User.js: ToDo: diffs FF63-FF64

[earthlng]

FF64 is scheduled for release 11th Dec

FF64 release notes [when ready]
[FF64 for developers](https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/64)
FF64 compatibility
FF64 security advisories

140 diffs ( 63 new, 45 gone, 32 different )

misc:

• [x] Onboarding no longer a system addon (now part of Activity Stream?) - https://github.com/ghacksuserjs/ghacks-user.js/commit/61be5ae563e0e7e3427885a16e6f920437797966
• [x] Pocket no longer a system addon - https://github.com/ghacksuserjs/ghacks-user.js/commit/ccdd4decf01dd3576e84c775d1a99fe3d7f5b27d
• [x] move 0370 to 0105b - https://github.com/ghacksuserjs/ghacks-user.js/commit/0e1b0a4b6e572f88a7e456a75be8e88f46a9b559

Added here for visibility

• general.buildID.override 583181
  
  
  
  • buildID is a hardcoded value for websites now, except privileged domains (e.g AMO), so there is no need to spoof this anymore. If you do not use RFP, then just be like the other 99% of FF users. Leave this pref alone. Here's how it works
  
  
  • > if RFP is enabled -> return the new fixed timestamp 20181001000000
  
  

else if general.buildID.override is set -> return that value
else if URL is not https://*.mozilla.org/* -> return the fixed timestamp
else return the real buildID for all https://*.mozilla.org/* URLs

new in v64.0:

• [x] CFR (Contextual Feature Recommendation) - https://github.com/ghacksuserjs/ghacks-user.js/commit/31adbba774139f1f79cc90c4b48126b5bd3912fa
  
  
  
  • pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr", true);
  
  
• [x] ADB Extension 1491315 - https://github.com/ghacksuserjs/ghacks-user.js/commit/61be5ae563e0e7e3427885a16e6f920437797966
  
  
  
  • pref("devtools.webide.autoinstallADBExtension", true); - replaces devtools.webide.autoinstallADBHelper (2608)
  
  
• [x] Telemetry Coverage 1492656 - https://github.com/ghacksuserjs/ghacks-user.js/commit/9d6bfb650cca3e0785849c49640a31d6323249f9
  
  
  
  • toolkit.coverage.opt-out (hidden pref)
  
  
• pref("dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value", false);
  
  
  
  • added to watchlist sticky, awaiting to hear back from Arthur and Tom if this messes with RFP's keyboard spoofing (see this comment)
  
  
  • seems this is not an issue see https://github.com/ghacksuserjs/ghacks-user.js/issues/535#issuecomment-447409166
  
  

▼ these three, if required (unlikely), will be covered in #528

pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"id\":\"cfr\",\"enabled\":false,\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"frequency\":{\"custom\":[{\"period\":\"daily\",\"cap\":1}]}}");
pref("browser.newtabpage.activity-stream.asrouter.providers.onboarding", "{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":true}");
pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{\"id\":\"snippets\",\"enabled\":false,\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000}");

removed, renamed or hidden in v64.0:

ALL DONE - https://github.com/ghacksuserjs/ghacks-user.js/commit/61be5ae563e0e7e3427885a16e6f920437797966

• [x] 0516 pref("browser.onboarding.enabled", true); 1462415
• [x] 2608 pref("devtools.webide.autoinstallADBHelper", true); 1491315
• [x] 2681 pref("security.csp.enable_violation_events", true); 1488165

changed in v64.0:

everything moved to ignore

---

ignore

click me for details

==NEW

pref("browser.contentblocking.originlog.length", 32);
pref("browser.fission.simulate", false);
pref("browser.urlbar.ctrlCanonizesURLs", true);
pref("browser.urlbar.quantumbar", false);
pref("devtools.gridinspector.maxHighlighters", 3);
pref("devtools.inspector.changes.enabled", false);
pref("devtools.performance.recording.ui-base-url", "https://perf-html.io");
pref("devtools.recordreplay.mvp.enabled", false);
pref("devtools.remote.adb.extensionURL", "https://ftp.mozilla.org/pub/mozilla.org/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi");
pref("devtools.responsive.showUserAgentInput", false);
pref("devtools.responsive.touchSimulation.enabled", false);
pref("devtools.responsive.userAgent", "");
pref("devtools.responsive.viewport.height", 480);
pref("devtools.responsive.viewport.pixelRatio", 0);
pref("devtools.responsive.viewport.width", 320);
pref("devtools.webconsole.jsterm.reverse-search", false);
pref("dom.caches.testing.enabled", false);
pref("dom.event.returnValue.enabled", false);
pref("dom.fetchObserver.enabled", false);
pref("dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value", false);
pref("dom.payments.request.user_interaction_required", true);
pref("dom.performance.children_results_ipc_timeout", 1000);
pref("dom.performance.time_to_first_interactive.enabled", false);
pref("dom.security.featurePolicy.enabled", false);
pref("dom.serviceWorkers.testing.enabled", false);
pref("dom.testing.structuredclonetester.enabled", false);
pref("dom.vr.external.notdetected.timeout", 60000);
pref("dom.vr.external.quit.timeout", 10000);
pref("dom.worker.canceling.timeoutMilliseconds", 30000);
pref("dom.xhr.standard_content_type_normalization", false);
pref("extensions.webextensions.performanceCountersMaxAge", 1000);
pref("extensions.webextensions.userScripts.enabled", false);
pref("gfx.font_ahem_antialias_none", false);
pref("gfx.webrender.blob.paint-flashing", false);
pref("identity.fxaccounts.commands.missed.fetch_interval", 86400);
pref("image.animated.generate-full-frames", false);
pref("image.cache.max-rasterized-svg-threshold-kb", 92160);
pref("image.mem.debug-reporting", false);
pref("intl.multilingual.downloadEnabled", true);
pref("javascript.options.baselinejit.threshold", 10);
pref("javascript.options.ion.frequent_bailout_threshold", 10);
pref("javascript.options.ion.threshold", 1000);
pref("layout.css.clip-path-path.enabled", false);
pref("layout.css.scrollbar-color.enabled", true);
pref("layout.css.supports-selector.enabled", false);
pref("media.navigator.mediadatadecoder_h264_enabled", false);
pref("media.wmf.force.allow-p010-format", false);
pref("network.security.esni.enabled", false);
pref("pdfjs.eventBusDispatchToDOM", false);
pref("privacy.userInteraction.document.interval", 1800);
pref("privacy.userInteraction.expiration", 2592000);
pref("security.certerrors.recordEventTelemetry", true);
pref("security.identitypopup.recordEventElemetry", true);
pref("security.sandbox.plugin.tempDirSuffix", "");
pref("security.tls.hello_downgrade_check", false);
pref("toolkit.aboutPerformance.showInternals", false);
pref("toolkit.coverage.enabled", false);
pref("toolkit.coverage.endpoint.base", "**h**ttps://coverage.mozilla.org");

==REMOVED or HIDDEN

pref("browser.audioFeeds.handler", "ask");
pref("browser.feeds.handler", "ask");
pref("browser.migrate.automigrate.daysToOfferUndo", 4);
pref("browser.migrate.automigrate.enabled", false);
pref("browser.migrate.automigrate.inpage.ui.enabled", false);
pref("browser.migrate.automigrate.ui.enabled", true);
pref("browser.onboarding.newtour", "performance,private,screenshots,addons,customize,default");
pref("browser.onboarding.notification.finished", false);
pref("browser.onboarding.notification.max-life-time-all-tours-ms", 1209600000);
pref("browser.onboarding.notification.max-life-time-per-tour-ms", 432000000);
pref("browser.onboarding.notification.max-prompt-count-per-tour", 8);
pref("browser.onboarding.notification.mute-duration-on-first-session-ms", 300000);
pref("browser.onboarding.state", "default");
pref("browser.onboarding.tourset-version", 2);
pref("browser.onboarding.updatetour", "performance,library,screenshots,singlesearch,customize,sync");
pref("browser.videoFeeds.handler", "ask");
pref("devtools.commands.dir", "");
pref("devtools.debugger.features.replay", false);
pref("devtools.gcli.eagerHelper", 2);
pref("devtools.gcli.hideIntro", false);
pref("devtools.gcli.imgurClientID", "0df414e888d7240");
pref("devtools.gcli.imgurUploadURL", "https://api.imgur.com/3/image");
pref("devtools.gcli.jquerySrc", "https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.1/jquery.min.js");
pref("devtools.gcli.lodashSrc", "https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.6.1/lodash.min.js");
pref("devtools.gcli.underscoreSrc", "https://cdnjs.cloudflare.com/ajax/libs/underscore.js/1.8.3/underscore-min.js");
pref("devtools.inspector.show-three-pane-tooltip", true);
pref("devtools.inspector.three-pane-first-run", true);
pref("devtools.new-animationinspector.enabled", true);
pref("devtools.promote.accessibility", 1);
pref("devtools.webide.adbAddonID", "[email protected]");
pref("devtools.webide.adbAddonURL", "https://ftp.mozilla.org/pub/mozilla.org/labs/fxos-simulator/adb-helper/#OS#/adbhelper-#OS#-latest.xpi");
pref("dom.streams.enabled", false);
pref("extensions.getAddons.themes.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/themes/?src=firefox");
pref("extensions.webcompat.perform_injections", true);
pref("extensions.webcompat.perform_ua_overrides", true);
pref("layout.css.filters.enabled", true);
pref("layout.css.scrollbar-colors.enabled", false);
pref("network.cookie.ipc.sync", false);
pref("plugins.remember_infobar_dismissal", true);
pref("webgl.restore-context-when-visible", true);
pref("xpinstall.customConfirmationUI", true);

==CHANGED

pref("alerts.useSystemBackend", false); // prev: true
pref("app.update.url", "https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml"); // prev: "https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%(noBug1296630v1)(nowebsense)/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml"
pref("browser.fastblock.limit", 20000); // prev: 0
pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"model_keys\":[\"nmf_model_animals\",\"nmf_model_business\",\"nmf_model_career\",\"nmf_model_datascience\",\"nmf_model_design\",\"nmf_model_education\",\"nmf_model_entertainment\",\"nmf_model_environment\",\"nmf_model_fashion\",\"nmf_model_finance\",\"nmf_model_food\",\"nmf_model_health\",\"nmf_model_home\",\"nmf_model_life\",\"nmf_model_marketing\",\"nmf_model_politics\",\"nmf_model_programming\",\"nmf_model_science\",\"nmf_model_shopping\",\"nmf_model_sports\",\"nmf_model_tech\",\"nmf_model_travel\",\"nb_model_animals\",\"nb_model_books\",\"nb_model_business\",\"nb_model_career\",\"nb_model_datascience\",\"nb_model_design\",\"nb_model_economics\",\"nb_model_education\",\"nb_model_entertainment\",\"nb_model_environment\",\"nb_model_fashion\",\"nb_model_finance\",\"nb_model_food\",\"nb_model_game\",\"nb_model_health\",\"nb_model_history\",\"nb_model_home\",\"nb_model_life\",\"nb_model_marketing\",\"nb_model_military\",\"nb_model_philosophy\",\"nb_model_photography\",\"nb_model_politics\",\"nb_model_productivity\",\"nb_model_programming\",\"nb_model_psychology\",\"nb_model_science\",\"nb_model_shopping\",\"nb_model_society\",\"nb_model_space\",\"nb_model_sports\",\"nb_model_tech\",\"nb_model_travel\",\"nb_model_writing\"],\"show_spocs\":false,\"personalized\":true,\"version\":1}"); // prev: "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}"
pref("browser.safebrowsing.downloads.remote.timeout_ms", 15000); // prev: 10000
pref("browser.tabs.multiselect", true); // prev: false
pref("devtools.debugger.features.map-await-expression", true); // prev: false
pref("devtools.inspector.activeSidebar", "layoutview"); // prev: "ruleview"
pref("devtools.webconsole.inputHistoryCount", 300); // prev: 50
pref("devtools.webconsole.jsterm.codeMirror", true); // prev: false
pref("dom.performance.enable_scheduler_timing", true); // prev: false
pref("dom.vr.service.enabled", true); // prev: false
pref("dom.xhr.lowercase_header.enabled", true); // prev: false
pref("editor.inline_table_editing.enabled_by_default", false); // prev: true
pref("editor.positioning.enabled_by_default", false); // prev: true
pref("editor.resizing.enabled_by_default", false); // prev: true
pref("extensions.geckoProfiler.acceptedExtensionIds", "[email protected],[email protected],[email protected]"); // prev: "[email protected],[email protected]"
pref("extensions.webextensions.enablePerformanceCounters", true); // prev: false
pref("extensions.webextensions.restrictedDomains", "accounts-static.cdn.mozilla.net,accounts.firefox.com,addons.cdn.mozilla.net,addons.mozilla.org,api.accounts.firefox.com,content.cdn.mozilla.net,discovery.addons.mozilla.org,input.mozilla.org,install.mozilla.org,oauth.accounts.firefox.com,profile.accounts.firefox.com,support.mozilla.org,sync.services.mozilla.com,testpilot.firefox.com"); // prev: "accounts-static.cdn.mozilla.net,accounts.firefox.com,addons.cdn.mozilla.net,addons.mozilla.org,api.accounts.firefox.com,content.cdn.mozilla.net,content.cdn.mozilla.net,discovery.addons.mozilla.org,input.mozilla.org,install.mozilla.org,oauth.accounts.firefox.com,profile.accounts.firefox.com,support.mozilla.org,sync.services.mozilla.com,testpilot.firefox.com"
pref("font.name-list.sans-serif.zh-TW", "Arial, Microsoft JhengHei, PMingLiU, MingLiU, MingLiU-ExtB"); // prev: "Arial, PMingLiU, MingLiU, MingLiU-ExtB"
pref("full-screen-api.unprefix.enabled", true); // prev: false
pref("identity.fxaccounts.commands.enabled", true); // prev: false
pref("layout.accessiblecaret.height", "36"); // prev: "36.0"
pref("layout.accessiblecaret.width", "34"); // prev: "34.0"
pref("layout.css.scrollbar-width.enabled", true); // prev: false
pref("layout.css.unknown-webkit-pseudo-element", true); // prev: false
pref("layout.css.xul-box-display-values.content.enabled", false); // prev: true
pref("layout.css.xul-tree-pseudos.content.enabled", false); // prev: true
pref("layout.scroll.root-frame-containers", 0); // prev: false
pref("media.getusermedia.agc_enabled", true); // prev: false
pref("network.http.throttle.enable", false); // prev: true
pref("security.pki.distrust_ca_policy", 2); // prev: 1

[earthlng]

some bugzilla tickets

• alerts.useSystemBackend
  Bug 1155505 - Part 3. Use native Windows Toast backend on Nightly only.

• browser.audioFeeds.handler
  Bug 1477669 - remove feed preview code and associated files/code,

• browser.contentblocking.originlog.length
  Bug 1493563 - Part 7: Store the log more compactly, and cap the size of the origin log at a maximum limit adjustable by a pref;

• browser.fastblock.limit
  Bug 1500208 - Disable FastBlock, hide FastBlock UI everywhere.
  Bug 1488951 - Put a limit on how long FastBlock runs.

• browser.feeds.handler
  Bug 1477669 - remove feed preview code and associated files/code,

• browser.fission.simulate
  Bug 1490810 - Simulate Fission for browser actors by blocking them from receiving sub-frame events.

• browser.migrate.automigrate.daysToOfferUndo
  Bug 1488926 - remove automigration code (already preffed off),

• browser.migrate.automigrate.enabled
  Bug 1488926 - remove automigration code (already preffed off),

• browser.migrate.automigrate.inpage.ui.enabled
  Bug 1488926 - remove automigration code (already preffed off),

• browser.migrate.automigrate.ui.enabled
  Bug 1488926 - remove automigration code (already preffed off),

• browser.onboarding.enabled
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.newtour
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.notification.finished
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.notification.max-life-time-all-tours-ms
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.notification.max-life-time-per-tour-ms
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.notification.max-prompt-count-per-tour
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.notification.mute-duration-on-first-session-ms
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.state
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.tourset-version
  Bug 1462415 - Delete onboarding system add-on

• browser.onboarding.updatetour
  Bug 1462415 - Delete onboarding system add-on

• browser.safebrowsing.downloads.remote.timeout_ms
  Bug 1479898 - P3. Increase the application reputation remote lookup timeout to 15sec

• browser.tabs.multiselect
  Bug 1474938 - Enable the multiselect tabs feature by default for release and beta builds
  Bug 1458010 - Add ability to select multiple tabs using Ctrl/Cmd

• browser.urlbar.ctrlCanonizesURLs
  Bug 237027 - allow turning off URL canonization, remove shift support, and move the remainder from 'cmd' to 'ctrl' on mac

• browser.urlbar.quantumbar
  Bug 1477985 - Implement basic UrlbarInput and UrlbarView classes and a hidden pref for using them.

• browser.videoFeeds.handler
  Bug 1477669 - remove feed preview code and associated files/code,

• devtools.debugger.features.map-await-expression
  Bug 1499614 - Enable top-level await support on every release channel

• devtools.gridinspector.maxHighlighters
  Bug 1317102 - Part 5: Increase the max grid highlighters shown to 3.
  Bug 1317102 - Part 1: Add a pref to enable displaying multiple grid containers in the CSS Grid Inspector.

• devtools.inspector.activeSidebar
  Bug 1499483 - Make the Layout view the default sidebar tab.

• devtools.inspector.changes.enabled
  Bug 1478448 - (Part 1) Add pref for Track Changes feature.

• devtools.new-animationinspector.enabled
  Bug 1463621 - Part 2: Remove devtools.new-animationinspector.enabled preference
  Bug 1470807: Enable new animation inspector on Beta and Release channel

• devtools.performance.recording.ui-base-url
  Bug 1480593 - Allow setting a different instance of perf.html for the new performance panel, using a pref

• devtools.promote.accessibility
  Bug 1482461 - remove "New" bubble from Accessibility panel tab
  Bug 1482454 - Display a "New" indicator to promote the accessibility panel

• devtools.recordreplay.mvp.enabled
  Bug 1495300 - Add a reload and record button

• devtools.responsive.showUserAgentInput
  Bug 1297431 - Add a custom user agent input in responsive design mode

• devtools.responsive.touchSimulation.enabled
  Bug 1248619 - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties

• devtools.responsive.userAgent
  Bug 1248619 - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties

• devtools.responsive.viewport.height
  Bug 1248619 - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties

• devtools.responsive.viewport.pixelRatio
  Bug 1248619 - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties

• devtools.responsive.viewport.width
  Bug 1248619 - Part 3: Restore the previous viewport size, user agent, display pixel ratio and touch simultation properties

• devtools.webconsole.inputHistoryCount
  Bug 1491768 - Increase input history limit

• devtools.webconsole.jsterm.codeMirror
  Bug 1473805 - Enable CodeMirror JSTerm by default on all releases;r=nchevobbe
  Bug 1470922 - Enable CodeMirror JSTerm on Nightly except for people using accessible technology
  Bug 1463409 - Add a preference to enable CodeMirror-powered jsterm

• devtools.webconsole.jsterm.reverse-search
  Bug 1024913 - Add a preference to enable the reverse search UI

• dom.caches.testing.enabled
  Bug 1489844 - Port DOMPrefs to StaticPrefs - part 3 - dom.caches.testing.enabled

• dom.fetchObserver.enabled
  Bug 1489844 - Port DOMPrefs to StaticPrefs - part 17 - dom.fetchObserver.enabled

• dom.ipc.tabs.shutdownTimeoutSecs
  Bug 1498942 - Lengthen timeouts for detecting hung content processes during shutdown

• dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value
  Bug 1479964 - Set KeyboardEvent.keyCode and KeyboardEvent.charCode to same value if the event is "keypress" event

• dom.payments.request.user_interaction_required
  Bug 1491996 - Add a pref to disable the user activation/gesture requirement for PaymentRequest.show()

• dom.performance.children_results_ipc_timeout
  Bug 1491816 - deal with unresponsive content processes in ChromeUtils.requestPerformanceMetrics()

• dom.performance.enable_scheduler_timing
  Bug 1496506 - Flip the pref for the new about:performance
  Bug 1464571 - fixes DOM Worker performance counters

• dom.performance.time_to_first_interactive.enabled
  Bug 1299118: Measure TTI (or TTFI at the moment) in Raptor TP6

• dom.security.featurePolicy.enabled
  Bug 1390801 - FeaturePolicy - part 2 - WebIDL + DOM integration

• dom.serviceWorkers.testing.enabled
  Bug 1489844 - Port DOMPrefs to StaticPrefs - part 9 - dom.serviceWorkers.testing.enabled

• dom.streams.enabled
  Bug 1489844 - Port DOMPrefs to StaticPrefs - part 13 - dom.streams.enabled,
  Bug 1491939 - Part 4: Enable streams on a per-realm basis. Drop dom.streams.enabled and dom.workers.options.streams; use only javascript.options.streams.

• dom.testing.structuredclonetester.enabled
  Bug 1487463 - implement StructuredCloneTester to be used in testing

• dom.vr.external.notdetected.timeout
  Bug 1466700 - Refactor gfxVROculus.cpp to use gfxVRExternal interface

• dom.vr.external.quit.timeout
  Bug 1466700 - Refactor gfxVROculus.cpp to use gfxVRExternal interface

• dom.vr.service.enabled
  Bug 1473399 - Enable VR Service thread by default.

• dom.worker.canceling.timeoutMilliseconds
  Bug 1489844 - Port DOMPrefs to StaticPrefs - part 27 - dom.worker.canceling.timeoutMilliseconds,

• dom.xhr.lowercase_header.enabled
  Bug 1398718 - change default pref to on for lowercase header names in XHR.getAllResponseHeaders;

• dom.xhr.standard_content_type_normalization
  Bug 1454325 - have XHRs adjust content type of uploads per spec using the MIME Sniffing standard;

• editor.inline_table_editing.enabled_by_default
  Bug 1490641 - Disable all Gecko specific UIs by default in release build
  Bug 1449564 - part 4: Make users can show Gecko specific editing UIs with new prefs

• editor.positioning.enabled_by_default
  Bug 1490641 - Disable all Gecko specific UIs by default in release build
  Bug 1449564 - part 4: Make users can show Gecko specific editing UIs with new prefs

• editor.resizing.enabled_by_default
  Bug 1490641 - Disable all Gecko specific UIs by default in release build
  Bug 1449564 - part 4: Make users can show Gecko specific editing UIs with new prefs

• extensions.geckoProfiler.acceptedExtensionIds
  Bug 1492955 - Add raptor webext to whitelist for GeckoProfiler webext API

• extensions.getAddons.themes.browseURL
  Bug 1495708 - Remove theme info bar and update plugin notice

• extensions.webextensions.enablePerformanceCounters
  Bug 1496506 - Flip the pref for the new about:performance
  Bug 1468550 - Track webextension activity

• extensions.webextensions.performanceCountersMaxAge
  Bug 1479740 - Track Web API calls made in the child

• extensions.webextensions.restrictedDomains
  Bug 1492421 - remove duplicate value in restrictedDomains pref

• extensions.webextensions.userScripts.enabled
  Bug 1491272 - Lock experimental userScripts API behind a pref and make it enabled by default on Nightly

• font.name-list.sans-serif.zh-TW
  Bug 1498438 - Use Microsoft JhengHei for zh-TW on all channel

• full-screen-api.unprefix.enabled
  Bug 1448225 - Convert StylePrefs to StaticPrefs

• gfx.font_ahem_antialias_none
  Bug 1494715 - Add a pref to disable antialiasing for Ahem only,

• gfx.webrender.blob.paint-flashing
  Bug 1490891. Support toggling paint flashing in blob images

• identity.fxaccounts.commands.enabled
  Bug 1484465 - Enable FxA Commands feature by default.
  Bug 1484461 - Disable FxA commands
  Bug 1483979 - Enable fxa commands
  Bug 1466933 - Implement FxA commands.

• identity.fxaccounts.commands.missed.fetch_interval
  Bug 1496637 - Fetch missed FxA commands sporadically on sync

• image.animated.generate-full-frames
  Bug 1337111 - Part 5. Add pref to force decoding of full frames, disabled by default.

• image.cache.max-rasterized-svg-threshold-kb
  Bug 1456558 - Part 2. Implement factor of 2 scaling support for SVGs in the surface cache.

• image.mem.debug-reporting
  Bug 1492930 - Part 4. Add ImageMemoryReporter to support extra shared surfaces reporting.

• intl.multilingual.downloadEnabled
  Bug 1493711 - Pref off downloading langpacks outside of release

• javascript.options.baselinejit.threshold
  Bug 1495431 Expose baseline and ion JIT warm up threshold options to preferences, about:config

• javascript.options.ion.frequent_bailout_threshold
  Bug 1495431 Expose baseline and ion JIT warm up threshold options to preferences, about:config

• javascript.options.ion.threshold
  Bug 1495431 Expose baseline and ion JIT warm up threshold options to preferences, about:config

• layout.accessiblecaret.height
  Bug 1485063 Part 1 - Move preferences used in AccessibleCaret to StaticPrefsList.h

• layout.accessiblecaret.width
  Bug 1485063 Part 1 - Move preferences used in AccessibleCaret to StaticPrefsList.h

• layout.css.clip-path-path.enabled
  Bug 1487838 - Add a pref for |clip-path:path()|.

• layout.css.filters.enabled
  Bug 1408841 - Remove preference "layout.css.filters.enabled".

• layout.css.scrollbar-color.enabled
  Bug 1494501 - Rename pref "layout.css.scrollbar-colors.enabled" to "layout.css.scrollbar-color.enabled".

• layout.css.scrollbar-colors.enabled
  Bug 1494501 - Rename pref "layout.css.scrollbar-colors.enabled" to "layout.css.scrollbar-color.enabled".
  Bug 1492012 - Enable scrollbar-color and scrollbar-width by default.

• layout.css.scrollbar-width.enabled
  Bug 1492012 - Enable scrollbar-color and scrollbar-width by default.
  Bug 1475033 part 3 - Add scrollbar-width property.

• layout.css.supports-selector.enabled
  Bug 1499386 - Implement @supports selector() syntax.

• layout.css.unknown-webkit-pseudo-element
  Bug 1424106 - Accept unknown webkit pseudo-element.

• layout.css.xul-box-display-values.content.enabled
  Bug 1477553: Hide display: -moz-box|-moz-inline-box from content on Nightly and early beta.

• layout.css.xul-tree-pseudos.content.enabled
  Bug 1480054: Restrict XUL tree pseudos on nightly and early-beta.

• layout.scroll.root-frame-containers
  Bug 1479757 - Switch to containerless scrolling for GeckoView+WR.

• media.getusermedia.agc_enabled
  Bug 1496714 - Enable AGC by default for getUserMedia.

• media.navigator.mediadatadecoder_h264_enabled
  Bug 1496529 - P8. Add media.navigator.mediadatadecoder_h264_enabled preference.

• media.wmf.force.allow-p010-format
  Bug 1497294 - P8. Disable P010 surface type with nvidia adapters.

• network.cookie.ipc.sync
  Bug 1483986 - Remove sync versions of document.cookie getter/setter;

• network.http.throttle.enable
  Bug 1503354 - Disable background HTTP response throttling for causing visible regressions.

• network.security.esni.enabled
  Bug 1473736 - Implement necko part of ESNI

• plugins.remember_infobar_dismissal
  Bug 1438857 - Remove the Flash plugin infobar.

• privacy.userInteraction.document.interval
  Bug 1491835 - Store User-Interaction for AntiTracking purposes - part 4 - update permissions after X seconds,

• privacy.userInteraction.expiration
  Bug 1491835 - Store User-Interaction for AntiTracking purposes - part 2 - storing user-interaction,

• security.certerrors.recordEventTelemetry
  Bug 1484255 - Add Telemetry Events for the certificate error pages.

• security.csp.enable_violation_events
  Bug 1488165 - Remove security.csp.enable_violation_events pref,
  Bug 1476820 - Convert some VarCache prefs in dom/security/ to use StaticPrefs.

• security.identitypopup.recordEventElemetry
  Bug 1484251 - Part 3 - Use Telemetry events to record interactions in the identity popup.

• security.pki.distrust_ca_policy
  Bug 1496467 - Enable Symantec Distrust in Firefox 64
  bug 1460062 - Enforce Symantec distrust in Firefox 63
  Bug 1442075 - Enforce Symantec distrust in Firefox 60
  Bug 1437754 - Add a pref and disable the Symantec distrust algorithm

• security.sandbox.plugin.tempDirSuffix
  Bug 1488439: Part 1 - Replace Windows temp folder in sandboxed plugin process (r=bobowen,erahm)

• security.tls.hello_downgrade_check
  Bug 1487279 - Pref to control TLS downgrade check,

• toolkit.aboutPerformance.showInternals
  Bug 1502440 - Hide browser internals in about:performance for beta and release users,

• toolkit.coverage.enabled
  Bug 1492656 - move Telemetry Coverage ping in-tree

• toolkit.coverage.endpoint.base
  Bug 1492656 - move Telemetry Coverage ping in-tree

• xpinstall.customConfirmationUI
  Bug 1473933: Part 2 - Remove more unused code.

[claustromaniac]

LOL another glitch in the parser.

pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"model_keys\":[\"nmf_model_animals\",\"nmf_model_business\",\"nmf_model_career\",\"nmf_model_datascience\",\"nmf_model_design\",\"nmf_model_education\",\"nmf_model_entertainment\",\"nmf_model_environment\",\"nmf_model_fashion\",\"nmf_model_finance\",\"nmf_model_food\",\"nmf_model_health\",\"nmf_model_home\",\"nmf_model_life\",\"nmf_model_marketing\",\"nmf_model_politics\",\"nmf_model_programming\",\"nmf_model_science\",\"nmf_model_shopping\",\"nmf_model_sports\",\"nmf_model_tech\",\"nmf_model_travel\",\"nb_model_animals\",\"nb_model_books\",\"nb_model_business\",\"nb_model_career\",\"nb_model_datascience\",\"nb_model_design\",\"nb_model_economics\",\"nb_model_education\",\"nb_model_entertainment\",\"nb_model_environment\",\"nb_model_fashion\",\"nb_model_finance\",\"nb_model_food\",\"nb_model_game\",\"nb_model_health\",\"nb_model_history\",\"nb_model_home\",\"nb_model_life\",\"nb_model_marketing\",\"nb_model_military\",\"nb_model_philosophy\",\"nb_model_photography\",\"nb_model_politics\",\"nb_model_productivity\",\"nb_model_programming\",\"nb_model_psychology\",\"nb_model_science\",\"nb_model_shopping\",\"nb_model_society\",\"nb_model_space\",\"nb_model_sports\",\"nb_model_tech\",\"nb_model_travel\",\"nb_model_writing\"],\"show_spocs\":false,\"personalized\":true,\"version\":1}"); // prev: "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}"

It's the length of the line. It breaks at 1024+ chars. One learns something new every day.

[Atavic]

pref("devtools.remote.adb.extensionURL",
pref("devtools.webide.autoinstallADBExtension",
pref("devtools.webide.adbAddonID",
pref("devtools.webide.adbAddonURL",
pref("devtools.webide.autoinstallADBHelper",

...are all about remote debugging: https://github.com/mozilla/devtools-adb-extension

[Atavic]

pref("security.identitypopup.recordEventElemetry", true);

That's a Typo.

[earthlng]

@claustromaniac you noob :smile_cat:
just kidding! programming is always a work-in-progress. My own script(s) had similar birth pains

@Atavic
thanks for the link. We already have at least one of those prefs in the user.js and will update it with the renamed pref and perhaps add 1 or 2 more.
Yes that's a typo by mozilla

[claustromaniac]

@earthlng I wasn't talking about my parser, though. Mine keeps becoming harder to break :sunglasses: I meant the GitHub parser:

changed in v64.0b9:

pref("alerts.useSystemBackend", false); // prev: true
pref("browser.fastblock.limit", 20000); // prev: 0
pref("browser.newtabpage.activity-stream.asrouter.messageProviders", "[{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":true},{\"id\":\"snippets\",\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000,\"enabled\":false},{\"id\":\"cfr\",\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"enabled\":false,\"cohort\":\"\"}]"); // prev: "[{\"id\":\"onboarding\",\"type\":\"local\",\"localProvider\":\"OnboardingMessageProvider\",\"enabled\":false,\"cohort\":0},{\"id\":\"snippets\",\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/us-west/bundles/bundle_d6d90fb9098ce8b45e60acf601bcb91b68322309.json\",\"updateCycleInMs\":14400000,\"enabled\":false},{\"id\":\"cfr\",\"type\":\"local\",\"localProvider\":\"CFRMessageProvider\",\"enabled\":false,\"cohort\":\"\"}]"
pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"model_keys\":[\"nmf_model_animals\",\"nmf_model_business\",\"nmf_model_career\",\"nmf_model_datascience\",\"nmf_model_design\",\"nmf_model_education\",\"nmf_model_entertainment\",\"nmf_model_environment\",\"nmf_model_fashion\",\"nmf_model_finance\",\"nmf_model_food\",\"nmf_model_health\",\"nmf_model_home\",\"nmf_model_life\",\"nmf_model_marketing\",\"nmf_model_politics\",\"nmf_model_programming\",\"nmf_model_science\",\"nmf_model_shopping\",\"nmf_model_sports\",\"nmf_model_tech\",\"nmf_model_travel\",\"nb_model_animals\",\"nb_model_books\",\"nb_model_business\",\"nb_model_career\",\"nb_model_datascience\",\"nb_model_design\",\"nb_model_economics\",\"nb_model_education\",\"nb_model_entertainment\",\"nb_model_environment\",\"nb_model_fashion\",\"nb_model_finance\",\"nb_model_food\",\"nb_model_game\",\"nb_model_health\",\"nb_model_history\",\"nb_model_home\",\"nb_model_life\",\"nb_model_marketing\",\"nb_model_military\",\"nb_model_philosophy\",\"nb_model_photography\",\"nb_model_politics\",\"nb_model_productivity\",\"nb_model_programming\",\"nb_model_psychology\",\"nb_model_science\",\"nb_model_shopping\",\"nb_model_society\",\"nb_model_space\",\"nb_model_sports\",\"nb_model_tech\",\"nb_model_travel\",\"nb_model_writing\"],\"show_spocs\":false,\"personalized\":true,\"version\":1}"); // prev: "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}"
pref("browser.safebrowsing.downloads.remote.timeout_ms", 15000); // prev: 10000

Am I the only one who sees the line for browser.newtabpage.activity-stream.feeds.section.topstories.options without syntax highlighting?

[earthlng]

oh damn, I wasn't exactly sure what you meant, I'm sorry mate :kissing_cat:
no I see the line without syntax highlighting too. I noticed it before in other diffs too but never gave it much of a thought about what the reason may be. @claustromaniac to the rescue ;)

[intika]

Thanks guys for taking time for that :+1:

[Thorin-Oakenpants]

Time people learnt (browser.urlbar.ctrlCanonizesURLs) that the urlbar did not die and is not a saint

Canonize vs Canonicalize

@fmarier Please inform your co-workers :grin:

[Thorin-Oakenpants]

These are just timing prefs, new features at default off, or unrelated to privacy/etc. Pipe up if you think something is important

moved from new to ignore

pref("browser.contentblocking.originlog.length", 32);
pref("browser.fission.simulate", false);
pref("browser.urlbar.ctrlCanonizesURLs", true);
pref("browser.urlbar.quantumbar", false);
pref("devtools.gridinspector.maxHighlighters", 3);
pref("devtools.inspector.changes.enabled", false);
pref("devtools.recordreplay.mvp.enabled", false);
pref("devtools.webconsole.jsterm.reverse-search", false);
pref("dom.caches.testing.enabled", false);
pref("dom.fetchObserver.enabled", false);
pref("dom.payments.request.user_interaction_required", true);
pref("dom.performance.children_results_ipc_timeout", 1000);
pref("dom.performance.time_to_first_interactive.enabled", false);
pref("dom.serviceWorkers.testing.enabled", false);
pref("dom.testing.structuredclonetester.enabled", false);
pref("dom.vr.external.notdetected.timeout", 60000);
pref("dom.vr.external.quit.timeout", 10000);
pref("dom.worker.canceling.timeoutMilliseconds", 30000);
pref("extensions.webextensions.performanceCountersMaxAge", 1000);
pref("gfx.font_ahem_antialias_none", false);
pref("gfx.webrender.blob.paint-flashing", false);
pref("identity.fxaccounts.commands.missed.fetch_interval", 86400);
pref("image.animated.generate-full-frames", false);
pref("image.cache.max-rasterized-svg-threshold-kb", 92160);
pref("image.mem.debug-reporting", false);
pref("intl.multilingual.downloadEnabled", true);
pref("javascript.options.baselinejit.threshold", 10);
pref("javascript.options.ion.frequent_bailout_threshold", 10);
pref("javascript.options.ion.threshold", 1000);
pref("layout.css.clip-path-path.enabled", false);
pref("layout.css.scrollbar-color.enabled", true);
pref("layout.css.supports-selector.enabled", false);
pref("media.navigator.mediadatadecoder_h264_enabled", false);
pref("media.wmf.force.allow-p010-format", false);
pref("pdfjs.eventBusDispatchToDOM", false);
pref("privacy.userInteraction.document.interval", 1800);
pref("privacy.userInteraction.expiration", 2592000);
pref("security.sandbox.plugin.tempDirSuffix", "");
pref("toolkit.aboutPerformance.showInternals", false);

[earthlng]

pref("dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value", false);
I'm not sure but it sounds like this breaks keyboard spoofing, perhaps regardless of the value:

https://bugzilla.mozilla.org/show_bug.cgi?id=1479964#c25

And also note that this patch changes the behavior of KeyboardEvent::KeyCode()
when spoofing is enabled and the instance is initialized by initKeyEvent() or
initKeyboardEvent(). That was changed by bug 1222285 unexpectedly and keeping
the behavior makes patched code really ugly. Therefore, this takes back the
old behavior even if spoofing is enabled.

maybe you can ask Ethan?

[Thorin-Oakenpants]

Ahh .. OK, onto it (will move it back up) .. I took the name and value to mean no change to current status quo. But I did mean to mention it to Arthur because it would no doubt be flipped to true. I guess I should have read the ticket.

Update: email sent

[fmarier]

Time people learnt (browser.urlbar.ctrlCanonizesURLs) that the urlbar did not die and is not a saint.

Lol! My new favourite typo.

[Thorin-Oakenpants]

@fmarier .. a tad OT: https://webtransparency.cs.princeton.edu/webcensus/data-release/ .. is any of that useful to you guys - eg "Firefox set to block all third-party cookies" and "DoNotTrack header is turned on" and all that cookie stuff

[fmarier]

https://webtransparency.cs.princeton.edu/webcensus/data-release/

Yes, in fact the researcher behind that project (Steven) now works at Mozilla.

[Thorin-Oakenpants]

Same as the last lot. If anything sticks out as being worthy of putting back for more investigation, sing out

PS: interesting scroll-bar width ticket (can this be used via a script (no need for XUL) so scrollbar width is not unique per OS? - just food for thought - note OS is already leaked in many other ways, so I'm not saying to do this, it's just interesting)

moved from changed to ignore

pref("browser.contentblocking.originlog.length", 32);
pref("browser.fission.simulate", false);
pref("browser.urlbar.ctrlCanonizesURLs", true);
pref("browser.urlbar.quantumbar", false);
pref("devtools.gridinspector.maxHighlighters", 3);
pref("devtools.inspector.changes.enabled", false);
pref("devtools.recordreplay.mvp.enabled", false);
pref("devtools.webconsole.jsterm.reverse-search", false);
pref("dom.caches.testing.enabled", false);
pref("dom.fetchObserver.enabled", false);
pref("dom.payments.request.user_interaction_required", true);
pref("dom.performance.children_results_ipc_timeout", 1000);
pref("dom.performance.time_to_first_interactive.enabled", false);
pref("dom.serviceWorkers.testing.enabled", false);
pref("dom.testing.structuredclonetester.enabled", false);
pref("dom.vr.external.notdetected.timeout", 60000);
pref("dom.vr.external.quit.timeout", 10000);
pref("dom.worker.canceling.timeoutMilliseconds", 30000);
pref("extensions.webextensions.performanceCountersMaxAge", 1000);
pref("gfx.font_ahem_antialias_none", false);
pref("gfx.webrender.blob.paint-flashing", false);
pref("identity.fxaccounts.commands.missed.fetch_interval", 86400);
pref("image.animated.generate-full-frames", false);
pref("image.cache.max-rasterized-svg-threshold-kb", 92160);
pref("image.mem.debug-reporting", false);
pref("intl.multilingual.downloadEnabled", true);
pref("javascript.options.baselinejit.threshold", 10);
pref("javascript.options.ion.frequent_bailout_threshold", 10);
pref("javascript.options.ion.threshold", 1000);
pref("layout.css.clip-path-path.enabled", false);
pref("layout.css.scrollbar-color.enabled", true);
pref("layout.css.supports-selector.enabled", false);
pref("media.navigator.mediadatadecoder_h264_enabled", false);
pref("media.wmf.force.allow-p010-format", false);
pref("pdfjs.eventBusDispatchToDOM", false);
pref("privacy.userInteraction.document.interval", 1800);
pref("privacy.userInteraction.expiration", 2592000);
pref("security.sandbox.plugin.tempDirSuffix", "");
pref("toolkit.aboutPerformance.showInternals", false);

[Thorin-Oakenpants]

Speak up if you spot anything that needs MOAR investigation

moved from new to ignore (notes inside)

pref("devtools.performance.recording.ui-base-url", "https://perf-html.io");
 // ^ 1480593: is/was hardcoded, this is just a pref to change it: eg for testing
pref("dom.security.featurePolicy.enabled", false);
 // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1390801
 // https://bugzilla.mozilla.org/attachment.cgi?id=9013973&action=diff
 // lets ignore this for now, it's not ready for be flipped IMO
pref("dom.xhr.standard_content_type_normalization", false);
 // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1454325
 // disabled due to issues: https://bugzilla.mozilla.org/show_bug.cgi?id=1499136
pref("extensions.webextensions.userScripts.enabled", false);
 // ^ wait til they flip it: https://bugzilla.mozilla.org/show_bug.cgi?id=1491272
 // META: https://bugzilla.mozilla.org/show_bug.cgi?id=1437098
pref("network.security.esni.enabled", false); // NECKO part of ESNI
 // ^ Disabling telemetry is the opt-out for this (and pref is currently false)
 // Am confused. Is this to enable ESNI or the telemetry?
pref("security.certerrors.recordEventTelemetry", true);
 // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1484255#c3
 // covered by telemetry master switch
pref("security.identitypopup.recordEventElemetry", true);
 // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1484251#c10
 // covered by telemetry master switch
pref("security.tls.hello_downgrade_check", false);
 // ^ https://bugzilla.mozilla.org/show_bug.cgi?id=1487279
 // let FF handle breakage. Pref is currently off anyway

[Thorin-Oakenpants]

pref("devtools.remote.adb.extensionURL", "https://ftp.mozilla.org/pub/mozilla.org/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi");
pref("devtools.webide.autoinstallADBExtension", true);

I assume the zilla would also cover the removal of devtools.webide.autoinstallADBHelper. I haven't looked at anything yet. Getting tired. I would assume the URL is covered by the other pref. Do we need this stuff? Someone do something :feel-free-to-help-guys:

---

pref("toolkit.coverage.enabled", false);
pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org");

Wots this all about: https://bugzilla.mozilla.org/show_bug.cgi?id=1492656#c8 (what's that access denied zilla?). I don't like the word "ping". Look the pref is false, but does that mean the old way is used instead. Someone do some digging please :needs-jesus:

[earthlng]

re: "coverage"
https://hg.mozilla.org/mozilla-central/file/tip/toolkit/components/telemetry/docs/data/coverage-ping.rst

This ping is not enabled by default. When enabled, a ping is generated a total of once per profile, as a diagnostic tool to determine whether Telemetry is working for users.

This ping contains no client id and no environment data.

You can find more background information in this blog post.

Expected behaviours
-------------------
The following is a list of expected behaviours for the ``coverage`` ping:

- The ping will only be sent once per ping version, per profile.
- If sending the ping fails, it will be retried on startup.
- A totally arbitrary UUID is generated on first run on a new profile, to use for filtering duplicates.
- The ping is sent to a different endpoint not using existing Telemetry.
- The ping does not honor the Telemetry enabled preference, but provides its own opt-out preference: `toolkit.coverage.opt-out`.
- The ping is disabled by default. It is intended to be enabled for users on an experimental basis using the preference `toolkit.coverage.enabled`.

Booo! :-1:

user_pref("toolkit.coverage.enabled", false);
user_pref("toolkit.coverage.opt-out", true);

is all we need IMO.

However, an unknown portion of our users do not report telemetry for a variety of reasons. This means we may not have data that is representative of our entire population. For example, some enterprise builds are preconfigured to not send telemetry and some users manually opt-out of telemetry collection. We believe the large majority of clients do send telemetry but currently have no way of measuring this.

So, they already know that "an unknown portion of our users do not report telemetry" but they "currently have no way of measuring this." How the fuck will "sample a portion of all Firefox clients" give them more "representative (data) of our entire population" ?

[earthlng]

ignore pref("dom.xhr.lowercase_header.enabled", true); // prev: false

:jeans: DONE - moved from changed to ignore

[earthlng]

Can they not extrapolate from ~500 million users and X million of telemetry reports based on telemetry client-id? IDK, it makes no sense to me

[earthlng]

todo: move 0370 to 0105b

:jeans: DONE - added to OP

[Thorin-Oakenpants]

FF65: https://bugzilla.mozilla.org/show_bug.cgi?id=1503681 .. something for earthlng to test, probably makes our script and E's extension's redundant. We can deal with it when we get 65 diffs

[earthlng]

they only address common, non-malicious use of it. LowerCaseEqualsLiteral("_blank")
There are other targets you can use instead of "_blank" and all those will still allow access to the opener

[earthlng]

^^ if it's not showing up in the diffs then it's always either a runtime-set or a hidden pref

[earthlng]

browser.newtabpage.activity-stream.asrouter.messageProviders was removed in the meantime and replaced with 3 new prefs. I will update the diff when 64 final lands. But I don't think we need to tamper with those because Onboarding and CFR are all local and you won't ever see onboarding if you don't use Activity Stream AFAIK. The 3rd part of "ASrouter" is snippets and that's covered already by 0105b.
We could add browser.newtabpage.activity-stream.feeds.asrouterfeed=false since that's the master switch for all ASrouter things but IDK if we really need/want to do that.

We also don't need to mess with
browser.newtabpage.activity-stream.feeds.section.topstories.options because that's covered by browser.newtabpage.activity-stream.feeds.section.topstories=false in 0105c

[earthlng]

do we want to do something with 4702 general.buildID.override? move to 9999?

[Thorin-Oakenpants]

Pocket no longer a system addon

Where do we move 0510 Pocket to? (0510 is also used in deprecated so we should update that bit as well)

[Thorin-Oakenpants]

do we want to do something with 4702 general.buildID.override? move to 9999?

Sure. Is it just obsolete code now, or actually removed?

[Atavic]

It's here.

[Thorin-Oakenpants]

I was being lazy, I can kinda remember the code snippet when we talked about why they changed the value...`. Anyway, without looking at the code on DXR, is this going to be like the battery pref, and it gets moved back?

The non-hardcoded real value for buildID is actually still returned on privileged domains. The question would be (and I haven't looked) is, does this pref get applied for those privileged domains. In other words, is the pref still used (as compared to just still being in code).

If we're going to be consistent then

• battery pref is still used -> not in 9999 (note: has some merit in being able to turn this off from extensions which have access to the API)
• buildId pref -> ?

[earthlng]

https://github.com/ghacksuserjs/ghacks-user.js/search?q=20181001000000&type=Issues

Where do we move 0510 Pocket to?

IDK, what do you suggest?

[Thorin-Oakenpants]

I went back to v54 and it used to live at 0373: the old 0370s were Snippets, Pocket, Flyweb, Social API.
current 0370s are all deprecated: 0372 Hello 0374 social. I guess 300s fits, but pocket (outside AS) doesn't do anything AFAIK unless you have an account? If it did any background connections to eg, pull in some recommendations (outside of AS), then 300s is it for sure. But regardless, it doesn't fit anywhere else .. so 0370 = :+1: AFAIConcerned

[earthlng]

that's fine.
We can ignore buildID because it can still be used to spoof on privileged mozilla pages for those who don't use RFP.
We can add the CRF one inactive under Misc or Personal and the VR to the other VR if you want.
No need for the distrust_ca_policy, returnValue or the 3 asrouter providers IMO.
That leaves the keyboard one but IDK what to do with that.

[earthlng]

by "ignore buildID" I mean keep it where it is

[Thorin-Oakenpants]

I thought we removed all those 0105* // comments about having a setting. We did have two, now I see four. I mapped all the UI settings to their prefs previously, and there were only two. It's why I have an issue open on cleaning up all the AS shit, because the UI is only for showing/hiding sections and does nothing to stop anything.

Pretty sure some of those four do not have a UI setting. In the meantime I have removed em all. We can deal with them again when we look at adding in and blanking all the other crap that isn't based on recent history. This is just a quick note, I'll get into it later

[Thorin-Oakenpants]

OT: https://bugzilla.mozilla.org/show_bug.cgi?id=167475 .. OK, I think have found a winner .. 17 years to patch

[earthlng]

topstories definitely has a setting. the other 2 are only visible if Pocket is enabled I believe. You'll see it if you use a vanilla profile

[Thorin-Oakenpants]

Yeah, I did it all in a nilla 63 in #528 and I don't remember any items getting hidden/shown based on other checkboxes. Anyway, if we want to put em back, I can remap them all later (in 64)

[earthlng]

Pocket doesn't have a checkbox. Don't need to put em back

[Thorin-Oakenpants]

Sorry mate, I misread what you meant .. I took when pocket is enabled to mean the pocket option in AS, not the hidden pref. It's gong to get too messy if we try and add individual UI info for these. You'll have to excuse me, I'm in a bit of trouble here and having a super hard time doing anything (and medical is at least a day away, if not longer). I'm not dying, so chill out :) .. but I am in sooooo much pain

[crssi]

^^ :cry: I wish you best :heart:

[Thorin-Oakenpants]

we can ignore dom.vr.service.enabled 1473399, as long as we cover devices (which RFP does) .. IANAExpert but any changes they do to VR is probably for the better (e.g giving it it's own thread, sandboxing it, etc)

[Thorin-Oakenpants]

dom.event.returnValue.enabledis false anyway, moving from new to ignore
Also see https://developer.mozilla.org/en-US/docs/Web/API/Event/returnValue

[Thorin-Oakenpants]

I'm all done. If you're happy, close this, change the date & version, do a pre-release

PS: Thanks for your hard work and input over the last few days :kiss: I love you more than :cat2:

[earthlng]

Great. Thank you too :kiss:

can you do the release thingy please?

[Thorin-Oakenpants]

done

[crssi]

Didn't catch right... is browser.newtabpage.activity-stream.asrouter.userprefs.cfr acting as false with some master switch?
If not, what is your opinion about CFRs?

Cheers and thank you for everything

[Thorin-Oakenpants]

There's nothing master switchey about the pref. It enables/disables whether or not you get recommendations as you browse. There are other prefs that control endpoints for getting data throughout Activity Stream. When or if we blank those, it's usually as a fallback or future proofing. And to be honest, with AS I think I want to do provide this (effectively kill all outbound connections) as AS only provides a UI for showing/hiding sections - and they would want to all data already locally available for when you make sections visible. i.e. I fully expect with all AS UI options unchecked, that it will still retrieve and update local storage of snippets, recommended, cfr, and so on But we'll deal with all that in #528

As for my opinion, personally I do not want it. Currently it's US users only and recommends extensions. The release says "relevant Firefox features, services, and extensions", so expect it to expand in future. However, if you read the Big E's detective work, there are no issues here - data is prepared based for the endpoints based on research or something (who knows) and all your browser does is go grab a copy to store locally (expect this to diverge with regional, language versions).

I'm all for FF encouraging users to add extensions (60% have none?), but what is the vetting process here. I'm sure there is one, but sheesh, I look at some of the extensions of the month BS and cringe. I hope it doesn't become spam-like, or recommend a compromised extension - eg like here's a cool screenshot extension, and then a few months later it's revealed the extension has been auto-opt_in to hover up and sell all your data. The AMO vetting process, while faster than manual, is letting shit creep thru (don't get me wrong, its better than the cesspit that chrome provides).

It would be nice if, in order to make a CFR list, a protocol is signed off on. First the Extension must be fully vetted, secondly the extension developer must agree, and thirdly, the extension developer must sign off on liability and damages etc and pinky swear under oath (and penalty) that bad shit will not happen, and than any change of ownership must notify Mozilla. IDK.

[crssi]

It looks to me that the users will end with a numerous extensions in their profile, slowing down FF as a result and from security/privacy point of view they will get an extensions which could leak to many stuff uncontrolled.

[Atavic]

"FACEBOOK_CONTAINER",
"GOOGLE_TRANSLATE",
"YOUTUBE_ENHANCE",
"WIKIPEDIA_CONTEXT_MENU_SEARCH",
"REDDIT_ENHANCEMENT",

source

[Thorin-Oakenpants]

That's just a test

[earthlng]

resource://activity-stream/lib/CFRMessageProvider.jsm

WIKIPEDIA_CONTEXT_MENU_SEARCH + REDDIT_ENHANCEMENT are excluded at the moment (exclude: true)

[Thorin-Oakenpants]

Re: dom.keyboardevent.keypress.set_keycode_and_charcode_to_same_value

So I asked Tom Ritter and Arthur Edelstein about this. Tom wasn't sure, and checked with Tim Huang who got back to us (the below is from an email)

Hi Guys,

Sorry for the late response. I've checked the change around that. The change affects two things inside KeyCode() function.

First, it won't spoof the keyCode if the event is from initKeyEvent() or initKeyboardEvent(). This doesn't pose more threats in terms of fingerprinting protection since we don't spoof the keyCode if the event is from the script.

Second, it will directly return charCode for KeyCode() function when it is a 'keypress' event with printable keys[1], which ignores spoofing entirely. I think the char code is platform independent. So, there should be no fingerprinting issue around that.

Therefore, I think we are good here.

[1] https://searchfox.org/mozilla-central/rev/fd32b3a6fa3eff1468311f6fcf32b45c117136df/dom/events/KeyboardEvent.cpp#201-209

[Thorin-Oakenpants]

devtools.performance.recording.ui-base-url was brought up in https://github.com/ghacksuserjs/ghacks-user.js/pull/597 @earthlng FYI if you think we should do anything. I haven't looked at anything about this so have zero idea of the ramifications - I assume about:performance would break? IDK

[Atavic]

Some info and links here.

It appeared with FF 64.