User.js: ToDo: AS overhaul

[Thorin-Oakenpants]

To do after we get 63-beta out

• move it out of system addons section (no need to cater for ESR, we have an archived v60 for that)
• expand/check on all the prefs (although old, see #396 )

[claustromaniac]

FWIW I have this on FF 64. Some of them are absolutely not necessary, but whatever.

clickey

// ACTIVITY STREAM
user_pref("browser.newtabpage.activity-stream.asrouter.devtoolsEnabled", false);
user_pref("browser.newtabpage.activity-stream.default.sites", "");
user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
user_pref("browser.newtabpage.activity-stream.feeds.aboutpreferences", false); // FF61+
user_pref("browser.newtabpage.activity-stream.feeds.asrouterfeed", false);
user_pref("browser.newtabpage.activity-stream.feeds.favicon", false);
user_pref("browser.newtabpage.activity-stream.feeds.messagecenterfeed", false); // FF61+
user_pref("browser.newtabpage.activity-stream.feeds.migration", false);
user_pref("browser.newtabpage.activity-stream.feeds.newtabinit", false);
user_pref("browser.newtabpage.activity-stream.feeds.places", false);
user_pref("browser.newtabpage.activity-stream.feeds.prefs", false);
user_pref("browser.newtabpage.activity-stream.feeds.section.highlights", false);
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "");
user_pref("browser.newtabpage.activity-stream.feeds.sections", false);
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
user_pref("browser.newtabpage.activity-stream.feeds.systemtick", false);
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.feeds.theme", false);
user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
user_pref("browser.newtabpage.activity-stream.filterAdult", false);
user_pref("browser.newtabpage.activity-stream.fxaccounts.endpoint", "");
user_pref("browser.newtabpage.activity-stream.improvesearch.noDefaultSearchTile", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts.searchEngines", "");
user_pref("browser.newtabpage.activity-stream.messageCenterExperimentEnabled", false);
// user_pref("browser.newtabpage.activity-stream.migrationExpired", true);
user_pref("browser.newtabpage.activity-stream.prerender", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includeBookmarks", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includeDownloads", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includeVisited", false);
user_pref("browser.newtabpage.activity-stream.showSearch", false);
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
user_pref("browser.newtabpage.activity-stream.showTopSites", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
user_pref("browser.newtabpage.activity-stream.telemetry.ut.events", false);
user_pref("browser.newtabpage.activity-stream.tippyTop.service.endpoint", "");

[earthlng]

listing all the options would be good

we already use a blank newtab page and disable the remote-y things because that's what most people don't like. If someone wants to use AS they can easily find all remaining options in the UI.
I don't think we need to add anything more atm.

[Atavic]

Seems another kind of beast to me.
It has its own modules, type:
resource://activity-stream/

[earthlng]

/* 0105: disable Activity Stream stuff (FF54+)
 * Activity Stream is the default homepage/newtab in FF57+. It is based on metadata and browsing behavior,
 * and includes telemetry and web content such as snippets, top stories (pocket), top sites, etc.
 *  - ONE: make sure to set your "home" and "newtab" to about:blank (or use an extension to control them)
 *  - TWO: DELETE the XPI file in your System Add-ons directory (note this get reinstalled on app updates)
 * And/or you can try to control the ever-growing, ever-changing "browser.newtabpage.activity-stream.*" prefs
 * [FF63+] Activity Stream (AS) is now builtin and no longer an easily deletable system addon!
 * [SETTING] Home>Firefox Home Content> ...
 * [1] https://wiki.mozilla.org/Firefox/Activity_Stream ***/
/* 0105a: disable AS telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
/* 0105b: disable AS Snippets ***/
user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false); // [SETTING] Home>Firefox Home Content>Snippets
/* 0105c: disable AS Top Stories and other Pocket-based and/or sponsored content ***/
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false); // [SETTING] Home>Firefox Home Content>Highlights>Pages Saved to Pocket
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
/* 0105d: disable AS recent Highlights in the Library (FF57+) ***/
   // user_pref("browser.library.activity-stream.enabled", false);

[earthlng]

or "disable Activity Stream stuff (ASS)" and "disable ASS telemetry" etc :smile:

[claustromaniac]

:cat2:'s :ballot_box: = :hash::three:

However, as long as the remote stuff stays disabled, I don't really mind. If you end up going for option 1, you may want to add the ui stuff inactive, though. Or, maybe that would be better left for the ever in-progress relaxed variant? BTW, and this is outright OT, what do you guys think about asking for more feedback? Adding some lines in the wiki and/or maybe in the updater scripts might help with that.

[earthlng]

we can go with the 3-line header but I don't really like your title.
I'm in favor of option 2 and NOT lumped together.

btw those who want AS real pretty may also want to reset browser.pagethumbnails.capturing_disabled.

[Thorin-Oakenpants]

new in FF64

pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"id\":\"cfr\",\"enabled\":false,\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"frequency\":{\"custom\":[{\"period\":\"daily\",\"cap\":1}]}}");
pref("browser.newtabpage.activity-stream.asrouter.providers.onboarding", "{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":true}");
pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{\"id\":\"snippets\",\"enabled\":false,\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000}");

:earth_americas: said

But I don't think we need to tamper with those because Onboarding and CFR are all local and you won't ever see onboarding if you don't use Activity Stream AFAIK. The 3rd part of "ASrouter" is snippets and that's covered already by 0105b.
We could add browser.newtabpage.activity-stream.feeds.asrouterfeed=false since that's the master switch for all ASrouter things but IDK if we really need/want to do that.

[Thorin-Oakenpants]

now that we're on FF64, I have taken every single AS related pref and ANAL-ysed them. Results so far. Am working on the rest

39 prefs: claustro's post
 3 prefs: new in 64 (asrouter.providers)
 1 pref : from elsewhere: browser.aboutHomeSnippets.updateUrl
 1 pref : from old section: browser.library.activity-stream.enabled
 9 prefs: from about:config no-one listed
==
53 prefs: total

ignore items already in user.js

user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
user_pref("browser.aboutHomeSnippets.updateUrl", "");
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
  //user_pref("browser.library.activity-stream.enabled", false);

ignore items that are local data or just UI

user_pref("browser.newtabpage.activity-stream.showSearch", false);
user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
user_pref("browser.newtabpage.activity-stream.feeds.section.highlights", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includeBookmarks", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includeDownloads", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includeVisited", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.rows" 2);
user_pref("browser.newtabpage.activity-stream.section.topstories.rows" 1);
user_pref("browser.newtabpage.activity-stream.topSitesRows", 1);
user_pref("browser.newtabpage.activity-stream.sectionOrder" "topsites,topstories,highlights");

ignore cuz we like the default

user_pref("browser.newtabpage.activity-stream.asrouter.devtoolsEnabled", false);
user_pref("browser.newtabpage.activity-stream.feeds.aboutpreferences", false);
  // ^ hides the entire Home>Firefox Home Content section
user_pref("browser.newtabpage.activity-stream.telemetry.ut.events", false);

ignore accounts, internals

user_pref("browser.newtabpage.activity-stream.fxaccounts.endpoint", "");
  // ^ if you have an account & use AS then you would probably want this
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "");
  // ^ if you use pocket AND allow pocket in AS then you probably want this
user_pref("browser.newtabpage.activity-stream.feeds.migration", false);
user_pref("browser.newtabpage.activity-stream.migrationLastShownDate"
user_pref("browser.newtabpage.activity-stream.migrationRemainingDays"
user_pref("browser.newtabpage.activity-stream.migrationExpired", true);

ignore not in 64 (about:config, see DXR results)

user_pref("browser.newtabpage.activity-stream.messageCenterExperimentEnabled", false);
  // ^ zero DXR results messageCenterExperiment
user_pref("browser.newtabpage.activity-stream.showTopSites", false);
  // ^ DXR results: migrate pref code, replaced by browser.newtabpage.activity-stream.feeds.topsites
user_pref("browser.newtabpage.activity-stream.feeds.theme", false);
  //  ^ zero DXR results feeds.theme
user_pref("browser.newtabpage.activity-stream.feeds.messagecenterfeed", false);
  //  ^ zero DXR results messagecenterfeed

ignore improve search experiment (see subsequent posts)

user_pref("browser.newtabpage.activity-stream.improvesearch.noDefaultSearchTile", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts.havePinned"
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts.searchEngines", "");

ignore misc (see subsequent posts)

user_pref("browser.newtabpage.activity-stream.default.sites", "");
user_pref("browser.newtabpage.activity-stream.feeds.newtabinit", false);
user_pref("browser.newtabpage.activity-stream.feeds.places", false);
user_pref("browser.newtabpage.activity-stream.feeds.prefs", false);
user_pref("browser.newtabpage.activity-stream.feeds.sections", false);
user_pref("browser.newtabpage.activity-stream.feeds.systemtick", false);
user_pref("browser.newtabpage.activity-stream.filterAdult", false);
user_pref("browser.newtabpage.activity-stream.pocketCta"
user_pref("browser.newtabpage.activity-stream.prerender", false);

---

That leaves 6 items for further followup

/* not in about config but.. ***/
user_pref("browser.newtabpage.activity-stream.tippyTop.service.endpoint", "");
  // ^ DXR shows a lot of "stuff*. In early AS days, this was shown to be getting data and stashing it locally

/* other ***/
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr"
user_pref("browser.newtabpage.activity-stream.feeds.asrouterfeed", false);
  // ^ Handles AS Router messages, such as snippets and onboaridng
user_pref("browser.newtabpage.activity-stream.feeds.favicon", false);
  // ^ Fetches tippy top manifests from remote service

/* new in 64 (not exactly endpoints!) ***/
user_pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "");
  // my value contains cfr=false, it does not change with the pther cfr pref
  // `{"id":"cfr","enabled":false,"type":"local",.... blah}`
user_pref("browser.newtabpage.activity-stream.asrouter.providers.onboarding", "");
  // ^^ I thought Onboarding uses GA?
  // {"id":"onboarding","type":"local","localProvider":"OnboardingMessageProvider","enabled":true}

and at 6 prefs left.. jump to this this comment

[earthlng]

tippyTop is now using "RemoteSettings" ie the same mechanism used for blocklists etc

https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/tippytop/records

These are all the buckets and collections currently used/available to RemoteSettings:

https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/records

everything with bucket *-preview is probably staging/development stuff and not used in production.
The interesting ones are all the "main" buckets, fe fxmonitor-breaches

In the 1st URL above you can replace main with the bucket name and tippytop with the collection name (see 2nd link) to look at the data

[Thorin-Oakenpants]

I was also looking at all the resource://activity-stream/ stuff.

• eg: `resource://activity-stream/data/content/tippytop/images/
  
  
  
  • ^^ probably used with browser.newtabpage.activity-stream.default.sites = YT, FB, amazon, reddit, wikipedia, twitter (well, at least for the EN portable version)
  
  

I plan on having a really good play around in a nilla 64/65. I think we're OK with everything that's left. But I do want to lock the F'er down more - also Onboarding is all local now, right, but it used to use GA. Other things to think about, the pinned, default search tiles - do they differ from the ones we sanitize ourselves - they seem built in => leads to my shit listed FollowOnSearch pet peeve. Also favicons can be a leak, maybe - eg is AS a protected page?

[Thorin-Oakenpants]

OT: In my travels found this: https://github.com/mozilla/firefox-data-store-docs/blob/master/README.md . Interesting seeing the sessionstore.js/recovery.js structure .. it includes scratchpad :)

[Thorin-Oakenpants]

from the 19 currently remaining prefs

user_pref("browser.newtabpage.activity-stream.improvesearch.noDefaultSearchTile", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts.havePinned"
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts.searchEngines", "");

I think we can ignore these. I did some digging. We'll need to watch out in diffs. Seems topSiteSearchShortcuts is a master pref, and the whole thing is an experiment/study. Wonder if it respects Telemetry options master pref, and if that's checked if it respects experiments (I never saw anything that suggests any of that, but for all I know it's only tested on Nightly)

• improvesearch.topSiteSearchShortcuts (currently default false)
  
  
  
  • source: "roll out the search shortcuts experiment"
  
  
  • source "controls if the search shortcuts experiment is on"
  
  
  • ^^ so seems to be the master pref
  
  
• improvesearch.noDefaultSearchTile (currently default true)
  
  
  
  • source "pref to be default true for the 62 release study if possible"
  
  
  • source "Experiment to remove tiles")
  
  
• topSiteSearchShortcuts.searchEngines (currently google,amazon)
  
  
  
  • source "comma-delimited list of search shortcuts that we should try and pin"
  
  
• topSiteSearchShortcuts.havePinned
  
  
  
  • I'll just guess this is set internally
  
  

Moving three two of these to ignore but I'll leave the others - see next post on further developments below with FF65 experiment flipped by Mozilla

---

Also the .filterAdult I can't be bothered checking out, but I assume it is an option that shows when you have pocket recommended trending stories or whatever enabled (using pockets multiple categories, tags). So that can go on ignore as well. Even if it wasn't, it's clearly not privacy/security related

---

.pocketCta can also be ignored. Can't find out for the life of me what CTA stands for, but everywhere I look (e.g https://github.com/mozilla/activity-stream/pull/4401 and on bugzilla, mercurial, dxr - it all relates to being logged in to pocket. We can ignore this pref.

---

browser.newtabpage.activity-stream.default.sites can also be ignored. Tested in a nilla profile, all images etc are local resources

[Thorin-Oakenpants]

improvesearch - see previous pic (FF65 Beta)

pref value is "youtube, facebook, wikipedia, reddit, amazon.com, twitter.com" (not the exact string, I'm just listing the sites), but note I have seven tiles, two with search overlays. That's because the improvesearch experiment is enabled. The improvesearch engines now only lists google (which it adds), and targets amazon (which it replaces), this is no doubt some internal cleanup - remember the 64 pref values for the search engines was google,amazon

To revert the improve search experiment, I have to set both improvesearch.topSiteSearchShirtucts AND improvesearch.noDefaultSearchTile to false, and then I'm back to 6 tiles with no search overlays

^^ so am thinking we add those two prefs to js at false as something like

/* 0105d: disable Activity Stream Improve Search Experiment ***/
user_pref("browser.newtabpage.activity-stream.improvesearch.noDefaultSearchTile", false);
user_pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", false);

My reasoning is that these are NOT necessarily the engines YOU wanted. They're not necessarily sanitized (by yourself). Also .. its an experiment/study IMO, they use the word everywhere. That said, it's just a change that rode the trains like everything else, so they're probably using the word in a different context. IDK. I'll test the telemetry settings to see if that makes a difference (doubt it).

PS: the search bar uses your installed engine AFAIK. eg, if you change it in options to one you added yourself, it will change in newtab

Update: Telemetry was already disabled in my 65 test profile, so yeah, improve search has nothing to do with that per se. But see next post FYI. And yes, the search bar in AS directly uses your the search engine from about:preferences#search settings (which I suspected, but just confirmed by adding a custom search engine for mozilla support and applying it - so if you have sanitized google search engine, the search bar is safe - comfirmed).

Update: Soz, I should have tested the fucking tile. All it does is apply an @google to the urlbar and you can type something. You do not have to have an actual search engine installed (e.g I tested after removing mine and just having duckduckgo).

When sent it sends some metadata: https://www.google.com/search?client=firefox-b-ab&q=test - but this is not a problem, because we already give away our browser in the UA string. Big deal. AS users, enjoy. Moving these two prefs then to ignore.

[Thorin-Oakenpants]

FYI: I saw this before (last week) and then couldn't find it again. Now I have. FF65 Beta

The GENERAL pref is browser.newtabpage.activity-stream.asrouter.userprefs.cfr. I had this option unchecked.

In PRIVACY&SECURITY, I checked "Allow FF to send technical data..." in order to get to the personalized extensions setting, which I then checked, and compared snapshots of prefs.js from before and after. The only difference was the master telemetry pref datareporting.healthreport.uploadEnabled, which is to be expected. There was also a client id pref change. The checkbox under General didn't change to match. I have no idea WTF that is all about. It doesn't seem to have a pref? Why would they even stick that there? Bugs? IDK. Something else to do for the next diffs I guess.

Edit: the Options>P&S Learn More leads to this

Really wanting to kill all endpoints now

[earthlng]

those are 2 different things. 1 is CFR, the other 1 is about personalized addon recommendations in about:addons + AMO. The latter uses the telemetry clientID and that's why it's listed there

[Thorin-Oakenpants]

^^ thanks

I'm going to knock off for a while, and I'm not sure if or how to address this. But favicons should be looked at. Again, we're fine, we don't use AS. But those who do, because extensions can't control protected pages, there can be 3rd party leaks. In fact grabbing a thumbnail would probably be even worse. Maybe we just can't do anything?

Maybe we add a line to 0105 about that. eg "AS grabbing favicons, thumbnails, will not be controlled by extensions protecting you, e.g uBO, uM, etc)

I will assume TP works in Activity Stream (@fmarier) , and I will assume FPI works in AS

[fmarier]

I will assume TP works in Activity Stream (@fmarier) , and I will assume FPI works in AS

Probably not until https://bugzilla.mozilla.org/show_bug.cgi?id=1380448 is fixed.

[Thorin-Oakenpants]

:disappointed: oh well, now I better check FPI too

[Thorin-Oakenpants]

@fmarier et al ..

I asked Tom Ritter "does AS respect FPI" and he replied

So Activity Stream aka about:newtab only induces network requests for background thumbnail jobs. The Pocket recommendations aren't generated by network requests.

The Background Thumbnail jobs are sent cookie-less, and the Set-Cookie responses from them are thrown away. To be extra sure, the requests also come from a separate container: 1457929 (which will isolate all the other stuff just in case) and that container is wiped on shutdown.

So we think there's pretty good separation for Activity Stream.

-tom

So "Background Thumbnail jobs are sent cookie-less" .. interesting. How will you apply GA then (and would it respect DNT)? In fact, how can TP work when it doesn't go through an URL Classifier / Cookie Mill? ..

so what's this all about then:

• FF61+ 1449294: Capture thumbnails with tracking protection always enabled
• Open 1453448: Capture thumbnails with safe browsing always enabled

The (extra?) container is "nice", but I can't help but feel that there's a hole here: thumbnails from anything could end mixed up together up in that container.

Anyway, the answer to my question is "NO". FPI is not used, it uses a reserved hidden container id of 5, instead (which is inferior), and no cookies are not used (AFAICT) and since cookies aren't used there's no localStorage, IDB, but the container gets wiped. I guess thumbnails aren't wiped and don;t get an OA then.

Still, grabbing thumbnails with no control over third party connections isn't great.

[earthlng]

DONE

[Thorin-Oakenpants]

^^ done: PS, I was also looking at throttling ssl timeouts becuz of those cats: see https://bugzilla.mozilla.org/show_bug.cgi?id=1511681

[Thorin-Oakenpants]

Where were we.. that's right .. 12 prefs to finish ANAL-ysing

browser.newtabpage.activity-stream.prerender - moving to ignore. "This is set automatically by PrefsFeed.jsm" source

---

five activity-stream.feeds.* prefs. See source and read it, and look up any local resource:// files. While these could possibly be used to block things vs just hiding the element (e.g places->visited sites? sections->break the whole thing?), all of this data is local (bookmarks, downloads, visited sites, search tiles, default sites, search widget bar thing, etc). Fiddling with these does not improve anything privacy/security/leaky/tracking wise - and would probably just break shit. Also probably initially internal prefs initially used for testing.

Moving to ignore

user_pref("browser.newtabpage.activity-stream.feeds.newtabinit", false);
  // ^ Sends a copy of the state to each new tab that is opened
user_pref("browser.newtabpage.activity-stream.feeds.places", false);
  // ^ Listens for and relays various Places-related events
user_pref("browser.newtabpage.activity-stream.feeds.prefs", false);
  // ^ dunno? preferences I guess
user_pref("browser.newtabpage.activity-stream.feeds.sections", false);
  // ^ Manages sections
user_pref("browser.newtabpage.activity-stream.feeds.systemtick", false);
  // ^ Produces system tick events to periodically check for data expiry

and we're down to 6

[Thorin-Oakenpants]

So we don't have to scroll up to my constantly edited post .. I'll start a new one here for the last 6

Now we're just down to nailing external network calls - but only if they are a risk (whatever that means)

• is data 100% local (i.e packaged in each build)
• if data is not local, then when it gets it, does it use GA (I have no issues with the data itself, it would be localized bundles)
• WTF exactly is TippyTop (ELI5 please)
• when does Onboarding kick in - anytime they want to give us a new feature tour? Is it 100% fully local?

Come on guys, gals, cats ... help me finish this ticket and put everyone's minds at rest. @earthlng , you can take a break buddy (and I'll re-read your earlier comments)

ignore (see subsequent comments)

/* TIPPYTOP ***/
user_pref("browser.newtabpage.activity-stream.feeds.favicon", false);
  // ^ Fetches tippy top manifests from remote service
user_pref("browser.newtabpage.activity-stream.tippyTop.service.endpoint", "");
  // ^ not in about config but.. DXR shows a lot of "stuff*
  // ^ way back in early AS days, this was shown to be getting data and stashing it locally

/* CFR ***/
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr"
  // ^ already in user.js, need some beer

---

3 prefs left (..aaaand onboarding & cfr are all local, so we're DONE)

/* ONBOARDING : I thought Onboarding uses GA ***/
user_pref("browser.newtabpage.activity-stream.asrouter.providers.onboarding", ""); // FF64+
user_pref("browser.newtabpage.activity-stream.feeds.asrouterfeed", false);
  // ^ Handles AS Router messages, such as snippets and onboarding

/* CFR ***/
user_pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", ""); // FF64+

[Thorin-Oakenpants]

Ermerghurrddd... I finally worked out WTF TippyTop is used for. We can ignore it. It's an favicon step which can reduce page thumbnails. AFAICT the process is

• checks if the website provided a favicon which has an high enough resolution (I think its 96x96?)
• verifies that there's a tippy-top fallback icon (I think it's Alexa top 200?)
• tries to request a rich-icon from FaviconFeed.jsm
• if all the above fails, it tries to get a screenshot of the page and pin it in the tile

--

Also browser.newtabpage.activity-stream.asrouter.userprefs.cfr can go in ignore, it's already in the user.js in 5000s. <== this is what happens when you bastards overwork me

[Thorin-Oakenpants]

Now we're talking, much more clear cut.

• IF onboarding is totally local (or if it does not use GA), then we ignore them. If we're not sure, then add them
• IF cfr is totally local, then ignore the cfr pref (and/or just rely on the pref in 5000s)

[Thorin-Oakenpants]

spent waaaay too much time on this, so I'll just take E's word for it

https://github.com/ghacksuserjs/ghacks-user.js/issues/528#issuecomment-446628055

Onboarding and CFR are all local

PS: If any of you ever get a GA cookie, send my regards to Earthlng when you complain. And lastly a massive thank you to all the hundreds of people who helped me wade through all this shit and offered tips, advise, links, and more ... (except Earthlng, who did absolutely SFA) /s