diff --git a/prefsCleaner.sh b/prefsCleaner.sh index 2ef32a2..50ca7e1 100755 --- a/prefsCleaner.sh +++ b/prefsCleaner.sh @@ -2,23 +2,12 @@ ## prefs.js cleaner for Linux/Mac ## author: @claustromaniac -## version: 1.9 +## version: 2.0 ## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh ## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_prefsCleaner() ) -# Check if running as root and if any files have the owner/group as root/wheel. -if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then - printf "You shouldn't run this with elevated privileges (such as with doas/sudo).\n" - exit 1 -elif [ -n "$(find ./ -user 0 -o -group 0)" ]; then - printf 'It looks like this script was previously run with elevated privileges, -you will need to change ownership of the following files to your user:\n' - find . -user 0 -o -group 0 - exit 1 -fi - readonly CURRDIR=$(pwd) ## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed) @@ -143,13 +132,23 @@ done ## change directory to the Firefox profile directory #cd "$(dirname "${SCRIPT_FILE}")" +# Check if running as root and if any files have the owner/group as root/wheel. +if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then + fQuit 1 "You shouldn't run this with elevated privileges (such as with doas/sudo)." +elif [ -n "$(find ./ -user 0 -o -group 0)" ]; then + printf 'It looks like this script was previously run with elevated privileges, +you will need to change ownership of the following files to your user:\n' + find . -user 0 -o -group 0 + fQuit 1 +fi + [ "$AUTOUPDATE" = true ] && update_prefsCleaner "$@" echo -e "\n\n" echo " ╔══════════════════════════╗" echo " ║ prefs.js cleaner ║" echo " ║ by claustromaniac ║" -echo " ║ v1.9 ║" +echo " ║ v2.0 ║" echo " ╚══════════════════════════╝" echo -e "\nThis script should be run from your Firefox profile directory.\n" echo "It will remove any entries from prefs.js that also exist in user.js." diff --git a/scratchpad-scripts/arkenfox-cleanup.js b/scratchpad-scripts/arkenfox-cleanup.js index 6e06248..edb18c9 100644 --- a/scratchpad-scripts/arkenfox-cleanup.js +++ b/scratchpad-scripts/arkenfox-cleanup.js @@ -1,9 +1,12 @@ /*** - This will reset the preferences that have been + This will reset the preferences that since FF91 have been - removed from the arkenfox user.js - deprecated by Mozilla but listed in the arkenfox user.js in the past - Last updated: 27-January-2023 + There is an archived version at https://github.com/arkenfox/user.js/issues/1080 + if you want the full list prior to FF118 + + Last updated: 18-October-2023 Instructions: - [optional] close Firefox and backup your profile @@ -32,8 +35,21 @@ const aPREFS = [ /* DEPRECATED */ - /* 103+ */ + /* 116-128 */ + 'dom.webnotifications.serviceworker.enabled', // 117 + 'layout.css.font-visibility.private', // 118 + 'layout.css.font-visibility.resistFingerprinting', // 116 + 'layout.css.font-visibility.standard', // 118 + 'layout.css.font-visibility.trackingprotection', // 118 + 'network.dns.skipTRR-when-parental-control-enabled', // 119 + 'permissions.delegation.enabled', // 118 + 'security.family_safety.mode', // 117 + /* 103-115 */ + 'browser.cache.offline.enable', // 115 + 'extensions.formautofill.heuristics.enabled', // 114 'network.cookie.lifetimePolicy', // 103 [technically removed in 104] + 'privacy.clearsitedata.cache.enabled', // 114 + 'privacy.resistFingerprinting.testGranularityMask', // 114 'security.pki.sha1_enforcement_level', // 103 /* 92-102 */ 'browser.urlbar.suggest.quicksuggest', // 95 @@ -48,196 +64,18 @@ 'security.csp.enable', // 99 'security.password_lifetime', // 102 'security.ssl3.rsa_des_ede3_sha', // 93 - /* 79-91 */ - 'browser.cache.offline.storage.enable', - 'browser.download.hide_plugins_without_extensions', - 'browser.library.activity-stream.enabled', - 'browser.search.geoSpecificDefaults', - 'browser.search.geoSpecificDefaults.url', - 'dom.ipc.plugins.flash.subprocess.crashreporter.enabled', - 'dom.ipc.plugins.reportCrashURL', - 'dom.w3c_pointer_events.enabled', - 'intl.charset.fallback.override', - 'network.ftp.enabled', - 'plugin.state.flash', - 'security.mixed_content.block_object_subrequest', - 'security.ssl.errorReporting.automatic', - 'security.ssl.errorReporting.enabled', - 'security.ssl.errorReporting.url', - /* 69-78 */ - 'browser.newtabpage.activity-stream.telemetry.ping.endpoint', - 'browser.tabs.remote.allowLinkedWebInFileUriProcess', - 'browser.urlbar.oneOffSearches', - 'devtools.webide.autoinstallADBExtension', - 'devtools.webide.enabled', - 'dom.indexedDB.enabled', - 'extensions.blocklist.url', - 'geo.wifi.logging.enabled', - 'geo.wifi.uri', - 'gfx.downloadable_fonts.woff2.enabled', - 'media.autoplay.allow-muted', - 'media.autoplay.enabled.user-gestures-needed', - 'offline-apps.allow_by_default', - 'plugins.click_to_play', - 'privacy.userContext.longPressBehavior', - 'toolkit.cosmeticAnimations.enabled', - 'toolkit.telemetry.hybridContent.enabled', - 'webgl.disable-extensions', - /* 61-68 */ - 'app.update.enabled', - 'browser.aboutHomeSnippets.updateUrl', - 'browser.chrome.errorReporter.enabled', - 'browser.chrome.errorReporter.submitUrl', - 'browser.chrome.favicons', - 'browser.ctrlTab.previews', - 'browser.fixup.hide_user_pass', - 'browser.newtabpage.activity-stream.asrouter.userprefs.cfr', - 'browser.newtabpage.activity-stream.disableSnippets', - 'browser.onboarding.enabled', - 'browser.search.countryCode', - 'browser.urlbar.autocomplete.enabled', - 'devtools.webide.adbAddonURL', - 'devtools.webide.autoinstallADBHelper', - 'dom.event.highrestimestamp.enabled', - 'experiments.activeExperiment', - 'experiments.enabled', - 'experiments.manifest.uri', - 'experiments.supported', - 'lightweightThemes.update.enabled', - 'media.autoplay.enabled', - 'network.allow-experiments', - 'network.cookie.lifetime.days', - 'network.jar.block-remote-files', - 'network.jar.open-unsafe-types', - 'plugin.state.java', - 'security.csp.enable_violation_events', - 'security.csp.experimentalEnabled', - 'shield.savant.enabled', - /* 60 or earlier */ - 'browser.bookmarks.showRecentlyBookmarked', - 'browser.casting.enabled', - 'browser.crashReports.unsubmittedCheck.autoSubmit', - 'browser.formautofill.enabled', - 'browser.formfill.saveHttpsForms', - 'browser.fullscreen.animate', - 'browser.history.allowPopState', - 'browser.history.allowPushState', - 'browser.history.allowReplaceState', - 'browser.newtabpage.activity-stream.enabled', - 'browser.newtabpage.directory.ping', - 'browser.newtabpage.directory.source', - 'browser.newtabpage.enhanced', - 'browser.newtabpage.introShown', - 'browser.pocket.api', - 'browser.pocket.enabled', - 'browser.pocket.oAuthConsumerKey', - 'browser.pocket.site', - 'browser.polaris.enabled', - 'browser.safebrowsing.appRepURL', - 'browser.safebrowsing.enabled', - 'browser.safebrowsing.gethashURL', - 'browser.safebrowsing.malware.reportURL', - 'browser.safebrowsing.provider.google.appRepURL', - 'browser.safebrowsing.reportErrorURL', - 'browser.safebrowsing.reportGenericURL', - 'browser.safebrowsing.reportMalwareErrorURL', - 'browser.safebrowsing.reportMalwareMistakeURL', - 'browser.safebrowsing.reportMalwareURL', - 'browser.safebrowsing.reportPhishMistakeURL', - 'browser.safebrowsing.reportURL', - 'browser.safebrowsing.updateURL', - 'browser.search.showOneOffButtons', - 'browser.selfsupport.enabled', - 'browser.selfsupport.url', - 'browser.sessionstore.privacy_level_deferred', - 'browser.tabs.animate', - 'browser.trackingprotection.gethashURL', - 'browser.trackingprotection.updateURL', - 'browser.urlbar.unifiedcomplete', - 'browser.usedOnWindows10.introURL', - 'camera.control.autofocus_moving_callback.enabled', - 'camera.control.face_detection.enabled', - 'datareporting.healthreport.about.reportUrl', - 'datareporting.healthreport.about.reportUrlUnified', - 'datareporting.healthreport.documentServerURI', - 'datareporting.healthreport.service.enabled', - 'datareporting.policy.dataSubmissionEnabled.v2', - 'devtools.webide.autoinstallFxdtAdapters', - 'dom.archivereader.enabled', - 'dom.beforeAfterKeyboardEvent.enabled', - 'dom.disable_image_src_set', - 'dom.disable_window_open_feature.scrollbars', - 'dom.disable_window_status_change', - 'dom.enable_user_timing', - 'dom.flyweb.enabled', - 'dom.idle-observers-api.enabled', - 'dom.keyboardevent.code.enabled', - 'dom.network.enabled', - 'dom.push.udp.wakeupEnabled', - 'dom.telephony.enabled', - 'dom.vr.oculus050.enabled', - 'dom.workers.enabled', - 'dom.workers.sharedWorkers.enabled', - 'extensions.formautofill.experimental', - 'extensions.screenshots.system-disabled', - 'extensions.shield-recipe-client.api_url', - 'extensions.shield-recipe-client.enabled', - 'full-screen-api.approval-required', - 'general.useragent.locale', - 'geo.security.allowinsecure', - 'intl.locale.matchOS', - 'loop.enabled', - 'loop.facebook.appId', - 'loop.facebook.enabled', - 'loop.facebook.fallbackUrl', - 'loop.facebook.shareUrl', - 'loop.feedback.formURL', - 'loop.feedback.manualFormURL', - 'loop.logDomains', - 'loop.server', - 'media.block-play-until-visible', - 'media.eme.apiVisible', - 'media.eme.chromium-api.enabled', - 'media.getusermedia.screensharing.allow_on_old_platforms', - 'media.getusermedia.screensharing.allowed_domains', - 'media.gmp-eme-adobe.autoupdate', - 'media.gmp-eme-adobe.enabled', - 'media.gmp-eme-adobe.visible', - 'network.http.referer.userControlPolicy', - 'network.http.sendSecureXSiteReferrer', - 'network.http.spdy.enabled.http2draft', - 'network.http.spdy.enabled.v3-1', - 'network.websocket.enabled', - 'pageThumbs.enabled', - 'pfs.datasource.url', - 'plugin.scan.Acrobat', - 'plugin.scan.Quicktime', - 'plugin.scan.WindowsMediaPlayer', - 'plugins.enumerable_names', - 'plugins.update.notifyUser', - 'plugins.update.url', - 'privacy.clearOnShutdown.passwords', - 'privacy.donottrackheader.value', - 'security.mixed_content.send_hsts_priming', - 'security.mixed_content.use_hsts', - 'security.ssl3.ecdhe_ecdsa_rc4_128_sha', - 'security.ssl3.ecdhe_rsa_rc4_128_sha', - 'security.ssl3.rsa_rc4_128_md5', - 'security.ssl3.rsa_rc4_128_sha', - 'security.tls.insecure_fallback_hosts.use_static_list', - 'security.tls.unrestricted_rc4_fallback', - 'security.xpconnect.plugin.unrestricted', - 'social.directories', - 'social.enabled', - 'social.remote-install.enabled', - 'social.share.activationPanelEnabled', - 'social.shareDirectory', - 'social.toast-notifications.enabled', - 'social.whitelist', - 'toolkit.telemetry.unifiedIsOptIn', /* REMOVED */ - /* 103+ */ + /* 116-128 */ + 'browser.fixup.alternate.enabled', + 'browser.taskbar.previews.enable', + 'browser.urlbar.dnsResolveSingleWordsAfterSearch', + 'media.gmp-widevinecdm.enabled', + 'network.protocol-handler.external.ms-windows-store', + 'privacy.partition.always_partition_third_party_non_cookie_storage', + 'privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage', + 'privacy.partition.serviceWorkers', + /* 103-115 */ 'beacon.enabled', 'browser.startup.blankWindow', 'browser.newtab.preload', @@ -257,6 +95,7 @@ 'extensions.formautofill.available', 'extensions.formautofill.creditCards.available', 'extensions.formautofill.creditCards.supported', + 'middlemouse.contentLoadURL', 'network.http.altsvc.oe', /* 92-102 */ 'browser.urlbar.trimURLs', @@ -271,224 +110,6 @@ 'privacy.firstparty.isolate.use_site', 'privacy.window.name.update.enabled', 'security.insecure_connection_text.enabled', - /* 79-91 */ - 'alerts.showFavicons', - 'browser.newtabpage.activity-stream.asrouter.providers.snippets', - 'browser.send_pings.require_same_host', - 'browser.urlbar.usepreloadedtopurls.enabled', - 'dom.allow_cut_copy', - 'dom.battery.enabled', - 'dom.IntersectionObserver.enabled', - 'dom.storage.enabled', - 'dom.vibrator.enabled', - 'extensions.screenshots.upload-disabled', - 'general.warnOnAboutConfig', - 'gfx.direct2d.disabled', - 'layers.acceleration.disabled', - 'media.getusermedia.audiocapture.enabled', - 'media.getusermedia.browser.enabled', - 'media.getusermedia.screensharing.enabled', - 'media.gmp-widevinecdm.visible', - 'media.media-capabilities.enabled', - 'network.http.redirection-limit', - 'privacy.partition.network_state', - 'security.insecure_connection_icon.enabled', - 'security.mixed_content.block_active_content', - 'security.ssl.enable_ocsp_stapling', - 'security.ssl3.dhe_rsa_aes_128_sha', - 'security.ssl3.dhe_rsa_aes_256_sha', - 'webgl.min_capability_mode', - /* 69-78 */ - 'browser.cache.disk_cache_ssl', - 'browser.search.geoip.url', - 'browser.search.region', - 'browser.sessionhistory.max_entries', - 'dom.push.connection.enabled', - 'dom.push.serverURL', - 'extensions.getAddons.discovery.api_url', - 'extensions.htmlaboutaddons.discover.enabled', - 'extensions.webservice.discoverURL', - 'intl.locale.requested', - 'intl.regional_prefs.use_os_locales', - 'media.block-autoplay-until-in-foreground', - 'middlemouse.paste', - 'plugin.sessionPermissionNow.intervalInMinutes', - 'privacy.usercontext.about_newtab_segregation.enabled', - 'security.insecure_connection_icon.pbmode.enabled', - 'security.insecure_connection_text.pbmode.enabled', - 'webgl.dxgl.enabled', - /* 61-68 */ - 'app.update.service.enabled', - 'app.update.silent', - 'app.update.staging.enabled', - 'browser.cache.disk.capacity', - 'browser.cache.disk.smart_size.enabled', - 'browser.cache.disk.smart_size.first_run', - 'browser.cache.offline.insecure.enable', - 'browser.contentblocking.enabled', - 'browser.laterrun.enabled', - 'browser.offline-apps.notify', - 'browser.rights.3.shown', - 'browser.safebrowsing.blockedURIs.enabled', - 'browser.safebrowsing.downloads.remote.block_dangerous', - 'browser.safebrowsing.downloads.remote.block_dangerous_host', - 'browser.safebrowsing.provider.google.gethashURL', - 'browser.safebrowsing.provider.google.reportMalwareMistakeURL', - 'browser.safebrowsing.provider.google.reportPhishMistakeURL', - 'browser.safebrowsing.provider.google.reportURL', - 'browser.safebrowsing.provider.google.updateURL', - 'browser.safebrowsing.provider.google4.dataSharing.enabled', - 'browser.safebrowsing.provider.google4.dataSharingURL', - 'browser.safebrowsing.provider.google4.gethashURL', - 'browser.safebrowsing.provider.google4.reportMalwareMistakeURL', - 'browser.safebrowsing.provider.google4.reportPhishMistakeURL', - 'browser.safebrowsing.provider.google4.reportURL', - 'browser.safebrowsing.provider.google4.updateURL', - 'browser.safebrowsing.provider.mozilla.gethashURL', - 'browser.safebrowsing.provider.mozilla.updateURL', - 'browser.safebrowsing.reportPhishURL', - 'browser.sessionhistory.max_total_viewers', - 'browser.sessionstore.max_windows_undo', - 'browser.slowStartup.maxSamples', - 'browser.slowStartup.notificationDisabled', - 'browser.slowStartup.samples', - 'browser.storageManager.enabled', - 'browser.urlbar.autoFill.typed', - 'browser.urlbar.filter.javascript', - 'browser.urlbar.maxHistoricalSearchSuggestions', - 'browser.urlbar.userMadeSearchSuggestionsChoice', - 'canvas.capturestream.enabled', - 'dom.allow_scripts_to_close_windows', - 'dom.disable_window_flip', - 'dom.forms.datetime', - 'dom.imagecapture.enabled', - 'dom.popup_maximum', - 'extensions.webextensions.keepStorageOnUninstall', - 'extensions.webextensions.keepUuidOnUninstall', - 'font.blacklist.underline_offset', - 'font.name.monospace.x-unicode', - 'font.name.monospace.x-western', - 'font.name.sans-serif.x-unicode', - 'font.name.sans-serif.x-western', - 'font.name.serif.x-unicode', - 'font.name.serif.x-western', - 'gfx.offscreencanvas.enabled', - 'javascript.options.shared_memory', - 'layout.css.font-loading-api.enabled', - 'media.gmp-gmpopenh264.autoupdate', - 'media.gmp-gmpopenh264.enabled', - 'media.gmp-manager.updateEnabled', - 'media.gmp-manager.url', - 'media.gmp-manager.url.override', - 'media.gmp-widevinecdm.autoupdate', - 'media.gmp.trial-create.enabled', - 'media.navigator.video.enabled', - 'media.peerconnection.ice.tcp', - 'media.peerconnection.identity.enabled', - 'media.peerconnection.identity.timeout', - 'media.peerconnection.turn.disable', - 'media.peerconnection.use_document_iceservers', - 'media.peerconnection.video.enabled', - 'network.auth.subresource-img-cross-origin-http-auth-allow', - 'network.cookie.leave-secure-alone', - 'network.cookie.same-site.enabled', - 'network.dnsCacheEntries', - 'network.dnsCacheExpiration', - 'network.http.fast-fallback-to-IPv4', - 'network.proxy.autoconfig_url.include_path', - 'offline-apps.quota.warn', - 'pdfjs.enableWebGL', - 'plugin.default.state', - 'plugin.defaultXpi.state', - 'plugin.scan.plid.all', - 'privacy.trackingprotection.annotate_channels', - 'privacy.trackingprotection.lower_network_priority', - 'privacy.trackingprotection.pbmode.enabled', - 'privacy.trackingprotection.ui.enabled', - 'security.data_uri.block_toplevel_data_uri_navigations', - 'security.insecure_field_warning.contextual.enabled', - 'security.insecure_password.ui.enabled', - 'security.tls.version.fallback-limit', - 'services.blocklist.addons.collection', - 'services.blocklist.gfx.collection', - 'services.blocklist.onecrl.collection', - 'services.blocklist.plugins.collection', - 'services.blocklist.signing.enforced', - 'services.blocklist.update_enabled', - 'signon.autofillForms.http', - 'signon.storeWhenAutocompleteOff', - 'toolkit.telemetry.cachedClientID', - 'urlclassifier.trackingTable', - 'xpinstall.whitelist.required', - /* 60 or lower */ - 'browser.migrate.automigrate.enabled', - 'browser.search.geoip.timeout', - 'browser.search.reset.enabled', - 'browser.search.reset.whitelist', - 'browser.stopReloadAnimation.enabled', - 'browser.tabs.insertRelatedAfterCurrent', - 'browser.tabs.loadDivertedInBackground', - 'browser.tabs.loadInBackground', - 'browser.tabs.selectOwnerOnClose', - 'browser.urlbar.clickSelectsAll', - 'browser.urlbar.doubleClickSelectsAll', - 'device.storage.enabled', - 'dom.keyboardevent.dispatch_during_composition', - 'dom.presentation.controller.enabled', - 'dom.presentation.discoverable', - 'dom.presentation.discovery.enabled', - 'dom.presentation.enabled', - 'dom.presentation.receiver.enabled', - 'dom.presentation.session_transport.data_channel.enable', - 'dom.vr.oculus.enabled', - 'dom.vr.openvr.enabled', - 'dom.vr.osvr.enabled', - 'extensions.pocket.api', - 'extensions.pocket.oAuthConsumerKey', - 'extensions.pocket.site', - 'general.useragent.compatMode.firefox', - 'geo.wifi.xhr.timeout', - 'gfx.layerscope.enabled', - 'media.flac.enabled', - 'media.mediasource.enabled', - 'media.mediasource.mp4.enabled', - 'media.mediasource.webm.audio.enabled', - 'media.mediasource.webm.enabled', - 'media.mp4.enabled', - 'media.ogg.enabled', - 'media.ogg.flac.enabled', - 'media.opus.enabled', - 'media.raw.enabled', - 'media.wave.enabled', - 'media.webm.enabled', - 'media.webspeech.recognition.enable', - 'media.wmf.amd.vp9.enabled', - 'media.wmf.enabled', - 'media.wmf.vp9.enabled', - 'network.dns.blockDotOnion', - 'network.stricttransportsecurity.preloadlist', - 'security.block_script_with_wrong_mime', - 'security.fileuri.strict_origin_policy', - 'security.sri.enable', - 'services.sync.enabled', - 'ui.submenuDelay', - 'webextensions.storage.sync.enabled', - 'webextensions.storage.sync.serverURL', - // excluding these e10 settings - // 'browser.tabs.remote.autostart', - // 'browser.tabs.remote.autostart.2', - // 'browser.tabs.remote.force-enable', - // 'browser.tabs.remote.separateFileUriProcess', - // 'extensions.e10sBlocksEnabling', - // 'extensions.webextensions.remote', - // 'dom.ipc.processCount', - // 'dom.ipc.shims.enabledWarnings', - // 'dom.ipc.processCount.extension', - // 'dom.ipc.processCount.file', - // 'security.sandbox.content.level', - // 'dom.ipc.plugins.sandbox-level.default', - // 'dom.ipc.plugins.sandbox-level.flash', - // 'security.sandbox.logging.enabled', /* IMPORTANT: last active pref must not have a trailing comma */ /* reset parrot: check your open about:config after running the script */ diff --git a/updater.sh b/updater.sh index 183ec5c..4807f8c 100755 --- a/updater.sh +++ b/updater.sh @@ -2,20 +2,15 @@ ## arkenfox user.js updater for macOS and Linux -## version: 3.8 +## version: 3.9 ## Author: Pat Johnson (@overdodactyl) ## Additional contributors: @earthlng, @ema-pe, @claustromaniac, @infinitewarp ## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_updater() ) -# Check if running as root and if any files have the owner/group as root/wheel. +# Check if running as root if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then - printf "You shouldn\'t run this with elevated privileges (such as with doas/sudo).\n" - exit 1 -elif [ -n "$(find ./ -user 0 -o -group 0)" ]; then - printf 'It looks like this script was previously run with elevated privileges, -you will need to change ownership of the following files to your user:\n' - find . -user 0 -o -group 0 + printf "You shouldn't run this with elevated privileges (such as with doas/sudo).\n" exit 1 fi @@ -396,6 +391,17 @@ show_banner update_updater "$@" getProfilePath # updates PROFILE_PATH or exits on error -cd "$PROFILE_PATH" && update_userjs +cd "$PROFILE_PATH" || exit 1 + +# Check if any files have the owner/group as root/wheel. +if [ -n "$(find ./ -user 0 -o -group 0)" ]; then + printf 'It looks like this script was previously run with elevated privileges, +you will need to change ownership of the following files to your user:\n' + find . -user 0 -o -group 0 + cd "$CURRDIR" + exit 1 +fi + +update_userjs cd "$CURRDIR" diff --git a/user.js b/user.js index 3e3b84c..4798b8a 100644 --- a/user.js +++ b/user.js @@ -1,8 +1,9 @@ /****** * name: arkenfox user.js -* date: 30 March 2023 -* version: 111 -* url: https://github.com/arkenfox/user.js +* date: 18 October 2023 +* version: 118 +* urls: https://github.com/arkenfox/user.js [repo] +* : https://arkenfox.github.io/gui/ [interactive] * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt * README: @@ -18,7 +19,6 @@ * Some site breakage and unintended consequences will happen. Everyone's experience will differ e.g. some user data is erased on exit (section 2800), change this to suit your needs * While not 100% definitive, search for "[SETUP" tags - e.g. third party images/videos not loading on some sites? check 1601 5. Some tag info [SETUP-SECURITY] it's one item, read it [SETUP-WEB] can cause some websites to break @@ -27,13 +27,15 @@ * RELEASES: https://github.com/arkenfox/user.js/releases - * It is best to use the arkenfox release that is optimized for and matches your Firefox version - * EVERYONE: each release - - run prefsCleaner to reset prefs made inactive, including deprecated (9999s) - ESR102 - - If you are not using arkenfox v102-1... (not a definitive list) - - 2815: clearOnShutdown cookies + offlineApps should be false - - 9999: switch the appropriate deprecated section(s) back on + * Use the arkenfox release that matches your Firefox version + - DON'T wait for arkenfox to update Firefox, nothing major changes these days + * Each release + - run prefsCleaner to reset prefs made inactive, including deprecated (9999) + * ESR + - It is recommended to not use the updater, or you will get a later version which may cause issues. + So you should manually append your overrides (and keep a copy), and manually update when you + change ESR releases (arkenfox is already past that release) + - If you decide to keep updating, then the onus is on - also see section 9999 * INDEX: @@ -42,27 +44,26 @@ 0300: QUIETER FOX 0400: SAFE BROWSING 0600: BLOCK IMPLICIT OUTBOUND - 0700: DNS / DoH / PROXY / SOCKS / IPv6 + 0700: DNS / DoH / PROXY / SOCKS 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS 0900: PASSWORDS 1000: DISK AVOIDANCE 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) - 1400: FONTS - 1600: HEADERS / REFERERS + 1600: REFERERS 1700: CONTAINERS 2000: PLUGINS / MEDIA / WEBRTC 2400: DOM (DOCUMENT OBJECT MODEL) 2600: MISCELLANEOUS 2700: ETP (ENHANCED TRACKING PROTECTION) 2800: SHUTDOWN & SANITIZING - 4500: RFP (RESIST FINGERPRINTING) + 4500: RFP (resistFingerprinting) 5000: OPTIONAL OPSEC 5500: OPTIONAL HARDENING 6000: DON'T TOUCH 7000: DON'T BOTHER 8000: DON'T BOTHER: FINGERPRINTING 9000: NON-PROJECT RELATED - 9999: DEPRECATED / REMOVED / LEGACY / RENAMED + 9999: DEPRECATED / RENAMED ******/ @@ -116,7 +117,6 @@ user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX] user_pref("intl.accept_languages", "en-US, en"); /* 0211: use en-US locale regardless of the system or region locale * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] - * [TEST] https://arkenfox.github.io/TZP/tests/formatting.html * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] @@ -132,6 +132,9 @@ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to make personalized extension recommendations * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/ user_pref("browser.discovery.enabled", false); +/* 0323: disable shopping experience [FF116+] + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156#c0 ***/ +user_pref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false] /** TELEMETRY ***/ /* 0330: disable new data submission [FF41+] @@ -256,20 +259,8 @@ user_pref("browser.places.speculativeConnect.enabled", false); * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ // user_pref("browser.send_pings", false); // [DEFAULT: false] -/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS / IPv6 ***/ +/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS ***/ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); -/* 0701: disable IPv6 - * IPv6 can be abused, especially with MAC addresses, and can leak with VPNs: assuming - * your ISP and/or router and/or website is IPv6 capable. Most sites will fall back to IPv4 - * [SETUP-WEB] PR_CONNECT_RESET_ERROR: this pref *might* be the cause - * [STATS] Firefox telemetry (Feb 2023) shows ~9% of successful connections are IPv6 - * [NOTE] This is an application level fallback. Disabling IPv6 is best done at an - * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP, - * then this won't make much difference. If you are masking your IP, then it can only help. - * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" - * [TEST] https://ipleak.org/ - * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ -user_pref("network.dns.disableIPv6", true); /* 0702: set the proxy server to do any DNS lookups when using SOCKS * e.g. in Tor, this stops your local DNS server from knowing your Tor destination * as a remote Tor node will handle the DNS request @@ -281,11 +272,11 @@ user_pref("network.proxy.socks_remote_dns", true); user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] /* 0704: disable GIO as a potential proxy bypass vector * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, - * dav, cdda, gphoto2, trash, etc. By default only sftp is accepted (FF87+) + * dav, cdda, gphoto2, trash, etc. From FF87-117, by default only sftp was accepted * [1] https://bugzilla.mozilla.org/1433507 * [2] https://en.wikipedia.org/wiki/GVfs * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/ -user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] +user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] [DEFAULT: "" FF118+] /* 0705: disable proxy direct failover for system requests [FF91+] * [WARNING] Default true is a security feature against malicious extensions [1] * [SETUP-CHROME] If you use a proxy and you trust your extensions @@ -296,55 +287,51 @@ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] * [WARNING] If false, this will break the fallback for some security features * [SETUP-CHROME] If you use a proxy and you understand the security impact * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/ - // user_pref("network.proxy.allow_bypass", false); // [HIDDEN PREF FF95-96] -/* 0710: disable DNS-over-HTTPS (DoH) rollout [FF60+] - * 0=off by default, 2=TRR (Trusted Recursive Resolver) first, 3=TRR only, 5=explicitly off + // user_pref("network.proxy.allow_bypass", false); +/* 0710: enable DNS-over-HTTPS (DoH) [FF60+] + * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off (no rollout) * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3] + * [SETTING] Privacy & Security>DNS over HTTPS * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy * [3] https://support.mozilla.org/en-US/kb/firefox-dns-over-https * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ - // user_pref("network.trr.mode", 5); + // user_pref("network.trr.mode", 3); +/* 0711: disable skipping DoH when parental controls are enabled [FF70+] ***/ +user_pref("network.dns.skipTRR-when-parental-control-enabled", false); +/* 0712: set DoH provider + * The custom uri is the value shown when you "Choose provider>Custom>" + * [NOTE] If you USE custom then "network.trr.uri" should be set the same + * [SETTING] Privacy & Security>DNS over HTTPS>Increased/Max>Choose provider ***/ + // user_pref("network.trr.uri", "https://example.dns"); + // user_pref("network.trr.custom_uri", "https://example.dns"); /*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); -/* 0801: disable location bar using search - * Don't leak URL typos to a search engine, give an error message instead - * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" - * [NOTE] This does not affect explicit user action such as using search buttons in the - * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) - * [SETUP-CHROME] Override this if you trust and use a privacy respecting search engine ***/ -user_pref("keyword.enabled", false); -/* 0802: disable location bar domain guessing - * domain guessing intercepts DNS "hostname not found errors" and resends a - * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work - * via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com - * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't - * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), - * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ -user_pref("browser.fixup.alternate.enabled", false); // [DEFAULT: false FF104+] -/* 0804: disable live search suggestions +/* 0801: disable location bar making speculative connections [FF56+] + * [1] https://bugzilla.mozilla.org/1348275 ***/ +user_pref("browser.urlbar.speculativeConnect.enabled", false); +/* 0802: disable location bar contextual suggestions [FF92+] + * [SETTING] Privacy & Security>Address Bar>Suggestions from... + * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/ +user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+] +user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); +/* 0803: disable live search suggestions * [NOTE] Both must be true for the location bar to work * [SETUP-CHROME] Override these if you trust and use a privacy respecting search engine * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/ user_pref("browser.search.suggest.enabled", false); user_pref("browser.urlbar.suggest.searches", false); -/* 0805: disable location bar making speculative connections [FF56+] - * [1] https://bugzilla.mozilla.org/1348275 ***/ -user_pref("browser.urlbar.speculativeConnect.enabled", false); -/* 0806: disable location bar leaking single words to a DNS provider **after searching** [FF78+] - * 0=never resolve, 1=use heuristics, 2=always resolve - * [1] https://bugzilla.mozilla.org/1642623 ***/ -user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0); // [DEFAULT: 0 FF104+] -/* 0807: disable location bar contextual suggestions [FF92+] - * [SETTING] Privacy & Security>Address Bar>Suggestions from... - * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/ -user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+] -user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); -/* 0808: disable tab-to-search [FF85+] - * Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search - * [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest>Search engines ***/ - // user_pref("browser.urlbar.suggest.engines", false); +/* 0805: disable urlbar trending search suggestions [FF118+] + * [SETTING] Search>Search Suggestions>Show trending search suggestions (FF119) ***/ +user_pref("browser.urlbar.trending.featureGate", false); +/* 0806: disable urlbar suggestions ***/ +user_pref("browser.urlbar.addons.featureGate", false); // [FF115+] +user_pref("browser.urlbar.mdn.featureGate", false); // [FF117+] [HIDDEN PREF] +user_pref("browser.urlbar.pocket.featureGate", false); // [FF116+] [DEFAULT: false] +user_pref("browser.urlbar.weather.featureGate", false); // [FF108+] [DEFAULT: false] +/* 0807: disable urlbar clipboard suggestions [FF118+] ***/ + // user_pref("browser.urlbar.clipboard.featureGate", false); // [DEFAULT: false] /* 0810: disable search and form history * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] * [NOTE] We also clear formdata on exit (2811) @@ -352,6 +339,10 @@ user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); +/* 0815: disable tab-to-search [FF85+] + * Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search + * [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest>Search engines ***/ + // user_pref("browser.urlbar.suggest.engines", false); /* 0820: disable coloring of visited links * [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing @@ -463,12 +454,6 @@ user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] user_pref("security.OCSP.require", true); /** CERTS / HPKP (HTTP Public Key Pinning) ***/ -/* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS] - * 0=disable detecting Family Safety mode and importing the root - * 1=only attempt to detect Family Safety mode (don't import the root) - * 2=detect Family Safety mode and import the root - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ -user_pref("security.family_safety.mode", 0); /* 1223: enable strict PKP (Public Key Pinning) * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE ***/ @@ -491,7 +476,7 @@ user_pref("security.pki.crlite_mode", 2); * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site") * [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions) * [TEST] http://example.com [upgrade] - * [TEST] http://httpforever.com/ [no upgrade] ***/ + * [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/ user_pref("dom.security.https_only_mode", true); // [FF76+] // user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] /* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ @@ -515,30 +500,13 @@ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); * [TEST] https://expired.badssl.com/ ***/ user_pref("browser.xul.error_pages.expert_bad_cert", true); -/*** [SECTION 1400]: FONTS ***/ -user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); -/* 1402: limit font visibility (Windows, Mac, some Linux) [FF94+] - * Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed - * In normal windows: uses the first applicable: RFP (4506) over TP over Standard - * In Private Browsing windows: uses the most restrictive between normal and private - * 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts - * [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc ***/ - // user_pref("layout.css.font-visibility.private", 1); - // user_pref("layout.css.font-visibility.standard", 1); - // user_pref("layout.css.font-visibility.trackingprotection", 1); - -/*** [SECTION 1600]: HEADERS / REFERERS +/*** [SECTION 1600]: REFERERS full URI: https://example.com:8888/foo/bar.html?id=1234 scheme+host+port+path: https://example.com:8888/foo/bar.html scheme+host+port: https://example.com:8888 [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ ***/ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); -/* 1601: control when to send a cross-origin referer - * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [SETUP-WEB] Breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram - * If "2" is too strict, then override to "0" and use Smart Referer extension (Strict mode + add exceptions) ***/ -user_pref("network.http.referer.XOriginPolicy", 2); /* 1602: control the amount of cross-origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); @@ -571,17 +539,6 @@ user_pref("media.peerconnection.ice.default_address_only", true); /* 2020: disable GMP (Gecko Media Plugins) * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ // user_pref("media.gmp-provider.enabled", false); -/* 2021: disable widevine CDM (Content Decryption Module) - * [NOTE] This is covered by the EME master switch (2022) ***/ - // user_pref("media.gmp-widevinecdm.enabled", false); -/* 2022: disable all DRM content (EME: Encryption Media Extension) - * Optionally hide the setting which also disables the DRM prompt - * [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV - * [SETTING] General>DRM Content>Play DRM-controlled content - * [TEST] https://bitmovin.com/demos/drm - * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ -user_pref("media.eme.enabled", false); - // user_pref("browser.eme.ui.enabled", false); /*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); @@ -590,11 +547,9 @@ user_pref("dom.disable_window_move_resize", true); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); -/* 2601: prevent accessibility services from accessing your browser [RESTART] - * [1] https://support.mozilla.org/kb/accessibility-services ***/ -user_pref("accessibility.force_disabled", 1); -/* 2603: remove temp files opened with an external application - * [1] https://bugzilla.mozilla.org/302433 ***/ +/* 2603: remove temp files opened from non-PB windows with an external application + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/ +user_pref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+] user_pref("browser.helperApps.deleteTempFileOnExit", true); /* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ user_pref("browser.uitour.enabled", false); @@ -602,9 +557,6 @@ user_pref("browser.uitour.enabled", false); /* 2608: reset remote debugging to disabled * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] -/* 2611: disable middle mouse click opening links from clipboard - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/ -user_pref("middlemouse.contentLoadURL", false); /* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+] * 0 (default) or 1=allow, 2=block * [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/ @@ -634,14 +586,8 @@ user_pref("network.IDN_show_punycode", true); * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/ user_pref("pdfjs.disabled", false); // [DEFAULT: false] user_pref("pdfjs.enableScripting", false); // [FF86+] -/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/ -user_pref("network.protocol-handler.external.ms-windows-store", false); -/* 2623: disable permissions delegation [FF73+] - * Currently applies to cross-origin geolocation, camera, mic and screen-sharing - * permissions, and fullscreen requests. Disabling delegation means any prompts - * for these will show/use their correct 3rd party origin - * [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/ -user_pref("permissions.delegation.enabled", false); +/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] */ +user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX] /** DOWNLOADS ***/ /* 2651: enable user interaction for security by always asking where to download @@ -660,8 +606,7 @@ user_pref("browser.download.always_ask_before_handling_new_types", true); /* 2660: lock down allowed extension directories * [SETUP-CHROME] This will break extensions, language packs, themes and any other * XPI files which are installed outside of profile and application directories - * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ - * [1] https://archive.is/DYjAM (archived) ***/ + * [1] https://archive.is/DYjAM ***/ user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] /* 2661: disable bypassing 3rd party extension install prompts [FF82+] @@ -688,11 +633,6 @@ user_pref("browser.contentblocking.category", "strict"); * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 * [3] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ // user_pref("privacy.antitracking.enableWebcompat", false); -/* 2710: enable state partitioning of service workers [FF96+] ***/ -user_pref("privacy.partition.serviceWorkers", true); // [DEFAULT: true FF105+] -/* 2720: enable APS (Always Partitioning Storage) ***/ -user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); // [FF104+] [DEFAULT: true FF109+] -user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false); // [FF105+] [DEFAULT: false FF109+] /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); @@ -727,10 +667,6 @@ user_pref("privacy.clearOnShutdown.sessions", true); // [DEFAULT: true] * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ user_pref("privacy.clearOnShutdown.cookies", true); // Cookies user_pref("privacy.clearOnShutdown.offlineApps", true); // Site Data -/* 2816: set cache to clear on exit [FF96+] - * [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust - * [1] https://bugzilla.mozilla.org/1671182 ***/ - // user_pref("privacy.clearsitedata.cache.enabled", true); /** SANITIZE MANUAL: IGNORES "ALLOW" SITE EXCEPTIONS ***/ /* 2820: reset default items to clear with Ctrl-Shift-Del [SETUP-CHROME] @@ -755,21 +691,21 @@ user_pref("privacy.cpd.cookies", false); * which will display a blank value, and are not guaranteed to work ***/ user_pref("privacy.sanitize.timeSpan", 0); -/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) +/*** [SECTION 4500]: RFP (resistFingerprinting) RFP covers a wide range of ongoing fingerprinting solutions. It is an all-or-nothing buy in: you cannot pick and choose what parts you want + [TEST] https://arkenfox.github.io/TZP/tzp.html [WARNING] DO NOT USE extensions to alter RFP protected metrics 418986 - limit window.screen & CSS media queries (FF41) - [TEST] https://arkenfox.github.io/TZP/tzp.html#screen 1281949 - spoof screen orientation (FF50) 1330890 - spoof timezone as UTC0 (FF55) 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) FF56 1369303 - spoof/disable performance API 1333651 - spoof User Agent & Navigator API - version: android version spoofed as ESR + version: android version spoofed as ESR (FF119 or lower) OS: JS spoofed as Windows 10, OS 10.15, Android 10, or Linux | HTTP Headers spoofed as Windows or Android 1369319 - disable device sensor API 1369357 - disable site specific zoom @@ -801,19 +737,23 @@ user_pref("privacy.sanitize.timeSpan", 0); 1595823 - return audioContext sampleRate as 44100 (FF72) 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74) 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78) + 1506364 - return "no-preference" with prefers-contrast (FF80) 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100) 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102) 1422237 - return "srgb" with color-gamut (FF110) + 1794628 - return "none" with inverted-colors (FF114) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); -/* 4501: enable privacy.resistFingerprinting [FF41+] - * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a site exception via the urlbar +/* 4501: enable RFP + * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar * RFP also has a few side effects: mainly timezone is UTC0, and websites will prefer light theme + * [NOTE] pbmode applies if true and the original pref is false * [1] https://bugzilla.mozilla.org/418986 ***/ -user_pref("privacy.resistFingerprinting", true); +user_pref("privacy.resistFingerprinting", true); // [FF41+] + // user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+] /* 4502: set new window size rounding max values [FF55+] * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen * [1] https://bugzilla.mozilla.org/1330882 ***/ @@ -822,7 +762,7 @@ user_pref("privacy.window.maxInnerHeight", 900); /* 4503: disable mozAddonManager Web API [FF57+] * [NOTE] To allow extensions to work on AMO, you also need 2662 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ -user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF] +user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); /* 4504: enable RFP letterboxing [FF67+] * Dynamically resizes the inner window by applying margins in stepped ranges [2] * If you use the dimension pref, then it will only apply those resolutions. @@ -838,9 +778,6 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] * [WARNING] DO NOT USE unless testing, see [1] comment 12 * [1] https://bugzilla.mozilla.org/1635603 ***/ // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); - // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); -/* 4506: set RFP's font visibility level (1402) [FF94+] ***/ - // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] /* 4510: disable using system colors * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ user_pref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS] @@ -932,27 +869,29 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow // user_pref("browser.taskbar.lists.frequent.enabled", false); // user_pref("browser.taskbar.lists.recent.enabled", false); // user_pref("browser.taskbar.lists.tasks.enabled", false); -/* 5015: disable Windows taskbar preview [WINDOWS] ***/ - // user_pref("browser.taskbar.previews.enable", false); // [DEFAULT: false] /* 5016: discourage downloading to desktop - * 0=desktop, 1=downloads (default), 2=last used - * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/ + * 0=desktop, 1=downloads (default), 2=custom + * [SETTING] To set your custom default "downloads": General>Downloads>Save files to ***/ // user_pref("browser.download.folderList", 2); /* 5017: disable Form Autofill * If .supportedCountries includes your region (browser.search.region) and .supported * is "detect" (default), then the UI will show. Stored data is not secure, uses JSON - * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ // user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] // user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] - // user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] /* 5018: limit events that can cause a pop-up ***/ // user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); /* 5019: disable page thumbnail collection ***/ // user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] /* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/ // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false); +/* 5021: disable location bar using search + * Don't leak URL typos to a search engine, give an error message instead + * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" + * [NOTE] This does not affect explicit user action such as using search buttons in the + * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) ***/ + // user_pref("keyword.enabled", false); /*** [SECTION 5500]: OPTIONAL HARDENING Not recommended. Overriding these can cause breakage and performance issues, @@ -986,13 +925,37 @@ user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); * Vulnerabilities [1] have increasingly been found, including those known and fixed * in native programs years ago [2]. WASM has powerful low-level access, making * certain attacks (brute-force) and vulnerabilities more possible - * [STATS] ~0.2% of websites, about half of which are for crytopmining / malvertising [2][3] + * [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3] * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ // user_pref("javascript.options.wasm", false); /* 5507: disable rendering of SVG OpenType fonts ***/ // user_pref("gfx.font_rendering.opentype_svg.enabled", false); +/* 5508: disable all DRM content (EME: Encryption Media Extension) + * Optionally hide the UI setting which also disables the DRM prompt + * [SETTING] General>DRM Content>Play DRM-controlled content + * [TEST] https://bitmovin.com/demos/drm + * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ + // user_pref("media.eme.enabled", false); + // user_pref("browser.eme.ui.enabled", false); +/* 5509: disable IPv6 if using a VPN + * This is an application level fallback. Disabling IPv6 is best done at an OS/network + * level, and/or configured properly in system wide VPN setups. + * [SETUP-WEB] PR_CONNECT_RESET_ERROR + * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" + * [TEST] https://ipleak.org/ + * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ + // user_pref("network.dns.disableIPv6", true); +/* 5510: control when to send a cross-origin referer + * 0=always (default), 1=only if base domains match, 2=only if hosts match + * [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/ + // user_pref("network.http.referer.XOriginPolicy", 2); +/* 5511: set DoH bootstrap address [FF89+] + * Firefox uses the system DNS to initially resolve the IP address of your DoH server. + * When set to a valid, working value that matches your "network.trr.uri" (0712) Firefox + * won't use the system DNS. If the IP doesn't match then DoH won't work ***/ + // user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF] /*** [SECTION 6000]: DON'T TOUCH ***/ user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!"); @@ -1007,8 +970,8 @@ user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] /* 6008: enforce no First Party Isolation [FF51+] - * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), - * and enabling FPI disables those. FPI is no longer maintained ***/ + * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI + * disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/ user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] /* 6009: enforce SmartBlock shims [FF81+] * In FF96+ these are listed in about:compat @@ -1021,7 +984,10 @@ user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla * [WHY] To prevent wasting Mozilla's time with a custom setup ***/ user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] -/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF102+ ***/ +/* 6012: enforce Quarantined Domains [FF115+] + * [WHY] https://support.mozilla.org/kb/quarantined-domains */ +user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] +/* 6050: prefsCleaner: previously active items removed from arkenfox 102-114 ***/ // user_pref("beacon.enabled", ""); // user_pref("browser.startup.blankWindow", ""); // user_pref("browser.newtab.preload", ""); @@ -1037,16 +1003,31 @@ user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] // user_pref("extensions.formautofill.addresses.supported", ""); // user_pref("extensions.formautofill.creditCards.available", ""); // user_pref("extensions.formautofill.creditCards.supported", ""); + // user_pref("middlemouse.contentLoadURL", ""); +/* 6051: prefsCleaner: previously active items removed from arkenfox 115-127 ***/ + // user_pref("accessibility.force_disabled", ""); + // user_pref("browser.fixup.alternate.enabled", ""); + // user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", ""); + // user_pref("network.protocol-handler.external.ms-windows-store", ""); + // user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", ""); + // user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", ""); + // user_pref("privacy.partition.serviceWorkers", ""); +/* 6052: prefsCleaner: deprecated ESR102 items from FF103-115 ***/ + // user_pref("browser.cache.offline.enable", ""); + // user_pref("extensions.formautofill.heuristics.enabled", ""); + // user_pref("network.cookie.lifetimePolicy", ""); + // user_pref("privacy.clearsitedata.cache.enabled", ""); + // user_pref("privacy.resistFingerprinting.testGranularityMask", ""); + // user_pref("security.pki.sha1_enforcement_level", ""); /*** [SECTION 7000]: DON'T BOTHER ***/ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); /* 7001: disable APIs - * Location-Aware Browsing, Full Screen, offline cache (appCache) - * [WHY] The API state is easily fingerprintable. Geo is behind a prompt (7002). - * appCache storage capability was removed in FF90. Full screen requires user interaction ***/ + * Location-Aware Browsing, Full Screen + * [WHY] The API state is easily fingerprintable. + * Geo is behind a prompt (7002). Full screen requires user interaction ***/ // user_pref("geo.enabled", false); // user_pref("full-screen-api.enabled", false); - // user_pref("browser.cache.offline.enable", false); /* 7002: set default permissions * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+] * 0=always ask (default), 1=allow, 2=block @@ -1062,8 +1043,8 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF109+] - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT: false FF109+] + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS @@ -1083,7 +1064,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies // user_pref("dom.securecontext.allowlist_onions", true); // [FF97+] 1382359/1744006 // user_pref("network.http.referer.hideOnionSource", true); // 1305144 /* 7007: referers - * [WHY] Only cross-origin referers (1600s) need control ***/ + * [WHY] Only cross-origin referers (1602, 5510) matter ***/ // user_pref("network.http.sendRefererHeader", 2); // user_pref("network.http.referer.trimmingPolicy", 0); /* 7008: set the default Referrer Policy [FF59+] @@ -1115,8 +1096,10 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ // user_pref("privacy.donottrackheader.enabled", true); /* 7016: customize ETP settings + * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ - // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5 FF103+] + // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5] + // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+] // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] // user_pref("privacy.partition.network_state.ocsp_cache", true); @@ -1128,11 +1111,10 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies /* 7017: disable service workers * [WHY] Already isolated with TCP (2701) behind a pref (2710) ***/ // user_pref("dom.serviceWorkers.enabled", false); -/* 7018: disable Web Notifications +/* 7018: disable Web Notifications [FF22+] * [WHY] Web Notifications are behind a prompt (7002) * [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/ - // user_pref("dom.webnotifications.enabled", false); // [FF22+] - // user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] + // user_pref("dom.webnotifications.enabled", false); /* 7019: disable Push Notifications [FF44+] * [WHY] Push requires subscription * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID" @@ -1188,22 +1170,45 @@ user_pref("browser.messaging-system.whatsNewPanel.enabled", false); * [SETTING] Search>Search Bar>Use the address bar for search and navigation>Show search terms instead of URL... ***/ user_pref("browser.urlbar.showSearchTerms.enabled", false); -/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED - Documentation denoted as [-]. Items deprecated prior to FF91 have been archived at [1] - [1] https://github.com/arkenfox/user.js/issues/123 -***/ +/*** [SECTION 9999]: DEPRECATED / RENAMED ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* ESR102.x still uses all the following prefs -// [NOTE] replace the * with a slash in the line above to re-enable them -// FF103 - // 2801: delete cookies and site data on exit - replaced by sanitizeOnShutdown* (2810) - // 0=keep until they expire (default), 2=keep until you close Firefox - // [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Firefox is closed - // [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1681493,1681495,1681498,1759665,1764761 -user_pref("network.cookie.lifetimePolicy", 2); -// 6012: disable SHA-1 certificates - // [-] https://bugzilla.mozilla.org/1766687 - // user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1] +/* ESR115.x still uses all the following prefs +// [NOTE] replace the * with a slash in the line above to re-enable active ones +// FF116 +// 4506: set RFP's font visibility level (1402) [FF94+] + // [-] https://bugzilla.mozilla.org/1838415 + // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] +// FF117 +// 1221: disable Windows Microsoft Family Safety cert [FF50+] [WINDOWS] + // 0=disable detecting Family Safety mode and importing the root + // 1=only attempt to detect Family Safety mode (don't import the root) + // 2=detect Family Safety mode and import the root + // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 + // [-] https://bugzilla.mozilla.org/1844908 +user_pref("security.family_safety.mode", 0); +// 7018: disable service worker Web Notifications [FF44+] + // [WHY] Web Notifications are behind a prompt (7002) + // [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ + // [-] https://bugzilla.mozilla.org/1842457 + // user_pref("dom.webnotifications.serviceworker.enabled", false); +// FF118 +// 1402: limit font visibility (Windows, Mac, some Linux) [FF94+] + // Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed + // In normal windows: uses the first applicable: RFP over TP over Standard + // In Private Browsing windows: uses the most restrictive between normal and private + // 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts + // [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc + // [-] https://bugzilla.mozilla.org/1847599 + // user_pref("layout.css.font-visibility.private", 1); + // user_pref("layout.css.font-visibility.standard", 1); + // user_pref("layout.css.font-visibility.trackingprotection", 1); +// 2623: disable permissions delegation [FF73+] + // Currently applies to cross-origin geolocation, camera, mic and screen-sharing + // permissions, and fullscreen requests. Disabling delegation means any prompts + // for these will show/use their correct 3rd party origin + // [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion + // [-] https://bugzilla.mozilla.org/1697151 + // user_pref("permissions.delegation.enabled", false); // ***/ /* END: internal custom pref to test for syntax errors ***/ diff --git a/wikipiki/smartReferer.png b/wikipiki/smartReferer.png deleted file mode 100644 index c64b93a..0000000 Binary files a/wikipiki/smartReferer.png and /dev/null differ