Compare commits
No commits in common. "master" and "2.1" have entirely different histories.
6 changed files with 441 additions and 1156 deletions
|
|
@ -1,6 +0,0 @@
|
|||
stages:
|
||||
- dummy
|
||||
dummy-job:
|
||||
stage: dummy
|
||||
script:
|
||||
- echo "Hello, world!"
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
### pre-requisites
|
||||
|
||||
<!--
|
||||
|
||||
if you ignore the pre-requisites and the template the issue might be closed.
|
||||
issues that have the `provide info` label need user input or they will be quarantined after a week,
|
||||
and closed after ten days.
|
||||
|
||||
suggestions are appreciated in the form of merge requests or alternatively well documented issues.
|
||||
|
||||
make sure you are in the right repository:
|
||||
https://librewolf.net/docs/faq/#i-have-a-problem-where-do-i-open-a-new-issue
|
||||
|
||||
-->
|
||||
|
||||
- [ ] I've read and followed the [contribution guidelines](https://librewolf.net/docs/faq/#do-you-have-any-contribution-guidelines);
|
||||
- [ ] I've reproduced the issue in a new LibreWolf profile;
|
||||
- [ ] I've checked that the problem is not present in a stock Firefox profile;
|
||||
|
||||
### details
|
||||
- browser version & OS:
|
||||
- steps to reproduce:
|
||||
- expected result:
|
||||
- actual result:
|
||||
- console errors and warnings:
|
||||
- others:
|
||||
31
README.md
31
README.md
|
|
@ -2,19 +2,26 @@
|
|||
|
||||
LibreWolf settings for all platforms.
|
||||
|
||||
we encourage users to find **their own setup** and to use our default configuration as something to build on top of. this is now easier thanks to the [overrides](https://librewolf.net/docs/faq/#where-do-i-find-my-librewolfoverridescfg).
|
||||
The configuration file was revamped and it includes improvements in usability, a more curated and focused selection of privacy settings, as well as the ability to override preferences with an external file.
|
||||
The old configuration (now tagged as `legacy`) should be considered deprecated and it will no longer be maintained.
|
||||
|
||||
We encourage users to find **their own setup** and to use our default configuration as something to build on top of. This is now easier thanks to the overrides, just place your own preferences in the proper location, according to your OS and install method:
|
||||
- Most distros and macOS -> `~/.librewolf/librewolf.overrides.cfg`
|
||||
- Flatpak -> `~/.var/app/io.gitlab.librewolf-community/.librewolf/librewolf.overrides.cfg`
|
||||
- Windows -> `%USERPROFILE%\.librewolf\librewolf.overrides.cfg`
|
||||
|
||||
## Useful links
|
||||
- [website](https://librewolf.net/): read the docs.
|
||||
- [faq](https://librewolf.net/docs/faq/): for any question you might have, and to help you creating your own pref file.
|
||||
- [all releases](https://gitlab.com/librewolf-community/browser).
|
||||
- [issue tracker](https://gitlab.com/librewolf-community/settings/-/issues).
|
||||
- if you ignore the pre-requisites and the template the issues might be closed.
|
||||
- issues that have the `provide info` label need user input or they will be quarantined after a week, and closed after ten days.
|
||||
- find us on [gitter](https://gitter.im/librewolf-community/librewolf) / [matrix](https://matrix.to/#/#librewolf:matrix.org) / [reddit](https://www.reddit.com/r/LibreWolf/) / [lemmy](https://lemmy.ml/c/librewolf).
|
||||
- [FAQ](https://gitlab.com/librewolf-community/settings/-/wikis/FAQ): to help you creating your own pref file.
|
||||
- [LibreWolf distributions](https://gitlab.com/librewolf-community/browser)
|
||||
- [Issue tracker](https://gitlab.com/librewolf-community/settings/-/issues)
|
||||
- Our community on [gitter](https://gitter.im/librewolf-community/librewolf)
|
||||
- [Website](https://librewolf-community.gitlab.io/)
|
||||
- [r/LibreWolf](https://www.reddit.com/r/LibreWolf/)
|
||||
|
||||
## Notes and thanks
|
||||
- this repository benefits from the knowledge and research provided by [arkenfox](https://github.com/arkenfox), so special thanks to the project.
|
||||
we do not use arkenfox's `user.js` but we try to keep up with it, and we also consider it a great resource for users who want to find their own setup.
|
||||
- many thanks to the firefox team and to the people working on [bugzilla](https://bugzilla.mozilla.org/home);
|
||||
- thanks to the whole LibreWolf community and to all the contributors of this repo.
|
||||
This repository benefits from the knowledge and research provided by [arkenfox](https://github.com/arkenfox), their documentation was vital to this revamp, so special thanks to their project.
|
||||
We do not use arkenfox's user.js but we try to keep up with it, and we also consider it a great resource for users who want to find their own setup.
|
||||
|
||||
Some of the older prefs in this project are taken from [pyllyukko](https://github.com/pyllyukko/user.js/) and many more were investigated on [bugzilla](https://bugzilla.mozilla.org/home).
|
||||
|
||||
Thank you to the whole LibreWolf community as once again this is entirely a community effort.
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -1,707 +1,8 @@
|
|||
This changelog will be used from now on to document changes in a precise manner, with a list of changes for each setting version.
|
||||
Setting versions are documented using the pref `librewolf.cfg.version`, available in about:config.
|
||||
|
||||
# 7.7
|
||||
|
||||
**base librewolf version**: 115.x
|
||||
|
||||
**References**:
|
||||
- https://gitlab.com/librewolf-community/settings/-/issues/262
|
||||
|
||||
#### Added preferences
|
||||
|
||||
```
|
||||
defaultPref("browser.urlbar.suggest.weather", false);
|
||||
defaultPref("extensions.quarantinedDomains.enabled", false);
|
||||
```
|
||||
|
||||
# 7.6
|
||||
|
||||
**base librewolf version**: 111.x - 114.x
|
||||
|
||||
**References**:
|
||||
- the prefs added in the `LOGGING` section are off by default in the official Mozilla builds, so we are just acting like Firefox here;
|
||||
|
||||
#### Removed preferences
|
||||
|
||||
```
|
||||
defaultPref("browser.contentblocking.report.monitor.enabled", false); // default
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
|
||||
```
|
||||
defaultPref("app.support.baseURL", "https://support.librewolf.net/");
|
||||
```
|
||||
|
||||
#### Added preferences
|
||||
|
||||
```
|
||||
pref("browser.dom.window.dump.enabled", false);
|
||||
pref("devtools.console.stdout.chrome", false);
|
||||
```
|
||||
|
||||
# 7.5
|
||||
|
||||
**target commit**: from 71a20c6fff90e7fbcb216f1d644ca1b40b32b8e2 to 6fe09c63cbfb83ebfb6a17f5e624248f2501b97e
|
||||
|
||||
**base librewolf version**: 109.x and 110.x
|
||||
|
||||
**References**:
|
||||
|
||||
- thumbnails are only used in privileged code to populate New Tab Page and Ctrl+Tab previews.
|
||||
- the startup blank window doesn't break anything and the perceived performance boost is irrelevant on modern hardware.
|
||||
- reset popup events to default as it's mostly a non-issue.
|
||||
|
||||
#### Removed preferences
|
||||
|
||||
```
|
||||
defaultPref("browser.pagethumbnails.capturing_disabled", true);
|
||||
defaultPref("browser.startup.blankWindow", false);
|
||||
defaultPref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
|
||||
```
|
||||
|
||||
# 7.4
|
||||
|
||||
**target commit**: b0d277a77b36e3bcc5c0f7a1b0eca7a54a388d9d
|
||||
|
||||
**base librewolf version**: 108.x
|
||||
|
||||
**References**:
|
||||
|
||||
- win7/8.x don't need this pref thanks to Firefox's own implementation of mDNS.
|
||||
|
||||
#### Removed preferences
|
||||
|
||||
```
|
||||
defaultPref("media.peerconnection.ice.no_host", true); // don't use any private IPs for ICE candidate
|
||||
```
|
||||
|
||||
# 7.3
|
||||
|
||||
**target commit**: from 9395f5c0e061250acbcbcb523d2270d57136d411 to 240e184b785e4e46c09ca6881111f7c2d4d31a3f
|
||||
|
||||
**base librewolf version**: 107.x
|
||||
|
||||
**References**:
|
||||
|
||||
- mixed content is already covered by HTTPS-only-mode;
|
||||
- [dom.disable_beforeunload is no longer necessary](https://github.com/arkenfox/user.js/issues/1575);
|
||||
- [beacon API is fine](https://gitlab.com/librewolf-community/settings/-/issues/229);
|
||||
- [Firefox Vew pref was removed in previous commit](https://gitlab.com/librewolf-community/settings/-/commit/9395f5c0e061250acbcbcb523d2270d57136d411), adding reference to the changelog;
|
||||
|
||||
#### Removed preferences
|
||||
|
||||
```
|
||||
defaultPref("security.mixed_content.block_display_content", true); // block insecure passive content
|
||||
defaultPref("dom.disable_beforeunload", true);
|
||||
defaultPref("dom.disable_open_during_load", true); // default
|
||||
defaultPref("browser.tabs.firefox-view", false);
|
||||
pref("beacon.enabled", false);
|
||||
```
|
||||
|
||||
# 7.2
|
||||
|
||||
**target commit**: from 7211e954b82da3cde5c5cf2d613fe1f84288e635 to eb51b4785e5b67fc388bcbd06a8324d5a54f5850
|
||||
|
||||
**base librewolf version**: 106.x
|
||||
|
||||
**References**:
|
||||
|
||||
- hide Firefox View til reviewed, see https://gitlab.com/librewolf-community/browser/source/-/issues/78;
|
||||
- hotfix for syntax error;
|
||||
|
||||
#### Removed preferences
|
||||
|
||||
```
|
||||
defaultPref("browser.ssl_override_behavior", 1); // deprecated
|
||||
```
|
||||
|
||||
#### Added preferences
|
||||
|
||||
```
|
||||
defaultPref("browser.tabs.firefox-view", false);
|
||||
```
|
||||
|
||||
# 7.1
|
||||
|
||||
**target commit**: 33e1ec1cb97d1f16a696057fe9007ae8391def6b
|
||||
|
||||
**base librewolf version**: 106.x
|
||||
|
||||
**References**:
|
||||
|
||||
- change most `lockPref()` to `pref()` or `defaultPref()`, see https://gitlab.com/librewolf-community/settings/-/issues/204;
|
||||
- offline autodetection is mature enough and it is used by some APIs;
|
||||
- if someone wants to get the mozilla extension for USB debugging, that's fine.
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("network.manage-offline-status", false);
|
||||
defaultPref("devtools.remote.adb.extensionURL", "");
|
||||
defaultPref("devtools.chrome.enabled", false); // default
|
||||
```
|
||||
|
||||
# 7.0
|
||||
|
||||
**target commit**: from ed9334d258d20830deafe1a02b87b0cea678236d to 1bdfd333e31c3d119c0bf5506a56b2026ead3583
|
||||
|
||||
**base librewolf version**: 105.x
|
||||
|
||||
**References**:
|
||||
|
||||
- [enable APS](https://github.com/arkenfox/user.js/issues/1530#issuecomment-1242850653);
|
||||
- trim unnecessary or default NTP prefs, then tidy existing ones;
|
||||
- stick to default session restore interval for writes;
|
||||
- remove a bunch of default prefs that have been that way for the longest;
|
||||
- offer accessibility by default;
|
||||
- remove hardcore svg security pref since CVEs are very old and irrelevant, see [this discussion](https://github.com/arkenfox/user.js/issues/1529);
|
||||
- improve [autoplay behavior](https://gitlab.com/librewolf-community/settings/-/issues/213).
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("privacy.partition.always_partition_third_party_non_cookie_storage", true);
|
||||
defaultPref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false);
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("browser.newtab.preload", false);
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false);
|
||||
lockPref("browser.newtabpage.activity-stream.discoverystream.enabled", false);
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.snippets", false); // default
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.system.topstories", false);
|
||||
defaultPref("browser.sessionstore.interval", 60000); // increase time between session saves
|
||||
defaultPref("network.http.windows-sso.enabled", false); // default
|
||||
defaultPref("privacy.partition.serviceWorkers", true); // default v105+
|
||||
defaultPref("accessibility.force_disabled", 1); // block accessibility services
|
||||
lockPref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false); // default
|
||||
lockPref("toolkit.telemetry.reportingpolicy.firstRun", false); // default
|
||||
defaultPref("network.http.referer.XOriginPolicy", 0); // default
|
||||
lockPref("browser.safebrowsing.passwords.enabled", false); // default
|
||||
lockPref("browser.safebrowsing.provider.google4.dataSharing.enabled", false); // default
|
||||
defaultPref("gfx.font_rendering.opentype_svg.enabled", false); // disale svg opentype fonts
|
||||
defaultPref("media.autoplay.blocking_policy", 2);
|
||||
```
|
||||
|
||||
# 6.9
|
||||
|
||||
**target commit**: 49a705f835e1438372fbdf1a779fbc5846212a68
|
||||
|
||||
**base librewolf version**: 104.x
|
||||
|
||||
**References**:
|
||||
- autofill prefs have been replaced in a migration, we now only keep the bare minimum;
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("browser.fixup.alternate.enabled", false); // default v104+
|
||||
defaultPref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0); // default v104+
|
||||
defaultPref("extensions.formautofill.available", "off"); // deprecated
|
||||
defaultPref("extensions.formautofill.creditCards.available", false); // deprecated
|
||||
defaultPref("extensions.formautofill.heuristics.enabled", false);
|
||||
```
|
||||
|
||||
# 6.8
|
||||
|
||||
**target commit**: 381cbed42c98d2376faf7e4ec449623bb99b0be1
|
||||
|
||||
**base librewolf version**: 103.x
|
||||
|
||||
**References**:
|
||||
- [geoclue](https://github.com/arkenfox/user.js/issues/1504);
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("geo.provider.use_geoclue", false); // [LINUX]
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("network.cookie.cookieBehavior", 5); // default
|
||||
```
|
||||
|
||||
# 6.7
|
||||
|
||||
**target commit**: from e505ddbf0242aec1017a565a74ff9ff5aa458fe5 to 02212c3f44e7aa68b22c8febd9158580d7e4b74f
|
||||
|
||||
**base librewolf version**: 103.x
|
||||
|
||||
**References**:
|
||||
- the cookie lifetime policy pref has been deprecated, see https://gitlab.com/librewolf-community/settings/-/issues/199;
|
||||
- stop disabling IPv6, see https://gitlab.com/librewolf-community/settings/-/issues/96;
|
||||
- discussion about domain guessing is available at https://gitlab.com/librewolf-community/settings/-/issues/197.
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("network.cookie.lifetimePolicy", 2); // deprecated
|
||||
defaultPref("network.dns.disableIPv6", true);
|
||||
```
|
||||
|
||||
#### Unlocked preferences
|
||||
```
|
||||
defaultPref("browser.fixup.alternate.enabled", false); // default v104+
|
||||
```
|
||||
|
||||
# 6.6
|
||||
|
||||
**target commit**: from bc16f4f14185e8791d819a69b7d798082ace67f8 to c983fcc8bea8fab31265bc345217b59ce5128de2
|
||||
|
||||
**base librewolf version**: 102.x
|
||||
|
||||
**References**:
|
||||
- sha1 certificates: https://bugzilla.mozilla.org/1767489 and https://bugzilla.mozilla.org/1766687.
|
||||
- trimming only applies to http websites so it's very minimal.
|
||||
- crlite: https://bugzilla.mozilla.org/show_bug.cgi?id=1773371, we can stick to default 3 till v103, then the value will be changed to 2 which is the best possible if mozilla feels like it's ready usability wise.
|
||||
- add more entries to the native query stripping list, to [get in line with brave](https://github.com/brave/brave-core/blob/master/browser/net/brave_site_hacks_network_delegate_helper.cc).
|
||||
- `services.settings.server` can now be used as a pref, see: https://gitlab.com/librewolf-community/browser/source/-/merge_requests/37
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("services.settings.server", "https://%.invalid") // set the remote settings URL (REMOTE_SETTINGS_SERVER_URL in the code)
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("security.pki.sha1_enforcement_level", 1); // default
|
||||
defaultPref("browser.urlbar.trimURLs", false);
|
||||
defaultPref("security.pki.crlite_mode", 3); // default
|
||||
defaultPref("security.OCSP.enabled", 1); // default
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
defaultPref("privacy.query_stripping.strip_list", "__hsfp __hssc __hstc __s _hsenc _openstat dclid fbclid gbraid gclid hsCtaTracking igshid mc_eid ml_subscriber ml_subscriber_hash msclkid oft_c oft_ck oft_d oft_id oft_ids oft_k oft_lk oft_sk oly_anon_id oly_enc_id rb_clickid s_cid twclid vero_conv vero_id wbraid wickedid yclid");
|
||||
```
|
||||
|
||||
# 6.5
|
||||
|
||||
**target commit**: b10dcbdd84e63787c4f2f6d34d41724b437df5be
|
||||
|
||||
**base librewolf version**: 101.x
|
||||
|
||||
**References**:
|
||||
- query stripping is now [part of strict mode](https://hg.mozilla.org/mozilla-central/rev/9d9425eb1ded).
|
||||
- session cookie prefs are useless given that we sanitize on close, [more details at arkenfox](https://github.com/arkenfox/user.js/pull/1443/commits/3207478033fefc19e933dab4eef6445125341ec4).
|
||||
- fission has been a default for the longest now.
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("privacy.query_stripping.enabled", true);
|
||||
defaultPref("network.cookie.thirdparty.sessionOnly", true);
|
||||
defaultPref("network.cookie.thirdparty.nonsecureSessionOnly", true);
|
||||
defaultPref("fission.autostart", true);
|
||||
```
|
||||
|
||||
# 6.4
|
||||
|
||||
**target commit**: eea09ca07333dc166213fa9c873e4916d979e97f
|
||||
|
||||
**base librewolf version**: 100.x
|
||||
|
||||
**References**:
|
||||
- hide Firefox Focus promo in private tabs.
|
||||
- double checking revoked certificates with both CRL and OCSP allows to detect false positives and it is also [the default](https://hg.mozilla.org/mozilla-central/rev/a6ba7b4ee17).
|
||||
- [clearOnShutdown prefs now respect exceptions](https://github.com/arkenfox/user.js/issues/1441) so we can tick all boxes in that UI as well.
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
lockPref("browser.promo.focus.enabled", false);
|
||||
defaultPref("privacy.clearOnShutdown.offlineApps", true);
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
defaultPref("security.pki.crlite_mode", 3); // prev 2
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("privacy.clearOnShutdown.cookies", false);
|
||||
```
|
||||
|
||||
# 6.3
|
||||
|
||||
**target commit**: e84fc950bfd7c3542cb974e9d545b9b8e18c010d
|
||||
|
||||
**base librewolf version**: 99.x
|
||||
|
||||
**References**:
|
||||
- Fixes the uBlock Origin installation URL
|
||||
|
||||
# 6.2
|
||||
|
||||
**target commit**: ac95f5195ed82ca6bcec48acf9d1241e3c683b25
|
||||
|
||||
**base librewolf version**: 99.x
|
||||
|
||||
**References**:
|
||||
- vpn pref was set to the wrong value by mistake.
|
||||
- offscreencanvas cannot be read back using JS, plus it is being tracked upstream. see [this comment](https://github.com/arkenfox/user.js/issues/1418#issuecomment-1093390017), which solves doubts from 6.1 changelog.
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("gfx.offscreencanvas.domain-enabled", false);
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
lockPref("browser.vpn_promo.enabled", false);
|
||||
```
|
||||
|
||||
# 6.1
|
||||
|
||||
**target commit**: 465257e5993893cd7896ef1533d37e245f206fb9
|
||||
|
||||
**base librewolf version**: 99.x
|
||||
|
||||
**References**:
|
||||
- csp pref has been deprecated.
|
||||
- quicksuggest prefs are redundant as it has a master switch. the master switch is now force applied on each restart of the browser.
|
||||
- do not whitelist offscreencanvas for now, we need to first check how it is tied to the "normal" canvas.
|
||||
|
||||
**Notes**: using the vpn pref should allow us to get rid of one patch.
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
lockPref("browser.vpn_promo.enabled", true);
|
||||
defaultPref("gfx.offscreencanvas.domain-enabled", false);
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
lockPref("security.csp.enable", true); // enforce csp, default
|
||||
lockPref("browser.urlbar.suggest.quicksuggest.nonsponsored", false);
|
||||
lockPref("browser.urlbar.suggest.quicksuggest.sponsored", false);
|
||||
lockPref("browser.urlbar.quicksuggest.dataCollection.enabled", false); // default
|
||||
lockPref("browser.urlbar.quicksuggest.scenario", "history");
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
pref("browser.urlbar.quicksuggest.enabled", false);
|
||||
```
|
||||
|
||||
# 6.0
|
||||
|
||||
**target commit**: 0822d491d2b377b5cd7f0429cee5aa916538fa50
|
||||
|
||||
**base librewolf version**: 98.x
|
||||
|
||||
**References**:
|
||||
- we are going to force history to custom mode and hide the UI for always on PB mode, a bunch of pointers are collected in [this MR](https://gitlab.com/librewolf-community/browser/source/-/merge_requests/21).
|
||||
- [handlers prefs are deprecated](https://bugzilla.mozilla.org/show_bug.cgi?id=1733497).
|
||||
- for OCSP see [this issue](https://gitlab.com/librewolf-community/settings/-/issues/150).
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
pref("privacy.history.custom", true);
|
||||
pref("browser.privatebrowsing.autostart", false);
|
||||
defaultPref("browser.preferences.moreFromMozilla", false); // hide about:preferences#moreFromMozilla
|
||||
defaultPref("security.OCSP.require", true); // set to hard-fail
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
/** [SECTION] HANDLERS
|
||||
* remove the default handlers for several tipe of files and services.
|
||||
*/
|
||||
lockPref("gecko.handlerService.schemes.mailto.0.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.mailto.0.name", "");
|
||||
lockPref("gecko.handlerService.schemes.mailto.1.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.mailto.1.name", "");
|
||||
lockPref("gecko.handlerService.schemes.irc.0.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.irc.0.name", "");
|
||||
lockPref("gecko.handlerService.schemes.ircs.0.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.ircs.0.name", "");
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
defaultPref("security.OCSP.enabled", 1);
|
||||
```
|
||||
|
||||
# 5.5
|
||||
|
||||
**target commit**: 0fc1ff53c99379d9d4625de65ea51287d57a0a3a
|
||||
|
||||
**base librewolf version**: 97.x
|
||||
|
||||
**References**:
|
||||
- showing the insecure connection text is redundant as there's already the lock UI for http websites.
|
||||
- `browser.places.speculativeConnect.enabled` controls speculative connections for bookmarks and will be fully effective only once we hit v98.
|
||||
- we will no longer disable history but we'll clear it on close. [reasoning](https://gitlab.com/librewolf-community/settings/-/issues/135).
|
||||
- [download annoyances](https://gitlab.com/librewolf-community/settings/-/issues/144).
|
||||
|
||||
**Notes**: the settings have been re-organized and they should also be documented a bit better now.
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("security.insecure_connection_text.enabled", true); // display http websites as insecure in the ui
|
||||
defaultPref("places.history.enabled", true);
|
||||
```
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("browser.places.speculativeConnect.enabled", false);
|
||||
defaultPref("browser.download.alwaysOpenPanel", false); // do not expand toolbar menu for every download, we already have enough interaction
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
pref("security.tls.version.enable-deprecated", false); // make TLS downgrades session only by enforcing it with pref()
|
||||
```
|
||||
|
||||
## 5.4
|
||||
|
||||
**target commit**:
|
||||
|
||||
**base librewolf version**: 96.x
|
||||
|
||||
**References**:
|
||||
- [serve custom uBO assets](https://gitlab.com/librewolf-community/settings/-/issues/134)
|
||||
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("librewolf.uBO.assetsBootstrapLocation", "https://gitlab.com/librewolf-community/browser/source/-/raw/main/assets/uBOAssets.json");
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
defaultPref("privacy.query_stripping.strip_list", "__hsfp __hssc __hstc __s _hsenc _openstat dclid fbclid gbraid gclid hsCtaTracking igshid mc_eid ml_subscriber ml_subscriber_hash msclkid oly_anon_id oly_enc_id rb_clickid s_cid twclid vero_conv vero_id wbraid wickedid yclid");
|
||||
```
|
||||
|
||||
## 5.3
|
||||
|
||||
**target commit**: c256656f377d3c15a8c7537c65f45dc802904df7
|
||||
|
||||
**base librewolf version**: 96.x
|
||||
|
||||
**References**:
|
||||
- [disable sync differently](https://gitlab.com/librewolf-community/settings/-/issues/132);
|
||||
- [remove tracking query params](https://gitlab.com/librewolf-community/settings/-/issues/128);
|
||||
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("identity.fxaccounts.enabled", false); // sync and firefox account
|
||||
defaultPref("privacy.query_stripping.enabled", true);
|
||||
defaultPref("privacy.query_stripping.strip_list", "__hsfp __hssc __hstc __s _hsenc _openstat dclid fbclid gclid hsCtaTracking igshid mc_eid ml_subscriber ml_subscriber_hash msclkid oly_anon_id oly_enc_id rb_clickid s_cid vero_conv vero_id wickedid yclid");
|
||||
```
|
||||
|
||||
## 5.2
|
||||
|
||||
**target commit**: f3b4414d30953d1ea3eb64a9d75c62c242ee991b
|
||||
|
||||
**base librewolf version**: 96.x
|
||||
|
||||
**References**:
|
||||
- [fix console issue](https://gitlab.com/librewolf-community/settings/-/issues/129)
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("devtools.selfxss.count", 0);
|
||||
```
|
||||
|
||||
## 5.1
|
||||
|
||||
**target commit**: f28b218e97acec8935c0c868863a9f4b6a061a39 and 60221803c46bf5cf2cbc5d77035927f9fd249e6a
|
||||
|
||||
**base librewolf version**: 96.x
|
||||
|
||||
**References**:
|
||||
- [fix language issue](https://gitlab.com/librewolf-community/settings/-/issues/125)
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
pref("intl.accept_languages", "en-US, en");
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("intl.locale.requested", "en-US");
|
||||
defaultPref("privacy.spoof_english", 2);
|
||||
defaultPref("browser.search.region", "US"); // set a default search region for all users
|
||||
defaultPref("extensions.getAddons.langpacks.url", ""); // prevent users from adding lang packs, which would cause leaks
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
pref("javascript.use_us_english_locale", true);
|
||||
```
|
||||
|
||||
## 5.0
|
||||
|
||||
**target commit**: from 8a98176400e2e44ae1138ea8bdc1991250f75b8e to b219a75b4a0d72b519ce386406f45acead940c9a
|
||||
|
||||
**base librewolf version**: 96.x
|
||||
|
||||
**References**:
|
||||
- [extension auto-updates](https://gitlab.com/librewolf-community/settings/-/issues/116)
|
||||
- [remove all the OS specific prefs](https://gitlab.com/librewolf-community/settings/-/issues/124)
|
||||
- [service workers and push](https://gitlab.com/librewolf-community/settings/-/issues/115)
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("privacy.partition.serviceWorkers", true); // isolate service workers
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("extensions.update.enabled", false); // disable automatic checks for extension updates
|
||||
defaultPref("extensions.update.autoUpdateDefault", false); // disable automatic installs of extension updates
|
||||
defaultPref("browser.tabs.loadBookmarksInTabs", true);
|
||||
defaultPref("clipboard.autocopy", false);
|
||||
defaultPref("dom.popup_maximum", 4);
|
||||
defaultPref("general.autoScroll", false);
|
||||
defaultPref("devtools.selfxss.count", 0); // was set because of https://gitlab.com/librewolf-community/browser/linux/-/issues/80
|
||||
defaultPref("dom.push.enabled", false); // disable push notifications
|
||||
defaultPref("dom.push.serverURL", ""); // default "wss://push.services.mozilla.com/"
|
||||
defaultPref("dom.serviceWorkers.enabled", false); // disable service workers, must enable for push notifications
|
||||
```
|
||||
|
||||
## 4.0
|
||||
|
||||
**target commit**: 9003f029f8fe087cde5bb081d51ab82340948874
|
||||
|
||||
**base librewolf version**: 95.x
|
||||
|
||||
**References**:
|
||||
- [review webrtc](https://gitlab.com/librewolf-community/settings/-/issues/108).
|
||||
- [stop disabling geo api](https://gitlab.com/librewolf-community/settings/-/issues/102).
|
||||
- [deprecate RFP dark mode](https://gitlab.com/librewolf-community/browser/common/-/issues/56).
|
||||
- `offlineApps` change in 3.1 did not respect exceptions, so revert it.
|
||||
- uncomment prefs to enable CRL without OCSP fallback, although they will fully work only when [this issue is closed](https://gitlab.com/librewolf-community/browser/common/-/issues/57).
|
||||
- we decided to force a larger new window size by default, to improve usability for RFP users while still keeping a rounded value. see [this comment](https://gitlab.com/librewolf-community/settings/-/issues/104#note_752186737).
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("privacy.window.maxInnerWidth", 1600);
|
||||
defaultPref("privacy.window.maxInnerHeight", 900);
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("media.peerconnection.enabled", false);
|
||||
lockPref("privacy.override_rfp_for_color_scheme", false);
|
||||
defaultPref("geo.enabled", false);
|
||||
defaultPref("permissions.default.geo", 2);
|
||||
defaultPref("privacy.clearOnShutdown.offlineApps", true);
|
||||
defaultPref("privacy.cpd.offlineApps", true);
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
defaultPref("security.remote_settings.crlite_filters.enabled", true);
|
||||
defaultPref("security.pki.crlite_mode", 2);
|
||||
```
|
||||
|
||||
## 3.2
|
||||
|
||||
**target commit**: 19e59813ed483de7ffc8a219da96eb18a942eb01
|
||||
|
||||
**base librewolf version**: 94.x
|
||||
|
||||
**References**:
|
||||
- block the new firefox suggests feature in full.
|
||||
- enforce a sane value for manual sanitizing.
|
||||
|
||||
**Notes**: the suggest prefs might be overkill, we should try to trim to the bare minimum in the next release.
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
lockPref("browser.urlbar.quicksuggest.enabled", false); // disable suggest and hide its ui
|
||||
lockPref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // disable suggestions from firefox
|
||||
lockPref("browser.urlbar.suggest.quicksuggest.sponsored", false); // disable sponsored suggestions
|
||||
lockPref("browser.urlbar.quicksuggest.dataCollection.enabled", false); // default
|
||||
defaultPref("privacy.sanitize.timeSpan", 0);
|
||||
```
|
||||
#### Changed preferences
|
||||
```
|
||||
lockPref("browser.urlbar.quicksuggest.scenario", "history"); // prevent opt-in, doesn't work alone
|
||||
```
|
||||
|
||||
## 3.1
|
||||
|
||||
**target commit**: 6844d4ad1c9ad8bb3ffdc29e0a607c21c0559da4 and 67e6a00b719ecd52782a724cd09a9f08fa4577c0
|
||||
|
||||
**base librewolf version**: 94.x
|
||||
|
||||
**References**:
|
||||
- the added prefs are all defense in depth.
|
||||
- `drawInTitlebar` was causing errors for some users, the bug was reproduced. Linux users might experience a different toolbar behavior because of this change.
|
||||
- the default value for scopes seems like a better choice than changing it.
|
||||
- `offlineApps` can be safely cleared without using logins, in fact it was most likely cleared by other sanitazion techniques regardless.
|
||||
|
||||
**Notes**: please notify users about the new website, thanks to @maltejur for helping with the migration.
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("webchannel.allowObject.urlWhitelist", ""); // remove webchannel whitelist
|
||||
lockPref("toolkit.telemetry.coverage.opt-out", true); // hidden
|
||||
defaultPref("privacy.cpd.offlineApps", true); // for consistency with clearOnShutdown prefs
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
defaultPref("extensions.autoDisableScopes", 11); // bring back to default
|
||||
defaultPref("browser.tabs.drawInTitlebar", true); // bring back to default
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
defaultPref("privacy.clearOnShutdown.offlineApps", true); // can be cleared
|
||||
defaultPref("app.support.baseURL", "https://librewolf.net/docs/faq/#");
|
||||
defaultPref("browser.search.searchEnginesURL", "https://librewolf.net/docs/faq/#how-do-i-add-a-search-engine");
|
||||
defaultPref("browser.geolocation.warning.infoURL", "https://librewolf.net/docs/faq/#how-do-i-enable-location-aware-browsing");
|
||||
defaultPref("app.feedback.baseURL", "https://librewolf.net/#questions");
|
||||
```
|
||||
|
||||
## 3.0
|
||||
|
||||
**target commit**: f0a2d5d70657cc87348282d6faaf72edff8bf304 and 4e0895a299ec99066f119d8ce1a2923fc91aa465
|
||||
|
||||
**base librewolf version**: 94.x
|
||||
|
||||
**References**:
|
||||
- as reported in #95 and discussed [here](https://gitlab.com/librewolf-community/browser/linux/-/issues/246) we are re-enabling TP by default, setting it to strict.
|
||||
- the sponsored shortcuts in about:preferences#home were already locked, now they are properly hidden.
|
||||
- enable fission as it is being [rolled out to stable](https://bugzilla.mozilla.org/show_bug.cgi?id=1732206).
|
||||
|
||||
**Notes**: all the removed preferences were either related to disabling TP, or unecessary when using strict mode. as a result of this trimming the tracking protection section of the .cfg file doesn't need to exist anymore.
|
||||
|
||||
#### Added preferences
|
||||
```
|
||||
defaultPref("browser.topsites.useRemoteSetting", false); // hide sponsored shortcuts button from about:preferences#home
|
||||
defaultPref("privacy.resistFingerprinting.letterboxing", false); // expose hidden letterboxing pref, but do not enable by default
|
||||
defaultPref("fission.autostart", true); // enable fission by default
|
||||
```
|
||||
|
||||
#### Removed preferences
|
||||
```
|
||||
lockPref("privacy.trackingprotection.enabled", false);
|
||||
lockPref("privacy.trackingprotection.pbmode.enabled", false);
|
||||
lockPref("privacy.trackingprotection.annotate_channels", false);
|
||||
defaultPref("browser.safebrowsing.provider.mozilla.updateURL", "");
|
||||
defaultPref("browser.safebrowsing.provider.mozilla.gethashURL", "");
|
||||
defaultPref("privacy.trackingprotection.cryptomining.enabled", false);
|
||||
defaultPref("privacy.trackingprotection.fingerprinting.enabled", false);
|
||||
defaultPref("browser.contentblocking.cryptomining.preferences.ui.enabled", false);
|
||||
defaultPref("browser.contentblocking.fingerprinting.preferences.ui.enabled", false);
|
||||
```
|
||||
|
||||
#### Changed preferences
|
||||
```
|
||||
pref("browser.contentblocking.category", "strict");
|
||||
```
|
||||
|
||||
## 2.0
|
||||
|
||||
**target commit**: from 6451faa167568313e5ed065fcb3ee2bb76132063 to b17a1ed657e22ac61b4399699223d36724b842e7
|
||||
|
||||
**base librewolf version**: 92.x
|
||||
|
||||
**References**:
|
||||
- [web content can no longer access the battery api](https://bugzilla.mozilla.org/show_bug.cgi?id=1313580).
|
||||
- http alternative services are [isolated by network partitioning and FPI](https://github.com/arkenfox/user.js/blob/269cf965bd51022ca69823f8f66a8e402280d856/user.js#L1350) and they are unchanged even in tor browser. from a security standpoint, the alternate service will need to provide the certificate of the origin in order to be considered trusthworthy.
|
||||
|
|
@ -819,9 +120,9 @@ defaultPref("browser.download.useDownloadDir", false); // force user interaction
|
|||
pref("browser.urlbar.quicksuggest.scenario", ""); // disable firefox suggests and hide its UI
|
||||
```
|
||||
|
||||
#### Commented preferences
|
||||
#### Commented prefs
|
||||
```
|
||||
// pref("network.trr.mode", 2); // previously uncommented defaultPref with value 5
|
||||
// pref("network.trr.mode", 2); // previously uncommented defaultPref with value 5
|
||||
// pref("network.trr.uri", "https://dns.quad9.net/dns-query"); // previously uncommented defaultPref with empty value
|
||||
```
|
||||
|
||||
|
|
@ -872,7 +173,7 @@ defaultPref("browser.safebrowsing.downloads.enabled", false);
|
|||
|
||||
## 1.6
|
||||
|
||||
**target commit**: 192f51abe21e9aeb9b01d396079e9b8533cab7bb
|
||||
**target commit**:
|
||||
|
||||
**base librewolf version**: 91.x
|
||||
|
||||
|
|
@ -992,5 +293,4 @@ lockPref("privacy.override_rfp_for_color_scheme", false);
|
|||
|
||||
**base librewolf version**: 89.x
|
||||
|
||||
This is the initial release from which we start tagging and versioning settings. For previous changes see
|
||||
[here](https://gitlab.com/librewolf-community/settings/-/blob/master/docs/changelog-legacy.md).
|
||||
This is the initial release from which we start tagging and versioning settings.
|
||||
|
|
|
|||
792
librewolf.cfg
792
librewolf.cfg
|
|
@ -1,210 +1,189 @@
|
|||
//----------------------|
|
||||
// LibreWolf settings |
|
||||
//----------------------|
|
||||
|
||||
/** LIBREWOLF SETTINGS
|
||||
*
|
||||
* take the time to read and understand, but also to customize the settings to find your own setup.
|
||||
* the answers to the most common questions can be found at https://librewolf.net/docs/faq/.
|
||||
*
|
||||
* WARNING: make sure the first line of this file is empty. this is a known bug.
|
||||
*/
|
||||
lockPref("librewolf.cfg.version", "7.7");
|
||||
|
||||
|
||||
/** INDEX
|
||||
* the file is organized in categories, and each one has a number of sections:
|
||||
*
|
||||
* PRIVACY [ISOLATION, SANITIZING, CACHE AND STORAGE, HISTORY AND SESSION RESTORE, QUERY STRIPPING]
|
||||
* NETWORKING [HTTPS, REFERERS, WEBRTC, PROXY, DNS, PREFETCHING AND SPECULATIVE CONNECTIONS]
|
||||
* FINGERPRINTING [RFP, WEBGL]
|
||||
* SECURITY [SITE ISOLATION, CERTIFICATES, TLS/SSL, PERMISSIONS, SAFE BROWSING, OTHERS]
|
||||
* REGION [LOCATION, LANGUAGE]
|
||||
* BEHAVIOR [DRM, SEARCH AND URLBAR, DOWNLOADS, AUTOPLAY, POP-UPS AND WINDOWS, MOUSE]
|
||||
* EXTENSIONS [USER INSTALLED, SYSTEM, EXTENSION FIREWALL]
|
||||
* BUILT-IN FEATURES [UPDATER, SYNC, LOCKWISE, CONTAINERS, DEVTOOLS, OTHERS]
|
||||
* UI [BRANDING, HANDLERS, FIRST LAUNCH, NEW TAB PAGE, ABOUT, RECOMMENDED]
|
||||
* TELEMETRY
|
||||
* WINDOWS [UPDATES, OTHERS]
|
||||
/**
|
||||
|
||||
NOTE: please take the time to read and understand, but also to customize the settings to find your own setup.
|
||||
the answers to the most common questions are at this link https://gitlab.com/librewolf-community/settings/-/wikis/FAQ
|
||||
|
||||
*/
|
||||
|
||||
defaultPref("librewolf.cfg.version", "2.0");
|
||||
|
||||
// -------------------------------------------
|
||||
// # SANITIZING COOKIES AND HISTORY, SESSIONS
|
||||
// -------------------------------------------
|
||||
|
||||
/** [CATEGORY] PRIVACY */
|
||||
defaultPref("network.cookie.cookieBehavior", 5); // dFPI, same as strict mode
|
||||
defaultPref("network.cookie.lifetimePolicy", 2); // keep cookies until the browser is closed then delete everything minus exceptions
|
||||
|
||||
/** [SECTION] ISOLATION
|
||||
* default to strict mode, which includes:
|
||||
* 1. dFPI for both normal and private windows
|
||||
* 2. strict blocking lists for trackers
|
||||
* 3. shims to avoid breakage caused by blocking lists
|
||||
* 4. stricter policies for xorigin referrers
|
||||
* 5. dFPI specific cookie cleaning mechanism
|
||||
* 6. query stripping
|
||||
*
|
||||
* the desired category must be set with pref() otherwise it won't stick.
|
||||
* the UI that allows to change mode manually is hidden.
|
||||
*/
|
||||
pref("browser.contentblocking.category", "strict");
|
||||
// enable APS
|
||||
defaultPref("privacy.partition.always_partition_third_party_non_cookie_storage", true);
|
||||
defaultPref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false);
|
||||
// make third party and http cookies session-only
|
||||
defaultPref("network.cookie.thirdparty.sessionOnly", true);
|
||||
defaultPref("network.cookie.thirdparty.nonsecureSessionOnly", true);
|
||||
|
||||
/** [SECTION] SANITIZING
|
||||
* all the cleaning prefs true by default except for siteSetting and offlineApps,
|
||||
* which is what we want. users should set manual exceptions in the UI if there
|
||||
* are cookies they want to keep.
|
||||
*/
|
||||
defaultPref("privacy.clearOnShutdown.offlineApps", true);
|
||||
/**
|
||||
this way of sanitizing would override the exceptions set by the users and just delete everything,
|
||||
therefore we tell it to delete everything but ignore data needed to stay logged into websites set
|
||||
manually as exceptions.
|
||||
*/
|
||||
defaultPref("privacy.clearOnShutdown.cookies", false);
|
||||
defaultPref("privacy.clearOnShutdown.offlineApps", false);
|
||||
defaultPref("privacy.sanitize.sanitizeOnShutdown", true);
|
||||
defaultPref("privacy.sanitize.timeSpan", 0);
|
||||
|
||||
/** [SECTION] CACHE AND STORAGE */
|
||||
defaultPref("browser.cache.disk.enable", false); // disable disk cache
|
||||
/** prevent media cache from being written to disk in pb, but increase max cache size to avoid playback issues */
|
||||
defaultPref("browser.privatebrowsing.forceMediaMemoryCache", true);
|
||||
defaultPref("media.memory_cache_max_size", 65536);
|
||||
defaultPref("browser.shell.shortcutFavicons", false); // disable favicons in profile folder
|
||||
defaultPref("browser.helperApps.deleteTempFileOnExit", true); // delete temporary files opened with external apps
|
||||
// disable browsing, search and form history
|
||||
defaultPref("places.history.enabled", false);
|
||||
defaultPref("browser.formfill.enable", false);
|
||||
|
||||
/** [SECTION] HISTORY AND SESSION RESTORE
|
||||
* since we hide the UI for modes other than custom we want to reset it for
|
||||
* everyone. same thing for always on PB mode.
|
||||
*/
|
||||
pref("privacy.history.custom", true);
|
||||
pref("browser.privatebrowsing.autostart", false);
|
||||
defaultPref("browser.formfill.enable", false); // disable form history
|
||||
defaultPref("browser.sessionstore.privacy_level", 2); // prevent websites from storing session data like cookies and forms
|
||||
// prevent websites from storing session data like cookies and forms, increase time between session saves
|
||||
defaultPref("browser.sessionstore.privacy_level", 2);
|
||||
defaultPref("browser.sessionstore.interval", 60000);
|
||||
|
||||
/** [SECTION] QUERY STRIPPING
|
||||
* currently we set the same query stripping list that brave uses:
|
||||
* https://github.com/brave/brave-core/blob/f337a47cf84211807035581a9f609853752a32fb/browser/net/brave_site_hacks_network_delegate_helper.cc#L29
|
||||
*/
|
||||
defaultPref("privacy.query_stripping.strip_list", "__hsfp __hssc __hstc __s _hsenc _openstat dclid fbclid gbraid gclid hsCtaTracking igshid mc_eid ml_subscriber ml_subscriber_hash msclkid oft_c oft_ck oft_d oft_id oft_ids oft_k oft_lk oft_sk oly_anon_id oly_enc_id rb_clickid s_cid twclid vero_conv vero_id wbraid wickedid yclid");
|
||||
/**
|
||||
* librewolf specific pref that allows to include the query stripping lists in uBO by default.
|
||||
* the asset file is fetched every 7 days.
|
||||
*/
|
||||
defaultPref("librewolf.uBO.assetsBootstrapLocation", "https://gitlab.com/librewolf-community/browser/source/-/raw/main/assets/uBOAssets.json");
|
||||
// ----------------------
|
||||
// # NETWORKING
|
||||
// ----------------------
|
||||
|
||||
/** [SECTION] LOGGING
|
||||
* these prefs are off by default in the official Mozilla builds,
|
||||
* so it only makes sense that we also disable them.
|
||||
* See https://gitlab.com/librewolf-community/settings/-/issues/240
|
||||
*/
|
||||
pref("browser.dom.window.dump.enabled", false);
|
||||
pref("devtools.console.stdout.chrome", false);
|
||||
|
||||
|
||||
|
||||
/** [CATEGORY] NETWORKING */
|
||||
|
||||
/** [SECTION] HTTPS */
|
||||
// https and mixed content
|
||||
defaultPref("dom.security.https_only_mode", true); // only allow https in all windows, including private browsing
|
||||
defaultPref("network.auth.subresource-http-auth-allow", 1); // block HTTP authentication credential dialogs
|
||||
defaultPref("network.auth.subresource-http-auth-allow", 1); // stop cross-origin resources from using HTTP authentication
|
||||
defaultPref("security.insecure_connection_text.enabled", true); // display http websites as insecure in the ui
|
||||
defaultPref("security.mixed_content.block_display_content", true); // block insecure passive content
|
||||
|
||||
/** [SECTION] REFERERS
|
||||
* to enhance privacy but keep a certain level of usability we trim cross-origin
|
||||
* referers to only send scheme, host and port, instead of completely avoid sending them.
|
||||
* as a general rule, the behavior of referes which are not cross-origin should not
|
||||
* be changed.
|
||||
*/
|
||||
defaultPref("network.http.referer.XOriginTrimmingPolicy", 2);
|
||||
defaultPref("network.dns.disableIPv6", true); // disable ipv6
|
||||
|
||||
/** [SECTION] WEBRTC
|
||||
* there is no point in disabling webrtc as mDNS protects the private IP on linux, osx and win10+.
|
||||
* the private IP address is only used in trusted environments, eg. allowed camera and mic access.
|
||||
*/
|
||||
defaultPref("media.peerconnection.ice.default_address_only", true); // use a single interface for ICE candidates, the vpn one when a vpn is used
|
||||
// always send xorigin referer but trim them
|
||||
defaultPref("network.http.referer.XOriginPolicy", 0); // default, might be worth changing to 2
|
||||
defaultPref("network.http.referer.XOriginTrimmingPolicy", 2); // trim referer to only send scheme, host and port
|
||||
|
||||
/** [SECTION] PROXY */
|
||||
defaultPref("network.gio.supported-protocols", ""); // disable gio as it could bypass proxy
|
||||
defaultPref("network.file.disable_unc_paths", true); // hidden, disable using uniform naming convention to prevent proxy bypass
|
||||
defaultPref("network.file.disable_unc_paths", true); // hidden, disable using uniform naming convention
|
||||
defaultPref("network.IDN_show_punycode", true); // use punycode in idn to prevent spoofing
|
||||
|
||||
// proxy
|
||||
defaultPref("network.proxy.socks_remote_dns", true); // forces dns query through the proxy when using one
|
||||
defaultPref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // force webrtc inside proxy when one is used
|
||||
defaultPref("network.gio.supported-protocols", ""); // disable gio as it could bypass proxy
|
||||
|
||||
/** [SECTION] DNS */
|
||||
// doh
|
||||
defaultPref("network.trr.confirmationNS", "skip"); // skip undesired doh test connection
|
||||
/**
|
||||
0 = default
|
||||
1 = browser picks faster
|
||||
2 = DoH with system dns fallback
|
||||
3 = DoH without fallback
|
||||
5 = DoH is off, default currently
|
||||
|
||||
below prefs must be applied with pref in order to work
|
||||
*/
|
||||
// pref("network.trr.mode", 2);
|
||||
// pref("network.trr.uri", "https://dns.quad9.net/dns-query");
|
||||
|
||||
// prefetching
|
||||
defaultPref("network.dns.disablePrefetch", true); // disable dns prefetching
|
||||
/**
|
||||
* librewolf does not use DoH, but it can be enabled with the following prefs:
|
||||
* pref("network.trr.mode", 2);
|
||||
* pref("network.trr.uri", "https://dns.quad9.net/dns-query");
|
||||
*
|
||||
* the possible modes are:
|
||||
* 0 = default
|
||||
* 1 = browser picks faster
|
||||
* 2 = DoH with system dns fallback
|
||||
* 3 = DoH without fallback
|
||||
* 5 = DoH is off, default currently
|
||||
*/
|
||||
lockPref("network.predictor.enabled", false); // disable predictor
|
||||
lockPref("network.prefetch-next", false); // disable link prefetching
|
||||
lockPref("network.http.speculative-parallel-limit", 0); // disable prefetching on mouse over
|
||||
|
||||
/** [SECTION] PREFETCHING AND SPECULATIVE CONNECTIONS
|
||||
* disable prefecthing for different things such as links, bookmarks and predictions.
|
||||
*/
|
||||
pref("network.predictor.enabled", false);
|
||||
pref("network.prefetch-next", false);
|
||||
pref("network.http.speculative-parallel-limit", 0);
|
||||
defaultPref("browser.places.speculativeConnect.enabled", false);
|
||||
// disable speculative connections and domain guessing from the urlbar
|
||||
defaultPref("browser.urlbar.speculativeConnect.enabled", false);
|
||||
defaultPref("network.manage-offline-status", false); // let user control the offline behavior
|
||||
|
||||
// ------------
|
||||
// # DOM
|
||||
// ------------
|
||||
|
||||
// pop-ups and window related preferences
|
||||
defaultPref("dom.disable_beforeunload", true); // disable "confirm you want to leave" pop-ups on close
|
||||
defaultPref("dom.disable_open_during_load", true); // block pop-ups windows
|
||||
defaultPref("dom.popup_maximum", 4); // limit maximum number of pop-ups
|
||||
defaultPref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); // limit events that cause pop-ups
|
||||
defaultPref("dom.disable_window_move_resize", true); // block scripts from resizing windows
|
||||
defaultPref("browser.link.open_newwindow", 3); // open 'new windows' targeted links in 'new tab'
|
||||
defaultPref("browser.link.open_newwindow.restriction", 0); // ignore the size when applying the above pref
|
||||
|
||||
/** [CATEGORY] FINGERPRINTING */
|
||||
// push notifications and service workeers
|
||||
defaultPref("dom.push.enabled", false); // disable push notifications
|
||||
defaultPref("dom.push.serverURL", ""); // default "wss://push.services.mozilla.com/"
|
||||
defaultPref("dom.serviceWorkers.enabled", false); // disable service workers, must enable for push notifications
|
||||
|
||||
/** [SECTION] RFP
|
||||
* librewolf should stick to RFP for fingerprinting. we should not set prefs that interfere with it
|
||||
* and disabling API for no good reason will be counter productive, so it should also be avoided.
|
||||
*/
|
||||
defaultPref("privacy.resistFingerprinting", true);
|
||||
// rfp related settings
|
||||
// --------------------------------
|
||||
// # CACHE AND TEMPORARY FILES
|
||||
// --------------------------------
|
||||
|
||||
defaultPref("browser.cache.disk.enable", false); // disable disk cache
|
||||
defaultPref("browser.privatebrowsing.forceMediaMemoryCache", true); // block media cache from writing to disk in pb mode
|
||||
defaultPref("media.memory_cache_max_size", 65536); // increase max cache size to avoid playback issues caused by above setting
|
||||
|
||||
defaultPref("browser.shell.shortcutFavicons", false); // disable shortcut favicons from being stored in profile
|
||||
defaultPref("browser.helperApps.deleteTempFileOnExit", true); // delete temporary files opened with external apps
|
||||
defaultPref("browser.pagethumbnails.capturing_disabled", true); // disable page thumbnails capturing
|
||||
|
||||
// ----------------------
|
||||
// # MEDIA
|
||||
// ----------------------
|
||||
|
||||
// disable webrtc
|
||||
defaultPref("media.peerconnection.enabled", false); // master switch
|
||||
|
||||
// limit potential IP leaks for webrtc users
|
||||
defaultPref("media.peerconnection.ice.default_address_only", true); // use public IP for ICE candidates
|
||||
defaultPref("media.peerconnection.ice.no_host", true); // don't use local IP for ICE candidates
|
||||
defaultPref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // force webrtc inside proxy for proxy users
|
||||
|
||||
// autoplay
|
||||
defaultPref("media.autoplay.blocking_policy", 2); // only allow to play when a certain element is clicked
|
||||
defaultPref("media.autoplay.default", 5); // personal preference, currently apply blocking policy to all autplay including muted
|
||||
|
||||
// --------------------------------------
|
||||
// # FINGERPRINTING
|
||||
// --------------------------------------
|
||||
|
||||
defaultPref("privacy.resistFingerprinting", true); // master switch
|
||||
|
||||
// rfp compatibility settings
|
||||
defaultPref("privacy.resistFingerprinting.block_mozAddonManager", true); // prevents rfp from breaking AMO
|
||||
defaultPref("browser.display.use_system_colors", false); // default, except Win
|
||||
/**
|
||||
* increase the size of new RFP windows for better usability, while still using a rounded value.
|
||||
* if the screen resolution is lower it will stretch to the biggest possible rounded value.
|
||||
* also, expose hidden letterboxing pref but do not enable it for now.
|
||||
*/
|
||||
defaultPref("privacy.window.maxInnerWidth", 1600);
|
||||
defaultPref("privacy.window.maxInnerHeight", 900);
|
||||
defaultPref("privacy.resistFingerprinting.letterboxing", false);
|
||||
defaultPref("browser.startup.blankWindow", false); // if set to true it breaks RFP windows resizing
|
||||
defaultPref("browser.display.use_system_colors", false); // default but enforced due to RFP
|
||||
|
||||
/** [SECTION] WEBGL */
|
||||
defaultPref("webgl.disabled", true);
|
||||
// librewolf specifc pref that prevents rfp from forcing light theme, review
|
||||
lockPref("privacy.override_rfp_for_color_scheme", false);
|
||||
|
||||
defaultPref("webgl.disabled", true); // master switch, disable webgl
|
||||
|
||||
// --------------------------------
|
||||
// # SECURITY
|
||||
// --------------------------------
|
||||
|
||||
/** [CATEGORY] SECURITY */
|
||||
// certificates
|
||||
defaultPref("security.cert_pinning.enforcement_level", 2); // enable strict public key pinning
|
||||
defaultPref("security.pki.sha1_enforcement_level", 1); // disable sha-1 certificates
|
||||
defaultPref("security.OCSP.enabled", 0); // disable OCSP fetching
|
||||
|
||||
/** [SECTION] CERTIFICATES */
|
||||
defaultPref("security.cert_pinning.enforcement_level", 2); // enable strict public key pinning, might cause issues with AVs
|
||||
/**
|
||||
* enable safe negotiation and show warning when it is not supported. might cause breakage
|
||||
* if the the server does not support RFC 5746, in tha case SSL_ERROR_UNSAFE_NEGOTIATION
|
||||
* will be shown.
|
||||
*/
|
||||
defaultPref("security.ssl.require_safe_negotiation", true);
|
||||
defaultPref("security.ssl.treat_unsafe_negotiation_as_broken", true);
|
||||
/**
|
||||
* our strategy with revocation is to perform all possible checks with CRL, but when a cert
|
||||
* cannot be checked with it we use OCSP stapled with hard-fail, to still keep privacy and
|
||||
* increase security.
|
||||
* crlite is in mode 3 by default, which allows us to detect false positive with OCSP.
|
||||
* in v103, when crlite is fully mature, it will switch to mode 2 and no longer double-check.
|
||||
*/
|
||||
defaultPref("security.remote_settings.crlite_filters.enabled", true);
|
||||
defaultPref("security.OCSP.require", true); // set to hard-fail, might cause SEC_ERROR_OCSP_SERVER_ERROR
|
||||
// crl with no OCSP fallback. commented for now but review
|
||||
// defaultPref("security.remote_settings.crlite_filters.enabled", true);
|
||||
// defaultPref("security.pki.crlite_mode", 2);
|
||||
|
||||
/** [SECTION] TLS/SSL */
|
||||
pref("security.tls.enable_0rtt_data", false); // disable 0 RTT to improve tls 1.3 security
|
||||
pref("security.tls.version.enable-deprecated", false); // make TLS downgrades session only by enforcing it with pref(), default
|
||||
defaultPref("browser.xul.error_pages.expert_bad_cert", true); // show relevant and advanced issues on warnings and error screens
|
||||
// safe negotiation
|
||||
defaultPref("security.ssl.require_safe_negotiation", true); // block websites that do not support safe negotiation, occasional breakage
|
||||
defaultPref("security.ssl.treat_unsafe_negotiation_as_broken", true); // show warning when safe negotiation is not enable and website is accessed
|
||||
|
||||
/** [SECTION] PERMISSIONS */
|
||||
pref("permissions.delegation.enabled", false); // force permission request to show real origin
|
||||
pref("permissions.manager.defaultsUrl", ""); // revoke special permissions for some mozilla domains
|
||||
// tls behavior
|
||||
lockPref("security.tls.enable_0rtt_data", false); // disable 0 round trip time to improve tls 1.3 security
|
||||
defaultPref("security.tls.version.enable-deprecated", false); // default but helps resetting the preference
|
||||
defaultPref("browser.ssl_override_behavior", 1); // prepopulate url on ssl warning screens
|
||||
defaultPref("browser.xul.error_pages.expert_bad_cert", true); // advanced ui infos for broken connections
|
||||
|
||||
/** [SECTION] SAFE BROWSING
|
||||
* disable safe browsing, including the fetch of updates. reverting the 7 prefs below
|
||||
* allows to perform local checks and to fetch updated lists from google.
|
||||
*/
|
||||
// permissions
|
||||
lockPref("permissions.delegation.enabled", false); // force permission request to show the real origin
|
||||
lockPref("permissions.manager.defaultsUrl", ""); // revoke special permissions from some mozilla domains
|
||||
|
||||
defaultPref("gfx.font_rendering.opentype_svg.enabled", false); // disale svg opentype fonts
|
||||
|
||||
defaultPref("browser.download.useDownloadDir", false); // force user interaction on downloads, by always asking location
|
||||
|
||||
lockPref("security.csp.enable", true); // default
|
||||
|
||||
// ---------------------------------
|
||||
// # SAFE BROWSING
|
||||
// ---------------------------------
|
||||
|
||||
// disable safe browsing, including the fetch of updates and all outgoing connections
|
||||
defaultPref("browser.safebrowsing.malware.enabled", false);
|
||||
defaultPref("browser.safebrowsing.phishing.enabled", false);
|
||||
defaultPref("browser.safebrowsing.blockedURIs.enabled", false);
|
||||
|
|
@ -212,193 +191,217 @@ defaultPref("browser.safebrowsing.provider.google4.gethashURL", "");
|
|||
defaultPref("browser.safebrowsing.provider.google4.updateURL", "");
|
||||
defaultPref("browser.safebrowsing.provider.google.gethashURL", "");
|
||||
defaultPref("browser.safebrowsing.provider.google.updateURL", "");
|
||||
/**
|
||||
* disable safe browsing checks on downloads, both local and remote. the resetting prefs
|
||||
* control remote checks, while the first one is for local checks only.
|
||||
*/
|
||||
|
||||
// disable safe browsing checks on downloads, both local and remote
|
||||
defaultPref("browser.safebrowsing.downloads.enabled", false);
|
||||
pref("browser.safebrowsing.downloads.remote.enabled", false);
|
||||
pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
|
||||
pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
|
||||
// empty for defense in depth
|
||||
pref("browser.safebrowsing.downloads.remote.url", "");
|
||||
pref("browser.safebrowsing.provider.google4.dataSharingURL", "");
|
||||
lockPref("browser.safebrowsing.downloads.remote.enabled", false);
|
||||
lockPref("browser.safebrowsing.downloads.remote.url", "");
|
||||
lockPref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
|
||||
lockPref("browser.safebrowsing.downloads.remote.block_uncommon", false);
|
||||
|
||||
/** [SECTION] OTHERS */
|
||||
defaultPref("network.IDN_show_punycode", true); // use punycode in idn to prevent spoofing
|
||||
defaultPref("pdfjs.enableScripting", false); // disable js scripting in the built-in pdf reader
|
||||
// other safe browsing options, all default but enforce
|
||||
lockPref("browser.safebrowsing.passwords.enabled", false);
|
||||
lockPref("browser.safebrowsing.provider.google4.dataSharing.enabled", false);
|
||||
lockPref("browser.safebrowsing.provider.google4.dataSharingURL", "");
|
||||
|
||||
// -----------------------
|
||||
// # DRM
|
||||
// -----------------------
|
||||
|
||||
defaultPref("media.eme.enabled", false); // disable drm content, master switch that also controls widevine plugin
|
||||
defaultPref("media.gmp-manager.url", "data:text/plain,"); // prevent outgoing connections when DRM is disabled
|
||||
|
||||
/** [CATEGORY] REGION */
|
||||
|
||||
/** [SECTION] LOCATION
|
||||
* replace google with mozilla as the default geolocation provide and prevent use of OS location services
|
||||
*/
|
||||
defaultPref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
|
||||
defaultPref("geo.provider.ms-windows-location", false); // [WINDOWS]
|
||||
defaultPref("geo.provider.use_corelocation", false); // [MAC]
|
||||
defaultPref("geo.provider.use_gpsd", false); // [LINUX]
|
||||
defaultPref("geo.provider.use_geoclue", false); // [LINUX]
|
||||
|
||||
/** [SECTION] LANGUAGE
|
||||
* show language as en-US for all users, regardless of their OS language and browser language.
|
||||
* both prefs must use pref() and not defaultPref to work.
|
||||
*/
|
||||
pref("javascript.use_us_english_locale", true);
|
||||
pref("intl.accept_languages", "en-US, en");
|
||||
// disable region specific updates from mozilla
|
||||
pref("browser.region.network.url", "");
|
||||
pref("browser.region.update.enabled", false);
|
||||
|
||||
|
||||
|
||||
/** [CATEGORY] BEHAVIOR */
|
||||
|
||||
/** [SECTION] DRM */
|
||||
defaultPref("media.eme.enabled", false); // master switch for drm content
|
||||
defaultPref("media.gmp-manager.url", "data:text/plain,"); // prevent checks for plugin updates when drm is disabled
|
||||
// disable the widevine and the openh264 plugins
|
||||
// disable the openh264 plugin
|
||||
defaultPref("media.gmp-provider.enabled", false);
|
||||
defaultPref("media.gmp-gmpopenh264.enabled", false);
|
||||
|
||||
/** [SECTION] SEARCH AND URLBAR
|
||||
* disable search suggestion and do not update opensearch engines.
|
||||
*/
|
||||
// ---------------------------------------------
|
||||
// # LOCATION, LANGUAGE AND REGION
|
||||
// ---------------------------------------------
|
||||
|
||||
defaultPref("geo.enabled", false); // block geo api, behind a prompt so review
|
||||
defaultPref("permissions.default.geo", 2); // review as well
|
||||
|
||||
// use mozilla geo service as deault
|
||||
defaultPref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
|
||||
|
||||
// prevent use of OS location services
|
||||
lockPref("geo.provider.ms-windows-location", false); // [WINDOWS]
|
||||
lockPref("geo.provider.use_corelocation", false); // [MAC]
|
||||
lockPref("geo.provider.use_gpsd", false); // [LINUX]
|
||||
|
||||
// show language as en-US for all users, regardless of their OS language and local version, to avoid leaking
|
||||
defaultPref("javascript.use_us_english_locale", true);
|
||||
defaultPref("intl.locale.requested", "en-US");
|
||||
defaultPref("privacy.spoof_english", 2);
|
||||
|
||||
// disable region updates
|
||||
lockPref("browser.region.network.url", "");
|
||||
lockPref("browser.region.update.enabled", false);
|
||||
|
||||
// --------------------------------
|
||||
// # SEARCH AND URLBAR
|
||||
// --------------------------------
|
||||
|
||||
// disable search suggestions
|
||||
defaultPref("browser.urlbar.suggest.searches", false);
|
||||
defaultPref("browser.search.suggest.enabled", false);
|
||||
defaultPref("browser.search.update", false);
|
||||
/**
|
||||
* the pref disables the whole feature and hide it from the ui
|
||||
* (as noted in https://bugzilla.mozilla.org/show_bug.cgi?id=1755057).
|
||||
* this also includes the best match feature, as it is part of firefox suggest.
|
||||
*/
|
||||
pref("browser.urlbar.quicksuggest.enabled", false);
|
||||
defaultPref("browser.urlbar.suggest.weather", false); // disable weather suggestions in urlbar once they are no longer behind feature gate
|
||||
pref("browser.urlbar.quicksuggest.scenario", ""); // disable firefox suggests and hide its UI
|
||||
|
||||
/** [SECTION] DOWNLOADS
|
||||
* user interaction should always be required for downloads, as a way to enhance security by asking
|
||||
* the user to specific a certain save location.
|
||||
*/
|
||||
defaultPref("browser.download.useDownloadDir", false);
|
||||
defaultPref("browser.download.autohideButton", false); // do not hide download button automatically
|
||||
defaultPref("browser.download.manager.addToRecentDocs", false); // do not add downloads to recents
|
||||
defaultPref("browser.download.alwaysOpenPanel", false); // do not expand toolbar menu for every download, we already have enough interaction
|
||||
defaultPref("browser.search.region", "US"); // set a default search region for all users
|
||||
defaultPref("browser.search.update", false); // do not update open search search engines
|
||||
defaultPref("browser.urlbar.trimURLs", false); // do not trim urls in the urlbar
|
||||
|
||||
/** [SECTION] AUTOPLAY
|
||||
* block autoplay unless element is right-clicked. this means background videos, videos in a different tab,
|
||||
* or media opened while other media is played will not start automatically.
|
||||
* thumbnails will not autoplay unless hovered. exceptions can be set from the UI.
|
||||
*/
|
||||
defaultPref("media.autoplay.default", 5);
|
||||
// urlbar-dns interactions, avoid unwanted and speculative connections
|
||||
defaultPref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
|
||||
defaultPref("browser.urlbar.speculativeConnect.enabled", false);
|
||||
lockPref("browser.fixup.alternate.enabled", false);
|
||||
|
||||
/** [SECTION] POP-UPS AND WINDOWS
|
||||
* prevent scripts from resizing existing windows and opening new ones, by forcing them into
|
||||
* new tabs that can't be resized as well.
|
||||
*/
|
||||
defaultPref("dom.disable_window_move_resize", true);
|
||||
defaultPref("browser.link.open_newwindow", 3);
|
||||
defaultPref("browser.link.open_newwindow.restriction", 0);
|
||||
// ----------------------------------
|
||||
// # BROWSER BEHAVIOR
|
||||
// ----------------------------------
|
||||
|
||||
/** [SECTION] MOUSE */
|
||||
defaultPref("browser.tabs.searchclipboardfor.middleclick", false); // prevent mouse middle click on new tab button to trigger searches or page loads
|
||||
lockPref("app.update.auto", false); // disable update auto installs
|
||||
|
||||
// password manager
|
||||
defaultPref("signon.rememberSignons", false); // disable saving passwords in the browser
|
||||
defaultPref("signon.autofillForms", false); // disable username and password autofills
|
||||
defaultPref("signon.formlessCapture.enabled", false); // disable formless login capture
|
||||
|
||||
|
||||
/** [CATEGORY] EXTENSIONS */
|
||||
|
||||
/** [SECTION] USER INSTALLED
|
||||
* extensions are allowed to operate on restricted domains, while their scope
|
||||
* is set to profile+applications (https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/).
|
||||
* an installation prompt should always be displayed.
|
||||
*/
|
||||
defaultPref("extensions.webextensions.restrictedDomains", "");
|
||||
defaultPref("extensions.enabledScopes", 5); // hidden
|
||||
defaultPref("extensions.postDownloadThirdPartyPrompt", false);
|
||||
/**
|
||||
* the pref disables quarantined domains.
|
||||
* this is a security feature, we should remove it with v116 as there will be a UI to control this per-extension.
|
||||
* unless we patch remote settings we rely on static dumps. this means even if we did not flip this pref it would
|
||||
* not make a difference at the moment.
|
||||
*/
|
||||
defaultPref("extensions.quarantinedDomains.enabled", false);
|
||||
|
||||
/** [SECTION] SYSTEM
|
||||
* built-in extension are not allowed to auto-update. additionally the reporter extension
|
||||
* of webcompat is disabled. urls are stripped for defense in depth.
|
||||
*/
|
||||
defaultPref("extensions.systemAddon.update.enabled", false);
|
||||
defaultPref("extensions.systemAddon.update.url", "");
|
||||
lockPref("extensions.webcompat-reporter.enabled", false);
|
||||
lockPref("extensions.webcompat-reporter.newIssueEndpoint", "");
|
||||
|
||||
/** [SECTION] EXTENSION FIREWALL
|
||||
* the firewall can be enabled with the below prefs, but it is not a sane default:
|
||||
* defaultPref("extensions.webextensions.base-content-security-policy", "default-src 'none'; script-src 'none'; object-src 'none';");
|
||||
* defaultPref("extensions.webextensions.base-content-security-policy.v3", "default-src 'none'; script-src 'none'; object-src 'none';");
|
||||
*/
|
||||
|
||||
|
||||
|
||||
/** [CATEGORY] BUILT-IN FEATURES */
|
||||
|
||||
/** [SECTION] UPDATER
|
||||
* since we do not bake auto-updates in the browser it doesn't make sense at the moment.
|
||||
*/
|
||||
lockPref("app.update.auto", false);
|
||||
|
||||
/** [SECTION] SYNC
|
||||
* this functionality is disabled by default but it can be activated in one click.
|
||||
* this pref fully controls the feature, including its ui.
|
||||
*/
|
||||
defaultPref("identity.fxaccounts.enabled", false);
|
||||
|
||||
/** [SECTION] LOCKWISE
|
||||
* disable the default password manager built into the browser, including its autofill
|
||||
* capabilities and formless login capture.
|
||||
*/
|
||||
defaultPref("signon.rememberSignons", false);
|
||||
defaultPref("signon.autofillForms", false);
|
||||
// autofill
|
||||
defaultPref("extensions.formautofill.available", "off");
|
||||
defaultPref("extensions.formautofill.addresses.enabled", false);
|
||||
defaultPref("extensions.formautofill.creditCards.enabled", false);
|
||||
defaultPref("signon.formlessCapture.enabled", false);
|
||||
defaultPref("extensions.formautofill.creditCards.available", false);
|
||||
defaultPref("extensions.formautofill.heuristics.enabled", false);
|
||||
|
||||
/** [SECTION] CONTAINERS
|
||||
* enable containers and show the settings to control them in the stock ui
|
||||
// mouse and input
|
||||
defaultPref("general.autoScroll", false); // prevent mouse middle click from triggering scrolling
|
||||
defaultPref("middlemouse.contentLoadURL", false); // prevent mouse middle click from opening links
|
||||
defaultPref("clipboard.autocopy", false); // disable autocopy to clibpboard
|
||||
|
||||
// containers
|
||||
defaultPref("privacy.userContext.enabled", true); // enable containers
|
||||
defaultPref("privacy.userContext.ui.enabled", true); // enable containers ui
|
||||
|
||||
defaultPref("pdfjs.enableScripting", false); // block pdf js scripting
|
||||
|
||||
defaultPref("accessibility.force_disabled", 1); // block accessibility services
|
||||
|
||||
// devtools
|
||||
defaultPref("devtools.chrome.enabled", false); // disable chrome debugging tools
|
||||
defaultPref("devtools.debugger.remote-enabled", false); // default, disable remote debugging
|
||||
defaultPref("devtools.remote.adb.extensionURL", ""); // url to download ad extension
|
||||
defaultPref("devtools.selfxss.count", 0); // see https://gitlab.com/librewolf-community/browser/linux/-/issues/80
|
||||
|
||||
// misc
|
||||
defaultPref("browser.shell.checkDefaultBrowser", false); // do not check if default browser
|
||||
defaultPref("browser.tabs.drawInTitlebar", true); // hide titlebar
|
||||
defaultPref("browser.aboutConfig.showWarning", false); // disable about:config warning
|
||||
defaultPref("browser.download.autohideButton", false); // hide download button automatically
|
||||
defaultPref("browser.download.manager.addToRecentDocs", false); // do not add downloads to recents
|
||||
defaultPref("browser.tabs.loadBookmarksInTabs", true); // always open bookmarks in new tab
|
||||
|
||||
// -----------------------------------
|
||||
// # TRACKING PROTECTION
|
||||
// -----------------------------------
|
||||
|
||||
pref("browser.contentblocking.category", "custom"); // set tracking protection category, using pref solves the UI bug
|
||||
|
||||
// enable / disable TP in normal and private browsing
|
||||
lockPref("privacy.trackingprotection.enabled", false);
|
||||
lockPref("privacy.trackingprotection.pbmode.enabled", false);
|
||||
|
||||
lockPref("privacy.trackingprotection.annotate_channels", false); // reduce priority of trackers, remove if TP is on
|
||||
|
||||
// remove urls to fetch contentblocking lists.
|
||||
// without these urls TP cannot work. the lists are not shipped with the browser but download on first launch.
|
||||
defaultPref("browser.safebrowsing.provider.mozilla.updateURL", "");
|
||||
defaultPref("browser.safebrowsing.provider.mozilla.gethashURL", "");
|
||||
|
||||
// disable blocking lists and hide ui elements in custom mode UI, if TP is enabled revert to true
|
||||
defaultPref("privacy.trackingprotection.cryptomining.enabled", false);
|
||||
defaultPref("privacy.trackingprotection.fingerprinting.enabled", false);
|
||||
defaultPref("browser.contentblocking.cryptomining.preferences.ui.enabled", false);
|
||||
defaultPref("browser.contentblocking.fingerprinting.preferences.ui.enabled", false);
|
||||
|
||||
// hide annoying ui elements from about:protections
|
||||
defaultPref("browser.contentblocking.report.lockwise.enabled", false);
|
||||
defaultPref("browser.contentblocking.report.monitor.enabled", false);
|
||||
lockPref("browser.contentblocking.report.hide_vpn_banner", true);
|
||||
lockPref("browser.contentblocking.report.vpn.enabled", false);
|
||||
lockPref("browser.contentblocking.report.show_mobile_app", false);
|
||||
|
||||
// --------------------------------------
|
||||
// # EXTENSIONS
|
||||
// --------------------------------------
|
||||
|
||||
/**
|
||||
allow extensions to work on all domains.
|
||||
default is "debug-notes.log"
|
||||
*/
|
||||
defaultPref("privacy.userContext.enabled", true);
|
||||
defaultPref("privacy.userContext.ui.enabled", true);
|
||||
defaultPref("extensions.webextensions.restrictedDomains", "");
|
||||
|
||||
/** [SECTION] DEVTOOLS
|
||||
* disable remote debugging.
|
||||
*/
|
||||
pref("devtools.debugger.remote-enabled", false); // default, but subject to branding so keep it
|
||||
defaultPref("devtools.selfxss.count", 0); // required for devtools console to work
|
||||
// set extensions scopes
|
||||
defaultPref("extensions.enabledScopes", 5);
|
||||
defaultPref("extensions.autoDisableScopes", 11);
|
||||
|
||||
defaultPref("extensions.postDownloadThirdPartyPrompt", false); // force install prompt for thrid party extensions
|
||||
|
||||
/**
|
||||
prevent users from adding lang packs, which would cause leaks.
|
||||
default is https://services.addons.mozilla.org/api/v3/addons/language-tools/?app=firefox&type=language&appversion=%VERSION%
|
||||
*/
|
||||
defaultPref("extensions.getAddons.langpacks.url", "");
|
||||
|
||||
// about:addons ui
|
||||
defaultPref("extensions.getAddons.showPane", false); // disable recommendations section
|
||||
defaultPref("extensions.htmlaboutaddons.recommendations.enabled", false); // disable recommendations from addons list
|
||||
defaultPref("lightweightThemes.getMoreURL", ""); // disable button to get more themes
|
||||
|
||||
// background checking and updating of extensions
|
||||
defaultPref("extensions.update.enabled", false); // disable automatic checks for extension updates
|
||||
defaultPref("extensions.update.autoUpdateDefault", false); // disable automatic installs of extension updates
|
||||
defaultPref("extensions.getAddons.cache.enabled", false); // disable fetching of extension metadata
|
||||
|
||||
// extension firewall, disabled by default
|
||||
// defaultPref("extensions.webextensions.base-content-security-policy", "default-src 'none'; script-src 'none'; object-src 'none';");
|
||||
// defaultPref("extensions.webextensions.base-content-security-policy.v3", "default-src 'none'; script-src 'none'; object-src 'none';");
|
||||
|
||||
// report site issue, disable button and url for in depth defense
|
||||
lockPref("extensions.webcompat-reporter.enabled", false);
|
||||
lockPref("extensions.webcompat-reporter.newIssueEndpoint", "");
|
||||
|
||||
// system addons, prevent updates and strip url for in depth defense
|
||||
defaultPref("extensions.systemAddon.update.enabled", false);
|
||||
defaultPref("extensions.systemAddon.update.url", "");
|
||||
|
||||
/** [SECTION] OTHERS */
|
||||
pref("webchannel.allowObject.urlWhitelist", ""); // remove web channel whitelist
|
||||
defaultPref("services.settings.server", "https://%.invalid") // set the remote settings URL (REMOTE_SETTINGS_SERVER_URL in the code)
|
||||
// --------------------------------
|
||||
// # URLS AND ANNOYANCES
|
||||
// --------------------------------
|
||||
|
||||
|
||||
|
||||
/** [CATEGORY] UI */
|
||||
|
||||
/** [SECTION] BRANDING
|
||||
* set librewolf support and releases urls in the UI, so that users land in the proper places.
|
||||
*/
|
||||
defaultPref("app.support.baseURL", "https://support.librewolf.net/");
|
||||
defaultPref("browser.search.searchEnginesURL", "https://librewolf.net/docs/faq/#how-do-i-add-a-search-engine");
|
||||
defaultPref("browser.geolocation.warning.infoURL", "https://librewolf.net/docs/faq/#how-do-i-enable-location-aware-browsing");
|
||||
defaultPref("app.feedback.baseURL", "https://librewolf.net/#questions");
|
||||
// set librewolf support and releases urls
|
||||
defaultPref("app.support.baseURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support#");
|
||||
defaultPref("browser.search.searchEnginesURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support#search");
|
||||
defaultPref("browser.geolocation.warning.infoURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support#location");
|
||||
defaultPref("app.feedback.baseURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support");
|
||||
defaultPref("app.releaseNotesURL", "https://gitlab.com/librewolf-community/browser");
|
||||
defaultPref("app.releaseNotesURL.aboutDialog", "https://gitlab.com/librewolf-community/browser");
|
||||
defaultPref("app.update.url.details", "https://gitlab.com/librewolf-community/browser");
|
||||
defaultPref("app.update.url.manual", "https://gitlab.com/librewolf-community/browser");
|
||||
|
||||
/** [SECTION] FIRST LAUNCH
|
||||
* disable what's new and ui tour on first start and updates. the browser
|
||||
* should also not stress user about being the default one.
|
||||
*/
|
||||
// remove default handlers and translation engine
|
||||
lockPref("gecko.handlerService.schemes.mailto.0.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.mailto.0.name", "");
|
||||
lockPref("gecko.handlerService.schemes.mailto.1.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.mailto.1.name", "");
|
||||
lockPref("gecko.handlerService.schemes.irc.0.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.irc.0.name", "");
|
||||
lockPref("gecko.handlerService.schemes.ircs.0.uriTemplate", "");
|
||||
lockPref("gecko.handlerService.schemes.ircs.0.name", "");
|
||||
lockPref("browser.translation.engine", "");
|
||||
|
||||
// disable welcome, what's new pages and ui tour
|
||||
defaultPref("browser.startup.homepage_override.mstone", "ignore");
|
||||
defaultPref("startup.homepage_override_url", "about:blank");
|
||||
defaultPref("startup.homepage_welcome_url", "about:blank");
|
||||
|
|
@ -406,58 +409,37 @@ defaultPref("startup.homepage_welcome_url.additional", "");
|
|||
lockPref("browser.messaging-system.whatsNewPanel.enabled", false);
|
||||
lockPref("browser.uitour.enabled", false);
|
||||
lockPref("browser.uitour.url", "");
|
||||
defaultPref("browser.shell.checkDefaultBrowser", false);
|
||||
|
||||
/** [SECTION] NEW TAB PAGE
|
||||
* we want NTP to display nothing but the search bar without anything distracting.
|
||||
* the three prefs below are just for minimalism and they should be easy to revert for users.
|
||||
*/
|
||||
// ------------------------------------
|
||||
// # NEW TAB PAGE
|
||||
// ------------------------------------
|
||||
|
||||
defaultPref("browser.newtab.preload", false);
|
||||
defaultPref("browser.newtabpage.activity-stream.section.highlights.includeDownloads", false);
|
||||
defaultPref("browser.newtabpage.activity-stream.section.highlights.includeVisited", false);
|
||||
defaultPref("browser.newtabpage.activity-stream.feeds.topsites", false);
|
||||
// hide stories and sponsored content from Firefox Home
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
|
||||
defaultPref("browser.newtabpage.activity-stream.feeds.topsites", false);
|
||||
|
||||
// hide pocket and sponsored content, from new tab page and search bar
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.system.topstories", false);
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.telemetry", false);
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"hidden\":true}"); // hide buggy pocket section from about:preferences#home
|
||||
lockPref("browser.newtabpage.activity-stream.showSponsored", false);
|
||||
lockPref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);
|
||||
// disable telemetry in Firefox Home
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.telemetry", false);
|
||||
lockPref("browser.newtabpage.activity-stream.telemetry", false);
|
||||
// hide stories UI in about:preferences#home, empty highlights list
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"hidden\":true}");
|
||||
lockPref("browser.newtabpage.activity-stream.default.sites", "");
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false);
|
||||
lockPref("browser.newtabpage.activity-stream.discoverystream.enabled", false);
|
||||
lockPref("browser.newtabpage.activity-stream.feeds.snippets", false); // default
|
||||
|
||||
/** [SECTION] ABOUT
|
||||
* remove annoying ui elements from the about pages, including about:protections
|
||||
*/
|
||||
defaultPref("browser.contentblocking.report.lockwise.enabled", false);
|
||||
lockPref("browser.contentblocking.report.hide_vpn_banner", true);
|
||||
lockPref("browser.contentblocking.report.vpn.enabled", false);
|
||||
lockPref("browser.contentblocking.report.show_mobile_app", false);
|
||||
lockPref("browser.vpn_promo.enabled", false);
|
||||
lockPref("browser.promo.focus.enabled", false);
|
||||
// ...about:addons recommendations sections and more
|
||||
defaultPref("extensions.htmlaboutaddons.recommendations.enabled", false);
|
||||
defaultPref("extensions.getAddons.showPane", false);
|
||||
defaultPref("extensions.getAddons.cache.enabled", false); // disable fetching of extension metadata
|
||||
defaultPref("lightweightThemes.getMoreURL", ""); // disable button to get more themes
|
||||
// ...about:preferences#home
|
||||
defaultPref("browser.topsites.useRemoteSetting", false); // hide sponsored shortcuts button
|
||||
// ...and about:config
|
||||
defaultPref("browser.aboutConfig.showWarning", false);
|
||||
// hide about:preferences#moreFromMozilla
|
||||
defaultPref("browser.preferences.moreFromMozilla", false);
|
||||
|
||||
/** [SECTION] RECOMMENDED
|
||||
* disable all "recommend as you browse" activity.
|
||||
*/
|
||||
// disable recommend as you browse
|
||||
lockPref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
|
||||
lockPref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
|
||||
|
||||
// --------------------------------
|
||||
// # TELEMETRY
|
||||
// --------------------------------
|
||||
|
||||
|
||||
/** [CATEGORY] TELEMETRY
|
||||
* telemetry is already disabled elsewhere and most of the stuff in here is just for redundancy.
|
||||
*/
|
||||
lockPref("toolkit.telemetry.unified", false); // master switch
|
||||
lockPref("toolkit.telemetry.enabled", false); // master switch
|
||||
lockPref("toolkit.telemetry.server", "data:,");
|
||||
|
|
@ -466,12 +448,13 @@ lockPref("toolkit.telemetry.newProfilePing.enabled", false);
|
|||
lockPref("toolkit.telemetry.updatePing.enabled", false);
|
||||
lockPref("toolkit.telemetry.firstShutdownPing.enabled", false);
|
||||
lockPref("toolkit.telemetry.shutdownPingSender.enabled", false);
|
||||
lockPref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false); // default
|
||||
lockPref("toolkit.telemetry.bhrPing.enabled", false);
|
||||
lockPref("toolkit.telemetry.reportingpolicy.firstRun", false); // default
|
||||
lockPref("toolkit.telemetry.cachedClientID", "");
|
||||
lockPref("toolkit.telemetry.previousBuildID", "");
|
||||
lockPref("toolkit.telemetry.server_owner", "");
|
||||
lockPref("toolkit.coverage.opt-out", true); // hidden
|
||||
lockPref("toolkit.telemetry.coverage.opt-out", true); // hidden
|
||||
lockPref("toolkit.coverage.opt-out", true); // [HIDDEN PREF]
|
||||
lockPref("toolkit.coverage.enabled", false);
|
||||
lockPref("toolkit.coverage.endpoint.base", "");
|
||||
lockPref("toolkit.crashreporter.infoURL", "");
|
||||
|
|
@ -479,47 +462,56 @@ lockPref("datareporting.healthreport.uploadEnabled", false);
|
|||
lockPref("datareporting.policy.dataSubmissionEnabled", false);
|
||||
lockPref("security.protectionspopup.recordEventTelemetry", false);
|
||||
lockPref("browser.ping-centre.telemetry", false);
|
||||
// opt-out of normandy and studies
|
||||
|
||||
// crash report
|
||||
lockPref("breakpad.reportURL", "");
|
||||
lockPref("browser.tabs.crashReporting.sendReport", false);
|
||||
|
||||
// normandy and studies
|
||||
lockPref("app.normandy.enabled", false);
|
||||
lockPref("app.normandy.api_url", "");
|
||||
lockPref("app.shield.optoutstudies.enabled", false);
|
||||
// disable personalized extension recommendations
|
||||
|
||||
// personalized extension recommendations
|
||||
lockPref("browser.discovery.enabled", false);
|
||||
lockPref("browser.discovery.containers.enabled", false);
|
||||
lockPref("browser.discovery.sites", "");
|
||||
// disable crash report
|
||||
lockPref("browser.tabs.crashReporting.sendReport", false);
|
||||
lockPref("breakpad.reportURL", "");
|
||||
// disable connectivity checks
|
||||
pref("network.connectivity-service.enabled", false);
|
||||
// disable captive portal
|
||||
pref("network.captive-portal-service.enabled", false);
|
||||
pref("captivedetect.canonicalURL", "");
|
||||
|
||||
/** [CATEGORY] WINDOWS
|
||||
* the prefs in this section only apply to windows installations and they don't have any
|
||||
* effect on linux, macos and bsd users.
|
||||
*/
|
||||
// connectivity checks
|
||||
lockPref("network.connectivity-service.enabled", false);
|
||||
|
||||
/** [SECTION] UPDATES
|
||||
* disable windows specific update services.
|
||||
*/
|
||||
// captive portal
|
||||
lockPref("network.captive-portal-service.enabled", false);
|
||||
lockPref("captivedetect.canonicalURL", "");
|
||||
|
||||
// prevent sending server side analytics
|
||||
lockPref("beacon.enabled", false);
|
||||
|
||||
// --------------------------------
|
||||
// # WINDOWS
|
||||
// --------------------------------
|
||||
|
||||
// disable windows specific background update service
|
||||
lockPref("app.update.service.enabled", false);
|
||||
defaultPref("app.update.background.scheduling.enabled", false);
|
||||
|
||||
/** [SECTION] OTHERS */
|
||||
lockPref("default-browser-agent.enabled", false); // disable windows specific telemetry
|
||||
defaultPref("network.protocol-handler.external.ms-windows-store", false); // prevent links from launching windows store
|
||||
pref("toolkit.winRegisterApplicationRestart", false); // disable automatic start and session restore after reboot
|
||||
defaultPref("network.protocol-handler.external.ms-windows-store", false); // disable links launching windows store
|
||||
|
||||
lockPref("toolkit.winRegisterApplicationRestart", false); // disable automatic Firefox start and session restore after reboot
|
||||
|
||||
lockPref("security.family_safety.mode", 0); // disable win8.1 family safety cert
|
||||
|
||||
lockPref("default-browser-agent.enabled", false); // disable windows specific telemetry
|
||||
|
||||
defaultPref("network.http.windows-sso.enabled", false); // disable MS auto authentication via sso
|
||||
|
||||
/** [CATEGORY] OVERRIDES
|
||||
* allow settings to be overriden with a file placed in the right location
|
||||
* https://librewolf.net/docs/settings/#where-do-i-find-my-librewolfoverridescfg
|
||||
*/
|
||||
// -----------------------------------
|
||||
// # OVERRIDES
|
||||
// -----------------------------------
|
||||
|
||||
// allow settings to be overriden with a file at `~/.librewolf/librewolf.overrides.cfg`
|
||||
// or `~/.var/app/io.gitlab.librewolf-community/.librewolf/librewolf.overrides.cfg` (Flatpak).
|
||||
let profile_directory;
|
||||
if (profile_directory = getenv('USERPROFILE') || getenv('HOME')) {
|
||||
defaultPref('autoadmin.global_config_url', `file://${profile_directory}/.librewolf/librewolf.overrides.cfg`);
|
||||
pref('autoadmin.global_config_url', `file://${profile_directory}/.librewolf/librewolf.overrides.cfg`);
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue