diff options
Diffstat (limited to 'opt/firefox')
| -rw-r--r-- | opt/firefox/.footprint | 53 | ||||
| -rw-r--r-- | opt/firefox/.signature | 10 | ||||
| -rw-r--r-- | opt/firefox/MAKEPKG | 168 | ||||
| -rw-r--r-- | opt/firefox/firefox.desktop | 13 | ||||
| -rw-r--r-- | opt/firefox/policies.json | 82 | ||||
| -rw-r--r-- | opt/firefox/rawnix.js | 204 |
6 files changed, 530 insertions, 0 deletions
diff --git a/opt/firefox/.footprint b/opt/firefox/.footprint new file mode 100644 index 0000000..ef124be --- /dev/null +++ b/opt/firefox/.footprint @@ -0,0 +1,53 @@ +drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/bin/ +lrwxrwxrwx root/root usr/bin/firefox -> /usr/lib/firefox/firefox +drwxr-xr-x root/root usr/lib/ +drwxr-xr-x root/root usr/lib/firefox/ +-rw-r--r-- root/root usr/lib/firefox/application.ini +-rw-r--r-- root/root usr/lib/firefox/dependentlibs.list +-rwxr-xr-x root/root usr/lib/firefox/firefox +-rwxr-xr-x root/root usr/lib/firefox/glxtest +-rwxr-xr-x root/root usr/lib/firefox/libgkcodecs.so +-rwxr-xr-x root/root usr/lib/firefox/liblgpllibs.so +-rwxr-xr-x root/root usr/lib/firefox/libmozavcodec.so +-rwxr-xr-x root/root usr/lib/firefox/libmozavutil.so +-rwxr-xr-x root/root usr/lib/firefox/libmozgtk.so +-rwxr-xr-x root/root usr/lib/firefox/libmozinference.so +-rwxr-xr-x root/root usr/lib/firefox/libmozsandbox.so +-rwxr-xr-x root/root usr/lib/firefox/libmozsqlite3.so +-rwxr-xr-x root/root usr/lib/firefox/libmozwayland.so +-rwxr-xr-x root/root usr/lib/firefox/libxul.so +-rw-r--r-- root/root usr/lib/firefox/omni.ja +-rwxr-xr-x root/root usr/lib/firefox/pingsender +-rw-r--r-- root/root usr/lib/firefox/platform.ini +-rwxr-xr-x root/root usr/lib/firefox/vaapitest +-rwxr-xr-x root/root usr/lib/firefox/vulkantest +drwxr-xr-x root/root usr/lib/firefox/browser/ +-rw-r--r-- root/root usr/lib/firefox/browser/omni.ja +drwxr-xr-x root/root usr/lib/firefox/browser/chrome/ +drwxr-xr-x root/root usr/lib/firefox/browser/chrome/icons/ +drwxr-xr-x root/root usr/lib/firefox/browser/chrome/icons/default/ +-rw-r--r-- root/root usr/lib/firefox/browser/chrome/icons/default/default128.png +-rw-r--r-- root/root usr/lib/firefox/browser/chrome/icons/default/default16.png +-rw-r--r-- root/root usr/lib/firefox/browser/chrome/icons/default/default32.png +-rw-r--r-- root/root usr/lib/firefox/browser/chrome/icons/default/default48.png +-rw-r--r-- root/root usr/lib/firefox/browser/chrome/icons/default/default64.png +drwxr-xr-x root/root usr/lib/firefox/browser/defaults/ +drwxr-xr-x root/root usr/lib/firefox/browser/defaults/preferences/ +-rw-r--r-- root/root usr/lib/firefox/browser/defaults/preferences/rawnix.js +drwxr-xr-x root/root usr/lib/firefox/defaults/ +drwxr-xr-x root/root usr/lib/firefox/defaults/pref/ +-rw-r--r-- root/root usr/lib/firefox/defaults/pref/channel-prefs.js +drwxr-xr-x root/root usr/lib/firefox/distribution/ +-rw-r--r-- root/root usr/lib/firefox/distribution/policies.json +drwxr-xr-x root/root usr/lib/firefox/fonts/ +-rw-r--r-- root/root usr/lib/firefox/fonts/TwemojiMozilla.ttf +drwxr-xr-x root/root usr/lib/firefox/gmp-clearkey/ +drwxr-xr-x root/root usr/lib/firefox/gmp-clearkey/0.1/ +-rwxr-xr-x root/root usr/lib/firefox/gmp-clearkey/0.1/libclearkey.so +-rw-r--r-- root/root usr/lib/firefox/gmp-clearkey/0.1/manifest.json +drwxr-xr-x root/root usr/share/ +drwxr-xr-x root/root usr/share/applications/ +-rw-r--r-- root/root usr/share/applications/firefox.desktop +drwxr-xr-x root/root usr/share/pixmaps/ +lrwxrwxrwx root/root usr/share/pixmaps/firefox.png -> /usr/lib/firefox/browser/chrome/icons/default/default128.png diff --git a/opt/firefox/.signature b/opt/firefox/.signature new file mode 100644 index 0000000..10a9411 --- /dev/null +++ b/opt/firefox/.signature @@ -0,0 +1,10 @@ +RWTZ9IduCSQ/mN6Tfhj/xy71dTqmfKwXxgFMQH215Kay7ZpMFCeciLbY22FQOFgZrtTHjErhXqZpD5ufPdm2lOcC1pSiNfzOyg8= + +SHA256 (MAKEPKG) = 39409973e20b92ade3aa56208feb98d3d6039692261f54329d1fa725f856aa50 +SHA256 (.footprint) = 204089c314eb232529280c47ff6a6491ff0be69723854d0a0287742c9db9ddd7 +SHA256 (firefox-153.3.0esr.source.tar.xz) = 69f1335e78d2a340fc13fcf265c0a72bdce2df8774c9d4d49ee77d1726236df5 +SHA256 (firefox-153esr-patches-03.tar.xz) = 39efa65af2e5eecac09745b8d2b469a6137365a786d118100d2eb1dc28288e49 +SHA256 (firefox.desktop) = a092fddc62bf5bff0c0f7891f59278463fa9b6ec24e9d811e49cd10b2282bdee +SHA256 (rawnix.js) = bab0f8bba99a0f6b2a129a0767168e6af7462ccdfdf7f610690fefb8f25f06b8 +SHA256 (policies.json) = 14dafc23074acb8d0cb8b3f9657c80b6d172da1f5711ef1a547301d458cd9004 +SHA256 (firefox#153.3.0esr-1.pkg.tar.gz) = 77a2b3f9847d986b2ef505551b9d52a629a8b148252a04681312f875181ef963 diff --git a/opt/firefox/MAKEPKG b/opt/firefox/MAKEPKG new file mode 100644 index 0000000..5f39ce4 --- /dev/null +++ b/opt/firefox/MAKEPKG @@ -0,0 +1,168 @@ +#!/bin/mkpkg +# description: Mozilla Firefox browser +# url: https://www.mozilla.org/firefox/ + +name=firefox +version=153.3.0esr +_version=153.3.0 +_patch=153esr-patches-03 +release=1 +depends=(gtk3 nss nspr libvpx libwebp pixman libffi alsa-lib ffmpeg dbus) +makedeps=(rust cbindgen nodejs python3 nasm) +source=( + https://ftp.mozilla.org/pub/$name/releases/$version/source/$name-$version.source.tar.xz + https://dev.gentoo.org/~juippis/mozilla/patchsets/firefox-$_patch.tar.xz + firefox.desktop + rawnix.js + policies.json +) + +sha256sums=( + "69f1335e78d2a340fc13fcf265c0a72bdce2df8774c9d4d49ee77d1726236df5" + "39efa65af2e5eecac09745b8d2b469a6137365a786d118100d2eb1dc28288e49" + "a092fddc62bf5bff0c0f7891f59278463fa9b6ec24e9d811e49cd10b2282bdee" + "bab0f8bba99a0f6b2a129a0767168e6af7462ccdfdf7f610690fefb8f25f06b8" + "14dafc23074acb8d0cb8b3f9657c80b6d172da1f5711ef1a547301d458cd9004" +) + +patch() { + cd $name-$_version + + # https://dev.gentoo.org/~juippis + for p in "$SRC"/firefox-patches/*.patch; do + [ -f "$p" ] && patch -p1 -i "$p" + done + + # musl: allow select() syscall in all sandbox policies + awk '/CASES_FOR_poll:/{print; print "#ifdef __NR_select"; print " case __NR_select:"; print "#endif"; next}1' \ + security/sandbox/linux/SandboxFilter.cpp > SandboxFilter.tmp + mv SandboxFilter.tmp security/sandbox/linux/SandboxFilter.cpp + + # bindgen: don't panic on unresolved field types when computing union layout (libclang 23) + sed -i 's/ctx\.resolve_type(inner)\.layout(ctx)/ctx.resolve_item_fallible(inner)?.kind().as_type()?.layout(ctx)/' \ + third_party/rust/bindgen/ir/ty.rs + sed -i 's/ctx\.resolve_type(data\.ty)\.layout(ctx)/ctx.resolve_item_fallible(data.ty)?.kind().as_type()?.layout(ctx)/' \ + third_party/rust/bindgen/ir/comp.rs + sed -i 's/"files":{[^}]*}/"files":{}/' third_party/rust/bindgen/.cargo-checksum.json + +} + +build() { + cd $name-$_version + + export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=none + export MOZBUILD_STATE_PATH="$PWD"/mozbuild + export MOZ_NOSPAM=1 + export SHELL=/bin/bash + + # Toolchain + export CC=clang CXX=clang++ + export AR=llvm-ar NM=llvm-nm RANLIB=llvm-ranlib + export AS=clang + + # Flags + export CFLAGS="$CFLAGS -w" + export CXXFLAGS="$CXXFLAGS -w" + export LDFLAGS="$LDFLAGS -Wl,-rpath=/usr/lib/firefox,--enable-new-dtags" + export MOZ_DEBUG_FLAGS=-g0 + export CXXSTDLIB=c++ + export LIBCLANG_PATH=/usr/lib + export MOZ_MAKE_FLAGS="-j$(nproc)" + + # Rustc wrapper: force -crt-static so build scripts can dlopen libclang + mkdir -p "$PWD"/rustc-wrap + printf '#!/bin/sh\nexec /usr/bin/rustc -Ctarget-feature=-crt-static -Cdebuginfo=0 "$@"\n' \ + > "$PWD"/rustc-wrap/rustc + chmod +x "$PWD"/rustc-wrap/rustc + export PATH="$PWD/rustc-wrap:$PATH" + + cat > .mozconfig << EOF +mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/firefox-shared +unset MOZ_TELEMETRY_REPORTING + +ac_add_options --prefix=/usr +ac_add_options --libdir=/usr/lib +ac_add_options --host=x86_64-unknown-linux-musl +ac_add_options --target=x86_64-unknown-linux-musl + +ac_add_options --enable-release +ac_add_options --enable-optimize +ac_add_options --enable-strip +ac_add_options --enable-install-strip +ac_add_options --enable-official-branding +ac_add_options --enable-application=browser +ac_add_options --enable-audio-backends=alsa +ac_add_options --enable-dbus +ac_add_options --enable-rust-simd +ac_add_options --enable-default-toolkit=cairo-gtk3-wayland-only + +# System libraries +ac_add_options --with-system-ffi +ac_add_options --with-system-jpeg +ac_add_options --with-system-libvpx +ac_add_options --with-system-nspr +ac_add_options --with-system-nss +ac_add_options --with-system-pixman +ac_add_options --without-system-png +ac_add_options --with-system-webp +ac_add_options --with-system-zlib +ac_add_options --without-wasm-sandboxed-libraries + +# No Mozilla/Google service keys +ac_add_options --without-mozilla-api-keyfile +ac_add_options --without-google-location-service-api-keyfile +ac_add_options --without-google-safebrowsing-api-keyfile + +# Disable unused features +ac_add_options --disable-jemalloc +ac_add_options --disable-elf-hack +ac_add_options --disable-tests +ac_add_options --disable-updater +ac_add_options --disable-crashreporter +ac_add_options --disable-debug +ac_add_options --disable-debug-symbols +ac_add_options --disable-profiling +ac_add_options --disable-necko-wifi +ac_add_options --disable-webspeech +ac_add_options --disable-accessibility +ac_add_options --disable-parental-controls +ac_add_options --disable-default-browser-agent +ac_add_options --disable-backgroundtasks +ac_add_options --disable-system-extension-dirs +ac_add_options --disable-vtune +ac_add_options --disable-callgrind +ac_add_options --disable-eme +ac_add_options --without-onnx-runtime +EOF + + ./mach configure + ./mach build + + DESTDIR="$PKG" ./mach install + + # Desktop integration + install -Dm644 "$SRC"/firefox.desktop "$PKG"/usr/share/applications/firefox.desktop + mkdir -p "$PKG"/usr/share/pixmaps + ln -sf /usr/lib/firefox/browser/chrome/icons/default/default128.png \ + "$PKG"/usr/share/pixmaps/firefox.png + + # System-wide privacy prefs (default prefs, user-overridable) + install -Dm644 "$SRC"/rawnix.js \ + "$PKG"/usr/lib/firefox/browser/defaults/preferences/rawnix.js + + # Enterprise policies (hard kills + locked prefs) + install -Dm644 "$SRC"/policies.json \ + "$PKG"/usr/lib/firefox/distribution/policies.json + + # Cleanup + rm -f "$PKG"/usr/lib/firefox/firefox-bin + rm -rf "$PKG"/usr/lib/firefox/browser/features + rm -f "$PKG"/usr/lib/firefox/removed-files +} + +signify() { + untrusted comment: public key + RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3 +} + +# vim: filetype=sh diff --git a/opt/firefox/firefox.desktop b/opt/firefox/firefox.desktop new file mode 100644 index 0000000..beb7504 --- /dev/null +++ b/opt/firefox/firefox.desktop @@ -0,0 +1,13 @@ +[Desktop Entry] +Name=Firefox +Name[en_US]=Firefox +GenericName=Web Browser +GenericName[en_US]=Web Browser +Comment=Free web browser from Mozilla +Exec=firefox %u +Terminal=false +Type=Application +Icon=firefox +Categories=GNOME;GTK;Network;WebBrowser; +MimeType=text/xml;text/mml;text/html;application/xhtml+xml;application/vnd.mozilla.xul+xml;x-scheme-handler/http;x-scheme-handler/https +StartupNotify=true diff --git a/opt/firefox/policies.json b/opt/firefox/policies.json new file mode 100644 index 0000000..76fe495 --- /dev/null +++ b/opt/firefox/policies.json @@ -0,0 +1,82 @@ +{ + "policies": { + "DisableTelemetry": true, + "DisableFirefoxStudies": true, + "DisableFirefoxAccounts": true, + "DisableAccounts": true, + "DisablePocket": true, + "DisableFeedbackCommands": true, + "DisableProfileImport": true, + "DisableSetDesktopBackground": true, + "DisableAppUpdate": true, + "DisableSystemAddonUpdate": true, + "DisableDefaultBrowserAgent": true, + "DisableMasterPasswordCreation": false, + "DontCheckDefaultBrowser": true, + "OfferToSaveLogins": false, + "PasswordManagerEnabled": false, + "NetworkPrediction": false, + "CaptivePortal": false, + "SearchSuggestEnabled": false, + "SkipTermsOfUse": true, + "UserMessaging": { + "WhatsNew": false, + "ExtensionRecommendations": false, + "FeatureRecommendations": false, + "UrlbarInterventions": false, + "SkipOnboarding": true, + "MoreFromMozilla": false, + "Locked": true + }, + "FirefoxHome": { + "Search": true, + "TopSites": true, + "SponsoredTopSites": false, + "Highlights": false, + "Pocket": false, + "SponsoredPocket": false, + "Snippets": false, + "Locked": true + }, + "FirefoxSuggest": { + "WebSuggestions": false, + "SponsoredSuggestions": false, + "ImproveSuggest": false, + "Locked": true + }, + "EnableTrackingProtection": { + "Value": true, + "Cryptomining": true, + "Fingerprinting": true, + "EmailTracking": true, + "Locked": true + }, + "DNSOverHTTPS": { + "Enabled": false, + "Locked": true + }, + "EncryptedMediaExtensions": { + "Enabled": false, + "Locked": true + }, + "PopupBlocking": { + "Default": true + }, + "Permissions": { + "Location": { "BlockNewRequests": true, "Locked": false }, + "Notifications": { "BlockNewRequests": true, "Locked": false } + }, + "Preferences": { + "browser.ml.enable": { "Value": false, "Status": "locked" }, + "browser.ml.chat.enabled": { "Value": false, "Status": "locked" }, + "browser.ml.linkPreview.enabled": { "Value": false, "Status": "locked" }, + "browser.ml.pageAssist.enabled": { "Value": false, "Status": "locked" }, + "extensions.ml.enabled": { "Value": false, "Status": "locked" }, + "browser.tabs.groups.smart.enabled": { "Value": false, "Status": "locked" }, + "browser.tabs.groups.smart.userEnabled": { "Value": false, "Status": "locked" }, + "pdfjs.enableAltTextModelDownload": { "Value": false, "Status": "locked" }, + "datareporting.policy.dataSubmissionEnabled": { "Value": false, "Status": "locked" }, + "network.connectivity-service.enabled": { "Value": false, "Status": "locked" } + } + } +} diff --git a/opt/firefox/rawnix.js b/opt/firefox/rawnix.js new file mode 100644 index 0000000..4cfd633 --- /dev/null +++ b/opt/firefox/rawnix.js @@ -0,0 +1,204 @@ +// rawnix firefox defaults +// installed to /usr/lib/firefox/browser/defaults/preferences/rawnix.js +// NOTE: default-pref files use pref(), NOT user_pref(). user_pref() is only +// valid in a profile's prefs.js / user.js and is a parse error here. + +// --------------------------------------------------------------------------- +// Telemetry / data reporting +// --------------------------------------------------------------------------- +pref("datareporting.policy.dataSubmissionEnabled", false); +pref("datareporting.healthreport.uploadEnabled", false); +pref("datareporting.usage.uploadEnabled", false); +pref("toolkit.telemetry.enabled", false); +pref("toolkit.telemetry.unified", false); +pref("toolkit.telemetry.archive.enabled", false); +pref("toolkit.telemetry.server", "data:,"); +pref("toolkit.telemetry.server_owner", ""); +pref("toolkit.telemetry.newProfilePing.enabled", false); +pref("toolkit.telemetry.shutdownPingSender.enabled", false); +pref("toolkit.telemetry.updatePing.enabled", false); +pref("toolkit.telemetry.bhrPing.enabled", false); +pref("toolkit.telemetry.firstShutdownPing.enabled", false); +pref("toolkit.telemetry.coverage.opt-out", true); +pref("toolkit.coverage.opt-out", true); +pref("toolkit.coverage.endpoint.base", ""); +pref("browser.ping-centre.telemetry", false); +pref("browser.newtabpage.activity-stream.telemetry", false); +pref("browser.newtabpage.activity-stream.feeds.telemetry", false); +pref("browser.tabs.crashReporting.sendReport", false); +pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); + +// --------------------------------------------------------------------------- +// Experiments, studies, remote-config, in-product messaging +// --------------------------------------------------------------------------- +pref("app.normandy.enabled", false); +pref("app.normandy.api_url", ""); +pref("app.shield.optoutstudies.enabled", false); +pref("messaging-system.rsexperimentloader.enabled", false); +pref("browser.discovery.enabled", false); +pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); +pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false); +pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"enabled\":false}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "{\"enabled\":false}"); +pref("browser.preferences.moreFromMozilla", false); +pref("browser.aboutwelcome.enabled", false); +pref("browser.shell.checkDefaultBrowser", false); +pref("browser.startup.homepage_override.mstone", "ignore"); + +// --------------------------------------------------------------------------- +// AI / machine learning +// browser.ml.enable is the master gate for the ONNX inference runtime. +// Verify names against about:config (filter: browser.ml) after a version bump. +// --------------------------------------------------------------------------- +pref("browser.ml.enable", false); +pref("browser.ml.chat.enabled", false); +pref("browser.ml.chat.menu", false); +pref("browser.ml.chat.shortcuts", false); +pref("browser.ml.chat.shortcuts.custom", false); +pref("browser.ml.chat.sidebar", false); +pref("browser.ml.chat.page", false); +pref("browser.ml.chat.provider", ""); +pref("browser.ml.chat.hideLocalhost", true); +pref("browser.ml.linkPreview.enabled", false); +pref("browser.ml.linkPreview.optin", false); +pref("browser.ml.pageAssist.enabled", false); +pref("extensions.ml.enabled", false); +pref("browser.tabs.groups.smart.enabled", false); +pref("browser.tabs.groups.smart.userEnabled", false); +pref("pdfjs.enableAltText", false); +pref("pdfjs.enableAltTextModelDownload", false); +pref("pdfjs.enableUpdatedAddImage", false); +// local translation: no server round-trip, but downloads models on demand +pref("browser.translations.enable", false); +pref("browser.translations.automaticallyPopup", false); + +// --------------------------------------------------------------------------- +// Accounts, Sync, Pocket +// --------------------------------------------------------------------------- +pref("identity.fxaccounts.enabled", false); +pref("identity.fxaccounts.toolbar.enabled", false); +pref("identity.fxaccounts.toolbar.syncSetup.panelAccessed", true); +pref("extensions.pocket.enabled", false); +pref("extensions.getAddons.showPane", false); +pref("extensions.htmlaboutaddons.recommendations.enabled", false); +pref("extensions.systemAddon.update.enabled", false); +pref("extensions.systemAddon.update.url", ""); + +// --------------------------------------------------------------------------- +// Address bar / search suggestions / Firefox Suggest (Merino) +// --------------------------------------------------------------------------- +pref("browser.search.suggest.enabled", false); +pref("browser.urlbar.suggest.searches", false); +pref("browser.urlbar.quicksuggest.enabled", false); +pref("browser.urlbar.quicksuggest.dataCollection.enabled", false); +pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); +pref("browser.urlbar.suggest.quicksuggest.sponsored", false); +pref("browser.urlbar.merino.endpointURL", ""); +pref("browser.urlbar.trending.featureGate", false); +pref("browser.urlbar.suggest.trending", false); +pref("browser.urlbar.weather.featureGate", false); +pref("browser.urlbar.addons.featureGate", false); +pref("browser.urlbar.mdn.featureGate", false); +pref("browser.urlbar.yelp.featureGate", false); +pref("browser.urlbar.clipboard.featureGate", false); +pref("browser.urlbar.speculativeConnect.enabled", false); +pref("browser.places.speculativeConnect.enabled", false); + +// --------------------------------------------------------------------------- +// New tab page +// --------------------------------------------------------------------------- +pref("browser.newtabpage.activity-stream.feeds.section.topstories", false); +pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false); +pref("browser.newtabpage.activity-stream.showSponsored", false); +pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false); +pref("browser.newtabpage.activity-stream.default.sites", ""); +pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", false); + +// --------------------------------------------------------------------------- +// Background network chatter +// --------------------------------------------------------------------------- +pref("network.captive-portal-service.enabled", false); +pref("captivedetect.canonicalURL", ""); +pref("network.connectivity-service.enabled", false); +pref("network.prefetch-next", false); +pref("network.dns.disablePrefetch", true); +pref("network.dns.disablePrefetchFromHTTPS", true); +pref("network.predictor.enabled", false); +pref("network.predictor.enable-prefetch", false); +pref("network.http.speculative-parallel-limit", 0); +pref("browser.region.network.url", ""); +pref("browser.region.update.enabled", false); +pref("geo.provider.network.url", ""); +pref("geo.provider.use_geoclue", false); +pref("beacon.enabled", false); + +// DNS: 5 = TRR fully disabled, use the system resolver. +// Set to 3 with network.trr.uri if you want strict DoH instead. +pref("network.trr.mode", 5); + +// --------------------------------------------------------------------------- +// Safe Browsing +// TRADEOFF: this removes phishing/malware warnings. A source build has no +// Google API key anyway, so remote lookups already fail; these prefs stop the +// periodic list downloads from Google's servers. +// --------------------------------------------------------------------------- +pref("browser.safebrowsing.malware.enabled", false); +pref("browser.safebrowsing.phishing.enabled", false); +pref("browser.safebrowsing.downloads.enabled", false); +pref("browser.safebrowsing.downloads.remote.enabled", false); +pref("browser.safebrowsing.downloads.remote.url", ""); +pref("browser.safebrowsing.provider.google4.updateURL", ""); +pref("browser.safebrowsing.provider.google4.gethashURL", ""); +pref("browser.safebrowsing.provider.google4.dataSharingURL", ""); +pref("browser.safebrowsing.provider.google.updateURL", ""); +pref("browser.safebrowsing.provider.google.gethashURL", ""); + +// --------------------------------------------------------------------------- +// Tracking protection / state partitioning +// --------------------------------------------------------------------------- +pref("browser.contentblocking.category", "strict"); +pref("privacy.trackingprotection.enabled", true); +pref("privacy.trackingprotection.pbmode.enabled", true); +pref("privacy.trackingprotection.socialtracking.enabled", true); +pref("privacy.trackingprotection.cryptomining.enabled", true); +pref("privacy.trackingprotection.fingerprinting.enabled", true); +pref("privacy.trackingprotection.emailtracking.enabled", true); +pref("network.cookie.cookieBehavior", 5); +pref("privacy.partition.network_state", true); +pref("privacy.partition.serviceWorkers", true); +pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); +pref("privacy.query_stripping.enabled", true); +pref("privacy.query_stripping.enabled.pbmode", true); +pref("privacy.globalprivacycontrol.enabled", true); +pref("privacy.globalprivacycontrol.functionality.enabled", true); +pref("privacy.fingerprintingProtection", true); +pref("privacy.fingerprintingProtection.pbmode", true); + +// privacy.resistFingerprinting is stronger but visibly breaks things: +// forces UTC, spoofs locale/screen size, letterboxes windows, blocks canvas. +// Leave it to the user rather than defaulting it on. +// pref("privacy.resistFingerprinting", true); + +// --------------------------------------------------------------------------- +// WebRTC local IP leak +// --------------------------------------------------------------------------- +pref("media.peerconnection.ice.default_address_only", true); + +// --------------------------------------------------------------------------- +// Misc +// --------------------------------------------------------------------------- +pref("browser.formfill.enable", false); +pref("signon.management.page.breach-alerts.enabled", false); +pref("signon.rememberSignons", false); +pref("browser.send_pings", false); +pref("dom.battery.enabled", false); +pref("media.gmp-gmpopenh264.enabled", false); +pref("media.gmp-widevinecdm.enabled", false); +pref("media.gmp-manager.url", "data:text/plain,"); + +// --------------------------------------------------------------------------- +// Misc +// --------------------------------------------------------------------------- +pref("browser.backup.enabled", false); +pref("browser.backup.scheduled.enabled", false); +pref("services.settings.server", "data:,#remote-settings-dumps-only"); |