ToDo: diffs FF59-FF60 #383
Comments
bugzilla tickets
|
|
^^I have asked/pointed the CSS Exfill author to your question. Cheers |
|
Hi all, I'm the author of CSS Exfil Protection. To answer Thorin's question, no I don't believe this removal would make the plugin obsolete as the plugin guards against several other methods that could be used to exfil data (background-image, list-style, cursor, & content). Actually, the plugin as it stands today does not block anything related to the -moz-document selector. Today is the first I've heard of this selector, although it sounds like it's getting phased out so it's likely I won't need to add protection. (PS - I would love for a day when my plugin becomes completely obsolete. Although it's fun hacking away at it, I'd rather see the protection offered by default in major browsers.) |
See here.
See here. While @mlgualtieri plugin works by pre-processing the CSS which is loaded onto a web page.
|
|
certain syntax errors stop the parsing and the debug pref is still useful in those cases. We just need to change the last one to something less definite. |
|
60b9 changes since 60b5 newpref("browser.cache.offline.insecure.enable", true); // 60b5: false removed, renamed or hidden
changed
EDIT: updated 1st post |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
IDK about that. If you don't trust your installed webextensions it might be a good idea. But if f.e a hacker manages to inject external JS into one of those domains, you'd normally see + block that with uMatrix. |
|
|
|
https://wiki.mozilla.org/Firefox/BrowserErrorCollection |
|
|
|
yeah let's NOT do that. You've seen the countless reddit posts asking why AMO detects their FFs as an older version. I assume, based on the mozAddonManager pref being an RFP sub-pref, the whole point of the mozAddonManager was to be able to detect the FF version despite RFP. |
|
I'd put it under 2600, something like this: /* 26xx: disable webextension restrictions on certain mozilla domains (FF60+) ***/
// user_pref("extensions.webextensions.restrictedDomains", "");add notes and/or warnings as you see fit, f.e. that several mozilla domains use google analytics and noscript etc won't be able to block that. |
|
For 3rd party scripts only, starting from FF 43 until today:
...see link here. |
|
If the 1st party uses web workers, then it is able to use IndexedDB. |
|
I totally agree! But it cannot be an oversight. |
|
60b16 changes since 60b9 newpref("app.normandy.first_run", true); changed
EDIT: updated 1st post |
|
Here's the meta bug for same-site cookies: https://bugzilla.mozilla.org/show_bug.cgi?id=samesite-cookies Probably no point in listing this pref in |
|
Is this the same as uMatrix rule... ...which reads as allow outbound 1st-party cookies and deny outbound 3rd-party cookies? |
|
|
|
@fmarier thx |
|
I agree with @fmarier in that we don't need the pref in the user.js per se but I think it's a nice new feature and worth adding for the links alone. something like this: /* 27xx: enable support for same-site cookies (FF60+)
* [NOTE] support for same-site cookies is enabled by default but we don't enforce it
* in case mozilla needs to turn it off quickly due to unforeseen bugs/breakage.
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=samesite-cookies
* [2] https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/
* [3] https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/ ***/
// user_pref("network.cookie.same-site.enabled", true); // default: true |
|
AFAIK FPI only works on domain anyway ie secure.bank.com has access to cookies etc from bank.com and vice-versa. same-site cookies makes it so that when you click a link to yourbank.com and you happen to be logged in to yourbank.com in another tab (or didn't logout) the cookie will not be sent and therefore preventing potential CSRF. FPI has nothing to do with that. EDIT: not just links but some other things as well, like certain forms and whatnot, see the .nl link for details. |
|
my 2 cents:
changed: IMO move to ignore: |
|
👖 you forgot to move 0512 to deprecated/removed |
yes exactly. I already planned to change the way I retrieve the default prefs for the next diff because of some changes mozilla made in 61 but I'll update this diff as well as soon as FF60 portable is available. I'll have to install a certain version to get a diff for it and thus I won't be able to create OS-diffs anymore because I don't have a Mac. |
|
|
updated the 1st post.
click me
pref("browser.newtabpage.activity-stream.collapseTopSites", false);
pref("browser.newtabpage.activity-stream.default.sites", "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/");
pref("browser.newtabpage.activity-stream.disableSnippets", false);
pref("browser.newtabpage.activity-stream.enableWideLayout", true);
pref("browser.newtabpage.activity-stream.feeds.favicon", true);
pref("browser.newtabpage.activity-stream.feeds.migration", true);
pref("browser.newtabpage.activity-stream.feeds.newtabinit", true);
pref("browser.newtabpage.activity-stream.feeds.places", true);
pref("browser.newtabpage.activity-stream.feeds.prefs", true);
pref("browser.newtabpage.activity-stream.feeds.section.highlights", true);
pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
pref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"api_key_pref\":\"extensions.pocket.oAuthConsumerKey\",\"hidden\":true,\"provider_description\":\"pocket_description\",\"provider_icon\":\"pocket\",\"provider_name\":\"Pocket\",\"read_more_endpoint\":\"https://getpocket.com/explore/trending?src=fx_new_tab\",\"stories_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off\",\"stories_referrer\":\"https://getpocket.com/recommendations\",\"privacy_notice_link\":\"https://www.mozilla.org/privacy/firefox/#suggest-relevant-content\",\"disclaimer_link\":\"https://getpocket.com/firefox/new_tab_learn_more\",\"topics_endpoint\":\"https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lang=en-US\",\"show_spocs\":false,\"personalized\":true}");
pref("browser.newtabpage.activity-stream.feeds.sections", true);
pref("browser.newtabpage.activity-stream.feeds.snippets", true);
pref("browser.newtabpage.activity-stream.feeds.systemtick", true);
pref("browser.newtabpage.activity-stream.feeds.telemetry", true);
pref("browser.newtabpage.activity-stream.feeds.topsites", true);
pref("browser.newtabpage.activity-stream.filterAdult", true);
pref("browser.newtabpage.activity-stream.migrationExpired", false);
pref("browser.newtabpage.activity-stream.migrationLastShownDate", 0);
pref("browser.newtabpage.activity-stream.migrationRemainingDays", 4);
pref("browser.newtabpage.activity-stream.section.highlights.collapsed", false);
pref("browser.newtabpage.activity-stream.section.highlights.includePocket", true);
pref("browser.newtabpage.activity-stream.section.topstories.collapsed", false);
pref("browser.newtabpage.activity-stream.section.topstories.showDisclaimer", true);
pref("browser.newtabpage.activity-stream.sectionOrder", "topsites,topstories,highlights");
pref("browser.newtabpage.activity-stream.showSearch", true);
pref("browser.newtabpage.activity-stream.showSponsored", true);
pref("browser.newtabpage.activity-stream.showTopSites", true);
pref("browser.newtabpage.activity-stream.telemetry", true);
pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "https://tiles.services.mozilla.com/v4/links/activity-stream");
pref("browser.newtabpage.activity-stream.telemetry.ut.events", false);
pref("browser.newtabpage.activity-stream.tippyTop.service.endpoint", "https://activity-stream-icons.services.mozilla.com/v1/icons.json.br");
pref("browser.newtabpage.activity-stream.topSitesRows", 1);
pref("extensions.pocket.api", "api.getpocket.com");
pref("extensions.pocket.oAuthConsumerKey", "40249-e88c401e1b1f2242d9e441c4");
pref("extensions.pocket.site", "getpocket.com");
pref("extensions.webcompat.perform_ua_overrides", true);
pref("pdfjs.cursorToolOnLoad", 0);
pref("pdfjs.defaultZoomValue", "");
pref("pdfjs.disableAutoFetch", false);
pref("pdfjs.disableFontFace", false);
pref("pdfjs.disablePageLabels", false);
pref("pdfjs.disablePageMode", false);
pref("pdfjs.disableRange", false);
pref("pdfjs.disableStream", false);
pref("pdfjs.enablePrintAutoRotate", false);
pref("pdfjs.enableWebGL", false);
pref("pdfjs.externalLinkTarget", 0);
pref("pdfjs.pdfBugEnabled", false);
pref("pdfjs.renderer", "canvas");
pref("pdfjs.renderInteractiveForms", false);
pref("pdfjs.showPreviousViewOnLoad", true);
pref("pdfjs.sidebarViewOnLoad", 0);
pref("pdfjs.textLayerMode", 1);
pref("pdfjs.useOnlyCssZoom", false); |
really? https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5158 |
|
Anything related to pdf and office files isn't secure. They are widely used, sent by mail and exploited. |
|
wanna finish this? what to do with the parrot? change the header of the first pref? what's the relevance of link 2? |
👍 IDK if we need the 3rd link either. Better to just explain what it means for users. maybe something like
|
probably not. Maybe if someone asks them to. The prefs are already there and it would be a simple change.
👍 re: moz-document - FF61 will also have an exception to avoid most breakage. It's unlikely that this will be backported to ESR. "ignore it since it will be covered by default in 61+" 👍
and maybe one for RFP-ALTS? |
|
cleanup scripts: I kinda liked the [changes-only] because users can reset everything with a single script. Otherwise they need to run 3 or 4 and commented-out won't be covered. |
everything we removed since last release only enforced the default values and doesn't need to be reset because they weren't stored in prefs.js anyway. |
|
you have all of them in the list above |
new in v59 stuff we forgot
layout.css.moz-document.content.enabled=falsedom.registerContentHandler.enabledscratchpad scripts
new in v60.0:
security.insecure_connection_text*- 1335970 - e373a0f5000removed, renamed or hidden in v60.0:
ALL DONE - d10c859 & 8f2b674 & c5a1a03
changed in v60.0:
privacy.resistFingerprinting.block_mozAddonManager(4503) -> active - 7d65d8cextensions.webextensions.restrictedDomains1202redundant in 60 due to RFP privacy.resistFingerprinting
20111337157 - c4a1583ignore
click me for details
==NEW
==REMOVED or HIDDEN
==CHANGED
The text was updated successfully, but these errors were encountered: