilla.org/show_bug.cgi?id=1499614) - Enable top-level await support on every release channel * devtools.gridinspector.maxHighlighters Bug [1317102](https://bugzilla.mozilla.org/show_bug.cgi?id=1317102) - Part 5: Increase the max grid highlighters shown to 3. Bug [1317102](https://bugzilla.mozilla.org/show_bug.cgi?id=1317102) - Part 1: Add a pref to enable displaying multiple grid containers in the CSS Grid Inspector. * devtools.inspector.activeSidebar Bug [1499483](https://bugzilla.mozilla.org/show_bug.cgi?id=1499483) - Make the Layout view the default sidebar tab. * devtools.inspector.changes.enabled Bug [1478448](https://bugzilla.mozilla.org/show_bug.cgi?id=1478448) - (Part 1) Add pref for Track Changes feature. * devtools.new-animationinspector.enabled Bug [1463621](https://bugzilla.mozilla.org/show_bug.cgi?id=1463621) - Part 2: Remove devtools.new-animationinspector.enabled preference Bug [1470807](https://bugzilla.mozilla.org/show_bug.cgi?id=1470807): Enable new animation inspector on Beta and Release channel * devtools.performance.recording.ui-base-url Bug [1480593](https://bugzilla.mozilla.org/show_bug.cgi?id=1480593) - Allow setting a different instance of perf.html for the new performance panel, using a pref * devtools.promote.accessibility Bug [1482461](https://bugzilla.mozilla.org/show_bug.cgi?id=1482461) - remove "New" bubble from Accessibility panel tab Bug [1482454](https://bugzilla.mozilla.org/show_bug.cgi?id=1482454) - Display a "New" indicator to promote the accessibility panel * devtools.recordreplay.mvp.enabled Bug [1495300](https://bugzilla.mozilla.org/show_bug.cgi?id=1495300) - Add a reload and record button * devtools.responsive.showUserAgentInput Bug [1297431](https://bugzilla.mozilla.org/show_bug.cgi?id=1297431) - Add a custom user agent input in responsive design mode * devtools.responsive.touchSimulation.enabled Bug [1248619](https://bugzilla.mozilla.org/show_bug.cgi?id=1248619) - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties * devtools.responsive.userAgent Bug [1248619](https://bugzilla.mozilla.org/show_bug.cgi?id=1248619) - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties * devtools.responsive.viewport.height Bug [1248619](https://bugzilla.mozilla.org/show_bug.cgi?id=1248619) - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties * devtools.responsive.viewport.pixelRatio Bug [1248619](https://bugzilla.mozilla.org/show_bug.cgi?id=1248619) - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties * devtools.responsive.viewport.width Bug [1248619](https://bugzilla.mozilla.org/show_bug.cgi?id=1248619) - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties * devtools.webconsole.inputHistoryCount Bug [1491768](https://bugzilla.mozilla.org/show_bug.cgi?id=1491768) - Increase input history limit * devtools.webconsole.jsterm.codeMirror Bug [1473805](https://bugzilla.mozilla.org/show_bug.cgi?id=1473805) - Enable CodeMirror JSTerm by default on all releases;r=nchevobbe Bug [1470922](https://bugzilla.mozilla.org/show_bug.cgi?id=1470922) - Enable CodeMirror JSTerm on Nightly except for people using accessible technology Bug [1463409](https://bugzilla.mozilla.org/show_bug.cgi?id=1463409) - Add a preference to enable CodeMirror-powered jsterm * devtools.webconsole.jsterm.reverse-search Bug [1024913](https://bugzilla.mozilla.org/show_bug.cgi?id=1024913) - Add a preference to enable the reverse search UI * dom.caches.testing.enabled Bug [1489844](https://bugzilla.mozilla.org/show_bug.cgi?id=1489844) - Port DOMPrefs to StaticPrefs - part 3 - dom.caches.testing.enabled * dom.fetchObserver.enabled Bug [1489844](https://bugzilla.mozilla.org/show_bug.cgi?id=1489844) - Port DOMPrefs to StaticPrefs - part 17 - dom.fetchObserver.enabled * dom.ipc.tabs.shutdownTimeoutSecs Bug [1498942](https://bugzilla.mozilla.org/show_bug.cgi?id=1498942) - Lengthen timeouts for detecting hung content processes during shutdown * dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value Bug [1479964](https://bugzilla.mozilla.org/show_bug.cgi?id=1479964) - Set KeyboardEvent.keyCode and KeyboardEvent.charCode to same value if the event is "keypress" event * dom.payments.request.user_interaction_required Bug [1491996](https://bugzilla.mozilla.org/show_bug.cgi?id=1491996) - Add a pref to disable the user activation/gesture requirement for PaymentRequest.show() * dom.performance.children_results_ipc_timeout Bug [1491816](https://bugzilla.mozilla.org/show_bug.cgi?id=1491816) - deal with unresponsive content processes in ChromeUtils.requestPerformanceMetrics() * dom.performance.enable_scheduler_timing Bug [1496506](https://bugzilla.mozilla.org/show_bug.cgi?id=1496506) - Flip the pref for the new about:performance Bug [1464571](https://bugzilla.mozilla.org/show_bug.cgi?id=1464571) - fixes DOM Worker performance counters * dom.performance.time_to_first_interactive.enabled Bug [1299118](https://bugzilla.mozilla.org/show_bug.cgi?id=1299118): Measure TTI (or TTFI at the moment) in Raptor TP6 * dom.security.featurePolicy.enabled Bug [1390801](https://bugzilla.mozilla.org/show_bug.cgi?id=1390801) - FeaturePolicy - part 2 - WebIDL + DOM integration * dom.serviceWorkers.testing.enabled Bug [1489844](https://bugzilla.mozilla.org/show_bug.cgi?id=1489844) - Port DOMPrefs to StaticPrefs - part 9 - dom.serviceWorkers.testing.enabled * dom.streams.enabled Bug [1489844](https://bugzilla.mozilla.org/show_bug.cgi?id=1489844) - Port DOMPrefs to StaticPrefs - part 13 - dom.streams.enabled, Bug [1491939](https://bugzilla.mozilla.org/show_bug.cgi?id=1491939) - Part 4: Enable streams on a per-realm basis. Drop dom.streams.enabled and dom.workers.options.streams; use only javascript.options.streams. * dom.testing.structuredclonetester.enabled Bug [1487463](https://bugzilla.mozilla.org/show_bug.cgi?id=1487463) - implement StructuredCloneTester to be used in testing * dom.vr.external.notdetected.timeout Bug [1466700](https://bugzilla.mozilla.org/show_bug.cgi?id=1466700) - Refactor gfxVROculus.cpp to use gfxVRExternal interface * dom.vr.external.quit.timeout Bug [1466700](https://bugzilla.mozilla.org/show_bug.cgi?id=1466700) - Refactor gfxVROculus.cpp to use gfxVRExternal interface * dom.vr.service.enabled Bug [1473399](https://bugzilla.mozilla.org/show_bug.cgi?id=1473399) - Enable VR Service thread by default. * dom.worker.canceling.timeoutMilliseconds Bug [1489844](https://bugzilla.mozilla.org/show_bug.cgi?id=1489844) - Port DOMPrefs to StaticPrefs - part 27 - dom.worker.canceling.timeoutMilliseconds, * dom.xhr.lowercase_header.enabled Bug [1398718](https://bugzilla.mozilla.org/show_bug.cgi?id=1398718) - change default pref to on for lowercase header names in XHR.getAllResponseHeaders; * dom.xhr.standard_content_type_normalization Bug [1454325](https://bugzilla.mozilla.org/show_bug.cgi?id=1454325) - have XHRs adjust content type of uploads per spec using the MIME Sniffing standard; * editor.inline_table_editing.enabled_by_default Bug [1490641](https://bugzilla.mozilla.org/show_bug.cgi?id=1490641) - Disable all Gecko specific UIs by default in release build Bug [1449564](https://bugzilla.mozilla.org/show_bug.cgi?id=1449564) - part 4: Make users can show Gecko specific editing UIs with new prefs * editor.positioning.enabled_by_default Bug [1490641](https://bugzilla.mozilla.org/show_bug.cgi?id=1490641) - Disable all Gecko specific UIs by default in release build Bug [1449564](https://bugzilla.mozilla.org/show_bug.cgi?id=1449564) - part 4: Make users can show Gecko specific editing UIs with new prefs * editor.resizing.enabled_by_default Bug [1490641](https://bugzilla.mozilla.org/show_bug.cgi?id=1490641) - Disable all Gecko specific UIs by default in release build Bug [1449564](https://bugzilla.mozilla.org/show_bug.cgi?id=1449564) - part 4: Make users can show Gecko specific editing UIs with new prefs * extensions.geckoProfiler.acceptedExtensionIds Bug [1492955](https://bugzilla.mozilla.org/show_bug.cgi?id=1492955) - Add raptor webext to whitelist for GeckoProfiler webext API * extensions.getAddons.themes.browseURL Bug [1495708](https://bugzilla.mozilla.org/show_bug.cgi?id=1495708) - Remove theme info bar and update plugin notice * extensions.webextensions.enablePerformanceCounters Bug [1496506](https://bugzilla.mozilla.org/show_bug.cgi?id=1496506) - Flip the pref for the new about:performance Bug [1468550](https://bugzilla.mozilla.org/show_bug.cgi?id=1468550) - Track webextension activity * extensions.webextensions.performanceCountersMaxAge Bug [1479740](https://bugzilla.mozilla.org/show_bug.cgi?id=1479740) - Track Web API calls made in the child * extensions.webextensions.restrictedDomains Bug [1492421](https://bugzilla.mozilla.org/show_bug.cgi?id=1492421) - remove duplicate value in restrictedDomains pref * extensions.webextensions.userScripts.enabled Bug [1491272](https://bugzilla.mozilla.org/show_bug.cgi?id=1491272) - Lock experimental userScripts API behind a pref and make it enabled by default on Nightly * font.name-list.sans-serif.zh-TW Bug [1498438](https://bugzilla.mozilla.org/show_bug.cgi?id=1498438) - Use Microsoft JhengHei for zh-TW on all channel * full-screen-api.unprefix.enabled Bug [1448225](https://bugzilla.mozilla.org/show_bug.cgi?id=1448225) - Convert StylePrefs to StaticPrefs * gfx.font_ahem_antialias_none Bug [1494715](https://bugzilla.mozilla.org/show_bug.cgi?id=1494715) - Add a pref to disable antialiasing for Ahem only, * gfx.webrender.blob.paint-flashing Bug [1490891](https://bugzilla.mozilla.org/show_bug.cgi?id=1490891). Support toggling paint flashing in blob images * identity.fxaccounts.commands.enabled Bug [1484465](https://bugzilla.mozilla.org/show_bug.cgi?id=1484465) - Enable FxA Commands feature by default. Bug [1484461](https://bugzilla.mozilla.org/show_bug.cgi?id=1484461) - Disable FxA commands Bug [1483979](https://bugzilla.mozilla.org/show_bug.cgi?id=1483979) - Enable fxa commands Bug [1466933](https://bugzilla.mozilla.org/show_bug.cgi?id=1466933) - Implement FxA commands. * identity.fxaccounts.commands.missed.fetch_interval Bug [1496637](https://bugzilla.mozilla.org/show_bug.cgi?id=1496637) - Fetch missed FxA commands sporadically on sync * image.animated.generate-full-frames Bug [1337111](https://bugzilla.mozilla.org/show_bug.cgi?id=1337111) - Part 5. Add pref to force decoding of full frames, disabled by default. * image.cache.max-rasterized-svg-threshold-kb Bug [1456558](https://bugzilla.mozilla.org/show_bug.cgi?id=1456558) - Part 2. Implement factor of 2 scaling support for SVGs in the surface cache. * image.mem.debug-reporting Bug [1492930](https://bugzilla.mozilla.org/show_bug.cgi?id=1492930) - Part 4. Add ImageMemoryReporter to support extra shared surfaces reporting. * intl.multilingual.downloadEnabled Bug [1493711](https://bugzilla.mozilla.org/show_bug.cgi?id=1493711) - Pref off downloading langpacks outside of release * javascript.options.baselinejit.threshold Bug [1495431](https://bugzilla.mozilla.org/show_bug.cgi?id=1495431) Expose baseline and ion JIT warm up threshold options to preferences, about:config * javascript.options.ion.frequent_bailout_threshold Bug [1495431](https://bugzilla.mozilla.org/show_bug.cgi?id=1495431) Expose baseline and ion JIT warm up threshold options to preferences, about:config * javascript.options.ion.threshold Bug [1495431](https://bugzilla.mozilla.org/show_bug.cgi?id=1495431) Expose baseline and ion JIT warm up threshold options to preferences, about:config * layout.accessiblecaret.height Bug [1485063](https://bugzilla.mozilla.org/show_bug.cgi?id=1485063) Part 1 - Move preferences used in AccessibleCaret to StaticPrefsList.h * layout.accessiblecaret.width Bug [1485063](https://bugzilla.mozilla.org/show_bug.cgi?id=1485063) Part 1 - Move preferences used in AccessibleCaret to StaticPrefsList.h * layout.css.clip-path-path.enabled Bug [1487838](https://bugzilla.mozilla.org/show_bug.cgi?id=1487838) - Add a pref for |clip-path:path()|. * layout.css.filters.enabled Bug [1408841](https://bugzilla.mozilla.org/show_bug.cgi?id=1408841) - Remove preference "layout.css.filters.enabled". * layout.css.scrollbar-color.enabled Bug [1494501](https://bugzilla.mozilla.org/show_bug.cgi?id=1494501) - Rename pref "layout.css.scrollbar-colors.enabled" to "layout.css.scrollbar-color.enabled". * layout.css.scrollbar-colors.enabled Bug [1494501](https://bugzilla.mozilla.org/show_bug.cgi?id=1494501) - Rename pref "layout.css.scrollbar-colors.enabled" to "layout.css.scrollbar-color.enabled". Bug [1492012](https://bugzilla.mozilla.org/show_bug.cgi?id=1492012) - Enable scrollbar-color and scrollbar-width by default. * layout.css.scrollbar-width.enabled Bug [1492012](https://bugzilla.mozilla.org/show_bug.cgi?id=1492012) - Enable scrollbar-color and scrollbar-width by default. Bug [1475033](https://bugzilla.mozilla.org/show_bug.cgi?id=1475033) part 3 - Add scrollbar-width property. * layout.css.supports-selector.enabled Bug [1499386](https://bugzilla.mozilla.org/show_bug.cgi?id=1499386) - Implement @supports selector() syntax. * layout.css.unknown-webkit-pseudo-element Bug [1424106](https://bugzilla.mozilla.org/show_bug.cgi?id=1424106) - Accept unknown webkit pseudo-element. * layout.css.xul-box-display-values.content.enabled Bug [1477553](https://bugzilla.mozilla.org/show_bug.cgi?id=1477553): Hide display: -moz-box|-moz-inline-box from content on Nightly and early beta. * layout.css.xul-tree-pseudos.content.enabled Bug [1480054](https://bugzilla.mozilla.org/show_bug.cgi?id=1480054): Restrict XUL tree pseudos on nightly and early-beta. * layout.scroll.root-frame-containers Bug [1479757](https://bugzilla.mozilla.org/show_bug.cgi?id=1479757) - Switch to containerless scrolling for GeckoView+WR. * media.getusermedia.agc_enabled Bug [1496714](https://bugzilla.mozilla.org/show_bug.cgi?id=1496714) - Enable AGC by default for getUserMedia. * media.navigator.mediadatadecoder_h264_enabled Bug [1496529](https://bugzilla.mozilla.org/show_bug.cgi?id=1496529) - P8. Add media.navigator.mediadatadecoder_h264_enabled preference. * media.wmf.force.allow-p010-format Bug [1497294](https://bugzilla.mozilla.org/show_bug.cgi?id=1497294) - P8. Disable P010 surface type with nvidia adapters. * network.cookie.ipc.sync Bug [1483986](https://bugzilla.mozilla.org/show_bug.cgi?id=1483986) - Remove sync versions of document.cookie getter/setter; * network.http.throttle.enable Bug [1503354](https://bugzilla.mozilla.org/show_bug.cgi?id=1503354) - Disable background HTTP response throttling for causing visible regressions. * network.security.esni.enabled Bug [1473736](https://bugzilla.mozilla.org/show_bug.cgi?id=1473736) - Implement necko part of ESNI * plugins.remember_infobar_dismissal Bug [1438857](https://bugzilla.mozilla.org/show_bug.cgi?id=1438857) - Remove the Flash plugin infobar. * privacy.userInteraction.document.interval Bug [1491835](https://bugzilla.mozilla.org/show_bug.cgi?id=1491835) - Store User-Interaction for AntiTracking purposes - part 4 - update permissions after X seconds, * privacy.userInteraction.expiration Bug [1491835](https://bugzilla.mozilla.org/show_bug.cgi?id=1491835) - Store User-Interaction for AntiTracking purposes - part 2 - storing user-interaction, * security.certerrors.recordEventTelemetry Bug [1484255](https://bugzilla.mozilla.org/show_bug.cgi?id=1484255) - Add Telemetry Events for the certificate error pages. * security.csp.enable_violation_events Bug [1488165](https://bugzilla.mozilla.org/show_bug.cgi?id=1488165) - Remove security.csp.enable_violation_events pref, Bug [1476820](https://bugzilla.mozilla.org/show_bug.cgi?id=1476820) - Convert some VarCache prefs in dom/security/ to use StaticPrefs. * security.identitypopup.recordEventElemetry Bug [1484251](https://bugzilla.mozilla.org/show_bug.cgi?id=1484251) - Part 3 - Use Telemetry events to record interactions in the identity popup. * security.pki.distrust_ca_policy Bug [1496467](https://bugzilla.mozilla.org/show_bug.cgi?id=1496467) - Enable Symantec Distrust in Firefox 64 bug [1460062](https://bugzilla.mozilla.org/show_bug.cgi?id=1460062) - Enforce Symantec distrust in Firefox 63 Bug [1442075](https://bugzilla.mozilla.org/show_bug.cgi?id=1442075) - Enforce Symantec distrust in Firefox 60 Bug [1437754](https://bugzilla.mozilla.org/show_bug.cgi?id=1437754) - Add a pref and disable the Symantec distrust algorithm * security.sandbox.plugin.tempDirSuffix Bug [1488439](https://bugzilla.mozilla.org/show_bug.cgi?id=1488439): Part 1 - Replace Windows temp folder in sandboxed plugin process (r=bobowen,erahm) * security.tls.hello_downgrade_check Bug [1487279](https://bugzilla.mozilla.org/show_bug.cgi?id=1487279) - Pref to control TLS downgrade check, * toolkit.aboutPerformance.showInternals Bug [1502440](https://bugzilla.mozilla.org/show_bug.cgi?id=1502440) - Hide browser internals in about:performance for beta and release users, * toolkit.coverage.enabled Bug [1492656](https://bugzilla.mozilla.org/show_bug.cgi?id=1492656) - move Telemetry Coverage ping in-tree * toolkit.coverage.endpoint.base Bug [1492656](https://bugzilla.mozilla.org/show_bug.cgi?id=1492656) - move Telemetry Coverage ping in-tree * xpinstall.customConfirmationUI Bug [1473933](https://bugzilla.mozilla.org/show_bug.cgi?id=1473933): Part 2 - Remove more unused code.

claustromaniac commented 5 years ago

LOL another glitch in the parser.

pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"model_keys\":[\"nmf_model_animals\",\"nmf_model_business\",\"nmf_model_career\",\"nmf_model_datascience\",\"nmf_model_design\",\"nmf_model_education\",\"nmf_model_entertainment\",\"nmf_model_environment\",\"nmf_model_fashion\",\"nmf_model_finance\",\"nmf_model_food\",\"nmf_model_health\",\"nmf_model_home\",\"nmf_model_life\",\"nmf_model_marketing\",\"nmf_model_politics\",\"nmf_model_programming\",\"nmf_model_science\",\"nmf_model_shopping\",\"nmf_model_sports\",\"nmf_model_tech\",\"nmf_model_travel\",\"nb_model_animals\",\"nb_model_books\",\"nb_model_business\",\"nb_model_career\",\"nb_model_datascience\",\"nb_model_design\",\"nb_model_economics\",\"nb_model_education\",\"nb_model_entertainment\",\"nb_model_environment\",\"nb_model_fashion\",\"nb_model_finance\",\"nb_model_food\",\"nb_model_game\",\"nb_model_health\",\"nb_model_history\",\"nb_model_home\",\"nb_model_life\",\"nb_model_marketing\",\"nb_model_military\",\"nb_model_philosophy\",\"nb_model_photography\",\"nb_model_politics\",\"nb_model_productivity\",\"nb_model_programming\",\"nb_model_psychology\",\"nb_model_science\",\"nb_model_shopping\",\"nb_model_society\",\"nb_model_space\",\"nb_model_sports\",\"nb_model_tech\",\"nb_model_travel\",\"nb_model_writing\"],\"show_spocs\":false,\"personalized\":true,\"version\":1}"); // prev: "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}"

It's the length of the line. It breaks at 1024+ chars. One learns something new every day.

Atavic commented 5 years ago 
pref("devtools.remote.adb.extensionURL",
pref("devtools.webide.autoinstallADBExtension",
pref("devtools.webide.adbAddonID",
pref("devtools.webide.adbAddonURL",
pref("devtools.webide.autoinstallADBHelper",

...are all about remote debugging: https://github.com/mozilla/devtools-adb-extension

Atavic commented 5 years ago 
pref("security.identitypopup.recordEventElemetry", true);

That's a Typo.

earthlng commented 5 years ago

~~@claustromaniac you noob :smile_cat: just kidding! programming is always a work-in-progress. My own script(s) had similar birth pains~~

@Atavic thanks for the link. We already have at least one of those prefs in the user.js and will update it with the renamed pref and perhaps add 1 or 2 more. Yes that's a typo by mozilla

claustromaniac commented 5 years ago

@earthlng I wasn't talking about my parser, though. Mine keeps becoming harder to break :sunglasses: I meant the GitHub parser:

changed in v64.0b9:

pref("alerts.useSystemBackend", false); // prev: true
pref("browser.fastblock.limit", 20000); // prev: 0
pref("browser.newtabpage.activity-stream.asrouter.messageProviders", "[{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":true},{\"id\":\"snippets\",\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000,\"enabled\":false},{\"id\":\"cfr\",\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"enabled\":false,\"cohort\":\"\"}]"); // prev: "[{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":false,\"cohort\":0},{\"id\":\"snippets\",\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/us-west/bundles/bundle_d6d90fb9098ce8b45e60acf601bcb91b68322309.json\",\"updateCycleInMs\":14400000,\"enabled\":false},{\"id\":\"cfr\",\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"enabled\":false,\"cohort\":\"\"}]"
pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"model_keys\":[\"nmf_model_animals\",\"nmf_model_business\",\"nmf_model_career\",\"nmf_model_datascience\",\"nmf_model_design\",\"nmf_model_education\",\"nmf_model_entertainment\",\"nmf_model_environment\",\"nmf_model_fashion\",\"nmf_model_finance\",\"nmf_model_food\",\"nmf_model_health\",\"nmf_model_home\",\"nmf_model_life\",\"nmf_model_marketing\",\"nmf_model_politics\",\"nmf_model_programming\",\"nmf_model_science\",\"nmf_model_shopping\",\"nmf_model_sports\",\"nmf_model_tech\",\"nmf_model_travel\",\"nb_model_animals\",\"nb_model_books\",\"nb_model_business\",\"nb_model_career\",\"nb_model_datascience\",\"nb_model_design\",\"nb_model_economics\",\"nb_model_education\",\"nb_model_entertainment\",\"nb_model_environment\",\"nb_model_fashion\",\"nb_model_finance\",\"nb_model_food\",\"nb_model_game\",\"nb_model_health\",\"nb_model_history\",\"nb_model_home\",\"nb_model_life\",\"nb_model_marketing\",\"nb_model_military\",\"nb_model_philosophy\",\"nb_model_photography\",\"nb_model_politics\",\"nb_model_productivity\",\"nb_model_programming\",\"nb_model_psychology\",\"nb_model_science\",\"nb_model_shopping\",\"nb_model_society\",\"nb_model_space\",\"nb_model_sports\",\"nb_model_tech\",\"nb_model_travel\",\"nb_model_writing\"],\"show_spocs\":false,\"personalized\":true,\"version\":1}"); // prev: "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}"
pref("browser.safebrowsing.downloads.remote.timeout_ms", 15000); // prev: 10000

Am I the only one who sees the line for browser.newtabpage.activity-stream.feeds.section.topstories.options without syntax highlighting?

earthlng commented 5 years ago

oh damn, I wasn't exactly sure what you meant, I'm sorry mate :kissing_cat: no I see the line without syntax highlighting too. I noticed it before in other diffs too but never gave it much of a thought about what the reason may be. @claustromaniac to the rescue ;)

intika commented 5 years ago

Thanks guys for taking time for that :+1:

Thorin-Oakenpants commented 5 years ago

Time people learnt (browser.urlbar.ctrlCanonizesURLs) that the urlbar did not die and is not a saint

Canonize vs Canonicalize

@fmarier Please inform your co-workers :grin:

Thorin-Oakenpants commented 5 years ago

These are just timing prefs, new features at default off, or unrelated to privacy/etc. Pipe up if you think something is important

moved from new to ignore

```js pref("browser.contentblocking.originlog.length", 32); pref("browser.fission.simulate", false); pref("browser.urlbar.ctrlCanonizesURLs", true); pref("browser.urlbar.quantumbar", false); pref("devtools.gridinspector.maxHighlighters", 3); pref("devtools.inspector.changes.enabled", false); pref("devtools.recordreplay.mvp.enabled", false); pref("devtools.webconsole.jsterm.reverse-search", false); pref("dom.caches.testing.enabled", false); pref("dom.fetchObserver.enabled", false); pref("dom.payments.request.user_interaction_required", true); pref("dom.performance.children_results_ipc_timeout", 1000); pref("dom.performance.time_to_first_interactive.enabled", false); pref("dom.serviceWorkers.testing.enabled", false); pref("dom.testing.structuredclonetester.enabled", false); pref("dom.vr.external.notdetected.timeout", 60000); pref("dom.vr.external.quit.timeout", 10000); pref("dom.worker.canceling.timeoutMilliseconds", 30000); pref("extensions.webextensions.performanceCountersMaxAge", 1000); pref("gfx.font_ahem_antialias_none", false); pref("gfx.webrender.blob.paint-flashing", false); pref("identity.fxaccounts.commands.missed.fetch_interval", 86400); pref("image.animated.generate-full-frames", false); pref("image.cache.max-rasterized-svg-threshold-kb", 92160); pref("image.mem.debug-reporting", false); pref("intl.multilingual.downloadEnabled", true); pref("javascript.options.baselinejit.threshold", 10); pref("javascript.options.ion.frequent_bailout_threshold", 10); pref("javascript.options.ion.threshold", 1000); pref("layout.css.clip-path-path.enabled", false); pref("layout.css.scrollbar-color.enabled", true); pref("layout.css.supports-selector.enabled", false); pref("media.navigator.mediadatadecoder_h264_enabled", false); pref("media.wmf.force.allow-p010-format", false); pref("pdfjs.eventBusDispatchToDOM", false); pref("privacy.userInteraction.document.interval", 1800); pref("privacy.userInteraction.expiration", 2592000); pref("security.sandbox.plugin.tempDirSuffix", ""); pref("toolkit.aboutPerformance.showInternals", false); ```

earthlng commented 5 years ago

pref("dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value", false); I'm not sure but it sounds like this breaks keyboard spoofing, perhaps regardless of the value:

https://bugzilla.mozilla.org/show_bug.cgi?id=1479964#c25

And also note that this patch changes the behavior of KeyboardEvent::KeyCode() when spoofing is enabled and the instance is initialized by initKeyEvent() or initKeyboardEvent(). That was changed by bug 1222285 unexpectedly and keeping the behavior makes patched code really ugly. Therefore, this takes back the old behavior even if spoofing is enabled.

maybe you can ask Ethan?

Thorin-Oakenpants commented 5 years ago

Ahh .. OK, onto it (will move it back up) .. I took the name and value to mean no change to current status quo. But I did mean to mention it to Arthur because it would no doubt be flipped to true. I guess I should have read the ticket.

Update: email sent

fmarier commented 5 years ago

Time people learnt (browser.urlbar.ctrlCanonizesURLs) that the urlbar did not die and is not a saint.

Lol! My new favourite typo.

Thorin-Oakenpants commented 5 years ago

@fmarier .. a tad OT: https://webtransparency.cs.princeton.edu/webcensus/data-release/ .. is any of that useful to you guys - eg "Firefox set to block all third-party cookies" and "DoNotTrack header is turned on" and all that cookie stuff

fmarier commented 5 years ago

https://webtransparency.cs.princeton.edu/webcensus/data-release/

Yes, in fact the researcher behind that project (Steven) now works at Mozilla.

Thorin-Oakenpants commented 5 years ago

Same as the last lot. If anything sticks out as being worthy of putting back for more investigation, sing out

PS: interesting scroll-bar width ticket (can this be used via a script (no need for XUL) so scrollbar width is not unique per OS? - just food for thought - note OS is already leaked in many other ways, so I'm not saying to do this, it's just interesting)

moved from changed to ignore

```js pref("browser.contentblocking.originlog.length", 32); pref("browser.fission.simulate", false); pref("browser.urlbar.ctrlCanonizesURLs", true); pref("browser.urlbar.quantumbar", false); pref("devtools.gridinspector.maxHighlighters", 3); pref("devtools.inspector.changes.enabled", false); pref("devtools.recordreplay.mvp.enabled", false); pref("devtools.webconsole.jsterm.reverse-search", false); pref("dom.caches.testing.enabled", false); pref("dom.fetchObserver.enabled", false); pref("dom.payments.request.user_interaction_required", true); pref("dom.performance.children_results_ipc_timeout", 1000); pref("dom.performance.time_to_first_interactive.enabled", false); pref("dom.serviceWorkers.testing.enabled", false); pref("dom.testing.structuredclonetester.enabled", false); pref("dom.vr.external.notdetected.timeout", 60000); pref("dom.vr.external.quit.timeout", 10000); pref("dom.worker.canceling.timeoutMilliseconds", 30000); pref("extensions.webextensions.performanceCountersMaxAge", 1000); pref("gfx.font_ahem_antialias_none", false); pref("gfx.webrender.blob.paint-flashing", false); pref("identity.fxaccounts.commands.missed.fetch_interval", 86400); pref("image.animated.generate-full-frames", false); pref("image.cache.max-rasterized-svg-threshold-kb", 92160); pref("image.mem.debug-reporting", false); pref("intl.multilingual.downloadEnabled", true); pref("javascript.options.baselinejit.threshold", 10); pref("javascript.options.ion.frequent_bailout_threshold", 10); pref("javascript.options.ion.threshold", 1000); pref("layout.css.clip-path-path.enabled", false); pref("layout.css.scrollbar-color.enabled", true); pref("layout.css.supports-selector.enabled", false); pref("media.navigator.mediadatadecoder_h264_enabled", false); pref("media.wmf.force.allow-p010-format", false); pref("pdfjs.eventBusDispatchToDOM", false); pref("privacy.userInteraction.document.interval", 1800); pref("privacy.userInteraction.expiration", 2592000); pref("security.sandbox.plugin.tempDirSuffix", ""); pref("toolkit.aboutPerformance.showInternals", false); ```

Thorin-Oakenpants commented 5 years ago

Speak up if you spot anything that needs MOAR investigation

moved from new to ignore (notes inside)

```js pref("devtools.performance.recording.ui-base-url", "https://perf-html.io"); // ^ 1480593: is/was hardcoded, this is just a pref to change it: eg for testing pref("dom.security.featurePolicy.enabled", false); // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1390801 // https://bugzilla.mozilla.org/attachment.cgi?id=9013973&action=diff // lets ignore this for now, it's not ready for be flipped IMO pref("dom.xhr.standard_content_type_normalization", false); // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1454325 // disabled due to issues: https://bugzilla.mozilla.org/show_bug.cgi?id=1499136 pref("extensions.webextensions.userScripts.enabled", false); // ^ wait til they flip it: https://bugzilla.mozilla.org/show_bug.cgi?id=1491272 // META: https://bugzilla.mozilla.org/show_bug.cgi?id=1437098 pref("network.security.esni.enabled", false); // NECKO part of ESNI // ^ Disabling telemetry is the opt-out for this (and pref is currently false) // Am confused. Is this to enable ESNI or the telemetry? pref("security.certerrors.recordEventTelemetry", true); // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1484255#c3 // covered by telemetry master switch pref("security.identitypopup.recordEventElemetry", true); // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1484251#c10 // covered by telemetry master switch pref("security.tls.hello_downgrade_check", false); // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1487279 // let FF handle breakage. Pref is currently off anyway ```

Thorin-Oakenpants commented 5 years ago 
pref("devtools.remote.adb.extensionURL", "https://ftp.mozilla.org/pub/mozilla.org/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi");
pref("devtools.webide.autoinstallADBExtension", true);

I assume the zilla would also cover the removal of devtools.webide.autoinstallADBHelper. I haven't looked at anything yet. Getting tired. I would assume the URL is covered by the other pref. Do we need this stuff? Someone do something :feel-free-to-help-guys:

pref("toolkit.coverage.enabled", false);
pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org");

Wots this all about: https://bugzilla.mozilla.org/show_bug.cgi?id=1492656#c8 (what's that access denied zilla?). I don't like the word "ping". Look the pref is false, but does that mean the old way is used instead. Someone do some digging please :needs-jesus:

earthlng commented 5 years ago

re: "coverage" https://hg.mozilla.org/mozilla-central/file/tip/toolkit/components/telemetry/docs/data/coverage-ping.rst

This ping is not enabled by default. When enabled, a ping is generated a total of once per profile, as a diagnostic tool to determine whether Telemetry is working for users.

This ping contains no client id and no environment data.

You can find more background information in this blog post.

Expected behaviours
-------------------
The following is a list of expected behaviours for the ``coverage`` ping:

- The ping will only be sent once per ping version, per profile.
- If sending the ping fails, it will be retried on startup.
- A totally arbitrary UUID is generated on first run on a new profile, to use for filtering duplicates.
- The ping is sent to a different endpoint not using existing Telemetry.
- The ping does not honor the Telemetry enabled preference, but provides its own opt-out preference: `toolkit.coverage.opt-out`.
- The ping is disabled by default. It is intended to be enabled for users on an experimental basis using the preference `toolkit.coverage.enabled`.

Booo! :-1: 

user_pref("toolkit.coverage.enabled", false);
user_pref("toolkit.coverage.opt-out", true);

is all we need IMO.

However, an unknown portion of our users do not report telemetry for a variety of reasons. This means we may not have data that is representative of our entire population. For example, some enterprise builds are preconfigured to not send telemetry and some users manually opt-out of telemetry collection. We believe the large majority of clients do send telemetry but currently have no way of measuring this.

So, they already know that "an unknown portion of our users do not report telemetry" but they "currently have no way of measuring this." How the fuck will "sample a portion of all Firefox clients" give them more "representative (data) of our entire population" ?

earthlng commented 5 years ago

ignore pref("dom.xhr.lowercase_header.enabled", true); // prev: false

:jeans: DONE - moved from changed to ignore

earthlng commented 5 years ago

Can they not extrapolate from ~500 million users and X million of telemetry reports based on telemetry client-id? IDK, it makes no sense to me

earthlng commented 5 years ago

todo: move 0370 to 0105b

:jeans: DONE - added to OP

Thorin-Oakenpants commented 5 years ago

FF65: https://bugzilla.mozilla.org/show_bug.cgi?id=1503681 .. something for earthlng to test, probably makes our script and E's extension's redundant. We can deal with it when we get 65 diffs

earthlng commented 5 years ago

they only address common, non-malicious use of it. LowerCaseEqualsLiteral("_blank") There are other targets you can use instead of "_blank" and all those will still allow access to the opener

earthlng commented 5 years ago

^^ if it's not showing up in the diffs then it's always either a runtime-set or a hidden pref

earthlng commented 5 years ago

browser.newtabpage.activity-stream.asrouter.messageProviders was removed in the meantime and replaced with 3 new prefs. I will update the diff when 64 final lands. But I don't think we need to tamper with those because Onboarding and CFR are all local and you won't ever see onboarding if you don't use Activity Stream AFAIK. The 3rd part of "ASrouter" is snippets and that's covered already by 0105b. We could add browser.newtabpage.activity-stream.feeds.asrouterfeed=false since that's the master switch for all ASrouter things but IDK if we really need/want to do that.

We also don't need to mess with browser.newtabpage.activity-stream.feeds.section.topstories.options because that's covered by browser.newtabpage.activity-stream.feeds.section.topstories=false in 0105c

earthlng commented 5 years ago

do we want to do something with 4702 general.buildID.override? move to 9999?

Thorin-Oakenpants commented 5 years ago

Pocket no longer a system addon

Where do we move 0510 Pocket to? (0510 is also used in deprecated so we should update that bit as well)

Thorin-Oakenpants commented 5 years ago

do we want to do something with 4702 general.buildID.override? move to 9999?

Sure. Is it just obsolete code now, or actually removed?

Atavic commented 5 years ago

It's here.

Thorin-Oakenpants commented 5 years ago

I was being lazy, I can kinda remember the code snippet when we talked about why they changed the value...`. Anyway, without looking at the code on DXR, is this going to be like the battery pref, and it gets moved back?

The non-hardcoded real value for buildID is actually still returned on privileged domains. The question would be (and I haven't looked) is, does this pref get applied for those privileged domains. In other words, is the pref still used (as compared to just still being in code).

If we're going to be consistent then

earthlng commented 5 years ago

https://github.com/ghacksuserjs/ghacks-user.js/search?q=20181001000000&type=Issues

Where do we move 0510 Pocket to?

IDK, what do you suggest?

Thorin-Oakenpants commented 5 years ago

I went back to v54 and it used to live at 0373: the old 0370s were Snippets, Pocket, Flyweb, Social API. current 0370s are all deprecated: 0372 Hello 0374 social. I guess 300s fits, but pocket (outside AS) doesn't do anything AFAIK unless you have an account? If it did any background connections to eg, pull in some recommendations (outside of AS), then 300s is it for sure. But regardless, it doesn't fit anywhere else .. so 0370 = :+1: AFAIConcerned

earthlng commented 5 years ago

that's fine. We can ignore buildID because it can still be used to spoof on privileged mozilla pages for those who don't use RFP. We can add the CRF one inactive under Misc or Personal and the VR to the other VR if you want. No need for the distrust_ca_policy, returnValue or the 3 asrouter providers IMO. That leaves the keyboard one but IDK what to do with that.

earthlng commented 5 years ago

by "ignore buildID" I mean keep it where it is

Thorin-Oakenpants commented 5 years ago

I thought we removed all those 0105* // comments about having a setting. We did have two, now I see four. I mapped all the UI settings to their prefs previously, and there were only two. It's why I have an issue open on cleaning up all the AS shit, because the UI is only for showing/hiding sections and does nothing to stop anything.

Pretty sure some of those four do not have a UI setting. In the meantime I have removed em all. We can deal with them again when we look at adding in and blanking all the other crap that isn't based on recent history. This is just a quick note, I'll get into it later

Thorin-Oakenpants commented 5 years ago

OT: https://bugzilla.mozilla.org/show_bug.cgi?id=167475 .. OK, I think have found a winner .. 17 years to patch

earthlng commented 5 years ago

topstories definitely has a setting. the other 2 are only visible if Pocket is enabled I believe. You'll see it if you use a vanilla profile

Thorin-Oakenpants commented 5 years ago

Yeah, I did it all in a nilla 63 in #528 and I don't remember any items getting hidden/shown based on other checkboxes. Anyway, if we want to put em back, I can remap them all later (in 64)

earthlng commented 5 years ago

Pocket doesn't have a checkbox. Don't need to put em back

Thorin-Oakenpants commented 5 years ago

Sorry mate, I misread what you meant .. I took when pocket is enabled to mean the pocket option in AS, not the hidden pref. It's gong to get too messy if we try and add individual UI info for these. You'll have to excuse me, I'm in a bit of trouble here and having a super hard time doing anything (and medical is at least a day away, if not longer). I'm not dying, so chill out :) .. but I am in sooooo much pain

crssi commented 5 years ago

^^ :cry: I wish you best :heart:

Thorin-Oakenpants commented 5 years ago

we can ignore dom.vr.service.enabled 1473399, as long as we cover devices (which RFP does) .. IANAExpert but any changes they do to VR is probably for the better (e.g giving it it's own thread, sandboxing it, etc)

Thorin-Oakenpants commented 5 years ago

dom.event.returnValue.enabledis false anyway, moving from new to ignore Also see https://developer.mozilla.org/en-US/docs/Web/API/Event/returnValue

Thorin-Oakenpants commented 5 years ago

I'm all done. If you're happy, close this, change the date & version, do a pre-release

PS: Thanks for your hard work and input over the last few days :kiss: I love you more than :cat2:

earthlng commented 5 years ago

Great. Thank you too :kiss:

can you do the release thingy please?

Thorin-Oakenpants commented 5 years ago

done

crssi commented 5 years ago

Didn't catch right... is browser.newtabpage.activity-stream.asrouter.userprefs.cfr acting as false with some master switch? If not, what is your opinion about CFRs?

Cheers and thank you for everything

Thorin-Oakenpants commented 5 years ago

There's nothing master switchey about the pref. It enables/disables whether or not you get recommendations as you browse. There are other prefs that control endpoints for getting data throughout Activity Stream. When or if we blank those, it's usually as a fallback or future proofing. And to be honest, with AS I think I want to do provide this (effectively kill all outbound connections) as AS only provides a UI for showing/hiding sections - and they would want to all data already locally available for when you make sections visible. i.e. I fully expect with all AS UI options unchecked, that it will still retrieve and update local storage of snippets, recommended, cfr, and so on But we'll deal with all that in #528

As for my opinion, personally I do not want it. Currently it's US users only and recommends extensions. The release says "relevant Firefox features, services, and extensions", so expect it to expand in future. However, if you read the Big E's detective work, there are no issues here - data is prepared based for the endpoints based on research or something (who knows) and all your browser does is go grab a copy to store locally (expect this to diverge with regional, language versions).

I'm all for FF encouraging users to add extensions (60% have none?), but what is the vetting process here. I'm sure there is one, but sheesh, I look at some of the extensions of the month BS and cringe. I hope it doesn't become spam-like, or recommend a compromised extension - eg like here's a cool screenshot extension, and then a few months later it's revealed the extension has been auto-opt_in to hover up and sell all your data. The AMO vetting process, while faster than manual, is letting shit creep thru (don't get me wrong, its better than the cesspit that chrome provides).

It would be nice if, in order to make a CFR list, a protocol is signed off on. First the Extension must be fully vetted, secondly the extension developer must agree, and thirdly, the extension developer must sign off on liability and damages etc and pinky swear under oath (and penalty) that bad shit will not happen, and than any change of ownership must notify Mozilla. IDK.

crssi commented 5 years ago

It looks to me that the users will end with a numerous extensions in their profile, slowing down FF as a result and from security/privacy point of view they will get an extensions which could leak to many stuff uncontrolled.