1
0
mirror of https://github.com/arkenfox/user.js.git synced 2025-07-22 13:21:47 +02:00
Commit Graph

1964 Commits

Author SHA1 Message Date
2a9cf32f45 security.insecure_connection_icon.enabled
inactive and default true
2021-08-27 10:39:40 +00:00
08395de188 1273: remove inactive pref 2021-08-27 10:37:54 +00:00
4ac17eaf78 tidy last commit 2021-08-26 06:50:46 +00:00
b5a3b54d3f clipboard to don't bother 2021-08-26 06:43:28 +00:00
38dc90a947 dom.allow_cut_copy
80f69a6f3d
2021-08-26 06:27:32 +00:00
80f69a6f3d 2406: remove
This doesn't achieve anything. AFAICT, it's an old gecko only API, not used on the web: superseded by the Clipboard API (added in FF21+)
2021-08-26 06:26:41 +00:00
498a25c759 0806: remove confusing line 2021-08-26 06:04:57 +00:00
64e8dfad0a 1004: remove setup tag
IDK if this is true: no one has ever complained, and I'm not interested in maintaining/testing it
2021-08-26 05:55:11 +00:00
5ec4fef4ed dedupe 0808 2021-08-26 05:40:59 +00:00
881a2d22eb cleanup tags
- there was only one perf left
- warning is down to 5: two in section headers, 3 on inactive prefs: no need to mention it, people will see them if they read each item/section
2021-08-25 16:14:59 +00:00
76c8ecd10d tidy 2021-08-25 15:56:57 +00:00
677b81765f tidy webgl 2021-08-25 15:36:15 +00:00
9f43d48a32 targetBlankNoOpener -> don't touch 2021-08-25 14:09:39 +00:00
6077d09b9f window.name -> don't touch
Also FPI FF65+ patch is not part of FPI, it is part of 4002 which is a separate pref
2021-08-25 14:04:50 +00:00
7144f8b7f8 cleanup continued,
More minor tweaks to come. This isn't final
- 0102: ambiguous that the clearing was related to PB mode
- 0900s:
   - get rid of 0901, it has no pref, stick link in header
   - 0905: values on multi-lines use spaces = more readable
- 1000s:
   - rename as disk avoidance and remove sub-section headers
   - remove the outdated section header
- 4001: it will never be perfected, it's doing it's job
- 5500s: optional hardening
   - legit security measures, but commonality in caveats, so I made them a separate section
   - this flips graphite, asm.js and wasm from active to inactive: these are overkill: exhibit A: hundreds of millions of Firefox users
   - e.g. graphite and wasm are enabled on Tor Browser
   - new CVE keyword links
- 7000s: don't bother - two more items added
- 5000s: optional opsec and cleanout 0800s header
- re-number
   - 0900s, 1000s, 1400s, 2400s

PS: I need a new parrot: "9000 syntax error: I ran out of parrots"
2021-08-24 22:51:48 +00:00
778421cad4 2021-08-24 08:59:11 +00:00
35ccaff58e calrify password prompt, 2021-08-24 08:52:12 +00:00
69132b588f 7000s: mathml, svg, 2021-08-24 05:43:38 +00:00
51748ea25a leverage cve keyword 2021-08-24 03:09:33 +00:00
269cf965bd renumber 1700s 2021-08-23 10:03:13 +00:00
b177c73f0d typo
technically it's "or" - FPI overrides network partitioning
2021-08-23 09:47:34 +00:00
613e55ae8c 7000s: add MOAR; renumber 0700s, 2021-08-23 09:42:21 +00:00
3697bd8d3a 1603 -> inactive
Yes it's pretty much useless. Yes it's fingerprintable, and what that entropy is, who knows. Since it's sent regardless with ETP, which we enable in all windows, then who cares. And if you don't use ETP in all windows, then I don't care either - just saying
2021-08-23 06:26:45 +00:00
9f08c7c0f4 7000s: referer policy
and re-number 1600s
2021-08-23 06:04:19 +00:00
05b7d61735 7000s: non cross origin referers 2021-08-23 04:54:49 +00:00
e31a6876e6 section 6000 2021-08-23 04:40:29 +00:00
47be7ba42f 1203 is a reset not enforce 2021-08-23 04:08:49 +00:00
033977fe10 move personal to last
probably more professional to keep it at the end since it isn't strictly project related. It also opens up space for `DON'T TOUCH` and `OPTIONAL OPSEC`
2021-08-23 03:39:15 +00:00
ab42deb541 Four more items to 7000s, 2021-08-23 02:55:36 +00:00
8a22a90804 colon insertion () 2021-08-22 16:23:51 +00:00
c55e6dcd68 flip order, order within groups
- note: keeping 91 separate for now for the easy info factpr
2021-08-22 08:27:15 +00:00
cf379bcce0 typos 2021-08-22 05:45:08 +00:00
2b26cd4f41 7000s: ciphers,
- merged 3DES cipher to bottom: it is still the same order of [1]
- 3DES pref will be deprecated: pref name changes, and the cipher slated to be unavailable unless you downgrade to < TLS1.2 - see https://bugzilla.mozilla.org/show_bug.cgi?id=1724072
   - FYI: we reset TLS downgrades to session only by resetting the pref currently in 1203
- "Minimal/non-existent threat of downgrade attacks"
   - FYI: these old ciphers are about 1-2% of traffic (from memory) - but that's still significant breakage
   - So the only reason to do this would be to harden against downgrade attacks (and inadvertently use weak sites = breakage): but that doesn't fit most user's threat model: and is probably never going to happen for them. Not sure if I can word that much better and just as succinct
2021-08-22 05:18:54 +00:00
8bfee5b59f hardware acceleration
see 04d648d55b
2021-08-22 01:55:28 +00:00
04d648d55b remove 2508
- inactive in user.js since
   - v55: gfx.direct2d.disabled
   - v67: layers.acceleration.disabled
- the way to counter hardware fingerprinting is within each API that may expose it
- this may have made some sense way back in the day, when there were less options/protections, but not any more
- [are we web render yet](https://arewewebrenderyet.com/) - yes, 100% - there is no need to cripple your browser's perf
2021-08-22 01:53:01 +00:00
7cdc76ecf9 dom.vibrator.enabled
see aded0707a4
2021-08-21 04:40:11 +00:00
aded0707a4 misc
- renumber 0200s, 2500s
- remove 2414: doesn't apply to desktop, and I think it has been neutered in android
2021-08-21 04:39:08 +00:00
2a011f1053 media.media-capabilities.enabled
see 213467d91b
2021-08-21 03:23:17 +00:00
213467d91b remove 2517
- inactive since we added it in v63
- this is not how you defeat fingerprinting (unless done in an enforced set)
- for the record: not even tor browser disable this
- fingerprinting this is not cheap in gecko (for now)
- from [2]
   - decoding/encoding capabilities: "it is expected that the entropy ... isn’t going to be significant"
   - HDR detection: "... has the potential to add significant entropy .. however .. but ... thus minimizing effective entropy" - it is what it is
   - note that RFP has some mitigations in FF82+ 1461454
2021-08-21 03:21:32 +00:00
da0c291127 update to ESR91 2021-08-21 02:26:17 +00:00
27ce48f319 trim fluff 2021-08-21 02:00:43 +00:00
37ded2a519 remove redundant warning 2021-08-20 14:10:09 +00:00
c9bdceb8d6 1244: fix no upgrade test 2021-08-20 13:23:59 +00:00
95136382e1 improve 1244, closes again 2021-08-20 13:18:43 +00:00
78d953bfda remove 1032
dead wood: marked as default false since at least v68, inactive since at least v78, and web notifications are controlled in 2300s
2021-08-20 03:16:25 +00:00
2d3d8ae5b0 alerts.showFavicons 2021-08-20 03:12:59 +00:00
cef08b63f1 4520 -> personal 2021-08-20 02:52:55 +00:00
a8e95e7310 dexter would be proud
- just to be clear, this section is not supported: not interested in references or explanations or  FF version numbers or default info etc
- "do more harm than good" - ambiguous, not interested in explaining why exactly: but FYI
  - some leak
  - most break shit
  - almost all are easily fingerprinted and the combo of them would make you really stand out
- removed the duplicate `ui.prefersReducedMotion` - this should move to personal as well
- moved `ui.systemUsesDarkTheme` to personal
2021-08-20 02:13:53 +00:00
5ab3c47b6b 7001: tweak
F11 has nothing to do with the API or why
2021-08-19 15:26:22 +00:00
45c52b6620 start section 7000s 2021-08-19 14:44:06 +00:00