User.js: ToDo: diffs FF58-FF59

[earthlng]

v58.0 and v59.0 - 200 diffs ( 88 new, 92 gone, 20 different )

FF59 is scheduled for release 2018-03-13

new in v59.0:

• [x] *.referer.defaultPolicy 587523 - https://github.com/ghacksuserjs/ghacks-user.js/commit/93a8f8919109876d448f46ebcefc781151c1ea5b
  
  
  
  • pref("network.http.referer.defaultPolicy", 3);
  
  
  • pref("network.http.referer.defaultPolicy.pbmode", 2);
  
  
• [x] pref("security.csp.enable_violation_events", false); 1425993 & 1037335 - https://github.com/ghacksuserjs/ghacks-user.js/commit/ffced9b4c00082d329f0d39d53e5d116ea968563
• [x] pref("toolkit.telemetry.hybridContent.enabled", true); 1417473 - https://github.com/ghacksuserjs/ghacks-user.js/commit/089f0826cfdd7680986bfe1e570e498b5aeff79b & https://github.com/ghacksuserjs/ghacks-user.js/commit/d4a20165efbc9dbdb46a77ab4b5839419f1cc9d2
• pref("security.insecure_connection_icon.enabled", false); 1273
• pref("security.insecure_connection_icon.pbmode.enabled", false); 1273
• leaving here for visibility
  
  
  
  • pref("privacy.spoof_english", 0); - see #304
  
  
  • pref("privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts", true); 1376865
  
  
  • pref("network.http.sendOriginHeader", 0); 446344 - will wait until Mozilla flip it in 1424076
  
  

removed, renamed or hidden in v59.0:

ALL DONE - https://github.com/ghacksuserjs/ghacks-user.js/commit/3192027f52dc204cf3f28817ec32600eb61b88d4 & https://github.com/ghacksuserjs/ghacks-user.js/commit/d4083e6a3eeba3055b4fa7dcea692ad10f20f285

• [x] pref("camera.control.face_detection.enabled", true); 1416703
• [x] pref("datareporting.healthreport.about.reportUrl", "https://fhr.cdn.mozilla.net/%LOCALE%/v4/"); 1352497
• [x] pref("dom.disable_window_status_change", true); 1425999
• [x] pref("dom.flyweb.enabled", false); 1374574
• [x] pref("dom.idle-observers-api.enabled", true); 1416703
• [x] pref("general.useragent.locale", "en-US"); 1414390
• [x] pref("intl.locale.matchOS", false); 1414390
• [x] pref("media.getusermedia.screensharing.allowed_domains", "long-string"); 1411742
• [x] pref("network.http.referer.userControlPolicy", 3); 587523
• [x] pref("security.mixed_content.send_hsts_priming", false); 1424917
• [x] pref("security.mixed_content.use_hsts", false); 1424917
• [x] pref("security.xpconnect.plugin.unrestricted", true); 1416703

changed in v59.0:

• [x] pref("dom.w3c_pointer_events.enabled", true); // prev: false - https://github.com/ghacksuserjs/ghacks-user.js/commit/0b3395b52017a30377bb429bc377cb119674f4ed
• pref("network.auth.subresource-img-cross-origin-http-auth-allow", false); // prev: true 0911
• pref("security.data_uri.block_toplevel_data_uri_navigations", true); // prev: false 2675
• pref("security.tls.enable_0rtt_data", true); // prev: false 1205
• pref("webchannel.allowObject.urlWhitelist", "moz-domains"); // prev: "moz-domains" 2665

redundant in 59 due to RFP ^{privacy.resistFingerprinting}

• [x] 2511 media.ondevicechange.enabled - 1372073 - https://github.com/ghacksuserjs/ghacks-user.js/commit/6fd415eab23ae8274508af037a4c02845b36df3b

---

ignore

==NEW

pref("alerts.useSystemBackend", true);
pref("apz.pinch_lock.mode", 1);
pref("apz.pinch_lock.scoll_lock_threshold", "0.03125");
pref("apz.pinch_lock.span_breakout_threshold", "0.03125");
pref("apz.pinch_lock.span_lock_threshold", "0.03125");
pref("devtools.debugger.breakpoints-visible", true);
pref("devtools.debugger.expressions-visible", true);
pref("devtools.debugger.features.breakpoints-dropdown", false);
pref("devtools.debugger.features.chrome-scopes", false);
pref("devtools.debugger.features.code-coverage", false);
pref("devtools.debugger.features.code-folding", false);
pref("devtools.debugger.features.event-listeners", false);
pref("devtools.debugger.features.map-scopes", false);
pref("devtools.debugger.features.outline", true);
pref("devtools.debugger.features.remove-command-bar-options", false);
pref("devtools.debugger.features.workers", true);
pref("devtools.debugger.scopes-visible", true);
pref("devtools.debugger.workers-visible", true);
pref("devtools.highlighter.writingModeAdjust", false);
pref("devtools.inspector.flexboxHighlighter.enabled", false);
pref("devtools.inspector.split-rule-enabled", false);
pref("devtools.inspector.split-sidebar-toggle", false);
pref("devtools.performance.new-panel-enabled", false);
pref("devtools.webconsole.sidebarToggle", false);
pref("dom.animations-api.pending-member.enabled", true);
pref("dom.clients.openwindow_favors_same_process", true);
pref("dom.registerContentHandler.enabled", true);
pref("dom.select_popup_in_content.enabled", false);
pref("dom.vr.controller.enumerate.interval", 1000);
pref("dom.vr.display.enumerate.interval", 5000);
pref("dom.vr.inactive.timeout", 5000);
pref("dom.vr.oculus.invisible.enabled", true);
pref("dom.webcomponents.shadowdom.enabled", false);
pref("extensions.formautofill.section.enabled", true);
pref("extensions.formautofill.supportedCountries", "US");
pref("extensions.formautofill.supportRTL", false);
pref("extensions.webextensions.tabhide.enabled", false);
pref("font.name-list.emoji", "Segoe UI Emoji, EmojiOne Mozilla");
pref("full-screen-api.ignore-widgets", false);
pref("gfx.direct2d.destroy-dt-on-paintthread", true);
pref("gfx.downloadable_fonts.keep_color_bitmaps", false);
pref("gfx.webrender.all", false);
pref("gfx.webrender.debug.compact-profiler", false);
pref("gfx.webrender.debug.disable-batching", false);
pref("gfx.webrender.debug.epochs", false);
pref("gfx.webrender.debug.gpu-sample-queries", false);
pref("gfx.webrender.debug.gpu-time-queries", false);
pref("gfx.webrender.hit-test", false);
pref("gfx.webrender.program-binary", true);
pref("identity.fxaccounts.remote.connectdevice.uri", "https://accounts.firefox.com/connect_another_device?service=sync&context=fx_desktop_v3");
pref("intl.charset.fallback.utf8_for_file", false);
pref("intl.ime.hack.set_input_scope_of_url_bar_to_default", true);
pref("javascript.options.spectre.index_masking", true);
pref("layers.omtp.paint-workers", 1);
pref("layout.css.moz-document.content.enabled", true);
pref("layout.css.overscroll-behavior.enabled", true);
pref("layout.display-list.retain.chrome", false);
pref("media.eme.hdcp-policy-check.enabled", false);
pref("media.peerconnection.rtpsourcesapi.enabled", true);
pref("media.seamless-looping", true);
pref("media.wmf.amd.highres.enabled", true);
pref("network.activity.intervalMilliseconds", 0);
pref("network.http.tailing.total-max", 45000);
pref("network.http.throttle.hold-time-ms", 800);
pref("network.http.throttle.max-time-ms", 500);
pref("network.http.throttle.read-interval-ms", 500);
pref("network.http.throttle.read-limit-bytes", 8000);
pref("network.http.throttle.version", 1);
pref("network.protocol-handler.external.htp", false);
pref("network.protocol-handler.external.htps", false);
pref("network.tcp.tcp_fastopen_http_check_for_stalls_only_if_idle_for", 10);
pref("network.tcp.tcp_fastopen_http_stalls_limit", 3);
pref("network.tcp.tcp_fastopen_http_stalls_timeout", 20);
pref("security.mixed_content.block_object_subrequest", false);
pref("security.signed_app_signatures.policy", 2);
pref("services.sync.log.logger", "Debug");
pref("services.sync.log.logger.engine", "Debug");
pref("webgl.max-contexts", 32);
pref("webgl.max-contexts-per-principal", 16);

==REMOVED or HIDDEN

pref("accessibility.usebrailledisplay", "");
pref("application.use_ns_plugin_finder", false);
pref("browser.chrome.toolbar_style", 2);
pref("browser.helperApps.alwaysAsk.force", false);
pref("browser.popups.showPopupBlocker", true);
pref("browser.search.order.US.3", "data:text/plain,browser.search.order.US.3=Bing");
pref("capability.policy.default.SOAPCall.invokeVerifySourceHeader", "allAccess");
pref("devtools.debugger.features.project-text-search", true);
pref("devtools.gridinspector.showNegativeLineNumbers", false);
pref("devtools.migration.warnings", true);
pref("devtools.remote.wifi.visible", true);
pref("devtools.telemetry.supported_performance_marks", "contentInteractive,navigationInteractive,navigationLoaded,visuallyLoaded,fullyLoaded,mediaEnumerated,scanEnd");
pref("dom.idle_period.throttled_length", 10000);
pref("dom.serviceWorkers.openWindow.enabled", true);
pref("dom.sysmsg.enabled", false);
pref("dom.webapps.useCurrentProfile", false);
pref("dom.webcomponents.enabled", false);
pref("extensions.getAddons.maxResults", 15);
pref("extensions.getAddons.recommended.url", "https://services.addons.mozilla.org/%LOCALE%/%APP%/api/%API_VERSION%/list/recommended/all/%MAX_RESULTS%/%OS%/%VERSION%?src=firefox");
pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%/%COMPATIBILITY_MODE%?src=firefox");
pref("gfx.font_rendering.directwrite.force-enabled", false);
pref("images.dither", "auto");
pref("javascript.options.mem.gc_refresh_frame_slices_enabled", true);
pref("layers.advanced.text-layers", 2);
pref("layers.gralloc.disable", false);
pref("layers.omtp.force-sync", false);
pref("layout.css.grid.enabled", true);
pref("media.cache.resource-index", 8192);
pref("media.getusermedia.aec_delay_agnostic", true);
pref("media.getusermedia.playout_delay", 40);
pref("media.navigator.load_adapt", true);
pref("media.navigator.load_adapt.avg_seconds", 3);
pref("media.navigator.load_adapt.encoder_only", true);
pref("media.navigator.load_adapt.high_load", "0.90");
pref("media.navigator.load_adapt.low_load", "0.40");
pref("media.navigator.load_adapt.measure_interval", 1000);
pref("media.navigator.video.default_minfps", 10);
pref("media.peerconnection.video.h264_enabled", false);
pref("media.raw.enabled", true);
pref("media.wmf.decoder.thread-count", -1);
pref("middlemouse.openNewWindow", true);
pref("network.activity.blipIntervalMilliseconds", 0);
pref("network.http.throttle.resume-background-in", 1000);
pref("network.http.throttle.time-window", 3000);
pref("notification.feature.enabled", false);
pref("prefs.converted-to-utf8", false);
pref("print.always_cache_old_pres", false);
pref("print.print_extra_margin", 90);
pref("profile.confirm_automigration", true);
pref("profile.migration_behavior", 0);
pref("profile.migration_directory", "");
pref("profile.seconds_until_defunct", -1);
pref("security.checkloaduri", true);
pref("security.mixed_content.hsts_priming_cache_timeout", 604800);
pref("security.mixed_content.hsts_priming_request_timeout", 2000);
pref("security.use_sqldb", true);
pref("services.sync.log.logger.addonutils", "Debug");
pref("services.sync.log.logger.authenticator", "Debug");
pref("services.sync.log.logger.declined", "Debug");
pref("services.sync.log.logger.engine.addons", "Debug");
pref("services.sync.log.logger.engine.addresses", "Debug");
pref("services.sync.log.logger.engine.apps", "Debug");
pref("services.sync.log.logger.engine.bookmarks", "Debug");
pref("services.sync.log.logger.engine.clients", "Debug");
pref("services.sync.log.logger.engine.creditcards", "Debug");
pref("services.sync.log.logger.engine.extension-storage", "Debug");
pref("services.sync.log.logger.engine.forms", "Debug");
pref("services.sync.log.logger.engine.history", "Debug");
pref("services.sync.log.logger.engine.passwords", "Debug");
pref("services.sync.log.logger.engine.prefs", "Debug");
pref("services.sync.log.logger.engine.tabs", "Debug");
pref("services.sync.log.logger.identity", "Debug");
pref("services.sync.log.logger.network.resources", "Debug");
pref("services.sync.log.logger.service.main", "Debug");
pref("services.sync.log.logger.status", "Debug");
pref("services.sync.log.rootLogger", "Debug");
pref("stagefright.disabled", false);
pref("stagefright.force-enabled", false);
pref("ui.key.saveLink.shift", true);
pref("viewmanager.do_doublebuffering", true);

==CHANGED

pref("browser.search.order.US.2", "data:text/plain,browser.search.order.US.2=Bing"); // prev: "data:text/plain,browser.search.order.US.2=Yahoo"
pref("devtools.debugger.call-stack-visible", true); // prev: false
pref("dom.event.coalesce_mouse_move", true); // prev: false
pref("dom.min_tracking_background_timeout_value", 4); // prev: 10000
pref("dom.vr.oculus.present.timeout", 500); // prev: 10000
pref("dom.vr.oculus.quit.timeout", 10000); // prev: 30000
pref("gfx.webrender.blob-images", 2); // prev: false
pref("image.mem.shared", 2); // prev: false
pref("media.getusermedia.agc", 3); // prev: 1
pref("media.webvtt.regions.enabled", true); // prev: false
pref("network.http.rcwn.enabled", true); // prev: false
pref("privacy.reduceTimerPrecision", true); // prev: false
pref("privacy.resistFingerprinting.reduceTimerPrecision.microseconds", 2000); // prev: 20
pref("services.sync.engine.tabs.filteredUrls", "^(about:.*|resource:.*|chrome:.*|wyciwyg:.*|file:.*|blob:.*|moz-extension:.*)$"); // prev: "^(about:.*|resource:.*|chrome:.*|wyciwyg:.*|file:.*|blob:.*)$"
pref("urlclassifier.disallow_completions", "see comment") // new value adds "goog-passwordwhite-proto"

[earthlng]

bugzilla tickets

• accessibility.usebrailledisplay
  Bug 1416703 - Part 1: Remove dead accessibility prefs in all.js.

• alerts.useSystemBackend
  Bug 1418287 - Add preference to disable the system notification service

• application.use_ns_plugin_finder
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• apz.pinch_lock.mode
  Bug 1180865 - Implement pinch locking in APZC.

• apz.pinch_lock.scoll_lock_threshold
  Bug 1180865 - Implement pinch locking in APZC.

• apz.pinch_lock.span_breakout_threshold
  Bug 1180865 - Implement pinch locking in APZC.

• apz.pinch_lock.span_lock_threshold
  Bug 1180865 - Implement pinch locking in APZC.

• browser.chrome.toolbar_style
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• browser.helperApps.alwaysAsk.force
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• browser.popups.showPopupBlocker
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• camera.control.face_detection.enabled
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• capability.policy.default.SOAPCall.invokeVerifySourceHeader
  Bug 1416703 - Part 8: Remove dead security prefs in all.js.

• devtools.debugger.call-stack-visible
  Bug 1328693 - Extract debugger preferences.
  Bug 1331654 - Bump Debugger.

• devtools.debugger.scopes-visible
  Bug 1328693 - Extract debugger preferences.
  Bug 1331654 - Bump Debugger.

• devtools.devedition.promo.enabled
  Bug 1204808 - Move devtools prefs to its own file in /devtools folder.

• devtools.gridinspector.showNegativeLineNumbers
  Bug 1424669 - Enable negative line numbers in the grid inspector.
  Bug 1369942 - Display Negative Line Numbers in CSS Grid Inspector.

• devtools.highlighter.writingModeAdjust
  Bug 1303171 - Adjust highlighters to account for writing mode and text dir.

• devtools.inspector.flexboxHighlighter.enabled
  Bug 1414275 - Part 2: Toggle flexbox layout highlighter from the rule view next to 'display: flex|inline-flex' declarations.

• devtools.inspector.split-rule-enabled
  Bug 1369945 - Display a split rule view panel in the inspector.

• devtools.inspector.split-sidebar-toggle
  Bug 1369945 - Display a split rule view panel in the inspector.

• devtools.migration.warnings
  Bug 1416703 - Part 4: Remove dead devtools prefs in all.js.

• devtools.performance.new-panel-enabled
  Bug 1408124 - Create a new perf actor and recording panel

• devtools.remote.wifi.visible
  Bug 1416703 - Part 4: Remove dead devtools prefs in all.js.

• devtools.telemetry.supported_performance_marks
  Bug 1416703 - Part 4: Remove dead devtools prefs in all.js.

• devtools.webconsole.sidebarToggle
  Bug 1419075 - Create a button that open a sidebar in the console.

• dom.animations-api.pending-member.enabled
  Bug 1412765 - Enable dom.animations-api.pending-member.enabled by default

• dom.clients.openwindow_favors_same_process
  Bug 1424338 P4 Implement ClientManager::OpenWindow()

• dom.disable_window_status_change
  Bug 1425999 - Remove the dom.disable_window_status_change pref, as it no longer can be disabled

• dom.event.coalesce_mouse_move
  Bug 1403743 - Keeping the mousemove coalescing enabled in the release build

• dom.flyweb.enabled
  Bug 1374574 - Remove the FlyWeb service and DOM interfaces.

• dom.idle_period.throttled_length
  Bug 1419144 - Part 2: Remove unused gThrottledIdlePeriodLength

• dom.idle-observers-api.enabled
  Bug 1416703 - Part 7: Remove some dead prefs in all.js

• dom.min_tracking_background_timeout_value
  Bug 1427614 - Turn off foreground throttling of tp timeouts

• dom.registerContentHandler.enabled
  Bug 1398169 - Use pref to disable registerContentHandler in non stable builds

• dom.select_popup_in_content.enabled
  Bug 1425088 - (Part 1) Add new pref to enable content-select

• dom.serviceWorkers.openWindow.enabled
  Bug 1293277 P3 Remove the dom.serviceWorkers.openWindow.enabled pref

• dom.sysmsg.enabled
  Bug 1416703 - Part 7: Remove some dead prefs in all.js

• dom.vr.controller.enumerate.interval
  Bug 1407423 - Ensure that any time we have loaded the Oculus runtime libary, we are polling ShouldQuit

• dom.vr.display.enumerate.interval
  Bug 1407423 - Ensure that any time we have loaded the Oculus runtime libary, we are polling ShouldQuit

• dom.vr.inactive.timeout
  Bug 1407423 - Ensure that any time we have loaded the Oculus runtime libary, we are polling ShouldQuit

• dom.vr.oculus.invisible.enabled
  Bug 1384279 - Oculus Rift Core 2.0 Adjustments

• dom.vr.oculus.present.timeout
  Bug 1384279 - Oculus Rift Core 2.0 Adjustments

• dom.vr.oculus.quit.timeout
  Bug 1384279 - Oculus Rift Core 2.0 Adjustments

• dom.webapps.useCurrentProfile
  Bug 1416703 - Part 7: Remove some dead prefs in all.js

• dom.webcomponents.enabled
  Bug 1428685 - Use dom.webcomponents.shadowdom.enabled pref for Shadow DOM.
  Bug 1428002 - Enable <script type="module"> in nightly builds
  Bug 1037335 - Add a pref to enable only within Nightly and Early Beta.

• dom.webcomponents.shadowdom.enabled
  Bug 1428685 - Use dom.webcomponents.shadowdom.enabled pref for Shadow DOM.

• extensions.formautofill.creditCards.available
  Bug 1417336 - [Form Autofill] Enable credit card autofill by default on beta build.
  Bug 1399382 - Add a pref to hide credit card autofill feature

• extensions.formautofill.section.enabled
  Bug 1339731 - Refactor FormAutofillHandler to support multiple section machanism.

• extensions.formautofill.supportedCountries
  Bug 1419312 - Expand supported locales and countries on Nightly and Beta.
  Bug 1417818 - Add CA/DE metadata from libaddressinput.
  Bug 1417843 - Add supportedCountries pref to configure which countries are supported.

• extensions.formautofill.supportRTL
  Bug 1419312 - Expand supported locales and countries on Nightly and Beta.

• extensions.getAddons.maxResults
  Bug 1263313 Remove search pane from about:addons

• extensions.getAddons.recommended.url
  Bug 1263313 Remove search pane from about:addons

• extensions.getAddons.search.url
  Bug 1263313 Remove search pane from about:addons

• extensions.webextensions.tabhide.enabled
  Bug 1423725 add show/hide tabs api,

• font.name-list.emoji
  Bug 1032671 - Part 3. Set font.name-list.emoji for some platforms.

• font.name-list.sans-serif.ko
  Bug 1407869 - Use Malgun Gothic as default on Korean on Nightly

• full-screen-api.ignore-widgets
  Bug 1422535 - Add full-screen-api.ignore-widgets pref to all.js so it's listed in about:config.

• general.useragent.locale
  Bug 1414390 - Add intl.locale.requested locale list to replace general.useragent.locale.

• gfx.direct2d.destroy-dt-on-paintthread
  Bug 1422169: Have the D3D11TextureData destructor defer releasing the last reference to its DrawTarget to the paint thread.

• gfx.downloadable_fonts.keep_color_bitmaps
  Bug 1418818 - Allow downloadable fonts to include CBLC/CBDT tables on platforms where we're using Freetype.

• gfx.font_rendering.directwrite.force-enabled
  Bug 1416703 - Part 6: Remove dead gfx prefs in all.js.

• gfx.webrender.all
  Bug 1425260: gfx.webrender.all turns on all preferences that are needed for webrender.

• gfx.webrender.blob-images
  Bug 1425260: gfx.webrender.all turns on all preferences that are needed for webrender.

• gfx.webrender.debug.compact-profiler
  Bug 1425791 - Update WebRenderDebugPref

• gfx.webrender.debug.disable-batching
  Bug 1420123 - Expose more WebRender debug flags to prefs.

• gfx.webrender.debug.epochs
  Bug 1425791 - Update WebRenderDebugPref

• gfx.webrender.debug.gpu-sample-queries
  Bug 1420123 - Expose more WebRender debug flags to prefs.

• gfx.webrender.debug.gpu-time-queries
  Bug 1420123 - Expose more WebRender debug flags to prefs.

• gfx.webrender.hit-test
  Bug 1423982 - Only do the WR-based hit-test if WR is enabled.

• gfx.webrender.program-binary
  Bug 1391159 - Handle WebRender ProgramBinary usage

• identity.fxaccounts.remote.connectdevice.uri
  Bug 1418466 - Add Connect Another Device button to relevant Sync UI.

• image.mem.shared
  Bug 1425260: gfx.webrender.all turns on all preferences that are needed for webrender.

• images.dither
  Bug 1416703 - Part 6: Remove dead gfx prefs in all.js.

• intl.charset.fallback.utf8_for_file
  Bug 1071816 - Add a pref to fallback to UTF-8 for files from file: URLs.

• intl.ime.hack.set_input_scope_of_url_bar_to_default
  Bug 1420215 - Make TSFTextStore set input scope of URL bar to IS_DEFAULT when some Microsoft's Trandtional and Simplified Chinese IMEs and some Microsoft's Korean IMEs which change their open state to "closed" when input scope is IS_URL

• intl.locale.matchOS
  Bug 1414390 - Add intl.locale.requested locale list to replace general.useragent.locale.

• javascript.options.mem.gc_refresh_frame_slices_enabled
  Bug 1421358 - Remove GCRuntime::notifyDidPaint and refresh_frame_slices.enabled pref.

• javascript.options.spectre.index_masking
  Bug 1430053 - Add prefs for index masking Spectre mitigations.

• layers.advanced.text-layers
  Bug 1406231 - remove the TextLayer class, and all remaining traces of it.

• layers.gralloc.disable
  Bug 1416703 - Part 6: Remove dead gfx prefs in all.js.

• layers.omtp.force-sync
  Remove layers.omtp.force-sync preference (bug 1416941,

• layers.omtp.paint-workers
  Create a PaintWorker thread pool and dispatch tiles to it (bug 1425056,

• layout.css.grid.enabled
  Bug 1398492: Remove the grid pref.

• layout.css.moz-document.content.enabled
  Bug 1035091: Disable @-moz-document on author sheets on nightly and early beta.

• layout.css.overscroll-behavior.enabled
  Bug 1428879 - Enable layout.css.overscroll-behavior.enabled by default.
  Bug 951793 - Style support for overscroll-behavior.

• layout.display-list.retain.chrome
  Bug 1413546 - Add pref to allow retained display lists within the parent process.

• media.cache.resource-index
  Bug 1414759 - Replace some unnecessary media prefs with code constants.

• media.eme.hdcp-policy-check.enabled
  Bug 1404230 - Part1 - Add media.eme.hdcp-policy-check.enabled for flexibility turning on/off this feature.

• media.getusermedia.aec_delay_agnostic
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.getusermedia.agc
  Bug 1397793 - Move to APM - Part 1 - UpdateSingleSource.

• media.getusermedia.playout_delay
  Bug 1411742 Remove the pref media.getusermedia.playout_delay and the field as they are not used anywhere

• media.getusermedia.screensharing.allowed_domains
  Bug 1411742 Remove all references to media.getusermedia.screensharing.allowed_domains as we have removed all uses of it in the code

• media.navigator.load_adapt
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.navigator.load_adapt.avg_seconds
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.navigator.load_adapt.encoder_only
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.navigator.load_adapt.high_load
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.navigator.load_adapt.low_load
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.navigator.load_adapt.measure_interval
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.navigator.video.default_minfps
  Bug 1411742 Remove the media.navigator.video.default_minfps pref and all uses of it as the field is never actually used

• media.peerconnection.rtpsourcesapi.enabled
  Bug 1430213 - add toggle pref for RTCRtpReceiver RTP sources APIs

• media.peerconnection.video.h264_enabled
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.raw.enabled
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• media.seamless-looping
  Bug 654787 - part1: Add pref for audio seamless looping;

• media.webvtt.regions.enabled
  Bug 1415805 - enable region preference and wpt tests webvtt/api/VTTRegion.

• media.wmf.amd.highres.enabled
  Bug 1417973 - Always use the AMD GPU decoder.

• media.wmf.decoder.thread-count
  Bug 1414759 - Replace some unnecessary media prefs with code constants.

• middlemouse.openNewWindow
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• network.activity.blipIntervalMilliseconds
  Bug 1415536 - Extend NotifyNetworkActivity to get sent/received bytes

• network.activity.intervalMilliseconds
  Bug 1415536 - Extend NotifyNetworkActivity to get sent/received bytes

• network.auth.subresource-img-cross-origin-http-auth-allow
  Bug 1423146 - Change a pref so that an auth prompt requested by an image resource loaded from cross-originis not allowed.

• network.http.rcwn.enabled
  Bug 1392841 - Enable RCWN on Nightly,

• network.http.referer.defaultPolicy
  Bug 587523 - rename referer.userControlPolicy to referer.defaultPolicy

• network.http.referer.defaultPolicy.pbmode
  Bug 587523 - strict-origin-when-cross-origin referer policy in pbmode

• network.http.referer.userControlPolicy
  Bug 587523 - rename referer.userControlPolicy to referer.defaultPolicy

• network.http.sendOriginHeader
  Bug 446344 - Implement Origin header CSRF mitigation.

• network.http.tailing.total-max
  Bug 1425301 - Progressively decrease the 6 seconds maximum quantum delay of tracker script tailing,

• network.http.throttle.hold-time-ms
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.http.throttle.max-time-ms
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.http.throttle.read-interval-ms
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.http.throttle.read-limit-bytes
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.http.throttle.resume-background-in
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.http.throttle.time-window
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.http.throttle.version
  Bug 1386746 - Throttle HTTP response by allowing only small amount of data to read periodically,

• network.protocol-handler.external.htp
  Bug 1422869 - Add "htp" and "htps" to the scheme typo fixup list.

• network.protocol-handler.external.htps
  Bug 1422869 - Add "htp" and "htps" to the scheme typo fixup list.

• network.tcp.tcp_fastopen_enable
  Bug 1426367 - Turn on TFO for Windows.

• network.tcp.tcp_fastopen_http_check_for_stalls_only_if_idle_for
  Bug 1426366 - Detect http transaction stalls with TFO.

• network.tcp.tcp_fastopen_http_stalls_limit
  Bug 1426366 - Detect http transaction stalls with TFO.

• network.tcp.tcp_fastopen_http_stalls_timeout
  Bug 1426366 - Detect http transaction stalls with TFO.

• notification.feature.enabled
  Bug 952453 - Remove mozNotification API

• prefs.converted-to-utf8
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• print.always_cache_old_pres
  Bug 1416703 - Part 2: Remove dead prefs for printing in all.js.

• print.print_extra_margin
  Bug 1416703 - Part 2: Remove dead prefs for printing in all.js.

• privacy.reduceTimerPrecision
  Bug 1424341 Add privacy.reduceTimerPrecision and privacy.reduceTimerPrecision.microseconds prefs and tests

• privacy.spoof_english
  Bug 1039069 - Provide a popup about English for international users.

• profile.confirm_automigration
  Bug 1416703 - Part 5: Remove dead prefs for profile management in all.js.

• profile.migration_behavior
  Bug 1416703 - Part 5: Remove dead prefs for profile management in all.js.

• profile.migration_directory
  Bug 1416703 - Part 5: Remove dead prefs for profile management in all.js.

• profile.seconds_until_defunct
  Bug 1416703 - Part 5: Remove dead prefs for profile management in all.js.

• security.checkloaduri
  Bug 1416703 - Part 8: Remove dead security prefs in all.js.

• security.csp.enable_violation_events
  Bug 1425993 - Make security violation events Nightly-only and update test expectations accordingly.
  Bug 1037335 - Add a pref to enable only within Nightly and Early Beta.

• security.data_uri.block_toplevel_data_uri_navigations
  Bug 1401895 - Block top-level navigations to data: URIs.

• security.insecure_connection_icon.enabled
  Bug 1310447 - Add a pref to display a negative indicator in the URL bar for non-secure sites

• security.insecure_connection_icon.pbmode.enabled
  Bug 1310447 - Add a pref to display a negative indicator in the URL bar for non-secure sites

• security.mixed_content.block_object_subrequest
  Bug 1190623 - Add a pref to consider object sub requests as active.

• security.mixed_content.hsts_priming_cache_timeout
  Bug 1424917 - Remove support for HSTS Priming.
  Bug 1339669 - Update security.mixed_content.hsts_priming_cache_timeout default

• security.mixed_content.hsts_priming_request_timeout
  Bug 1424917 - Remove support for HSTS Priming.
  Bug 1374443 - Decrease HSTS priming timeout to 2s

• security.mixed_content.send_hsts_priming
  Bug 1424917 - Remove support for HSTS Priming.

• security.mixed_content.use_hsts
  Bug 1424917 - Remove support for HSTS Priming.

• security.signed_app_signatures.policy
  Bug 1403844 - Verify COSE signature on add-ons,
  bug 1421413 - add a preference to control which add-on signature algorithms are valid

• security.tls.enable_0rtt_data
  Bug 1425196 - Turn on the TLS1.3 early-data.
  Bug 1423988 - Turn off the tls 1.3 early-data.

• security.tls.version.max
  Bug 1368599 - Disable TLS 1.3 by default for Release 55.

• security.use_sqldb
  bug 1417677 - remove "security.use_sqldb" and always use the sqlite-backed NSS DBs
  bug 783994 - use the sqlite-backed certificate and key DBs
  bug 1398932 - add a preference for enabling the sqlite-backed NSS databases

• security.xpconnect.plugin.unrestricted
  Bug 1416703 - Part 8: Remove dead security prefs in all.js.

• stagefright.disabled
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• stagefright.force-enabled
  Bug 1416703 - Part 3: Remove dead media prefs in all.js.

• toolkit.telemetry.hybridContent.enabled
  Bug 1417473 - Enable the hybrid content telemetry API.

• ui.key.saveLink.shift
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• urlclassifier.disallow_completions
  Bug 1407879 - Check password field url against the local whitelist.
  Bug 1385484 - Cleanup Safe Browsing prefs and sync the download protection setting.
  Bug 1375277 - New safebrowsing threat type "POTENTIALLY_HARMFUL_APPLICATION" introduced by v4.

• viewmanager.do_doublebuffering
  Bug 1416703 - Part 7: Remove some dead prefs in all.js.

• webchannel.allowObject.urlWhitelist
  Bug 1346072 - Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels.

• webgl.max-contexts
  Bug 1421481 - Increase allowed number of webgl contexts on mobile.

• webgl.max-contexts-per-principal
  Bug 1421481 - Increase allowed number of webgl contexts on mobile.

[Thorin-Oakenpants]

hmm .. where did intl.locale.requested in 0205 go? - https://github.com/ghacksuserjs/ghacks-user.js/commit/14c1620994f10e4a4d34f515a6ba22b5b725e058 - zilla link in comments on commit

[earthlng]

it's a hidden pref

[Thorin-Oakenpants]

network.http.referer.defaultPolicy.pbmode -> 587523 pb mode non-secure referers -> moz blog

We made this change only after first ensuring that this would have minimal to no effect on web usability

Awesome. So can this be enforced in normal mode as well? (I haven't read thru the ticket or patches, so if @fmarier can give a quick answer, or someone wants to check it out for me, then that would cool, otherwise I'll come back to it). Note there are two other new referer prefs and one removed, so we should look at them all together

[1] https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ <- breakage report/study

[fmarier]

The network.http.referer.defaultPolicy.* prefs are just setting the default referrers. You can ignore those and just set network.http.referer.XOriginTrimmingPolicy or network.http.referer.XOriginPolicy directly. The latter are not overridable and take precedence over defaultPolicy*.

[Thorin-Oakenpants]

^^ Don't answer, I'll get to it another day .. but if "the latter are not overridable and take precedence over defaultPolicy*" then why bother having a defaultPolicy .. makes no sense in that context, needs MAOR info :)

OffT: Gee whizz some regression is killing keyboard keys: ne1 else having this? works fine in the urlbar/searchbar and other apps (not a hardware problem) - typing and editing is becoming an absolute nightmare [edit doesn't seem to be RFP]

• delete - eg if I type cake and then left arrow back into the word, say before the a in cake and hit delete, nothing happens (if I select what I want to delete though, it works)
• back key - doesn't work at all by the looks of it

^^ Update: its caused by permissions.default.shortcuts from the FF58 release diffs

Back OnT:

In Firefox Regular and Private Browsing Mode, if a site specifically sets a more restrictive or more liberal Referrer Policy than the browser default, the browser will honor the websites request since the site author is intentionally changing the value.

Users can also change their default referrer options in Firefox. These will override the browser’s default Referrer Policy and override the site author’s Referrer Policy, putting the users choice first

^^ This is contradictory. If a site sets a "more restrictive or more liberal" - why not just say "if the policy differs". So if a site sets a policy, and it differs from default, then it gets used, else it uses the user's settings - correct?. HOW does FF determine if settings are default or not? By the user_set/modified status? Or by the value in allprejs.js or whatever it's called?**

[earthlng]

why not just say "if the policy differs".

I think it's nice that they explicitly mention that a "more liberal" policy also overrides the browser default, because I was already wondering if it did that.

So if a site sets a policy, and it differs from default, then it gets used, else it uses the user's settings - correct?

yes and no but mostly no. If a site sets a policy it always overwrites the default browser policy BUT the user settings always take precedence. But depending on the set policy and the user prefs it's possible that the user-prefs don't need to do anything, for example if a site sets a policy to never send referrers.

HOW does FF determine if settings are default or not?

if you mean "how does FF determine if the browser policy should apply", it simply needs to look at the response headers and if the Referrer-Policy header is not set by the site, FF sets its own.
But the actual referer headers are sent with request headers and that's where the "real" user-pref settings are applied if necessary. "real" = 1601-1605 (+1607 if Tor is used)

[earthlng]

I really don't like the claim "referers are best controlled by an extension." nor the recommendation to "Use an extension to block all referers, and then whitelist sites ...", for several reasons:

1. it causes a lot of breakage
2. it makes you stand out a lot
3. it's a shitload of unnecessary work to whitelist all the problematic sites
4. whitelisting is very easy to screw up unless you know exactly what you do

Our #1 recommendation should be to use the settings as we have set them.
#2 can be "hardening" by setting 1603 to 2 (+ optionally 1604 to 1 or 2 for the rare cases where 1603=2 could still leak something, namely when the scheme or port changes)
#3 is better than no protection but it can still cause breakage and we shouldn't recommend to set it that way. Something like "if Option 1 causes problems on certain sites, temporarily reset network.http.referer.XOriginPolicy in about:config, do your thing and then set it back to 1" would be better IMO.
#4 could be the current #3 but with a clear indication that it is a shitty option

[Atavic]

If you look at 3 from Pants eyes (who said he whitelisted a few sites where he logs into) the unnecessary work doesn't exist.

[Thorin-Oakenpants]

@ earthlng - draft something up then. And take into account all the new prefs in 59 if you can. Create a new topic or PR if you want, I don't want to pollute the diffs too much, as I think it might get a lot of chat (i need shit explained to me a lot) - the last time when we looked at 1600, it went on and on and on and on .. 3000 posts if I remember rightly.

I actually agree on the extension part: for now I am just using uM's spoof and our settings. When I used to use the legacy RefControl (I think that was it) for per domain control, it WAS a lot of work to set it up - too much hassle - [edit: it wasn't so much the setting up for my main websites that was the problem - it was all the one off sites I visit = too much breakage and pissing around = often flicked open a secondary browser = defeats the purpose of using my FF setup - end edit]. Meanwhile there are no decent extensions for WebExt - there's this one which looks OK for doing the job, but it's a smelly dirty phone home spying bastard, not that I bothered to dig deeper than the reviews :) Those who want to go the route of per domain will just get some extension.

so :+1: for your ideas
"Except for DNT (Do Not Track), referers are best controlled by an extension" - just remove it

[Thorin-Oakenpants]

FYI (FF60+): https://www.fxsitecompat.com/en-CA/docs/2018/support-for-application-cache-on-insecure-sites-has-been-deprecated/

[Thorin-Oakenpants]

it's a hidden pref

But we have picked up on hidden prefs before, IIRC. Hence why I asked. I just now checked the files you do and in what order. So I guess my "picking up on hidden prefs before" must be wrong. Wonder how we can nail those

[earthlng]

draft something up then. And take into account all the new prefs in 59 if you can.

https://github.com/ghacksuserjs/ghacks-user.js/pull/356 - .sendOriginHeader is most likely not gonna land in FF59 release and isn't included in the PR

[Thorin-Oakenpants]

IF we add the two reduced timer prefs (original bugzilla 1424341): FYI

• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/getTime#Reduced_time_precision
• doc is a work in progress: see https://bugzilla.mozilla.org/show_bug.cgi?id=1217238#c111

[Thorin-Oakenpants]

2511 will be covered by RFP in FF59+. I've added the section to the first post. We also need to keep an eye on geolocation blocking - its going to be removed as part of RFP 1441295 because it 1. TBB can already disable it (geo.enabled) 2. it's behind a prompt

^^ We should probably just do a commit now and move the 4609 & 4612 back to 0201 and 02xx
^^ thumbs up for this

[Thorin-Oakenpants]

https://github.com/ghacksuserjs/ghacks-user.js/commit/2de13258ff968b72708cdbc08dddc0fb02ff8ae5

Its actually worth thinking about setting geo.enabled to inactive and enforcing permissions.default.geo to 2

This would mean all sites will auto deny geolocation requests, but users can then set site specific overrides (for RFP users this won't work until the RFP bit is removed). This makes the user.js more user friendly IMO and I don't see any downsides or issues (unless I'm missing something)

Edit: Except this is no good for ESR52.x users since permissions.default.geo doesn't exist

[Thorin-Oakenpants]

OT: https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/

• catches overflow integers
• The new parser is slightly stricter and rejects some malformed input that the old parser accepted
• invalid escapes
• null chars
• error messages (no warnings) give line numbers (cool!)
• 17 yrs old bug resolved: holy MF ... 107264 - error trapping

also (haven't read the bug yet) allow .js preference files to set locked prefs - this is awesome!! So can we lock prefs now from user.js?

Note that the addition of the ‘locked’ attribute fixed a 10 year old bug 440908

So does this mean the syntax error parrot might not always be true?

Error recovery minimizes the risk of data loss caused by the increased strictness because malformed pref lines in prefs.js will be removed but well-formed pref lines afterwards are preserved

Not sure if any of this is of interest to earthlng & co

Ships in FF60: 1423840

[earthlng]

changed the grammar used by default preference files (but _not_ user preference files) ... The attributes supported so far are ‘sticky’ and ‘locked’.

But yes, the parrot prefs will probably become useless when this lands. When ESR52 reaches EOL we can probably remove them.

[earthlng]

• network.http.sendOriginHeader - wait until they change it to 1 or 2
• privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts - may want to add this, idk
• security.csp.enable_violation_events - they'll eventually enable this but we should never allow it - add to MISC with the other security.csp.* prefs
• security.mixed_content.block_object_subrequest - stupid flash stuff. ignore
• toolkit.telemetry.hybridContent.enabled - add to 0330

ignore everything else I guess

[Thorin-Oakenpants]

Agreed: am looking at the items still in the ``` sections

new

• alerts.useSystemBackend seems fine, its just a pref for using XUL notifications
• dom.clients.openwindow_favors_same_process sounded excited but did my head in :headspin:
• dom.registerContentHandler.enabled we could set to false - they put it behind a pref so they could test it for a few releases before actually stripping out all the code. I think we can ignore this
• extensions.formautofill.section.enabled i don't think we care about a multiple sections pref as we have a master switch, right?
• the rest all look harmless: eme, peerconnection both already covered & not touching spectre prefs

changed

• dom.w3c_pointer_events.enabled - will look for a bugzilla
• rest seem fine

[Thorin-Oakenpants]

done

security.mixed_content.block_object_subrequest - stupid flash stuff. ignore

[Thorin-Oakenpants]

https://bugzilla.mozilla.org/show_bug.cgi?id=1417473#c66 ... https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/ -> 404 not found

Why isn't all this telemetry covered under a master switch. Maybe it is, or under a couple of switches. But man, its getting so convoluted and new prefs every release (pings etc) that its just becoming easier to add the prefs and not investigate

[earthlng]

layout.css.moz-document.content.enabled=false might be worth considering.
https://bugzilla.mozilla.org/show_bug.cgi?id=1035091
https://www.fxsitecompat.com/en-CA/docs/2015/moz-document-support-will-be-dropped/

[Thorin-Oakenpants]

So down to 3 or 5 prefs .. will keep look at the css one later - I need a break (food, a movie, etc)

Can you dig up the w3c pointer and canvas RFP tickets?

edit: canvas - https://bugzilla.mozilla.org/show_bug.cgi?id=1376865 .. never picked up they added a new pref

[earthlng]

https://bugzilla.mozilla.org/show_bug.cgi?id=1411467

[hubiqs]

Sorry if I'm posting where I shouldn't, I just wanted to say what phenomenal work you do, release after release.
Mozillas myriad of changes and anti-features keep piling up, I would find it hard to stomach using Firefox without your work. Hopefully a serious fork will happen one day, with the likes of you involved in it. Until such time, everyone who's capable should be using your config.
Thank you for all your time and efforts in doing this, really. I look forward to the next changelog!

[Thorin-Oakenpants]

https://reviewboard.mozilla.org/r/221164/diff/3#index_header

Just in case this breaks something irrepairably, we have a cutoff pref. We don't intend to keep this pref forever

privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts - I do not think we need to add this to the user.js. I will leave it in the top section for visibility, and mention in the RFP sticky

[Thorin-Oakenpants]

OT: @earthlng may be of interest to you https://github.com/gorhill/uMatrix/issues/967 -> https://bugzilla.mozilla.org/show_bug.cgi?id=1377689

[Thorin-Oakenpants]

Why isn't all this telemetry covered under a master switch

I was looking at the GPO stuff ( https://github.com/mozilla/policy-templates ) that Mike Kaply has going on. I know he's expressed interest in the container prefs section (Tom was showing off on ghacks!), so maybe he's interested in some other items - @mkaply, feel free to peruse the user.js for ideas

Now I'm not 100% sure exactly how this works, but I think any policy is tied to a pref (or prefs: see 1429186), and we can just use those prefs in the user.js (one example already is the fxaccounts we added)

Here is a bugzilla for a policy to handle telemetry - 1429153 - so no idea if they will create a master pref

PS: I'm quite keen to create a group policy sticky and itemize each policy item along with its bugzillas and prefs used

[Thorin-Oakenpants]

• network.http.sendOriginHeader - wait until they change it to 1 or 2

446344 default is 0 in 59.

// Include an origin header on non-GET and non-HEAD requests regardless of CORS
// 0=never send, 1=send when same-origin only, 2=always send

Why wait until Mozilla flip the pref? I'm assuming you're thinking along the lines of enforcing to 0 based on the waiting game? My understanding is that this would be better as 1? @fmarier what are your succinct thoughts on this - when would it be likely to be flipped, and to what?

[Thorin-Oakenpants]

/* 2600s: disable CSP security violation events
 * [earthlng will explain why because I have no idea] ***/  << needs a little more cowbell
user_pref("security.csp.enable_violation_events", false);

---

and last one: dom.w3c_pointer_events.enabled flipped to true in 59 - https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent . Do we really want this? Seems like a lot of data can be gathered here - from hardware (mouse, touch, pen/stylus) and things like width, height, pressure, tangential pressure, tilt(s), twist - there's a lot of entropy in here. I wonder what TBB will do or if they have a ticket open on it. Note the pref has been around since 41.

using 2516 - most of the 2500s are in the 4600's

/* 2516: disable PointerEvents
 * [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent ***/
user_pref("dom.w3c_pointer_events.enabled", false);

[mkaply]

If there is anything in here that is useful at an enterprisey level, I might be interested, but changing this many prefs is way out of our scope. And honestly I'm not convinced that changing a lot of these is even useful.

[earthlng]

@hubiqs Thanks for your kind words! There's never a wrong place for comments like that :)

[earthlng]

re: GPO - here you can see which policies are purely pref-based ie setAndLockPref()

re: sendOriginHeader - it's not ready yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1424076
Once they set it to 2 (which I presume they will) we can set it to 1, maybe with a note for people who want to completely disable it. Origin leaks are already happening right now and there's no pref to disable that. (fe. remote fonts, maybe everything else loaded with CSS as well, IDK, haven't tested it yet)

re: csp violation events - addons like uBO etc cause lots of CSP violation reports, as you can see for example in the uMatrix issue you linked above. uBO and uMatrix can already block these reports which would normally be sent to the server but these new violation events allow a site to receive the reports with JS. Ergo we also want to block those. A site doesn't need to know that we block fonts and whatnot.
https://developer.mozilla.org/en-US/docs/Web/API/SecurityPolicyViolationEvent

re: w3c_pointer_events - I'm not sure. Was disabled until now so it shouldn't cause too many problems if we keep it that way.

[earthlng]

Enterprise policies [meta] ticket

[fmarier]

Why wait until Mozilla flip the pref? I'm assuming you're thinking along the lines of enforcing to 0 based on the waiting game? My understanding is that this would be better as 1? @fmarier what are your succinct thoughts on this - when would it be likely to be flipped, and to what?

It's a good thing to enable because many sites use it to protect against CSRF attacks. It only gets set on non-GET and non-HEAD requests (i.e. it's pretty much just when you submit a form) so it wouldn't really be an effective way to track users.

We've got a few things to fix before we can flip the default value to 2, but you're welcome to enable it now, there shouldn't be any downsides.

[Thorin-Oakenpants]

@mkaply

If there is anything in here that is useful at an enterprisey level, I might be interested

That's what I meant. Since it contains some 450+ relevant prefs for ESR60+, which all retain to security, tracking, privacy etc - that this might be a good list for you to peruse for ideas, that was all. This is where Tom got those container prefs you were interested in

but changing this many prefs is way out of our scope

Yup, not what was I was after :)

[Thorin-Oakenpants]

• PointerEvents - added, and I emailed Arthur on what he plans to do with it
• sendOriginHeader - OK, we'll forget about it until Mozilla flip it (left in at top for visibility)
• CSP violation events - will enforce as false. thanks for the plain English explanation :)

note: I use uBO's no-csp-reports: * true .. can't find the uBO issue where it was argued for and against and gorhill's explanation made me immediately check this option to block CSP reporting

uBO and uMatrix can already block these reports

Umm, where in uM is this?

[Thorin-Oakenpants]

@earthlng https://github.com/ghacksuserjs/ghacks-user.js/commit/ffced9b4c00082d329f0d39d53e5d116ea968563 - if you want to add an explanation, go ahead. Close this issue when happy and I will do a version/date change and release an alpha

[Thorin-Oakenpants]

Ooooh .. haven't looked in there for ages .. its currently

 disableCSPReportInjection false

So I can change that to true, right? - https://github.com/gorhill/uMatrix/wiki/Raw-settings .. something about webworkers

[earthlng]

nvm, I was wrong. Keep that setting false and block csp reports with uBlock.

[earthlng]

@fmarier here you said:

It only gets set on non-GET and non-HEAD requests (i.e. it's pretty much just when you submit a form) so it wouldn't really be an effective way to track users.

but the origin header is already set on a bunch of GET requests even without this new pref. On github fe. in css, js and websocket requests and those are all GET requests. The issue isn't so much tracking but leaking information. IMO it's particularly bad for remote fonts fe. from google. Are you guys aware of that? Are there any plans to change that behavior? If not, why? Why do fe. fonts need to send an origin header? There are no CSRF risks when requesting fonts

[fmarier]

The Origin header in that case comes from CORS, not the CSRF protection feature. It's a little confusing because the same header name is used for two different features.