User.js: Same project

[TerkiKerel]

Hi,

I was using your userjs but I research more and I see another project on github:
https://github.com/pyllyukko/user.js/

It has more contributors, the user.js and ignore.list files are well documented.

The goal of these both projects are exactly same and they use mostly same js preferences :)

It would be great to see your efforts in one project, so we can share the power and get a better security...

Thank you

[Atavic]

Hi and welcome. Yes, most people in here knows the pyllyukko repo. The owners of both repos collaborate and happily share info. While pyllyukko started earlier, this very repo did a great development... the more, the better!

[Thorin-Oakenpants]

While pyllyukko started earlier

Earlier "on Github" - FTFY ... I had already built an early version of this before I shared with ghacks.net, which was before I stuck it on Github

[Thorin-Oakenpants]

Hey @TerkiKerel , I did some number crunching for you

PK ACTIVE PREFS (284)
===============

items not in GH (75 / 26%)
   31: deprecated before 52 branch (old ciphers NOT in GH)
   13: items where PK is enforcing the default (=same in ESR52+ and FF60)
   31: including 22 `network.protocol*`. Of the remaining 9, some are deprecated
       or do not work (from previous tests & research)

 items in GH (209 / 74%)
  173: the same (157 + 9 + 7) [see 1]
   25: different
  198: FF52+ prefs in common
       12.6% "divergence" in common prefs
   11: deprecated pre FF52 (they happen to all be the same)

[1] 157 identical (incl. minor diffs eg URL values eg data:text)
      9 GH is inactive and PK is enforcing default (checked in both ESR52.8 and FF60)
      7 same end result

I only did the analysis based on comparing PK to GH (not the other way round).

So if you happen to be using an up to date browser, then between GH + PK user.js's

• there are 198 prefs that matter (not deprecated pre FF52) in common with what PK applies
• of these 198 prefs, 12.6% are different
• of these 25 different prefs, 5 are ciphers, which could be viewed as a single item - either match your security suite FP with the default, or slightly harden encryption
• this leaves 20 items of difference, of which a few don't really matter (eg bookmark backups). Some GH is tougher, some PK is tougher. And diffs some won't matter in the context of extensions (eg the cookie setting)

Now PK also has 75 active prefs we don't

• 44 of those don't matter, i.e deprecated or they enforce default
• of the remaining 31, 22 can be viewed as one item (network.protocol*)
• of the remaining 9, at least 2 and maybe up to 7 are useless (they do nothing!)

So far, so good. So these are essentially the same project: there really are only a few major'ish differences that actually matter in the sense of how they affect your privacy/security, and some of these are open to interpretation (eg starting in PB mode) or based on breakage (in trying to strike a balance).

BUT wait a sec. NO WAY are these the same project .. because what we haven't done (but did once just for PK), is any analysis of what GH has that PK doesn't (excluding anything that we enforce at default). And I think that number is a LOT. Also we have cool sections like deprecated, one char switches, sexy formatting, numbered items, more info in the actual user.js (eg FPI and RFP info), and take into account things such as RFP alternatives. And more.

Same project? Nah .. not by a country mile.

PS: I will post the diffs in a new issue at some stage. I've already investigated most, and there's nothing to see or do, TBH. BTW we did this exercise over a year ago.

[Thorin-Oakenpants]

Not a proper comparison, but as of right now, the GH user.js has (excluding the parrot pref)

131 - inactive
392 - active (including if 1-char switches flipped on)
---
523 - total prefs that apply to FF52+

So at most, eg a ESR52.x user who needs to flip the deprecated section and RFP Alts section, 392 prefs are applied. 198 of these are in common with PK, leaving 194 active prefs that GH applies that PK doesn't. Some of these will be enforcing defaults (I haven't analyzed this yet, but lets say 25% - that's still 150 odd difference). Note, that the personal section (5000s) is all inactive. That's a lot of privacy/FP/security etc related prefs.

We've done 9 releases since coming to GitHub (52-60), and without actually counting .. on avg 10 new items per FF release, is 90 items. These two projects would have been a lot closer a year ago, but since then, PK's is woefully out of sync with new prefs (it needs a good comparison to shake out anything super important) but is probably very close on ESR52.x branch.

Already did a monsta diff once for PK, and it was never really fully looked at (it really was a MONSTA to deal with), but they did add quite a lot from it (20 or 30 prefs maybe - some directly from the diff, some later from other people but they were in the monsta diff). PK is always welcome to gather info from here. But don't kid yourself that these are the same project :)