install.py: Waterfox compatibility and default to firefox user.js always (#485)

* install.py: Integrate waterfox and default to firefox user.js always

This commit:
- Removes the old --zen switch
- Adds a new --browser/-b switch to specify the browser. Available
  options: firefox, waterfox, zen
- Now defaults to the firefox user.js even if there's new user.js added

* install.py: Remove the redundant --zen flag

.gitattributes

@@ -0,0 +1 @@
+* text=auto

.github/FUNDING.yml

@@ -1,13 +0,0 @@
-# These are supported funding model platforms
-
-github: yokoffing
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: yokoffing
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: yokoffing
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

Fastfox.js

@@ -3,7 +3,7 @@
  * Fastfox                                                                              *
  * "Non ducor duco"                                                                     *
  * priority: speedy browsing                                                            *
- * version: 148                                                                         *
+ * version: 150                                                                         *
  * url: https://github.com/yokoffing/Betterfox                                          *
  ***************************************************************************************/
 
@@ -121,7 +121,7 @@
 // [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1945683
 // [2] https://www.reddit.com/r/firefox/comments/1p58qre/firefox_is_getting_ready_to_make_youtube_fast/
 // [3] https://www.ghacks.net/2025/11/24/these-two-tweaks-should-improve-firefoxs-performance-on-youtube-significantly/
-user_pref("gfx.webrender.layer-compositor", true);
+//user_pref("gfx.webrender.layer-compositor", true);
     // If your PC uses an AMD GPU, you might want to make a second change.
     // This one improves CPU usage on AMD systems.
 //user_pref("media.wmf.zero-copy-nv12-textures-force-enabled", true);

Securefox.js

@@ -3,7 +3,7 @@
  * Securefox                                                                *
  * "Natura non contristatur"                                                *     
  * priority: provide sensible security and privacy                          *
- * version: 148                                                             *
+ * version: 150                                                             *
  * url: https://github.com/yokoffing/Betterfox                              *
  * credit: Most prefs are reproduced and adapted from the arkenfox project  *
  * credit urL: https://github.com/arkenfox/user.js                          *
@@ -690,45 +690,6 @@ user_pref("network.prefetch-next", false);
 //user_pref("network.early-hints.preconnect.enabled", true);
 //user_pref("network.early-hints.preconnect.max_connections", 10); // DEFAULT
 
-// PREF: Network Predictor (NP)
-// When enabled, it trains and uses Firefox's algorithm to preload page resource
-// by tracking past page resources. It uses a local file (history) of needed images,
-// scripts, etc. to request them preemptively when navigating.
-// [NOTE] By default, it only preconnects DNS, TCP, and SSL handshakes.
-// No data sends until clicking. With "network.predictor.enable-prefetch" enabled,
-// it also performs prefetches.
-// [1] https://wiki.mozilla.org/Privacy/Reviews/Necko
-// [2] https://www.ghacks.net/2014/05/11/seer-disable-firefox/
-// [3] https://github.com/dillbyrne/random-agent-spoofer/issues/238#issuecomment-110214518
-// [4] https://www.igvita.com/posa/high-performance-networking-in-google-chrome/#predictor
-//user_pref("network.predictor.enabled", false); // [DEFAULT: false FF144+]
-
-// PREF: Network Predictor fetch for resources ahead of time
-// Prefetch page resources based on past user behavior.
-//user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false]
-
-// PREF: make Network Predictor active when hovering over links
-// When hovering over links, Network Predictor uses past resource history to
-// preemptively request what will likely be needed instead of waiting for the document.
-// Predictive connections automatically open when hovering over links to speed up
-// loading, starting some work in advance.
-//user_pref("network.predictor.enable-hover-on-ssl", false); // DEFAULT
-
-// PREF: assign Network Predictor confidence levels
-// [NOTE] Keep in mind that Network Predictor must LEARN your browsing habits.
-// Editing these lower will cause more speculative connections to occur,
-// which reduces accuracy over time and has privacy implications.
-//user_pref("network.predictor.preresolve-min-confidence", 60); // DEFAULT
-//user_pref("network.predictor.preconnect-min-confidence", 90); // DEFAULT
-//user_pref("network.predictor.prefetch-min-confidence", 100); // DEFAULT
-
-// PREF: other Network Predictor values
-// [NOTE] Keep in mmind that Network Predictor must LEARN your browsing habits.
-//user_pref("network.predictor.prefetch-force-valid-for", 10); // DEFAULT; how long prefetched resources are considered valid and usable (in seconds) for the prediction modeling
-//user_pref("network.predictor.prefetch-rolling-load-count", 10); // DEFAULT; the maximum number of resources that Firefox will prefetch in memory at one time based on prediction modeling
-//user_pref("network.predictor.max-resources-per-entry", 250); // default=100
-//user_pref("network.predictor.max-uri-length", 1000); // default=500
-
 /******************************************************************************
  * SECTION: SEARCH / URL BAR                                                 *
 ******************************************************************************/
@@ -1106,7 +1067,11 @@ user_pref("editor.truncate_user_pastes", false);
 
 // PREF: disable automatic authentication on Microsoft sites [WINDOWS]
 // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1695693,1719301
-//user_pref("network.http.windows-sso.enabled", false);
+//user_pref("network.http.windows-sso.enabled", false); // DEFAULT
+
+// PREF: enforce no direct attestation in passkeys [FF144+]
+// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1981587 ***/
+//user_pref("security.webauthn.always_allow_direct_attestation", false); // [DEFAULT: false]
 
 /****************************************************************************
  * SECTION: ADDRESS + CREDIT CARD MANAGER                                   *
@@ -1294,7 +1259,7 @@ user_pref("privacy.userContext.ui.enabled", true);
     //user_pref("browser.eme.ui.enabled", false);
 
 /******************************************************************************
- * SECTION: JIT                                                              *
+ * SECTION: JIT & WASM                                                        *
 ******************************************************************************/
 // PREF: Just-In-Time Compilation
 // Around half of zero-day exploits are directly related to "just in time"
@@ -1303,8 +1268,7 @@ user_pref("privacy.userContext.ui.enabled", true);
 // [1] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/
 // [2] https://www.youtube.com/watch?v=i7qlZeDt9o4
 
-// PREF: JavaScript JIT
+// PREF: Ion and Baseline JIT
-// PREF: disable Ion and baseline JIT to harden against JS exploits
 // [NOTE] When both Ion and JIT are disabled, and trustedprincipals
 // is enabled, then Ion can still be used by extensions [4].
 // Tor Browser doesn't even ship with these disabled by default.
@@ -1314,31 +1278,40 @@ user_pref("privacy.userContext.ui.enabled", true);
 // [4] https://bugzilla.mozilla.org/show_bug.cgi?id=1599226
 // [5] https://wiki.mozilla.org/IonMonkey
 // [6] https://github.com/arkenfox/user.js/issues/1791#issuecomment-1891273681
-//user_pref("javascript.options.baselinejit", false);
+//user_pref("javascript.options.baselinejit", false); // DO NOT TOUCH
 //user_pref("javascript.options.ion", false);
-//user_pref("javascript.options.jit_trustedprincipals", false);
+//user_pref("javascript.options.jit_trustedprincipals", true); // HIDDEN PREF
+
+// PREF: Blinterp (JIT-like)
+// You do not need to touch blinterp unless you want to go even slower
+// than the Baseline JIT (which I do not recommend).
+//user_pref("javascript.options.blinterp", false);
 
 // PREF: WebAssembly JIT [FF52+]
 // Vulnerabilities [1] have increasingly been found, including those known and fixed
 // in native programs years ago [2]. WASM has powerful low-level access, making
 // certain attacks (brute-force) and vulnerabilities more possible.
+// trustedprincipals: This controls whether WebAssembly is allowed in "privileged" contexts
+// (like your extensions or internal browser scripts).
 // [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3]
 // [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm
 // [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
 // [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes
 //user_pref("javascript.options.wasm", false);
     //user_pref("javascript.options.wasm_trustedprincipals", false);
-    //user_pref("javascript.options.wasm_baselinejit", false);
+    //user_pref("javascript.options.wasm_baselinejit", true); // DO NOT TOUCH
     //user_pref("javascript.options.wasm_optimizingjit", false);
 
 // PREF: Asm.js JIT [FF22+]
+// Asm.js is essentially the "ancestor" of WebAssembly. It was a strict subset of JavaScript
+// designed to allow browsers to pre-compile code into highly efficient machine instructions.
+// However, WebAssembly was created specifically to replace Asm.js and has done so almost entirely.
+// Disabling Asm.js removes the "legacy" risk surface without affecting your ability to run modern WebAssembly sites.
 // [1] http://asmjs.org/
 // [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
 // [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/
-//user_pref("javascript.options.asmjs", false);
+// [4] https://github.com/rh0dev/slides/blob/master/OffensiveCon2018_From_Assembly_to_JavaScript_and_back.pdf
-
+//user_pref("javascript.options.asmjs", false); // DEFAULT
-// PREF: Blinterp (JIT-like)
-//user_pref("javascript.options.blinterp", false);
      
 /******************************************************************************
  * SECTION: VARIOUS                                                          *
@@ -1389,6 +1362,11 @@ user_pref("pdfjs.enableScripting", false); // [FF86+]
 // [5] https://www.google.com/chrome/privacy/whitepaper.html#malware
 // [6] https://security.googleblog.com/2022/08/how-hash-based-safe-browsing-works-in.html
 
+// [FF147+] Firefox now supports the Safe Browsing V5 protocol and has migrated
+// from Safe Browsing V4 to the local list mode of Safe Browsing V5 protocol.
+// [1] https://developers.google.com/safe-browsing/reference
+// [2] https://developers.google.com/safe-browsing/reference/Local.List.Mode
+
 // PREF: Safe Browsing
 // [WARNING] Be sure to have alternate security measures if you disable SB! Adblockers do not count!
 // [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content
@@ -1654,7 +1632,6 @@ user_pref("browser.tabs.crashReporting.sendReport", false);
 
 // PREF: assorted telemetry
 // [NOTE] Shouldn't be needed for user.js, but browser forks may want to disable these prefs.
-//user_pref("doh-rollout.disable-heuristics", true); // ensure DoH doesn't get enabled automatically
 //user_pref("dom.security.unexpected_system_load_telemetry_enabled", false);
 //user_pref("messaging-system.rsexperimentloader.enabled", false);
 //user_pref("network.trr.confirmation_telemetry_enabled", false);

install.py

@@ -99,7 +99,7 @@ def _get_default_profile_folder(firefox_root):
     print(f"Reading {config_path}...")
 
     config_parser = ConfigParser(strict=False)
-    config_parser.read(config_path)
+    config_parser.read(config_path, encoding = "utf8")
 
     path = None
     for section in config_parser.sections():
@@ -174,12 +174,17 @@ def download_betterfox(url):
 def extract_betterfox(data, profile_folder):
     zipfile = ZipFile(data)
     userjs_zipinfo = None
+    depth = 1 # default to firefox user.js living at root dir
+    if args.browser != "firefox":
+        depth = 2 # ignore the outside
     for file in zipfile.filelist:
-        if "/zen/" in file.filename and not args.zen:
+        path = file.filename.split("/")
+        if len(path)-1 != depth or (args.browser not in path and depth != 1) :
             continue
         if file.filename.endswith("user.js"):
             userjs_zipinfo = file
             userjs_zipinfo.filename = Path(userjs_zipinfo.filename).name
+            break
 
     if not userjs_zipinfo:
         raise BaseException("Could not find user.js!")
@@ -212,18 +217,15 @@ if __name__ == "__main__":
 
     default_profile_folder = _get_default_profile_folder(firefox_root)
 
-    argparser = ArgumentParser(
+    argparser = ArgumentParser()
-
-    )
     argparser.add_argument("--overrides", "-o", default=default_profile_folder.joinpath("user-overrides.js"), help="if the provided file exists, add overrides to user.js. Defaults to " + str(default_profile_folder.joinpath("user-overrides.js"))),
-    argparser.add_argument("--zen", "-z", action="store_true", default=False, help="Install user.js for the Zen browser instead. Defaults to False"),
-    
     
     advanced = argparser.add_argument_group("Advanced")
     advanced.add_argument("--betterfox-version", "-bv", default=None, help=f"Which version of Betterfox to install. Defaults to the latest compatible release for your installed Firefox version")
     advanced.add_argument("--profile-dir", "-p", "-pd", default=default_profile_folder, help=f"Which profile dir to install user.js in. Defaults to {default_profile_folder}")
     advanced.add_argument("--repository-owner", "-ro", default="yokoffing", help="owner of the Betterfox repository. Defaults to yokoffing")
     advanced.add_argument("--repository-name", "-rn", default="Betterfox", help="name of the Betterfox repository. Defaults to Betterfox")
+    advanced.add_argument("--browser", "-b", default="firefox", help="Which browser should Betterfox install to. Defaults to firefox. Available options: firefox, zen, waterfox")
     
     disable = argparser.add_argument_group("Disable functionality")
     disable.add_argument("--no-backup", "-nb", action="store_true", default=False, help="disable backup of current profile (not recommended)"),

personal/user-overrides.js

@@ -20,16 +20,6 @@
 /** FASTFOX ***/
 user_pref("browser.sessionstore.restore_pinned_tabs_on_demand", true);
 
-// SPECULATIVE LOADING WITHOUT PREDICTOR
-user_pref("network.http.speculative-parallel-limit", 20);
-//user_pref("network.dns.disablePrefetch", false);
-//user_pref("network.dns.disablePrefetchFromHTTPS", false);
-//user_pref("dom.prefetch_dns_for_anchor_https_document", true); 
-user_pref("browser.urlbar.speculativeConnect.enabled", true);
-user_pref("browser.places.speculativeConnect.enabled", true);
-user_pref("network.prefetch-next", true);
-user_pref("network.http.max-persistent-connections-per-server", 20); // increase download connections
-
 /** SECUREFOX ***/
 user_pref("privacy.trackingprotection.allow_list.convenience.enabled", false); // disable Strict allowlist of convenience features
 user_pref("signon.rememberSignons", false); // disable password manager
@@ -155,3 +145,58 @@ user_pref("geo.provider.use_geoclue", false); // [LINUX]
 user_pref("pdfjs.defaultZoomValue", "page-width"); // PDF zoom level
 
 
+/** DELETE IF NOT WATERFOX ***/
+// PREF: improve font rendering by using DirectWrite everywhere like Chrome [WINDOWS]
+user_pref("gfx.font_rendering.cleartype_params.rendering_mode", 5);
+user_pref("gfx.font_rendering.cleartype_params.cleartype_level", 100);
+user_pref("gfx.font_rendering.cleartype_params.enhanced_contrast", 100);
+user_pref("gfx.font_rendering.directwrite.use_gdi_table_loading", false);
+
+// UI
+user_pref("browser.urlbar.scotchBonnet.enableOverride", false); // disable unified search button
+user_pref("identity.fxaccounts.enabled", false); // disable Firefox Sync and profiles
+user_pref("browser.profiles.enabled", false); // disable Firefox Sync and profiles
+
+/** FASTFOX ***/
+user_pref("network.http.rcwn.enabled", false);
+//user_pref("network.http.pacing.requests.enabled", false); // pacing requests
+
+user_pref("browser.sessionhistory.max_total_viewers", 4); // default=8
+
+// PREF: adjust DNS expiration time
+// [ABOUT] about:networking#dns
+// [NOTE] These prefs will be ignored by DNS resolver if using DoH/TRR.
+user_pref("network.dnsCacheExpiration", 3600); // keep entries for 1 hour; default=60
+
+user_pref("browser.sessionstore.interval", 900000); // save session every 15 minutes
+
+/** SECUREFOX ***/
+user_pref("signon.rememberSignons", false); // disable password manager
+user_pref("extensions.formautofill.addresses.enabled", false); // disable address manager
+user_pref("extensions.formautofill.creditCards.enabled", false); // disable credit card manager
+user_pref("accessibility.force_disabled", 1); // disable Accessibility features
+user_pref("dom.security.https_only_mode", false); // disable HTTPS Only in normal windows
+user_pref("dom.security.https_only_mode_pbm", true); // HTTPS Only in PB windows
+
+user_pref("media.eme.enabled", false); // disable DRM
+user_pref("browser.eme.ui.enabled", false); // hide the UI setting; this also disables the DRM prompt 
+
+user_pref("network.trr.max-fails", 5); // lower max attempts to use DoH
+
+// PREF: disable using the OS's geolocation service
+//user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
+//user_pref("geo.provider.use_corelocation", false); // [MAC]
+//user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX]
+
+user_pref("privacy.userContext.enabled", false); // disable Container Tabs
+
+/** PESKYFOX ***/
+user_pref("browser.bookmarks.max_backups", 0); // minimize disk use; manually back-up
+user_pref("view_source.wrap_long_lines", true);  // wrap source lines
+user_pref("devtools.debugger.ui.editor-wrapping", true);  // wrap lines in devtools
+user_pref("browser.zoom.full", false); // text-only zoom, not all elements on page
+user_pref("layout.word_select.eat_space_to_next_word", false); // do not select the space next to a word when selecting a word
+user_pref("ui.key.menuAccessKey", 0); // remove underlined characters from various settings
+user_pref("general.autoScroll", false); // disable unintentional behavior for middle click
+user_pref("ui.SpellCheckerUnderlineStyle", 1); // [HIDDEN] dots for spell check errors
+user_pref("reader.parse-on-load.enabled", false); // disable reader mode

policies.json

@@ -6,7 +6,6 @@
         "DisableFirefoxStudies": true,
         "DisableTelemetry": true,
         "DisableFeedbackCommands": true,
-        "DisablePocket": true,
         "DisableSetDesktopBackground": true,
         "DisableDeveloperTools": false,
         "DontCheckDefaultBrowser": true,
@@ -15,6 +14,15 @@
             "ProviderURL": "",
             "Locked": false
         },
+
+        "FirefoxHome": {
+          "SponsoredStories": false,
+          "SponsoredTopSites": false,
+          "Stories": false
+        },
+        "GenerativeAI": {
+          "Enabled": false
+        },
         "ManualAppUpdateOnly": false,
         "ManualAppUpdateOnly_comment": "Change to true to disable auto-updates.",
         "NoDefaultBookmarks": true,
@@ -36,7 +44,8 @@
             "PreventInstalls": false,
             "Remove": [
                 "Amazon.com",
-                "eBay"
+                "eBay",
+                "Perplexity"
             ],
             "Default": "DuckDuckGo",
             "Add": [

user.js

@@ -10,16 +10,10 @@
 /****************************************************************************
  * Betterfox                                                                *
  * "Ad meliora"                                                             *
- * version: 148                                                             *
+ * version: 150                                                             *
  * url: https://github.com/yokoffing/Betterfox                              *
 ****************************************************************************/
 
-/****************************************************************************
- * SECTION: FASTFOX                                                         *
-****************************************************************************/
-user_pref("gfx.canvas.accelerated.cache-size", 256); // reset pref
-user_pref("gfx.webrender.layer-compositor", true);
-
 /****************************************************************************
  * SECTION: SECUREFOX                                                       *
 ****************************************************************************/
@@ -202,6 +196,3 @@ user_pref("layout.word_select.eat_space_to_next_word", false);
 /****************************************************************************
  * END: BETTERFOX                                                           *
 ****************************************************************************/
-
-
-

waterfox/README.md

@@ -0,0 +1,8 @@
+### Betterfox Aqua
+#### A user.js for Waterfox
+Just FYI: There are some long-term issues with Waterfox where the browser doesn't load certain internal settings or resets prefs after restart. For examples, see https://github.com/BrowserWorks/waterfox/issues/3196 and https://github.com/BrowserWorks/waterfox/issues/3947.
+
+> [!IMPORTANT]
+> Fork-specific files are side projects and will not update every release. When in doubt, use the standard Firefox user.js.
+>
+> This is also a reminder that Waterfox is based on the [Firefox ESR](https://support.mozilla.org/kb/firefox-esr-release-cycle) release cycle.

waterfox/user.js

@@ -10,7 +10,7 @@
 /****************************************************************************
  * Betterfox Aqua                                                           *
  * "Ex nihilo nihil fit"                                                    *
- * version: 140.8                                                           *
+ * version: 140.10                                                          *
  * url: https://github.com/yokoffing/Betterfox                              *
 ****************************************************************************/
 
@@ -22,7 +22,7 @@ user_pref("browser.contentblocking.category", "strict");
 user_pref("browser.download.start_downloads_in_tmp_dir", true);
 
 /** OCSP & CERTS / HPKP ***/
-//user_pref("privacy.antitracking.isolateContentScriptResources", true); // needed for next ESR if not a default pref
+user_pref("privacy.antitracking.isolateContentScriptResources", true); // needed for next ESR if not a default pref
 user_pref("security.csp.reporting.enabled", false);
 
 /** DISK AVOIDANCE ***/
@@ -44,6 +44,7 @@ user_pref("browser.places.speculativeConnect.enabled", false);
 user_pref("network.prefetch-next", false);
 
 /** SEARCH / URL BAR ***/
+//user_pref("browser.urlbar.trimURLs", true); // FF default
 //user_pref("browser.urlbar.trimHttps", true); // optional
 //user_pref("browser.urlbar.untrimOnUserInteraction.featureGate", true); // optional
 user_pref("browser.search.suggest.enabled", false);
@@ -101,7 +102,6 @@ user_pref("browser.newtabpage.activity-stream.showSponsoredCheckboxes", false);
 // visit https://github.com/yokoffing/Betterfox/blob/main/Smoothfox.js
 // Enter your scrolling overrides below this line:
 
-
 /****************************************************************************
  * START: MY OVERRIDES                                                      *
 ****************************************************************************/
@@ -109,6 +109,12 @@ user_pref("browser.newtabpage.activity-stream.showSponsoredCheckboxes", false);
 // visit https://github.com/yokoffing/Betterfox/wiki/Optional-Hardening
 // Enter your personal overrides below this line:
 
+/** WATERFOX-SPECIFIC ***/
+user_pref("cookiebanners.service.mode", 0); // project depreciated
+user_pref("cookiebanners.service.mode.privateBrowsing", 0); // project depreciated
+
+//user_pref("waterfox.blocker.ui.enabled", true); // new adblocker option
+//user_pref("waterfox.blocker.enabled", true);
 
 /****************************************************************************
  * END: BETTERFOX                                                           *