Skip to content

v153 #2056

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Thorin-II wants to merge 6 commits into
base: master
Choose a base branch
from
+17 −15
Open

v153 #2056

Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1a9e0bb
v151
Jun 2, 2026
7602fda
remove privacy.partition.network_state.ocsp_cache
Jul 7, 2026
b0a5a61
fix spelling, remove optInPartitioning #2017
Thorin-II Jul 12, 2026
0f47862
ecdhe_ecdsa_aes_256_sha
Thorin-II Jul 14, 2026
60f3ab6
containers
Thorin-II Jul 22, 2026
26adb5f
FF153+ containers are default true
Thorin-II Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions user.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
/******
* name: arkenfox user.js
* date: 21 April 2026
* version: 144
* date: 20 July 2026
* version: 152
* urls: https://github.com/arkenfox/user.js [repo]
* : https://arkenfox.github.io/gui/ [interactive]
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt
Expand Down Expand Up @@ -394,7 +394,7 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
* but the problem is that the browser can't know that. Setting this pref to true is the only way for the
* browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server
* [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site?
* [STATS] SSL Labs (Nov 2025) reports almost 99.85% of top sites have secure renegotiation [4]
* [STATS] SSL Labs (June 2025) reports almost 99.85% of top sites have secure renegotiation [4]
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://datatracker.ietf.org/doc/html/rfc5746
* [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
Expand Down Expand Up @@ -797,6 +797,8 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!");
1984333 - spoof navigator.hardwareConcurrency as 4 except mac return 8 (FF143)
previously FF55+ it returned 2
1999126 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF147)
2047612 - enforce IME styling in EditContext API (FF154)
2045882 - enforce sRGB in canvas (FF154?)
***/
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
/* 4501: enable RFP
Expand Down Expand Up @@ -961,7 +963,7 @@ user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!");
* [1] http://asmjs.org/
* [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
* [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
// user_pref("javascript.options.asmjs", false);
// user_pref("javascript.options.asmjs", false); // [DEFAULT: false FF148+]
/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART]
* [NOTE] When both Ion and JIT are disabled, and trustedprincipals
* is enabled, then Ion can still be used by extensions (1599226)
Expand Down Expand Up @@ -1064,7 +1066,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies
/* 7003: disable non-modern cipher suites [1]
* [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks
* [1] https://browserleaks.com/ssl ***/
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF150+]
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
Expand Down Expand Up @@ -1123,7 +1125,6 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies
// user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+]
// user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+]
// user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+]
// user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true]
// user_pref("privacy.query_stripping.enabled", true); // [FF101+]
// user_pref("privacy.trackingprotection.enabled", true);
// user_pref("privacy.trackingprotection.socialtracking.enabled", true);
Expand Down Expand Up @@ -1191,6 +1192,8 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan
Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below.
But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides.

READ: https://ritter.vg/blog-telemetry.html

Opt-out
- Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain
- Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading
Expand Down