Repository: arkenfox/user.js
Branch: master
Commit: 0f14e030b3a9
Files: 15
Total size: 131.7 KB
Directory structure:
gitextract_yp2a848f/
├── .gitattributes
├── .github/
│ └── ISSUE_TEMPLATE/
│ ├── tools.md
│ ├── troubleshooting-help.md
│ └── user-js.md
├── .travis.yml
├── LICENSE.txt
├── README.md
├── _config.yml
├── prefsCleaner.bat
├── prefsCleaner.sh
├── scratchpad-scripts/
│ ├── arkenfox-cleanup.js
│ └── troubleshooter.js
├── updater.bat
├── updater.sh
└── user.js
================================================
FILE CONTENTS
================================================
================================================
FILE: .gitattributes
================================================
* text=auto
*.js text
*.md text
*.yml text
*.txt text
*.sh text
## *.bat text eol=crlf
*.bat -text
*.png binary
.gitattributes export-ignore
*.yml export-ignore
/wikipiki export-ignore
/.github export-ignore
================================================
FILE: .github/ISSUE_TEMPLATE/tools.md
================================================
---
name: Tools
about: Report issues with the updaters, the troubleshooter, or any other tools.
title: ''
labels: ''
assignees: ''
---
<!--
Please specify:
- the name of the file (i.e. updater.bat, updater.sh)
- steps to reproduce the issue
- actual result
- expected result
Blank out this field before typing, or start typing after the next line.
-->
================================================
FILE: .github/ISSUE_TEMPLATE/troubleshooting-help.md
================================================
---
name: Troubleshooting help
about: Ask for help to solve problems with user.js
title: 'follow instructions or this will be closed as invalid'
labels: ''
assignees: ''
---
<!--
Issues will be closed as invalid if you do not troubleshoot first, or if you ignore the required info in the template.
We do not support forks or no-longer supported releases.
-->
🟥 https://github.com/arkenfox/user.js/wiki/5.2-Troubleshooting
- [ ] I have read the troubleshooting guide, done the checks and confirmed this is caused by arkenfox
- _unchecked issues ~~may~~ will be closed as invalid_
🟪 REQUIRED INFO
- Browser version & OS:
- Steps to Reproduce (STR):
- Expected result:
- Actual result:
- Console errors and warnings:
- Anything else you deem worth mentioning:
---
================================================
FILE: .github/ISSUE_TEMPLATE/user-js.md
================================================
---
name: user.js
about: Suggest changes to user.js
title: ''
labels: ''
assignees: ''
---
We value feedback in general, but we value feedback from informed users more. There is no need for you to be an expert to participate (most of us aren't), but we hope that you at least understand our decisions before questioning them. We discuss all changes openly, and we do not make changes lightly. So, if you don't understand why we decided to add/remove/change a certain pref, search the repo. The answer is most certainly here.
If some change we made took you by surprise (in the wrong way), remember that keeping track of changes is your responsibility. Watch the repo, read the [changelogs](https://github.com/arkenfox/user.js/issues?utf8=✓&q=is%3Aissue+label%3Achangelog), compare [releases](https://github.com/arkenfox/user.js/releases) as you update your copy of user.js, or use any other method you prefer.
Clear all of this when you're ready to type.
================================================
FILE: .travis.yml
================================================
language: node_js
node_js:
- "node"
before_script:
- npm install -g acorn
script:
- acorn user.js
================================================
FILE: LICENSE.txt
================================================
MIT License
Copyright (c) 2020 arkenfox
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
================================================
FILE: README.md
================================================
### 🟪 user.js
A `user.js` is a configuration file that can control Firefox settings - for a more technical breakdown and explanation, you can read more in the [wiki](https://github.com/arkenfox/user.js/wiki/2.1-User.js)
### 🟩 the arkenfox user.js
[](https://opensource.org/licenses/MIT)
The `arkenfox user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).
Everyone, experts included, should at least read the [wiki](https://github.com/arkenfox/user.js/wiki), as it contains important information regarding a few `user.js` settings. There is also an [interactive current release](https://arkenfox.github.io/gui/), thanks to [icpantsparti2](https://github.com/icpantsparti2).
Note that we do *not* recommend connecting over Tor on Firefox. Use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en) if your [threat model](https://2019.www.torproject.org/about/torusers.html) calls for it, or for accessing hidden services.
Also be aware that the `arkenfox user.js` is made specifically for desktop Firefox. Using it as-is in other Gecko-based browsers can be counterproductive, especially in the Tor Browser.
### 🟧 sitemap
- [releases](https://github.com/arkenfox/user.js/releases)
- [changelogs](https://github.com/arkenfox/user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog)
- [wiki](https://github.com/arkenfox/user.js/wiki)
- [stickies](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22)
- [diffs](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Adiffs)
- [common questions and answers](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Aanswered)
### 🟥 acknowledgments
Literally thousands of sources, references and suggestions. Many thanks, and much appreciated.
================================================
FILE: _config.yml
================================================
theme: jekyll-theme-midnight
title: user.js
description: An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting
================================================
FILE: prefsCleaner.bat
================================================
@ECHO OFF & SETLOCAL DisableDelayedExpansion
TITLE prefs.js cleaner
REM ### prefs.js cleaner for Windows
REM ## author: @claustromaniac
REM ## version: 2.8
CD /D "%~dp0"
IF /I "%~1"=="-unattended" (SET _ua=1)
:begin
ECHO:
ECHO:
ECHO ########################################
ECHO #### prefs.js cleaner for Windows ####
ECHO #### by claustromaniac ####
ECHO #### v2.8 ####
ECHO ########################################
ECHO:
CALL :message "This script should be run from your Firefox profile directory."
ECHO It will remove any entries from prefs.js that also exist in user.js.
CALL :message "This will allow inactive preferences to be reset to their default values."
ECHO This Firefox profile shouldn't be in use during the process.
CALL :message ""
TIMEOUT 1 /nobreak >nul
IF NOT DEFINED _ua (
CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]"
CLS
IF ERRORLEVEL 3 (EXIT /B)
IF ERRORLEVEL 2 (GOTO :showhelp)
)
IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory." 30)
IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30)
CALL :strlenCheck
CALL :FFcheck
CALL :message "Backing up prefs.js..."
FOR /F "delims=" %%# IN ('powershell -command get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%#
COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js"
CALL :message "Cleaning prefs.js..."
CALL :cleanup
CALL :message "All done!"
TIMEOUT 5 >nul
ENDLOCAL
EXIT /B
REM ########## Abort Function ###########
:abort
CALL :message %1
TIMEOUT %~2 >nul
EXIT
REM ########## Message Function #########
:message
ECHO:
ECHO: %~1
ECHO:
GOTO :EOF
REM ### string length Check Function ####
:strlenCheck
SET /a cnt=0
setlocal ENABLEDELAYEDEXPANSION
FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO (
ECHO:%%H >nul
SET /a cnt += 1
IF /I "%%G" NEQ "!cnt!" (
ECHO:
CALL :message "ERROR: line !cnt! in prefs.js is too long."
(CALL :abort "Aborting ..." 30)
)
)
endlocal
GOTO :EOF
REM ####### Firefox Check Function ######
:FFcheck
TASKLIST /FI "IMAGENAME eq firefox.exe" 2>NUL | FIND /I /N "firefox.exe">NUL
IF NOT ERRORLEVEL 1 (
CLS
CALL :message "Firefox is still running."
ECHO If you're not currently using this profile you can continue, otherwise
CALL :message "close Firefox first!"
ECHO:
PAUSE
CLS
CALL :message "Resuming..."
TIMEOUT 5 /nobreak >nul
)
GOTO :EOF
REM ######### Cleanup Function ##########
:cleanup
FOR /F tokens^=2^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^[^\"']*user_pref[ ]*\([ ]*[\"'][^\"']*[\"'][ ]*," user.js') DO (
IF NOT ""=="%%G" (SET "[%%G]=1")
)
(
FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO (
IF ""=="%%H" (
ECHO:
) ELSE (
FOR /F tokens^=1^,2^ delims^=^"^' %%I IN ("%%H") DO (
IF NOT DEFINED [%%J] (ECHO:%%H)
)
)
)
)>tempcleanedprefs
MOVE /Y tempcleanedprefs prefs.js
GOTO :EOF
REM ############### Help ##################
:showhelp
MODE 80,34
CLS
CALL :message "This script creates a backup of your prefs.js file before doing anything."
ECHO It should be safe, but you can follow these steps if something goes wrong:
ECHO:
CALL :message " 1. Make sure Firefox is closed."
ECHO 2. Delete prefs.js in your profile folder.
CALL :message " 3. Delete Invalidprefs.js if you have one in the same folder."
ECHO 4. Rename or copy your latest backup to prefs.js.
CALL :message " 5. Run Firefox and see if you notice anything wrong with it."
ECHO 6. If you do notice something wrong, especially with your extensions,
CALL :message " and/or with the UI, go to about:support, and restart Firefox with"
ECHO add-ons disabled. Then, restart it again normally, and see if the
CALL :message " problems were solved."
ECHO:
CALL :message "If you are able to identify the cause of your issues, please bring it up"
ECHO on arkenfox user.js GitHub repository.
ECHO:
ECHO:
PAUSE
CLS
GOTO :begin
REM #####################################
================================================
FILE: prefsCleaner.sh
================================================
#!/usr/bin/env bash
## prefs.js cleaner for Linux/Mac
## author: @claustromaniac
## version: 2.1
## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh
## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_prefsCleaner() )
readonly CURRDIR=$(pwd)
## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed)
SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null)
## fallback for Macs without coreutils
[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]}
AUTOUPDATE=true
QUICKSTART=false
## download method priority: curl -> wget
DOWNLOAD_METHOD=''
if command -v curl >/dev/null; then
DOWNLOAD_METHOD='curl --max-redirs 3 -so'
elif command -v wget >/dev/null; then
DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O'
else
AUTOUPDATE=false
echo -e "No curl or wget detected.\nAutomatic self-update disabled!"
fi
fQuit() {
## change directory back to the original working directory
cd "${CURRDIR}"
[ "$1" -eq 0 ] && echo -e "\n$2" || echo -e "\n$2" >&2
exit $1
}
fUsage() {
echo -e "\nUsage: $0 [-ds]"
echo -e "
Optional Arguments:
-s Start immediately
-d Don't auto-update prefsCleaner.sh"
}
download_file() { # expects URL as argument ($1)
declare -r tf=$(mktemp)
$DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error
}
fFF_check() {
# there are many ways to see if firefox is running or not, some more reliable than others
# this isn't elegant and might not be future-proof but should at least be compatible with any environment
while [ -e lock ]; do
echo -e "\nThis Firefox profile seems to be in use. Close Firefox and try again.\n" >&2
read -r -p "Press any key to continue."
done
}
## returns the version number of a prefsCleaner.sh file
get_prefsCleaner_version() {
echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")"
}
## updates the prefsCleaner.sh file based on the latest public version
update_prefsCleaner() {
declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/prefsCleaner.sh')"
[ -z "$tmpfile" ] && echo -e "Error! Could not download prefsCleaner.sh" && return 1 # check if download failed
[[ $(get_prefsCleaner_version "$SCRIPT_FILE") == $(get_prefsCleaner_version "$tmpfile") ]] && return 0
mv "$tmpfile" "$SCRIPT_FILE"
chmod u+x "$SCRIPT_FILE"
"$SCRIPT_FILE" "$@" -d
exit 0
}
fClean() {
# the magic happens here
prefs="@@"
prefexp="user_pref[ ]*\([ ]*[\"']([^\"']+)[\"'][ ]*,"
while read -r line; do
if [[ "$line" =~ $prefexp && $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then
prefs="${prefs}${BASH_REMATCH[1]}@@"
fi
done <<< "$(grep -E "$prefexp" user.js)"
while IFS='' read -r line || [[ -n "$line" ]]; do
if [[ "$line" =~ ^$prefexp ]]; then
if [[ $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then
echo "$line"
fi
else
echo "$line"
fi
done < "$1" > prefs.js
}
fStart() {
if [ ! -e user.js ]; then
fQuit 1 "user.js not found in the current directory."
elif [ ! -e prefs.js ]; then
fQuit 1 "prefs.js not found in the current directory."
fi
fFF_check
mkdir -p prefsjs_backups
bakfile="prefsjs_backups/prefs.js.backup.$(date +"%Y-%m-%d_%H%M")"
mv prefs.js "${bakfile}" || fQuit 1 "Operation aborted.\nReason: Could not create backup file $bakfile"
echo -e "\nprefs.js backed up: $bakfile"
echo "Cleaning prefs.js..."
fClean "$bakfile"
fQuit 0 "All done!"
}
while getopts "sd" opt; do
case $opt in
s)
QUICKSTART=true
;;
d)
AUTOUPDATE=false
;;
esac
done
## change directory to the Firefox profile directory
cd "$(dirname "${SCRIPT_FILE}")"
# Check if running as root and if any files have the owner as root/wheel.
if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then
fQuit 1 "You shouldn't run this with elevated privileges (such as with doas/sudo)."
elif [ -n "$(find ./ -user 0)" ]; then
printf 'It looks like this script was previously run with elevated privileges,
you will need to change ownership of the following files to your user:\n'
find . -user 0
fQuit 1
fi
[ "$AUTOUPDATE" = true ] && update_prefsCleaner "$@"
echo -e "\n\n"
echo " ╔══════════════════════════╗"
echo " ║ prefs.js cleaner ║"
echo " ║ by claustromaniac ║"
echo " ║ v2.1 ║"
echo " ╚══════════════════════════╝"
echo -e "\nThis script should be run from your Firefox profile directory.\n"
echo "It will remove any entries from prefs.js that also exist in user.js."
echo "This will allow inactive preferences to be reset to their default values."
echo -e "\nThis Firefox profile shouldn't be in use during the process.\n"
[ "$QUICKSTART" = true ] && fStart
echo -e "\nIn order to proceed, select a command below by entering its corresponding number.\n"
select option in Start Help Exit; do
case $option in
Start)
fStart
;;
Help)
fUsage
echo -e "\nThis script creates a backup of your prefs.js file before doing anything."
echo -e "It should be safe, but you can follow these steps if something goes wrong:\n"
echo "1. Make sure Firefox is closed."
echo "2. Delete prefs.js in your profile folder."
echo "3. Delete Invalidprefs.js if you have one in the same folder."
echo "4. Rename or copy your latest backup to prefs.js."
echo "5. Run Firefox and see if you notice anything wrong with it."
echo "6. If you do notice something wrong, especially with your extensions, and/or with the UI, go to about:support, and restart Firefox with add-ons disabled. Then, restart it again normally, and see if the problems were solved."
echo -e "If you are able to identify the cause of your issues, please bring it up on the arkenfox user.js GitHub repository.\n"
;;
Exit)
fQuit 0
;;
esac
done
fQuit 0
================================================
FILE: scratchpad-scripts/arkenfox-cleanup.js
================================================
/***
This will reset the preferences that since FF91 have been
- removed from the arkenfox user.js
- deprecated by Mozilla but listed in the arkenfox user.js in the past
There is an archived version at https://github.com/arkenfox/user.js/issues/123
if you want the full list since jesus
Last updated: 14-August-2025
Instructions:
- [optional] close Firefox and backup your profile
- [optional] disable your network connection [1]
- start Firefox
- load about:config and press Ctrl+Shift+K to open the Web Console for about:config
- using about:config is important, so the script has the right permissions
- paste this script
- if you edited the list of prefs in the script, make sure the last pref does not have a trailing comma
- hit enter
- check the Info output to see which prefs were reset
- restart
- some prefs require a restart
- a restart will reapply your user.js
- [optional] re-enable your network connection
[1] Blocking Firefox from the internet ensures it cannot act on your reset preferences in the
period before you restart it, such as app and extension auto-updating, or downloading unwanted
components (GMP etc). It depends on what you're resetting and how long before you restart.
***/
(() => {
if ('undefined' === typeof(Services)) return alert('about:config needs to be the active tab!');
const aPREFS = [
/* DEPRECATED */
/* 129-140 */
'browser.shopping.experience2023.enabled', // 140
'browser.urlbar.pocket.featureGate', // 140
'media.ondevicechange.enabled', // 137
'webchannel.allowObject.urlWhitelist', // 132
/* 116-128 */
'browser.contentanalysis.default_allow', // 127
'browser.messaging-system.whatsNewPanel.enabled', // 126
'browser.ping-centre.telemetry', // 123
'dom.webnotifications.serviceworker.enabled', // 117
'javascript.use_us_english_locale', // 119
'layout.css.font-visibility.private', // 118
'layout.css.font-visibility.resistFingerprinting', // 116
'layout.css.font-visibility.standard', // 118
'layout.css.font-visibility.trackingprotection', // 118
'network.dns.skipTRR-when-parental-control-enabled', // 119
'permissions.delegation.enabled', // 118
'security.family_safety.mode', // 117
'widget.non-native-theme.enabled', // 127
/* 103-115 */
'browser.cache.offline.enable', // 115
'extensions.formautofill.heuristics.enabled', // 114
'network.cookie.lifetimePolicy', // 103 [technically removed in 104]
'privacy.clearsitedata.cache.enabled', // 114
'privacy.resistFingerprinting.testGranularityMask', // 114
'security.pki.sha1_enforcement_level', // 103
/* 92-102 */
'browser.urlbar.suggest.quicksuggest', // 95
'dom.securecontext.whitelist_onions', // 97
'dom.storage.next_gen', // 102
'network.http.spdy.enabled', // 100
'network.http.spdy.enabled.deps',
'network.http.spdy.enabled.http2',
'network.http.spdy.websockets',
'layout.css.font-visibility.level', // 94
'security.ask_for_password', // 102
'security.csp.enable', // 99
'security.password_lifetime', // 102
'security.ssl3.rsa_des_ede3_sha', // 93
/* REMOVED */
/* 129-140 */
'dom.securecontext.allowlist_onions',
'network.http.referer.hideOnionSource',
'privacy.clearOnShutdown.cache',
'privacy.clearOnShutdown.cookies',
'privacy.clearOnShutdown.downloads',
'privacy.clearOnShutdown.formdata',
'privacy.clearOnShutdown.history',
'privacy.clearOnShutdown.offlineApps',
'privacy.clearOnShutdown.sessions',
'privacy.cpd.cache',
'privacy.cpd.cookies',
'privacy.cpd.formdata',
'privacy.cpd.history',
'privacy.cpd.offlineApps',
'privacy.cpd.sessions',
/* 116-128 */
'browser.fixup.alternate.enabled',
'browser.taskbar.previews.enable',
'browser.urlbar.dnsResolveSingleWordsAfterSearch',
'geo.provider.network.url',
'geo.provider.network.logging.enabled',
'geo.provider.use_gpsd',
'media.gmp-widevinecdm.enabled',
'network.protocol-handler.external.ms-windows-store',
'privacy.partition.always_partition_third_party_non_cookie_storage',
'privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage',
'privacy.partition.serviceWorkers',
/* 103-115 */
'beacon.enabled',
'browser.startup.blankWindow',
'browser.newtab.preload',
'browser.newtabpage.activity-stream.feeds.discoverystreamfeed',
'browser.newtabpage.activity-stream.feeds.snippets',
'browser.region.network.url',
'browser.region.update.enabled',
'browser.search.region',
'browser.ssl_override_behavior',
'browser.tabs.warnOnClose',
'devtools.chrome.enabled',
'dom.disable_beforeunload',
'dom.disable_open_during_load',
'dom.netinfo.enabled',
'dom.vr.enabled',
'extensions.formautofill.addresses.supported',
'extensions.formautofill.available',
'extensions.formautofill.creditCards.available',
'extensions.formautofill.creditCards.supported',
'middlemouse.contentLoadURL',
'network.http.altsvc.oe',
/* 92-102 */
'browser.urlbar.trimURLs',
'dom.caches.enabled',
'dom.storageManager.enabled',
'dom.storage_access.enabled',
'dom.targetBlankNoOpener.enabled',
'network.cookie.thirdparty.sessionOnly',
'network.cookie.thirdparty.nonsecureSessionOnly',
'privacy.firstparty.isolate.block_post_message',
'privacy.firstparty.isolate.restrict_opener_access',
'privacy.firstparty.isolate.use_site',
'privacy.window.name.update.enabled',
'security.insecure_connection_text.enabled',
/* IMPORTANT: last active pref must not have a trailing comma */
/* reset parrot: check your open about:config after running the script */
'_user.js.parrot'
];
console.clear();
let c = 0;
for (const sPname of aPREFS) {
if (Services.prefs.prefHasUserValue(sPname)) {
Services.prefs.clearUserPref(sPname);
if (!Services.prefs.prefHasUserValue(sPname)) {
console.info('reset', sPname);
c++;
} else console.warn('failed to reset', sPname);
}
}
focus();
const d = (c==1) ? ' pref' : ' prefs';
alert(c ? 'successfully reset ' + c + d + "\n\nfor details check the console" : 'nothing to reset');
return 'all done';
})();
================================================
FILE: scratchpad-scripts/troubleshooter.js
================================================
/*** arkenfox user.js troubleshooter.js v1.6.3 ***/
(function() {
if ("undefined" === typeof(Services)) return alert('about:config needs to be the active tab!');
const aPREFS = [
/* known culprits */
'network.cookie.cookieBehavior',
'network.http.referer.XOriginPolicy',
'privacy.firstparty.isolate',
'privacy.resistFingerprinting',
'security.mixed_content.block_display_content',
'svg.disabled',
/* Storage + Cache */
'browser.cache.offline.enable',
'dom.storage.enabled',
'dom.storageManager.enabled',
/* Workers, Web + Push Notifications */
'dom.caches.enabled',
'dom.push.connection.enabled',
'dom.push.enabled',
'dom.push.serverURL',
'dom.serviceWorkers.enabled',
'dom.webnotifications.enabled',
'dom.webnotifications.serviceworker.enabled',
/* Fonts */
'browser.display.use_document_fonts',
'font.blacklist.underline_offset',
'gfx.font_rendering.graphite.enabled',
'gfx.font_rendering.opentype_svg.enabled',
'layout.css.font-loading-api.enabled',
/* Misc */
'browser.link.open_newwindow.restriction',
'canvas.capturestream.enabled',
'dom.event.clipboardevents.enabled',
'dom.event.contextmenu.enabled',
'dom.IntersectionObserver.enabled',
'dom.popup_allowed_events',
'full-screen-api.enabled',
'intl.accept_languages',
'javascript.options.asmjs',
'javascript.options.wasm',
'permissions.default.shortcuts',
/* Hardware */
'dom.vr.enabled',
'media.ondevicechange.enabled',
/* Audio + Video */
'dom.webaudio.enabled',
'media.autoplay.default', // FF63+
'media.autoplay.blocking_policy', // FF78+
/* Forms */
'browser.formfill.enable',
'signon.autofillForms',
'signon.formlessCapture.enabled',
/* HTTPS */
'security.cert_pinning.enforcement_level',
'security.family_safety.mode',
'security.OCSP.require',
'security.pki.sha1_enforcement_level',
'security.ssl.require_safe_negotiation',
'security.ssl.treat_unsafe_negotiation_as_broken',
'security.ssl3.dhe_rsa_aes_128_sha',
'security.ssl3.dhe_rsa_aes_256_sha',
'security.ssl3.ecdhe_ecdsa_aes_128_sha',
'security.ssl3.ecdhe_rsa_aes_128_sha',
'security.ssl3.rsa_aes_128_sha',
'security.ssl3.rsa_aes_256_sha',
'security.ssl3.rsa_des_ede3_sha',
'security.tls.enable_0rtt_data',
'security.tls.version.max',
'security.tls.version.min',
/* Plugins + Flash */
'plugin.default.state',
'plugin.state.flash',
/* unlikely to cause problems */
'dom.popup_maximum',
'geo.provider.network.url',
'layout.css.visited_links_enabled',
'mathml.disabled',
'network.auth.subresource-http-auth-allow',
'network.http.redirection-limit',
'network.protocol-handler.external.ms-windows-store',
'privacy.trackingprotection.enabled',
'security.data_uri.block_toplevel_data_uri_navigations',
'privacy.window.name.update.enabled', // FF82+
'last.one.without.comma'
]
// any runtime-set pref that everyone will have and that can be safely reset
const oFILLER = { type: 64, name: 'app.update.lastUpdateTime.browser-cleanup-thumbnails', value: 1580000000 };
function getMyList(arr) {
const aRet = [];
for (const sPname of arr) {
if (Services.prefs.prefHasUserValue(sPname)) {
const ptype = Services.prefs.getPrefType(sPname);
switch (ptype) {
case 32: // string (see https://dxr.mozilla.org/mozilla-central/source/modules/libpref/nsIPrefBranch.idl#31)
aRet.push({'type':ptype,'name':sPname,'value':Services.prefs.getCharPref(sPname)});
break;
case 64: // int
aRet.push({'type':ptype,'name':sPname,'value':Services.prefs.getIntPref(sPname)});
break;
case 128: // boolean
aRet.push({'type':ptype,'name':sPname,'value':Services.prefs.getBoolPref(sPname)});
break;
default:
console.log("error detecting pref-type for '"+sPname+"' !");
}
}
}
return aRet;
}
function reapply(arr) {
for (const oPref of arr) {
switch (oPref.type) {
case 32: // string
Services.prefs.setCharPref(oPref.name, oPref.value);
break;
case 64: // int
Services.prefs.setIntPref(oPref.name, oPref.value);
break;
case 128: // boolean
Services.prefs.setBoolPref(oPref.name, oPref.value);
break;
default:
console.log("error re-appyling value for '"+oPref.name+"' !"); // should never happen
}
}
}
function myreset(arr) {
for (const oPref of arr) Services.prefs.clearUserPref(oPref.name);
}
function resetAllMatchingDefault(arr) {
const aTmp = getMyList(arr);
myreset(aTmp);
reapply(aTmp);
}
function _main(aALL) {
const _h = (arr) => Math.ceil(arr.length/2);
let aTmp = aALL, aDbg = aALL;
reapply(aALL);
myreset(aTmp.slice(0, _h(aTmp)));
while (aTmp.length) {
alert('NOW TEST AGAIN !');
if (confirm('if the problem still exists click OK, otherwise click Cancel.')) {
aTmp = aTmp.slice(_h(aTmp));
} else {
aTmp = aTmp.slice(0, _h(aTmp));
aDbg = aTmp; // update narrowed down list
if (aDbg.length == 1) break;
}
reapply(aALL);
myreset(aTmp.slice(0, _h(aTmp))); // reset half of the remaining prefs
}
reapply(aALL);
if (aDbg.length == 1) return alert("narrowed it down to:\n\n"+aDbg[0].name+"\n");
if (aDbg.length == aALL.length) {
const msg = "Failed to narrow it down beyond the initial "+aALL.length+" prefs. The problem is most likely caused by at least 2 prefs!\n\n" +
"Either those prefs are too far apart in the list or there are exactly 2 culprits and they just happen to be at the wrong place.\n\n" +
"In case it's the latter, the script can add a dummy pref and you can try again - Try again?";
if (confirm(msg)) return _main([...aALL, oFILLER]);
} else if (aDbg.length > 10 && confirm("Narrowed it down to "+aDbg.length+" prefs. Try narrowing it down further?")) {
return _main(aDbg.reverse());
}
alert("Narrowed it down to "+ aDbg.length.toString() +" prefs, check the console ...");
console.log('The problem is caused by 2 or more of these prefs:');
for (const oPref of aDbg) console.log(oPref.name);
}
resetAllMatchingDefault(aPREFS); // reset user-set prefs matching FFs default value
const aBAK = getMyList(aPREFS);
//console.log(aBAK.length, "user-set prefs from our list detected and their values stored.");
const sMsg = "all detected prefs reset.\n\n" +
"!! KEEP THIS PROMPT OPEN AND TEST THE SITE IN ANOTHER TAB !!\n\n" +
"IF the problem still exists, this script can't help you - click Cancel to re-apply your values and exit.\n\n" +
"Click OK if your problem is fixed.";
focus();
myreset(aBAK);
if (!confirm(sMsg)) {
reapply(aBAK);
return;
}
_main(aBAK);
})();
================================================
FILE: updater.bat
================================================
@ECHO OFF & SETLOCAL EnableDelayedExpansion
TITLE arkenfox user.js updater
REM ## arkenfox user.js updater for Windows
REM ## author: @claustromaniac
REM ## version: 4.20
REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows
SET v=4.19
VERIFY ON
CD /D "%~dp0"
SET _myname=%~n0
SET _myparams=%*
:parse
IF "%~1"=="" (GOTO endparse)
IF /I "%~1"=="-unattended" (SET _ua=1)
IF /I "%~1"=="-log" (SET _log=1)
IF /I "%~1"=="-logp" (SET _log=1 & SET _logp=1)
IF /I "%~1"=="-multioverrides" (SET _multi=1)
IF /I "%~1"=="-merge" (SET _merge=1)
IF /I "%~1"=="-updatebatch" (SET _updateb=1)
IF /I "%~1"=="-singlebackup" (SET _singlebackup=1)
IF /I "%~1"=="-esr" (SET _esr=1)
SHIFT
GOTO parse
:endparse
FOR /F %%i IN ('PowerShell -Command "[Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls12'"') DO (
IF "%%i" == "False" (
CALL :message "Your PowerShell version doesn't support TLS1.2 ^!"
ECHO: Instructions to update PowerShell are on the arkenfox wiki
PAUSE
EXIT
)
)
IF DEFINED _updateb (
REM The normal flow here goes from phase 1 to phase 2 and then phase 3.
IF NOT "!_myname:~0,9!"=="[updated]" (
IF EXIST "[updated]!_myname!.bat" (
REM ## Phase 3 ##: The new script, with the original name, will:
REM * Delete the [updated]*.bat and *.bat.old scripts
REM * Begin the normal routine
FC "[updated]!_myname!.bat" "!_myname!.bat.old" >nul
IF NOT "!errorlevel!"=="0" (
CALL :message "Script updated to version !v!"
TIMEOUT 3 >nul
)
REN "[updated]!_myname!.bat" "[updated]!_myname!.bat.old"
DEL /F "!_myname!.bat.old" "[updated]!_myname!.bat.old"
GOTO begin
)
REM ## Phase 1 ##
REM * Download new batch and name it [updated]*.bat
REM * Start that script in a new CMD window
REM * Exit
CALL :message "Updating script..."
REM Uncomment the next line and comment out the PowerShell call for testing.
REM COPY /B /Y "!_myname!.bat" "[updated]!_myname!.bat" >nul
CALL :psdownload https://raw.githubusercontent.com/arkenfox/user.js/master/updater.bat "[updated]!_myname!.bat"
IF EXIST "[updated]!_myname!.bat" (
START /min CMD /C "[updated]!_myname!.bat" !_myparams!
) ELSE (
CALL :message "Failed. Make sure PowerShell is allowed internet access."
TIMEOUT 120 >nul
)
) ELSE (
IF "!_myname!"=="[updated]" (
CALL :message "The [updated] label is reserved. Rename this script and try again."
TIMEOUT 300 >nul
) ELSE (
REM ## Phase 2 ##: The [updated]*.bat script will:
REM * Rename the old script and make a copy of itself with the original name.
REM * Run that copy in a new CMD instance
REM * Exit
IF EXIST "!_myname:~9!.bat" ( REN "!_myname:~9!.bat" "!_myname:~9!.bat.old" )
COPY /B /Y "!_myname!.bat" "!_myname:~9!.bat"
START CMD /C "!_myname:~9!.bat" !_myparams!
)
)
EXIT /B
)
:begin
CLS
ECHO:
ECHO:
ECHO: ########################################
ECHO: #### user.js Updater for Windows ####
ECHO: #### by claustromaniac ####
ECHO: #### v!v! ####
ECHO: ########################################
ECHO:
SET /A "_line=0"
IF NOT EXIST user.js (
CALL :message "user.js not detected in the current directory."
) ELSE (
FOR /F "skip=1 tokens=1,* delims=:" %%G IN (user.js) DO (
SET /A "_line+=1"
IF !_line! GEQ 4 (GOTO exitloop)
IF !_line! EQU 1 (SET _name=%%H)
IF !_line! EQU 2 (SET _date=%%H)
IF !_line! EQU 3 (SET _version=%%G)
)
:exitloop
IF NOT "!_name!"=="" (
SET "_tempvar="
IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1
IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1
IF !_tempvar! EQU 1 (
CALL :message "!_name! !_version:~2!,!_date!"
) ELSE (CALL :message "Current user.js version not recognised.")
) ELSE (CALL :message "Current user.js version not recognised.")
)
ECHO:
IF NOT DEFINED _ua (
CALL :message "This batch should be run from your Firefox profile directory."
ECHO: It will download the latest version of arkenfox user.js from github and then
CALL :message "append any of your own changes from user-overrides.js to it."
CALL :message "Visit the wiki for more detailed information."
ECHO:
TIMEOUT 1 /nobreak >nul
CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]"
CLS
IF ERRORLEVEL 3 (EXIT /B)
IF ERRORLEVEL 2 (GOTO :showhelp)
)
IF DEFINED _log (
CALL :log >>user.js-update-log.txt 2>&1
IF DEFINED _logp (START user.js-update-log.txt)
EXIT /B
:log
SET _log=2
ECHO:##################################################################
ECHO: %date%, %time%
)
IF EXIST user.js.new (DEL /F "user.js.new")
CALL :message "Retrieving latest user.js file from github repository..."
CALL :psdownload https://raw.githubusercontent.com/arkenfox/user.js/master/user.js "user.js.new"
IF EXIST user.js.new (
IF DEFINED _esr (
CALL :message "Activating ESR section..."
CALL :activate user.js.new ".x still uses all the following prefs"
)
IF DEFINED _multi (
FORFILES /P user.js-overrides /M *.js >nul 2>&1
IF NOT ERRORLEVEL 1 (
IF DEFINED _merge (
CALL :message "Merging..."
COPY /B /Y user.js-overrides\*.js user-overrides-merged.js
CALL :merge user-overrides-merged.js
COPY /B /Y user.js.new+user-overrides-merged.js user.js.new
CALL :merge user.js.new
) ELSE (
CALL :message "Appending..."
COPY /B /Y user.js.new+"user.js-overrides\*.js" user.js.new
)
) ELSE (CALL :message "No override files found.")
) ELSE (
IF EXIST "user-overrides.js" (
COPY /B /Y user.js.new+"user-overrides.js" "user.js.new"
IF DEFINED _merge (
CALL :message "Merging user-overrides.js..."
CALL :merge user.js.new
) ELSE (
CALL :message "user-overrides.js appended."
)
) ELSE (CALL :message "user-overrides.js not found.")
)
IF EXIST user.js (
FC user.js.new user.js >nul && SET "_changed=false" || SET "_changed=true"
)
IF "!_changed!"=="true" (
CALL :message "Backing up..."
IF DEFINED _singlebackup (
MOVE /Y user.js user.js.bak >nul
) ELSE (
FOR /F "delims=" %%# IN ('powershell -command get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%#
MOVE /Y user.js "user-backup-!ldt!.js" >nul
)
REN user.js.new user.js
CALL :message "Update complete."
) ELSE (
IF "!_changed!"=="false" (
DEL /F user.js.new >nul
CALL :message "Update completed without changes."
) ELSE (
REN user.js.new user.js
CALL :message "Update complete."
SET "_changed=true"
)
)
) ELSE (
CALL :message "Update failed. Make sure PowerShell is allowed internet access."
ECHO: No changes were made.
)
IF NOT DEFINED _log (
IF NOT DEFINED _ua (
IF EXIST prefsCleaner.bat (
IF "!_changed!"=="true" (
CALL :message "Would you like to run the prefsCleaner now?"
CHOICE /C YN /N /M "(Y/N) "
IF "1"=="!errorlevel!" ( START "" cmd.exe /C "prefsCleaner.bat" )
) ELSE (PAUSE)
) ELSE (PAUSE)
)
)
EXIT /B
::::::::::::::: Message :::::::::::::::
:message
SETLOCAL DisableDelayedExpansion
IF NOT "2"=="%_log%" (ECHO:)
ECHO: %~1
IF NOT "2"=="%_log%" (ECHO:)
ENDLOCAL
GOTO :EOF
::::::::::::::: Download :::::::::::::::
:psdownload
(
PowerShell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('%~1', '%~2')"
) >nul 2>&1
GOTO :EOF
::::::::::::::: Activate Section :::::::::::::::
:activate
:: arg1 = file
:: arg2 = line substring
SETLOCAL DisableDelayedExpansion
(
FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" "%~1"') DO (
SET "_temp=%%H"
SETLOCAL EnableDelayedExpansion
IF "!_temp:%~2=!"=="!_temp!" (
ENDLOCAL & ECHO:%%H
) ELSE (
ECHO://!_temp:~2!
ENDLOCAL
)
)
)>updatertempfile
MOVE /Y updatertempfile "%~1" >nul
ENDLOCAL
GOTO :EOF
::::::::::::::: Merge :::::::::::::::
:merge
SETLOCAL DisableDelayedExpansion
FOR /F tokens^=2^,^*^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^user_pref[ ]*\([ ]*[\"'].*[\"'][ ]*,.*\)[ ]*;" "%~1"') DO (SET "[%%G]=%%H")
FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out --- '[^'][^']*'.*" "%~1"') DO (SET "__unset__%%G=1")
(
FOR /F "tokens=1,* delims=:" %%I IN ('FINDSTR /N "^" "%~1"') DO (
SET "_temp=%%J"
SETLOCAL EnableDelayedExpansion
IF NOT "!_temp:~0,9!"=="user_pref" (
ENDLOCAL & ECHO:%%J
) ELSE (
IF "!_temp:;=!"=="!_temp!" (
ENDLOCAL & ECHO:%%J
) ELSE (
ENDLOCAL
FOR /F tokens^=2^ delims^=^'^" %%K IN ("%%J") DO (
IF NOT "_user.js.parrot"=="%%K" (
IF DEFINED __unset__%%K (
ECHO://%%J
) ELSE (
IF DEFINED [%%K] (
SETLOCAL EnableDelayedExpansion
FOR /F "delims=" %%L IN ("![%%K]!") DO (
ENDLOCAL & ECHO:user_pref("%%K"%%L
SET "[%%K]="
)
)
)
) ELSE (ECHO:%%J)
)
)
)
)
)>updatertempfile
MOVE /Y updatertempfile "%~1" >nul
ENDLOCAL
GOTO :EOF
::::::::::::::: Help :::::::::::::::
:showhelp
MODE 80,54
CLS
CALL :message "Available arguments (case-insensitive):"
CALL :message " -esr"
ECHO: Activate ESR related preferences
CALL :message " -log"
ECHO: Write the console output to a logfile (user.js-update-log.txt)
CALL :message " -logP"
ECHO: Like -log, but also open the logfile after updating.
CALL :message " -merge"
ECHO: Merge overrides instead of appending them. Single-line comments and
ECHO: _user.js.parrot lines are appended normally. Overrides for inactive
ECHO: user.js prefs will be appended. When -Merge and -MultiOverrides are used
ECHO: together, a user-overrides-merged.js file is also generated in the root
ECHO: directory for quick reference. It contains only the merged data from
ECHO: override files and can be safely discarded after updating, or used as the
ECHO: new user-overrides.js. When there are conflicting records for the same
ECHO: pref, the value of the last one declared will be used. Visit the wiki
ECHO: for usage examples and more detailed information.
CALL :message " -multiOverrides"
ECHO: Use any and all .js files in a user.js-overrides sub-folder as overrides
ECHO: instead of the default user-overrides.js file. Files are appended in
ECHO: alphabetical order.
CALL :message " -unattended"
ECHO: Run without user input.
CALL :message " -singleBackup"
ECHO: Use a single backup file and overwrite it on new updates, instead of
ECHO: cumulative backups. This was the default behaviour before v4.3.
CALL :message " -updateBatch"
ECHO: Update the script itself on execution, before the normal routine.
CALL :message ""
PAUSE
MODE 80,25
GOTO :begin
================================================
FILE: updater.sh
================================================
#!/usr/bin/env bash
## arkenfox user.js updater for macOS and Linux
## version: 4.0
## Author: Pat Johnson (@overdodactyl)
## Additional contributors: @earthlng, @ema-pe, @claustromaniac, @infinitewarp
## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_updater() )
# Check if running as root
if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then
printf "You shouldn't run this with elevated privileges (such as with doas/sudo).\n"
exit 1
fi
readonly CURRDIR=$(pwd)
SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null)
[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]}
readonly SCRIPT_DIR=$(dirname "${SCRIPT_FILE}")
#########################
# Base variables #
#########################
# Colors used for printing
RED='\033[0;31m'
BLUE='\033[0;34m'
BBLUE='\033[1;34m'
GREEN='\033[0;32m'
ORANGE='\033[0;33m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color
# Argument defaults
UPDATE='check'
CONFIRM='yes'
OVERRIDE='user-overrides.js'
BACKUP='multiple'
COMPARE=false
SKIPOVERRIDE=false
VIEW=false
PROFILE_PATH=false
ESR=false
# Download method priority: curl -> wget
DOWNLOAD_METHOD=''
if command -v curl >/dev/null; then
DOWNLOAD_METHOD='curl --max-redirs 3 -so'
elif command -v wget >/dev/null; then
DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O'
else
echo -e "${RED}This script requires curl or wget.\nProcess aborted${NC}"
exit 1
fi
show_banner() {
echo -e "${BBLUE}
############################################################################
#### ####
#### arkenfox user.js ####
#### Hardening the Privacy and Security Settings of Firefox ####
#### Maintained by @Thorin-Oakenpants and @earthlng ####
#### Updater for macOS and Linux by @overdodactyl ####
#### ####
############################################################################"
echo -e "${NC}\n"
echo -e "Documentation for this script is available here: ${CYAN}https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-maclinux${NC}\n"
}
#########################
# Arguments #
#########################
usage() {
echo
echo -e "${BLUE}Usage: $0 [-bcdehlnrsuv] [-p PROFILE] [-o OVERRIDE]${NC}" 1>&2 # Echo usage string to standard error
echo -e "
Optional Arguments:
-h Show this help message and exit.
-p PROFILE Path to your Firefox profile (if different than the dir of this script)
IMPORTANT: If the path contains spaces, wrap the entire argument in quotes.
-l Choose your Firefox profile from a list
-u Update updater.sh and execute silently. Do not seek confirmation.
-d Do not look for updates to updater.sh.
-s Silently update user.js. Do not seek confirmation.
-b Only keep one backup of each file.
-c Create a diff file comparing old and new user.js within userjs_diffs.
-o OVERRIDE Filename or path to overrides file (if different than user-overrides.js).
If used with -p, paths should be relative to PROFILE or absolute paths
If given a directory, all files inside will be appended recursively.
You can pass multiple files or directories by passing a comma separated list.
Note: If a directory is given, only files inside ending in the extension .js are appended
IMPORTANT: Do not add spaces between files/paths. Ex: -o file1.js,file2.js,dir1
IMPORTANT: If any file/path contains spaces, wrap the entire argument in quotes.
Ex: -o \"override folder\"
-n Do not append any overrides, even if user-overrides.js exists.
-v Open the resulting user.js file.
-r Only download user.js to a temporary file and open it.
-e Activate ESR related preferences."
echo
exit 1
}
#########################
# File Handling #
#########################
download_file() { # expects URL as argument ($1)
declare -r tf=$(mktemp)
$DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error
}
open_file() { # expects one argument: file_path
if [ "$(uname)" == 'Darwin' ]; then
open "$1"
elif [ "$(uname -s | cut -c -5)" == "Linux" ]; then
xdg-open "$1"
else
echo -e "${RED}Error: Sorry, opening files is not supported for your OS.${NC}"
fi
}
readIniFile() { # expects one argument: absolute path of profiles.ini
declare -r inifile="$1"
# tempIni will contain: [ProfileX], Name=, IsRelative= and Path= (and Default= if present) of the only (if) or the selected (else) profile
if [ "$(grep -c '^\[Profile' "${inifile}")" -eq "1" ]; then ### only 1 profile found
tempIni="$(grep '^\[Profile' -A 4 "${inifile}")"
else
echo -e "Profiles found:\n––––––––––––––––––––––––––––––"
## cmd-substitution to strip trailing newlines and in quotes to keep internal ones:
echo "$(grep --color=never -E 'Default=[^1]|\[Profile[0-9]*\]|Name=|Path=|^$' "${inifile}")"
echo '––––––––––––––––––––––––––––––'
read -p 'Select the profile number ( 0 for Profile0, 1 for Profile1, etc ) : ' -r
echo -e "\n"
if [[ $REPLY =~ ^(0|[1-9][0-9]*)$ ]]; then
tempIni="$(grep "^\[Profile${REPLY}" -A 4 "${inifile}")" || {
echo -e "${RED}Profile${REPLY} does not exist!${NC}" && exit 1
}
else
echo -e "${RED}Invalid selection!${NC}" && exit 1
fi
fi
# extracting 0 or 1 from the "IsRelative=" line
declare -r pathisrel=$(sed -n 's/^IsRelative=\([01]\)$/\1/p' <<< "${tempIni}")
# extracting only the path itself, excluding "Path="
PROFILE_PATH=$(sed -n 's/^Path=\(.*\)$/\1/p' <<< "${tempIni}")
# update global variable if path is relative
[[ ${pathisrel} == "1" ]] && PROFILE_PATH="$(dirname "${inifile}")/${PROFILE_PATH}"
}
getProfilePath() {
declare -r f1=~/Library/Application\ Support/Firefox/profiles.ini
declare -r f2=~/.mozilla/firefox/profiles.ini
if [ "$PROFILE_PATH" = false ]; then
PROFILE_PATH="$SCRIPT_DIR"
elif [ "$PROFILE_PATH" = 'list' ]; then
if [[ -f "$f1" ]]; then
readIniFile "$f1" # updates PROFILE_PATH or exits on error
elif [[ -f "$f2" ]]; then
readIniFile "$f2"
else
echo -e "${RED}Error: Sorry, -l is not supported for your OS${NC}"
exit 1
fi
#else
# PROFILE_PATH already set by user with -p
fi
}
#########################
# Update updater.sh #
#########################
# Returns the version number of a updater.sh file
get_updater_version() {
echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")"
}
# Update updater.sh
# Default: Check for update, if available, ask user if they want to execute it
# Args:
# -d: New version will not be looked for and update will not occur
# -u: Check for update, if available, execute without asking
update_updater() {
[ "$UPDATE" = 'no' ] && return 0 # User signified not to check for updates
declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh')"
[ -z "${tmpfile}" ] && echo -e "${RED}Error! Could not download updater.sh${NC}" && return 1 # check if download failed
if [[ $(get_updater_version "$SCRIPT_FILE") < $(get_updater_version "${tmpfile}") ]]; then
if [ "$UPDATE" = 'check' ]; then
echo -e "There is a newer version of updater.sh available. ${RED}Update and execute Y/N?${NC}"
read -p "" -n 1 -r
echo -e "\n\n"
[[ $REPLY =~ ^[Yy]$ ]] || return 0 # Update available, but user chooses not to update
fi
else
return 0 # No update available
fi
mv "${tmpfile}" "$SCRIPT_FILE"
chmod u+x "$SCRIPT_FILE"
"$SCRIPT_FILE" "$@" -d
exit 0
}
#########################
# Update user.js #
#########################
# Returns version number of a user.js file
get_userjs_version() {
[ -e "$1" ] && echo "$(sed -n '4p' "$1")" || echo "Not detected."
}
add_override() {
input=$1
if [ -f "$input" ]; then
echo "" >> user.js
cat "$input" >> user.js
echo -e "Status: ${GREEN}Override file appended:${NC} ${input}"
elif [ -d "$input" ]; then
SAVEIFS=$IFS
IFS=$'\n\b' # Set IFS
FILES="${input}"/*.js
for f in $FILES
do
add_override "$f"
done
IFS=$SAVEIFS # restore $IFS
else
echo -e "${ORANGE}Warning: Could not find override file:${NC} ${input}"
fi
}
remove_comments() { # expects 2 arguments: from-file and to-file
sed -e '/^\/\*.*\*\/[[:space:]]*$/d' -e '/^\/\*/,/\*\//d' -e 's|^[[:space:]]*//.*$||' -e '/^[[:space:]]*$/d' -e 's|);[[:space:]]*//.*|);|' "$1" > "$2"
}
# Applies latest version of user.js and any custom overrides
update_userjs() {
declare -r newfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')"
[ -z "${newfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && return 1 # check if download failed
echo -e "Please observe the following information:
Firefox profile: ${ORANGE}$(pwd)${NC}
Available online: ${ORANGE}$(get_userjs_version "$newfile")${NC}
Currently using: ${ORANGE}$(get_userjs_version user.js)${NC}\n\n"
if [ "$CONFIRM" = 'yes' ]; then
echo -e "This script will update to the latest user.js file and append any custom configurations from user-overrides.js. ${RED}Continue Y/N? ${NC}"
read -p "" -n 1 -r
echo -e "\n"
if ! [[ $REPLY =~ ^[Yy]$ ]]; then
echo -e "${RED}Process aborted${NC}"
rm "$newfile"
return 1
fi
fi
# Copy a version of user.js to diffs folder for later comparison
if [ "$COMPARE" = true ]; then
mkdir -p userjs_diffs
cp user.js userjs_diffs/past_user.js &>/dev/null
fi
# backup user.js
mkdir -p userjs_backups
local bakname="userjs_backups/user.js.backup.$(date +"%Y-%m-%d_%H%M")"
[ "$BACKUP" = 'single' ] && bakname='userjs_backups/user.js.backup'
cp user.js "$bakname" &>/dev/null
mv "${newfile}" user.js
echo -e "Status: ${GREEN}user.js has been backed up and replaced with the latest version!${NC}"
if [ "$ESR" = true ]; then
sed -e 's/\/\* \(ESR[0-9]\{2,\}\.x still uses all.*\)/\/\/ \1/' user.js > user.js.tmp && mv user.js.tmp user.js
echo -e "Status: ${GREEN}ESR related preferences have been activated!${NC}"
fi
# apply overrides
if [ "$SKIPOVERRIDE" = false ]; then
while IFS=',' read -ra FILES; do
for FILE in "${FILES[@]}"; do
add_override "$FILE"
done
done <<< "$OVERRIDE"
fi
# create diff
if [ "$COMPARE" = true ]; then
pastuserjs='userjs_diffs/past_user.js'
past_nocomments='userjs_diffs/past_userjs.txt'
current_nocomments='userjs_diffs/current_userjs.txt'
remove_comments "$pastuserjs" "$past_nocomments"
remove_comments user.js "$current_nocomments"
diffname="userjs_diffs/diff_$(date +"%Y-%m-%d_%H%M").txt"
diff=$(diff -w -B -U 0 "$past_nocomments" "$current_nocomments")
if [ -n "$diff" ]; then
echo "$diff" > "$diffname"
echo -e "Status: ${GREEN}A diff file was created:${NC} ${PWD}/${diffname}"
else
echo -e "Warning: ${ORANGE}Your new user.js file appears to be identical. No diff file was created.${NC}"
[ "$BACKUP" = 'multiple' ] && rm "$bakname" &>/dev/null
fi
rm "$past_nocomments" "$current_nocomments" "$pastuserjs" &>/dev/null
fi
[ "$VIEW" = true ] && open_file "${PWD}/user.js"
}
#########################
# Execute #
#########################
if [ $# != 0 ]; then
# Display usage if first argument is -help or --help
if [ "$1" = '--help' ] || [ "$1" = '-help' ]; then
usage
else
while getopts ":hp:ludsno:bcvre" opt; do
case $opt in
h)
usage
;;
p)
PROFILE_PATH=${OPTARG}
;;
l)
PROFILE_PATH='list'
;;
u)
UPDATE='yes'
;;
d)
UPDATE='no'
;;
s)
CONFIRM='no'
;;
n)
SKIPOVERRIDE=true
;;
o)
OVERRIDE=${OPTARG}
;;
b)
BACKUP='single'
;;
c)
COMPARE=true
;;
v)
VIEW=true
;;
e)
ESR=true
;;
r)
tfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')"
[ -z "${tfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && exit 1 # check if download failed
mv "$tfile" "${tfile}.js"
echo -e "${ORANGE}Warning: user.js was saved to temporary file ${tfile}.js${NC}"
open_file "${tfile}.js"
exit 0
;;
\?)
echo -e "${RED}\n Error! Invalid option: -$OPTARG${NC}" >&2
usage
;;
:)
echo -e "${RED}Error! Option -$OPTARG requires an argument.${NC}" >&2
exit 2
;;
esac
done
fi
fi
show_banner
update_updater "$@"
getProfilePath # updates PROFILE_PATH or exits on error
cd "$PROFILE_PATH" || exit 1
# Check if any files have the owner as root/wheel.
if [ -n "$(find ./ -user 0)" ]; then
printf 'It looks like this script was previously run with elevated privileges,
you will need to change ownership of the following files to your user:\n'
find . -user 0
cd "$CURRDIR"
exit 1
fi
update_userjs
cd "$CURRDIR"
================================================
FILE: user.js
================================================
/******
* name: arkenfox user.js
* date: 4 November 2025
* version: 140
* urls: https://github.com/arkenfox/user.js [repo]
* : https://arkenfox.github.io/gui/ [interactive]
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt
* README:
1. Consider using Tor Browser if it meets your needs or fits your threat model
* https://2019.www.torproject.org/about/torusers.html
2. Read the entire wiki
* https://github.com/arkenfox/user.js/wiki
3. If you skipped step 2, return to step 2
4. Make changes in a user-overrides.js
* There are often trade-offs and conflicts between security vs privacy vs anti-tracking
and these need to be balanced against functionality & convenience & breakage
* Some site breakage and unintended consequences will happen. Everyone's experience will differ
e.g. some user data is erased on exit (section 2800), change this to suit your needs
* While not 100% definitive, search for "[SETUP" tags
5. Some tag info
[SETUP-SECURITY] it's one item, read it
[SETUP-WEB] can cause some websites to break
[SETUP-CHROME] changes how Firefox itself behaves (i.e. not directly website related)
[SETUP-HARDEN] prefs you may like to add to overrides
6. Override Recipes: https://github.com/arkenfox/user.js/issues/1080
* RELEASES: https://github.com/arkenfox/user.js/releases
* Use the arkenfox release that matches your Firefox version
- DON'T wait for arkenfox to update Firefox, nothing major changes these days
* Each release
- run prefsCleaner to reset prefs made inactive, including deprecated (9999)
* ESR (Extended Support Release)
- It is recommended to not use the updater, or you will get a later version which may cause issues.
So you should manually append your overrides (and keep a copy), and manually update when you
change ESR releases (arkenfox is already past that release)
- If you decide to keep updating, then the onus is on you - also see section 9999
* INDEX:
0100: STARTUP
0200: GEOLOCATION
0300: QUIETER FOX
0400: SAFE BROWSING
0600: BLOCK IMPLICIT OUTBOUND
0700: DNS / DoH / PROXY / SOCKS
0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
0900: PASSWORDS
1000: DISK AVOIDANCE
1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP)
1600: REFERERS
1700: CONTAINERS
2000: PLUGINS / MEDIA / WEBRTC
2400: DOM (DOCUMENT OBJECT MODEL)
2600: MISCELLANEOUS
2700: ETP (ENHANCED TRACKING PROTECTION)
2800: SHUTDOWN & SANITIZING
4000: FPP (fingerprintingProtection)
4500: OPTIONAL RFP (resistFingerprinting)
5000: OPTIONAL OPSEC
5500: OPTIONAL HARDENING
6000: DON'T TOUCH
7000: DON'T BOTHER
8000: DON'T BOTHER: FINGERPRINTING
8500: TELEMETRY
9000: NON-PROJECT RELATED
9999: DEPRECATED / RENAMED
******/
/* START: internal custom pref to test for syntax errors
* [NOTE] Not all syntax errors cause parsing to abort i.e. reaching the last debug pref
* no longer necessarily means that all prefs have been applied. Check the console right
* after startup for any warnings/error messages related to non-applied prefs
* [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/
user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?");
/* 0000: disable about:config warning ***/
user_pref("browser.aboutConfig.showWarning", false);
/*** [SECTION 0100]: STARTUP ***/
user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!");
/* 0102: set startup page [SETUP-CHROME]
* 0=blank, 1=home, 2=last visited page, 3=resume previous session
* [NOTE] Session Restore is cleared if history is also cleared (2811+), and not used in Private Browsing mode
* [SETTING] General>Startup>Restore previous session ***/
user_pref("browser.startup.page", 0);
/* 0103: set HOME+NEWWINDOW page
* about:home=Firefox Home (default, see 0105), custom URLs..., Blank Page
* [SETTING] Home>New Windows and Tabs>Homepage and new windows ***/
user_pref("browser.startup.homepage", "chrome://browser/content/blanktab.html");
/* 0104: set NEWTAB page
* true=Firefox Home (default, see 0105), false=blank page
* [SETTING] Home>New Windows and Tabs>New tabs ***/
user_pref("browser.newtabpage.enabled", false);
/* 0105: disable sponsored content on Firefox Home (Activity Stream)
* [SETTING] Home>Firefox Home Content ***/
user_pref("browser.newtabpage.activity-stream.showSponsored", false); // [FF58+] Sponsored stories
user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false); // [FF83+] Sponsored shortcuts
user_pref("browser.newtabpage.activity-stream.showSponsoredCheckboxes", false); // [FF140+] Support Firefox
/* 0106: clear default topsites
* [NOTE] This does not block you from adding your own ***/
user_pref("browser.newtabpage.activity-stream.default.sites", "");
/*** [SECTION 0200]: GEOLOCATION ***/
user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!");
/* 0202: disable using the OS's geolocation service ***/
user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
user_pref("geo.provider.use_corelocation", false); // [MAC]
user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX]
/*** [SECTION 0300]: QUIETER FOX ***/
user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!");
/** RECOMMENDATIONS ***/
/* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/
user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
/* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
/* 0322: disable personalized Extension Recommendations in about:addons and AMO [FF65+]
* [NOTE] This pref has no effect when Health Reports (8501) are disabled
* [SETTING] Privacy & Security>Firefox Data Collection and Use>Allow personalized extension recommendations
* [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/
user_pref("browser.discovery.enabled", false);
/** ACTIVITY STREAM ***/
/* 0335: disable Firefox Home (Activity Stream) telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
/** STUDIES ***/
/* 0340: disable Studies
* [SETTING] Privacy & Security>Firefox Data Collection and Use>Install and run studies ***/
user_pref("app.shield.optoutstudies.enabled", false);
/* 0341: disable Normandy/Shield [FF60+]
* Shield is a telemetry system that can push and test "recipes"
* [1] https://mozilla.github.io/normandy/ ***/
user_pref("app.normandy.enabled", false);
user_pref("app.normandy.api_url", "");
/** CRASH REPORTS ***/
/* 0350: disable Crash Reports ***/
user_pref("breakpad.reportURL", "");
user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+]
// user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false]
/* 0351: enforce no submission of backlogged Crash Reports [FF58+]
* [SETTING] Privacy & Security>Firefox Data Collection and Use>Send backlogged crash reports ***/
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false]
/** OTHER ***/
/* 0360: disable Captive Portal detection
* [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/
user_pref("captivedetect.canonicalURL", "");
user_pref("network.captive-portal-service.enabled", false); // [FF52+]
/* 0361: disable Network Connectivity checks [FF65+]
* [1] https://bugzilla.mozilla.org/1460537 ***/
user_pref("network.connectivity-service.enabled", false);
/*** [SECTION 0400]: SAFE BROWSING (SB)
SB has taken many steps to preserve privacy. If required, a full url is never sent
to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes.
Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+)
doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity)
[1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
[2] https://wiki.mozilla.org/Security/Safe_Browsing
[3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work
[4] https://educatedguesswork.org/posts/safe-browsing-privacy/
***/
user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!");
/* 0401: disable SB (Safe Browsing)
* [WARNING] Do this at your own risk! These are the master switches
* [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/
// user_pref("browser.safebrowsing.malware.enabled", false);
// user_pref("browser.safebrowsing.phishing.enabled", false);
/* 0402: disable SB checks for downloads (both local lookups + remote)
* This is the master switch for the safebrowsing.downloads* prefs (0403, 0404)
* [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/
// user_pref("browser.safebrowsing.downloads.enabled", false);
/* 0403: disable SB checks for downloads (remote)
* To verify the safety of certain executable files, Firefox may submit some information about the
* file, including the name, origin, size and a cryptographic hash of the contents, to the Google
* Safe Browsing service which helps Firefox determine whether or not the file should be blocked
* [SETUP-SECURITY] If you do not understand this, or you want this protection, then override this ***/
user_pref("browser.safebrowsing.downloads.remote.enabled", false);
// user_pref("browser.safebrowsing.downloads.remote.url", ""); // Defense-in-depth
/* 0404: disable SB checks for unwanted software
* [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/
// user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
// user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
/* 0405: disable "ignore this warning" on SB warnings [FF45+]
* If clicked, it bypasses the block for that session. This is a means for admins to enforce SB
* [TEST] see https://github.com/arkenfox/user.js/wiki/Appendix-A-Test-Sites#-mozilla
* [1] https://bugzilla.mozilla.org/1226490 ***/
// user_pref("browser.safebrowsing.allowOverride", false);
/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/
user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
/* 0601: disable link prefetching
* [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
user_pref("network.prefetch-next", false);
/* 0602: disable DNS prefetching
* [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
user_pref("network.dns.disablePrefetch", true);
user_pref("network.dns.disablePrefetchFromHTTPS", true);
/* 0603: disable predictor / prefetching ***/
user_pref("network.predictor.enabled", false);
user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false]
/* 0604: disable link-mouseover opening connection to linked server
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
user_pref("network.http.speculative-parallel-limit", 0);
/* 0605: disable mousedown speculative connections on bookmarks and history [FF98+] ***/
user_pref("browser.places.speculativeConnect.enabled", false);
/* 0610: enforce no "Hyperlink Auditing" (click tracking)
* [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
// user_pref("browser.send_pings", false); // [DEFAULT: false]
/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS ***/
user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
/* 0702: set the proxy server to do any DNS lookups when using SOCKS
* e.g. in Tor, this stops your local DNS server from knowing your Tor destination
* as a remote Tor node will handle the DNS request
* [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
user_pref("network.proxy.socks_remote_dns", true);
/* 0703: disable using UNC (Uniform Naming Convention) paths [FF61+]
* [SETUP-CHROME] Can break extensions for profiles on network shares
* [1] https://bugzilla.mozilla.org/1413868 ***/
user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
/* 0704: disable GIO as a potential proxy bypass vector
* Gvfs/GIO has a set of supported protocols like obex, network, archive, computer,
* dav, cdda, gphoto2, trash, etc. From FF87-117, by default only sftp was accepted
* [1] https://bugzilla.mozilla.org/1433507
* [2] https://en.wikipedia.org/wiki/GVfs
* [3] https://en.wikipedia.org/wiki/GIO_(software) ***/
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] [DEFAULT: ""]
/* 0705: disable proxy direct failover for system requests [FF91+]
* [WARNING] Default true is a security feature against malicious extensions [1]
* [SETUP-CHROME] If you use a proxy and you trust your extensions
* [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/
// user_pref("network.proxy.failover_direct", false);
/* 0706: disable proxy bypass for system request failures [FF95+]
* RemoteSettings, UpdateService, Telemetry [1]
* [WARNING] If false, this will break the fallback for some security features
* [SETUP-CHROME] If you use a proxy and you understand the security impact
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/
// user_pref("network.proxy.allow_bypass", false);
/* 0710: enable DNS-over-HTTPS (DoH) [FF60+]
* 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off (no rollout)
* see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3]
* [SETTING] Privacy & Security>DNS over HTTPS
* [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/
* [2] https://wiki.mozilla.org/Security/DOH-resolver-policy
* [3] https://support.mozilla.org/kb/firefox-dns-over-https
* [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/
// user_pref("network.trr.mode", 3);
/* 0712: set DoH provider
* The custom uri is the value shown when you "Choose provider>Custom>"
* [NOTE] If you USE custom then "network.trr.uri" should be set the same
* [SETTING] Privacy & Security>DNS over HTTPS>Increased/Max>Choose provider ***/
// user_pref("network.trr.uri", "https://example.dns");
// user_pref("network.trr.custom_uri", "https://example.dns");
/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/
user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
/* 0801: disable location bar making speculative connections [FF56+]
* [1] https://bugzilla.mozilla.org/1348275 ***/
user_pref("browser.urlbar.speculativeConnect.enabled", false);
/* 0802: disable location bar contextual suggestions
* [NOTE] The UI is controlled by the .enabled pref
* [SETTING] Search>Address Bar>Suggestions from...
* [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/
user_pref("browser.urlbar.quicksuggest.enabled", false); // [FF92+]
user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+]
user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); // [FF92+]
/* 0803: disable live search suggestions
* [NOTE] Both must be true for live search to work in the location bar
* [SETUP-CHROME] Override these if you trust and use a privacy respecting search engine
* [SETTING] Search>Show search suggestions | Show search suggestions in address bar results ***/
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);
/* 0805: disable urlbar trending search suggestions [FF118+]
* [SETTING] Search>Search Suggestions>Show trending search suggestions (FF119) ***/
user_pref("browser.urlbar.trending.featureGate", false);
/* 0806: disable urlbar suggestions ***/
user_pref("browser.urlbar.addons.featureGate", false); // [FF115+]
user_pref("browser.urlbar.amp.featureGate", false); // [FF141+] adMarketplace
user_pref("browser.urlbar.fakespot.featureGate", false); // [FF130+] [DEFAULT: false]
user_pref("browser.urlbar.mdn.featureGate", false); // [FF117+]
user_pref("browser.urlbar.weather.featureGate", false); // [FF108+]
user_pref("browser.urlbar.wikipedia.featureGate", false); // [FF141+]
user_pref("browser.urlbar.yelp.featureGate", false); // [FF124+]
/* 0807: disable urlbar clipboard suggestions [FF118+] ***/
// user_pref("browser.urlbar.clipboard.featureGate", false);
/* 0808: disable recent searches [FF120+]
* [NOTE] Recent searches are cleared if history is cleared (2811+)
* [1] https://support.mozilla.org/kb/search-suggestions-firefox ***/
// user_pref("browser.urlbar.recentsearches.featureGate", false);
/* 0810: disable search and form history
* [NOTE] We also clear formdata on exit (2811+)
* [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2]
* [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
* [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html
* [2] https://bugzilla.mozilla.org/381681 ***/
user_pref("browser.formfill.enable", false);
/* 0815: disable tab-to-search [FF85+]
* Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search
* [SETTING] Search>Address Bar>When using the address bar, suggest>Search engines ***/
// user_pref("browser.urlbar.suggest.engines", false);
/* 0820: disable coloring of visited links
* [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive
* redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing
* attacks. History can also be cleared on exit (2811+). However, social engineering [2#limits][4][5]
* and advanced targeted timing attacks could still produce usable results
* [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector
* [2] https://dbaron.org/mozilla/visited-privacy
* [3] https://bugzilla.mozilla.org/1632765
* [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use)
* [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/
// user_pref("layout.css.visited_links_enabled", false);
/* 0830: enable separate default search engine in Private Windows and its UI setting
* [SETTING] Search>Default Search Engine>Choose a different default search engine for Private Windows only ***/
user_pref("browser.search.separatePrivateDefault", true); // [FF70+]
user_pref("browser.search.separatePrivateDefault.ui.enabled", true); // [FF71+]
/*** [SECTION 0900]: PASSWORDS
[1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas
***/
user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
/* 0903: disable auto-filling username & password form fields
* can leak in cross-site forms *and* be spoofed
* [NOTE] Username & password is still available when you enter the field
* [SETTING] Privacy & Security>Passwords>Autofill logins and passwords
* [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/
* [2] https://homes.esat.kuleuven.be/~asenol/leaky-forms/ ***/
user_pref("signon.autofillForms", false);
/* 0904: disable formless login capture for Password Manager [FF51+] ***/
user_pref("signon.formlessCapture.enabled", false);
/* 0905: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+]
* hardens against potential credentials phishing
* 0 = don't allow sub-resources to open HTTP authentication credentials dialogs
* 1 = don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
* 2 = allow sub-resources to open HTTP authentication credentials dialogs (default) ***/
user_pref("network.auth.subresource-http-auth-allow", 1);
/* 0906: enforce no automatic authentication on Microsoft sites [FF91+] [WINDOWS 10+]
* [SETTING] Privacy & Security>Logins and Passwords>Allow Windows single sign-on for...
* [1] https://support.mozilla.org/kb/windows-sso ***/
// user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false]
/* 0907: enforce no automatic authentication on Microsoft sites [FF131+] [MAC]
* On macOS, SSO only works on corporate devices ***/
// user_pref("network.http.microsoft-entra-sso.enabled", false); // [DEFAULT: false]
/*** [SECTION 1000]: DISK AVOIDANCE ***/
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
/* 1001: disable disk cache
* [NOTE] We also clear cache on exit (2811+)
* [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this ***/
user_pref("browser.cache.disk.enable", false);
/* 1002: set media cache in Private Browsing to in-memory and increase its maximum size
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
user_pref("media.memory_cache_max_size", 65536);
/* 1003: disable storing extra session data [SETUP-CHROME]
* define on which sites to save extra session data such as form content, cookies and POST data
* 0=everywhere, 1=unencrypted sites, 2=nowhere ***/
user_pref("browser.sessionstore.privacy_level", 2);
/* 1005: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS]
* [1] https://bugzilla.mozilla.org/603903 ***/
user_pref("toolkit.winRegisterApplicationRestart", false);
/* 1006: disable favicons in shortcuts [WINDOWS]
* URL shortcuts use a cached randomly named .ico file which is stored in your
* profile/shortcutCache directory. The .ico remains after the shortcut is deleted
* If set to false then the shortcuts use a generic Firefox icon ***/
user_pref("browser.shell.shortcutFavicons", false);
/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP)
Your cipher and other settings can be used in server side fingerprinting
[TEST] https://www.ssllabs.com/ssltest/viewMyClient.html
[TEST] https://browserleaks.com/ssl
[TEST] https://ja3er.com/
[1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
***/
user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
/** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/
/* 1201: require safe negotiation
* Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a
* MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations
* but the problem is that the browser can't know that. Setting this pref to true is the only way for the
* browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server
* [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site?
* [STATS] SSL Labs (May 2024) reports over 99.7% of top sites have secure renegotiation [4]
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://datatracker.ietf.org/doc/html/rfc5746
* [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
* [4] https://www.ssllabs.com/ssl-pulse/ ***/
user_pref("security.ssl.require_safe_negotiation", true);
/* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+]
* This data is not forward secret, as it is encrypted solely under keys derived using
* the offered PSK. There are no guarantees of non-replay between connections
* [1] https://github.com/tlswg/tls13-spec/issues/1001
* [2] https://www.rfc-editor.org/rfc/rfc9001.html#name-replay-attacks-with-0-rtt
* [3] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/
user_pref("security.tls.enable_0rtt_data", false);
/** OCSP (Online Certificate Status Protocol)
[1] https://scotthelme.co.uk/revocation-is-broken/
[2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
***/
/* 1211: enforce OCSP fetching to confirm current validity of certificates
* 0=disabled, 1=enabled (default), 2=enabled for EV certificates only
* OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority)
* It's a trade-off between security (checking) and privacy (leaking info to the CA)
* [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling
* [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers...
* [1] https://en.wikipedia.org/wiki/Ocsp ***/
user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1]
/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail
* [SETUP-WEB] SEC_ERROR_OCSP_SERVER_ERROR | SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST
* When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail)
* Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail)
* It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it
* could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers)
* [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
* [2] https://www.imperialviolet.org/2014/04/19/revchecking.html
* [3] https://letsencrypt.org/2024/12/05/ending-ocsp/ ***/
user_pref("security.OCSP.require", true);
/** CERTS / HPKP (HTTP Public Key Pinning) ***/
/* 1223: enable strict PKP (Public Key Pinning)
* 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict
* [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE ***/
user_pref("security.cert_pinning.enforcement_level", 2);
/* 1224: enable CRLite [FF73+]
* 0 = disabled
* 1 = consult CRLite but only collect telemetry
* 2 = consult CRLite and enforce both "Revoked" and "Not Revoked" results
* 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (default)
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071
* [2] https://blog.mozilla.org/security/tag/crlite/ ***/
user_pref("security.remote_settings.crlite_filters.enabled", true); // [DEFAULT: true FF137+]
user_pref("security.pki.crlite_mode", 2);
/** MIXED CONTENT ***/
/* 1241: disable insecure passive content (such as images) on https pages ***/
// user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244)
/* 1244: enable HTTPS-Only mode in all windows
* When the top-level is HTTPS, insecure subresources are also upgraded (silent fail)
* [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site")
* [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions)
* [TEST] http://example.com [upgrade]
* [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/
user_pref("dom.security.https_only_mode", true); // [FF76+]
// user_pref("dom.security.https_only_mode_pbm", true); // [FF80+]
/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/
// user_pref("dom.security.https_only_mode.upgrade_local", true);
/* 1246: disable HTTP background requests [FF82+]
* When attempting to upgrade, if the server doesn't respond within 3 seconds, Firefox sends
* a top-level HTTP request without path in order to check if the server supports HTTPS or not
* This is done to avoid waiting for a timeout which takes 90 seconds
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/
user_pref("dom.security.https_only_mode_send_http_background_request", false);
/** UI (User Interface) ***/
/* 1270: display warning on the padlock for "broken security" (if 1201 is false)
* Bug: warning padlock not indicated for subresources on a secure page! [2]
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://bugzilla.mozilla.org/1353705 ***/
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
/* 1272: display advanced information on Insecure Connection warning pages
* only works when it's possible to add an exception
* i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/)
* [TEST] https://expired.badssl.com/ ***/
user_pref("browser.xul.error_pages.expert_bad_cert", true);
/*** [SECTION 1600]: REFERERS
full URI: https://example.com:8888/foo/bar.html?id=1234
scheme+host+port+path: https://example.com:8888/foo/bar.html
scheme+host+port: https://example.com:8888
[1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
***/
user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!");
/* 1602: control the amount of cross-origin information to send [FF52+]
* 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
user_pref("network.http.referer.XOriginTrimmingPolicy", 2);
/*** [SECTION 1700]: CONTAINERS ***/
user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
/* 1701: enable Container Tabs and its UI setting [FF50+]
* [SETTING] General>Tabs>Enable Container Tabs
* https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/
user_pref("privacy.userContext.enabled", true);
user_pref("privacy.userContext.ui.enabled", true);
/* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+]
* [NOTE] The menu is always shown on long press and right click
* [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/
// user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true);
/* 1703: set external links to open in site-specific containers [FF123+]
* [SETUP-WEB] Depending on your container extension(s) and their settings
* true=Firefox will not choose a container (so your extension can)
* false=Firefox will choose the container/no-container (default)
* [1] https://bugzilla.mozilla.org/1874599 ***/
// user_pref("browser.link.force_default_user_context_id_for_external_opens", true);
/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/
user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
/* 2002: force WebRTC inside the proxy [FF70+] ***/
user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true);
/* 2003: force a single network interface for ICE candidates generation [FF42+]
* When using a system-wide proxy, it uses the proxy interface
* [1] https://developer.mozilla.org/docs/Web/API/RTCIceCandidate
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
user_pref("media.peerconnection.ice.default_address_only", true);
/* 2004: force exclusion of private IPs from ICE candidates [FF51+]
* [SETUP-HARDEN] This will protect your private IP even in TRUSTED scenarios after you
* grant device access, but often results in breakage on video-conferencing platforms ***/
// user_pref("media.peerconnection.ice.no_host", true);
/* 2020: disable GMP (Gecko Media Plugins)
* [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
// user_pref("media.gmp-provider.enabled", false);
/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/
user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!");
/* 2402: prevent scripts from moving and resizing open windows ***/
user_pref("dom.disable_window_move_resize", true);
/*** [SECTION 2600]: MISCELLANEOUS ***/
user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
/* 2603: remove temp files opened from non-PB windows with an external application
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/
user_pref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+]
user_pref("browser.helperApps.deleteTempFileOnExit", true);
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
user_pref("browser.uitour.enabled", false);
// user_pref("browser.uitour.url", ""); // Defense-in-depth
/* 2608: reset remote debugging to disabled
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+]
* 0 (default) or 1=allow, 2=block
* [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/
// user_pref("permissions.default.shortcuts", 2);
/* 2616: remove special permissions for certain mozilla domains [FF35+]
* [1] resource://app/defaults/permissions ***/
user_pref("permissions.manager.defaultsUrl", "");
/* 2619: use Punycode in Internationalized Domain Names to eliminate possible spoofing
* [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded
* [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com)
* [1] https://wiki.mozilla.org/IDN_Display_Algorithm
* [2] https://en.wikipedia.org/wiki/IDN_homograph_attack
* [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox
* [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
user_pref("network.IDN_show_punycode", true);
/* 2620: enforce PDFJS, disable PDFJS scripting
* This setting controls if the option "Display in Firefox" is available in the setting below
* and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With")
* [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1]
* It doesn't break "state separation" of browser content (by not sharing with OS, independent apps).
* It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
* [NOTE] JS can still force a pdf to open in-browser by bundling its own code
* [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons
* [SETTING] General>Applications>Portable Document Format (PDF)
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
user_pref("pdfjs.enableScripting", false); // [FF86+]
/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] ***/
user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX]
/* 2630: disable content analysis by DLP (Data Loss Prevention) agents
* DLP agents are background processes on managed computers that allow enterprises to monitor locally running
* applications for data exfiltration events, which they can allow/block based on customer defined DLP policies.
* 0=Block all requests, 1=Warn on all requests (which lets the user decide), 2=Allow all requests
* [1] https://github.com/chromium/content_analysis_sdk ***/
user_pref("browser.contentanalysis.enabled", false); // [FF121+] [DEFAULT: false]
user_pref("browser.contentanalysis.default_result", 0); // [FF127+] [DEFAULT: 0]
/* 2635: disable referrer and storage access for resources injected by content scripts [FF139+] ***/
// user_pref("privacy.antitracking.isolateContentScriptResources", true);
/* 2640: disable CSP Level 2 Reporting [FF140+] ***/
user_pref("security.csp.reporting.enabled", false);
/** DOWNLOADS ***/
/* 2651: enable user interaction for security by always asking where to download
* [SETUP-CHROME] On Android this blocks longtapping and saving images
* [SETTING] General>Downloads>Always ask you where to save files ***/
user_pref("browser.download.useDownloadDir", false);
/* 2652: disable downloads panel opening on every download [FF96+] ***/
user_pref("browser.download.alwaysOpenPanel", false);
/* 2653: disable adding downloads to the system's "recent documents" list ***/
user_pref("browser.download.manager.addToRecentDocs", false);
/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+]
* [SETTING] General>Files and Applications>What should Firefox do with other files ***/
user_pref("browser.download.always_ask_before_handling_new_types", true);
/** EXTENSIONS ***/
/* 2660: limit allowed extension directories
* 1=profile, 2=user, 4=application, 8=system, 16=temporary, 31=all
* The pref value represents the sum: e.g. 5 would be profile and application directories
* [SETUP-CHROME] Breaks usage of files which are installed outside allowed directories
* [1] https://archive.is/DYjAM ***/
user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF]
// user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15]
/* 2661: disable bypassing 3rd party extension install prompts [FF82+]
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 ***/
user_pref("extensions.postDownloadThirdPartyPrompt", false);
/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+]
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
// user_pref("extensions.webextensions.restrictedDomains", "");
/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/
user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
/* 2701: enable ETP Strict Mode [FF86+]
* ETP Strict Mode enables Total Cookie Protection (TCP)
* [NOTE] Adding site exceptions disables all ETP protections for that site and increases the risk of
* cross-site state tracking e.g. exceptions for SiteA and SiteB means PartyC on both sites is shared
* [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/
* [SETTING] to add site exceptions: Urlbar>ETP Shield
* [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/
user_pref("browser.contentblocking.category", "strict"); // [HIDDEN PREF]
/* 2702: disable ETP web compat features [FF93+]
* [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants
* Opener and redirect heuristics are granted for 30 days, see [3]
* [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/
* [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12
* [3] https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/
// user_pref("privacy.antitracking.enableWebcompat", false);
/*** [SECTION 2800]: SHUTDOWN & SANITIZING
We enable sanitizeOnShutdown to help prevent 1st party website tracking across sessions.
We consider history/downloads, which are not accessible to websites, as orthogonal and exempt these
[SETUP-HARDEN] to clear all history/downloads on close, add the appropriate overrides from 2800's
***/
user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!");
/* 2810: enable Firefox to clear items on shutdown
* [NOTE] In FF129+ clearing "siteSettings" on shutdown (2811+), or manually via site data (2820+) and
* via history (2830), will no longer remove sanitize on shutdown "cookie and site data" site exceptions (2815)
* [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes | Settings ***/
user_pref("privacy.sanitize.sanitizeOnShutdown", true);
/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS ***/
/* 2811: set/enforce clearOnShutdown items (if 2810 is true) [SETUP-CHROME] [FF128+] ***/
user_pref("privacy.clearOnShutdown_v2.cache", true); // [DEFAULT: true]
user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", false); // [DEFAULT: true]
// user_pref("privacy.clearOnShutdown_v2.siteSettings", false); // [DEFAULT: false]
/* 2812: set/enforce clearOnShutdown items [FF136+] ***/
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", false); // [DEFAULT: true]
user_pref("privacy.clearOnShutdown_v2.downloads", false); // [HIDDEN]
user_pref("privacy.clearOnShutdown_v2.formdata", true);
/* 2813: set Session Restore to clear on shutdown (if 2810 is true) [FF34+]
* [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811+)
* [NOTE] If true, this prevents resuming from crashes (also see 5008) ***/
// user_pref("privacy.clearOnShutdown.openWindows", true);
/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS ***/
/* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME] [FF128+]
* [NOTE] Exceptions: For cross-domain logins, add exceptions for both sites
* e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on)
* [WARNING] Be selective with what sites you "Allow", as they also disable partitioning (1767271)
* [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question)
* [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/
user_pref("privacy.clearOnShutdown_v2.cookiesAndStorage", true);
/** SANITIZE SITE DATA: IGNORES "ALLOW" SITE EXCEPTIONS ***/
/* 2820: set manual "Clear Data" items [SETUP-CHROME] [FF128+]
* Firefox remembers your last choices. This will reset them when you start Firefox
* [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/
user_pref("privacy.clearSiteData.cache", true);
user_pref("privacy.clearSiteData.cookiesAndStorage", false); // keep false until it respects "allow" site exceptions
user_pref("privacy.clearSiteData.historyFormDataAndDownloads", false);
// user_pref("privacy.clearSiteData.siteSettings", false);
/* 2821: set manual "Clear Data" items [FF136+] ***/
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", false);
user_pref("privacy.clearSiteData.formdata", true);
/** SANITIZE HISTORY: IGNORES "ALLOW" SITE EXCEPTIONS ***/
/* 2830: set manual "Clear History" items, also via Ctrl-Shift-Del [SETUP-CHROME] [FF128+]
* Firefox remembers your last choices. This will reset them when you start Firefox
* [SETTING] Privacy & Security>History>Custom Settings>Clear History ***/
user_pref("privacy.clearHistory.cache", true); // [DEFAULT: true]
user_pref("privacy.clearHistory.cookiesAndStorage", false);
user_pref("privacy.clearHistory.historyFormDataAndDownloads", false); // [DEFAULT: true]
// user_pref("privacy.clearHistory.siteSettings", false); // [DEFAULT: false]
/* 2831: set manual "Clear History" items [FF136+] ***/
user_pref("privacy.clearHistory.browsingHistoryAndDownloads", false); // [DEFAULT: true]
user_pref("privacy.clearHistory.formdata", true);
/** SANITIZE MANUAL: TIMERANGE ***/
/* 2840: set "Time range to clear" for "Clear Data" (2820+) and "Clear History" (2830+)
* Firefox remembers your last choice. This will reset the value when you start Firefox
* 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today
* [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown,
* which will display a blank value, and are not guaranteed to work ***/
user_pref("privacy.sanitize.timeSpan", 0);
/*** [SECTION 4000]: FPP (fingerprintingProtection)
RFP (4501) overrides FPP
In FF118+ FPP is on by default in private windows (4001) and in FF119+ is controlled
by ETP (2701). FPP will also use Remote Services in future to relax FPP protections
on a per site basis for compatibility (4004).
https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc
[NOTE] RFPTargets + granular overrides are somewhat experimental and may produce unexpected results
- e.g. FrameRate can only be controlled per process, not per origin
1826408 - restrict to system fonts (kBaseFonts + kLangPackFonts) (Windows, Mac, some Linux) (FF119+)
1928705: android (FF134+)
https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
1858181 - subtly randomize canvas per eTLD+1, per session and per window-mode (FF120+)
1887682 - use fdlibm's sin, cos and tan in jsmath (FF134+)
1954194 - available screen resolution: return a fixed offset height from screen per platform when not full screen (FF143+)
1984333 - hardwareConcurrency: less than 8 return 4 else return 8 (FF143+)
1977836 - maxTouchPoints: return multi-touch as 5 (FF143+)
1917607 - subtly randomize WebGL's readPixels (FF145+)
***/
user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!");
/* 4001: enable FPP in PB mode [FF114+]
* [NOTE] In FF119+, FPP for all modes (7016) is enabled with ETP Strict (2701) ***/
// user_pref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT: true]
/* 4002: set global FPP overrides [FF114+]
* uses "RFPTargets" [1] which despite the name these are not used by RFP
* e.g. "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC" = all targets but allow prefers-color-scheme and do not change timezone
* e.g. "-AllTargets,+CanvasRandomization,+JSDateTimeUTC" = no targets but do use FPP canvas and change timezone
* [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults
* [1] https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc ***/
// user_pref("privacy.fingerprintingProtection.overrides", "");
/* 4003: set granular FPP overrides
* JSON format: e.g."[{\"firstPartyDomain\": \"netflix.com\", \"overrides\": \"-CanvasRandomization,-FrameRate,\"}]"
* [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults ***/
// user_pref("privacy.fingerprintingProtection.granularOverrides", "");
/* 4004: disable remote FPP overrides [FF127+] ***/
// user_pref("privacy.fingerprintingProtection.remoteOverrides.enabled", false);
/*** [SECTION 4500]: OPTIONAL RFP (resistFingerprinting)
RFP overrides FPP (4000)
FF128+ Arkenfox by default uses FPP (automatically enabled with ETP Strict). For most people
this is all you need. To use RFP instead, add RFP (4501) to your overrides, and optionally
add letterboxing (4504), spoof_english (4506), and WebGL (4520).
RFP is an all-or-nothing buy in: you cannot pick and choose what parts you want
[WARNING] DO NOT USE extensions to alter RFP protected metrics
418986 - limit window.screen & CSS media queries (FF41)
FF56
1333651 - spoof User Agent & Navigator API
JS: spoofed as Windows 10, OS X 10.15, Android 10, or Linux
HTTP Header: spoofed as Windows 10 or Android 10 until FF136 then matches JS spoof
1369319 - disable device sensor API
1369357 - disable site specific zoom
1337161 - hide gamepads from content
1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true
1333641 - reduce fingerprinting in WebSpeech API
FF57
1369309 - spoof media statistics
1382499 - reduce screen co-ordinate fingerprinting in Touch API
1217290 & 1409677 - enable some fingerprinting resistance for WebGL
1354633 - limit MediaError.message to a whitelist
FF58+
1372073 - spoof/block fingerprinting in MediaDevices API (FF59)
Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone"
Block: suppresses the ondevicechange event
1039069 - warn when language prefs are not set to "en*" (FF59)
1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59)
Spoofing mimics the content language of the document. Currently it only supports en-US.
Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62)
1479239 - return "no-preference" with prefers-reduced-motion (FF63)
1363508 & 1826051 & 1957658 - spoof/suppress Pointer Events, spoof maxTouchPoints (FF64, FF132, FF143, ESR140.2)
FF64: maxTouchPoints: 0 = desktop
FF132: maxTouchPoints: 0 = mac | 10 = windows, linux, mobile
FF143/140.2: maxTouchPoints: 0 = mac, linux | 10 = windows | 5 = mobile
1492766 - spoof pointerEvent.pointerid (FF65)
1485266 - disable exposure of system colors to CSS or canvas (FF67)
1494034 - return "light" with prefers-color-scheme (FF67)
1564422 - spoof audioContext outputLatency (FF70)
1595823 - return audioContext sampleRate as 44100 (FF72)
1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74)
1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78)
1506364 - return "no-preference" with prefers-contrast (FF80)
1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80)
1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82)
531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1)
1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102)
1422237 - return "srgb" with color-gamut (FF110)
1794628 - return "none" with inverted-colors (FF114)
1787790 - normalize system fonts (FF128)
1835987 - spoof timezone as Atlantic/Reykjavik (previously FF55+ was UTC) (FF128)
1656377 - spoof pointerEvents azimuthAngle and altitudeAngle (FF131)
1834307 - always use smooth scrolling (FF132)
1918202 - spoof screen orientation based on spoofed screen size and platform (FF132)
previously FF50+ it always returned landscape-primary and an angle of 0
1390465 - load all subtitles in WebVTT (Video Text Tracks) (FF133)
1873382 - make spoofed devicePixelRatio and CSS media queries match (FF133)
previously FF41+ devicePixelRatio was hardcoded as 1 and FF127+ as 2
previously FF41+ CSS media queries were spoofed as zoom level at a devicePixelRatio of 1
1955425 - return 128 for WebGPU subgroupMaxSize (FF138)
1966860 - spoof WebGL debug renderer info (FF140)
previously FF60+ it was disabled
1781277 - return 10GiB for storage estimate until persistent-storage granted (FF142, ESR140.1)
1972600 - spoof network connection for HTMLMediaElement preload (FF142, ESR140.1)
1975851 - return true for navigator.onLine (FF142, ESR140.1)
1973265 - disable WebCodecs API (FF142)
1984333 - spoof navigator.hardwareConcurrency as 4 except mac return 8 (FF143+)
previously FF55+ it returned 2
***/
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
/* 4501: enable RFP
* [NOTE] pbmode applies if true and the original pref is false
* [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar.
* RFP also has a few side effects: mainly that timezone is GMT, and websites will prefer light theme ***/
// user_pref("privacy.resistFingerprinting", true); // [FF41+]
// user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+]
/* 4502: set RFP new window size max rounded values [FF55+]
* [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen
* [1] https://bugzilla.mozilla.org/1330882 ***/
user_pref("privacy.window.maxInnerWidth", 1600);
user_pref("privacy.window.maxInnerHeight", 900);
/* 4503: disable mozAddonManager Web API [FF57+]
* [NOTE] To allow extensions to work on AMO, you also need 2662
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
user_pref("privacy.resistFingerprinting.block_mozAddonManager", true);
/* 4504: enable letterboxing [FF67+]
* Dynamically resizes the inner window by applying margins in stepped ranges [2]
* If you use the dimension pref, then it will only apply those resolutions.
* The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000")
* [SETUP-WEB] This is independent of RFP (4501). If you're using RFP, but dislike the
* margins, then don't enable this pref, keeping in mind that it is effectively fingerprintable
* [WARNING] DO NOT USE: the dimension pref is only meant for testing
* [1] https://bugzilla.mozilla.org/1407366
* [2] https://hg.mozilla.org/mozilla-central/rev/7211cb4f58ff#l5.13 ***/
// user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
// user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF]
/* 4505: disable RFP by domain [FF91+]
* [NOTE]: The pref takes comma separated values: e.g. "*domain1.tld, *domain2.tld"
* Working domain examples: "arkenfox.github.io", "*github.io"
* Non-working domain examples: "https://arkenfox.github.io", "github.io", "*arkenfox.github.io" ***/
// user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid");
/* 4506: disable RFP spoof english prompt [FF59+]
* 0=prompt, 1=disabled, 2=enabled
* [NOTE] When changing from value 2, preferred languages ('intl.accept_languages') is not reset.
* [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale.
* [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/
user_pref("privacy.spoof_english", 1);
/* 4507: skip browser.startup.blankWindow if RFP is used [FF136+] ***/
// user_pref("privacy.resistFingerprinting.skipEarlyBlankFirstPaint", true); // [DEFAULT: true]
/* 4510: enforce Contrast Control off [FF138+]
* 0=automatic, 1=off, 2=custom
* [SETTING] General>Language and Appearance>Contrast Control ***/
// user_pref("browser.display.document_color_use", 1); // [DEFAULT: 1 NON-WINDOWS]
/* 4511: disable using system accent colors ***/
user_pref("widget.non-native-theme.use-theme-accent", false); // [DEFAULT: false WINDOWS]
/* 4512: enforce links targeting new windows to open in a new tab instead
* 1=most recent window or tab, 2=new window, 3=new tab
* Stops malicious window sizes and some screen resolution leaks.
* You can still right-click a link and open in a new window
* [SETTING] General>Tabs>Open links in tabs instead of new windows
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3]
/* 4513: set all open window methods to abide by "browser.link.open_newwindow" (4512)
* [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/
user_pref("browser.link.open_newwindow.restriction", 0);
/* 4520: disable WebGL (Web Graphics Library) ***/
// user_pref("webgl.disabled", true);
/*** [SECTION 5000]: OPTIONAL OPSEC
Disk avoidance, application data isolation, eyeballs...
***/
user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow");
/* 5001: start Firefox in PB (Private Browsing) mode
* [NOTE] In this mode all windows are "private windows" and the PB mode icon is not displayed
* [NOTE] The P in PB mode can be misleading: it means no "persistent" disk state such as history,
* caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode).
* In fact, PB mode limits or removes the ability to control some of these, and you need to quit
* Firefox to clear them. PB is best used as a one off window (Menu>New Private Window) to provide
* a temporary self-contained new session. Close all private windows to clear the PB session.
* [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode
* [1] https://wiki.mozilla.org/Private_Browsing
* [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/
// user_pref("browser.privatebrowsing.autostart", true);
/* 5002: disable memory cache
* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
// user_pref("browser.cache.memory.enable", false);
// user_pref("browser.cache.memory.capacity", 0);
/* 5003: disable saving passwords
* [NOTE] This does not clear any passwords already saved
* [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/
// user_pref("signon.rememberSignons", false);
/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART]
* [NOTE] This means any permission changes are session only
* [1] https://bugzilla.mozilla.org/967812 ***/
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
/* 5005: disable intermediate certificate caching [FF41+] [RESTART]
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
* Saved logins and passwords are not available. Reset the pref and restart to return them ***/
// user_pref("security.nocertdb", true);
/* 5006: disable favicons in history and bookmarks
* [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your
* actual history (and bookmarks) already do. Your history is more detailed, so
* control that instead; e.g. disable history, clear history on exit, use PB mode
* [NOTE] favicons.sqlite is sanitized on Firefox close ***/
// user_pref("browser.chrome.site_icons", false);
/* 5007: exclude "Undo Closed Tabs" in Session Restore ***/
// user_pref("browser.sessionstore.max_tabs_undo", 0);
/* 5008: disable resuming session from crash
* [TEST] about:crashparent ***/
// user_pref("browser.sessionstore.resume_from_crash", false);
/* 5009: disable "open with" in download dialog [FF50+]
* Application data isolation [1]
* [1] https://bugzilla.mozilla.org/1281959 ***/
// user_pref("browser.download.forbid_open_with", true);
/* 5010: disable location bar suggestion types
* [SETTING] Search>Address Bar>When using the address bar, suggest ***/
// user_pref("browser.urlbar.suggest.history", false);
// user_pref("browser.urlbar.suggest.bookmark", false);
// user_pref("browser.urlbar.suggest.openpage", false);
// user_pref("browser.urlbar.suggest.topsites", false); // [FF78+]
/* 5011: disable location bar dropdown
* This value controls the total number of entries to appear in the location bar dropdown ***/
// user_pref("browser.urlbar.maxRichResults", 0);
/* 5012: disable location bar autofill
* [1] https://support.mozilla.org/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/
// user_pref("browser.urlbar.autoFill", false);
/* 5013: disable browsing and download history
* [NOTE] We also clear history and downloads on exit (2811+)
* [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/
// user_pref("places.history.enabled", false);
/* 5014: disable Windows jumplist [WINDOWS] ***/
// user_pref("browser.taskbar.lists.enabled", false);
// user_pref("browser.taskbar.lists.frequent.enabled", false);
// user_pref("browser.taskbar.lists.recent.enabled", false);
// user_pref("browser.taskbar.lists.tasks.enabled", false);
/* 5016: discourage downloading to desktop
* 0=desktop, 1=downloads (default), 2=custom
* [SETTING] To set your custom default "downloads": General>Downloads>Save files to ***/
// user_pref("browser.download.folderList", 2);
/* 5017: disable Form Autofill
* If .supportedCountries includes your region (browser.search.region) and .supported
* is "detect" (default), then the UI will show. Stored data is not secure, uses JSON
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
// user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
// user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
/* 5018: limit events that can cause a pop-up ***/
// user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
/* 5019: disable page thumbnail collection ***/
// user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/
// user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false);
/* 5021: disable location bar using search
* Don't leak URL typos to a search engine, give an error message instead
* Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
* [NOTE] This does not affect explicit user action such as using search buttons in the
* dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) ***/
// user_pref("keyword.enabled", false);
/*** [SECTION 5500]: OPTIONAL HARDENING
Not recommended. Overriding these can cause breakage and performance issues,
they are mostly fingerprintable, and the threat model is practically nonexistent
***/
user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!");
/* 5501: disable MathML (Mathematical Markup Language) [FF51+]
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/
// user_pref("mathml.disabled", true); // 1173199
/* 5502: disable in-content SVG (Scalable Vector Graphics) [FF53+]
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/
// user_pref("svg.disabled", true); // 1216893
/* 5503: disable graphite
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
// user_pref("gfx.font_rendering.graphite.enabled", false);
/* 5504: disable asm.js [FF22+]
* [1] http://asmjs.org/
* [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
* [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
// user_pref("javascript.options.asmjs", false);
/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART]
* [NOTE] When both Ion and JIT are disabled, and trustedprincipals
* is enabled, then Ion can still be used by extensions (1599226)
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit
* [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ ***/
// user_pref("javascript.options.ion", false);
// user_pref("javascript.options.baselinejit", false);
// user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF]
/* 5506: disable WebAssembly [FF52+]
* Vulnerabilities [1] have increasingly been found, including those known and fixed
* in native programs years ago [2]. WASM has powerful low-level access, making
* certain attacks (brute-force) and vulnerabilities more possible
* [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3]
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm
* [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
* [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/
// user_pref("javascript.options.wasm", false);
/* 5507: disable rendering of SVG OpenType fonts ***/
// user_pref("gfx.font_rendering.opentype_svg.enabled", false);
/* 5508: disable all DRM (Digital Rights Management) content (EME: Encryption Media Extension)
* Optionally hide the UI setting which also disables the DRM prompt
* [SETTING] General>DRM Content>Play DRM-controlled content
* [TEST] https://bitmovin.com/demos/drm
* [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/
// user_pref("media.eme.enabled", false);
// user_pref("browser.eme.ui.enabled", false);
/* 5509: disable IPv6 if using a VPN
* This is an application level fallback. Disabling IPv6 is best done at an OS/network
* level, and/or configured properly in system wide VPN setups.
* [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT"
* [SETUP-WEB] PR_CONNECT_RESET_ERROR
* [TEST] https://ipleak.org/
* [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/
// user_pref("network.dns.disableIPv6", true);
/* 5510: control when to send a cross-origin referer
* 0=always (default), 1=only if base domains match, 2=only if hosts match
* [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/
// user_pref("network.http.referer.XOriginPolicy", 2);
/* 5511: set DoH bootstrap address [FF89+]
* Firefox uses the system DNS to initially resolve the IP address of your DoH server.
* When set to a valid, working value that matches your "network.trr.uri" (0712) Firefox
* won't use the system DNS. If the IP doesn't match then DoH won't work ***/
// user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF]
/*** [SECTION 6000]: DON'T TOUCH ***/
user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!");
/* 6001: enforce Firefox blocklist
* [WHY] It includes updates for "revoked certificates"
* [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/
user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true]
/* 6002: enforce no referer spoofing
* [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/
user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false]
/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save
* [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000]
/* 6008: enforce no First Party Isolation [FF51+]
* [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI
* disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/
user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false]
/* 6009: enforce SmartBlock shims (about:compat) [FF81+]
* [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/
user_pref("extensions.webcompat.enable_shims", true); // [HIDDEN PREF] [DEFAULT: true]
/* 6010: enforce no TLS 1.0/1.1 downgrades
* [TEST] https://tls-v1-1.badssl.com:1010/ ***/
user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false]
/* 6011: enforce disabling of Web Compatibility Reporter [FF56+]
* Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla
* [WHY] To prevent wasting Mozilla's time with a custom setup ***/
user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false]
/* 6012: enforce Quarantined Domains [FF115+]
* [WHY] https://support.mozilla.org/kb/quarantined-domains ***/
user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true]
/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF128+ ***/
// user_pref("privacy.clearOnShutdown.cache", "");
// user_pref("privacy.clearOnShutdown.cookies", "");
// user_pref("privacy.clearOnShutdown.downloads", "");
// user_pref("privacy.clearOnShutdown.formdata", "");
// user_pref("privacy.clearOnShutdown.history", "");
// user_pref("privacy.clearOnShutdown.offlineApps", "");
// user_pref("privacy.clearOnShutdown.sessions", "");
// user_pref("privacy.cpd.cache", "");
// user_pref("privacy.cpd.cookies", "");
// user_pref("privacy.cpd.formdata", "");
// user_pref("privacy.cpd.history", "");
// user_pref("privacy.cpd.offlineApps", "");
// user_pref("privacy.cpd.sessions", "");
/* 6051: prefsCleaner: reset previously active items removed from arkenfox FF140+ ***/
// user_pref("browser.display.use_system_colors", "");
/*** [SECTION 7000]: DON'T BOTHER ***/
user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!");
/* 7001: disable APIs
* Location-Aware Browsing, Full Screen
* [WHY] The API state is easily fingerprintable.
* Geo is behind a prompt (7002). Full screen requires user interaction ***/
// user_pref("geo.enabled", false);
// user_pref("full-screen-api.enabled", false);
/* 7002: set default permissions
* Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+]
* 0=always ask (default), 1=allow, 2=block
* [WHY] These are fingerprintable via Permissions API, except VR. Just add site
* exceptions as allow/block for frequently visited/annoying sites: i.e. not global
* [SETTING] to add site exceptions: Ctrl+I>Permissions>
* [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/
// user_pref("permissions.default.geo", 0);
// user_pref("permissions.default.camera", 0);
// user_pref("permissions.default.microphone", 0);
// user_pref("permissions.default.desktop-notification", 0);
// user_pref("permissions.default.xr", 0); // Virtual Reality
/* 7003: disable non-modern cipher suites [1]
* [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks
* [1] https://browserleaks.com/ssl ***/
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
// user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS
// user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS
// user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS
// user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS
/* 7004: control TLS versions
* [WHY] Passive fingerprinting and security ***/
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3]
// user_pref("security.tls.version.max", 4);
/* 7005: disable SSL session IDs [FF36+]
* [WHY] Passive fingerprinting and perf costs. These are session-only
* and isolated with network partitioning (FF85+) and/or containers ***/
// user_pref("security.ssl.disable_session_identifiers", true);
/* 7007: referers
* [WHY] Only cross-origin referers (1602, 5510) matter ***/
// user_pref("network.http.sendRefererHeader", 2);
// user_pref("network.http.referer.trimmingPolicy", 0);
/* 7008: set the default Referrer Policy [FF59+]
* 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
* [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/
// user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2]
// user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2]
/* 7010: disable HTTP Alternative Services [FF37+]
* [WHY] Already isolated with network partitioning (FF85+) ***/
// user_pref("network.http.altsvc.enabled", false);
/* 7011: disable website control over browser right-click context menu
* [WHY] Just use Shift-Right-Click ***/
// user_pref("dom.event.contextmenu.enabled", false);
/* 7012: disable icon fonts (glyphs) and local fallback rendering
* [WHY] Breakage, font fallback is equivalency, also RFP
* [1] https://bugzilla.mozilla.org/789788
* [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
// user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
// user_pref("gfx.downloadable_fonts.fallback_delay", -1);
/* 7013: disable Clipboard API
* [WHY] Fingerprintable. Breakage. Cut/copy/paste require user
* interaction, and paste is limited to focused editable fields ***/
// user_pref("dom.event.clipboardevents.enabled", false);
/* 7014: disable System Add-on updates
* [WHY] It can compromise security. System addons ship with prefs, use those ***/
// user_pref("extensions.systemAddon.update.enabled", false); // [FF62+]
// user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
/* 7015: enable the DNT (Do Not Track) HTTP header
* [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/
// user_pref("privacy.donottrackheader.enabled", true);
/* 7016: customize ETP settings
* [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled
* [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/
// user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5]
// user_pref("network.cookie.cookieBehavior.optInPartitioning", true); // [ETP FF132+]
// user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true);
// user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+]
// user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+]
// user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+]
// user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true]
// user_pref("privacy.query_stripping.enabled", true); // [FF101+]
// user_pref("privacy.trackingprotection.enabled", true);
// user_pref("privacy.trackingprotection.socialtracking.enabled", true);
// user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true]
// user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true]
/* 7017: disable service workers
* [WHY] Already isolated with TCP (2701) behind a pref ***/
// user_pref("dom.serviceWorkers.enabled", false);
/* 7018: disable Web Notifications [FF22+]
* [WHY] Web Notifications are behind a prompt (7002)
* [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/
// user_pref("dom.webnotifications.enabled", false);
/* 7019: disable Push Notifications [FF44+]
* [WHY] Website "push" requires subscription, and the API is required for CRLite (1224)
* [NOTE] To remove all subscriptions, reset "dom.push.userAgentID"
* [1] https://support.mozilla.org/kb/push-notifications-firefox ***/
// user_pref("dom.push.enabled", false);
/* 7020: disable WebRTC (Web Real-Time Communication)
* [WHY] Firefox desktop uses mDNS hostname obfuscation and the private IP is never exposed until
* required in TRUSTED scenarios; i.e. after you grant device (microphone or camera) access
* [TEST] https://browserleaks.com/webrtc
* [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ
* [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/
// user_pref("media.peerconnection.enabled", false);
/* 7021: enable GPC (Global Privacy Control) in non-PB windows
* [WHY] Passive and active fingerprinting. Mostly redundant with Tracking Protection
* in ETP Strict (2701) and sanitizing on close (2800s) ***/
// user_pref("privacy.globalprivacycontrol.enabled", true);
/*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING
[WHY] They are insufficient to help anti-fingerprinting and do more harm than good
[WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere
***/
user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan");
/* 8001: prefsCleaner: reset items useless for anti-fingerprinting ***/
// user_pref("browser.display.use_document_fonts", "");
// user_pref("browser.zoom.siteSpecific", "");
// user_pref("device.sensors.enabled", "");
// user_pref("dom.enable_performance", "");
// user_pref("dom.enable_resource_timing", "");
// user_pref("dom.gamepad.enabled", "");
// user_pref("dom.maxHardwareConcurrency", "");
// user_pref("dom.w3c_touch_events.enabled", "");
// user_pref("dom.webaudio.enabled", "");
// user_pref("font.system.whitelist", "");
// user_pref("general.appname.override", "");
// user_pref("general.appversion.override", "");
// user_pref("general.buildID.override", "");
// user_pref("general.oscpu.override", "");
// user_pref("general.platform.override", "");
// user_pref("general.useragent.override", "");
// user_pref("media.navigator.enabled", "");
// user_pref("media.video_stats.enabled", "");
// user_pref("media.webspeech.synth.enabled", "");
// user_pref("ui.use_standins_for_native_colors", "");
// user_pref("webgl.enable-debug-renderer-info", "");
/*** [SECTION 8500]: TELEMETRY
Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below.
But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides.
Opt-out
- Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain
- Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading
Choice
- Every new profile on first use provides data collection/use policy and the abillty to opt-out
- It can be disabled at any time (Settings>Privacy & Security>Data Collection and Use)
Data
- no PII (Personally Identifiable Information)
- can be viewed in about:telemetry
- uses Prio [1][2][3], Glean [4], Oblivious HTTP [5][6]
[1] https://crypto.stanford.edu/prio/
[2] https://hacks.mozilla.org/2018/10/testing-privacy-preserving-telemetry-with-prio/
[3] https://blog.mozilla.org/security/2019/06/06/next-steps-in-privacy-preserving-telemetry-with-prio/
[4] https://firefox-source-docs.mozilla.org/toolkit/components/glean/index.html
[5] https://firefox-source-docs.mozilla.org/toolkit/components/glean/user/ohttp.html
[6] https://blog.mozilla.org/en/tag/oblivious-http/
***/
user_pref("_user.js.parrot", "8500 syntax error: the parrot's off the twig!");
/* 8500: disable new data submission [FF41+]
* If disabled, no policy is shown or upload takes place, ever
* [1] https://bugzilla.mozilla.org/1195552 ***/
user_pref("datareporting.policy.dataSubmissionEnabled", false);
/* 8501: disable Health Reports
* [SETTING] Privacy & Security>Firefox Data Collection and Use>Send technical... data ***/
user_pref("datareporting.healthreport.uploadEnabled", false);
/* 0802: disable telemetry
* The "unified" pref affects the behavior of the "enabled" pref
* - If "unified" is false then "enabled" controls the telemetry module
* - If "unified" is true then "enabled" only controls whether to record extended data
* [NOTE] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true) or release builds (false) [2]
* [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
* [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
user_pref("toolkit.telemetry.unified", false);
user_pref("toolkit.telemetry.enabled", false); // see [NOTE]
user_pref("toolkit.telemetry.server", "data:,");
user_pref("toolkit.telemetry.archive.enabled", false);
user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+]
user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+]
user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+]
/* 8503: disable Telemetry Coverage
* [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/
user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF]
user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF]
user_pref("toolkit.coverage.endpoint.base", "");
/*** [SECTION 9000]: NON-PROJECT RELATED ***/
user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!");
/* 9001: disable welcome notices ***/
user_pref("browser.startup.homepage_override.mstone", "ignore"); // [HIDDEN PREF]
/* 9002: disable General>Browsing>Recommend extensions/features as you browse [FF67+] ***/
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
/* 9004: disable search terms [FF110+]
* [SETTING] Search>Search Bar>Use the address bar for search and navigation>Show search terms instead of URL... ***/
user_pref("browser.urlbar.showSearchTerms.enabled", false);
/*** [SECTION 9999]: DEPRECATED / RENAMED ***/
user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!");
/* ESR128.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable active ones
// FF132
// 2617: remove webchannel whitelist
// [-] https://bugzilla.mozilla.org/1275612
// user_pref("webchannel.allowObject.urlWhitelist", "");
// FF140
// 0323: disable shopping experience [FF116+]
// [-] https://bugzilla.mozilla.org/1964845
// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156#c0
user_pref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false]
// 0806: disable urlbar suggestions
// [-] https://bugzilla.mozilla.org/1959497
user_pref("browser.urlbar.pocket.featureGate", false); // [FF116+] [DEFAULT: false]
// ***/
/* END: internal custom pref to test for syntax errors ***/
user_pref("_user.js.parrot", "SUCCESS: No no he's not dead, he's, he's restin'!");
gitextract_yp2a848f/ ├── .gitattributes ├── .github/ │ └── ISSUE_TEMPLATE/ │ ├── tools.md │ ├── troubleshooting-help.md │ └── user-js.md ├── .travis.yml ├── LICENSE.txt ├── README.md ├── _config.yml ├── prefsCleaner.bat ├── prefsCleaner.sh ├── scratchpad-scripts/ │ ├── arkenfox-cleanup.js │ └── troubleshooter.js ├── updater.bat ├── updater.sh └── user.js
SYMBOL INDEX (5 symbols across 1 files)
FILE: scratchpad-scripts/troubleshooter.js
function getMyList (line 105) | function getMyList(arr) {
function reapply (line 128) | function reapply(arr) {
function myreset (line 146) | function myreset(arr) {
function resetAllMatchingDefault (line 150) | function resetAllMatchingDefault(arr) {
function _main (line 156) | function _main(aALL) {
Condensed preview — 15 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (142K chars).
[
{
"path": ".gitattributes",
"chars": 211,
"preview": "* text=auto\n\n*.js text\n*.md text\n*.yml text\n*.txt text\n*.sh text\n## *.bat text eol=crlf\n*.bat -text\n\n*.png binary\n\n.gita"
},
{
"path": ".github/ISSUE_TEMPLATE/tools.md",
"chars": 367,
"preview": "---\nname: Tools\nabout: Report issues with the updaters, the troubleshooter, or any other tools.\ntitle: ''\nlabels: ''\nass"
},
{
"path": ".github/ISSUE_TEMPLATE/troubleshooting-help.md",
"chars": 785,
"preview": "---\nname: Troubleshooting help\nabout: Ask for help to solve problems with user.js\ntitle: 'follow instructions or this wi"
},
{
"path": ".github/ISSUE_TEMPLATE/user-js.md",
"chars": 960,
"preview": "---\nname: user.js\nabout: Suggest changes to user.js\ntitle: ''\nlabels: ''\nassignees: ''\n\n---\n\nWe value feedback in genera"
},
{
"path": ".travis.yml",
"chars": 104,
"preview": "language: node_js\nnode_js:\n - \"node\"\nbefore_script:\n - npm install -g acorn\nscript:\n - acorn user.js\n"
},
{
"path": "LICENSE.txt",
"chars": 1065,
"preview": "MIT License\n\nCopyright (c) 2020 arkenfox\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\no"
},
{
"path": "README.md",
"chars": 2041,
"preview": "### 🟪 user.js\nA `user.js` is a configuration file that can control Firefox settings - for a more technical breakdown an"
},
{
"path": "_config.yml",
"chars": 179,
"preview": "theme: jekyll-theme-midnight\ntitle: user.js\ndescription: An ongoing comprehensive user.js template for configuring and h"
},
{
"path": "prefsCleaner.bat",
"chars": 4167,
"preview": "@ECHO OFF & SETLOCAL DisableDelayedExpansion\r\nTITLE prefs.js cleaner\r\n\r\nREM ### prefs.js cleaner for Windows\r\nREM ## aut"
},
{
"path": "prefsCleaner.sh",
"chars": 6013,
"preview": "#!/usr/bin/env bash\n\n## prefs.js cleaner for Linux/Mac\n## author: @claustromaniac\n## version: 2.1\n\n## special thanks to "
},
{
"path": "scratchpad-scripts/arkenfox-cleanup.js",
"chars": 6340,
"preview": "/***\n This will reset the preferences that since FF91 have been\n - removed from the arkenfox user.js\n - deprecated by"
},
{
"path": "scratchpad-scripts/troubleshooter.js",
"chars": 7072,
"preview": "/*** arkenfox user.js troubleshooter.js v1.6.3 ***/\n\n(function() {\n\n if (\"undefined\" === typeof(Services)) return alert"
},
{
"path": "updater.bat",
"chars": 10928,
"preview": "@ECHO OFF & SETLOCAL EnableDelayedExpansion\r\nTITLE arkenfox user.js updater\r\n\r\nREM ## arkenfox user.js updater for Windo"
},
{
"path": "updater.sh",
"chars": 13803,
"preview": "#!/usr/bin/env bash\n\n## arkenfox user.js updater for macOS and Linux\n\n## version: 4.0\n## Author: Pat Johnson (@overdodac"
},
{
"path": "user.js",
"chars": 80779,
"preview": "/******\n* name: arkenfox user.js\n* date: 4 November 2025\n* version: 140\n* urls: https://github.com/arkenfox/use"
}
]
About this extraction
This page contains the full source code of the arkenfox/user.js GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 15 files (131.7 KB), approximately 37.3k tokens, and a symbol index with 5 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.