make up yer mind

stick it back in for two releases - pref gets removed in FF65 anyway
finalize beta
2025-09-01 17:38:30 +02:00 · 2018-11-13 15:30:39 +00:00 · 2018-11-13 15:12:20 +00:00 · 2018-11-13 15:11:01 +00:00 · 2018-11-13 15:01:35 +00:00 · 2018-11-13 08:42:49 +00:00
5 changed files with 146 additions and 83 deletions
--- a/README.md
+++ b/README.md
@ -1,21 +1,23 @@
-### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) user.js
+### ![][b] user.js
 A `user.js` is a configuration file that can control hundreds of Firefox settings. For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.1-Overview) wiki page.
-### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) ghacks user.js
+### ![][b] ghacks user.js
-The `ghacks user.js` is a **template**, which, as provided, aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).
+The `ghacks user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).
 Everyone, experts included, should at least read the [implementation](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation) wiki page, as it contains important information regarding a few `ghacks user.js` settings.
 Sitemap: [Releases](https://github.com/ghacksuserjs/ghacks-user.js/releases), [changelogs](https://github.com/ghacksuserjs/ghacks-user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog), [Wiki](https://github.com/ghacksuserjs/ghacks-user.js/wiki), [stickies](https://github.com/ghacksuserjs/ghacks-user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22). [diffs](https://github.com/ghacksuserjs/ghacks-user.js/issues?q=is%3Aissue+label%3Adiffs)
-### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) acknowledgments
+### ![][b] acknowledgments
 Literally thousands of sources, references and suggestions. That said...
 * Martin Brinkmann at [ghacks](https://www.ghacks.net/) <sup>1</sup>
 * The ghacks community and commentators
 * [12bytes](http://12bytes.org/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs)
-   * The 12bytes article now uses this user.js and supplements it with an additonal JS hosted right [here](https://github.com/atomGit/Firefox-user.js) at github
+   * The 12bytes article now uses this user.js and supplements it with an additonal JS hosted at [GitLab](https://gitlab.com/labwrat/Firefox-user.js/tree/master)
 <sup>1</sup> The ghacks user.js was an independent project by [Thorin-Oakenpants](https://github.com/Thorin-Oakenpants) started in early 2015 and was [first published](https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/) at ghacks in August 2015. With Martin Brinkmann's blessing, it will keep the ghacks name.
-### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+### ![][b] [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [b]: https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/wikipiki/bullet01.png
--- a/_config.yml
+++ b/_config.yml
@ -1 +1,3 @@
 theme: jekyll-theme-midnight
 title: ghacks-user.js
 description: An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting
--- a/scratchpad-scripts/ghacks-clear-[removed].js
+++ b/scratchpad-scripts/ghacks-clear-[removed].js
@ -1,7 +1,7 @@
 /***
 This will reset the preferences that have been removed completely from the ghacks user.js.
- Last updated: 08-Sept-2018
+ Last updated: 30-Sept-2018
 For instructions see:
 https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
@ -102,6 +102,10 @@
    /* 62-beta */
    'browser.urlbar.autoFill.typed',
    'security.tls.version.fallback-limit',
    /* 63-beta */
    'extensions.webextensions.keepStorageOnUninstall',
    'extensions.webextensions.keepUuidOnUninstall',
    'privacy.trackingprotection.ui.enabled',
    /* reset parrot: check your open about:config after running the script */
    '_user.js.parrot'
  ]
--- a/user.js
+++ b/user.js
@ -1,8 +1,8 @@
 /******
 * name: ghacks user.js
-* date: 08 September 2018
+* date: 13 November 2018
-* version 62-beta: Total Eclipse of the Pants
+* version 63-beta: Pants Romance
-*   "Once upon a time there was light in my life, but now there's only pants in the dark"
+*   "Rah rah ah-ah-ah! Ro mah ro-mah-mah. Gaga oh-la-la! Want your pants romance"
 * authors: v52+ github | v51- www.ghacks.net
 * url: https://github.com/ghacksuserjs/ghacks-user.js
 * license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
@ -90,7 +90,6 @@ user_pref("permissions.default.geo", 2); // 0=always ask (default), 1=allow, 2=b
 * [NOTE] May not be hidden if Firefox has changed your settings due to your locale
 * [1] https://trac.torproject.org/projects/tor/ticket/16254
 * [2] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine ***/
 user_pref("browser.search.countryCode", "US"); // (hidden pref)
 user_pref("browser.search.region", "US"); // (hidden pref)
 user_pref("browser.search.geoip.url", "");
 /* 0205: set OS & APP locale (FF59+)
@ -119,16 +118,11 @@ user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?ke
     monetized extensions, time constraints, legacy issues, and fear of breakage/bugs.
     It is still important to do updates for security reasons, please do so manually. ***/
 user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!");
 /* 0301a: disable auto-update checks for Firefox
 * [NOTE] Firefox currently checks every 12 hrs and allows 8 day notification dismissal
 * [SETTING] General>Firefox Updates>Never check for updates ***/
   // user_pref("app.update.enabled", false);
 /* 0301b: disable auto-update checks for extensions
 * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/
   // user_pref("extensions.update.enabled", false);
-/* 0302a: disable auto update installing for Firefox (after the check in 0301a)
+/* 0302a: disable auto update installing for Firefox
- * [SETTING] General>Firefox Updates>Check for updates but let you choose...
+ * [SETTING] General>Firefox Updates>Check for updates but let you choose... ***/
 * [NOTE] The UI checkbox also controls the behavior for checking, the pref only controls auto installing ***/
 user_pref("app.update.auto", false);
 /* 0302b: disable auto update installing for extensions (after the check in 0301b)
 * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/
@ -216,27 +210,25 @@ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!");
 * [NOTE] It includes updates for "revoked certificates"
 * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
 * [2] https://trac.torproject.org/projects/tor/ticket/16931 ***/
-user_pref("extensions.blocklist.enabled", true);
+user_pref("extensions.blocklist.enabled", true); // default: true
 user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
-/* 0402: enable Kinto blocklist updates (FF50+)
+/* 0403: disable individual unwanted/unneeded parts of the Kinto blocklists
 * What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications
 * As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be
 * revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes ***/
 user_pref("services.blocklist.update_enabled", true);
 /* 0403: disable individual unwanted/unneeded parts of the Kinto blocklists ***/
   // user_pref("services.blocklist.onecrl.collection", ""); // revoked certificates
   // user_pref("services.blocklist.addons.collection", "");
   // user_pref("services.blocklist.plugins.collection", "");
   // user_pref("services.blocklist.gfx.collection", "");
 /** SAFE BROWSING (SB)
-    This sub-section has been redesigned to differentiate between "real-time"/"user initiated"
+    This sub-section has been redesigned to differentiate between "real-time"/"user initiated" data
-    data being sent to Google from all other settings such as using local blocklists/whitelists and
+    being sent to Google from all other settings such as using local blocklists/whitelists and updating
-    updating those lists. There are NO privacy issues here. *IF* required, a full url is never sent
+    those lists. There are NO privacy issues here. *IF* required, a full url is never sent to Google,
-    to Google, only a PART-hash of the prefix, and this is hidden with noise of other real PART-hashes.
+    only a PART-hash of the prefix, and this is hidden with noise of other real PART-hashes. Google also
-    Google also swear it is anonymized and only used to flag malicious sites/activity. Firefox
+    swear it is anonymized and only used to flag malicious sites/activity. Firefox also takes measures
-    also takes measures such as striping out identifying parameters and storing safe browsing
+    such as striping out identifying parameters and storing safe browsing cookies in a separate jar.
-    cookies in a separate jar. (#Turn on browser.safebrowsing.debug to monitor this activity)
+    SB v4 (FF57+) doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity)
    #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
    [1] https://wiki.mozilla.org/Security/Safe_Browsing ***/
 /* 0410: disable "Block dangerous and deceptive content" (under Options>Privacy & Security)
@ -285,9 +277,6 @@ user_pref("browser.safebrowsing.provider.google4.dataSharingURL", "");
 * [2] https://support.mozilla.org/kb/tracking-protection-firefox ***/
   // user_pref("privacy.trackingprotection.pbmode.enabled", true); // default: true
   // user_pref("privacy.trackingprotection.enabled", true);
 /* 0421: enable more Tracking Protection choices under Options>Privacy & Security>Use Tracking Protection
 * Displays three choices: "Always", "Only in private windows", "Never" ***/
 user_pref("privacy.trackingprotection.ui.enabled", true);
 /* 0422: set which Tracking Protection block list to use
 * [WARNING] We don't recommend enforcing this from here, as available block lists can change
 * [SETTING] Privacy & Security>Tracking Protection>Change Block List ***/
@ -306,6 +295,8 @@ user_pref("privacy.trackingprotection.ui.enabled", true);
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1170190,1141814 ***/
   // user_pref("privacy.trackingprotection.annotate_channels", false);
   // user_pref("privacy.trackingprotection.lower_network_priority", false);
 /* 0426: enforce Content Blocking (required to block cookies) (FF63+) ***/
 user_pref("browser.contentblocking.enabled", true); // default: true
 /*** 0500: SYSTEM ADD-ONS / EXPERIMENTS
     System Add-ons are a method for shipping extensions, considered to be
@ -333,7 +324,6 @@ user_pref("network.allow-experiments", false);
 user_pref("app.normandy.enabled", false);
 user_pref("app.normandy.api_url", "");
 user_pref("app.shield.optoutstudies.enabled", false);
 user_pref("shield.savant.enabled", false); // (FF61+)
 /* 0505: disable System Add-on updates
 * [NOTE] In FF61 and lower, you will not get any System Add-on updates except when you update Firefox ***/
   // user_pref("extensions.systemAddon.update.enabled", false); // (FF62+)
@ -346,18 +336,28 @@ user_pref("browser.ping-centre.telemetry", false);
 * [1] https://en.wikipedia.org/wiki/Pocket_(application)
 * [2] https://www.gnu.gl/blog/Posts/multiple-vulnerabilities-in-pocket/ ***/
 user_pref("extensions.pocket.enabled", false);
 /* 0513: disable Follow On Search (FF53+)
 * Just DELETE the XPI file in your System Add-ons directory
 * [1] https://blog.mozilla.org/data/2017/06/05/measuring-search-in-firefox/ ***/
 /* 0514: disable Activity Stream (FF54+)
 * Activity Stream is the default homepage/newtab in FF57+. It is based on metadata and browsing behavior,
 * and includes telemetry and web content such as snippets, top stories (pocket), top sites, etc.
 *  - ONE: make sure to set your "home" and "newtab" to about:blank (or use an extension to control them)
 *  - TWO: DELETE the XPI file in your System Add-ons directory (note this get reinstalled on app updates)
 * And/or you can try to control the ever-growing, ever-changing "browser.newtabpage.activity-stream.*" prefs
 * [FF63+] Activity Stream (AS) is now builtin and no longer an easily deletable system addon!
 *     We'll clean this up and move to a new number when ESR67 is released.
 * [1] https://wiki.mozilla.org/Firefox/Activity_Stream
 * [2] https://www.ghacks.net/2016/02/15/firefox-mockups-show-activity-stream-new-tab-page-and-share-updates/ ***/
 user_pref("browser.library.activity-stream.enabled", false); // (FF57+)
 /* 0514a: disable AS Snippets ***/
 user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
 user_pref("browser.newtabpage.activity-stream.feeds.snippets", false); // [SETTING] Home>Firefox Home Content>Snippets
 /* 0514b: disable AS Top Stories and other Pocket-based and/or sponsored content ***/
 user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
 user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false); // [SETTING] Home>Firefox Home Content>Highlights>Pages Saved to Pocket
 user_pref("browser.newtabpage.activity-stream.showSponsored", false);
 /* 0514c: disable AS telemetry ***/
 user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
 user_pref("browser.newtabpage.activity-stream.telemetry", false);
 user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
 /* 0515: disable Screenshots (FF55+)
 * alternatively in FF60+, disable uploading to the Screenshots server
 * [1] https://github.com/mozilla-services/screenshots
@ -424,7 +424,7 @@ user_pref("network.predictor.enable-prefetch", false);
 user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
 /* 0701: disable IPv6
 * IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
- * with VPNs. That's even assuming your ISP and/or router and/or website can hande it
+ * with VPNs. That's even assuming your ISP and/or router and/or website can handle it
 * [WARNING] This is just an application level fallback. Disabling IPv6 is best done
 * at an OS/network level, and/or configured properly in VPN setups
 * [TEST] http://ipv6leak.com/
@ -471,6 +471,14 @@ user_pref("network.proxy.autoconfig_url.include_path", false); // default: false
 /* 0709: disable using UNC (Uniform Naming Convention) paths (FF61+)
 * [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/
 user_pref("network.file.disable_unc_paths", true); // (hidden pref)
 /* 0710: disable GIO as a potential proxy bypass vector
 * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda,
 * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64)
 * [1] https://bugzilla.mozilla.org/1433507
 * [2] https://trac.torproject.org/23044
 * [3] https://en.wikipedia.org/wiki/GVfs
 * [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
 user_pref("network.gio.supported-protocols", ""); // (hidden pref)
 /*** 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS [SETUP]
     If you are in a private environment (no unwanted eyeballs) and your device is private
@ -558,6 +566,10 @@ user_pref("browser.formfill.enable", false);
 * [SETTING] Privacy & Security>History>Custom Settings>Remember my browsing and download history
 * [NOTE] You can clear history and downloads on exiting Firefox (see 2803) ***/
   // user_pref("places.history.enabled", false);
 /* 0864: disable date/time picker (FF57+ default true)
 * This can leak your locale if not en-US
 * [1] https://trac.torproject.org/projects/tor/ticket/21787 ***/
 user_pref("dom.forms.datetime", false);
 /* 0870: disable Windows jumplist [WINDOWS] ***/
 user_pref("browser.taskbar.lists.enabled", false);
 user_pref("browser.taskbar.lists.frequent.enabled", false);
@ -610,15 +622,16 @@ user_pref("security.insecure_field_warning.contextual.enabled", true);
 user_pref("network.auth.subresource-img-cross-origin-http-auth-allow", false);
 /*** 1000: CACHE [SETUP]
-     ETAG [1] and other [2] cache tracking/fingerprinting techniques can be averted by
+     ETAG [1] and other [2][3] cache tracking/fingerprinting techniques can be averted by
     disabling *BOTH* disk (1001) and memory (1003) cache. ETAGs can also be neutralized
-     by modifying response headers [3]. Another solution is to use a hardened configuration
+     by modifying response headers [4]. Another solution is to use a hardened configuration
-     with Temporary Containers [4]. Alternatively, you can *LIMIT* exposure by clearing
+     with Temporary Containers [5]. Alternatively, you can *LIMIT* exposure by clearing
     cache on close (2803). or on a regular basis manually or with an extension.
     [1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
     [2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
-     [3] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
+     [3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
-     [4] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
+     [4] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
     [5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
 ***/
 user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
 /** CACHE ***/
@ -679,9 +692,8 @@ user_pref("toolkit.winRegisterApplicationRestart", false);
 * If set to false then the shortcuts use a generic Firefox icon ***/
 user_pref("browser.shell.shortcutFavicons", false);
 /* 1031: disable favicons in tabs and new bookmarks
- * bookmark favicons are stored as data blobs in places.sqlite>moz_favicons ***/
+ * bookmark favicons are stored as data blobs in favicons.sqlite ***/
   // user_pref("browser.chrome.site_icons", false);
   // user_pref("browser.chrome.favicons", false);
 /* 1032: disable favicons in web notifications ***/
 user_pref("alerts.showFavicons", false); // default: false
@ -700,10 +712,11 @@ user_pref("alerts.showFavicons", false); // default: false
 ***/
 user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
 /** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/
-/* 1201: disable old SSL/TLS - vulnerable to a MiTM attack
+/* 1201: disable old SSL/TLS "insecure" renegotiation (vulnerable to a MiTM attack)
- * [WARNING] Tested Feb 2017 - still breaks too many sites
+ * [WARNING] <2% of secure sites do NOT support the newer "secure" renegotiation, see [2]
- * [1] https://wiki.mozilla.org/Security:Renegotiation ***/
+ * [1] https://wiki.mozilla.org/Security:Renegotiation
-   // user_pref("security.ssl.require_safe_negotiation", true);
+ * [2] https://www.ssllabs.com/ssl-pulse/ ***/
 user_pref("security.ssl.require_safe_negotiation", true);
 /* 1202: control TLS versions with min and max
 * 1=min version of TLS 1.0, 2=min version of TLS 1.1, 3=min version of TLS 1.2 etc
 * [NOTE] Jul-2017: Telemetry indicates approx 2% of TLS web traffic uses 1.0 or 1.1
@ -777,7 +790,7 @@ user_pref("security.cert_pinning.enforcement_level", 2);
 /** MIXED CONTENT ***/
 /* 1240: disable insecure active content on https pages - mixed content
 * [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
-user_pref("security.mixed_content.block_active_content", true);
+user_pref("security.mixed_content.block_active_content", true); // default: true
 /* 1241: disable insecure passive content (such as images) on https pages - mixed context ***/
 user_pref("security.mixed_content.block_display_content", true);
@ -811,7 +824,7 @@ user_pref("security.pki.sha1_enforcement_level", 1);
   // user_pref("security.ssl3.rsa_aes_256_sha", false);
 /** UI (User Interface) ***/
-/* 1270: display warning (red padlock) for "broken security"
+/* 1270: display warning (red padlock) for "broken security" (see 1201)
 * [1] https://wiki.mozilla.org/Security:Renegotiation ***/
 user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
 /* 1271: control "Add Security Exception" dialog on SSL warnings
@ -846,9 +859,11 @@ user_pref("browser.display.use_document_fonts", 0);
   // user_pref("font.name.sans-serif.x-western", "Arial"); // default: Arial
   // user_pref("font.name.monospace.x-unicode", "Lucida Console");
   // user_pref("font.name.monospace.x-western", "Lucida Console"); // default: Courier New
-/* 1403: enable icon fonts (glyphs) (FF41+)
+/* 1403: disable icon fonts (glyphs) (FF41) and local fallback rendering
- * [1] https://bugzilla.mozilla.org/789788 ***/
+ * [1] https://bugzilla.mozilla.org/789788
-user_pref("gfx.downloadable_fonts.enabled", true); // default: true
+ * [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/
   // user_pref("gfx.downloadable_fonts.enabled", false);
   // user_pref("gfx.downloadable_fonts.fallback_delay", -1);
 /* 1404: disable rendering of SVG OpenType fonts
 * [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/
 user_pref("gfx.font_rendering.opentype_svg.enabled", false);
@ -883,7 +898,7 @@ user_pref("gfx.font_rendering.graphite.enabled", false);
     use the site and then change the values back. If you visit those sites regularly (e.g. Vimeo), use an extension.
                    full URI: https://example.com:8888/foo/bar.html?id=1234
-       scheme+host+path+port: https://example.com:8888/foo/bar.html
+       scheme+host+port+path: https://example.com:8888/foo/bar.html
            scheme+host+port: https://example.com:8888
     #Required reading [#] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
@ -893,13 +908,13 @@ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!");
 * 0=never, 1=send only when links are clicked, 2=for links and images (default) ***/
 user_pref("network.http.sendRefererHeader", 2);
 /* 1602: ALL: control the amount of information to send
- * 0=send full URI (default), 1=scheme+host+path+port, 2=scheme+host+port ***/
+ * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
 user_pref("network.http.referer.trimmingPolicy", 0);
 /* 1603: CROSS ORIGIN: control when to send a referer [SETUP]
 * 0=always (default), 1=only if base domains match, 2=only if hosts match ***/
 user_pref("network.http.referer.XOriginPolicy", 1);
 /* 1604: CROSS ORIGIN: control the amount of information to send (FF52+)
- * 0=send full URI (default), 1=scheme+host+path+port, 2=scheme+host+port ***/
+ * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
 user_pref("network.http.referer.XOriginTrimmingPolicy", 0);
 /* 1605: ALL: disable spoofing a referer
 * [WARNING] Spoofing effectively disables the anti-CSRF (Cross-Site Request Forgery) protections that some sites may rely on ***/
@ -935,7 +950,7 @@ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
 * [SETTING] Privacy & Security>Tabs>Enable Container Tabs ***/
   // user_pref("privacy.userContext.enabled", true);
 /* 1703: enable a private container for thumbnail loads (FF51+) ***/
-   // user_pref("privacy.usercontext.about_newtab_segregation.enabled", true);
+   // user_pref("privacy.usercontext.about_newtab_segregation.enabled", true); // default: true in FF61+
 /* 1704: set long press behaviour on "+ Tab" button to display container menu (FF53+)
 * 0=disables long press, 1=when clicked, the menu is shown
 * 2=the menu is shown after X milliseconds
@ -1030,9 +1045,10 @@ user_pref("dom.imagecapture.enabled", false); // default: false
 /* 2028: disable offscreen canvas (FF44+)
 * [1] https://developer.mozilla.org/docs/Web/API/OffscreenCanvas ***/
 user_pref("gfx.offscreencanvas.enabled", false); // default: false
-/* 2030: disable auto-play of HTML5 media
+/* 2030: disable auto-play of HTML5 media (FF63+)
 * 0=Allowed (default), 1=Blocked, 2=Prompt
 * [WARNING] This may break video playback on various sites ***/
-user_pref("media.autoplay.enabled", false);
+user_pref("media.autoplay.default", 1);
 /* 2031: disable audio auto-play in non-active tabs (FF51+)
 * [1] https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ ***/
 user_pref("media.block-autoplay-until-in-foreground", true);
@ -1198,6 +1214,11 @@ user_pref("dom.webaudio.enabled", false);
 /* 2516: disable PointerEvents
 * [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent ***/
 user_pref("dom.w3c_pointer_events.enabled", false);
 /* 2517: disable Media Capabilities API (FF63+)
 * [WARNING] This *may* affect media performance if disabled, no one is sure
 * [1] https://github.com/WICG/media-capabilities
 * [2] https://wicg.github.io/media-capabilities/#security-privacy-considerations ***/
   // user_pref("media.media-capabilities.enabled", false);
 /*** 2600: MISCELLANEOUS ***/
 user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
@ -1305,12 +1326,6 @@ user_pref("browser.download.forbid_open_with", true);
 * [1] archived: https://archive.is/DYjAM ***/
 user_pref("extensions.enabledScopes", 1); // (hidden pref)
 user_pref("extensions.autoDisableScopes", 15);
 /* 2661: clear localStorage and UUID when an extension is uninstalled
 * [NOTE] Both preferences must be the same
 * [1] https://developer.mozilla.org/Add-ons/WebExtensions/API/storage/local
 * [2] https://bugzilla.mozilla.org/1213990 ***/
 user_pref("extensions.webextensions.keepStorageOnUninstall", false);
 user_pref("extensions.webextensions.keepUuidOnUninstall", false);
 /* 2662: disable webextension restrictions on certain mozilla domains (also see 4503) (FF60+)
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
   // user_pref("extensions.webextensions.restrictedDomains", "");
@ -1332,7 +1347,7 @@ user_pref("security.csp.experimentalEnabled", true);
 * [1] https://bugzilla.mozilla.org/1331351
 * [2] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
 * [3] https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/ ***/
-user_pref("security.data_uri.block_toplevel_data_uri_navigations", true);
+user_pref("security.data_uri.block_toplevel_data_uri_navigations", true); // default: true in FF59+
 /* 2684: enforce a security delay on some confirmation dialogs such as install, open/save
 * [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
 * [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
@ -1349,7 +1364,9 @@ user_pref("security.dialog_enable_delay", 700); // default: 1000 (milliseconds)
 user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
 /* 2701: disable 3rd-party cookies and site-data [SETUP]
 * You can set exceptions under site permissions or use an extension
- * 0=allow all 1=allow same host 2=disallow all 3=allow 3rd party if it already set a cookie
+ * 0=Accept cookies and site data, 1=Block third-party cookies, 2=Block all cookies,
 * 3=Block cookies from unvisited sites, 4=Block third-party trackers (FF63+)
 * [NOTE] value 4 is tied to the Tracking Protection lists so make sure you have 0424 + 0425 on default values!
 * [SETTING] Privacy & Security>History>Custom Settings>Accept cookies from sites
 * [NOTE] Blocking 3rd party controls 3rd party access to localStorage, IndexedDB, Cache API and Service Worker Cache.
 * Blocking 1st party controls access to localStorage and IndexedDB (note: Service Workers can still use IndexedDB).
@ -1364,11 +1381,10 @@ user_pref("network.cookie.cookieBehavior", 1);
 user_pref("network.cookie.thirdparty.sessionOnly", true);
 user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // (FF58+)
 /* 2703: set cookie lifetime policy
- * 0=until they expire (default), 2=until you close Firefox, 3=for n days (see next pref)
+ * 0=until they expire (default), 2=until you close Firefox
 * [NOTE] 3=for n days : no longer supported in FF63+ (see 2704-deprecated)
 * [SETTING] Privacy & Security>History>Custom Settings>Accept cookies from sites>Keep until ***/
   // user_pref("network.cookie.lifetimePolicy", 0);
 /* 2704: set cookie lifetime in days (see above pref) - default is 90 days ***/
   // user_pref("network.cookie.lifetime.days", 90);
 /* 2705: disable HTTP sites setting cookies with the "secure" directive (FF52+)
 * [1] https://developer.mozilla.org/Firefox/Releases/52#HTTP ***/
 user_pref("network.cookie.leave-secure-alone", true); // default: true
@ -1378,7 +1394,7 @@ user_pref("network.cookie.leave-secure-alone", true); // default: true
 * [3] https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/ ***/
   // user_pref("network.cookie.same-site.enabled", true); // default: true
 /* 2710: disable DOM (Document Object Model) Storage
- * [WARNING] This will break a LOT of sites' functionality.
+ * [WARNING] This will break a LOT of sites' functionality AND extensions!
 * You are better off using an extension for more granular control ***/
   // user_pref("dom.storage.enabled", false);
 /* 2720: enforce IndexedDB (IDB) as enabled
@ -1389,12 +1405,11 @@ user_pref("network.cookie.leave-secure-alone", true); // default: true
 * via an extenion. Note that IDB currently cannot be sanitized by host.
 * [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ ***/
 user_pref("dom.indexedDB.enabled", true); // default: true
-/* 2730: disable offline cache
+/* 2730: disable offline cache ***/
 * [NOTE] For FF51-FF60 (ESR not included), this is required 'true' for Storage API (2750) ***/
 user_pref("browser.cache.offline.enable", false);
 /* 2730b: disable offline cache on insecure sites (FF60+)
 * [1] https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/ ***/
-user_pref("browser.cache.offline.insecure.enable", false);
+user_pref("browser.cache.offline.insecure.enable", false); // default: false in FF62+
 /* 2731: enforce websites to ask to store data for offline use
 * [1] https://support.mozilla.org/questions/1098540
 * [2] https://bugzilla.mozilla.org/959985 ***/
@ -1406,7 +1421,6 @@ user_pref("dom.caches.enabled", false);
 * The API gives sites the ability to find out how much space they can use, how much
 * they are already using, and even control whether or not they need to be alerted
 * before the user agent disposes of site data in order to make room for other things.
 * [NOTE] For FF51-FF60 (ESR not included), if Storage API is enabled, then Offline Cache (2730) must be also be enabled
 * [1] https://developer.mozilla.org/docs/Web/API/StorageManager
 * [2] https://developer.mozilla.org/docs/Web/API/Storage_API
 * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/
@ -1478,6 +1492,7 @@ user_pref("privacy.sanitize.timeSpan", 0);
 ** 1344170 - isolate blob: URI (FF55+)
 ** 1300671 - isolate data:, about: URLs (FF55+)
 ** 1473247 - isolate IP addresses (FF63+)
 ** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+)
 NOTE: FPI has some issues depending on your Firefox release
 ** 1418931 - [fixed in FF58+] IndexedDB (Offline Website Data) with FPI Origin Attributes
@ -1491,8 +1506,14 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
 user_pref("privacy.firstparty.isolate", true);
 /* 4002: enforce FPI restriction for window.opener (FF54+)
 * [NOTE] Setting this to false may reduce the breakage in 4001
- * [1] https://bugzilla.mozilla.org/1319773#c22 ***/
+ * [FF65+] blocks postMessage with targetOrigin "*" if originAttributes don't match. But
-user_pref("privacy.firstparty.isolate.restrict_opener_access", true);
+ * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
 * The 2nd pref removes that limitation and will only allow communication if FPDs also match.
 * [1] https://bugzilla.mozilla.org/1319773#c22
 * [2] https://bugzilla.mozilla.org/1492607
 * [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
 user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // default: true
   // user_pref("privacy.firstparty.isolate.block_post_message", true); // (hidden pref)
 /*** 4500: privacy.resistFingerprinting (RFP)
   This master switch will be used for a wide range of items, many of which will
@ -1547,6 +1568,7 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true);
      FF60: Fix keydown/keyup events (1438795)
 ** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
 ** 1459089 - disable OS locale in HTTP Accept-Language headers [ANDROID] (FF62+)
 ** 1363508 - spoof/suppress Pointer Events (FF64+)
 ***/
 user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
 /* 4501: enable privacy.resistFingerprinting (FF41+)
@ -1659,9 +1681,10 @@ user_pref("webgl.enable-debug-renderer-info", false);
 user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow");
 /* 4701: navigator.userAgent ***/
   // user_pref("general.useragent.override", ""); // (hidden pref)
-/* 4702: navigator.buildID (
+/* 4702: navigator.buildID
- * reveals build time down to the second
+ * Revealed build time down to the second. In FF64+ it now returns a fixed timestamp
- * [1] https://bugzilla.mozilla.org/583181 ***/
+ * [1] https://bugzilla.mozilla.org/583181
 * [2] https://www.fxsitecompat.com/en-CA/docs/2018/navigator-buildid-now-returns-a-fixed-timestamp/ ***/
   // user_pref("general.buildID.override", ""); // (hidden pref)
 /* 4703: navigator.appName ***/
   // user_pref("general.appname.override", ""); // (hidden pref)
@ -1695,7 +1718,6 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
   // user_pref("layout.spellcheckDefault", 2); // 0=none, 1-multi-line, 2=multi-line & single-line
 /* UX BEHAVIOR ***/
   // user_pref("browser.backspace_action", 2); // 0=previous page, 1=scroll up, 2=do nothing
   // user_pref("browser.ctrlTab.previews", true);
   // user_pref("browser.tabs.closeWindowWithLastTab", false);
   // user_pref("browser.tabs.loadBookmarksInTabs", true); // open bookmarks in a new tab (FF57+)
   // user_pref("browser.urlbar.decodeURLsOnCopy", true); // see Bugzilla 1320061 (FF53+)
@ -2114,6 +2136,38 @@ user_pref("network.jar.open-unsafe-types", false);
   // [-] (part5) https://bugzilla.mozilla.org/1461243
 user_pref("plugin.state.java", 0);
 // * * * /
 // FF63
 // 0202: disable GeoIP-based search results
   // [NOTE] May not be hidden if Firefox has changed your settings due to your locale
   // [-] https://bugzilla.mozilla.org/1462015
 user_pref("browser.search.countryCode", "US"); // (hidden pref)
 // 0301a: disable auto-update checks for Firefox
   // [SETTING] General>Firefox Updates>Never check for updates
   // [-] https://bugzilla.mozilla.org/1420514
   // user_pref("app.update.enabled", false);
 // 0402: enable Kinto blocklist updates (FF50+)
   // What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications
   // As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be
   // revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes
   // [-] https://bugzilla.mozilla.org/1458917
 user_pref("services.blocklist.update_enabled", true);
 // 0503: disable "Savant" Shield study (FF61+)
   // [-] https://bugzilla.mozilla.org/1457226
 user_pref("shield.savant.enabled", false);
 // 1031: disable favicons in tabs and new bookmarks - merged into browser.chrome.site_icons
   // [-] https://bugzilla.mozilla.org/1453751
   // user_pref("browser.chrome.favicons", false);
 // 2030: disable auto-play of HTML5 media - replaced by media.autoplay.default
   // [WARNING] This may break video playback on various sites
   // [-] https://bugzilla.mozilla.org/1470082
 user_pref("media.autoplay.enabled", false);
 // 2704: set cookie lifetime in days (see 2703)
   // [-] https://bugzilla.mozilla.org/1457170
   // user_pref("network.cookie.lifetime.days", 90); // default: 90
 // 5000's: enable "Ctrl+Tab cycles through tabs in recently used order" - replaced by browser.ctrlTab.recentlyUsedOrder
   // [-] https://bugzilla.mozilla.org/1473595
   // user_pref("browser.ctrlTab.previews", true);
 // * * * /
 // ***/
 /* END: internal custom pref to test for syntax errors ***/
--- a/wikipiki/License-MIT-yellow.svg
+++ b/wikipiki/License-MIT-yellow.svg
@ -0,0 +1 @@
 <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="78" height="20"><linearGradient id="b" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="a"><rect width="78" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#a)"><path fill="#555" d="M0 0h47v20H0z"/><path fill="#dfb317" d="M47 0h31v20H47z"/><path fill="url(#b)" d="M0 0h78v20H0z"/></g><g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="110"> <text x="245" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="370">license</text><text x="245" y="140" transform="scale(.1)" textLength="370">license</text><text x="615" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="210">MIT</text><text x="615" y="140" transform="scale(.1)" textLength="210">MIT</text></g> </svg>
Author	SHA1	Message	Date
Thorin-Oakenpants	3003f2dd85	make up yer mind stick it back in for two releases - pref gets removed in FF65 anyway	2018-11-13 15:30:39 +00:00
Thorin-Oakenpants	ce48306a0d	finalize beta	2018-11-13 15:12:20 +00:00
Thorin-Oakenpants	3423d39fa9	2517 Media Capabilities => inactive see `f214e4bc4e (comments)`	2018-11-13 15:11:01 +00:00
Thorin-Oakenpants	4834472107	remove 0426 content blocking	2018-11-13 15:01:35 +00:00
Thorin-Oakenpants	f214e4bc4e	2517: disable Media Capabilities API (for now)	2018-11-13 08:42:49 +00:00
Thorin-Oakenpants	8fd6061bcc	0426: enforce CB	2018-11-13 08:19:19 +00:00
Thorin-Oakenpants	92acb6b2f7	saving the world, one byte at a time	2018-11-12 00:06:19 +00:00
earthlng	b6b9733afa	remove old information (#531 ) Pants said "We do not need to keep anything for ESR users. ESR users are on v60, and we have an archived 60 for them." This isn't even affecting ESR60 but only older versions.	2018-11-08 04:14:32 +13:00
claustromaniac	89bc0bee16	scheme+host+path+port -> scheme+host+port+path (#530 )	2018-11-04 14:44:20 +00:00
earthlng	f8fc465d0a	2701: add new descriptions and new value (#527 )	2018-10-30 04:40:24 +13:00
earthlng	58fa4e9b6d	0514: disable snippets, top stories, telemetry	2018-10-29 14:26:49 +00:00
Thorin-Oakenpants	afee555045	FPI: isolate postMessage...	2018-10-28 16:46:22 +00:00
earthlng	5a36b4e016	Update README.md	2018-10-28 15:58:47 +00:00
earthlng	7b3e6f5143	Update README.md	2018-10-28 15:20:41 +00:00
Thorin-Oakenpants	452c717502	Update README.md	2018-10-28 11:09:47 +00:00
Thorin-Oakenpants	661af196d9	Update README.md	2018-10-28 11:08:18 +00:00
earthlng	39a30d710b	Update README.md	2018-10-27 16:30:38 +00:00
earthlng	8f10300c15	Update _config.yml	2018-10-27 16:29:34 +00:00
earthlng	806d047729	Update README.md	2018-10-27 16:28:15 +00:00
earthlng	0efebe3e83	Update README.md	2018-10-27 16:17:25 +00:00
Thorin-Oakenpants	49d9314b0a	Update README.md	2018-10-27 15:00:10 +00:00
Thorin-Oakenpants	b4b5e3a068	Add files via upload	2018-10-28 03:57:54 +13:00
Thorin-Oakenpants	29d832e350	Update README.md	2018-10-27 14:55:15 +00:00
Mtq	68e44285c5	Update README.md (#524 ) + compressed	2018-10-28 03:52:19 +13:00
Thorin-Oakenpants	e8bfa93696	0410s: SBv4 & cookies, #520	2018-10-25 00:13:50 +00:00
Thorin-Oakenpants	1abe1fd4df	4702: buildID cleanup, closes 518	2018-10-24 10:15:37 +00:00
Thorin-Oakenpants	24f7847f73	2703: make value 3 info clearer	2018-10-23 16:13:23 +00:00
earthlng	56206f77ba	removed, renamed or hidden in v63.0 (#523 ) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3	2018-10-24 04:45:31 +13:00
Thorin-Oakenpants	587194ce84	1403: icon fonts: flip, make inactive, closes #521	2018-10-20 01:35:37 +00:00
Thorin-Oakenpants	7aac6d476a	1270: link to 1201, #519	2018-10-16 12:01:42 +00:00
Thorin-Oakenpants	9e073ea5d5	1201: SSL renegotiation -> active, closes #519	2018-10-16 11:57:32 +00:00
Thorin-Oakenpants	732c438148	0710: disable GIO... #442	2018-10-14 12:11:56 +00:00
Thorin-Oakenpants	58931bc15d	start 63 commits	2018-10-11 11:25:03 +00:00
Thorin-Oakenpants	21b18cbe49	finalize 62	2018-10-11 10:46:35 +00:00
Thorin-Oakenpants	cbcd293e68	RFP: spoof/suppress Pointer Events https://bugzilla.mozilla.org/show_bug.cgi?id=1363508	2018-10-11 05:50:09 +00:00
earthlng	aacf5d4a0b	update 1031 description	2018-09-30 15:30:32 +00:00
earthlng	ec5fb6e3a1	removed privacy.trackingprotection.ui.enabled	2018-09-30 15:24:33 +00:00
earthlng	b2fc9bc266	remove 0421: privacy.trackingprotection.ui.enabled - pref removed in FF63 (https://bugzilla.mozilla.org/1476879) - when we added it the default was false - default is true since FF57 - it's only an UI thing ergo we don't need to move it to 9999	2018-09-30 15:20:36 +00:00
Thorin-Oakenpants	ca1cc2001f	Update README.md	2018-09-20 23:40:29 +00:00
Thorin-Oakenpants	f88af1dac6	Update README.md	2018-09-20 23:39:44 +00:00
Thorin-Oakenpants	1c6c5ea2ff	1000s: cache header section #496	2018-09-13 05:09:07 +00:00
Thorin-Oakenpants	2d316ceedd	removed webextensions.keep	2018-09-12 22:27:26 +00:00
Thorin-Oakenpants	36c791c4bc	remove 2661: webextensions.keep Added in FF51 with defaults false and never changed since	2018-09-12 22:23:59 +00:00
earthlng	ee213f2bab	infos about default values (#504 ) * more infos * add colons not all EOL comments for defaults start with `// default` (23). The common string is `default:` (27 incl. these ones) with or without preceding or trailing spaces	2018-09-13 10:17:56 +12:00
Thorin-Oakenpants	01a978e33a	add 0864: dom.forms.datetime, closes #495	2018-09-11 16:43:18 +00:00
		`@ -0,0 +1 @@`
							<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="78" height="20"><linearGradient id="b" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="a"><rect width="78" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#a)"><path fill="#555" d="M0 0h47v20H0z"/><path fill="#dfb317" d="M47 0h31v20H47z"/><path fill="url(#b)" d="M0 0h78v20H0z"/></g><g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="110"> <text x="245" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="370">license</text><text x="245" y="140" transform="scale(.1)" textLength="370">license</text><text x="615" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="210">MIT</text><text x="615" y="140" transform="scale(.1)" textLength="210">MIT</text></g> </svg>