User.js: RFP and document fonts

[Synkky]

This might be an incredibly dumb question...

Currently, user.js is preventing the browser from using any document provided fonts.
Now that RFP covers font visibility, can document fonts still be considered a "high entropy fingerprinting vector" when RFP is active or are document fonts and font visibility completely unrelated?

[KOLANICH]

Related. When one supplies document fonts files, he eliminates variability in the files, this way he can probe the variation in environments (libs, drivers, OSes, rendering engines, browser settings) separately.

[smokemyshoes]

I'm also interested in this topic. If one could share some knowledge on what is the best settings/approach to fonts now with the new font-features in RFP, it would be most appreciated. TIA

[KOLANICH]

IDK what is better for now: use the most mitigated browser or not to use the Web at all. Remember - fingerprinting will never be properly mitigated, because it requires consensus of all stakeholders, but the largest stakeholder has conflict of interests.

[Thorin-Oakenpants]

It's a little messy, RFP doesn't kick in with font visibility limitations until FF80, so how do we handle ESR users (I need to think about it more).... that said ESR users technically should be using the 78 release and not come back for another year: but that doesn't stop them updating with current and flipping the ESR section: because we provide that feature

... BUT .. I wanted to move document fonts into the RFP alts section (so it's off by default since that section is commented out) and said as much to earthlng (I think it was in a PR), but at the time we didn't and of course RFP protecting fonts only just landed in 80

so it's just a matter of working out how to do it so it works for both FF80+ and ESR78

---

As I've always said, if you mess with RFP then you lose "immunity" - read this: of course document fonts should be inactive if you're using RFP - live by the sword, die by the sword

.. as much as it seems that you're giving away some free data on fonts - you're not: you can't hide your OS and the lists are quite limiting. There will be some entropy within each OS, but that's far better than being one of a very few RFP users with one or three fonts detected (depending on the script)

... and remember that this is a last line of defense, a failsafe: blocking scripts is the first step and you do that by controlling what gets into your browser. Enumerating fonts is also slow'ish: I don't think too many scripts bother to dig too deeply: so once you weed out the non-OS fonts for your OS including the obligatory software ones like Adobe and MS office and libre office etc, they're maybe checking 15 or 20 30 fonts maximum that concern you, not the entire possible list of fonts for your OS - so the entropy within that 15-20 30 or so fonts will be less than reality.

[Thorin-Oakenpants]

so here's what I get on Windows 7 with RFP (no messing with font whitelisting or document fonts)

Arial, Arial Black, Arial Narrow, Calibri, Cambria, Cambria Math, Courier, Courier New, Georgia, Helvetica, Impact, Lucida Console, Lucida Sans Unicode, Microsoft Sans Serif, MS Gothic, MS PGothic, MS Sans Serif, MS Serif, Palatino Linotype, Segoe Print, Segoe Script, Segoe UI, Segoe UI Light, Segoe UI Semibold, Segoe UI Symbol, Tahoma, Times, Times New Roman, Trebuchet MS, Verdana, Wingdings

here's my updated result after I reinstalled 45 missing fonts (from my almost identical Win 7 VM) (I deleted loads of fonts many years ago)

Arial, Arial Black, Arial Narrow, Calibri, Cambria, Cambria Math, Comic Sans MS, Consolas, Courier, Courier New, Georgia, Helvetica, Impact, Lucida Console, Lucida Sans Unicode, Microsoft Sans Serif, MS Gothic, MS PGothic, MS Sans Serif, MS Serif, Palatino Linotype, Segoe Print, Segoe Script, Segoe UI, Segoe UI Light, Segoe UI Semibold, Segoe UI Symbol, Tahoma, Times, Times New Roman, Trebuchet MS, Verdana, Wingdings

That's pretty stable IMO (there is one false positive: but everyone will be the same on that). I know that not all windows users report Arial Narrow (or it might be the other one, Arial Black) and maybe some changes in Segoe: I think it has something to with GDI.

Mac should also be pretty solid. And android doesn't have a list. My only concern would be Linux. i.e concern over entropy within your limited font list. That the Linux list is (was?) only based on two distros makes it more stable IMO.

Also, the other benefit over blocking document fonts, is that some glyphs and shit might unbreak (never seen any breakage to be honest), and website will now look more like they were meant to (TBH, I've loved the last 5 years of all sites using the same font)

[Synkky]

Alright, I got what I wanted, I shouldn't use document fonts even if RFP is active
I also don't dislike using the same font in all sites
The only thing that kind of sucks at times is when a website uses the material icons font or font awesome or something similar, it looks terrible in that case, since words pop out instead of icons

[Thorin-Oakenpants]

There is no way to reconcile ESR users with the current user.js (i.e updated all the time and they flip the ESR section) with moving one or both to the RFP alts.

Thinking about it, the RFP Alts already contains the alt (font vis) and the answer is to simply comment out doc fonts (just like the whitelist is)

[Thorin-Oakenpants]

I also don't dislike using the same font in all sites

Wow, the web looks and feels a little lot different with docs fonts enabled (edit: for regular sites of mine). It'll just take a week to get used to it

[atomGit]

... so how do we handle ESR users ...

There is no way to reconcile ESR users with the current user.js ...

how many people are using this user.js and an ESR? - in that number may the solution you're seeking (personally i wouldn't bother supporting an ESR unless there's a lot of users)

regarding document fonts, on what level are we allowing/disallowing? one can force fonts in settings, but this doesn't prevent downloading

browser.display.use_document_fonts does nothing to prevent FP AFAIK because even if '0' they are still downloaded

the problem here, as i see it, is on the Mozilla end - if one sets this to 0 then the fonts shouldn't be downloaded AND FP should be mitigated by ... supplying a generic list or whatever

[crssi]

Next ESR isn't yet on a Firefox Release Calendar.

What if you make separate user.js for ESR78 (delete when ESR79) and go on with the actual one?... ESR78 is just a brick on the road which will not change anymore.

[earthlng]

@Thorin-Oakenpants

so here's what I get on Windows 7 with RFP

Are you sure you tested that correctly?
I count 31 fonts in the list you posted but I get 65 detected in my FF81.
Like, how can you have Arial Narrow in your list if that's not even in the allowlist, for example?
And why don't you have Candara, Comic Sans MS, Consolas, Constantia, Corbel and about 30 more fonts not detected?

That's pretty stable IMO

seems pretty unstable to me

[Thorin-Oakenpants]

no to maintaining multiple js files

FYI: ESR is every 13 releases (4 weekly releases, 13 releases = 1yr) - but it's not guaranteed, some years it might be 12 weeks (e.g. delays). So the next one is FF91, then FF104 all things going to plan ... click me

font docs and font whitelist are not RFP alts .. font vis is (for FF80+ users), so that's the way it has to be: they cannot and will not go in alts because they are no longer valid alternatives.

personally i wouldn't bother supporting an ESR ...

number of users using ESR but updating and flipping the ESR section: unknown, but it wouldn't be none: e.g. new users on ESR come in and grab the lastest, and some users with a bit of knowledge like to get up to date with changes. The only clean way to handle that is for them to add an override if they want to limit fonts

while the user.js says the version number in name and in the user.js at the top, that doesn;t stop people from using current versions for ESR - and we have an ESR section they can flip - so it's not like we can turn a blind eye and ignore it

eh

downloadable fonts has ZERO to do with FPing DEVICE fonts (system, installed)... .a Mac user and a Windows user walk into a bar and order a google font... now what? what does that prove? (edit: don't ask about the Linux user)

[Thorin-Oakenpants]

seems pretty unstable to me

I'm on Windows 7, not Windows 10. As for Arial Narrow/Bold variations - they also happen in TB - it's a OS/GDI thing - the whitelist and font vis lists are "families", not specific fonts

edit: also on "Candara, Comic Sans MS, Consolas, Constantia, Corbel" <-- are those in the Panopticlick test, which is what I quoted

[crssi]

no to maintaining multiple js files

Sure... that I meant, the ESR78 file should not be maintained anymore. 😉

[Thorin-Oakenpants]

correct .. it's called v78 and is a release users can download

[earthlng]

oh you used the Panopticlick test, that explains it. I tested on TZP.

they also happen in TB - it's a OS/GDI thing

does TB already use all the latest font-vis/whitelist patches? either way that OS/GDI difference thing definitely sucks.

[Thorin-Oakenpants]

that explains it

Only partially. Panopticlick yeah, cuz I was illustrating that scripts don't do massive font lists (or targeted OS ones like TZP), so depends on the fonts they check

BUT ... edit: for the record: I don't have Candara, Comic Sans MS, Consolas, Constantia, Corbel which are part of kBaseFonts - but I should? link - I know about 4 or 5 years ago I cleaned out a lot of fonts .. ooophs .. so my example propabaly isn't atypical

edit2: I can pull em from a windows 7 VM I have, and compare beforehand to see what I'm missing

---

TB whitelist overrides font vis (and RFP choosing font vis 1 when enabled). TB is 78 and doesn't include font vis patches, but if/when they move to 4 weekly cycles, they're covered

[earthlng]

how many fonts does TZP detect on your system? ie without a whitelist, doc-fonts allowed and just RFP's font-vis limitation

[Thorin-Oakenpants]

FF - 60 56 fonts

56 (but it should be more if I had the correct system fonts) . not sure where I got 60 from, sorry

Arial, Arial Black, Arial Narrow, Calibri, Cambria, Cambria Math, Courier, Courier New, Ebrima, Georgia, Helvetica, Impact, Lucida Console, Lucida Sans Unicode, Malgun Gothic, Marlett, Microsoft Himalaya, Microsoft JhengHei, Microsoft New Tai Lue, Microsoft PhagsPa, Microsoft Sans Serif, Microsoft Tai Le, Microsoft YaHei, Microsoft Yi Baiti, MingLiU_HKSCS-ExtB, MingLiU-ExtB, Mongolian Baiti, MS Gothic, MS PGothic, MS Sans Serif, MS Serif, MS UI Gothic, MV Boli, NSimSun, Palatino Linotype, PMingLiU-ExtB, Roman, Segoe Print, Segoe Script, Segoe UI, Segoe UI Light, Segoe UI Semibold, Segoe UI Symbol, SimSun, SimSun-ExtB, Small Fonts, Sylfaen, Symbol, Tahoma, Times, Times New Roman, Trebuchet MS, Twemoji Mozilla, Verdana, Webdings, Wingdings

no false positives (except webdings: which might have been me removing some fonts years ago, any maybe it's embedded in the system somewhere? IDK) and no positive negatives

edit: without font vis (or any other font fuckery) - it's 106 (TZP's list is only checking windows fonts)

Tor Browser 10 (esr78 based) - 67 fonts

Arial, Arial Black, Arial Narrow, Batang, Cambria Math, Courier, Courier New, Euphemia, Gautami, Georgia, Gulim, GulimChe, Helvetica, Iskoola Pota, Kalinga, Kartika, Latha, Lucida Console, Malgun Gothic, Mangal, Meiryo, Meiryo UI, Microsoft Himalaya, Microsoft JhengHei, Microsoft YaHei, MingLiU, MS Gothic, MS Mincho, MS PGothic, MS PMincho, ＭＳ Ｐゴシック, ＭＳ Ｐ明朝, MS Sans Serif, MS Serif, ＭＳ ゴシック, ＭＳ 明朝, MV Boli, Noto Sans Buginese, Noto Sans Khmer, Noto Sans Lao, Noto Sans Myanmar, Noto Sans Yi, Nyala, Plantagenet Cherokee, PMingLiU, Raavi, Roman, Segoe UI, Segoe UI Light, Segoe UI Semibold, Shruti, SimSun, Small Fonts, Sylfaen, Tahoma, Times, Times New Roman, Tunga, Verdana, Vrinda, 굴림, 굴림체, 바탕, 宋体, 微软雅黑, 新細明體, 細明體

[earthlng]

If you go to the control panel > fonts and double click on Arial, how many fonts does it have in it? Mine has 5 - no "Narrow".

So I guess not even all Win7's will look the same, huh? That fucking sucks. I imagine it'll be a nightmare in Linux if the font-vis limitation isn't even a hard limitation and instead allows all font families within fonts. Like, some distros will have fe Arial with 5 variations, other will have 6 etc. What a shitshow!

[Thorin-Oakenpants]

yeah, so if you look at fonts (e.g. C:\Windows\Fonts) ... in my case I have a Arial and Arial Unicode MS Regular - Arial will have a multiple "sheets" icon indicating it's a family containing styles - my Arial contains three styles: Regular, Black, Narrow

also note the ToDo on line 7 or thereabouts in the font vis list for windows10

[Thorin-Oakenpants]

@earthlng are you win 7 or win 10? because it's probably only going to be FPing equivalency: that is all win10 hopefully are the same, and all win7 are the same. That's wishful, because of installed system fonts for other languages. They were never going to be able to make everyone on windows the same. Even apple couldn't do it for mac users.

The best you can hope for is that all the bulk of en-US users on your windows version match you

[Thorin-Oakenpants]

ahh, now I know where I got 60 from. FF83 (practically nilla) returns 56, but FF81 and FF82 (nilla profiles and my own FF) returns 60. I'll have to come back to it - I think but have to check, it was the binary search missing fonts due to the order of some fonts in the list, but I thought that patch was in 81 already [edit: yeah that landed in 80]

https://bugzilla.mozilla.org/show_bug.cgi?id=1661532 is FF82 but FF only bundles one font and it shouldn't affect anyone - who would install Twemoji as a system font?

Maybe there is some other font vis change in 82 or 83

update: right so looks like they dropped the alt non-western names in FF83 (or it may be a nightly flag thing), or it may be a bug?

@earthlng see if you can find a matching bugzilla

[earthlng]

Yikes. I don't have the Unicode one and my Arial has 5 styles. Win7 too.

[earthlng]

IMO it was less bad with doc fonts disabled. How many fonts does it detect in your Win7 VM with RFP + doc fonts disabled?
I get 2 for the 1st and 43 for the fallback

[Thorin-Oakenpants]

did u install the OS as en-US (I did, but then everyone gets Arial on install so probably fishing there: but installing as CJK would make a diff with overall fonts)? I suspect different releases of the OS vary - such as language installs and versions (Pro, Ultimate, Home, etc) - mine is from a Enterprise Ultimate SP1. Also I don't fully understand this GDI backend thing (I know you're testing without sandboxie, so didn't mean that)

Arial MS Unicode doesn't matter since it's not a family and it's not n kBaseFonts

[earthlng]

looks like they dropped the alt non-western names in FF83

could be related to the EARLY_BETA_OR_EARLIER flag on font.name-list.sans-serif.zh-TW, IDK. source

[Thorin-Oakenpants]

2 or 4 (same ones: two in western one two in non-ascii chars), and I had a whitelist set same as TB with Twemoji added, and from memory it was 25 for fallback (and I was blocking the downloadable font) - I'll see if I can remember to retest for you - remind me if I forget and it's important to you. Right now I need a big break, maybe a sleep

it might seem worse, but if you don't follow RFP you'll stick out like a masked Trump rally

[Thorin-Oakenpants]

could be related

nightly: 56 fonts
82 dev: 60
82 beta: 60
81: 60

I might poke jfkthame: but only after searching and checking the current list wasn't modified

Here's the original list - D66125 and that doesn't have those non-western names (and neither does current central)

Where do you look up currently nightly on DXR? I need a break :)

might be this: 1665196 - I had a poke at all 83 bugzilla and this is the only thing that sticks out (I sorted by comp and looked at layout: text & fonts, and I sorted by assignee and looked at jfk)

[earthlng]

the list wasn't modified for a while: https://hg.mozilla.org/mozilla-central/log/tip/gfx/thebes/StandardFonts-win10.inc

nightly has lots of cutting edge things already enabled but most of those aren't gonna land in stable anytime soon. Not much use in testing these kind of things with nightly IMO

[Thorin-Oakenpants]

true. I knew the answer to your question was 60, so it threw me when the paste was 56 items - I just wanted to know why it changed. The easiest thing to do is to just see what 83 beta/dev do .. I have a ToDo list somwhere

edit: oh, and AFAIK what was dropped is the non-Western name of what is already listed

[Thorin-Oakenpants]

How many fonts does it detect in your Win7 VM with RFP + doc fonts disabled? I get 2 for the 1st and 43 for the fallback

OK, my earlier answer was my bare metal. The win7 VM is a 32bit nightmare (for testing 32bit architecture) which came from the same Enterprise All-in-one Win7 SP1 which must be 15+ yrs old (my current machine is 11 years and kicking ass). The VM is a bare bones "win 7 ultimate" install with no other MS installs like Office etc, - that may affect fonts. It also fails on lots of windows updates (lols for installing a 15 year old iso: can to manually install patches to get TB v9 working) but that shouldn't affect fonts, but may - who knows.

If you want, I can do that test for you, just let me know: otherwise I'll save the time

[Thorin-Oakenpants]

win7 VM - FF81

no font fuckery: 148 fonts (including shit I should have like Candara etc)

Andalus,  Angsana New, AngsanaUPC, Aparajita, Arabic Typesetting, Arial, Arial  Black, Batang, BatangChe, Browallia New, BrowalliaUPC, Calibri, Calibri  Light, Calibri Light Italic, Cambria, Cambria Math, Candara, Comic Sans  MS, Consolas, Constantia, Corbel, Cordia New, CordiaUPC, Courier,  Courier New, DaunPenh, David, DFKai-SB, DilleniaUPC, DokChampa, Dotum,  DotumChe, Ebrima, Estrangelo Edessa, EucrosiaUPC, Euphemia, FangSong,  Franklin Gothic Medium, FrankRuehl, FreesiaUPC, Gabriola, Gautami,  Georgia, Gisha, Gulim, GulimChe, Gungsuh, GungsuhChe, Helvetica, Impact,  IrisUPC, Iskoola Pota, JasmineUPC, KaiTi, Kalinga, Kartika, Khmer UI,  KodchiangUPC, Kokila, Lao UI, Latha, Leelawadee, Levenim MT, LilyUPC,  Lucida Console, Lucida Sans Unicode, Malgun Gothic, Mangal, Marlett,  Meiryo, Meiryo UI, Microsoft Himalaya, Microsoft JhengHei, Microsoft New  Tai Lue, Microsoft PhagsPa, Microsoft Sans Serif, Microsoft Tai Le,  Microsoft Uighur, Microsoft YaHei, Microsoft Yi Baiti, MingLiU,  MingLiU_HKSCS, MingLiU_HKSCS-ExtB, MingLiU-ExtB, Miriam, Miriam Fixed,  Mongolian Baiti, MoolBoran, MS Gothic, MS Mincho, MS PGothic, MS  PMincho, ＭＳ Ｐゴシック, ＭＳ Ｐ明朝, MS Sans Serif, MS Serif, MS UI Gothic, ＭＳ  ゴシック, ＭＳ 明朝, MV Boli, Narkisim, NSimSun, Nyala, Palatino Linotype,  Plantagenet Cherokee, PMingLiU, PMingLiU-ExtB, Raavi, Rod, Roman, Sakkal  Majalla, Segoe Print, Segoe Script, Segoe UI, Segoe UI Light, Segoe UI  Semibold, Segoe UI Symbol, Shonar Bangla, Shruti, SimHei, Simplified  Arabic, Simplified Arabic Fixed, SimSun, SimSun-ExtB, Small Fonts,  Sylfaen, Symbol, Tahoma, Times, Times New Roman, Traditional Arabic,  Trebuchet MS, Tunga, Twemoji Mozilla, Utsaah, Vani, Verdana, Vijaya,  Vrinda, Webdings, Wingdings, 굴림, 굴림체, 바탕, 宋体, 微软雅黑, 新細明體, 細明體

RFP only: 67 fonts

Arial,  Arial Black, Calibri, Calibri Light, Calibri Light Italic, Cambria,  Cambria Math, Candara, Comic Sans MS, Consolas, Constantia, Corbel,  Courier, Courier New, Ebrima, Gabriola, Georgia, Helvetica, Impact,  Lucida Console, Lucida Sans Unicode, Malgun Gothic, Marlett, Microsoft  Himalaya, Microsoft JhengHei, Microsoft New Tai Lue, Microsoft PhagsPa,  Microsoft Sans Serif, Microsoft Tai Le, Microsoft YaHei, Microsoft Yi  Baiti, MingLiU_HKSCS-ExtB, MingLiU-ExtB, Mongolian Baiti, MS Gothic, MS  PGothic, ＭＳ Ｐゴシック, MS Sans Serif, MS Serif, MS UI Gothic, ＭＳ ゴシック, MV  Boli, NSimSun, Palatino Linotype, PMingLiU-ExtB, Roman, Segoe Print,  Segoe Script, Segoe UI, Segoe UI Light, Segoe UI Semibold, Segoe UI  Symbol, SimSun, SimSun-ExtB, Small Fonts, Sylfaen, Symbol, Tahoma,  Times, Times New Roman, Trebuchet MS, Twemoji Mozilla, Verdana,  Webdings, Wingdings, 宋体, 微软雅黑

RFP + font docs disabled : 2 fonts see pic

the font fallback

Calibri,  Calibri Light, Calibri Light Italic, Cambria, Cambria Math, Candara,  Consolas, Constantia, Corbel, Ebrima, Gabriola, Lucida Sans Unicode,  Malgun Gothic, Microsoft Himalaya, Microsoft JhengHei, Microsoft New Tai  Lue, Microsoft PhagsPa, Microsoft Sans Serif, Microsoft Tai Le,  Microsoft YaHei, Microsoft Yi Baiti, MingLiU_HKSCS-ExtB, MingLiU-ExtB,  Mongolian Baiti, MS Gothic, MS PGothic, ＭＳ Ｐゴシック, MS Sans Serif, MS UI  Gothic, ＭＳ ゴシック, MV Boli, NSimSun, PMingLiU-ExtB, Segoe UI, Segoe UI  Light, Segoe UI Semibold, Segoe UI Symbol, SimSun, SimSun-ExtB, Sylfaen,  Tahoma, Twemoji Mozilla, Verdana, 宋体, 微软雅黑

[Thorin-Oakenpants]

wow! me = my bare metal, vm = well, a vm: both are enterprise win7 ultimate from the same iso

• arial: me 3 styles, vm 5 styles
• calibri: me 4 styles, vm 6 styles

Ahh, I found something out. So I copied my vm fonts to a a folder in my real os. Instead of a single family, it creates multiple files, e.g. calibrili (light italic), calibril (light), etc. If you install one that you haven't got, it adds* it to the family in windows/fonts

So that explains how a system can start with less but end up with more styles: e.g. MS Office may add some more styles, etc

[Thorin-Oakenpants]

hah .. now I have 9 styles

Arial Regular
Arial Black
Arial Bold
Arial Bold Italic
Arial Italic
Arial Narrow
Arial Narrow Bold
Arial Narrow Bold Italic
Arial Narrow Italic

and they are all listed in the TZP font test .. but only Arial (i.e Regular), Arial Black and Arial Narrow are detected. I don't think the other matter, see VM results - but over my head .. GDI stuff, VM limitations?

OK, so I copied all the win7 vm fonts to my windows fonts folder and skipped any that existed. Now I'm more atypical. There are still some diffs (using Beta 82):

• no fuck fuckery : 150 (not quite the same as 148 in the VM) - note: this was 106 before I updated my fonts
  
  
  
  • the diff is Arial Narrow, Arial Unicode MS (I did a compare)
  
  
• RFP only: 68 fonts (67 in VM)
  
  
  
  • the diff is Arial Narrow (I did a compare)
  
  
• RFP + font docs: 2 fonts (and fallback is 45) = hashes are identical to the pic two posts up
  ^^ does earthlng match my 2 + 45 ?

@earthlng .. how's that? Now, I srsly need a break...

So sticking to kBaseFonts (so ignore the arial unicode one: maybe I got that from installing SQL server or something: it's not listed on the Windows 7 font list), it seems as if something can influence whether or not some styles in families apply: Arial Narrow for sure. I think this is where GDI comes in

I have seen other variations between TB users (same Windows version) that weren't Arial Narrow (not sure if Arial Black was one) but that may have simply been a missing font, not a style: it's in a tor trac ticket if I look it up

[earthlng]

thanks!

re: win7 VM - FF81

RFP only: 67 fonts

I have 65 with RFP only. With RFP + doc-fonts disabled I get 2 for the 1st test and 43 for the fallback.

the 2 missing ones are both times Calibri Light and Calibri Light Italic. My Calibri font has 4 styles

looks like they dropped the alt non-western names in FF83 ... see if you can find a matching bugzilla

looks like 1648474 (FF82+)

[Thorin-Oakenpants]

maybe, but my 82's still produce them. I know about the shared.list pref, so I think that that's the key - nightly has it flipped (i think?)

[Thorin-Oakenpants]

I have 68 with RFP only (same as before which was that 60 count, but now I have my missing should-have-been-there Consolas, Corbel etc) - so I'm guessing the diff between u and me is the two Calibri and Arial Narrow = a style thing

[earthlng]

Where do you look up currently nightly on DXR?

IDK if DXR still gets updated. Fe it still doesn't have the ESR78 repo. I'd recommend to switch to https://searchfox.org/

By default it's searching nightly (= mozilla-central).
If you scroll down to Repositories indexed, you can switch to fe mozilla-release, mozilla-beta, mozilla-esr78

[Thorin-Oakenpants]

I'd recommend to switch to https://searchfox.org/

will do. didn't realize it DXR was a bit behind

[Thorin-Oakenpants]

thanks @syncng for bringing this up :kiss: - totally slipped my checks/reminders and we should have done it last release TBH

[Synkky]

No problem. Honestly, this conversation was a lot more of a clusterfuck than I thought it would be -_-'

[atomGit]

is there any way to force browser fonts and avoid fingerprinting (RFP enabled, Linux)?

it seems like there is not from what i understand, however there's NO WAY i want to allow websites to set their own goofy fonts

[Thorin-Oakenpants]

downloadable fonts is different: you can block those just like any other web content: and of course, that can break things such as material fonts and ligatures and icon fonts etc. These have nothing to do with FPing (except that you blocked them, big F deal, no ones gives a shit about tracking that, and it's not stable between sites)

What you're talking about is when the web page says what font it would like you to use: Comic Sans anyone? Nothing you can do about that except block document fonts (which would wreck your FP when compared to other RFP users), or use stylish stylus or something - which might be OK for a couple of regular sites you use, but I wouldn't do that to all of them, plus it sounds like way too much work

there's NO WAY i want to allow websites to set their own goofy fonts

Having had doc fonts blocked for about five years, holy shit did the web look a little weird after I re-enabled that. Not just the font, but the sizes. A site I use went from about 25 line items visible in my permanent sized inner window, to about 15.

But the thing is, after a couple of weeks, it all seems normal. You'll get over it. Just be thankful Comic Sans isn't on the allowlist 😀

[atomGit]

yes, i should have clarified - i am referring to doc fonts

... or use stylish or something - which might be OK for a couple of regular sites you use, but I wouldn't do that to all of them...

i think that's exactly what i'm gonna do :smile: something like this...

h1, h2, h3, h4, h5, h6 {
    font-family: sans-serif !important;
}
a, p, aside {
    font-family: sans-serif !important;
    font-size: 1em;
}
code, kbd, tt, var, samp, pre {
    font-family: monospace !important;
    font-size: 1em;
}

this is global, but i can always add exceptions where needed

off topic, but i believe Stylish sold out to the dark side - Stylus is the one to use

Having had doc fonts blocked for about five years, holy shit did the web look a little weird after I re-enabled that. Not just the font, but the sizes. [...] But the thing is, after a couple of weeks, it all seems normal.

i get you, but how easy it is to adapt i think is dependent on eyesight and display size, as well as personal preference of course - in my case NO! and that's the reason i disabled the pref in the first place - i'll never buy a laptop again... ever - i'm already having to set layout.css.devPixelsPerPx to 1.35 and jack up default font sizes just to be able to read anything and even at that the text size isn't much bigger than for a novel

so i'm testing the css method (defaulted the pref) and hoping it will work acceptably well in most cases

[Thorin-Oakenpants]

stylus, yup, sorry, my bad. I even have stylus installed and enabled for two websites only. I edited my post

FWIW: I think changing styles globally is a bad idea - but up to you. The FP risk is probably zero (but I have a PoC that will fuck you up: it's been in the making and on my wish list for over a year - and it will become part of TZP down the track)

Eyesight. Same. Getting older (but wiser). On a 1440x2560 dual screens 27 inches with scaling at 100% and decPixelsPerPx at default. My face is exactly an arms length away. But I know that on a few sites, I move closer my head slightly closer

• https://eu.aoc.com/en/monitors/q27p1