FF80 is scheduled for release August 25th
FF80 release notes [when ready]
[FF80 for developers](https://developer.mozilla.org/docs/Mozilla/Firefox/Releases/80)
FF80 compatibility
FF80 security advisories
65 diffs ( 40 new, 8 gone, 17 different )
new in v80.0:
- [x] pref("dom.security.https_only_mode_pbm", false); - https://github.com/ghacksuserjs/ghacks-user.js/commit/38d772e4c8721f59a361370572cdb25d777ea04a
0207pref("browser.region.update.enabled", true); - actually added hidden in FF79 - bad earthlng 😀- FYI: pref("dom.block_download_insecure", false); 1614969
removed, renamed or hidden in v80.0:
no changes necessary this time
changed in v80.0:
no changes necessary this time
ignore
==NEW ==REMOVED or HIDDEN ==CHANGEDclick me for details
pref("apz.force_disable_desktop_zooming_scrollbars", true);
pref("browser.preferences.experimental.hidden", false);
pref("browser.preferences.exposeHTTPSOnly", false);
pref("browser.tabs.documentchannel.parent-controlled", false);
pref("browser.topsites.useRemoteSetting", false);
pref("browser.urlbar.loglevel", "Error");
pref("browser.urlbar.update2", false);
pref("browser.urlbar.update2.localOneOffs", false);
pref("browser.urlbar.update2.oneOffsRefresh", false);
pref("browser.urlbar.update2.tabToComplete", false);
pref("devtools.netmonitor.audits.slow", 500);
pref("dom.security.https_only_mode_ever_enabled_pbm", false);
pref("dom.security.unexpected_system_load_telemetry_enabled", true);
pref("dom.suspend_inactive.enabled", false);
pref("domsecurity.httpsonly.infoURL", "https://developer.mozilla.org/en-US/docs/Glossary/https");
pref("extensions.backgroundServiceWorker.enabled", false);
pref("extensions.formautofill.addresses.capture.enabled", false);
pref("extensions.formautofill.creditCards.hideui", false);
pref("extensions.serviceWorkerRegister.allowed", false);
pref("fission.processOriginNames", false);
pref("gfx.use-ahardwarebuffer-content", false);
pref("layout.animation.prerender.partial.jank", false);
pref("layout.css.prefers-contrast.enabled", false);
pref("media.videocontrols.picture-in-picture.video-toggle.has-used", false);
pref("media.videocontrols.picture-in-picture.video-toggle.mode", -1);
pref("media.videocontrols.picture-in-picture.video-toggle.position", "right");
pref("print.tab_modal.enabled", false);
pref("security.bad_cert_domain_error.url_fix_enabled", false);
pref("security.ssl3.rsa_aes_128_gcm_sha256", true);
pref("security.ssl3.rsa_aes_256_gcm_sha384", true);
pref("security.warn_submit_secure_to_insecure", true);
pref("security.xfocsp.errorReporting.automatic", false);
pref("security.xfocsp.errorReporting.enabled", true);
pref("signon.management.page.fileImport.enabled", false);
pref("storage.sqlite.exclusiveLock.enabled", true);
pref("webgl.debug.incomplete-tex-color", 0);
pref("webgl.oop.via-pcq", false);
pref("browser.urlbar.update2.expandTextOnFocus", false);
pref("devtools.accessibility.auto-init.enabled", true);
pref("devtools.responsive.browserUI.enabled", true);
pref("dom.sidebar.enabled", false);
pref("layout.viewport_contains_no_contents_area", true);
pref("media.getusermedia.experimental_input_processing", false);
pref("network.standard-url.punycode-host", true);
pref("webgl.prototype.ipc-pcq", 0);
pref("apz.mvm.force-enabled", true); // prev: false
pref("browser.aboutwelcome.overrideContent", "{\"id\": \"multi-stage-welcome-default\",\"template\": \"multistage\",\"screens\": [{\"id\": \"AW_GET_STARTED\",\"order\": 0,\"content\": {\"zap\": true,\"title\": {\"string_id\": \"onboarding-multistage-welcome-header\"},\"subtitle\": {\"string_id\": \"onboarding-multistage-welcome-subtitle\"},\"primary_button\": {\"label\": {\"string_id\": \"onboarding-multistage-welcome-primary-button-label\"},\"action\": {\"navigate\": true}},\"secondary_button\": {\"text\": {\"string_id\": \"onboarding-multistage-welcome-secondary-button-text\"},\"label\": {\"string_id\": \"onboarding-multistage-welcome-secondary-button-label\"},\"position\": \"top\",\"action\": {\"type\": \"OPEN_URL\",\"addFlowParams\": true,\"data\": {\"args\": \"https://accounts.firefox.com/?service=sync&action=email&context=fx_desktop_v3&entrypoint=activity-stream-firstrun&style=trailhead\",\"where\": \"current\"}}}}}, {\"id\": \"AW_IMPORT_SETTINGS\",\"order\": 1,\"content\": {\"zap\": true, \"disclaimer\": {\"string_id\": \"onboarding-import-sites-disclaimer\"},\"title\": {\"string_id\": \"onboarding-multistage-import-header\"},\"subtitle\": {\"string_id\": \"onboarding-multistage-import-subtitle\"},\"tiles\": {\"type\": \"topsites\",\"info\": true},\"primary_button\": {\"label\": {\"string_id\": \"onboarding-multistage-import-primary-button-label\"},\"action\": {\"type\": \"SHOW_MIGRATION_WIZARD\",\"navigate\": true}},\"secondary_button\": {\"label\": {\"string_id\": \"onboarding-multistage-import-secondary-button-label\"},\"action\": {\"navigate\": true}}}}, {\"id\": \"AW_CHOOSE_THEME\",\"order\": 2,\"content\": {\"zap\": true,\"title\": {\"string_id\": \"onboarding-multistage-theme-header\"},\"subtitle\": {\"string_id\": \"onboarding-multistage-theme-subtitle\"},\"tiles\": {\"type\": \"theme\",\"action\": {\"theme\": \"<event>\"}, \"data\": [{\"theme\": \"automatic\",\"label\": {\"string_id\": \"onboarding-multistage-theme-label-automatic\"}, \"description\": {\"string_id\": \"onboarding-multistage-theme-description-automatic\"}, \"tooltip\": {\"string_id\": \"onboarding-multistage-theme-tooltip-automatic\"}}, {\"theme\": \"light\",\"label\": {\"string_id\": \"onboarding-multistage-theme-label-light\"}, \"tooltip\": {\"string_id\": \"onboarding-multistage-theme-tooltip-light\"}},{\"theme\": \"dark\",\"label\": {\"string_id\": \"onboarding-multistage-theme-label-dark\"}, \"tooltip\": {\"string_id\": \"onboarding-multistage-theme-tooltip-dark\"}}]},\"primary_button\": {\"label\": {\"string_id\": \"onboarding-multistage-theme-primary-button-label\"},\"action\": {\"navigate\": true}},\"secondary_button\": {\"label\": {\"string_id\": \"onboarding-multistage-theme-secondary-button-label\"},\"action\": {\"theme\": \"automatic\",\"navigate\": true}}}}]}"); // prev: ""
pref("browser.newtabpage.activity-stream.discoverystream.personalization.version", 2); // prev: 1
pref("browser.newtabpage.activity-stream.discoverystream.region-layout-config", "US,CA,GB,DE,IE"); // prev: "US,CA,GB,DE"
pref("browser.newtabpage.activity-stream.discoverystream.region-stories-config", "US,DE,CA,GB,IE"); // prev: "US,DE,CA,GB"
pref("dom.animations-api.compositing.enabled", true); // prev: false
pref("dom.arena_allocator.enabled", true); // prev: false
pref("dom.max_chrome_script_run_time", 0); // prev: 20
pref("extensions.blocklist.useMLBF", true); // prev: false
pref("extensions.blocklist.useMLBF.stashes", true); // prev: false
pref("identity.sync.useOAuthForSyncToken", true); // prev: false
pref("media.navigator.video.use_transport_cc", true); // prev: false
pref("media.peerconnection.video.use_rtx", true); // prev: false
pref("media.peerconnection.video.use_rtx.blocklist", ""); // prev: "*.google.com"
pref("security.allow_disjointed_external_uri_loads", false); // prev: true
pref("signon.backup.enabled", true); // prev: false
pref("signon.capture.inputChanges.enabled", false); // prev: true
earthlng
All 18 comments
apz.force_disable_desktop_zooming_scrollbars apz.mvm.force-enabled browser.aboutwelcome.overrideContent browser.newtabpage.activity-stream.discoverystream.personalization.version browser.newtabpage.activity-stream.discoverystream.region-layout-config browser.newtabpage.activity-stream.discoverystream.region-stories-config browser.preferences.experimental.hidden browser.preferences.exposeHTTPSOnly browser.region.update.enabled browser.tabs.documentchannel.parent-controlled browser.topsites.useRemoteSetting browser.urlbar.loglevel browser.urlbar.update2 browser.urlbar.update2.expandTextOnFocus browser.urlbar.update2.localOneOffs browser.urlbar.update2.oneOffsRefresh browser.urlbar.update2.tabToComplete devtools.accessibility.auto-init.enabled devtools.netmonitor.audits.slow devtools.responsive.browserUI.enabled dom.animations-api.compositing.enabled dom.arena_allocator.enabled dom.block_download_insecure dom.max_chrome_script_run_time dom.security.https_only_mode_ever_enabled_pbm dom.security.https_only_mode_pbm dom.security.unexpected_system_load_telemetry_enabled dom.sidebar.enabled dom.suspend_inactive.enabled domsecurity.httpsonly.infoURL extensions.backgroundServiceWorker.enabled extensions.blocklist.useMLBF extensions.blocklist.useMLBF.stashes extensions.formautofill.addresses.capture.enabled extensions.formautofill.creditCards.hideui extensions.serviceWorkerRegister.allowed fission.processOriginNames gfx.use-ahardwarebuffer-content identity.sync.useOAuthForSyncToken layout.animation.prerender.partial.jank layout.css.prefers-contrast.enabled layout.viewport_contains_no_contents_area media.getusermedia.experimental_input_processing media.navigator.video.use_transport_cc media.peerconnection.video.use_rtx media.peerconnection.video.use_rtx.blocklist media.videocontrols.picture-in-picture.video-toggle.has-used media.videocontrols.picture-in-picture.video-toggle.mode media.videocontrols.picture-in-picture.video-toggle.position network.standard-url.punycode-host print.tab_modal.enabled security.allow_disjointed_external_uri_loads security.bad_cert_domain_error.url_fix_enabled security.ssl3.rsa_aes_128_gcm_sha256 security.ssl3.rsa_aes_256_gcm_sha384 security.warn_submit_secure_to_insecure security.xfocsp.errorReporting.automatic security.xfocsp.errorReporting.enabled signon.backup.enabled signon.capture.inputChanges.enabled signon.management.page.fileImport.enabled storage.sqlite.exclusiveLock.enabled webgl.debug.incomplete-tex-color webgl.oop.via-pcq webgl.prototype.ipc-pcqsome bugzilla tickets
Bug 1655160. Disable new desktop zooming scrollbar code for now.
Bug 1651332. Create a pref to gate the new scrollbar code on.
Bug 1648687 - Disable the visual-viewport-only MVM for Firefox 79.
Bug 1644271 - Enable the MVM pref by default.
Bug 1644271 - Add a pref to enable the MobileViewportManager.
Bug 1656631 - Make static sites in import screen as default experience.
Bug 1653322 - Converted import topsites "disclaimer" tooltip to a footer
Bug 1653087 - Add default theme as an option to multistage choose a theme screen
Bug 1649292 - Make multistage about:welcome as default UX
Bug 1637079 - Initial multi stage about:welcome layout
Bug 1644890 - newtab stories v2 targeting on by default
Bug 1644889 - Turn on newtab story targeting v2 in nightly.
Bug 1657530 - Enable Ireland region for newtab stories.
Bug 1653061 - turn on 7 rows of pocket stories in the de locale
Bug 1653061 - turn on 7 rows of pocket stories in the de locale.
Bug 1632574 - Turn Pocket stories on by default in GB
Bug 1632574 - Turn Pocket stories on by default in GB.
Bug 1657530 - Enable Ireland region for newtab stories.
Bug 1632574 - Turn Pocket stories on by default in GB
Bug 1632574 - Turn Pocket stories on by default in GB.
Bug 1648222 - Hide the experimental features category if there are no available experimental features.
Bug 1644152: Expose HTTPS-Only Mode in about:preferences.
Bug 1651124 - Enable region cachebusting on release
Bug 1627555 - Update region if in new location for a length of time.
Bug 1647557 - Add preffed-off code for controlling document loads directly from CanonicalBrowsingContext.
Bug 1653932 - Add pref for top site defaults from remote settings.
Bug 1650099 - Unify UrlbarProviders logger boilerplate.
Bug 1647930 - Create urlbar.update2 prefs.
Bug 1647930 - Create urlbar.update2 prefs.
Bug 1647930 - Create urlbar.update2 prefs.
Bug 1647930 - Create urlbar.update2 prefs.
Bug 1647930 - Create urlbar.update2 prefs.
Bug 1640778 - remove auto-init experiment code.
Bug 1642520 - enable accessibility panel auto initialization on all channels.
Bug 1602075 - add an accessibility-panel-auto-init feature to control the panel auto enabling functionality.
Bug 1648373 - Add slow requests indicator
Bug 1585097 - Delete the devtools.responsive.browserUI.enabled pref.
Bug 1585005 - Enable RDM Fission for all builds.
Bug 1621306 - Enable the devtools.responsive.browserUI.enabled pref in Nightly only
Bug 1652676 - Enable Web Animations API compositing operations on release channels;
Bug 1652496 - Enable DOM arena allocation in Release
Bug 1614969 - Check download with MixedContentBlocker
Bug 1654325 - disable the parent process slow script dialog,
Bug 1647719: Introduce Pref for HTTS-Only in Private Browsing Mode.
Bug 1647719: Introduce Pref for HTTS-Only in Private Browsing Mode.
Bug 1644671 - systemprincipal restrictions telemetry
Bug 1632448 - Remove AddSearchProvider implementation.
Bug 1639577 - Only suspend GeckoView tabs that are alone in their BrowsingContextGroup
Bug 1644152: Expose HTTPS-Only Mode in about:preferences.
Bug 1609920 - part 1: Allow the WebExtension Framework to register a moz-extension service worker.
Bug 1620621 - Implement blocklist stashing behind pref
Bug 1620621 - Add bloomfilter-based blocklist for addons
Bug 1631018 - Enable blocklist v3 by default on desktop
Bug 1620621 - Implement blocklist stashing behind pref
Bug 1631018 - Enable blocklist v3 by default on desktop
Bug 1626055 - Disable address autofill auto-saving until we deal with duplicate addresses.
Bug 1658027 - Separate visual interactions on Credit Card Autofill for A/B testing.
Bug 1609920 - part 2: Guard ServiceWorkerContainer::Register to allow/disallow moz-extension scheme based on prefs.
Bug 1642772: Add fission process renaming to eTLD+1 for Nightly (only) via a pref
Bug 1648411 - Add AHardwareBuffer layer buffer support on android
Bug 1648194 - Enable 'identity.sync.useOAuthForSyncToken' for all users.
Bug 1635937 - Enable 'identity.sync.useOAuthForSyncToken' pref for Nightly users
Bug 1631830 - Fetch Sync tokens with OAuth behind a pref
Bug 1324591 - Report janked animations to the main-thread and update them on the main-thread.
Bug 1506364 - Implement the prefers-contrast media-query.
Bug 1650686 - Drop layout.viewport_contains_no_contents_area.
Bug 1646660 - Disable cheaper processing made in bug 1628779.
Bug 1628779 - Pass the audio rountrip latency to the echo canceller, and disable extended filter and delay agnostic AEC, on macOS Nightly.
Bug 1651722 - Enable transport-cc and rtx and let them ride the trains;
Bug 1625803 - Enable transport-cc extension for nightly and early beta;
Bug 1606823 - Add support for WebRTC transport-cc extension.
Bug 1651722 - Enable transport-cc and rtx and let them ride the trains;
Bug 1641600 - Re-enable rtx and add *.google.com to blocklist;
Bug 1638758 - Turn off just-added media.peerconnection.video.use_rtx in nightly.
Bug 1632489 - Enable rtx for early beta or earlier;
acked out 4 changesets (bug 1632489) for android crashes at test_peerConnection_maxFsConstraint.html. CLOSED TREE
Bug 1164187 - Add pref for rtx;
Bug 1651722 - Enable transport-cc and rtx and let them ride the trains;
Bug 1641600 - Re-enable rtx and add *.google.com to blocklist;
Bug 1653663 - Add experimental Picture-in-Picture toggle variations.
Bug 1653663 - Add experimental Picture-in-Picture toggle variations.
Bug 1653663 - Add experimental Picture-in-Picture toggle variations.
Bug 1637727 - convert network.standard-url.punycode-host to a StaticPref.
Bug 1653201 - Remove internal nsStandardURL punycode pref
Bug 1652627 - Setup a pref for tab modal print UI
Bug 1650162 - Turn security.allow_disjointed_external_uri_loads back on to fix regressions opening external applications.
Bug 1606797 - do not allow navigating to external URIs in cross-origin disjoint browsing contexts,
Bug 1656253 - disable security.bad_cert_domain_error.url_fix_enabled in late beta and release.
Bug 1617987 - Fix URLs by prefixing www. when users encounter bad cert domain errors.
Bug 1641356 - Unhide RSA-AES-GCM ciphersuite preferences
Bug 1641356 - Unhide RSA-AES-GCM ciphersuite preferences
Bug 436200 - Add a pref to turn off warning submitting secure to insecure.
Bug 1647825 - Part 1: Add the UI for enable reporting XFO and CSP:frame-ancestors error.
Bug 1647825 - Part 1: Add the UI for enable reporting XFO and CSP:frame-ancestors error.
Bug 1593467 - Automatically restore from logins-backup.json when logins.json is missing or corrupt.
Bug 1597358 - Create a backup of logins.json to use when logins.json is missing or corrupt.
Bug 1654405 - pref doorhanger v2 off outside Nightly;r=MattN
Bug 1641412 - Pass all possible UNs/PWs to doorhanger;r=MattN,sfoster
Bug 1654604 - Hold CSV Import to Nightly for Fx80.
Bug 1650201 - Fix mozStorage prefs read before profile and fallback to a non-exclusive VFS when it can't get an exclusive lock.
Bug 1649894 - Add webgl.debug.incomplete-tex-color.
Bug 1607940 - Stand up webgl.out-of-process:true path.
Bug 1607940 - Stand up webgl.out-of-process:true path.
earthlng
on 19 Aug 2020
dom.security.https_only_mode_ever_enabled_pbm
# WARNING: Don't ever update that pref manually! It is only used
# for telemetry purposes and allows to reason about retention of
# the pref dom.security.https_only_mode_pbm from above.
moved to ignore
prefers-contrast = false -> safe to ignore IMO
unexpected_system_load_telemetry_enabled - should be covered by disabling telemetry but there's an unfixed regression causing a crash, so maybe we should disable this
browser.preferences.* - no need to add/change these IMO. Just waiting until it rides the train is fine
earthlng
on 23 Aug 2020
browser.tabs.documentchannel.parent-controlled - not ready yet and documentchannel stuff goes pretty deep so it's best not to mess with this. see https://bugzilla.mozilla.org/show_bug.cgi?id=1647557#c0:
This is the main thing needed for bug 1647550, but isn't fully correct until we can also use it for all load types (including history loads).
We need all loads to be controlled from the parent at the same time so that all requests are processed in the same place and in the right order.
moving to ignore
earthlng
on 23 Aug 2020
So we added browser.region.update.enabled in https://github.com/ghacksuserjs/ghacks-user.js/commit/6905187b3e14b1aea336ffcbfdf4e42126593527 ... the source was 1627555 which is FF79.. and if you look at D79272 the code is
#ifdef EARLY_BETA_OR_EARLIER
pref("browser.region.update.enabled", true);
#endif
So, what exactly does that mean (I know it means beta, dev, nightly the value is true)? I'm asking if that means the pref can be still be used in stable 79? I know it was being used in beta/dev/nightly 79 .. (I'm not asking if it was functional, just asking if it can be overwritten by user.js)
So is the commit correct and it was new in 79, or is it new in 80?
soz for the rambling .. I've been at it hard AF for two days
Thorin-Oakenpants
on 23 Aug 2020
browser.preferences.exposeHTTPSOnly .. that explains https://github.com/ghacksuserjs/ghacks-user.js/commit/58fb1db8380d641f43fa90308c36cd15fea0bb31
I was waiting for beta 81 to land to see if it was still there .. I had bookmarked this when I did that commit, to remind me .. I should have looked at the changes
We don't need to add browser.preferences.exposeHTTPSOnly - we have the 1244 pref(s), and they'll flip it when ready. And then it becomes dead wood, and we would remove it. So F that :)
1244 suggestions
- change the setting tag to [Nightly] or remove it and wait for FF to show it by default?
- add
dom.security.https_only_mode_pbmpref
- is this where if true it overrides
dom.security.https_only_mode? - in other words, what is the relationship between the two prefs?
- is this where if true it overrides
Thorin-Oakenpants
on 23 Aug 2020
prefers-contrast= false -> safe to ignore IMO
Yes, this is the one I mentioned last diffs. It's just a master switch. We don't want it to be different to default ever ... because it will alter your fingerprint
- e.g. when its default true and someone sets it to false, then they will return something whatever the web page code says such as "not supported" and everyone else will return "no-preference", "forced", "high" or "low"
When FF flip it on, RFP will take care of it. AFAIK there isn't any prefs to set the value for RFP Alts like we can for reduced-motion or color-scheme
Thorin-Oakenpants
on 23 Aug 2020
browser.region.update.enabled - https://github.com/ghacksuserjs/ghacks-user.js/issues/978#issuecomment-665589158
re: 1244 suggestions - the SETTING line already has (FF81+). Assuming they'll flip exposeHTTPSOnly in FF81, I think that's fine.
Yes we can add https_only_mode_pbm. The one we already have, https_only_mode, enables HOM for both normal and private windows, whereas the new one enables it for private windows only.
If https_only_mode is true, https_only_mode_pbm is ignored
earthlng
on 24 Aug 2020
browser.region.update.enabled is set to true for FF80 as per this commit. Relevant bug.
geeknik
on 24 Aug 2020
security.xfocsp.errorReporting.* - https://bugzilla.mozilla.org/show_bug.cgi?id=1647825#c9:
The reporting is disabled by default. When users hit an XFO or a CSP error page, there is a checkbox UI to allow user opt-in the reporting. Once users check the checkbox, we will start to report. So, we will report every time users hit an XFO or CSP error page. And users can opt-out the reporting by unchecking the checkbox. After that, we will no longer report the error.
screenshot of the error page with the checkbox: https://bug1647825.bmoattachments.org/attachment.cgi?id=9162074
"The reporting is disabled by default" = security.xfocsp.errorReporting.automatic=false
Checking the checkbox flips the .automatic pref to true.
Setting security.xfocsp.errorReporting.enabled to false hides the checkbox.
Uses normal telemetry ping (which we disable) and "The client_id and environment are not sent with this ping."
So in our case the checkbox does nothing and we could include these 2 prefs to (1) make sure the reporting is disabled and (2) the checkbox is not visible. Or just move them to ignore
earthlng
on 25 Aug 2020
security.allow_disjointed_external_uri_loads - caused some regressions initially but they apparently think it's ready now after landing some fixes in FF80.
# Whether window A is allowed to navigate cross-origin window B (that is not
# a descendant frame of A) to a URI that loads externally.
"allow...=false" is what we want. move to ignore IMO
earthlng
on 25 Aug 2020
Assuming they'll flip
exposeHTTPSOnlyin FF81, I think that's fine.
I doubt it will land in FF81 .. it's not even going to be dev/beta 81 (99% sure, but I'll wait for dev/beta 81 to land to comfirm) - there are too many blockers IMO.
My thinking now is we just remove it and wait for the pref to get flipped (or removed) in stable and that's out reminder to add the [setting] tag
Thorin-Oakenpants
on 25 Aug 2020
security.xfocsp.errorReporting.*... So in our case the checkbox does nothing and we could include these 2 prefs to (1) make sure the reporting is disabled and (2) the checkbox is not visible. Or just move them to ignore
I'm 51/49 in favor of ignoring ... I typed out the discussion in my head and got nowhere: tl;dr you and I are fine, and we will always pick up if the automatic pref is flipped, and the less stuff in the user.js the better. That said, defence in depth is good, especially since URIs would be recorded and that data would be kept (I think: I'm not sure what happens when the pings fails - are you talking about browser.ping-centre.telemetry in 0506?)
The choice is yours @earthlng
Thorin-Oakenpants
on 25 Aug 2020
I'm 51/49 in favor of ignoring
I agree. It's opt-in and the worst that could happen is someone willingly opting-in to help Mozilla identify and block malicious sites and ending up not sending anything because we have all telemetry disabled.
Even if it would send a ping somehow, "the client_id and environment are not sent with this ping." and thus the only potentially linkable/identifiable "id" would be the IP and IDK if they record/store that. But even if they do record and/or store that - it's opt-in!
earthlng
on 25 Aug 2020
https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/80 unexciting (which is actually a feature)
LOL
what's left
- A; new: pref("dom.block_download_insecure", false);
- B: new: pref("dom.security.unexpected_system_load_telemetry_enabled", true);
- C: changed: pref("signon.backup.enabled", true); // prev: false
- D: changed: pref("signon.capture.inputChanges.enabled", false); // prev: true
C: ignore IMO: a local backed up passwords file is (probably) no more dangerous than having the original. I haven't read anything about it, so I don't know if it keeps multiple copies or how often or if it's triggered when you add/remove passwords. But it can't hurt for end users, except that if you removed the account details for secretplace.com, there could still be a record of it. We're getting a bit edge case here.
D: NFI : feel free to look up if it's harmless
A: this has some regressions. I wouldn't expect any of our users to get HTTP downloads on secure pages. We could either wait for it to get flipped, or add it now (because who knows if it will take 14 releases to get flipped like noopener)
B:E said : should be covered by disabling telemetry but there's an unfixed regression causing a crash, so maybe we should disable this
- IMO ignore it: if crashes were that bad, Moz would do a point release
tl;dr: B,C,D = ignore; A = ignore and make a note (new issue as reminder) to revisit in 3 or 4 releases
@earthlng and co, wot say you
Thorin-Oakenpants
on 28 Aug 2020
^^ Thanks. Sorry for my laziness .. I know the relevant bugzillas are listed by earthlng: and I see most bugs because every day or so I check out all landed bugs as I look for possible version feature detection items (edit: I don't read them all as I'm looking for feature detection: so I can ignore things like wasm, svg, etc which are things that can be disabled by a pref: but I do look at interesting things that might impact us)
D: Ahhh, yeah, we can ignore that
Thorin-Oakenpants
on 28 Aug 2020
I wouldn't expect any of our users to get HTTP downloads on secure pages.
HTTP downloads are still common if mirrors are used because of big downloads.
This pref is on about:config but not in dxr. :rofl: LOL.
rusty-snake
on 28 Aug 2020
Here's a bit of a dig around
Depends on
- 1654780 drag and drop bypasses
Regressions
- open 1654139 silent failure to DL
- fixed 82: 1656296 = add indicator for blocked downloads
- open 1660969 ship panel/button to manually confirm/override block
- open 1660952 probable duplicate or may be windows only
Lots of others marked as duplicates
- pdfs not loading (if not viewed internally)
- other DLs nothing happens or insecure warnings
One of the comments in one of those tickets says telemetry indicates about 10% of downloads initiated from secure sites are insecure. So I guess they just need to get user notification and manual overrides working, and the we can flip it on
Thorin-Oakenpants
on 28 Aug 2020
Related issues
Thorin-Oakenpants
·
7Comments
crssi
·
4Comments
Thorin-Oakenpants
·
4Comments
crssi
·
3Comments
Just-me-ghacks
·
6Comments