User.js: ToDo: diffs FF78-FF79

Created on 21 Jul 2020  路  24Comments  路  Source: arkenfox/user.js

FF79 is scheduled for release July 28th

FF79 release notes [when ready]
[FF79 for developers](https://developer.mozilla.org/docs/Mozilla/Firefox/Releases/79)
FF79 compatibility
FF79 security advisories

other

93 diffs ( 42 new, 27 gone, 24 different )

new in v79.0:

  • FYI

    • pref("browser.fixup.dns_first_for_single_words", false); 1643259, D78279

    • pref("browser.navigation.requireUserInteraction", false); 1515073 - META Shipping 1645211

    • pref("network.cookie.sameSite.schemeful", false); - Currently an experiment: treats cookies from the same domain, but with different schemes (e.g. http://example.com and https://example.com) as cross-site instead of same-site. Improves security, but potentially introduces breakage

    • pref("privacy.partition.network_state.connection_with_proxy", false); investigate for 4003 1642667

removed, renamed or hidden in v79.0:

changed in v79.0:

ignore

click me for details

==NEW

pref("app.update.notifyDuringDownload", false);
pref("apz.mvm.force-enabled", false);
pref("browser.download.alwaysOpenInSystemViewerContextMenuItem", true);
pref("browser.download.openInSystemViewerContextMenuItem", true);
pref("browser.preferences.experimental", false);
pref("devtools.netmonitor.msg.displayed-messages.limit", 500);
pref("devtools.netmonitor.msg.messageDataLimit", 100000);
pref("devtools.netmonitor.msg.payload-preview-height", 128);
pref("devtools.netmonitor.msg.visibleColumns", "[\"data\", \"time\"]");
pref("devtools.overflow.debugging.enabled", false);
pref("doh-rollout.provider-steering.enabled", false);
pref("doh-rollout.provider-steering.provider-list", "[{ \"name\": \"comcast\", \"canonicalName\": \"doh-discovery.xfinity.com\", \"uri\": \"https://doh.xfinity.com/dns-query\" }]");
pref("dom.forms.enterkeyhint", false);
pref("dom.ipc.processPrelaunch.fission.number", 3);
pref("dom.quotaManager.overrideXFullPathname", true);
pref("dom.script_loader.external_scripts.speculate_async.enabled", false);
pref("dom.script_loader.external_scripts.speculate_link_preload.enabled", false);
pref("dom.script_loader.external_scripts.speculate_non_parser_inserted.enabled", false);
pref("dom.script_loader.external_scripts.speculative_omt_parse.enabled", false);
pref("editor.white_space_normalization.blink_compatible", false);
pref("gfx.webrender.precache-shaders", false);
pref("javascript.options.asyncstack_capture_debuggee_only", true);
pref("javascript.options.experimental.weakrefs.expose_cleanupSome", false);
pref("javascript.options.wasm_gc", false);
pref("javascript.options.weakrefs", true);
pref("layout.css.prefers-color-scheme-no-preference.enabled", false);
pref("mathml.stixgeneral_operator_stretching.disabled", false);
pref("media.clockdrift.buffering", 5);
pref("media.peerconnection.ice.obfuscate_host_addresses.blocklist", "");
pref("media.peerconnection.video.use_rtx.blocklist", "*.google.com");
pref("print.always_print_silent", false);
pref("privacy.purge_trackers.consider_entity_list", false);
pref("security.intermediate_preloading_healer.enabled", false);
pref("security.intermediate_preloading_healer.timer_interval_ms", 300000);
pref("signon.backup.enabled", false);
pref("signon.capture.inputChanges.enabled", true);
pref("telemetry.fog.test.localhost_port", 0);
pref("ui.mouse.radius.reposition", false);

==REMOVED or HIDDEN

pref("browser.find.anonymous_content.enabled", true);
pref("browser.newtabpage.activity-stream.telemetry.structuredIngestion", true);
pref("browser.urlbar.delay", 50);
pref("browser.urlbar.formatting.enabled", true);
pref("browser.urlbar.restyleSearches", false);
pref("browser.urlbar.update1.interventions", true);
pref("browser.urlbar.update1.searchTips", true);
pref("browser.urlbar.usepreloadedtopurls.expire_days", 14);
pref("devtools.netmonitor.ws.displayed-frames.limit", 500);
pref("devtools.netmonitor.ws.messageDataLimit", 100000);
pref("devtools.netmonitor.ws.payload-preview-height", 128);
pref("devtools.netmonitor.ws.visibleColumns", "[\"data\", \"time\"]");
pref("dom.largeAllocation.testing.allHttpLoads", false);
pref("fission.rebuild_frameloaders_on_remoteness_change", true);
pref("intl.charset.detector", "chrome://global/locale/intl.properties");
pref("intl.charset.detector.iso2022jp.allowed", true);
pref("intl.charset.detector.ng.enabled", true);
pref("intl.charset.fallback.tld", true);
pref("jsloader.shareGlobal", true);
pref("layout.css.scrollbar-color.enabled", true);
pref("layout.css.scrollbar-width.enabled", true);
pref("media.peerconnection.ice.obfuscate_host_addresses.whitelist", "");
pref("security.aboutcertificate.enabled", true);
pref("toolkit.asyncshutdown.report_writes_after", 40000);
pref("toolkit.telemetry.isGeckoViewMode", false);

==CHANGED

pref("apz.windows.force_disable_direct_manipulation", false); // prev: true
pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "{\"id\":\"message-groups\",\"enabled\":true,\"type\":\"remote-settings\",\"bucket\":\"message-groups\",\"updateCycleInMs\":3600000}"); // prev: "{\"id\":\"message-groups\",\"enabled\":false,\"type\":\"remote-settings\",\"bucket\":\"message-groups\",\"updateCycleInMs\":3600000}"
pref("browser.newtabpage.activity-stream.discoverystream.region-layout-config", "US,CA,GB,DE"); // prev: "US,CA,GB"
pref("browser.newtabpage.activity-stream.discoverystream.region-spocs-config", "US,CA"); // prev: "US"
pref("browser.urlbar.richSuggestions.tail", true); // prev: false
pref("devtools.accessibility.auto-init.enabled", true); // prev: false
pref("devtools.application.enabled", true); // prev: false
pref("devtools.contenttoolbox.fission", true); // prev: false
pref("devtools.debugger.features.async-captured-stacks", true); // prev: false
pref("devtools.debugger.features.async-live-stacks", false); // prev: true
pref("devtools.responsive.browserUI.enabled", true); // prev: false
pref("dom.ipc.tabs.shutdownTimeoutSecs", 20); // prev: 5
pref("dom.manifest.enabled", true); // prev: false
pref("image.http.accept", ""); // prev: "image/webp,*/*"
pref("javascript.options.asyncstack", true); // prev: false
pref("network.send_ODA_to_content_directly", false); // prev: true
pref("privacy.userInteraction.expiration", 3888000); // prev: 2592000
pref("security.allow_disjointed_external_uri_loads", true); // prev: false
pref("toolkit.shutdown.fastShutdownStage", 1); // prev: 0
pref("webextensions.storage.sync.kinto", false); // prev: true

diffs enhancement task
Source
picture earthlng

Most helpful comment

You're welcome.

Clearing the URL should always work and not cause any problems but you can stop the code path at an earlier stage by also setting the 2 other prefs I mentioned so that it never actually gets to the point where it would use that URL:

user_pref("browser.search.region", "US");
user_pref("browser.region.update.enabled", false);
user_pref("browser.region.network.url", "");

Be cursed by a new about:config that does not show anything when you search "location".

I hear you :)
FYI you can bookmark chrome://global/content/config.xhtml as about:config, so that when you start typing "about" (without the quotes) it will show up in the urlbar dropdown list for easy access to the old and much better XUL about:config which allows you, among other things, to search for values.

picture earthlng on 29 Jul 2020
👍2

All 24 comments

some bugzilla tickets

  • app.update.notifyDuringDownload
    Bug 1642404 - add an option to show that an update is being downloaded

  • apz.mvm.force-enabled
    Bug 1648687 - Disable the visual-viewport-only MVM for Firefox 79.
    Bug 1644271 - Enable the MVM pref by default.
    Bug 1644271 - Add a pref to enable the MobileViewportManager.

  • apz.windows.force_disable_direct_manipulation
    Bug 1643634. Let the WS_EX_LAYERED | WS_EX_TRANSPARENT flags on the compositor window ride the trains.
    Bug 1635243. Only use WS_EX_LAYERED | WS_EX_TRANSPARENT on the compositor window on nightly for now.

  • browser.download.alwaysOpenInSystemViewerContextMenuItem
    Bug 1639069 - Add download context menu items to 'Use' and 'Always use' the system viewer to open the download.

  • browser.download.openInSystemViewerContextMenuItem
    Bug 1639069 - Add download context menu items to 'Use' and 'Always use' the system viewer to open the download.

  • browser.find.anonymous_content.enabled
    Bug 1650444 - Remove browser.find.anonymous_content.enabled.

  • browser.fixup.dns_first_for_single_words
    Bug 1643259 - Unhide browser.fixup.dns_first_for_single_words.

  • browser.navigation.requireUserInteraction
    Bug 1515073 - Part 3 - Add support for skipping session entries without user interaction on desktop.

  • browser.newtabpage.activity-stream.asrouter.providers.message-groups
    Bug 1640734 - Frequency capping should apply separately for production and experiment messages
    Bug 1633009 - Disable the Remote Settings message-group provider because it is not used

  • browser.newtabpage.activity-stream.discoverystream.region-layout-config
    Bug 1653061 - turn on 7 rows of pocket stories in the de locale.
    Bug 1632574 - Turn Pocket stories on by default in GB
    Bug 1613739 - Pref to switch story rows based on region

  • browser.newtabpage.activity-stream.discoverystream.region-spocs-config
    Bug 1650200 - Turn on spocs in CA by default.

  • browser.preferences.experimental
    Bug 1648223 - Enable the Experimental Preferences by default.
    Bug 1644535 - Add section to about:preferences for Experimental Features.

  • browser.tabs.remote.useCrossOriginEmbedderPolicy
    Bug 1619649 - Set the prefs for COOP header, COEP header, and postMessage SAB to true on all channels;

  • browser.tabs.remote.useCrossOriginOpenerPolicy
    Bug 1619649 - Set the prefs for COOP header, COEP header, and postMessage SAB to true on all channels;

  • browser.urlbar.delay
    Bug 1643639 - Hide some urlbar prefs that may cause trouble to the user.

  • browser.urlbar.formatting.enabled
    Bug 1643639 - Hide some urlbar prefs that may cause trouble to the user.

  • browser.urlbar.restyleSearches
    Bug 1643639 - Hide some urlbar prefs that may cause trouble to the user.
    Bug 1626946 - Remove search suggestions that dupe a search history result.

  • browser.urlbar.richSuggestions.tail
    Bug 1653085 - Enable browser.urlbar.richSuggestions.tail on Release.
    Bug 1645059 - Enable browser.urlbar.richSuggestions.tail.
    Bug 1626897 - Part 2 - Add support for tail suggestions to SearchSuggestionsController.jsm.

  • browser.urlbar.update1.interventions
    Bug 1643638 - Remove update1.searchTips and update1.interventions.

  • browser.urlbar.update1.searchTips
    Bug 1643638 - Remove update1.searchTips and update1.interventions.

  • browser.urlbar.usepreloadedtopurls.enabled
    Bug 1643639 - Hide some urlbar prefs that may cause trouble to the user.

  • browser.urlbar.usepreloadedtopurls.expire_days
    Bug 1643639 - Hide some urlbar prefs that may cause trouble to the user.

  • devtools.accessibility.auto-init.enabled
    Bug 1642520 - enable accessibility panel auto initialization on all channels.
    Bug 1602075 - add an accessibility-panel-auto-init feature to control the panel auto enabling functionality.

  • devtools.application.enabled
    Bug 1642947 - Enable application panel in all channels

  • devtools.contenttoolbox.fission
    Bug 1639934 - Enable devtools.contenttoolbox.fission by default but gate it behind fission.autostart

  • devtools.debugger.features.async-captured-stacks
    Bug 1615625 - Enable async captured stacks on all channels.
    Bug 1615622 - Enable Async Captured Stacks in Nightly and DevEdition.

  • devtools.debugger.features.async-live-stacks
    Bug 1615625 - Enable async captured stacks on all channels.
    Bug 1615622 - Enable Async Captured Stacks in Nightly and DevEdition.
    Bug 1592728 - Enable async live stacks in all channels.

  • devtools.netmonitor.msg.displayed-messages.limit
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.msg.messageDataLimit
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.msg.payload-preview-height
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.msg.visibleColumns
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.ws.displayed-frames.limit
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.ws.messageDataLimit
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.ws.payload-preview-height
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.netmonitor.ws.visibleColumns
    Bug 1636418 - Rename WebSockets codebase to Messages.

  • devtools.overflow.debugging.enabled
    Bug 1641069 - Add pref "devtools.overflow.debugging.enabled".

  • devtools.responsive.browserUI.enabled
    Bug 1585005 - Enable RDM Fission for all builds.
    Bug 1621306 - Enable the devtools.responsive.browserUI.enabled pref in Nightly only

  • doh-rollout.provider-steering.enabled
    Bug 1646896 - Ship a default value for doh-rollout.provider-steering.provider-list in mozilla-central.

  • doh-rollout.provider-steering.provider-list
    Bug 1646896 - Ship a default value for doh-rollout.provider-steering.provider-list in mozilla-central.

  • dom.forms.enterkeyhint
    Bug 1490661 - Part 1. Support HTML.enterKeyHint in Nighly.

  • dom.ipc.processPrelaunch.fission.number
    Bug 1602757: add preallocation cache for webIsolated (fission) processes

  • dom.ipc.tabs.shutdownTimeoutSecs
    Bug 1637048 - Significantly increase the time we wait before killing a content process that hasn't finished shutting down

  • dom.largeAllocation.testing.allHttpLoads
    Bug 1508306 - Part 1: Migate the Large-Allocation handler to DocumentLoadListener,

  • dom.manifest.enabled
    Bug 1647858 - Enable dom.manifest.enabled for all channels

  • dom.postMessage.sharedArrayBuffer.withCOOP_COEP
    Bug 1619649 - Set the prefs for COOP header, COEP header, and postMessage SAB to true on all channels;
    Bug 1641874 - Make the pref unchangeable at runtime;

  • dom.quotaManager.overrideXFullPathname
    Bug 1645943 - Override xFullPathname to avoid the use of GetFullPathNameW;

  • dom.script_loader.external_scripts.speculate_async.enabled
    Bug 1606652 - Speculatively off thread parse external scripts as soon as they are fetched.

  • dom.script_loader.external_scripts.speculate_link_preload.enabled
    Bug 1606652 - Speculatively off thread parse external scripts as soon as they are fetched.

  • dom.script_loader.external_scripts.speculate_non_parser_inserted.enabled
    Bug 1606652 - Speculatively off thread parse external scripts as soon as they are fetched.

  • dom.script_loader.external_scripts.speculative_omt_parse.enabled
    Bug 1606652 - Speculatively off thread parse external scripts as soon as they are fetched.

  • dom.targetBlankNoOpener.enabled
    Bug 1522083 - Enable noopener by default for area and anchor elements with target=_blank and no rel attribute set,

  • editor.white_space_normalization.blink_compatible
    Bug 1642594 - part 5: Implement first version of new white-space normalizer which simulates Blink's one

  • fission.rebuild_frameloaders_on_remoteness_change
    Bug 1640019 - Part 6: Get rid of the rebuild_frameloaders pref,

  • gfx.webrender.precache-shaders
    Bug 1643832 - Add Pref flag to enable shader precaching at startup.

  • image.http.accept
    Bug 1641208 - Accept header does not include image/avif even when image.avif.enable is set.

  • intl.charset.detector
    Bug 1603712 - Remove intl.charset.detector.ng.enabled pref and resulting dead code.

  • intl.charset.fallback.override
    Bug 1603712 - Remove intl.charset.detector.ng.enabled pref and resulting dead code.

  • javascript.options.asyncstack
    Bug 1601179 - Enable async stacks but limit captured async stacks to debuggees.

  • javascript.options.asyncstack_capture_debuggee_only
    Bug 1601179 - Enable async stacks but limit captured async stacks to debuggees.

  • javascript.options.experimental.weakrefs.expose_cleanupSome
    Bug 1639246 - Ship weak refs
    Bug 1641517 - Don't expose FinalizationRegistry.prototype.cleanupSome in the browser

  • javascript.options.weakrefs
    Bug 1639246 - Ship weak refs

  • jsloader.shareGlobal
    Bug 1643910 - Remove ability to disable JSM global sharing.

  • layout.css.prefers-color-scheme-no-preference.enabled
    Bug 1643656 - Remove prefers-color-scheme: no-preference.

  • layout.css.scrollbar-color.enabled
    Bug 1641324 Remove the layout.css.scrollbar-width.enabled and layout.css.scrollbar-color.enabled prefs

  • layout.css.scrollbar-width.enabled
    Bug 1641324 Remove the layout.css.scrollbar-width.enabled and layout.css.scrollbar-color.enabled prefs

  • mathml.stixgeneral_operator_stretching.disabled
    Bug 1630935 - Add use counter and deprecation warning for STIXGeneral fonts.

  • media.clockdrift.buffering
    Bug 1637235 - Implement the audio drift correction.

  • media.peerconnection.ice.obfuscate_host_addresses.blocklist
    Bug 1643155 - Rename obfuscate_host_addresses pref;

  • media.peerconnection.ice.obfuscate_host_addresses.whitelist
    Bug 1643155 - Rename obfuscate_host_addresses pref;

  • media.peerconnection.video.use_rtx.blocklist
    Bug 1641600 - Re-enable rtx and add *.google.com to blocklist;

  • network.cookie.sameSite.schemeful
    Bug 1638358 - Cookie Schemeful Same-Site - part 5 - schemeful comparison,

  • network.send_ODA_to_content_directly
    Bug 1646058 - Disable network.send_ODA_to_content_directly,
    Bug 1623380 - Send ODA directly to content process

  • print.always_print_silent
    Bug 1471854 - Make print.always_print_silent a static pref.

  • privacy.partition.network_state.connection_with_proxy
    Bug 1642667 - Isolate alt-srv and connection pool per first-party when privacy.partition.network_state is set to true - part 2 - tests,

  • privacy.purge_trackers.consider_entity_list
    Bug 1642899 - Consider entity allow lists for cookie purging.

  • privacy.userInteraction.expiration
    Bug 1637143 - Extend storage access API user interaction permission lifetime to 45 days.

  • security.aboutcertificate.enabled
    Bug 1641082 - remove old certificate viewer implementation

  • security.allow_disjointed_external_uri_loads
    Bug 1650162 - Turn security.allow_disjointed_external_uri_loads back on to fix regressions opening external applications.
    Bug 1606797 - do not allow navigating to external URIs in cross-origin disjoint browsing contexts,

  • security.intermediate_preloading_healer.enabled
    Bug 1630434 - de-duplicate preloaded intermediates that may have been cached in cert9.db

  • security.intermediate_preloading_healer.timer_interval_ms
    Bug 1630434 - de-duplicate preloaded intermediates that may have been cached in cert9.db

  • signon.backup.enabled
    Bug 1597358 - Create a backup of logins.json to use when logins.json is missing or corrupt.

  • signon.capture.inputChanges.enabled
    Bug 1641412 - Pass all possible UNs/PWs to doorhanger;r=MattN,sfoster

  • telemetry.fog.test.localhost_port
    Bug 1643395 - Allow configuring FOG server to localhost via pref

  • toolkit.asyncshutdown.report_writes_after
    Bug 1610134: revert late writes from nsTerminator.
    Bug 1610134: Part 2: Increase timeout pref that turns on late write checking
    Bug 1610134: Part 1: add timeout pref that turns on late write checking to see if it's possible to crash browser earlier.

  • toolkit.shutdown.fastShutdownStage
    Bug 1640929 - Advance fast shutdown to 1 on all channels
    Bug 1630655 - Actually advance lateWriteChecksStage to 3

  • toolkit.telemetry.isGeckoViewMode
    Bug 1620656 - Remove 'geckoview' telemetry support.

  • ui.mouse.radius.reposition
    Bug 1572508 - Convert ui.touch.* and ui.mouse.* VarCache prefs to static prefs.

  • webextensions.storage.sync.kinto
    Bug 1634615 - flip the pref to enable the rust browser.storage.sync implementation.
    Bug 1623245 - A new browser.storage.sync local storage implementation, pref'd off.
    Bug 1642271 - don't sync the webextensions.storage.sync.kinto preference.
    Bug 1635352 (part 1) - Add a new bridged extension-storage engine.

earthlng picture earthlng on 21 Jul 2020

browser.urlbar.usepreloadedtopurls.enabled wasn't removed, just hidden. Default value is false so we can just remove it completely for now and, if necessary, pick it back up when/if they ever enable it, or move it back up to where it was and add some tags.

pref("browser.tabs.remote.useCrossOriginEmbedderPolicy", true); // prev: false
pref("browser.tabs.remote.useCrossOriginOpenerPolicy", true); // prev: false
pref("dom.postMessage.sharedArrayBuffer.withCOOP_COEP", true); // prev: false

these 3 combined re-enable postmessage support for sharedArrayBuffer stuff under certain circumstances, ie this:

https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/79#JavaScript

Don't know if the high-precision timers that this can provide are covered by RFP.

pref("devtools.application.enabled", true); // prev: false
pref("dom.manifest.enabled", true); // prev: false

enable the Application panel

The Application panel provides tools for inspecting and debugging modern web apps (also known as Progressive Web Apps). This includes inspection of service workers and web app manifests.

But I don't think it actually works ATM because (source)

Note that the Application panel depends on Service worker support

Service worker support = devtools.debugger.features.windowless-service-workers. They had to re-disable that pref again due to bad performance.

the 2 media.peerconnection.* - we already have 2001 user_pref("media.peerconnection.enabled", false); so these 2 probably don't really matter

earthlng picture earthlng on 28 Jul 2020

I need help.

On Firefox 79 I cannot disable location.services.mozilla.com anymore. Every browser start trying to connect and my firewall block it. With Firefox 78.0.2 I not have this issue. Mozilla blocked any possibility to disable location.services.mozilla.com for users, how they did it before for firefox.settings.services.mozilla.com? I tried false/true all new prefs but nothing help.

TarTakTarBok picture TarTakTarBok on 28 Jul 2020

@TarTakTarBok What are you trying to achieve? What exactly is the problem with connecting to location.services.mozilla.com - see #966

Thorin-Oakenpants picture Thorin-Oakenpants on 29 Jul 2020

The problem is that I completely disable all geolocation, and the connection to the location.services.mozilla.com server still happens.

user_pref("browser.search.geoSpecificDefaults", false);
user_pref("browser.search.geoSpecificDefaults.url", "");
user_pref("geo.enabled", false);
user_pref("geo.provider.network.url", "");
user_pref("geo.provider.network.logging.enabled", false);
user_pref("geo.provider.ms-windows-location", false);
user_pref("geo.provider.use_corelocation", false);
user_pref("geo.provider.use_gpsd", false);
user_pref("permissions.default.geo", 2);

As soon as I start the browser immediately attempts to connect to the location.services.mozilla.com server. At Firefox 78.0.2 and below, this did not happen. Because all of the above prefs disabled any geolocation. But with the release of Firefox 79, everything changed. One of two. Or Mozilla remove from users the ability to COMPLETELY disable geolocation or in Firefox 79 a new pref appeared that is enabled by default and therefore connects to location.services.mozilla.com. I'm more toward to the first option. Since in the past, Mozilla has already deprived users of any opportunity to disable the connection with the server firefox.settings.services.mozilla.com and I had to block this through host file.

https://bugzilla.mozilla.org/show_bug.cgi?id=1598562

I think they've done the same right now. Deprived users of the ability to completely disable geolocation. I do not use Mozilla services and always stop any attempts "phoning home". So I wanted to know from you maybe I missed some pref? If not, then this is the second non-disabling "phoning home" from Mozilla and I have nothing left to do how to add a another block to host file.

TarTakTarBok picture TarTakTarBok on 29 Jul 2020

Hi,

try setting browser.search.region to US. That should be enough for FF79. Please let us know if that does the trick.

For the future you may also want to set browser.region.update.enabled to false. This pref is currently hidden and defaults to false in Release but that will change in FF80 or 81.

Optionally set browser.region.network.url to empty string.

earthlng picture earthlng on 29 Jul 2020
❤1

@earthlng

Yes, you are right. Responsible for this:

browser.region.network.url;https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%

Therefore, you just need to add to user.js

user_pref("browser.region.network.url", "");

Thank you very much for your help. Be damned a new about:config that does not show anything when you search "location".

Is there any possibility that the old version "about:config" would open when entering about:config in urlbar? Some elegant solution other than bookmarking? CSS, for example?

TarTakTarBok picture TarTakTarBok on 29 Jul 2020

You're welcome.

Clearing the URL should always work and not cause any problems but you can stop the code path at an earlier stage by also setting the 2 other prefs I mentioned so that it never actually gets to the point where it would use that URL:

user_pref("browser.search.region", "US");
user_pref("browser.region.update.enabled", false);
user_pref("browser.region.network.url", "");

Be cursed by a new about:config that does not show anything when you search "location".

I hear you :)
FYI you can bookmark chrome://global/content/config.xhtml as about:config, so that when you start typing "about" (without the quotes) it will show up in the urlbar dropdown list for easy access to the old and much better XUL about:config which allows you, among other things, to search for values.

earthlng picture earthlng on 29 Jul 2020
👍2

Alredy add to user.js.

I totaly disable any urlbar dropdown. Therefore, only the add of a bookmark or some CSS solution (it is unlikely). Maybe I should experiment with the redirect or something. In any case, I appreciate for your help.

TarTakTarBok picture TarTakTarBok on 29 Jul 2020

@earthlng Any ideas on the last 3 items, and also that region crap

Thorin-Oakenpants picture Thorin-Oakenpants on 2 Aug 2020 
/* 0205: disable GeoIP-based search results
 * [NOTE] May not be hidden if Firefox has changed your settings due to your locale ***/
user_pref("browser.search.region", "US"); // [HIDDEN PREF]
user_pref("browser.region.update.enabled", false);
user_pref("browser.region.network.url", ""); // [FF78+]
earthlng picture earthlng on 2 Aug 2020

browser.navigation.requireUserInteraction has unfixed regressions - ignore for now IMO

earthlng picture earthlng on 2 Aug 2020

region is being "redefined" - I'll dig up a meta ticket, and it's not like there's a roadmap or list of what it's all meant to do. But we can;t just have things breaking because someone throws a hissy fit when a mozilla url is pinged. If they don;t trust mozilla, then they shouldn't be using Firefox

edit: What exactly is the threat here, is my question. That patch link helps explain a little - how exactly does the search engine leak anything (not to a third party) - I don't quite get it. The region is also used by other things such as AS(?) which can be get fucked, DoH rollout(?), however .. the search pref might be OK (it's US in TB), the region updating, I think will cause problems? yes/no?

browser.navigation.requireUserInteraction - I know (its not that bad). But if we don't add it and flip it active, then we miss out for ages, and like most things we then wait for it to flip and hope it flips - look how long it took to turn on noopener (14 releases FFS). I like this one because it helps solve that shitty history push/pop state

Thorin-Oakenpants picture Thorin-Oakenpants on 2 Aug 2020

requireUserInteraction: it's bad enough that they even disabled it again in nightly.

the search pref might be OK (it's US in TB), the region updating, I think will cause problems?

if we'd force the region to US we may as well disable the updating too because it's pointless

earthlng picture earthlng on 3 Aug 2020

if we'd force the region to US we may as well disable the updating too because it's pointless

So that was my initial analysis (and I wasn't keen of making anything active). Now I've time to think about it. Let's see if I have this correct

  • Firefox ships with default search engines: these are decided by the bundle

    • i.e. I unpack and use a FF portable en-US, or a Nightly/Beta en-US install

    • i.e. it comes with default engines for e.g. google as compared to yandex or something for russian builds

  • Firefox gets your "location" and will change your region

    • after two weeks? (might be right away for a new profile? doesn't matter)

    • e.g. my portables and installed Nightly/Beta are all showing browser.search.region as my actual country

  • How is location discovered? What if you're on a VPN?

    • I guess it gets the VPN server's location: but generally a user would change servers from time to time

  • IIUnderstandCorrectly, just changing the search region to en-US wouldn't be enough, because a location check would change it on you: It's storing Region.current and Region.home and those two decide the search region pref - so yes, if we set it, then the update check needs to also be blocked/stopped

What is it updating? Is it just the pref changes? Or if you're holidaying in Russia, do you get a yandex engine (I don't think so since the engines are bundled inside omni jar, right)?

What does the pref change actually do? I'm on en-US, with en-US search region, and I do a google search using the build in search engine. How does that differ exactly if I was on holiday in France for three weeks? Do I suddenly switch from google.com to google.fr ? (google might not be a great example because the TLD can change based on IP). How does google know I want french stuff (i.e how does mozilla influence the results? does it send something to google?)

In the case of right now for me, using the default google search engine, with my region as mars, I am still getting google.com, not google.mars

  • If we force it to en-US (and stop the update check), do all the non en-US users now get different search results to what they expect: do we make them stand out more? e.g. they search for "starbucks" and get starbucks.com instead of starbucks.fr as a suggestion?
  • Does anyone else but the search provider know
  • Is anything actually leaked (must be, right, if the search results are being changed by "region")
  • Is this affecting user-added search engines?

I've always said we shouldn't mess with people's search engines, and users are free to add their own (and disable the default ones).

AFAIC .. connecting to the location services URL is not a privacy issue: but probably needs to be stopped for the real issue, which is: FF changing the region pref just because your location changed and was stable for two weeks (right? region.current need to be stable for two weeks), and would likewise take two weeks to flip back when you get home - I think this use case would be rare.

So the only relevant question here is what exactly is the privacy leak here?

Thorin-Oakenpants picture Thorin-Oakenpants on 4 Aug 2020

Anyone know if dom.targetBlankNoOpener.enabled makes "Don't Touch My Tabs" extension redundant? Thanks.

B00ze64 picture B00ze64 on 6 Aug 2020

we've never recommended Don't Touch My Tabs

Thorin-Oakenpants picture Thorin-Oakenpants on 6 Aug 2020

I have ditched Don't Touch My Tabs in favor of dom.targetBlankNoOpener.enable.

crssi picture crssi on 6 Aug 2020

Thanks @crssi I shall do the same. It's not that I do not like DTMT, seems to work fine, but one less extension is always a plus.

@Thorin-Oakenpants Sure, but I do not necessarily use everything you recommend and nothing else lol. I do avoid stuff you say to avoid however :-) I do appreciate everyone's work here though, very well organized nowadays, I can simply read the DIFF issues (and related Mozilla bugs) to keep-up every month (I do this manually, my user.js is organized differently then yours). And when I redid my user.js completely to move from FF52 to FF77, you guys had nice scripts that I used to identify deprecated things and different things etc. Took me days, but you all made it easier than before. Thanks.

Best Regards,

B00ze64 picture B00ze64 on 7 Aug 2020

doc; https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html

Thorin-Oakenpants picture Thorin-Oakenpants on 8 Aug 2020

Instead of forcing everyone into the "US" region, we could use "ZZ" which is what they use to mean "unknown".
That'd probably not be ideal for people in the US because it'd opt them out of certain things that mozilla rolls out based on region, fe currently formautofill. But IDK if anyone really cares about that.
I also don't know what kind of content they'd show on AS for the "unknown" region, etc. But again ... does anyone really care about that shit?
IMO it's kinda dumb to tie content and whatnot to an IP address anyways, because it'll constantly change for VPN users for example or people who travel a lot. Like, 1 day they'll get all their AS content in russian and then maybe spanish the next 2 weeks?! Sounds pretty awesome. :trollface:
Habla espaniol? No, but gracias, mucho appreciados. Vodka? Da! na zdrowie :)

earthlng picture earthlng on 10 Aug 2020

dns_first_for_single_words = default false - SGTM. No need to add or change this IMO

earthlng picture earthlng on 10 Aug 2020

so several days ago I looked at what TB does for ESR78 based (but I didn't look at non en-US build) and they had for defaults

  • user_pref("browser.search.region", "US");
  • user_pref("browser.region.update.enabled", false);
  • user_pref("browser.region.network.url", "");

note: Still can't find browser.region.update.enabled in about config in FF. Is it hidden? When was it added
note 2: we should check some non en-US TB bundles (but I don't even think TB uses it: browser.search.region = en-US in the en-US build is because it's not hidden for en-US builds? IDK for sure: needs MOAR cowbell)

Now TB actually rip out or nip AS in the bud before it's even called, and they ship their own list of search engines, etc: so they're not really in the same boat as us. What I think we could do is something more like this

user_pref("browser.region.update.enabled", false);
  // user_pref("browser.search.region", "US");
  // user_pref("browser.region.network.url", ""); // defense in depth? do we even need this?

Most people wouldn't have been bouncing around getting new regions (2 weeks of a solid new region? edit: 2 solid weeks where the region !== home), and thus we lock em down to what they should be. We don't push en-US at them, as that might affect roll-outs: e.g. DoH, or their Pocket content for those who like that on AS, or AS users, etc

As for the threat of not being en-US "region" - I don't see one TBH.

Thorin-Oakenpants picture Thorin-Oakenpants on 10 Aug 2020

Looks like they flipped browser.region.update.enabled to true for Firefox 80 on 17 July 2020. At least according to this commit with the message Enable region cachebusting on release r=mikedeboer. Relevant bug.

geeknik picture geeknik on 10 Aug 2020
👍1
Was this page helpful?
0 / 5 - 0 ratings

Related issues

earthlng picture earthlng  路  6Comments
Thorin-Oakenpants picture Thorin-Oakenpants  路  5Comments
kaliostro2 picture kaliostro2  路  7Comments
TerkiKerel picture TerkiKerel  路  4Comments
Thorin-Oakenpants picture Thorin-Oakenpants  路  4Comments