Git/firefox-user.js
1
0
Fork 0
mirror of https://github.com/arkenfox/user.js.git synced 2025-11-03 23:35:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

1222->2672 and 2613->2512

Browse Source
This commit is contained in:
Roman-Nopantski
2017-02-27 23:39:26 +13:00
committed by GitHub
parent d4d6440be9
commit 4a6fbddb01
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
user.js
View File

@@ -672,9 +672,6 @@ user_pref("network.stricttransportsecurity.preloadlist", true);
// 0=do neither 1=pre-populate url 2+pre-populate url + pre-fetch cert (default) // 0=do neither 1=pre-populate url 2+pre-populate url + pre-fetch cert (default)
// https://github.com/pyllyukko/user.js/issues/210 // https://github.com/pyllyukko/user.js/issues/210
user_pref("browser.ssl_override_behavior", 1); user_pref("browser.ssl_override_behavior", 1);
// 1222: enforce CSP (Content Security Policy) (default is true)
// https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
user_pref("security.csp.enable", true);
// 1223: display advanced information on Insecure Connection warning pages (thanks @crssi) // 1223: display advanced information on Insecure Connection warning pages (thanks @crssi)
// only works when it's possible to add an exception, i.e doesn't work for HSTS (https://subdomain.preloaded-hsts.badssl.com/) // only works when it's possible to add an exception, i.e doesn't work for HSTS (https://subdomain.preloaded-hsts.badssl.com/)
// test: https://expired.badssl.com/ // test: https://expired.badssl.com/
@@ -1074,6 +1071,9 @@ user_pref("dom.webaudio.enabled", false);
// https://developer.mozilla.org/en-US/docs/Web/Events/devicechange // https://developer.mozilla.org/en-US/docs/Web/Events/devicechange
// https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/ondevicechange // https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/ondevicechange
user_pref("media.ondevicechange.enabled", false); user_pref("media.ondevicechange.enabled", false);
// 2512: disable device sensor API - fingerprinting vector
// https://trac.torproject.org/projects/tor/ticket/15758
user_pref("device.sensors.enabled", false);
/*** 2600: MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY ***/ /*** 2600: MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY ***/
user_pref("ghacks_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); user_pref("ghacks_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
@@ -1105,9 +1105,6 @@ user_pref("devtools.webide.enabled", false);
// https://trac.torproject.org/projects/tor/ticket/16222 // https://trac.torproject.org/projects/tor/ticket/16222
user_pref("browser.casting.enabled", false); user_pref("browser.casting.enabled", false);
user_pref("gfx.layerscope.enabled", false); user_pref("gfx.layerscope.enabled", false);
// 2613: disable device sensor API - fingerprinting vector
// https://trac.torproject.org/projects/tor/ticket/15758
user_pref("device.sensors.enabled", false);
// 2614: disable SPDY as it can contain identifiers // 2614: disable SPDY as it can contain identifiers
// https://www.torproject.org/projects/torbrowser/design/#identifier-linkability (no. 10) // https://www.torproject.org/projects/torbrowser/design/#identifier-linkability (no. 10)
user_pref("network.http.spdy.enabled", false); user_pref("network.http.spdy.enabled", false);
@@ -1244,6 +1241,9 @@ user_pref("svg.disabled", true);
// https://en.wikipedia.org/wiki/IDN_homograph_attack // https://en.wikipedia.org/wiki/IDN_homograph_attack
// CVE-2017-5383: https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ // CVE-2017-5383: https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/
user_pref("network.IDN_show_punycode", true); user_pref("network.IDN_show_punycode", true);
// 2673: enforce CSP (Content Security Policy) (default is true)
// https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
user_pref("security.csp.enable", true);
/*** 2697: USER AGENT (UA) SPOOFING /*** 2697: USER AGENT (UA) SPOOFING
Spoofing your UA to *LOWER* entropy *does* *not* *work*. It may even cause site breakage Spoofing your UA to *LOWER* entropy *does* *not* *work*. It may even cause site breakage