|
|
|
@@ -1,8 +1,8 @@
|
|
|
|
|
/******
|
|
|
|
|
* name: ghacks user.js
|
|
|
|
|
* date: 26 June 2019
|
|
|
|
|
* version 67: Barbie Pants
|
|
|
|
|
* "I'm a Barbie pants in a Barbie world. Life in plastic, it's fantastic"
|
|
|
|
|
* date: 4 September 2019
|
|
|
|
|
* version 69-beta: Pants One More Time
|
|
|
|
|
* "When I'm not with pants I lose my mind. Give me a sign. Hit me, pants, one more time."
|
|
|
|
|
* authors: v52+ github | v51- www.ghacks.net
|
|
|
|
|
* url: https://github.com/ghacksuserjs/ghacks-user.js
|
|
|
|
|
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
|
|
|
|
@@ -112,10 +112,8 @@ user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
|
|
|
|
|
/* 0105b: disable Activity Stream Snippets
|
|
|
|
|
* Runs code received from a server (aka Remote Code Execution) and sends information back to a metrics server
|
|
|
|
|
* [1] https://abouthome-snippets-service.readthedocs.io/ ***/
|
|
|
|
|
user_pref("browser.aboutHomeSnippets.updateUrl", "");
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
|
|
|
|
|
/* 0105c: disable Activity Stream Top Stories, Pocket-based and/or sponsored content ***/
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
|
|
|
|
@@ -202,11 +200,6 @@ user_pref("app.update.auto", false);
|
|
|
|
|
* used when installing/updating an extension, and in daily background update checks: if false, it
|
|
|
|
|
* hides the expanded text description (if it exists) when you "show more details about an addon" ***/
|
|
|
|
|
// user_pref("extensions.getAddons.cache.enabled", false);
|
|
|
|
|
/* 0307: disable auto updating of lightweight themes (LWT)
|
|
|
|
|
* Not to be confused with themes in 0301* + 0302*, which use the FF55+ Theme API
|
|
|
|
|
* Mozilla plan to convert existing LWTs and remove LWT support in the future, see [1]
|
|
|
|
|
* [1] https://blog.mozilla.org/addons/2018/09/20/future-themes-here/ ***/
|
|
|
|
|
user_pref("lightweightThemes.update.enabled", false);
|
|
|
|
|
/* 0308: disable search update
|
|
|
|
|
* [SETTING] General>Firefox Updates>Automatically update search engines ***/
|
|
|
|
|
user_pref("browser.search.update", false);
|
|
|
|
@@ -214,9 +207,13 @@ user_pref("browser.search.update", false);
|
|
|
|
|
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
|
|
|
|
|
/* 0310: disable sending the URL of the website where a plugin crashed ***/
|
|
|
|
|
user_pref("dom.ipc.plugins.reportCrashURL", false);
|
|
|
|
|
/* 0320: disable about:addons' Get Add-ons panel (uses Google Analytics) ***/
|
|
|
|
|
/* 0320: disable about:addons' Recommendations pane (uses Google Analytics) ***/
|
|
|
|
|
user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
|
|
|
|
|
user_pref("extensions.webservice.discoverURL", "");
|
|
|
|
|
/* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/
|
|
|
|
|
user_pref("extensions.getAddons.discovery.api_url", "");
|
|
|
|
|
user_pref("extensions.htmlaboutaddons.discover.enabled", false);
|
|
|
|
|
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
|
|
|
|
|
/* 0330: disable telemetry
|
|
|
|
|
* the pref (.unified) affects the behaviour of the pref (.enabled)
|
|
|
|
|
* IF unified=false then .enabled controls the telemetry module
|
|
|
|
@@ -270,9 +267,8 @@ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+
|
|
|
|
|
* [2] https://www.gnu.gl/blog/Posts/multiple-vulnerabilities-in-pocket/ ***/
|
|
|
|
|
user_pref("extensions.pocket.enabled", false);
|
|
|
|
|
/* 0390: disable Captive Portal detection
|
|
|
|
|
* [1] https://en.wikipedia.org/wiki/Captive_portal
|
|
|
|
|
* [2] https://wiki.mozilla.org/Necko/CaptivePortal
|
|
|
|
|
* [3] https://trac.torproject.org/projects/tor/ticket/21790 ***/
|
|
|
|
|
* [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy
|
|
|
|
|
* [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/
|
|
|
|
|
user_pref("captivedetect.canonicalURL", "");
|
|
|
|
|
user_pref("network.captive-portal-service.enabled", false); // [FF52+]
|
|
|
|
|
/* 0391: disable Network Connectivity checks [FF65+]
|
|
|
|
@@ -421,7 +417,8 @@ user_pref("network.http.altsvc.oe", false);
|
|
|
|
|
user_pref("network.proxy.socks_remote_dns", true);
|
|
|
|
|
/* 0707: disable (or setup) DNS-over-HTTPS (DoH) [FF60+]
|
|
|
|
|
* TRR = Trusted Recursive Resolver
|
|
|
|
|
* .mode: 0=off, 1=race, 2=TRR first, 3=TRR only, 4=race for stats but always use native result
|
|
|
|
|
* 0=off, 1=race (removed in FF69), 2=TRR first, 3=TRR only,
|
|
|
|
|
* 4=race for stats but always use native result (removed in FF69)
|
|
|
|
|
* [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare)
|
|
|
|
|
* [1] https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/
|
|
|
|
|
* [2] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ ***/
|
|
|
|
@@ -480,7 +477,7 @@ user_pref("browser.sessionhistory.max_entries", 10);
|
|
|
|
|
/* 0805: disable CSS querying page history - CSS history leak
|
|
|
|
|
* [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's
|
|
|
|
|
* only in 'certain circumstances', also see latest comments in [2]
|
|
|
|
|
* [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX C on how to use)
|
|
|
|
|
* [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX A on how to use)
|
|
|
|
|
* [1] https://dbaron.org/mozilla/visited-privacy
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/147777
|
|
|
|
|
* [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/
|
|
|
|
@@ -527,10 +524,6 @@ user_pref("browser.formfill.enable", false);
|
|
|
|
|
* [NOTE] We also clear history and downloads on exiting Firefox (see 2803)
|
|
|
|
|
* [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/
|
|
|
|
|
// user_pref("places.history.enabled", false);
|
|
|
|
|
/* 0864: disable date/time picker
|
|
|
|
|
* This can leak your locale if not en-US
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/21787 ***/
|
|
|
|
|
user_pref("dom.forms.datetime", false);
|
|
|
|
|
/* 0870: disable Windows jumplist [WINDOWS] ***/
|
|
|
|
|
user_pref("browser.taskbar.lists.enabled", false);
|
|
|
|
|
user_pref("browser.taskbar.lists.frequent.enabled", false);
|
|
|
|
@@ -593,6 +586,7 @@ user_pref("browser.cache.disk.enable", false);
|
|
|
|
|
* [1] http://kb.mozillazine.org/Browser.cache.disk_cache_ssl ***/
|
|
|
|
|
user_pref("browser.cache.disk_cache_ssl", false);
|
|
|
|
|
/* 1003: disable memory cache
|
|
|
|
|
/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes
|
|
|
|
|
* [NOTE] Not recommended due to performance issues ***/
|
|
|
|
|
// user_pref("browser.cache.memory.enable", false);
|
|
|
|
|
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF]
|
|
|
|
@@ -792,8 +786,6 @@ user_pref("browser.display.use_document_fonts", 0);
|
|
|
|
|
/* 1404: disable rendering of SVG OpenType fonts
|
|
|
|
|
* [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/
|
|
|
|
|
user_pref("gfx.font_rendering.opentype_svg.enabled", false);
|
|
|
|
|
/* 1405: disable WOFF2 (Web Open Font Format) [FF35+] ***/
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.woff2.enabled", false);
|
|
|
|
|
/* 1408: disable graphite which FF49 turned back on by default
|
|
|
|
|
* In the past it had security issues. Update: This continues to be the case, see [1]
|
|
|
|
|
* [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 ***/
|
|
|
|
@@ -876,15 +868,11 @@ user_pref("privacy.userContext.enabled", true);
|
|
|
|
|
user_pref("privacy.usercontext.about_newtab_segregation.enabled", true); // [DEFAULT: true in FF61+]
|
|
|
|
|
/* 1704: set behaviour on "+ Tab" button to display container menu [FF53+] [SETUP-CHROME]
|
|
|
|
|
* 0=no menu (default), 1=show when clicked, 2=show on long press
|
|
|
|
|
* [NOTE] The menu does not contain a non-container tab option (use Ctrl+T to open non-container tab)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1328756 ***/
|
|
|
|
|
user_pref("privacy.userContext.longPressBehavior", 2);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 1800]: PLUGINS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!");
|
|
|
|
|
/* 1802: enable click to play and set to 0 minutes ***/
|
|
|
|
|
user_pref("plugins.click_to_play", true);
|
|
|
|
|
user_pref("plugin.sessionPermissionNow.intervalInMinutes", 0);
|
|
|
|
|
/* 1803: disable Flash plugin
|
|
|
|
|
* 0=deactivated, 1=ask, 2=enabled
|
|
|
|
|
* ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash
|
|
|
|
@@ -907,6 +895,8 @@ user_pref("media.eme.enabled", false);
|
|
|
|
|
/*** [SECTION 2000]: MEDIA / CAMERA / MIC ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
|
|
|
|
|
/* 2001: disable WebRTC (Web Real-Time Communication)
|
|
|
|
|
* [SETUP-WEB] WebRTC can leak your IP address from behind your VPN, but if this is not
|
|
|
|
|
* in your threat model, and you want Real-Time Communication, this is the pref for you
|
|
|
|
|
* [1] https://www.privacytools.io/#webrtc ***/
|
|
|
|
|
user_pref("media.peerconnection.enabled", false);
|
|
|
|
|
/* 2002: limit WebRTC IP leaks if using WebRTC
|
|
|
|
@@ -916,6 +906,8 @@ user_pref("media.peerconnection.enabled", false);
|
|
|
|
|
user_pref("media.peerconnection.ice.default_address_only", true);
|
|
|
|
|
user_pref("media.peerconnection.ice.no_host", true); // [FF51+]
|
|
|
|
|
/* 2010: disable WebGL (Web Graphics Library)
|
|
|
|
|
* [SETUP-WEB] When disabled, may break some websites. When enabled, provides high entropy,
|
|
|
|
|
* especially with readPixels(). Some of the other entropy is lessened with RFP (see 4501)
|
|
|
|
|
* [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/
|
|
|
|
|
* [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/
|
|
|
|
|
user_pref("webgl.disabled", true);
|
|
|
|
@@ -936,15 +928,15 @@ user_pref("media.getusermedia.audiocapture.enabled", false);
|
|
|
|
|
// user_pref("permissions.default.camera", 2);
|
|
|
|
|
// user_pref("permissions.default.microphone", 2);
|
|
|
|
|
/* 2030: disable autoplay of HTML5 media [FF63+]
|
|
|
|
|
* 0=Allowed, 1=Blocked (2=Prompt - removed in FF66)
|
|
|
|
|
* 0=Allow all, 1=Block non-muted media (default in FF67+), 2=Prompt (removed in FF66), 5=Block all (FF69+)
|
|
|
|
|
* [NOTE] You can set exceptions under site permissions
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Block websites from automatically playing sound ***/
|
|
|
|
|
user_pref("media.autoplay.default", 1); // [DEFAULT: 1 in FF67+]
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/
|
|
|
|
|
// user_pref("media.autoplay.default", 5);
|
|
|
|
|
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] ***/
|
|
|
|
|
user_pref("media.autoplay.enabled.user-gestures-needed", false);
|
|
|
|
|
/* 2032: disable audio autoplay in non-active tabs [FF51+]
|
|
|
|
|
/* 2032: disable autoplay of HTML5 media in non-active tabs [FF51+]
|
|
|
|
|
* [1] https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ ***/
|
|
|
|
|
user_pref("media.block-autoplay-until-in-foreground", true);
|
|
|
|
|
user_pref("media.block-autoplay-until-in-foreground", true); // [DEFAULT: true]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
|
|
|
|
@@ -977,7 +969,7 @@ user_pref("browser.link.open_newwindow.restriction", 0);
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
|
|
|
|
|
user_pref("dom.disable_open_during_load", true);
|
|
|
|
|
/* 2212: limit events that can cause a popup [SETUP-WEB]
|
|
|
|
|
* default is "change click dblclick mouseup pointerup notificationclick reset submit touchend contextmenu"
|
|
|
|
|
* default is "change click dblclick auxclick mouseup pointerup notificationclick reset submit touchend contextmenu"
|
|
|
|
|
* [1] http://kb.mozillazine.org/Dom.popup_allowed_events ***/
|
|
|
|
|
user_pref("dom.popup_allowed_events", "click dblclick");
|
|
|
|
|
|
|
|
|
@@ -1022,7 +1014,7 @@ user_pref("dom.serviceWorkers.enabled", false);
|
|
|
|
|
// user_pref("dom.push.connection.enabled", false);
|
|
|
|
|
// user_pref("dom.push.serverURL", "");
|
|
|
|
|
// user_pref("dom.push.userAgentID", "");
|
|
|
|
|
/* 2306: set a default permission for Notifications (both 2305 and 2306) [FF58+]
|
|
|
|
|
/* 2306: set a default permission for Notifications (both 2304 and 2305) [FF58+]
|
|
|
|
|
* 0=always ask (default), 1=allow, 2=block
|
|
|
|
|
* [NOTE] Best left at default "always ask", fingerprintable via Permissions API
|
|
|
|
|
* [SETTING] to add site exceptions: Page Info>Permissions>Receive Notifications
|
|
|
|
@@ -1040,11 +1032,15 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!
|
|
|
|
|
* the website for it to look at the clipboard
|
|
|
|
|
* [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ ***/
|
|
|
|
|
user_pref("dom.event.clipboardevents.enabled", false);
|
|
|
|
|
/* 2403: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
|
|
|
|
|
/* 2403: disable middlemouse paste leaking clipboard content on Linux after autoscroll
|
|
|
|
|
* Defense in depth if clipboard events are enabled (see 2402)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
user_pref("middlemouse.paste", false); // [DEFAULT: false on Windows]
|
|
|
|
|
/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
|
|
|
|
|
* this disables document.execCommand("cut"/"copy") to protect your clipboard
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1170911 ***/
|
|
|
|
|
user_pref("dom.allow_cut_copy", false); // [HIDDEN PREF]
|
|
|
|
|
/* 2404: disable "Confirm you want to leave" dialog on page close
|
|
|
|
|
user_pref("dom.allow_cut_copy", false);
|
|
|
|
|
/* 2405: disable "Confirm you want to leave" dialog on page close
|
|
|
|
|
* Does not prevent JS leaks of the page close event.
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/Events/beforeunload
|
|
|
|
|
* [2] https://support.mozilla.org/questions/1043508 ***/
|
|
|
|
@@ -1189,13 +1185,10 @@ user_pref("pdfjs.disabled", false); // [DEFAULT: false]
|
|
|
|
|
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
|
|
|
|
|
* [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
|
|
|
|
|
user_pref("network.protocol-handler.external.ms-windows-store", false);
|
|
|
|
|
/* 2622: disable middlemouse paste leaking on Linux
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
user_pref("middlemouse.paste", false); // [DEFAULT: false on Windows]
|
|
|
|
|
|
|
|
|
|
/** DOWNLOADS ***/
|
|
|
|
|
/* 2650: discourage downloading to desktop
|
|
|
|
|
* 0=desktop 1=downloads 2=last used
|
|
|
|
|
* 0=desktop, 1=downloads (default), 2=last used
|
|
|
|
|
* [SETTING] To set your default "downloads": General>Downloads>Save files to ***/
|
|
|
|
|
// user_pref("browser.download.folderList", 2);
|
|
|
|
|
/* 2651: enforce user interaction for security by always asking where to download [SETUP-CHROME]
|
|
|
|
@@ -1228,9 +1221,6 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15]
|
|
|
|
|
/* 2680: enable CSP (Content Security Policy)
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/
|
|
|
|
|
user_pref("security.csp.enable", true); // [DEFAULT: true]
|
|
|
|
|
/* 2682: enable CSP 1.1 experimental hash-source directive [FF29+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975 ***/
|
|
|
|
|
user_pref("security.csp.experimentalEnabled", true);
|
|
|
|
|
/* 2684: enforce a security delay on some confirmation dialogs such as install, open/save
|
|
|
|
|
* [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
|
|
|
|
|
* [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
|
|
|
|
@@ -1252,9 +1242,8 @@ user_pref("security.dialog_enable_delay", 700);
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
|
|
|
|
|
/* 2701: disable 3rd-party cookies and site-data [SETUP-WEB]
|
|
|
|
|
* 0=Accept cookies and site data (default), 1=(Block) All third-party cookies, 2=(Block) All cookies,
|
|
|
|
|
* 3=(Block) Cookies from unvisited sites, 4=(Block) Third-party trackers (FF63+)
|
|
|
|
|
* [NOTE] Value 4 is tied to the Tracking Protection lists
|
|
|
|
|
* 0=Accept cookies and site data, 1=(Block) All third-party cookies, 2=(Block) All cookies,
|
|
|
|
|
* 3=(Block) Cookies from unvisited sites, 4=(Block) Third-party trackers (FF63+) (default FF69+)
|
|
|
|
|
* [NOTE] You can set exceptions under site permissions or use an extension
|
|
|
|
|
* [SETTING] Privacy & Security>Content Blocking>Custom>Choose what to block>Cookies ***/
|
|
|
|
|
user_pref("network.cookie.cookieBehavior", 1);
|
|
|
|
@@ -1344,9 +1333,9 @@ user_pref("privacy.cpd.offlineApps", true); // Offline Website Data
|
|
|
|
|
user_pref("privacy.cpd.passwords", false); // this is not listed
|
|
|
|
|
user_pref("privacy.cpd.sessions", true); // Active Logins
|
|
|
|
|
user_pref("privacy.cpd.siteSettings", false); // Site Preferences
|
|
|
|
|
/* 2805: privacy.*.openWindows (clear session restore data) [FF34+]
|
|
|
|
|
* [NOTE] There is a years-old bug that these cause two windows when Firefox restarts.
|
|
|
|
|
* You do not need these anyway if session restore is cleared with history (see 2803) ***/
|
|
|
|
|
/* 2805: clear Session Restore data when sanitizing on shutdown or manually [FF34+]
|
|
|
|
|
* [NOTE] Not needed if Session Restore is not used (see 0102) or is already cleared with history (see 2803)
|
|
|
|
|
* [NOTE] privacy.cpd.openWindows has a bug that causes an additional window to open ***/
|
|
|
|
|
// user_pref("privacy.clearOnShutdown.openWindows", true);
|
|
|
|
|
// user_pref("privacy.cpd.openWindows", true);
|
|
|
|
|
/* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804)
|
|
|
|
@@ -1372,9 +1361,9 @@ user_pref("privacy.sanitize.timeSpan", 0);
|
|
|
|
|
** 1300671 - isolate data:, about: URLs (FF55+)
|
|
|
|
|
** 1473247 - isolate IP addresses (FF63+)
|
|
|
|
|
** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+)
|
|
|
|
|
** 1542309 - isolate top-level domain URLs (FF68+)
|
|
|
|
|
** 1542309 - isolate top-level domain URLs when host is in the public suffix list (FF68+)
|
|
|
|
|
** 1506693 - isolate pdfjs range-based requests (FF68+)
|
|
|
|
|
** 1330467 - isolate site permissions (coming)
|
|
|
|
|
** 1330467 - isolate site permissions (FF69+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
|
|
|
|
|
/* 4001: enable First Party Isolation [FF51+]
|
|
|
|
@@ -1453,11 +1442,13 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAUL
|
|
|
|
|
** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
|
|
|
|
|
** 1540726 - return "light" with prefers-color-scheme (FF67+)
|
|
|
|
|
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
|
|
|
|
|
** 1564422 - spoof audioContext outputLatency (FF70+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
|
|
|
|
|
/* 4501: enable privacy.resistFingerprinting [FF41+]
|
|
|
|
|
* This pref is the master switch for all other privacy.resist* prefs unless stated
|
|
|
|
|
* [SETUP-WEB] RFP is not ready for the masses, so expect some website breakage
|
|
|
|
|
* [SETUP-WEB] RFP can cause the odd website to break in strange ways, and has a few side affects,
|
|
|
|
|
* but is largely robust nowadays. Give it a try. Your choice. Also see 4504 (letterboxing).
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/418986 ***/
|
|
|
|
|
user_pref("privacy.resistFingerprinting", true);
|
|
|
|
|
/* 4502: set new window sizes to round to hundreds [FF55+] [SETUP-CHROME]
|
|
|
|
@@ -1465,8 +1456,8 @@ user_pref("privacy.resistFingerprinting", true);
|
|
|
|
|
* The override values are a starting point to round from if you want some control
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1330882
|
|
|
|
|
* [2] https://hardware.metrics.mozilla.com/ ***/
|
|
|
|
|
// user_pref("privacy.window.maxInnerWidth", 1600); // [HIDDEN PREF]
|
|
|
|
|
// user_pref("privacy.window.maxInnerHeight", 900); // [HIDDEN PREF]
|
|
|
|
|
// user_pref("privacy.window.maxInnerWidth", 1000);
|
|
|
|
|
// user_pref("privacy.window.maxInnerHeight", 1000);
|
|
|
|
|
/* 4503: disable mozAddonManager Web API [FF57+]
|
|
|
|
|
* [NOTE] As a side-effect in FF57-59 this allowed extensions to work on AMO. In FF60+ you also need
|
|
|
|
|
* to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect
|
|
|
|
@@ -1476,7 +1467,8 @@ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDE
|
|
|
|
|
* Dynamically resizes the inner window (FF67; 200w x100h: FF68+; stepped ranges) by applying letterboxing,
|
|
|
|
|
* using dimensions which waste the least content area, If you use the dimension pref, then it will only apply
|
|
|
|
|
* those resolutions. The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000, 1600x900")
|
|
|
|
|
* [NOTE] This does NOT require RFP (see 4501) **for now**
|
|
|
|
|
* [SETUP-WEB] This does NOT require RFP (see 4501) **for now**, so if you're not using 4501, or you are but you're
|
|
|
|
|
* not taking anti-fingerprinting seriously and a little visual change upsets you, then feel free to flip this pref
|
|
|
|
|
* [WARNING] The dimension pref is only meant for testing, and we recommend you DO NOT USE it
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1407366 ***/
|
|
|
|
|
user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
|
|
|
|
@@ -1621,6 +1613,7 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
/* APPEARANCE ***/
|
|
|
|
|
// user_pref("browser.download.autohideButton", false); // [FF57+]
|
|
|
|
|
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
|
|
|
|
|
// user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent
|
|
|
|
|
/* CONTENT BEHAVIOR ***/
|
|
|
|
|
// user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
|
|
|
|
|
// user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX]
|
|
|
|
@@ -1632,6 +1625,7 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
// user_pref("browser.urlbar.decodeURLsOnCopy", true); // see bugzilla 1320061 [FF53+]
|
|
|
|
|
// user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [WINDOWS] [MAC]
|
|
|
|
|
// user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART]
|
|
|
|
|
// user_pref("view_source.tab", false); // view "page/selection source" in a new window [FF68+, FF59 and under]
|
|
|
|
|
/* OTHER ***/
|
|
|
|
|
// user_pref("browser.bookmarks.max_backups", 2);
|
|
|
|
|
// user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); // disable CFR [FF67+]
|
|
|
|
@@ -1753,6 +1747,37 @@ user_pref("dom.event.highrestimestamp.enabled", true); // [DEFAULT: true]
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1528953
|
|
|
|
|
// user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF68
|
|
|
|
|
// 0105b: disable Activity Stream Legacy Snippets
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1546190,1540939
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
|
|
|
|
|
user_pref("browser.aboutHomeSnippets.updateUrl", "");
|
|
|
|
|
// 0307: disable auto updating of lightweight themes (LWT)
|
|
|
|
|
// Not to be confused with themes in 0301* + 0302*, which use the FF55+ Theme API
|
|
|
|
|
// Mozilla plan to convert existing LWTs and remove LWT support in the future, see [1]
|
|
|
|
|
// [1] https://blog.mozilla.org/addons/2018/09/20/future-themes-here/
|
|
|
|
|
// [-] (part3b) https://bugzilla.mozilla.org/1525762
|
|
|
|
|
user_pref("lightweightThemes.update.enabled", false);
|
|
|
|
|
// 2682: enable CSP 1.1 experimental hash-source directive [FF29+]
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1386214
|
|
|
|
|
user_pref("security.csp.experimentalEnabled", true);
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/* ESR68.x still uses all the following prefs
|
|
|
|
|
// [NOTE] replace the * with a slash in the line above to re-enable them
|
|
|
|
|
// FF69
|
|
|
|
|
// 1405: disable WOFF2 (Web Open Font Format) [FF35+]
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1556991
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.woff2.enabled", false);
|
|
|
|
|
// 1802: enforce click-to-play for plugins
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1519434
|
|
|
|
|
user_pref("plugins.click_to_play", true); // [DEFAULT: true in FF25+]
|
|
|
|
|
// 2033: disable autoplay for muted videos [FF63+] - replaced by `media.autoplay.default` options (2030)
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1562331
|
|
|
|
|
// user_pref("media.autoplay.allow-muted", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/* END: internal custom pref to test for syntax errors ***/
|
|
|
|
|
Thorin-Oakenpants