Compare commits

..

76 Commits

Author SHA1 Message Date
c367beabe3 81-beta 2020-09-23 12:20:59 +00:00
e1d336a178 standardize some error codes
* 0 : successful termination
* 2 : command line syntax error
* 1 : catchall for general errors

Plus a few text improvements based on unmerged PR 4fbb2be98d
2020-09-15 13:36:39 +00:00
ee3e5f0186 v4.12: arkenfox 2020-09-15 12:04:54 +00:00
42b7650d42 v2.8: arkenfox 2020-09-15 11:58:52 +00:00
f61d4a0d38 Update prefsCleaner.sh 2020-09-15 11:55:28 +00:00
7fe9784bf8 we no longer have github pages 2020-09-15 06:18:54 +00:00
ed05c64482 we no longer have github pages 2020-09-15 06:18:33 +00:00
16c3658040 align look with TZP 2020-09-15 06:17:44 +00:00
515d6ff874 v2.3: update repo name 2020-09-15 06:11:35 +00:00
fc65052286 migration: cleanup code references 2020-09-15 06:07:32 +00:00
6a107d4d2f migration: cleanup code references 2020-09-15 06:06:32 +00:00
eff4b74130 migration: cleanup code references 2020-09-15 06:05:33 +00:00
2532ddcc18 update name 2020-09-15 05:59:51 +00:00
44e22835c1 update name 2020-09-15 05:58:39 +00:00
1f545312fd update names + links 2020-09-15 05:57:30 +00:00
637e5964db update links 2020-09-15 05:56:00 +00:00
26bca612d7 rename as arkenfox 2020-09-15 05:54:22 +00:00
6fdda5fb62 rename as arkenfox 2020-09-15 05:53:09 +00:00
ed5b158777 Rename ghacks-clear-RFP-alternatives.js to arkenfox-clear-RFP-alternatives.js 2020-09-15 05:52:28 +00:00
4c4270f1d7 migration changes 2020-09-15 04:33:50 +00:00
af51631597 Update LICENSE.txt 2020-09-15 04:19:03 +00:00
ae0c980d25 migration 2020-09-15 04:15:03 +00:00
3e4c56cf27 arkenfox support
also fixes mixed line endings
2020-09-13 12:16:21 +00:00
18112f9ae8 last F time :) update TZP links 2020-09-11 21:55:12 +00:00
c8eee094e0 update links 2020-09-11 03:23:55 +00:00
78a7c194eb update ref links 2020-09-10 07:33:50 +00:00
f606c8b866 2203 values
see https://bugzilla.mozilla.org/show_bug.cgi?id=1663500 where they reverted https://bugzilla.mozilla.org/show_bug.cgi?id=1661643 where they said value 1 didn't do anything - all changes in FF82, so nothing to see here folks ... move along
2020-09-08 23:49:22 +00:00
9c98972d14 misc2 (#1010)
* forceMediaMemoryCache breakage

* add back ESR68-EOL for prefsCleaner users
2020-09-05 15:42:34 +00:00
75a03df0f7 miscellaneous (#1007)
- less active prefs
   - now that ESR68 is EOL, at least a whopping two (0602, 1273)
   - also I don't know when the default changed - another whopping whole one (1240)
   - and where we do enforce/reset a pref to default, lets say that
   - this is not a definitive list, sing out if there is anything else
- IPv6 info
   - especially for Iron Heart who likes to claim that this pref breaks 5% of sites
- cleanup of settings tags now we only care abut ESR78+
2020-09-05 15:20:46 +00:00
76019e6fbe ESR78 unhidden prefs
also, the note about WebExt + SVG only applies to people using outdated versions .. so that can go too
2020-09-03 13:27:25 +00:00
3c2bd930c3 start 81-alpha, EOL for ESR68 2020-09-03 13:11:16 +00:00
ed993d5502 80 final 2020-09-03 13:04:31 +00:00
22d2d702be 1409: obsolete RFP mention 2020-09-03 13:02:09 +00:00
8dacf6e91f fix typo (#1005) 2020-08-31 21:47:57 +00:00
fbe1d48fe2 2203: open_newwindow values
- FYI: https://bugzilla.mozilla.org/show_bug.cgi?id=1661643
- https://hg.mozilla.org/integration/autoland/rev/12d62b074178
2020-08-31 19:49:00 +00:00
5fd7f6de7e 80-alpha 2020-08-28 18:27:20 +00:00
592b959c24 Updater.sh rework 2 (#1000)
* rework DOWNLOAD_METHOD, download_file, open_file

* remove legacy command leftover line

* return empty string if download fails and return/exit if this happens and show error message

* fix IFS var typo

* bump version

* add quotes

Co-authored-by: TotallyLeGIT <bbkqx24kxlgvgbss@mailban.de>
2020-08-28 10:51:15 +00:00
c6f53c8768 2201 deprecated (dead prefs removed in 82), #979 (#1002) 2020-08-26 11:28:47 +00:00
38d772e4c8 https-only mode updates (#1001) 2020-08-25 14:59:41 +00:00
cfce521919 1409: RFP changes in FF81+ (#998) 2020-08-23 14:37:18 +00:00
a5ab3e23d6 Update README.md 2020-08-22 22:16:27 +00:00
b3eee6c9fd improve readability, remove lots of unnecessary echo commands, remove legacy arguments (#997)
Co-authored-by: TotallyLeGIT <bbkqx24kxlgvgbss@mailban.de>
2020-08-22 12:07:13 +00:00
8d6d17d46b 1244: HTTPS-only mode: FF80+ site exceptions
The option is not shown if https-only-mode is not being applied. I tested with `http://asmjs.org/` since it doesn't redirect/upgrade to secure.
2020-08-21 21:05:08 +00:00
9a37e1340c 0905: add reference, #982 2020-08-20 17:18:22 +00:00
f1e0203ef4 0105b, cleaner value, see #992 2020-08-15 01:56:01 +00:00
726d5bde30 0105b: stop console error, closes #992 2020-08-14 14:12:28 +00:00
f9f0fffd27 Update README.md 2020-08-14 09:01:14 +00:00
93840ca181 0602 not hidden in ESR78 2020-08-13 15:37:25 +00:00
99aa5af356 password master->primary 2020-08-13 15:34:26 +00:00
0358fdac8b 80-alpha 2020-08-13 15:32:45 +00:00
815c3026b5 79 final 2020-08-13 15:30:36 +00:00
5ed3047b7a references cleanup 2020-08-13 15:22:38 +00:00
e16ede1cdf 79-beta 2020-08-13 14:44:27 +00:00
6905187b3e 0207/0208: region/search (#989) 2020-08-13 04:39:38 +00:00
172118e61b RFP+Alts: fixup sequential numbering, see #987 2020-08-05 01:35:10 +00:00
8452edb94b 4600: see #987 2020-08-04 10:25:29 +00:00
0f6957bbd4 4600: add missing version section 2020-08-04 10:18:29 +00:00
8c2bcc0352 1007: bump to 64mb, see #941 2020-08-03 22:50:58 +00:00
bc832575d8 1003: kibibytes 2020-08-03 14:52:21 +00:00
c4b7e07691 4500: site partitioning 2020-08-02 01:47:48 +00:00
58fb1db838 HTTPS-Only Mode UI 2020-08-02 01:27:30 +00:00
2809854802 font visibility / RFP (#985) 2020-08-01 11:03:17 +00:00
091a71aade browser.urlbar.usepreloadedtopurls.enabled 2020-07-29 02:22:09 +00:00
117ab133b1 remove 0809
not deprecated, just hidden: default is false anyway
2020-07-29 02:19:20 +00:00
c4a06c4689 missing comma 2020-07-23 12:23:14 +00:00
0d27689c64 update to ESR78
and this time add the file extension
2020-07-23 12:22:20 +00:00
771e57480a Delete ghacks-clear-RFP-alternatives 2020-07-23 12:21:10 +00:00
f8fd03482d 79 deprecated 2020-07-23 11:19:49 +00:00
10cc1224d0 Create ghacks-clear-removed.js 2020-07-23 11:00:23 +00:00
52926cca7a Delete ghacks-clear-[removed].js 2020-07-23 10:59:19 +00:00
be64819ce7 update to ESR78 2020-07-23 10:58:22 +00:00
24c228df92 update to ESR78 2020-07-23 10:57:12 +00:00
892b3d9d69 Delete ghacks-clear-FF68inclusive-[deprecated].js 2020-07-23 10:53:38 +00:00
df21798b81 Delete ghacks-clear-FF68inclusive-[RFP-alternatives].js 2020-07-23 10:53:25 +00:00
46d03279d3 79 start, fixup 2429 default info 2020-07-22 12:35:13 +00:00
fe0af3bb34 remove 0709 duplicate, 78 final 2020-07-21 10:40:01 +00:00
16 changed files with 287 additions and 261 deletions

View File

@ -8,16 +8,16 @@ assignees: ''
---
Before you proceed...
- Issues will be closed as invalid if you do not [troubleshoot](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.4-Troubleshooting), including
- Issues will be closed as invalid if you do not [troubleshoot](https://github.com/arkenfox/user.js/wiki/1.4-Troubleshooting), including
- confirming the problem is caused by the `user.js`
- searching the `[Setup` tags in the `user.js`
- Search the GitHub repository. The information you need is most likely here already.
- Note: We do not support forks
See also:
- Extension breakage due to prefs [issue 391](https://github.com/ghacksuserjs/ghacks-user.js/issues/391)
- Prefs vs Recommended Extensions: Co-Existance+Enhancement | Conflicts [issue 350](https://github.com/ghacksuserjs/ghacks-user.js/issues/350)
- The extension CSP header modification game [issue 664](https://github.com/ghacksuserjs/ghacks-user.js/issues/664)
- Extension breakage due to prefs [issue 391](https://github.com/arkenfox/user.js/issues/391)
- Prefs vs Recommended Extensions: Co-Existance+Enhancement | Conflicts [issue 350](https://github.com/arkenfox/user.js/issues/350)
- The extension CSP header modification game [issue 664](https://github.com/arkenfox/user.js/issues/664)
If you still need help, help us help you by providing relevant information:
- browser version

View File

@ -9,7 +9,7 @@ assignees: ''
We value feedback in general, but we value feedback from informed users more. There is no need for you to be an expert to participate (most of us aren't), but we hope that you at least understand our decisions before questioning them. We discuss all changes openly, and we do not make changes lightly. So, if you don't understand why we decided to add/remove/change a certain pref, search the repo. The answer is most certainly here.
If some change we made took you by surprise (in the wrong way), remember that keeping track of changes is your responsibility. Watch the repo, read the [changelogs](https://github.com/ghacksuserjs/ghacks-user.js/issues?utf8=✓&q=is%3Aissue+label%3Achangelog), compare [releases](https://github.com/ghacksuserjs/ghacks-user.js/releases) as you update your copy of user.js, or use any other method you prefer.
If some change we made took you by surprise (in the wrong way), remember that keeping track of changes is your responsibility. Watch the repo, read the [changelogs](https://github.com/arkenfox/user.js/issues?utf8=✓&q=is%3Aissue+label%3Achangelog), compare [releases](https://github.com/arkenfox/user.js/releases) as you update your copy of user.js, or use any other method you prefer.
Clear all of this when you're ready to type.

View File

@ -1,6 +1,6 @@
MIT License
Copyright (c) 2017 ghacksuserjs
Copyright (c) 2020 arkenfox
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal

View File

@ -1,27 +1,28 @@
### ![][b] user.js
A `user.js` is a configuration file that can control hundreds of Firefox settings. For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.1-Overview) wiki page.
### 🟪 user.js
A `user.js` is a configuration file that can control hundreds of Firefox settings. For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/arkenfox/user.js/wiki/1.1-Overview) wiki page.
### ![][b] ghacks user.js
The `ghacks user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).
### 🟩 the arkenfox user.js
Everyone, experts included, should at least read the [implementation](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation) wiki page, as it contains important information regarding a few `ghacks user.js` settings.
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
The `arkenfox user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).
Everyone, experts included, should at least read the [implementation](https://github.com/arkenfox/user.js/wiki/1.3-Implementation) wiki page, as it contains important information regarding a few `user.js` settings.
Note that we do *not* recommend connecting over Tor on Firefox. Use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en) if your [threat model](https://www.torproject.org/about/torusers.html.en) calls for it, or for accessing hidden services.
Also be aware that this `user.js` is made specifically for desktop Firefox. Using it as-is in other Gecko-based browsers can be counterproductive, especially in the Tor Browser.
Also be aware that the `arkenfox user.js` is made specifically for desktop Firefox. Using it as-is in other Gecko-based browsers can be counterproductive, especially in the Tor Browser.
Sitemap: [Releases](https://github.com/ghacksuserjs/ghacks-user.js/releases), [changelogs](https://github.com/ghacksuserjs/ghacks-user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog), [Wiki](https://github.com/ghacksuserjs/ghacks-user.js/wiki), [stickies](https://github.com/ghacksuserjs/ghacks-user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22). [diffs](https://github.com/ghacksuserjs/ghacks-user.js/issues?q=is%3Aissue+label%3Adiffs)
### 🟧 sitemap
### ![][b] acknowledgments
Literally thousands of sources, references and suggestions. That said...
- [Releases](https://github.com/arkenfox/user.js/releases)
- [changelogs](https://github.com/arkenfox/user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog)
- [Wiki](https://github.com/arkenfox/user.js/wiki)
- [stickies](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22)
- [diffs](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Adiffs)
* Martin Brinkmann at [ghacks](https://www.ghacks.net/) <sup>1</sup>
* The ghacks community and commentators
* [12bytes](https://12bytes.org/articles/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs)
* The 12bytes article now uses this user.js and supplements it with an additional JS hosted at [Codeberg](https://codeberg.org/12bytes.org/Firefox-user.js-supplement)
### 🟥 acknowledgments
Literally thousands of sources, references and suggestions. Special mention to:
<sup>1</sup> The ghacks user.js was an independent project by [Thorin-Oakenpants](https://github.com/Thorin-Oakenpants) started in early 2015 and was [first published](https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/) at ghacks in August 2015. With Martin Brinkmann's blessing, it will keep the ghacks name.
* This [12bytes article](https://12bytes.org/articles/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs) which uses the `arkenfox user.js` and supplements it with an additional JS hosted at [Codeberg](https://codeberg.org/12bytes.org/Firefox-user.js-supplement)
### ![][b] [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[b]: /wikipiki/bullet01.png

View File

@ -1,3 +1,3 @@
theme: jekyll-theme-midnight
title: ghacks-user.js
title: user.js
description: An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting

View File

@ -3,7 +3,7 @@ TITLE prefs.js cleaner
REM ### prefs.js cleaner for Windows
REM ## author: @claustromaniac
REM ## version: 2.2
REM ## version: 2.3
CD /D "%~dp0"
@ -13,7 +13,7 @@ ECHO:
ECHO ########################################
ECHO #### prefs.js cleaner for Windows ####
ECHO #### by claustromaniac ####
ECHO #### v2.2 ####
ECHO #### v2.3 ####
ECHO ########################################
ECHO:
CALL :message "This script should be run from your Firefox profile directory."
@ -101,7 +101,7 @@ ECHO add-ons disabled. Then, restart it again normally, and see if the
CALL :message " problems were solved."
ECHO:
CALL :message "If you are able to identify the cause of your issues, please bring it up"
ECHO on ghacks-user.js GitHub repository.
ECHO on arkenfox user.js GitHub repository.
ECHO:
ECHO:
PAUSE

View File

@ -2,7 +2,7 @@
## prefs.js cleaner for Linux/Mac
## author: @claustromaniac
## version: 1.2
## version: 1.3
## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh
@ -58,7 +58,7 @@ echo -e "\n\n"
echo " ╔══════════════════════════╗"
echo " ║ prefs.js cleaner ║"
echo " ║ by claustromaniac ║"
echo " ║ v1.2 ║"
echo " ║ v1.3 ║"
echo " ╚══════════════════════════╝"
echo -e "\nThis script should be run from your Firefox profile directory.\n"
echo "It will remove any entries from prefs.js that also exist in user.js."
@ -90,7 +90,7 @@ select option in Start Help Exit; do
echo "4. Rename or copy your latest backup to prefs.js."
echo "5. Run Firefox and see if you notice anything wrong with it."
echo "6. If you do notice something wrong, especially with your extensions, and/or with the UI, go to about:support, and restart Firefox with add-ons disabled. Then, restart it again normally, and see if the problems were solved."
echo -e "If you are able to identify the cause of your issues, please bring it up on ghacks-user.js GitHub repository.\n"
echo -e "If you are able to identify the cause of your issues, please bring it up on the arkenfox user.js GitHub repository.\n"
;;
Exit)
fQuit 0

View File

@ -1,10 +1,12 @@
/***
This will reset the preferences that are under sections 4600 & 4700 in the ghacks user.js
up to and including Firefox/ESR 68. These are the prefs that are no longer necessary,
or they conflict with, privacy.resistFingerprinting if you have that enabled.
Version: up to and including FF/ESR78
This will reset the preferences that are under sections 4600 & 4700 in the
arkenfox user.js. These are the prefs that are no longer necessary, or they
conflict with, privacy.resistFingerprinting if you have that enabled.
For instructions see:
https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
https://github.com/arkenfox/user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
***/
(function() {
@ -24,6 +26,8 @@
'webgl.enable-debug-renderer-info',
'dom.w3c_pointer_events.enabled',
'ui.use_standins_for_native_colors',
'ui.systemUsesDarkTheme',
'ui.prefersReducedMotion',
/* section 4700 */
'general.useragent.override',
'general.buildID.override',

View File

@ -1,17 +1,44 @@
/***
Version: up to and including FF/ESR78
This will reset the preferences that have been deprecated by Mozilla
and used in the ghacks user.js up to and including Firefox/ESR 68
and used in the arkenfox user.js
It is in reverse order, so feel free to remove sections that do not apply
For instructions see:
https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
https://github.com/arkenfox/user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
***/
(function() {
let ops = [
/* deprecated */
/* 78 */
'media.autoplay.enabled.user-gestures-needed',
'toolkit.cosmeticAnimations.enabled',
/* 77 */
'browser.urlbar.oneOffSearches',
'browser.tabs.remote.allowLinkedWebInFileUriProcess',
/* 76 */
'extensions.blocklist.url',
/* 74 */
'geo.wifi.uri',
'geo.wifi.logging.enabled',
'privacy.userContext.longPressBehavior',
'webgl.disable-extensions',
/* 72 */
'browser.newtabpage.activity-stream.telemetry.ping.endpoint',
'toolkit.telemetry.hybridContent.enabled',
'dom.indexedDB.enabled',
/* 71 */
'devtools.webide.enabled',
'devtools.webide.autoinstallADBExtension',
'offline-apps.allow_by_default',
/* 69 */
'gfx.downloadable_fonts.woff2.enabled',
'plugins.click_to_play',
'media.autoplay.allow-muted',
/* 68 */
'browser.newtabpage.activity-stream.disableSnippets',
'browser.aboutHomeSnippets.updateUrl',

View File

@ -1,15 +1,15 @@
/***
This will reset the preferences that have been removed completely from the ghacks user.js.
This will reset the preferences that have been removed completely from the arkenfox user.js.
Last updated: 12-April-2020
Last updated: 14-Sept-2020
For instructions see:
https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
https://github.com/arkenfox/user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
***/
(function() {
let ops = [
/* removed in ghacks user.js v52-57 */
/* removed in arkenfox user.js v52-57 */
/* 52-alpha */
'browser.search.reset.enabled',
'browser.search.reset.whitelist',
@ -221,6 +221,8 @@
/* 75-beta */
'browser.search.geoip.url',
'browser.search.region',
/* 79-beta */
'browser.urlbar.usepreloadedtopurls.enabled',
/* reset parrot: check your open about:config after running the script */
'_user.js.parrot'
]

View File

@ -1,5 +1,5 @@
/*** ghacks-user.js troubleshooter.js v1.6.1 ***/
/*** arkenfox user.js troubleshooter.js v1.6.1 ***/
(function() {

View File

@ -1,12 +1,12 @@
@ECHO OFF & SETLOCAL EnableDelayedExpansion
TITLE ghacks user.js updater
TITLE arkenfox user.js updater
REM ## ghacks-user.js updater for Windows
REM ## arkenfox user.js updater for Windows
REM ## author: @claustromaniac
REM ## version: 4.10
REM ## instructions: https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.3-Updater-Scripts
REM ## version: 4.12
REM ## instructions: https://github.com/arkenfox/user.js/wiki/3.3-Updater-Scripts
SET v=4.10
SET v=4.12
VERIFY ON
CD /D "%~dp0"
@ -52,7 +52,7 @@ IF DEFINED _updateb (
REM Uncomment the next line and comment out the PowerShell call for testing.
REM COPY /B /Y "!_myname!.bat" "[updated]!_myname!.bat" >nul
(
PowerShell -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/updater.bat', '[updated]!_myname!.bat')"
PowerShell -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/arkenfox/user.js/master/updater.bat', '[updated]!_myname!.bat')"
) >nul 2>&1
IF EXIST "[updated]!_myname!.bat" (
START /min CMD /C "[updated]!_myname!.bat" !_myparams!
@ -100,7 +100,10 @@ IF NOT EXIST user.js (
)
:exitloop
IF NOT "!_name!"=="" (
IF /I NOT "!_name!"=="!_name:ghacks=!" (
SET "_tempvar="
IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1
IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1
IF !_tempvar! EQU 1 (
CALL :message "!_name! !_version:~2!,!_date!"
) ELSE (CALL :message "Current user.js version not recognised.")
) ELSE (CALL :message "Current user.js version not recognised.")
@ -108,7 +111,7 @@ IF NOT EXIST user.js (
ECHO:
IF NOT DEFINED _ua (
CALL :message "This batch should be run from your Firefox profile directory."
ECHO: It will download the latest version of ghacks user.js from github and then
ECHO: It will download the latest version of arkenfox user.js from github and then
CALL :message "append any of your own changes from user-overrides.js to it."
CALL :message "Visit the wiki for more detailed information."
ECHO:
@ -130,16 +133,16 @@ IF DEFINED _log (
IF EXIST user.js.new (DEL /F "user.js.new")
CALL :message "Retrieving latest user.js file from github repository..."
(
PowerShell -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/user.js', 'user.js.new')"
PowerShell -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/arkenfox/user.js/master/user.js', 'user.js.new')"
) >nul 2>&1
IF EXIST user.js.new (
IF DEFINED _rfpalts (
CALL :message "Activating RFP Alternatives section..."
CALL :activate user.js.new "[SETUP-non-RFP]"
)
IF DEFINED _esr (
CALL :message "Activating ESR section..."
CALL :activate user.js.new ".x still uses all the following prefs"
)
IF DEFINED _esr (
CALL :message "Activating ESR section..."
CALL :activate user.js.new ".x still uses all the following prefs"
)
IF DEFINED _multi (
FORFILES /P user.js-overrides /M *.js >nul 2>&1
@ -216,8 +219,8 @@ ENDLOCAL
GOTO :EOF
::::::::::::::: Activate Section :::::::::::::::
:activate
:: arg1 = file
:activate
:: arg1 = file
:: arg2 = line substring
SETLOCAL DisableDelayedExpansion
(

View File

@ -1,8 +1,8 @@
#!/usr/bin/env bash
## ghacks-user.js updater for macOS and Linux
## arkenfox user.js updater for macOS and Linux
## version: 2.6
## version: 2.8
## Author: Pat Johnson (@overdodactyl)
## Additional contributors: @earthlng, @ema-pe, @claustromaniac
@ -11,7 +11,7 @@
readonly CURRDIR=$(pwd)
sfp=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null)
if [ -z "$sfp" ]; then sfp=${BASH_SOURCE[0]}; fi
[ -z "$sfp" ] && sfp=${BASH_SOURCE[0]}
readonly SCRIPT_DIR=$(dirname "${sfp}")
@ -42,27 +42,27 @@ ESR=false
# Download method priority: curl -> wget
DOWNLOAD_METHOD=''
if [[ $(command -v 'curl') ]]; then
DOWNLOAD_METHOD='curl'
DOWNLOAD_METHOD='curl --max-redirs 3 -so'
elif [[ $(command -v 'wget') ]]; then
DOWNLOAD_METHOD='wget'
DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O'
else
echo -e "${RED}This script requires curl or wget.\nProcess aborted${NC}"
exit 0
exit 1
fi
show_banner () {
echo -e "${BBLUE}\n"
echo ' ############################################################################'
echo ' #### ####'
echo ' #### ghacks user.js ####'
echo ' #### Hardening the Privacy and Security Settings of Firefox ####'
echo ' #### Maintained by @Thorin-Oakenpants and @earthlng ####'
echo ' #### Updater for macOS and Linux by @overdodactyl ####'
echo ' #### ####'
echo ' ############################################################################'
echo -e "${BBLUE}
############################################################################
#### ####
#### arkenfox user.js ####
#### Hardening the Privacy and Security Settings of Firefox ####
#### Maintained by @Thorin-Oakenpants and @earthlng ####
#### Updater for macOS and Linux by @overdodactyl ####
#### ####
############################################################################"
echo -e "${NC}\n"
echo -e "Documentation for this script is available here: ${CYAN}https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.3-Updater-Scripts${NC}\n"
echo -e "Documentation for this script is available here: ${CYAN}https://github.com/arkenfox/user.js/wiki/3.3-Updater-Scripts${NC}\n"
}
#########################
@ -70,66 +70,50 @@ show_banner () {
#########################
usage() {
echo -e "${BLUE}\nUsage: $0 [-h] [-p PROFILE] [-u] [-d] [-s] [-n] [-b] [-c] [-v] [-r] [-e] [-o OVERRIDE]\n${NC}" 1>&2 # Echo usage string to standard error
echo 'Optional Arguments:'
echo -e "\t-h,\t\t Show this help message and exit."
echo -e "\t-p PROFILE,\t Path to your Firefox profile (if different than the dir of this script)"
echo -e "\t\t\t IMPORTANT: if the path include spaces, wrap the entire argument in quotes."
echo -e "\t-l, \t\t Choose your Firefox profile from a list"
echo -e "\t-u,\t\t Update updater.sh and execute silently. Do not seek confirmation."
echo -e "\t-d,\t\t Do not look for updates to updater.sh."
echo -e "\t-s,\t\t Silently update user.js. Do not seek confirmation."
echo -e "\t-b,\t\t Only keep one backup of each file."
echo -e "\t-c,\t\t Create a diff file comparing old and new user.js within userjs_diffs. "
echo -e "\t-o OVERRIDE,\t Filename or path to overrides file (if different than user-overrides.js)."
echo -e "\t\t\t If used with -p, paths should be relative to PROFILE or absolute paths"
echo -e "\t\t\t If given a directory, all files inside will be appended recursively."
echo -e "\t\t\t You can pass multiple files or directories by passing a comma separated list."
echo -e "\t\t\t\t Note: If a directory is given, only files inside ending in the extension .js are appended"
echo -e "\t\t\t\t IMPORTANT: do not add spaces between files/paths. Ex: -o file1.js,file2.js,dir1"
echo -e "\t\t\t\t IMPORTANT: if any files/paths include spaces, wrap the entire argument in quotes."
echo -e "\t\t\t\t\t Ex: -o \"override folder\" "
echo -e "\t-n,\t\t Do not append any overrides, even if user-overrides.js exists."
echo -e "\t-v,\t\t Open the resulting user.js file."
echo -e "\t-r,\t\t Only download user.js to a temporary file and open it."
echo -e "\t-e,\t\t Activate ESR related preferences."
echo -e
echo 'Deprecated Arguments (they still work for now):'
echo -e "\t-donotupdate,\t Use instead -d"
echo -e "\t-update,\t Use instead -u"
echo -e
echo
echo -e "${BLUE}Usage: $0 [-bcdehlnrsuv] [-p PROFILE] [-o OVERRIDE]${NC}" 1>&2 # Echo usage string to standard error
echo -e "
Optional Arguments:
-h Show this help message and exit.
-p PROFILE Path to your Firefox profile (if different than the dir of this script)
IMPORTANT: If the path contains spaces, wrap the entire argument in quotes.
-l Choose your Firefox profile from a list
-u Update updater.sh and execute silently. Do not seek confirmation.
-d Do not look for updates to updater.sh.
-s Silently update user.js. Do not seek confirmation.
-b Only keep one backup of each file.
-c Create a diff file comparing old and new user.js within userjs_diffs.
-o OVERRIDE Filename or path to overrides file (if different than user-overrides.js).
If used with -p, paths should be relative to PROFILE or absolute paths
If given a directory, all files inside will be appended recursively.
You can pass multiple files or directories by passing a comma separated list.
Note: If a directory is given, only files inside ending in the extension .js are appended
IMPORTANT: Do not add spaces between files/paths. Ex: -o file1.js,file2.js,dir1
IMPORTANT: If any file/path contains spaces, wrap the entire argument in quotes.
Ex: -o \"override folder\"
-n Do not append any overrides, even if user-overrides.js exists.
-v Open the resulting user.js file.
-r Only download user.js to a temporary file and open it.
-e Activate ESR related preferences."
echo
exit 1
}
legacy_argument () {
echo -e "${ORANGE}\nWarning: command line arguments have changed."
echo -e "$1 has been deprecated and may not work in the future.\n"
echo -e "Please view the new options using the -h argument.${NC}"
}
#########################
# File Handling #
#########################
# Download files
download_file () {
declare -r url=$1
download_file () { # expects URL as argument ($1)
declare -r tf=$(mktemp)
local dlcmd=''
if [ $DOWNLOAD_METHOD = 'curl' ]; then
dlcmd="curl -o $tf"
else
dlcmd="wget -O $tf"
fi
$dlcmd "${url}" &>/dev/null && echo "$tf" || echo '' # return the temp-filename (or empty string on error)
$DOWNLOAD_METHOD "${tf}" "$1" && echo "$tf" || echo '' # return the temp-filename or empty string on error
}
open_file () { #expects one argument: file_path
open_file () { # expects one argument: file_path
if [ "$(uname)" == 'Darwin' ]; then
open "$1"
elif [ "$(expr substr $(uname -s) 1 5)" == "Linux" ]; then
elif [ "$(uname -s | cut -c -5)" == "Linux" ]; then
xdg-open "$1"
else
echo -e "${RED}Error: Sorry, opening files is not supported for your OS.${NC}"
@ -204,23 +188,22 @@ get_updater_version () {
# Update updater.sh
# Default: Check for update, if available, ask user if they want to execute it
# Args:
# -donotupdate: New version will not be looked for and update will not occur
# -update: Check for update, if available, execute without asking
# -d: New version will not be looked for and update will not occur
# -u: Check for update, if available, execute without asking
update_updater () {
if [ $UPDATE = 'no' ]; then
return 0 # User signified not to check for updates
fi
declare -r tmpfile=$(download_file 'https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/updater.sh')
declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh')"
[ -z "${tmpfile}" ] && echo -e "${RED}Error! Could not download updater.sh${NC}" && return 1 # check if download failed
if [[ $(get_updater_version "${SCRIPT_DIR}/updater.sh") < $(get_updater_version "${tmpfile}") ]]; then
if [ $UPDATE = 'check' ]; then
echo -e "There is a newer version of updater.sh available. ${RED}Update and execute Y/N?${NC}"
read -p "" -n 1 -r
echo -e "\n\n"
if [[ $REPLY =~ ^[Nn]$ ]]; then
return 0 # Update available, but user chooses not to update
fi
[[ $REPLY =~ ^[Nn]$ ]] && return 0 # Update available, but user chooses not to update
fi
else
return 0 # No update available
@ -228,7 +211,7 @@ update_updater () {
mv "${tmpfile}" "${SCRIPT_DIR}/updater.sh"
chmod u+x "${SCRIPT_DIR}/updater.sh"
"${SCRIPT_DIR}/updater.sh" "$@" -d
exit 1
exit 0
}
@ -238,11 +221,7 @@ update_updater () {
# Returns version number of a user.js file
get_userjs_version () {
if [ -e $1 ]; then
echo "$(sed -n '4p' "$1")"
else
echo "Not detected."
fi
[ -e $1 ] && echo "$(sed -n '4p' "$1")" || echo "Not detected."
}
add_override () {
@ -252,7 +231,7 @@ add_override () {
cat "$input" >> user.js
echo -e "Status: ${GREEN}Override file appended:${NC} ${input}"
elif [ -d "$input" ]; then
FSAVEIFS=$IFS
SAVEIFS=$IFS
IFS=$'\n\b' # Set IFS
FILES="${input}"/*.js
for f in $FILES
@ -271,12 +250,13 @@ remove_comments () { # expects 2 arguments: from-file and to-file
# Applies latest version of user.js and any custom overrides
update_userjs () {
declare -r newfile=$(download_file 'https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/user.js')
declare -r newfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')"
[ -z "${newfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && return 1 # check if download failed
echo 'Please observe the following information:'
echo -e "\tFirefox profile: ${ORANGE}$(pwd)${NC}"
echo -e "\tAvailable online: ${ORANGE}$(get_userjs_version $newfile)${NC}"
echo -e "\tCurrently using: ${ORANGE}$(get_userjs_version user.js)\n${NC}\n"
echo -e "Please observe the following information:
Firefox profile: ${ORANGE}$(pwd)${NC}
Available online: ${ORANGE}$(get_userjs_version $newfile)${NC}
Currently using: ${ORANGE}$(get_userjs_version user.js)${NC}\n\n"
if [ $CONFIRM = 'yes' ]; then
echo -e "This script will update to the latest user.js file and append any custom configurations from user-overrides.js. ${RED}Continue Y/N? ${NC}"
@ -298,9 +278,7 @@ update_userjs () {
# backup user.js
mkdir -p userjs_backups
local bakname="userjs_backups/user.js.backup.$(date +"%Y-%m-%d_%H%M")"
if [ $BACKUP = 'single' ]; then
bakname='userjs_backups/user.js.backup'
fi
[ $BACKUP = 'single' ] && bakname='userjs_backups/user.js.backup'
cp user.js "$bakname" &>/dev/null
mv "${newfile}" user.js
@ -336,14 +314,12 @@ update_userjs () {
echo -e "Status: ${GREEN}A diff file was created:${NC} ${PWD}/${diffname}"
else
echo -e "Warning: ${ORANGE}Your new user.js file appears to be identical. No diff file was created.${NC}"
if [ $BACKUP = 'multiple' ]; then
rm $bakname &>/dev/null
fi
[ $BACKUP = 'multiple' ] && rm $bakname &>/dev/null
fi
rm $past_nocomments $current_nocomments $pastuserjs &>/dev/null
fi
if [ "$VIEW" = true ]; then open_file "${PWD}/user.js"; fi
[ "$VIEW" = true ] && open_file "${PWD}/user.js"
}
#########################
@ -351,16 +327,9 @@ update_userjs () {
#########################
if [ $# != 0 ]; then
readonly legacy_lc=$(echo $1 | tr '[A-Z]' '[a-z]')
# Display usage if first argument is -help or --help
if [ $1 = '--help' ] || [ $1 = '-help' ]; then
usage
elif [ $legacy_lc = '-donotupdate' ]; then
UPDATE='no'
legacy_argument $1
elif [ $legacy_lc = '-update' ]; then
UPDATE='yes'
legacy_argument $1
else
while getopts ":hp:ludsno:bcvre" opt; do
case $opt in
@ -401,11 +370,12 @@ if [ $# != 0 ]; then
ESR=true
;;
r)
tfile=$(download_file 'https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/user.js')
tfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')"
[ -z "${tfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && exit 1 # check if download failed
mv $tfile "${tfile}.js"
echo -e "${ORANGE}Warning: user.js was saved to temporary file ${tfile}.js${NC}"
open_file "${tfile}.js"
exit 1
exit 0
;;
\?)
echo -e "${RED}\n Error! Invalid option: -$OPTARG${NC}" >&2
@ -413,7 +383,7 @@ if [ $# != 0 ]; then
;;
:)
echo -e "${RED}Error! Option -$OPTARG requires an argument.${NC}" >&2
exit 1
exit 2
;;
esac
done

235
user.js
View File

@ -1,23 +1,22 @@
/******
* name: ghacks user.js
* date: 20 Jul 2020
* version 78-beta
* authors: v52+ github | v51- www.ghacks.net
* url: https://github.com/ghacksuserjs/ghacks-user.js
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
* name: arkenfox user.js
* date: 23 Sep 2020
* version 81-beta
* url: https://github.com/arkenfox/user.js
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt
* releases: These are end-of-stable-life-cycle legacy archives.
*Always* use the master branch user.js for a current up-to-date version
url: https://github.com/ghacksuserjs/ghacks-user.js/releases
url: https://github.com/arkenfox/user.js/releases
* README:
0. Consider using Tor Browser if it meets your needs or fits your threat model better
* https://www.torproject.org/about/torusers.html.en
1. READ the full README
* https://github.com/ghacksuserjs/ghacks-user.js/blob/master/README.md
* https://github.com/arkenfox/user.js/blob/master/README.md
2. READ this
* https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation
* https://github.com/arkenfox/user.js/wiki/1.3-Implementation
3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum
* Real time binary checks with Google services are disabled (0412)
* You will still get prompts to update Firefox, but auto-installing them is disabled (0302a)
@ -39,7 +38,7 @@
[SETUP-HARDEN] maybe you should consider using the Tor Browser
* [WARNING] tags are extra special and used sparingly, so heed them
4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile)
5. KEEP UP TO DATE: https://github.com/ghacksuserjs/ghacks-user.js/wiki#small_orange_diamond-maintenance
5. KEEP UP TO DATE: https://github.com/arkenfox/user.js/wiki#small_orange_diamond-maintenance
* INDEX:
@ -117,7 +116,7 @@ user_pref("browser.newtabpage.activity-stream.telemetry", false);
* Runs code received from a server (aka Remote Code Execution) and sends information back to a metrics server
* [1] https://abouthome-snippets-service.readthedocs.io/ ***/
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{}");
/* 0105c: disable Activity Stream Top Stories, Pocket-based and/or sponsored content ***/
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
@ -165,6 +164,13 @@ user_pref("geo.provider.use_gpsd", false); // [LINUX]
* i.e. ignore all of Mozilla's various search engines in multiple locales ***/
user_pref("browser.search.geoSpecificDefaults", false);
user_pref("browser.search.geoSpecificDefaults.url", "");
/* 0207: disable region updates
* [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
user_pref("browser.region.network.url", ""); // [FF78+]
user_pref("browser.region.update.enabled", false); // [[FF79+]
/* 0208: set search region
* [NOTE] May not be hidden if Firefox has changed your settings due to your region (see 0207) ***/
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
/** LANGUAGE / LOCALE ***/
/* 0210: set preferred language for displaying web pages
@ -175,13 +181,6 @@ user_pref("intl.accept_languages", "en-US, en");
* [1] https://bugzilla.mozilla.org/867501
* [2] https://bugzilla.mozilla.org/1629630 ***/
user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
/* 0212: enforce fallback text encoding to match en-US
* When the content or server doesn't declare a charset the browser will
* fallback to the "Current locale" based on your application language
* [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-)
* [TEST] https://hsivonen.com/test/moz/check-charset.htm
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 ***/
user_pref("intl.charset.fallback.override", "windows-1252");
/*** [SECTION 0300]: QUIET FOX
Starting in user.js v67, we only disable the auto-INSTALL of Firefox. You still get prompts
@ -207,8 +206,7 @@ user_pref("app.update.auto", false);
* when false, extension detail tabs will have no description ***/
// user_pref("extensions.getAddons.cache.enabled", false);
/* 0308: disable search engine updates (e.g. OpenSearch)
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines
* [SETTING] General>Firefox Updates>Automatically update search engines (FF72-) ***/
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines ***/
user_pref("browser.search.update", false);
/* 0309: disable sending Flash crash reports ***/
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
@ -347,17 +345,14 @@ user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
* Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/
user_pref("browser.ping-centre.telemetry", false);
/* 0515: disable Screenshots
* alternatively in FF60+, disable uploading to the Screenshots server
* [1] https://github.com/mozilla-services/screenshots
* [2] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/ ***/
* alternatively in FF60+, disable uploading to the Screenshots server ***/
// user_pref("extensions.screenshots.disabled", true); // [FF55+]
// user_pref("extensions.screenshots.upload-disabled", true); // [FF60+]
/* 0517: disable Form Autofill
* [NOTE] Stored data is NOT secure (uses a JSON file)
* [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses (FF74+)
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill
* [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
user_pref("extensions.formautofill.available", "off"); // [FF56+]
user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
@ -372,33 +367,31 @@ user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
* [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
user_pref("network.prefetch-next", false);
/* 0602: disable DNS prefetching
* [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/
* [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
* [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
user_pref("network.dns.disablePrefetch", true);
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF ESR] [DEFAULT: true FF70+]
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true FF70+]
/* 0603: disable predictor / prefetching ***/
user_pref("network.predictor.enabled", false);
user_pref("network.predictor.enable-prefetch", false); // [FF48+]
/* 0605: disable link-mouseover opening connection to linked server
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests
* [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
user_pref("network.http.speculative-parallel-limit", 0);
/* 0606: disable "Hyperlink Auditing" (click tracking) and enforce same host in case
/* 0606: enforce no "Hyperlink Auditing" (click tracking)
* [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
user_pref("browser.send_pings", false); // [DEFAULT: false]
user_pref("browser.send_pings.require_same_host", true);
user_pref("browser.send_pings.require_same_host", true); // defense-in-depth
/*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/
user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
/* 0701: disable IPv6
* IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
* with VPNs. That's even assuming your ISP and/or router and/or website can handle it.
* IPv6 can be abused, especially with MAC addresses, and they do not play nice with VPNs. That's
* even assuming your ISP and/or router and/or website can handle it. Sites will fall back to IPv4
* [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6
* [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
* then this won't make much difference. If you are masking your IP, then it can only help.
* [TEST] https://ipleak.org/
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626
* [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626
* [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/
user_pref("network.dns.disableIPv6", true);
/* 0702: disable HTTP2
@ -429,7 +422,7 @@ user_pref("network.http.altsvc.oe", false);
* [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
user_pref("network.proxy.socks_remote_dns", true);
/* 0708: disable FTP [FF60+]
* [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/
* [1] https://www.fxsitecompat.dev/en-CA/docs/2020/ftp-support-will-be-removed/ ***/
// user_pref("network.ftp.enabled", false);
/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
* [SETUP-CHROME] Can break extensions for profiles on network shares
@ -444,11 +437,6 @@ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
* [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]
/*** [SECTION 0709]: HOTFIX for FF77, FIXED in FF78 ***/
/* 0709: disabling UNC can cause extension storage to fail
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/923 ***/
user_pref("network.file.disable_unc_paths", false); // [HIDDEN PREF]
/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
Change items 0850 and above to suit for privacy vs convenience and functionality. Consider
your environment (no unwanted eyeballs), your device (restricted access), your device's
@ -490,9 +478,6 @@ user_pref("layout.css.visited_links_enabled", false);
* [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);
/* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
* [1] https://bugzilla.mozilla.org/1211726 ***/
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
/* 0810: disable location bar making speculative connections [FF56+]
* [1] https://bugzilla.mozilla.org/1348275 ***/
user_pref("browser.urlbar.speculativeConnect.enabled", false);
@ -519,7 +504,7 @@ user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
* [1] https://support.mozilla.org/en-US/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/
// user_pref("browser.urlbar.autoFill", false);
/* 0860: disable search and form history
* [SETUP-WEB] Be aware thet autocomplete form data can be read by third parties, see [1] [2]
* [SETUP-WEB] Be aware that autocomplete form data can be read by third parties, see [1] [2]
* [NOTE] We also clear formdata on exit (see 2803)
* [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
* [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html
@ -543,20 +528,21 @@ user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
* [NOTE] This does not clear any passwords already saved
* [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/
// user_pref("signon.rememberSignons", false);
/* 0902: use a master password
/* 0902: use a primary password
* There are no preferences for this. It is all handled internally.
* [SETTING] Privacy & Security>Logins and Passwords>Use a master password
* [1] https://support.mozilla.org/kb/use-master-password-protect-stored-logins ***/
/* 0903: set how often Firefox should ask for the master password
* [SETTING] Privacy & Security>Logins and Passwords>Use a Primary Password
* [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas ***/
/* 0903: set how often Firefox should ask for the primary password
* 0=the first time (default), 1=every time it's needed, 2=every n minutes (see 0904) ***/
user_pref("security.ask_for_password", 2);
/* 0904: set how often in minutes Firefox should ask for the master password (see 0903)
/* 0904: set how often in minutes Firefox should ask for the primary password (see 0903)
* in minutes, default is 30 ***/
user_pref("security.password_lifetime", 5);
/* 0905: disable auto-filling username & password form fields
* can leak in cross-site forms *and* be spoofed
* [NOTE] Username & password is still available when you enter the field
* [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords ***/
* [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords
* [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/
user_pref("signon.autofillForms", false);
/* 0909: disable formless login capture for Password Manager [FF51+] ***/
user_pref("signon.formlessCapture.enabled", false);
@ -582,7 +568,7 @@ user_pref("network.auth.subresource-http-auth-allow", 1);
[2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
[3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
[4] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
[5] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
[5] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor
***/
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
/** CACHE ***/
@ -592,17 +578,18 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m
* [NOTE] We also clear cache on exiting Firefox (see 2803) ***/
user_pref("browser.cache.disk.enable", false);
/* 1003: disable memory cache
/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/
* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
// user_pref("browser.cache.memory.enable", false);
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR]
// user_pref("browser.cache.memory.capacity", 0);
/* 1006: disable permissions manager from writing to disk [RESTART]
* [NOTE] This means any permission changes are session only
* [1] https://bugzilla.mozilla.org/967812 ***/
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
/* 1007: disable media cache from writing to disk in Private Browsing
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB */
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB
* [SETUP-WEB] ESR78: playback might break on subsequent loading (1650281) ***/
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
user_pref("media.memory_cache_max_size", 16384);
user_pref("media.memory_cache_max_size", 65536);
/** SESSIONS & SESSION RESTORE ***/
/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
@ -739,7 +726,7 @@ user_pref("security.family_safety.mode", 0);
user_pref("security.cert_pinning.enforcement_level", 2);
/** MIXED CONTENT ***/
/* 1240: disable insecure active content on https pages
/* 1240: enforce no insecure active content on https pages
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
@ -747,10 +734,15 @@ user_pref("security.mixed_content.block_display_content", true);
/* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+]
* [1] https://bugzilla.mozilla.org/1190623 ***/
user_pref("security.mixed_content.block_object_subrequest", true);
/* 1244: enable https-only-mode [FF76+]
* [NOTE] This is experimental
* [1] https://bugzilla.mozilla.org/1613063 */
/* 1244: enable HTTPS-Only mode [FF76+]
* When "https_only_mode" (all windows) is true, "https_only_mode_pbm" (private windows only) is ignored
* [WARNING] This is experimental, see [1] and you can't set exceptions if FPI is enabled, see [2]
* [SETTING] to add site exceptions: Page Info>Permissions>Use insecure HTTP (FF80+)
* [SETTING] Privacy & Security>HTTPS-Only Mode (FF80+ with browser.preferences.exposeHTTPSOnly = true)
* [1] https://bugzilla.mozilla.org/1613063 [META]
* [2] https://bugzilla.mozilla.org/1647829 ***/
// user_pref("dom.security.https_only_mode", true); // [FF76+]
// user_pref("dom.security.https_only_mode_pbm", true); // [FF80+]
// user_pref("dom.security.https_only_mode.upgrade_local", true); // [FF77+]
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro]
@ -795,7 +787,7 @@ user_pref("browser.ssl_override_behavior", 1);
* [TEST] https://expired.badssl.com/ ***/
user_pref("browser.xul.error_pages.expert_bad_cert", true);
/* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/
user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true FF70+]
// user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true FF70+]
user_pref("security.insecure_connection_text.enabled", true); // [FF60+]
/*** [SECTION 1400]: FONTS ***/
@ -819,9 +811,10 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false);
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
user_pref("gfx.font_rendering.graphite.enabled", false);
/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed
* [NOTE] in FF80 RFP restricts the whitelist to bundled and "Base Fonts"
* ...and in FF81+ the whitelist **overrides** RFP's font visibility (see 4618)
* [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
* Eventually privacy.resistFingerprinting (see 4500) will cover this
* [1] https://bugzilla.mozilla.org/1121643 ***/
// user_pref("font.system.whitelist", ""); // [HIDDEN PREF]
@ -902,8 +895,7 @@ user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies
/* 1803: disable Flash plugin
* 0=deactivated, 1=ask, 2=enabled
* ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash
* [NOTE] You can still override individual sites via site permissions
* [1] https://www.ghacks.net/2013/07/09/how-to-make-sure-that-a-firefox-plugin-never-activates-again/ ***/
* [NOTE] You can still override individual sites via site permissions ***/
user_pref("plugin.state.flash", 0);
/* 1820: disable GMP (Gecko Media Plugins)
* [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
@ -926,7 +918,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
* [1] https://www.privacytools.io/#webrtc ***/
user_pref("media.peerconnection.enabled", false);
/* 2002: limit WebRTC IP leaks if using WebRTC
* In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3])
* In FF70+ these settings match Mode 4 (Mode 3 in older versions), see [3]
* [TEST] https://browserleaks.com/webrtc
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy
@ -967,29 +959,19 @@ user_pref("media.autoplay.blocking_policy", 2);
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
/* 2201: prevent websites from disabling new window features ***/
user_pref("dom.disable_window_open_feature.close", true);
user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.menubar", true);
user_pref("dom.disable_window_open_feature.minimizable", true);
user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar
user_pref("dom.disable_window_open_feature.resizable", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.status", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.titlebar", true);
user_pref("dom.disable_window_open_feature.toolbar", true);
/* 2202: prevent scripts from moving and resizing open windows ***/
user_pref("dom.disable_window_move_resize", true);
/* 2203: open links targeting new windows in a new tab instead
* This stops malicious window sizes and some screen resolution leaks.
* You can still right-click a link and open in a new window.
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
user_pref("browser.link.open_newwindow", 3);
user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab
user_pref("browser.link.open_newwindow.restriction", 0);
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
* [NOTE] You can still manually toggle the browser's fullscreen state (F11),
* but this pref will disable embedded video/game fullscreen controls, e.g. youtube
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen ***/
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/
// user_pref("full-screen-api.enabled", false);
/* 2210: block popup windows
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
@ -1057,9 +1039,8 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!
* [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress
* This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website
* [WARNING] If both 'middlemouse.paste' and 'general.autoScroll' are true (at least one
* is default false) then enabling this pref can leak clipboard content, see [2]
* [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/
* [2] https://bugzilla.mozilla.org/1528289 */
* is default false) then enabling this pref can leak clipboard content, see [1]
* [1] https://bugzilla.mozilla.org/1528289 */
// user_pref("dom.event.clipboardevents.enabled", false);
/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
* this disables document.execCommand("cut"/"copy") to protect your clipboard
@ -1099,7 +1080,7 @@ user_pref("javascript.options.wasm", false);
// user_pref("dom.IntersectionObserver.enabled", false);
/* 2429: enable (limited but sufficient) window.opener protection [FF65+]
* Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF78+]
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
@ -1107,7 +1088,7 @@ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is m
* Initially a Linux issue (high precision readout) that was fixed.
* However, it is still another metric for fingerprinting, used to raise entropy.
* e.g. do you have a battery or not, current charging status, charge level, times remaining etc
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code, see [1]
* [1] https://bugzilla.mozilla.org/1313580 ***/
// user_pref("dom.battery.enabled", false);
/* 2505: disable media device enumeration [FF29+]
@ -1162,15 +1143,14 @@ user_pref("browser.uitour.url", "");
* [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes
* [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
user_pref("devtools.chrome.enabled", false);
/* 2608: disable remote debugging
/* 2608: reset remote debugging to disabled
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
* [TEST] https://arkenfox.github.io/TZP/tzp.html#misc
* [1] https://bugzilla.mozilla.org/1173199 ***/
// user_pref("mathml.disabled", true);
/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+]
* [NOTE] In FF70+ and ESR68.1.0+ this no longer affects extensions (1564208)
* [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile.
* [1] https://bugzilla.mozilla.org/1216893 ***/
// user_pref("svg.disabled", true);
@ -1210,8 +1190,7 @@ user_pref("network.IDN_show_punycode", true);
* CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare)
* [SETTING] General>Applications>Portable Document Format (PDF) ***/
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
* [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/
user_pref("network.protocol-handler.external.ms-windows-store", false);
/* 2622: enforce no system colors; they can be fingerprinted
* [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/
@ -1375,6 +1354,7 @@ user_pref("privacy.cpd.siteSettings", false); // Site Preferences
user_pref("privacy.sanitize.timeSpan", 0);
/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
4001: FPI
** 1278037 - isolate indexedDB (FF51+)
** 1277803 - isolate favicons (FF52+)
** 1264562 - isolate OCSP cache (FF52+)
@ -1393,22 +1373,29 @@ user_pref("privacy.sanitize.timeSpan", 0);
** 1506693 - isolate pdfjs range-based requests (FF68+)
** 1330467 - isolate site permissions (FF69+)
** 1534339 - isolate IPv6 (FF73+)
4003: NETWORK PARTITON
** 1647732 - isolate font cache (FF80+)
** 1649673 - isolate speculative connections (FF80+)
***/
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
/* 4001: enable First Party Isolation [FF51+]
* [SETUP-WEB] May break cross-domain logins and site functionality until perfected
* [1] https://bugzilla.mozilla.org/1260931 ***/
* [1] https://bugzilla.mozilla.org/1260931
* [2] https://bugzilla.mozilla.org/1299996 [META] ***/
user_pref("privacy.firstparty.isolate", true);
/* 4002: enforce FPI restriction for window.opener [FF54+]
* [NOTE] Setting this to false may reduce the breakage in 4001
* FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute, see [2],[3]
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
* [1] https://bugzilla.mozilla.org/1319773#c22
* [2] https://bugzilla.mozilla.org/1492607
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
// user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
// user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR]
// user_pref("privacy.firstparty.isolate.block_post_message", true);
/* 4003: enable site partitioning (FF78+)
* [1] https://bugzilla.mozilla.org/1590107 [META] */
user_pref("privacy.partition.network_state", true);
/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
This master switch will be used for a wide range of items, many of which will
@ -1421,7 +1408,7 @@ user_pref("privacy.firstparty.isolate", true);
[NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at
100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run.
Test your window size, do some math, resize to allow for all the non inner window elements
[TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
[TEST] https://arkenfox.github.io/TZP/tzp.html#screen
** 1281949 - spoof screen orientation (FF50+)
** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044)
@ -1465,17 +1452,18 @@ user_pref("privacy.firstparty.isolate", true);
FF60: Fix keydown/keyup events (1438795)
** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4617) (FF63+)
** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4614) (FF63+)
** 1363508 - spoof/suppress Pointer Events (see 4615) (FF64+)
FF65: pointerEvent.pointerid (1492766)
** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+)
** 1485266 - disable exposure of system colors to CSS or canvas (see 4616) (FF67+)
** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+)
** 1494034 - return "light" with prefers-color-scheme (see 4617) (FF67+)
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
** 1564422 - spoof audioContext outputLatency (FF70+)
** 1595823 - spoof audioContext sampleRate (FF72+)
** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+)
** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+)
** 1653987 - limit font visibility to bundled and "Base Fonts" (see 4618) (non-ANDROID) (FF80+)
***/
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
/* 4501: enable privacy.resistFingerprinting [FF41+]
@ -1594,23 +1582,31 @@ user_pref("media.ondevicechange.enabled", false);
// [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
user_pref("webgl.enable-debug-renderer-info", false);
// * * * /
// FF65+
// 4614: [2516] disable PointerEvents
// FF63+
// 4614: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
// 0=no-preference, 1=reduce
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
// FF64+
// 4615: [2516] disable PointerEvents
// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
user_pref("dom.w3c_pointer_events.enabled", false);
// * * * /
// FF67+
// 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+]
// 4616: [2618] disable exposure of system colors to CSS or canvas [FF44+]
// [NOTE] See second listed bug: may cause black on black for elements with undefined colors
// [SETUP-CHROME] Might affect CSS in themes and extensions
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
user_pref("ui.use_standins_for_native_colors", true);
// 4616: enforce prefers-color-scheme as light [FF67+]
// 4617: enforce prefers-color-scheme as light [FF67+]
// 0=light, 1=dark : This overrides your OS value
user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
// 4617: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
// 0=no-preference, 1=reduce
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
// FF80+
// 4618: limit font visbility (non-ANDROID) [FF79+]
// Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts, see [1]
// 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts
// [NOTE] Bundled fonts are auto-allowed
// [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
user_pref("layout.css.font-visibility.level", 1);
// * * * /
// ***/
@ -1685,11 +1681,24 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
// user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR)
/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
Documentation denoted as [-]. Items deprecated in FF68 or earlier have been archived at [1],
Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1],
which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
[1] https://github.com/arkenfox/user.js/issues/123
***/
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
/* ESR78.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable them
// FF79
// 0212: enforce fallback text encoding to match en-US
// When the content or server doesn't declare a charset the browser will
// fallback to the "Current locale" based on your application language
// [TEST] https://hsivonen.com/test/moz/check-charset.htm
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025
// [-] https://bugzilla.mozilla.org/1603712
user_pref("intl.charset.fallback.override", "windows-1252");
// * * * /
// ***/
/* ESR68.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable them
// FF69
@ -1752,10 +1761,20 @@ user_pref("webgl.disable-extensions", true);
// [2] https://trac.torproject.org/projects/tor/ticket/16931
// [-] https://bugzilla.mozilla.org/1618188
user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
// 2201: prevent websites from disabling new window features
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507375,1660524
user_pref("dom.disable_window_open_feature.close", true);
user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.menubar", true);
user_pref("dom.disable_window_open_feature.minimizable", true);
user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar
user_pref("dom.disable_window_open_feature.resizable", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.status", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.titlebar", true);
user_pref("dom.disable_window_open_feature.toolbar", true);
// * * * /
// FF77
// 0850e: disable location bar one-off searches [FF51+]
// [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/
// [-] https://bugzilla.mozilla.org/1628926
// user_pref("browser.urlbar.oneOffSearches", false);
// 2605: block web content in file processes [FF55+]

Binary file not shown.

Before

Width:  |  Height:  |  Size: 3.3 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 3.1 KiB