diff --git a/scratchpad-scripts/arkenfox-cleanup.js b/scratchpad-scripts/arkenfox-cleanup.js index 298e6367..105a526c 100644 --- a/scratchpad-scripts/arkenfox-cleanup.js +++ b/scratchpad-scripts/arkenfox-cleanup.js @@ -6,7 +6,7 @@ There is an archived version at https://github.com/arkenfox/user.js/issues/123 if you want the full list since jesus - Last updated: 19-December-2025 + Last updated: 23-July-2026 Instructions: - [optional] close Firefox and backup your profile @@ -83,6 +83,8 @@ 'browser.display.use_system_colors', 'browser.urlbar.fakespot.featureGate', 'keyword.enabled', + 'privacy.userContext.enabled', + 'privacy.userContext.ui.enabled', 'security.OCSP.enabled', 'security.OCSP.require', /* 129-140 */ diff --git a/user.js b/user.js index df733227..2aad278d 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: arkenfox user.js -* date: 21 April 2026 -* version: 144 +* date: 30 July 2026 +* version: 153 * urls: https://github.com/arkenfox/user.js [repo] * : https://arkenfox.github.io/gui/ [interactive] * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt @@ -394,7 +394,7 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); * but the problem is that the browser can't know that. Setting this pref to true is the only way for the * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? - * [STATS] SSL Labs (Nov 2025) reports almost 99.85% of top sites have secure renegotiation [4] + * [STATS] SSL Labs (June 2025) reports almost 99.85% of top sites have secure renegotiation [4] * [1] https://wiki.mozilla.org/Security:Renegotiation * [2] https://datatracker.ietf.org/doc/html/rfc5746 * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 @@ -469,11 +469,6 @@ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); /*** [SECTION 1700]: CONTAINERS ***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); -/* 1701: enable Container Tabs and its UI setting [FF50+] - * [SETTING] General>Tabs>Enable Container Tabs - * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ -user_pref("privacy.userContext.enabled", true); -user_pref("privacy.userContext.ui.enabled", true); /* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+] * [NOTE] The menu is always shown on long press and right click * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ @@ -797,6 +792,8 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); 1984333 - spoof navigator.hardwareConcurrency as 4 except mac return 8 (FF143) previously FF55+ it returned 2 1999126 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF147) + 2047612 - enforce IME styling in EditContext API (FF154) + 2045882 - enforce sRGB in canvas (FF154?) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); /* 4501: enable RFP @@ -939,7 +936,7 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow // user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); /* 5019: disable page thumbnail collection ***/ // user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] -/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/ +/* 5020: disable Windows native notifications and use app notifications instead [FF111+] [WINDOWS] ***/ // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false); /*** [SECTION 5500]: OPTIONAL HARDENING @@ -961,7 +958,7 @@ user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); * [1] http://asmjs.org/ * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ - // user_pref("javascript.options.asmjs", false); + // user_pref("javascript.options.asmjs", false); // [DEFAULT: false FF148+] /* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART] * [NOTE] When both Ion and JIT are disabled, and trustedprincipals * is enabled, then Ion can still be used by extensions (1599226) @@ -1040,6 +1037,9 @@ user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] // user_pref("browser.urlbar.fakespot.featureGate", ""); // user_pref("security.OCSP.enabled", ""); // user_pref("security.OCSP.require", ""); +/* 6051: prefsCleaner: reset previously active items removed from arkenfox FF153+ ***/ + // user_pref("privacy.userContext.enabled", ""); + // user_pref("privacy.userContext.ui.enabled", ""); /*** [SECTION 7000]: DON'T BOTHER ***/ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); @@ -1064,8 +1064,8 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF150+] + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT: false FF154+] // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS @@ -1118,12 +1118,10 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5] - // user_pref("network.cookie.cookieBehavior.optInPartitioning", true); // [ETP FF132+] // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] // user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+] // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+] - // user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true] // user_pref("privacy.query_stripping.enabled", true); // [FF101+] // user_pref("privacy.trackingprotection.enabled", true); // user_pref("privacy.trackingprotection.socialtracking.enabled", true); @@ -1191,6 +1189,8 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below. But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides. + READ: https://ritter.vg/blog-telemetry.html + Opt-out - Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain - Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading