Last active
October 21, 2018 12:49
-
-
Save pyllyukko/f5184fbb51b5e340f5637adee582c4d9 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /****** | |
| ghacks user.js * date: 18 Feb 2017 vs pyllyukko user.js | |
| WHAT ghacks has that pyllyukko doesn't | |
| ******/ | |
| /*** 0100: STARTUP ***/ | |
| // 0101: disable "slow startup" options | |
| // warnings, disk history, welcomes, intros, EULA, default browser check | |
| user_pref("browser.slowStartup.notificationDisabled", true); | |
| user_pref("browser.slowStartup.maxSamples", 0); | |
| user_pref("browser.slowStartup.samples", 0); | |
| user_pref("browser.rights.3.shown", true); | |
| user_pref("browser.startup.homepage_override.mstone", "ignore"); | |
| user_pref("startup.homepage_welcome_url", ""); | |
| user_pref("startup.homepage_welcome_url.additional", ""); | |
| user_pref("startup.homepage_override_url", ""); | |
| user_pref("browser.laterrun.enabled", false); | |
| user_pref("browser.usedOnWindows10.introURL", ""); | |
| // 0102: set start page (0=blank, 1=home, 2=last visited page, 3=resume previous session) | |
| // home = browser.startup.homepage preference : Options>General>Startup | |
| // user_pref("browser.startup.page", 0); | |
| /*** 0200: GEOLOCATION ***/ | |
| // 0201: disable location-aware browsing | |
| user_pref("geo.wifi.uri", "https://127.0.0.1"); | |
| user_pref("geo.wifi.logging.enabled", false); // (hidden pref) | |
| user_pref("geo.wifi.xhr.timeout", 1); | |
| user_pref("browser.search.geoip.timeout", 1); | |
| // 0202: disable GeoIP-based search results | |
| // NOTE: may not be hidden if Mozilla have changed your settings due to your locale | |
| // https://trac.torproject.org/projects/tor/ticket/16254 | |
| user_pref("browser.search.countryCode", "US"); // (hidden pref) | |
| user_pref("browser.search.region", "US"); // (hidden pref) | |
| // 0203: disable using OS locale, force APP locale | |
| user_pref("intl.locale.matchOS", false); | |
| // 0204: set APP local | |
| user_pref("general.useragent.locale", "en-US"); | |
| // 0206: disable geographically specific results/search engines eg: "browser.search.*.US" | |
| // i.e ignore all of Mozilla's multiple deals with multiple engines in multiple locales | |
| user_pref("browser.search.geoSpecificDefaults", false); | |
| user_pref("browser.search.geoSpecificDefaults.url", ""); | |
| // 0207: set language to match | |
| // WARNING: reset this to your default if you don't want English | |
| user_pref("intl.accept_languages", "en-US, en"); | |
| // 0208: enforce US English locale regardless of the system locale | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=867501 | |
| user_pref("javascript.use_us_english_locale", true); // (hidden pref) | |
| /*** 0300: QUIET FOX [PART 1] ***/ | |
| // 0301: disable browser auto update | |
| user_pref("app.update.enabled", false); | |
| // Options>Advanced>Update>Use a background service to install updates | |
| user_pref("app.update.service.enabled", false); | |
| // ensure update information is not suppressed | |
| user_pref("app.update.silent", false); | |
| // disable background update staging | |
| user_pref("app.update.staging.enabled", false); | |
| // 0305: disable add-ons auto update | |
| user_pref("extensions.update.autoUpdateDefault", false); | |
| // 0307: disable auto updating of personas (themes) | |
| user_pref("lightweightThemes.update.enabled", false); | |
| // 0309: disable sending Flash crash reports | |
| user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false); | |
| // 0310: disable sending the URL of the website where a plugin crashed | |
| user_pref("dom.ipc.plugins.reportCrashURL", false); | |
| // 0320: disable extension discovery | |
| // featured extensions for displaying in Get Add-ons panel | |
| user_pref("extensions.webservice.discoverURL", "http://127.0.0.1"); | |
| // 0330b: set unifiedIsOptIn to make sure telemetry respects OptIn choice and that telemetry | |
| // is enabled ONLY for people that opted into it, even if unified Telemetry is enabled | |
| user_pref("toolkit.telemetry.unifiedIsOptIn", true); // (hidden pref) | |
| // 0331: remove url of server telemetry pings are sent to | |
| user_pref("toolkit.telemetry.server", ""); | |
| // 0332: disable archiving pings locally - irrelevant if toolkit.telemetry.unified is false | |
| user_pref("toolkit.telemetry.archive.enabled", false); | |
| // 0333a: disable health report | |
| user_pref("datareporting.healthreport.documentServerURI", ""); // (hidden pref) | |
| // 0333b: disable about:healthreport page (which connects to Mozilla for locale/css+js+json) | |
| // If you have disabled health reports, then this about page is useless - disable it | |
| // If you want to see what health data is present, then these must be set at default | |
| user_pref("datareporting.healthreport.about.reportUrl", "data:text/plain,"); | |
| // 0335: remove a telemetry clientID | |
| // if you haven't got one, be proactive and set it now for future proofing | |
| user_pref("toolkit.telemetry.cachedClientID", ""); | |
| // 0336: disable "Heartbeat" (Mozilla user rating telemetry) | |
| // https://trac.torproject.org/projects/tor/ticket/18738 | |
| user_pref("browser.selfsupport.enabled", false); // (hidden pref) | |
| // 0340: disable experiments | |
| user_pref("experiments.manifest.uri", ""); | |
| user_pref("experiments.activeExperiment", false); | |
| // 0341: disable Mozilla permission to silently opt you into tests | |
| user_pref("network.allow-experiments", false); | |
| // 0350: disable crash reports | |
| user_pref("breakpad.reportURL", ""); | |
| // 0351: disable sending of crash reports (FF44+) | |
| user_pref("browser.tabs.crashReporting.sendReport", false); | |
| // 0360: disable new tab tile ads & preload & marketing junk | |
| user_pref("browser.newtabpage.introShown", true); | |
| // 0373: pocket | |
| user_pref("extensions.pocket.api", ""); | |
| user_pref("extensions.pocket.site", ""); | |
| user_pref("extensions.pocket.oAuthConsumerKey", ""); | |
| // 0374: disable "social" integration | |
| // https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Social_API | |
| user_pref("social.whitelist", ""); | |
| user_pref("social.toast-notifications.enabled", false); | |
| user_pref("social.shareDirectory", ""); | |
| user_pref("social.remote-install.enabled", false); | |
| user_pref("social.directories", ""); | |
| user_pref("social.share.activationPanelEnabled", false); | |
| user_pref("social.enabled", false); // (hidden pref) | |
| // 0375: disable "Reader View" | |
| user_pref("reader.parse-on-load.enabled", false); | |
| // 0376: disable FlyWeb, a set of APIs for advertising and discovering local-area web servers | |
| // https://wiki.mozilla.org/FlyWeb | |
| // http://www.ghacks.net/2016/07/26/firefox-flyweb/ | |
| user_pref("dom.flyweb.enabled", false); | |
| // 0380: disable sync | |
| user_pref("services.sync.enabled", false); // (hidden pref) | |
| /*** 0400: QUIET FOX [PART 2] ***/ | |
| // 0401: .....sanitize blocklist url | |
| user_pref("extensions.blocklist.url", "https://blocklist.addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/"); | |
| // 0402: disable/enable various Kinto blocklist updates (FF50+) | |
| // What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications | |
| // As FF transitions to Kinto, the blocklists have been broken down (more could be added). These contain | |
| // block entries for certs to be revoked, add-ons and plugins to be disabled, and gfx environments that | |
| // cause problems or crashes. Here you can remove the collection name to prevent each specific list updating | |
| user_pref("services.blocklist.update_enabled", true); | |
| user_pref("services.blocklist.signing.enforced", true); | |
| user_pref("services.blocklist.onecrl.collection", "certificates"); // Revoked certificates | |
| user_pref("services.blocklist.addons.collection", "addons"); | |
| user_pref("services.blocklist.plugins.collection", ""); // I have no plugins | |
| user_pref("services.blocklist.gfx.collection", ""); // I have gfx hw acceleration disabled | |
| // 0410: disable safe browsing | |
| // I have redesigned this sub-section to differentiate between "real-time"/"user initiated" | |
| // data being sent to Google from all other settings such as using local blocklists/whitelists | |
| // and updating those lists. There SHOULD be NO privacy issues here. Even *IF* an URL was sent | |
| // to Google, they swear it is anonymized and only used to flag malicious sites/activity. Firefox | |
| // also takes measures such as striping out identifying parameters and storing safe browsing | |
| // cookies in a separate jar. (#Turn on browser.safebrowsing.debug to monitor this activity) | |
| // To use safebrowsing but not "leak" binary download info to Google, only use 0410e and 0410f | |
| // #Required reading: https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ | |
| // https://wiki.mozilla.org/Security/Safe_Browsing | |
| // 0410a: disable "Block dangerous and deceptive content" This setting is under Options>Security | |
| // in FF47 and under this is was titled "Block reported web forgeries" | |
| // this covers deceptive sites such as phishing and social engineering | |
| user_pref("browser.safebrowsing.phishing.enabled", false); // (FF50+) | |
| // 0410b: disable "Block dangerous downloads" This setting is under Options>Security | |
| // in FF47 and under this was titled "Block reported attack sites" | |
| // this covers malware and PUPs (potentially unwanted programs) | |
| user_pref("browser.safebrowsing.downloads.enabled", false); | |
| // disable "Warn me about unwanted and uncommon software" Also under Options>Security (FF48+) | |
| user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); | |
| user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); | |
| // yet more prefs added (FF49+) | |
| user_pref("browser.safebrowsing.downloads.remote.block_dangerous", false); | |
| user_pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false); | |
| // 0410c: disable Google safebrowsing downloads, updates | |
| user_pref("browser.safebrowsing.provider.google.updateURL", ""); // update google lists | |
| user_pref("browser.safebrowsing.provider.google.gethashURL", ""); // list hash check | |
| user_pref("browser.safebrowsing.provider.google4.updateURL", ""); // (FF50+) | |
| user_pref("browser.safebrowsing.provider.google4.gethashURL", ""); // (FF50+) | |
| // 0410d: disable mozilla safebrowsing downloads, updates | |
| // NOTE: These two prefs are also used for Tracking Protection (see 0420) | |
| user_pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); // resolves hash conflicts | |
| user_pref("browser.safebrowsing.provider.mozilla.updateURL", ""); // update FF lists | |
| // 0410e: disable binaries NOT in local lists being checked by Google (real-time checking) | |
| user_pref("browser.safebrowsing.downloads.remote.url", ""); | |
| // 0410f: disable reporting URLs | |
| user_pref("browser.safebrowsing.provider.google.reportURL", ""); | |
| user_pref("browser.safebrowsing.reportMalwareMistakeURL", ""); | |
| user_pref("browser.safebrowsing.reportPhishMistakeURL", ""); | |
| user_pref("browser.safebrowsing.reportPhishURL", ""); | |
| user_pref("browser.safebrowsing.provider.google4.reportURL", ""); // (FF50+) | |
| // 0410g: show=true or hide=false the 'ignore this warning' on Safe Browsing warnings which | |
| // when clicked bypasses the block for that session. This is a means for admins to enforce SB | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1226490 | |
| // tests: see APPENDIX A: TEST SITES - Section 06 | |
| // user_pref("browser.safebrowsing.allowOverride", true); | |
| // 0421: enable more Tracking Protection choices under Options>Privacy>Use Tracking Protection | |
| user_pref("privacy.trackingprotection.ui.enabled", true); | |
| // 0430: disable SSL Error Reporting - PRIVACY | |
| // https://gecko.readthedocs.org/en/latest/browser/base/sslerrorreport/preferences.html | |
| user_pref("security.ssl.errorReporting.automatic", false); | |
| user_pref("security.ssl.errorReporting.url", ""); | |
| // 0440: disable Mozilla's blocklist for known Flash tracking/fingerprinting (48+) | |
| // If you don't have Flash, then you don't need this enabled | |
| // NOTE: if enabled, you will need to check what prefs (safebrowsing URLs etc) this uses to update | |
| // http://www.ghacks.net/2016/07/18/firefox-48-blocklist-against-plugin-fingerprinting/ | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1237198 | |
| user_pref("browser.safebrowsing.blockedURIs.enabled", false); | |
| /*** 0600: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - eg clicked on] ***/ | |
| // 0603a: disable more Necko/Captive Portal | |
| // https://en.wikipedia.org/wiki/Captive_portal | |
| // https://wiki.mozilla.org/Necko/CaptivePortal | |
| user_pref("captivedetect.canonicalURL", ""); | |
| user_pref("network.captive-portal-service.enabled", false); // (FF52+?) | |
| // 0607: stop links launching Windows Store on Windows 8/8.1/10 | |
| // http://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ | |
| user_pref("network.protocol-handler.external.ms-windows-store", false); | |
| // 0608: disable predictor / prefetching (FF48+) | |
| user_pref("network.predictor.enable-prefetch", false); | |
| /*** 0800: LOCATION BAR / SEARCH / AUTO SUGGESTIONS / HISTORY / FORMS etc ***/ | |
| // 0808: disable history suggestions - PRIVACY (shoulder surfers, forensics/unattended browser) | |
| user_pref("browser.urlbar.suggest.history", false); | |
| // 0809: limit history leaks via enumeration (PER TAB: back/forward) - PRIVACY | |
| // This is a PER TAB session history. You still have a full history stored under all history | |
| // default=50, minimum=1=currentpage, 2 is the recommended minimum as some pages | |
| // use it as a means of referral (eg hotlinking), 4 or 6 may be more practical | |
| user_pref("browser.sessionhistory.max_entries", 4); | |
| // 0813: disable saving form data on secure websites - PRIVACY (shoulder surfers etc) | |
| // For convenience & functionality, this is best left at default true. | |
| // You can clear formdata on exiting Firefox (see 2803) | |
| // user_pref("browser.formfill.saveHttpsForms", false); | |
| // 0815: disable live search suggestions in the urlbar and toggle off the Opt-In prompt (FF41+) | |
| // Setting: Options>Privacy>Location Bar>Related searches from the default search engine | |
| user_pref("browser.urlbar.userMadeSearchSuggestionsChoice", true); | |
| // 0817: disable Jumplist (Windows7+) | |
| user_pref("browser.taskbar.lists.enabled", false); | |
| user_pref("browser.taskbar.lists.frequent.enabled", false); | |
| user_pref("browser.taskbar.lists.recent.enabled", false); | |
| user_pref("browser.taskbar.lists.tasks.enabled", false); | |
| // 0818: disable taskbar preview | |
| user_pref("browser.taskbar.previews.enable", false); | |
| // 0819: disable one-off searches from the addressbar (FF51+) | |
| // http://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ | |
| user_pref("browser.urlbar.oneOffSearches", false); | |
| // 0820: disable search reset (about:searchreset) (FF51+) | |
| // http://www.ghacks.net/2016/08/19/firefox-51-search-restore-feature/ | |
| user_pref("browser.search.reset.enabled", false); | |
| user_pref("browser.search.reset.whitelist", ""); | |
| /*** 0900: PASSWORDS ***/ | |
| // 0904: how often in minutes Mozilla should ask for the master password (see pref above) | |
| // in minutes, default is 30 | |
| user_pref("security.password_lifetime", 5); | |
| // 0906: ignore websites' autocomplete="off" (FF30+) | |
| user_pref("signon.storeWhenAutocompleteOff", true); | |
| // 0907: force warnings for logins on non-secure (non HTTPS) pages | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1217156 | |
| user_pref("security.insecure_password.ui.enabled", true); | |
| // 0908: When attempting to fix an entered URL, do not fix an entered password along with it | |
| // i.e do not turn ~http://user:password@foo into ~http://user:password@(prefix)foo(suffix) | |
| // but instead ~http://user@(prefix)foo(suffix)) | |
| user_pref("browser.fixup.hide_user_pass", true); | |
| // 0909: disabling for now (FF51+) | |
| user_pref("signon.formlessCapture.enabled", false); | |
| /*** 1000: CACHE ***/ | |
| // 1001: disable disk cache | |
| user_pref("browser.cache.disk.capacity", 0); | |
| user_pref("browser.cache.disk.smart_size.enabled", false); | |
| user_pref("browser.cache.disk.smart_size.first_run", false); | |
| // 1006: disable pages being stored in memory. This is not the same as memory cache. | |
| // Visited pages are stored in memory in such a way that they don't have to be | |
| // re-parsed. This improves performance when pressing back/forward. | |
| // For the sake of completeness, this option is listed for the truly paranoid. | |
| // 0=none, -1=auto (that's minus 1), or any other positive integer | |
| // http://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers | |
| // user_pref("browser.sessionhistory.max_total_viewers", 0); | |
| // 1007: disable the Session Restore service completely | |
| // WARNING: This also disables the "Recently Closed Tabs" feature | |
| // It does not affect "Recently Closed Windows" or any history. | |
| user_pref("browser.sessionstore.max_tabs_undo", 0); | |
| user_pref("browser.sessionstore.max_windows_undo", 0); | |
| // 1008: IF you use session restore (see 1007 above), increasing the minimal interval between | |
| // two session save operations can help on older machines and some websites. | |
| // Default is 15000 (15 secs). Try 30000 (30sec), 60000 (1min) etc - your choice. | |
| // WARNING: This can also affect entries in the "Recently Closed Tabs" feature: | |
| // i.e the longer the interval the more chance a quick tab open/close won't be captured | |
| // this longer interval *MAY* affect history but I cannot replicate any history not recorded | |
| // user_pref("browser.sessionstore.interval", 30000); | |
| // 1009: DNS cache and expiration time (default 400 and 60 - same as TBB) | |
| // user_pref("network.dnsCacheEntries", 400); | |
| // user_pref("network.dnsCacheExpiration", 60); | |
| // 1010: disable randomized FF HTTP cache decay experiments | |
| // https://trac.torproject.org/projects/tor/ticket/13575 | |
| user_pref("browser.cache.frecency_experiment", -1); | |
| // 1011: disable permissions manager from writing to disk (requires restart) | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=967812 | |
| // user_pref("permissions.memory_only", true); // (hidden pref) | |
| // 1012: disable resuming session from crash | |
| user_pref("browser.sessionstore.resume_from_crash", false); | |
| /*** 1200: SSL / OCSP / CERTS / ENCRYPTION / HSTS/HPKP/HTTPS ***/ | |
| // 1215: disable Microsoft Family Safety cert (Windows 8.1) | |
| // 0: disable detecting Family Safety mode and importing the root | |
| // 1: only attempt to detect Family Safety mode (don't import the root) | |
| // 2: detect Family Safety mode and import the root | |
| user_pref("security.family_safety.mode", 0); | |
| // 1218: disable HSTS Priming (FF51+) | |
| // RISKS: formerly blocked mixed-content may load, may cause noticeable delays eg requests | |
| // time out, requests may not be handled well by servers, possible fingerprinting | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1246540#c145 | |
| user_pref("security.mixed_content.send_hsts_priming", false); | |
| user_pref("security.mixed_content.use_hsts", false); | |
| // 1220: disable intermediate certificate caching (fingerprinting attack vector) | |
| // NOTE: This affects login/cert/key dbs. AFAIK the only effect is all active logins start anew | |
| // per session. This may be better handled under FPI (ticket 1323644, part of Tor Uplift) | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1334485 // related bug | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1216882 // related bug (see comment 9) | |
| // user_pref("security.nocertdb", true); // (hidden pref) | |
| /*** 1400: FONTS ***/ | |
| // 1402: allow icon fonts (glyphs) (FF41+) | |
| user_pref("gfx.downloadable_fonts.enabled", true); | |
| // 1404: use more legible default fonts | |
| // WARNING: These are the author's settings, comment out if you do not require them | |
| // Been using this for over a year, it really grows on you | |
| user_pref("font.name.serif.x-unicode", "Georgia"); | |
| user_pref("font.name.serif.x-western", "Georgia"); // default Times New Roman | |
| user_pref("font.name.sans-serif.x-unicode", "Arial"); | |
| user_pref("font.name.sans-serif.x-western", "Arial"); // default Arial | |
| user_pref("font.name.monospace.x-unicode", "Lucida Console"); | |
| user_pref("font.name.monospace.x-western", "Lucida Console"); // default Courier New | |
| // 1405: disable woff2 | |
| user_pref("gfx.downloadable_fonts.woff2.enabled", false); | |
| // 1406: disable CSS Font Loading API | |
| // WARNING: Disabling fonts can uglify the web a fair bit. | |
| user_pref("layout.css.font-loading-api.enabled", false); | |
| // 1407: remove special underline handling for a few fonts which you will probably never use. | |
| // Any of these fonts on your system can be enumerated for fingerprinting. Requires restart. | |
| // http://kb.mozillazine.org/Font.blacklist.underline_offset | |
| user_pref("font.blacklist.underline_offset", ""); | |
| // 1408: disable graphite which FF49 turned back on by default | |
| // In the past it had security issues - need citation | |
| user_pref("gfx.font_rendering.graphite.enabled", false); | |
| /*** 1600: HEADERS / REFERERS ***/ | |
| // 1601: disable referer from an SSL Website | |
| // to be deprecated in FF52+? - https://bugzilla.mozilla.org/show_bug.cgi?id=1308725 | |
| user_pref("network.http.sendSecureXSiteReferrer", false); | |
| // 1602: DNT HTTP header - essentially USELESS - default is off. I recommend off. | |
| // user_pref("privacy.donottrackheader.value", 1); // (hidden pref) | |
| // 1605: referer, HOW to handle cross origins | |
| // 0=always (default), 1=only if base domains match, 2=only if hosts match | |
| // user_pref("network.http.referer.XOriginPolicy", 0); | |
| // 1606: referer, WHAT to send (limit the information) | |
| // 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port | |
| // user_pref("network.http.referer.trimmingPolicy", 0); | |
| /*** 1800: PLUGINS ***/ | |
| // 1801: set default plugin state (i.e new plugins on discovery) to never activate | |
| // 0=disabled, 1=ask to activate, 2=active - you can override individual plugins | |
| user_pref("plugin.default.state", 0); | |
| user_pref("plugin.defaultXpi.state", 0); | |
| // 1802: enable click to play and set to 0 minutes | |
| user_pref("plugin.sessionPermissionNow.intervalInMinutes", 0); | |
| // 1805: disable scanning for plugins | |
| // http://kb.mozillazine.org/Plugin_scanning | |
| // plid.all = whether to scan the directories specified in the Windows registry for PLIDs | |
| // includes: RealPlayer, Next-Generation Java Plug-In, Adobe Flash, Antivirus etc | |
| // WARNING: The author turned off plugins, try it one day. You are not missing much. | |
| user_pref("plugin.scan.plid.all", false); | |
| // 1806: Acrobat, Quicktime, WMP are handled separately from 1805 above. | |
| // The string refers to min version number allowed | |
| user_pref("plugin.scan.Acrobat", "99999"); | |
| user_pref("plugin.scan.Quicktime", "99999"); | |
| user_pref("plugin.scan.WindowsMediaPlayer", "99999"); | |
| // 1807: disable auto-play of HTML5 media | |
| // WARNING: This may break youtube video playback (and probably other sites). If you block | |
| // autoplay but occasionally would like a toggle button, try the following add-on | |
| // https://addons.mozilla.org/en-US/firefox/addon/autoplay-toggle | |
| user_pref("media.autoplay.enabled", false); | |
| // 1808: disable audio auto-play in non-active tabs (FF51+) | |
| // http://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ | |
| user_pref("media.block-autoplay-until-in-foreground", true); | |
| // 1820: disable all GMP (Gecko Media Plugins) | |
| // https://wiki.mozilla.org/GeckoMediaPlugins | |
| user_pref("media.gmp.trial-create.enabled", false); | |
| // 1825: disable widevine CDM | |
| user_pref("media.gmp-widevinecdm.visible", false); | |
| user_pref("media.gmp-widevinecdm.enabled", false); | |
| user_pref("media.gmp-widevinecdm.autoupdate", false); | |
| // 1830: disable all DRM content (EME: Encryption Media Extension) | |
| user_pref("media.eme.enabled", false); // Options>Content>Play DRM Content | |
| user_pref("browser.eme.ui.enabled", false); // hides "Play DRM Content" checkbox, restart required | |
| user_pref("media.eme.apiVisible", false); // block websites detecting DRM is disabled | |
| // 1840: disable the OpenH264 Video Codec by Cisco to "Never Activate" | |
| user_pref("media.gmp-gmpopenh264.autoupdate", false); | |
| // 1850: disable the Adobe EME "Primetime CDM" (Content Decryption Module) | |
| // https://trac.torproject.org/projects/tor/ticket/16285 | |
| user_pref("media.gmp-eme-adobe.enabled", false); | |
| user_pref("media.gmp-eme-adobe.visible", false); | |
| user_pref("media.gmp-eme-adobe.autoupdate", false); | |
| /*** 2000: MEDIA / CAMERA / MIKE ***/ | |
| // 2001: disable WebRTC | |
| // https://www.privacytools.io/#webrtc | |
| user_pref("media.peerconnection.use_document_iceservers", false); | |
| user_pref("media.peerconnection.video.enabled", false); | |
| user_pref("media.peerconnection.identity.enabled", false); | |
| user_pref("media.peerconnection.identity.timeout", 1); | |
| user_pref("media.peerconnection.turn.disable", true); | |
| // disable video capability for WebRTC | |
| user_pref("media.navigator.video.enabled", false); | |
| // 2010: disable WebGL, force bare minimum feature set if used & disable WebGL extensions | |
| // http://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/ | |
| // https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern | |
| user_pref("pdfjs.enableWebGL", false); | |
| user_pref("webgl.min_capability_mode", true); | |
| user_pref("webgl.disable-extensions", true); | |
| user_pref("webgl.disable-fail-if-major-performance-caveat", true); | |
| // 2012: two more webgl preferences (FF51+) | |
| user_pref("webgl.dxgl.enabled", false); | |
| user_pref("webgl.enable-webgl2", false); | |
| // 2021: disable speech recognition | |
| user_pref("media.webspeech.synth.enabled", false); | |
| // 2022: disable screensharing | |
| user_pref("media.getusermedia.screensharing.allowed_domains", ""); | |
| user_pref("media.getusermedia.screensharing.allow_on_old_platforms", false); | |
| user_pref("media.getusermedia.browser.enabled", false); | |
| user_pref("media.getusermedia.audiocapture.enabled", false); | |
| // 2024: enable/disable MSE (Media Source Extensions) | |
| // http://www.ghacks.net/2014/05/10/enable-media-source-extensions-firefox/ | |
| user_pref("media.mediasource.enabled", true); | |
| user_pref("media.mediasource.mp4.enabled", true); | |
| user_pref("media.mediasource.webm.audio.enabled", true); | |
| user_pref("media.mediasource.webm.enabled", true); | |
| // 2025: enable/disable various media types - end user personal choice | |
| // WARNING: this is the author's settings, choose your own | |
| user_pref("media.mp4.enabled", true); | |
| user_pref("media.flac.enabled", true); // (FF51+) | |
| user_pref("media.ogg.enabled", false); | |
| user_pref("media.ogg.flac.enabled", false); // (FF51+) | |
| user_pref("media.opus.enabled", false); | |
| user_pref("media.raw.enabled", false); | |
| user_pref("media.wave.enabled", false); | |
| user_pref("media.webm.enabled", true); | |
| user_pref("media.wmf.enabled", true); // https://www.youtube.com/html5 - for the two H.264 entries | |
| // 2026: disable canvas capture stream | |
| // https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement/captureStream | |
| user_pref("canvas.capturestream.enabled", false); | |
| // 2027: disable camera image capture | |
| // https://trac.torproject.org/projects/tor/ticket/16339 | |
| user_pref("dom.imagecapture.enabled", false); | |
| // 2028: disable offscreen canvas | |
| // https://developer.mozilla.org/en-US/docs/Web/API/OffscreenCanvas | |
| user_pref("gfx.offscreencanvas.enabled", false); | |
| /*** 2200: UI MEDDLING ***/ | |
| // 2202: UI SPOOFING: disable scripts hiding or disabling the following on new windows | |
| user_pref("dom.disable_window_open_feature.location", true); | |
| user_pref("dom.disable_window_open_feature.menubar", true); | |
| user_pref("dom.disable_window_open_feature.resizable", true); | |
| user_pref("dom.disable_window_open_feature.status", true); | |
| user_pref("dom.disable_window_open_feature.toolbar", true); | |
| // 2203: POPUP windows - prevent or allow javascript UI meddling | |
| user_pref("dom.disable_window_flip", true); // window z-order | |
| user_pref("dom.disable_window_move_resize", true); | |
| user_pref("dom.disable_window_open_feature.close", true); | |
| user_pref("dom.disable_window_open_feature.minimizable", true); | |
| user_pref("dom.disable_window_open_feature.personalbar", true); //bookmarks toolbar | |
| user_pref("dom.disable_window_open_feature.titlebar", true); | |
| user_pref("dom.disable_window_status_change", true); | |
| user_pref("dom.allow_scripts_to_close_windows", false); | |
| // 2204: disable links opening in a new window | |
| // https://trac.torproject.org/projects/tor/ticket/9881 | |
| // test url: https://people.torproject.org/~gk/misc/entire_desktop.html | |
| // You can still right click a link and select open in a new window | |
| // This is to stop malicious window sizes and screen res leaks etc in conjunction | |
| // with 2203 dom.disable_window_move_resize=true | 2418 full-screen-api.enabled=false | |
| // user_pref("browser.link.open_newwindow.restriction", 0); | |
| /*** 2300: SERVICE WORKERS ***/ | |
| // 2301: disable workers API and service workers API | |
| // https://developer.mozilla.org/en-US/docs/Web/API/Worker | |
| // https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API | |
| // http://www.ghacks.net/2016/03/02/manage-service-workers-in-firefox-and-chrome/ | |
| // WARNING: WILL break sites as this gains traction: eg mega.nz requires workers | |
| user_pref("dom.workers.enabled", false); | |
| user_pref("dom.serviceWorkers.enabled", false); | |
| // 2302: disable service workers cache and cache storage | |
| user_pref("dom.caches.enabled", false); | |
| // 2303: disable push notifications (FF44+) [requires serviceWorkers to be enabled] | |
| // web apps can receive messages pushed to them from a server, whether or | |
| // not the web app is in the foreground, or even currently loaded | |
| // https://developer.mozilla.org/en/docs/Web/API/Push_API | |
| // WARNING: may affect social media sites like Twitter | |
| user_pref("dom.push.enabled", false); | |
| user_pref("dom.push.connection.enabled", false); | |
| user_pref("dom.push.serverURL", ""); | |
| user_pref("dom.push.userAgentID", ""); | |
| // 2304: disable web/push notifications | |
| // https://developer.mozilla.org/en-US/docs/Web/API/notification | |
| // NOTE: you can still override individual domains under site permissions (FF44+) | |
| // WARNING: may affect social media sites like Twitter | |
| user_pref("dom.webnotifications.serviceworker.enabled", false); | |
| /*** 2400: DOM & JAVASCRIPT ***/ | |
| // 2403: disable clipboard commands (cut/copy) from "non-priviledged" content | |
| // this disables document.execCommand("cut"/"copy") to protect your clipboard | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1170911 | |
| user_pref("dom.allow_cut_copy", false); // (hidden pref) | |
| // 2410: disable User Timing API | |
| // https://trac.torproject.org/projects/tor/ticket/16336 | |
| user_pref("dom.enable_user_timing", false); | |
| // 2411: disable resource/navigation timing | |
| user_pref("dom.enable_resource_timing", false); | |
| // 2414: disable shaking the screen | |
| user_pref("dom.vibrator.enabled", false); | |
| // 2415: max popups from a single non-click event - default is 20! | |
| user_pref("dom.popup_maximum", 3); | |
| // 2415b: limit events that can cause a popup | |
| // default is "change click dblclick mouseup notificationclick reset submit touchend" | |
| // WARNING: Author killed all methods but does this with Popup Blocker Ultimate | |
| // in Strict mode with whitelist. Or you can allow all but blacklist. Either way, | |
| // Popup Blocker Ultimate overwrites this pref with a blank (or allows everything!). | |
| // http://kb.mozillazine.org/Dom.popup_allowed_events | |
| user_pref("dom.popup_allowed_events", "click dblclick"); | |
| // 2416: disable idle observation | |
| user_pref("dom.idle-observers-api.enabled", false); | |
| // 2418: disable full-screen API | |
| // This setting WAS under about:permissions>All Sites>Fullscreen | |
| // NOTE: about:permissions is no longer available since FF46 but you can still override | |
| // individual domains: use info icon in urlbar etc or right click on a web page>view page info | |
| // set to false=block, set to true=ask | |
| user_pref("full-screen-api.enabled", false); | |
| // 2421: in addition to 2420, these settings will help harden JS against exploits such as CVE-2015-0817 | |
| // https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 | |
| // WARNING: causes the odd site issue and there is also a performance loss | |
| // Update: Jan-2017: commented out for now, as performance gains outweigh extra security | |
| // user_pref("javascript.options.ion", false); | |
| // user_pref("javascript.options.baselinejit", false); | |
| // 2425: disable ArchiveAPI i.e reading content of archives, such as zip files, directly | |
| // in the browser, through DOM file objects. Default is false. | |
| user_pref("dom.archivereader.enabled", false); | |
| // 2450: force FF to tell you if a website asks to store data for offline use | |
| // https://support.mozilla.org/en-US/questions/1098540 | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=959985 | |
| user_pref("offline-apps.allow_by_default", false); | |
| // Options>Advanced>Network>Tell me when a website asks to store data for offline use | |
| user_pref("browser.offline-apps.notify", true); | |
| // change size of warning quota for offline cache (default 51200) | |
| // Offline cache is only used in rare cases to store data locally. FF will store small amounts | |
| // (default <50MB) of data in the offline (application) cache without asking for permission. | |
| // user_pref("offline-apps.quota.warn", 51200); | |
| /*** 2500: HARDWARE FINGERPRINTING ***/ | |
| // 2504: disable virtual reality devices | |
| // https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API | |
| user_pref("dom.vr.oculus.enabled", false); | |
| user_pref("dom.vr.osvr.enabled", false); // (FF49+) | |
| user_pref("dom.vr.openvr.enabled", false); // (FF51+) | |
| // 2507: disable keyboard fingerprinting (FF38+) (physical keyboards) | |
| // The Keyboard API allows tracking the "read parameter" of pressed keys in forms on | |
| // web pages. These parameters vary between types of keyboard layouts such as QWERTY, | |
| // AZERTY, Dvorak, and between various languages, eg German vs English. | |
| // WARNING: Don't use if Android + physical keyboard | |
| // UPDATE: This MAY be incorporated better into the Tor Uplift project (see 2699) | |
| // https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/code | |
| // https://www.privacy-handbuch.de/handbuch_21v.htm | |
| user_pref("dom.keyboardevent.code.enabled", false); | |
| user_pref("dom.beforeAfterKeyboardEvent.enabled", false); | |
| user_pref("dom.keyboardevent.dispatch_during_composition", false); | |
| // 2509: disable touch events | |
| // https://developer.mozilla.org/en-US/docs/Web/API/Touch_events | |
| // https://trac.torproject.org/projects/tor/ticket/10286 | |
| // fingerprinting attack vector - leaks screen res & actual screen coordinates | |
| // WARNING: If you use touch eg Win8/10 Metro/Smartphone reset this to default | |
| user_pref("dom.w3c_touch_events.enabled", 0); | |
| // 2511: disable MediaDevices change detection (FF51+) (enabled by default starting FF52+) | |
| // https://developer.mozilla.org/en-US/docs/Web/Events/devicechange | |
| // https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/ondevicechange | |
| user_pref("media.ondevicechange.enabled", false); | |
| /*** 2600: MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY ***/ | |
| // 2605: don't integrate activity into windows recent documents | |
| user_pref("browser.download.manager.addToRecentDocs", false); | |
| // 2606: disable hiding mime types (Options>Applications) not associated with a plugin | |
| user_pref("browser.download.hide_plugins_without_extensions", false); | |
| // 2612: disable SimpleServiceDiscovery - which can bypass proxy settings - eg Roku | |
| // https://trac.torproject.org/projects/tor/ticket/16222 | |
| user_pref("gfx.layerscope.enabled", false); | |
| // 2614: disable SPDY as it can contain identifiers | |
| // https://www.torproject.org/projects/torbrowser/design/#identifier-linkability (no. 10) | |
| user_pref("network.http.spdy.enabled", false); | |
| user_pref("network.http.spdy.enabled.deps", false); | |
| // 2615: disable http2 for now as well | |
| user_pref("network.http.spdy.enabled.http2", false); | |
| // 2619: limit HTTP redirects (this does not control redirects with HTML meta tags or JS) | |
| // WARNING: a low setting of 5 or under will probably break some sites (eg gmail logins) | |
| // To control HTML Meta tag and JS redirects, use an add-on (eg NoRedirect). Default is 20 | |
| user_pref("network.http.redirection-limit", 10); | |
| // 2620: disable middle mouse click opening links from clipboard | |
| // https://trac.torproject.org/projects/tor/ticket/10089 | |
| // http://kb.mozillazine.org/Middlemouse.contentLoadURL | |
| user_pref("middlemouse.contentLoadURL", false); | |
| // 2621: disable IPv6 (included for knowledge ONLY - not recommended) | |
| // user_pref("network.dns.disableIPv6", true); | |
| // user_pref("network.http.fast-fallback-to-IPv4", true); | |
| // 2622: ensure you have a security delay when installing add-ons (milliseconds) | |
| // default=1000, This also covers the delay in "Save" on downloading files. | |
| // http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox | |
| // http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ | |
| user_pref("security.dialog_enable_delay", 1000); | |
| // 2626: strip optional user agent token, default is false, included for completeness | |
| // https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference | |
| user_pref("general.useragent.compatMode.firefox", false); | |
| // 2627: Spoof default UA & relevant (navigator) parts (also see 0204 for UA language) | |
| // C: navigator.appName | |
| user_pref("general.appname.override", "Netscape"); // (hidden pref) | |
| // D: navigator.appVersion | |
| user_pref("general.appversion.override", "5.0 (Windows)"); // (hidden pref) | |
| // E: navigator.platform leaks in JS | |
| user_pref("general.platform.override", "Win32"); // (hidden pref) | |
| // F: navigator.oscpu | |
| user_pref("general.oscpu.override", "Windows NT 6.1"); // (hidden pref) | |
| // 2628: disable UITour backend so there is no chance that a remote page can use it | |
| user_pref("browser.uitour.url", ""); | |
| // 2629: disable remote JAR files being opened, regardless of content type | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1215235 | |
| user_pref("network.jar.block-remote-files", true); | |
| // 2650: start the browser in e10s mode (48+) | |
| // After restarting the browser, you can check whether it's enabled by visiting | |
| // about:support and checking that "Multiprocess Windows" = 1 | |
| // use force-enable and extensions.e10sblocksenabling if you have add-ons | |
| // user_pref("browser.tabs.remote.autostart", true); | |
| // user_pref("browser.tabs.remote.autostart.2", true); // (FF49+) | |
| // user_pref("browser.tabs.remote.force-enable", true); // (hidden pref) | |
| // user_pref("extensions.e10sBlocksEnabling", false); | |
| // 2651: control e10s number of container processes | |
| // http://www.ghacks.net/2016/02/15/change-how-many-processes-multi-process-firefox-uses/ | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1207306 | |
| // user_pref("dom.ipc.processCount", 4); | |
| // 2652: enable console shim warnings for extensions that don't have the flag | |
| // 'multiprocessCompatible' set to true | |
| user_pref("dom.ipc.shims.enabledWarnings", true); | |
| // 2660: enforce separate content process for file://URLs (FF53+?) | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1147911 | |
| // http://www.ghacks.net/2016/11/27/firefox-53-exclusive-content-process-for-local-files/ | |
| user_pref("browser.tabs.remote.separateFileUriProcess", true); | |
| // 2662: disable "open with" in download dialog (FF50+) | |
| // This is very useful to enable when the browser is sandboxed (e.g. via AppArmor) | |
| // in such a way that it is forbidden to run external applications. | |
| // WARNING: This may interfere with some users' workflow or methods | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1281959 | |
| user_pref("browser.download.forbid_open_with", true); | |
| // 2663: disable MathML (FF51+) | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1173199 | |
| // test: http://browserspy.dk/mathml.php | |
| user_pref("mathml.disabled", true); | |
| // 2664: disable DeviceStorage API | |
| // https://wiki.mozilla.org/WebAPI/DeviceStorageAPI | |
| user_pref("device.storage.enabled", false); | |
| // 2665: sanitize webchannel whitelist | |
| user_pref("webchannel.allowObject.urlWhitelist", ""); | |
| // 2666: disable HTTP Alternative Services | |
| // http://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/#comment-3970881 | |
| user_pref("network.http.altsvc.enabled", false); | |
| user_pref("network.http.altsvc.oe", false); | |
| // 2668: lock down allowed extension directories | |
| // WARNING: this will break add-ons (Roboform, Internet Download Manager and others) that | |
| // do not use the default XPI directories | |
| // https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ | |
| // archived: http://archive.is/DYjAM | |
| user_pref("extensions.enabledScopes", 1); // (hidden pref) | |
| user_pref("extensions.autoDisableScopes", 15); | |
| // 2669: strip paths when sending URLs to PAC scripts (FF51+) | |
| // CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC) | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1255474 | |
| user_pref("network.proxy.autoconfig_url.include_path", false); | |
| // 2670: close bypassing of CSP via image mime types (FF51+) | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1288361 | |
| user_pref("security.block_script_with_wrong_mime", true); | |
| // 2671: disable SVG (FF53+) | |
| // WARNING: SVG is fairly common (~15% of the top 10K sites), so will cause some breakage | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1216893 | |
| user_pref("svg.disabled", true); | |
| /*** 2698: FIRST PARTY ISOLATION (PFI) ***/ | |
| // 2698a: enable first party isolation pref and OriginAttribute (FF51+) | |
| // WARNING: breaks lots of cross-domain logins and site funtionality until perfected | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1260931 | |
| // 2698b: this also isolates OCSP requests by first party domain | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1264562 | |
| // user_pref("privacy.firstparty.isolate", true); | |
| /*** 2700: COOKIES & DOM STORAGE ***/ | |
| // 2704: set cookie lifetime in days (see above pref) - default is 90 days | |
| // user_pref("network.cookie.lifetime.days", 90); | |
| // 2706: disable Storage API (FF51+) which gives sites' code the ability to find out how much space | |
| // they can use, how much they are already using, and even control whether or not they need to | |
| // be alerted before the user agent disposes of site data in order to make room for other things. | |
| // https://developer.mozilla.org/en-US/docs/Web/API/StorageManager | |
| // https://developer.mozilla.org/en-US/docs/Web/API/Storage_API | |
| user_pref("dom.storageManager.enabled", false); | |
| // 2707: clear localStorage and UUID when a WebExtension is uninstalled | |
| // NOTE: both preferences must be the same | |
| // https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/storage/local | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1213990 | |
| user_pref("extensions.webextensions.keepStorageOnUninstall", false); | |
| user_pref("extensions.webextensions.keepUuidOnUninstall", false); | |
| /*** 2800: SHUTDOWN ***/ | |
| // 2803a: include all open windows/tabs when you shutdown | |
| // user_pref("privacy.clearOnShutdown.openWindows", true); | |
| // 2804: (to match above) - auto selection of items to delete with Ctrl-Shift-Del | |
| user_pref("privacy.cpd.cache", true); | |
| user_pref("privacy.cpd.cookies", false); | |
| user_pref("privacy.cpd.downloads", true); | |
| user_pref("privacy.cpd.formdata", true); | |
| user_pref("privacy.cpd.history", true); | |
| user_pref("privacy.cpd.offlineApps", true); | |
| user_pref("privacy.cpd.passwords", false); | |
| user_pref("privacy.cpd.sessions", false); | |
| user_pref("privacy.cpd.siteSettings", false); | |
| // 2804a: include all open windows/tabs when you run clear recent history | |
| // user_pref("privacy.cpd.openWindows", true); | |
| // 2805: reset default 'Time range to clear' for 'clear recent history' (see 2804 above) | |
| // Firefox remembers your last choice. This will reset the value when you start FF. | |
| // 0=everything 1=last hour, 2=last 2 hours, 3=last 4 hours, 4=today | |
| user_pref("privacy.sanitize.timeSpan", 0); | |
| /*** 3000: PERSONAL SETTINGS ***/ | |
| // 3001: disable annoying warnings | |
| user_pref("general.warnOnAboutConfig", false); | |
| user_pref("browser.tabs.warnOnClose", false); | |
| user_pref("browser.tabs.warnOnCloseOtherTabs", false); | |
| user_pref("browser.tabs.warnOnOpen", false); | |
| // 3001a: disable warning when a domain requests full screen | |
| // https://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Using_full_screen_mode | |
| // user_pref("full-screen-api.warning.delay", 0); | |
| // user_pref("full-screen-api.warning.timeout", 0); | |
| // 3002: disable closing browser with last tab | |
| user_pref("browser.tabs.closeWindowWithLastTab", false); | |
| // 3004: disable backspace (0 = previous page, 1 = scroll up, 2 = do nothing) | |
| user_pref("browser.backspace_action", 2); | |
| // 3007: open new windows in a new tab instead | |
| // This setting is under Options>General>Tabs | |
| // 1=current window, 2=new window, 3=most recent window | |
| user_pref("browser.link.open_newwindow", 3); | |
| // 3008: disable "Do you really want to leave this site?" popups | |
| // https://support.mozilla.org/en-US/questions/1043508 | |
| user_pref("dom.disable_beforeunload", true); | |
| // 3009: turn on APZ (Async Pan/Zoom) - requires e10s | |
| // http://www.ghacks.net/2015/07/28/scrolling-in-firefox-to-get-a-lot-better-thanks-to-apz/ | |
| // user_pref("layers.async-pan-zoom.enabled", true); | |
| // 3010: enable ctrl-tab previews | |
| user_pref("browser.ctrlTab.previews", true); | |
| // 3011: don't open "page/selection source" in a tab. The window used instead is cleaner | |
| // and easier to use and move around (eg developers/multi-screen). | |
| user_pref("view_source.tab", false); | |
| // 3012: spellchecking: 0=none, 1-multi-line controls, 2=multi-line & single-line controls | |
| user_pref("layout.spellcheckDefault", 1); | |
| // 3015: disable tab animation, speed things up a little | |
| user_pref("browser.tabs.animate", false); | |
| // 3016: disable fullscreeen animation. Test using F11. | |
| // Animation is smother but is annoyingly slow, while no animation can be startling | |
| user_pref("browser.fullscreen.animate", false); | |
| // 3017: submenu in milliseconds. 0=instant while a small number allows | |
| // a mouse pass over menu items without any submenus alarmingly shooting out | |
| user_pref("ui.submenuDelay", 75); // (hidden pref) | |
| // 3018: maximum number of daily bookmark backups to keep (default is 15) | |
| user_pref("browser.bookmarks.max_backups", 2); | |
| // 3020: FYI: urlbar click behaviour (with defaults) | |
| user_pref("browser.urlbar.clickSelectsAll", true); | |
| user_pref("browser.urlbar.doubleClickSelectsAll", false); | |
| // 3021: FYI: tab behaviours (with defaults) | |
| // open links in a new tab immediately to the right of parent tab, not far right | |
| user_pref("browser.tabs.insertRelatedAfterCurrent", true); | |
| // switch to the parent tab (if it has one) on close, rather than to the adjacent right tab if | |
| // it exists or to the adjacent left tab if it doesn't. NOTE: requires browser.link.open_newwindow | |
| // set to 3 (see pref 3007). NOTE: does not apply to middle-click or Ctrl-clicking links. | |
| user_pref("browser.tabs.selectOwnerOnClose", true); | |
| // Options>General>When I open a link in a new tab, switch to it immediately | |
| // default is unchecked = DON'T switch to it = true | |
| user_pref("browser.tabs.loadInBackground", true); | |
| // set behavior of pages normally meant to open in a new window (such as target="_blank" | |
| // or from an external program), but that have instead been loaded in a new tab. | |
| // true: load the new tab in the background, leaving focus on the current tab | |
| // false: load the new tab in the foreground, taking the focus from the current tab. | |
| user_pref("browser.tabs.loadDivertedInBackground", false); | |
| // 3022: hide recently bookmarked items (you still have the original bookmarks) (FF49+) | |
| user_pref("browser.bookmarks.showRecentlyBookmarked", false); | |
| // 3023: disable automigrate, current default is false but may change (FF49+) | |
| // need more info, but lock down for now | |
| user_pref("browser.migrate.automigrate.enabled", false); | |
| /*** 9997: DEPRECATED ***/ | |
| // 2607: (23+) disable page thumbnails, it was around v23, not 100% sure when | |
| // this pref was replaced with browser.pagethumbnails.capturing_disabled | |
| // user_pref("pageThumbs.enabled", false); | |
| // 2408: (31+) disable network API - fingerprinting vector | |
| // user_pref("dom.network.enabled", false); | |
| // 2620: (35+) disable WebSockets | |
| // https://developer.mozilla.org/en-US/Firefox/Releases/35 | |
| // user_pref("network.websocket.enabled", false); | |
| // 2023: (37+) disable camera autofocus callback (was in 36, not in 37) | |
| // Not part of any specification, the API will be superceded by the WebRTC Capture | |
| // and Stream API ( http://w3c.github.io/mediacapture-main/getusermedia.html ) | |
| // https://developer.mozilla.org/en-US/docs/Mozilla/Firefox_OS/API/CameraControl/ | |
| // user_pref("camera.control.autofocus_moving_callback.enabled", false); | |
| // 1804: (41+) disable plugin enumeration | |
| // user_pref("plugins.enumerable_names", ""); | |
| // 0420: (42+) disable tracking protection | |
| // this particular pref was never in stable | |
| // labelled v42+ because that's when tracking protection landed | |
| // user_pref("browser.polaris.enabled", false); | |
| // 2803: (42+) what to clear on shutdown | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1102184#c23 | |
| // user_pref("privacy.clearOnShutdown.passwords", false); | |
| // 0411: (43+) disable safebrowsing urls & download | |
| // user_pref("browser.safebrowsing.gethashURL", ""); | |
| // user_pref("browser.safebrowsing.malware.reportURL", ""); | |
| // user_pref("browser.safebrowsing.provider.google.appRepURL", ""); | |
| // user_pref("browser.safebrowsing.reportErrorURL", ""); | |
| // user_pref("browser.safebrowsing.reportGenericURL", ""); | |
| // user_pref("browser.safebrowsing.reportMalwareErrorURL", ""); | |
| // user_pref("browser.safebrowsing.reportMalwareURL", ""); | |
| // user_pref("browser.safebrowsing.reportURL", ""); | |
| // user_pref("browser.safebrowsing.updateURL", ""); | |
| // 0420: (43+) disable tracking protection. FF43+ URLs are now part of safebrowsing | |
| // https://wiki.mozilla.org/Security/Tracking_protection (look under Prefs) | |
| // NOTE: getupdateURL = WRONG / never existed. updateURL = CORRECT and has been added FYI | |
| // user_pref("browser.trackingprotection.gethashURL", ""); | |
| // user_pref("browser.trackingprotection.getupdateURL", ""); | |
| // user_pref("browser.trackingprotection.updateURL", ""); | |
| // 1803: (43+) remove plugin finder service | |
| // http://kb.mozillazine.org/Pfs.datasource.url | |
| // user_pref("pfs.datasource.url", ""); | |
| // 2403: (43+) disable scripts changing images - test link below | |
| // http://www.w3schools.com/jsref/tryit.asp?filename=tryjsref_img_src2 | |
| // WARNING: will break some sites such as Google Maps and a lot of web apps | |
| // user_pref("dom.disable_image_src_set", true); | |
| // 2615: (43+) disable http2 for now as well | |
| // user_pref("network.http.spdy.enabled.http2draft", false); | |
| // 3001a: (43+) disable warning when a domain requests full screen | |
| // replaced by setting full-screen-api.warning.timeout to zero | |
| // user_pref("full-screen-api.approval-required", false); | |
| // 3003: (43+) disable new search panel UI [Classic Theme Restorer can restore the old search] | |
| // user_pref("browser.search.showOneOffButtons", false); | |
| // 1201: (44+) block rc4 whitelist | |
| // https://developer.mozilla.org/en-US/Firefox/Releases/44#Security | |
| // user_pref("security.tls.insecure_fallback_hosts.use_static_list", false); | |
| // 2417: (44+) disable SharedWorkers, which allow the exchange of data between iFrames that | |
| // are open in different tabs, even if the sites do not belong to the same domain. | |
| // https://www.torproject.org/projects/torbrowser/design/#identifier-linkability (no. 8) | |
| // https://bugs.torproject.org/15562 | |
| // is used in FF 45and 46 code once, to set it for a test | |
| // user_pref("dom.workers.sharedWorkers.enabled", false); | |
| // 1005: (45+) disable deferred level of storing extra session data 0=all 1=http-only 2=none | |
| // user_pref("browser.sessionstore.privacy_level_deferred", 2); | |
| // 0334b: (46+) disable FHR (Firefox Health Report) v2 data being sent to Mozilla servers | |
| // user_pref("datareporting.policy.dataSubmissionEnabled.v2", false); | |
| // 0410e: (46+) safebrowsing | |
| // user_pref("browser.safebrowsing.appRepURL", ""); // Google application reputation check | |
| // 0333b: (47+) disable about:healthreport page UNIFIED | |
| // user_pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); | |
| // 0807: (47+) disable history manipulation | |
| // https://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Manipulating_the_browser_history | |
| // WARNING: if set to false it breaks some sites (youtube) ability to correctly show the | |
| // url in location bar and for the forward/back tab history to work | |
| // user_pref("browser.history.allowPopState", false); | |
| // user_pref("browser.history.allowPushState", false); | |
| // user_pref("browser.history.allowReplaceState", false); | |
| // 0806: (48+) disable 'unified complete': 'Search with [default search engine]' | |
| // this feature has been added back in Classic Theme Restorer | |
| // http://techdows.com/2016/05/firefox-unified-complete-aboutconfig-preference-removed.html | |
| // user_pref("browser.urlbar.unifiedcomplete", false); | |
| // 2202: (49+) ONE of the new window UI prefs | |
| // user_pref("dom.disable_window_open_feature.scrollbars", true); | |
| // 2431: (49+) disable ONE of the push notification prefs | |
| // user_pref("dom.push.udp.wakeupEnabled", false); | |
| // 1809: (50+) remove Mozilla's plugin update URL | |
| // user_pref("plugins.update.url", ""); | |
| // 1851: (51+) delay play of videos until they're visible | |
| // https://bugzilla.mozilla.org/show_bug.cgi?id=1180563 | |
| // user_pref("media.block-play-until-visible", true); | |
| // 2504: (51+) disable virtual reality devices | |
| // user_pref("dom.vr.oculus050.enabled", false); | |
| // 2614: (51+) disable SPDY | |
| // user_pref("network.http.spdy.enabled.v3-1", false); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Can you make scripts that set a timer to automatically pause/stop on all Youtube embed videos? Like pause a video after X seconds!!?