Merge pull request #146 from carmenbianca/line-endings

Convert line endings to LF

.gitattributes

@@ -0,0 +1,8 @@
+* text=auto
+
+*.js text
+*.md text
+*.yml text
+*.txt text
+
+*.png binary

user.js

@@ -1,8 +1,8 @@
 /******
 * name: ghacks user.js
-* date: 27 April 2017
-* version 53: Achy Breaky Pants
-*   "But don't tell my pants, my achy breaky pants, I just don't think they'd understand"
+* date: 14 June 2017
+* version 54: Pantsthumping
+*   "I get pulled down, but I get up again, you're never gonna keep me down"
 * authors: v52+ github | v51- www.ghacks.net
 * url: https://github.com/ghacksuserjs/ghacks-user.js
 
@@ -190,6 +190,9 @@ user_pref("browser.newtabpage.directory.source", "data:text/plain,");
 user_pref("browser.newtabpage.enabled", false);
 user_pref("browser.newtabpage.enhanced", false);
 user_pref("browser.newtabpage.introShown", true);
+/* 0361: disable Activity Stream (system addon) (FF54+)
+ * [1] https://wiki.mozilla.org/Firefox/Activity_Stream ***/
+user_pref("browser.newtabpage.activity-stream.enabled", false);
 /* 0370: disable "Snippets" (Mozilla content shown on about:home screen)
  * MUST use HTTPS - arbitrary content injected into this page via http opens up MiTM attacks
  * [1] https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service ***/
@@ -276,8 +279,6 @@ user_pref("browser.safebrowsing.downloads.remote.enabled", false);
 user_pref("browser.safebrowsing.downloads.remote.url", "");
 /* 0415: disable reporting URLs ***/
 user_pref("browser.safebrowsing.provider.google.reportURL", "");
-user_pref("browser.safebrowsing.reportMalwareMistakeURL", "");
-user_pref("browser.safebrowsing.reportPhishMistakeURL", "");
 user_pref("browser.safebrowsing.reportPhishURL", "");
 user_pref("browser.safebrowsing.provider.google4.reportURL", ""); // (FF50+)
 user_pref("browser.safebrowsing.provider.google.reportMalwareMistakeURL", ""); // (FF54+)
@@ -327,7 +328,8 @@ user_pref("network.dns.disablePrefetchFromHTTPS", true); // (hidden pref)
 user_pref("network.predictor.enabled", false);
 /* 0603b: disable more Necko/Captive Portal
  * [1] https://en.wikipedia.org/wiki/Captive_portal
- * [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/
+ * [2] https://wiki.mozilla.org/Necko/CaptivePortal
+ * [3] https://trac.torproject.org/projects/tor/ticket/21790 ***/
 user_pref("captivedetect.canonicalURL", "");
 user_pref("network.captive-portal-service.enabled", false); // (FF52+)
 /* 0605: disable link-mouseover opening connection to linked server
@@ -339,7 +341,7 @@ user_pref("network.http.speculative-parallel-limit", 0);
  * [2] http://kb.mozillazine.org/Browser.send_pings.require_same_host ***/
 user_pref("browser.send_pings", false);
 user_pref("browser.send_pings.require_same_host", true);
-/* 0607: disable links launching Windows Store on Windows 8/8.1/10
+/* 0607: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
  * [1] http://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
 user_pref("network.protocol-handler.external.ms-windows-store", false);
 /* 0608: disable predictor / prefetching (FF48+) ***/
@@ -390,6 +392,9 @@ user_pref("browser.search.suggest.enabled", false);
  * [SETTING] Options>Search>Show search suggestions in location bar results ***/
 user_pref("browser.urlbar.suggest.searches", false);
 user_pref("browser.urlbar.userMadeSearchSuggestionsChoice", true); // (FF41+)
+/* 0809: disable location bar suggesting "preloaded" top websites (FF54+)
+ * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1211726 ***/
+user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
 /* 0850a: disable location bar autocomplete [controlled by 0850b]
    // user_pref("browser.urlbar.autocomplete.enabled", false);
 /* 0850b: disable location bar suggestion types [controls 0850a]
@@ -428,6 +433,10 @@ user_pref("browser.urlbar.oneOffSearches", false);
  * [SETTING] Options>Privacy>History>Custom Settings>Remember my browsing and download history
  * [NOTE] You can clear history and downloads on exiting Firefox (see 2803) ***/
    // user_pref("places.history.enabled", false);
+/* 0863: disable Form Autofill (FF54+)
+ * [1] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/
+ * [2] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
+user_pref("browser.formautofill.enabled", false);
 /* 0870: disable Windows jumplist [WINDOWS] ***/
 user_pref("browser.taskbar.lists.enabled", false);
 user_pref("browser.taskbar.lists.frequent.enabled", false);
@@ -488,7 +497,8 @@ user_pref("browser.cache.disk.smart_size.first_run", false);
 /* 1002: disable disk cache for SSL pages
  * [1] http://kb.mozillazine.org/Browser.cache.disk_cache_ssl ***/
 user_pref("browser.cache.disk_cache_ssl", false);
-/* 1003: disable memory cache ***/
+/* 1003: disable memory cache
+ * [NOTE] Not recommended due to performance issues ***/
    // user_pref("browser.cache.memory.enable", false);
 /* 1004: disable offline cache ***/
 user_pref("browser.cache.offline.enable", false);
@@ -496,9 +506,11 @@ user_pref("browser.cache.offline.enable", false);
  * To improve performance when pressing back/forward Firefox stores visited pages
  * so they don't have to be re-parsed. This is not the same as memory cache.
  * 0=none, -1=auto (that's minus 1), or for other values see [1]
+ * [NOTE] Not recommended unless you know what you're doing
  * [1] http://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers ***/
    // user_pref("browser.sessionhistory.max_total_viewers", 0);
 /* 1006: disable permissions manager from writing to disk (requires restart)
+ * [NOTE] This means any permission changes are session only
  * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=967812 ***/
    // user_pref("permissions.memory_only", true); // (hidden pref)
 /* 1007: disable randomized FF HTTP cache decay experiments
@@ -539,7 +551,7 @@ user_pref("browser.shell.shortcutFavicons", false);
    // user_pref("browser.chrome.site_icons", false);
    // user_pref("browser.chrome.favicons", false);
 /* 1032: disable favicons in web notifications ***/
-   // user_pref("alerts.showFavicons", false);
+user_pref("alerts.showFavicons", false);
 
 /*** 1100: MULTI-PROCESS (e10s)
      We recommend you let Firefox handle this. Until e10s is enforced, if
@@ -554,7 +566,7 @@ user_pref("browser.shell.shortcutFavicons", false);
    // user_pref("browser.tabs.remote.autostart.2", true); // (FF49+) (hidden pref)
    // user_pref("browser.tabs.remote.force-enable", true); // (hidden pref)
    // user_pref("extensions.e10sBlocksEnabling", false);
-/* 1102: control number of e10s processes
+/* 1102: control number of content rendering processes
  * [1] http://www.ghacks.net/2016/02/15/change-how-many-processes-multi-process-firefox-uses/
  * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1207306 ***/
    // user_pref("dom.ipc.processCount", 4);
@@ -567,6 +579,8 @@ user_pref("browser.shell.shortcutFavicons", false);
    // user_pref("browser.tabs.remote.separateFileUriProcess", true);
 /* 1105: enable console shim warnings for add-ons with the 'multiprocessCompatible' flag as false ***/
 user_pref("dom.ipc.shims.enabledWarnings", true);
+/* 1106: control number of WebExtension processes ***/
+   // user_pref("dom.ipc.processCount.extension", 1);
 /* 1110: set sandbox level. DO NOT MEDDLE WITH THESE. They are included to inform you NOT to play
  * with them. The values are integers, but the code below deliberately contains a data mismatch
  * [1] https://wiki.mozilla.org/Sandbox
@@ -574,6 +588,8 @@ user_pref("dom.ipc.shims.enabledWarnings", true);
    // user_pref("security.sandbox.content.level", "donotuse");
    // user_pref("dom.ipc.plugins.sandbox-level.default", "donotuse");
    // user_pref("dom.ipc.plugins.sandbox-level.flash", "donotuse");
+/* 1111: enable sandbox logging ***/
+   // user_pref("security.sandbox.logging.enabled", true);
 
 /*** 1200: HTTPS ( SSL/TLS / OCSP / CERTS / HSTS / HPKP / CIPHERS )
    Note that your cipher and other settings can be used server side as a fingerprint attack
@@ -602,8 +618,8 @@ user_pref("ghacks_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
  * [1] http://kb.mozillazine.org/Security.tls.version.*
  * [2] https://www.ssl.com/how-to/turn-off-ssl-3-0-and-tls-1-0-in-your-browser/ ***/
    // user_pref("security.tls.version.min", 2);
-   // user_pref("security.tls.version.fallback-limit", 3);
-   // user_pref("security.tls.version.max", 4); // 4 = allow up to and including TLS 1.3
+user_pref("security.tls.version.fallback-limit", 3);
+user_pref("security.tls.version.max", 4); // 4 = allow up to and including TLS 1.3
 /* 1203: disable SSL session tracking (FF36+)
  * SSL Session IDs speed up HTTPS connections (no need to renegotiate) and last for 48hrs.
  * Since the ID is unique, web servers can (and do) use it for tracking. If set to true,
@@ -637,7 +653,8 @@ user_pref("security.OCSP.enabled", 1);
 /* 1220: disable Windows 8.1's Microsoft Family Safety cert [WINDOWS] (FF50+)
  * 0=disable detecting Family Safety mode and importing the root
  * 1=only attempt to detect Family Safety mode (don't import the root)
- * 2=detect Family Safety mode and import the root ***/
+ * 2=detect Family Safety mode and import the root
+ * [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/
 user_pref("security.family_safety.mode", 0);
 /* 1221: disable intermediate certificate caching (fingerprinting attack vector)
  * [NOTE] This may be better handled under FPI (ticket 1323644, part of Tor Uplift)
@@ -659,7 +676,8 @@ user_pref("security.cert_pinning.enforcement_level", 2);
  * [2] https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List ***/
 user_pref("network.stricttransportsecurity.preloadlist", true);
 /** MIXED CONTENT ***/
-/* 1240: disable insecure active content on https pages - mixed content ***/
+/* 1240: disable insecure active content on https pages - mixed content
+ * [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
 user_pref("security.mixed_content.block_active_content", true);
 /* 1241: disable insecure passive content (such as images) on https pages - mixed context
  * [WARNING] When set to true, this will visually break many sites (March 2017) ***/
@@ -801,7 +819,7 @@ user_pref("network.http.referer.spoofSource", false);
  * [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy
  * [1] https://www.w3.org/TR/referrer-policy/
  * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1304623 ***/
-   // user_pref("network.http.referer.userControlPolicy", 3);
+user_pref("network.http.referer.userControlPolicy", 3);
 /* 1607: TOR: hide (not spoof) referrer when leaving a .onion domain (FF54+)
  * [NOTE] Firefox cannot access .onion sites by default. We recommend you use
  * TBB (Tor Browser Bundle) which is specifically designed for the dark web
@@ -865,7 +883,6 @@ user_pref("media.gmp-widevinecdm.autoupdate", false);
 /* 1830: disable all DRM content (EME: Encryption Media Extension) [SETUP] ***/
 user_pref("media.eme.enabled", false); // Options>Content>Play DRM Content
 user_pref("browser.eme.ui.enabled", false); // hides "Play DRM Content" checkbox, restart required
-user_pref("media.eme.apiVisible", false); // block websites detecting DRM is disabled
 /* 1840: disable the OpenH264 Video Codec by Cisco to "Never Activate"
  * and disable pings to the external update/download server
  * This is the bundled codec used for video chat in WebRTC ***/
@@ -883,6 +900,7 @@ user_pref("media.peerconnection.video.enabled", false);
 user_pref("media.peerconnection.identity.enabled", false);
 user_pref("media.peerconnection.identity.timeout", 1);
 user_pref("media.peerconnection.turn.disable", true);
+user_pref("media.peerconnection.ice.tcp", false);
 user_pref("media.navigator.video.enabled", false); // video capability for WebRTC
 /* 2002: limit WebRTC IP leaks if using WebRTC
  * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1189041
@@ -974,33 +992,48 @@ user_pref("browser.link.open_newwindow.restriction", 0);
  * [2] https://support.mozilla.org/en-US/questions/1043508 ***/
 user_pref("dom.disable_beforeunload", true);
 
-/*** 2300: SERVICE WORKERS ***/
+/*** 2300: WEB WORKERS [SETUP]
+     A worker is a JS "background task" running in a global context, i.e it is different from
+     the current window. Workers can spawn new workers (must be the same origin & scheme),
+     including service and shared workers. Shared workers can be utilized by multiple scripts
+     and communicate between browsing contexts (windows/tabs/iframes) and can even control your
+     cache. Push and web notifications require service workers, which in turn require workers.
+
+     [WARNING] Disabling workers *will* break sites (eg Google Street View, Twitter).
+     It is recommended that you use a separate profile for these sorts of sites.
+
+     [1]    Web Workers: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API
+     [2]         Worker: https://developer.mozilla.org/en-US/docs/Web/API/Worker
+     [3] Service Worker: https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API
+     [4]   SharedWorker: https://developer.mozilla.org/en-US/docs/Web/API/SharedWorker
+     [5]   ChromeWorker: https://developer.mozilla.org/en-US/docs/Web/API/ChromeWorker
+ ***/
 user_pref("ghacks_user.js.parrot", "2300 syntax error: the parrot's off the twig!");
-/* 2301: disable workers API and service workers API
- * [NOTE] CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed)
- * [WARNING] Will break sites especially workers eg Google Street View
- * [1] https://developer.mozilla.org/en-US/docs/Web/API/Worker
- * [2] https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API
- * [3] http://www.ghacks.net/2016/03/02/manage-service-workers-in-firefox-and-chrome/ ***/
+/* 2301: disable workers
+ * [NOTE] CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed) ***/
 user_pref("dom.workers.enabled", false);
+/* 2302: disable service workers
+ * Service workers essentially act as proxy servers that sit between web apps, and the browser
+ * and network, are event driven, and can control the web page/site it is associated with,
+ * intercepting and modifying navigation and resource requests, and caching resources.
+ * [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode.
+ * [NOTE] Service workers only run over HTTPS. Service Workers have no DOM access. ***/
 user_pref("dom.serviceWorkers.enabled", false);
-/* 2302: disable service workers cache and cache storage ***/
+/* 2303: disable service workers' cache and cache storage ***/
 user_pref("dom.caches.enabled", false);
-/* 2303: disable push notifications (FF44+) [requires serviceWorkers to be enabled]
+/* 2304: disable web notifications
+ * [NOTE] You can still override individual domains under site permissions (FF44+)
+ * [1] https://developer.mozilla.org/en-US/docs/Web/API/Notifications_API ***/
+user_pref("dom.webnotifications.enabled", false);
+user_pref("dom.webnotifications.serviceworker.enabled", false);
+/* 2305: disable push notifications (FF44+)
  * web apps can receive messages pushed to them from a server, whether or
  * not the web app is in the foreground, or even currently loaded
- * [WARNING] May affect social media sites like Twitter
  * [1] https://developer.mozilla.org/en/docs/Web/API/Push_API ***/
 user_pref("dom.push.enabled", false);
 user_pref("dom.push.connection.enabled", false);
 user_pref("dom.push.serverURL", "");
 user_pref("dom.push.userAgentID", "");
-/* 2304: disable web/push notifications
- * [NOTE] You can still override individual domains under site permissions (FF44+)
- * [WARNING] May affect social media sites like Twitter
- * [1] https://developer.mozilla.org/en-US/docs/Web/API/notification ***/
-user_pref("dom.webnotifications.enabled", false);
-user_pref("dom.webnotifications.serviceworker.enabled", false);
 
 /*** 2400: DOM & JAVASCRIPT ***/
 user_pref("ghacks_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!");
@@ -1059,9 +1092,6 @@ user_pref("javascript.options.asmjs", false);
 /* 2422: disable WebAssembly for now (FF52+)
  * [1] https://developer.mozilla.org/en-US/docs/WebAssembly ***/
 user_pref("javascript.options.wasm", false);
-/* 2425: disable ArchiveAPI i.e reading content of archives, such as zip files, directly
- * in the browser, through DOM file objects. Default is false. ***/
-user_pref("dom.archivereader.enabled", false);
 /* 2426: disable Intersection Observer API (FF53+)
  * Almost a year to complete, three versions late to stable (as default false),
  * number #1 cause of crashes in nightly numerous times, and is (primarily) an
@@ -1159,6 +1189,11 @@ user_pref("dom.presentation.session_transport.data_channel.enable", false);
  * [3] https://trac.torproject.org/projects/tor/ticket/22127
  * [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency ***/
    // user_pref("dom.maxHardwareConcurrency", 2);
+/* 2515: disable site specific zoom
+ * Zoom levels affect screen res and are highly fingerprintable. This does not stop you using
+ * zoom, it will just not use/remember any site specific settings. Zoom levels on new tabs
+ * and new windows are reset to default and only the current tab retains the current zoom ***/
+user_pref("browser.zoom.siteSpecific", false);
 
 /*** 2600: MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY ***/
 user_pref("ghacks_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
@@ -1414,6 +1449,8 @@ user_pref("security.csp.experimentalEnabled", true);
 /* 2699f: spoof navigator.hardwareConcurrency as 2 (also see 2514) (FF55+)
  * This spoof *shouldn't* affect core chrome/Firefox performance
  * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1360039 ***/
+/* 2699g: reduce precision of time exposed by javascript (FF55+)
+ * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1217238 ***/
 user_pref("privacy.resistFingerprinting", true); // (hidden pref)
 
 /*** 2700: COOKIES & DOM STORAGE ***/
@@ -1493,10 +1530,11 @@ user_pref("privacy.cpd.offlineApps", true); // Offline Website Data
 user_pref("privacy.cpd.passwords", false); // this is not listed
 user_pref("privacy.cpd.sessions", true); // Active Logins
 user_pref("privacy.cpd.siteSettings", false); // Site Preferences
-/* 2805: privacy.*.openWindows (FF34+)
- * We don't know what they do because we don't care what they do ***/
-user_pref("privacy.clearOnShutdown.openWindows", false);
-user_pref("privacy.cpd.openWindows", false);
+/* 2805: privacy.*.openWindows (clear session restore data) (FF34+)
+ * [NOTE] There is a years-old bug that these cause two windows when Firefox restarts.
+ * You do not need these anyway if session restore is disabled (see 1020) ***/
+   // user_pref("privacy.clearOnShutdown.openWindows", true);
+   // user_pref("privacy.cpd.openWindows", true);
 /* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804)
  * Firefox remembers your last choice. This will reset the value when you start Firefox.
  * 0=everything, 1=last hour, 2=last two hours, 3=last four hours
@@ -1596,6 +1634,10 @@ user_pref("browser.bookmarks.showRecentlyBookmarked", false);
 user_pref("browser.urlbar.decodeURLsOnCopy", true);
 /* 3028: disable middle-click enabling auto-scrolling [WINDOWS] [MAC] ***/
    // user_pref("general.autoScroll", false);
+/* 3029: disable Firefox Screenshots (FF54+)
+ * [1] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/
+ * [2] https://github.com/mozilla-services/screenshots ***/
+   // user_pref("extensions.screenshots.system-disabled", true);
 
 /* END: internal custom pref to test for syntax errors ***/
 user_pref("ghacks_user.js.parrot", "No no he's not dead, he's, he's restin'! Remarkable bird, the Norwegian Blue");
@@ -1726,7 +1768,7 @@ user_pref("browser.history.allowReplaceState", false);
 // ***/
 /* FF48
 // 0806: disable 'unified complete': 'Search with [default search engine]'
-   // [1] http://techdows.com/2016/05/firefox-unified-complete-aboutconfig-preference-removed.html
+   // [-] http://techdows.com/2016/05/firefox-unified-complete-aboutconfig-preference-removed.html
    // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1181078
 user_pref("browser.urlbar.unifiedcomplete", false);
 // ***/
@@ -1758,12 +1800,13 @@ user_pref("browser.usedOnWindows10.introURL", "");
 // 0308: disable plugin update notifications
    // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1277905
 user_pref("plugins.update.notifyUser", false);
-// 0410: disable "Block dangerous and deceptive content"- replaced by browser.safebrowsing.phishing.enabled
+// 0410: disable "Block dangerous and deceptive content" - replaced by browser.safebrowsing.phishing.enabled
    // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1025965
    // user_pref("browser.safebrowsing.enabled", false);
 // 1266: disable rc4 ciphers
    // [1] https://trac.torproject.org/projects/tor/ticket/17369
    // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1268728
+   // [-] https://www.fxsitecompat.com/en-CA/docs/2016/rc4-support-has-been-completely-removed/
 user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
 user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
 user_pref("security.ssl3.rsa_rc4_128_md5", false);
@@ -1829,3 +1872,16 @@ user_pref("media.getusermedia.screensharing.allow_on_old_platforms", false);
    // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1322736
 user_pref("dom.beforeAfterKeyboardEvent.enabled", false);
 // ***/
+/* FF54
+// 0415: disable reporting URLs (safe browsing)
+   // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1288633
+user_pref("browser.safebrowsing.reportMalwareMistakeURL", "");
+user_pref("browser.safebrowsing.reportPhishMistakeURL", "");
+// 1830: block websites detecting DRM is disabled
+   // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1242321
+user_pref("media.eme.apiVisible", false);
+// 2425: disable Archive Reader API
+   // i.e reading archive contents directly in the browser, through DOM file objects
+   // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1342361
+user_pref("dom.archivereader.enabled", false);
+// ***/