foxgirl-settings/librewolf.cfg

//----------------------|
//  LibreWolf settings  |
//----------------------|

/**
 
 NOTE: please take the time to read and understand, but also to customize the settings to find your own setup.
 the answers to the most common questions are at this link https://gitlab.com/librewolf-community/settings/-/wikis/FAQ
 
 */

defaultPref("librewolf.cfg.version", "2.0");

// -------------------------------------------
// # SANITIZING COOKIES AND HISTORY, SESSIONS
// -------------------------------------------

defaultPref("network.cookie.cookieBehavior", 5); // dFPI, same as strict mode
defaultPref("network.cookie.lifetimePolicy", 2); // keep cookies until the browser is closed then delete everything minus exceptions

// make third party and http cookies session-only
defaultPref("network.cookie.thirdparty.sessionOnly", true);
defaultPref("network.cookie.thirdparty.nonsecureSessionOnly", true);

/**
 this way of sanitizing would override the exceptions set by the users and just delete everything,
 therefore we tell it to delete everything but ignore data needed to stay logged into websites set
 manually as exceptions.
*/
defaultPref("privacy.clearOnShutdown.cookies", false);
defaultPref("privacy.clearOnShutdown.offlineApps", false);
defaultPref("privacy.sanitize.sanitizeOnShutdown", true);

// disable browsing, search and form history
defaultPref("places.history.enabled", false);
defaultPref("browser.formfill.enable", false);

// prevent websites from storing session data like cookies and forms, increase time between session saves
defaultPref("browser.sessionstore.privacy_level", 2);
defaultPref("browser.sessionstore.interval", 60000);

// ----------------------
// # NETWORKING
// ----------------------

// https and mixed content
defaultPref("dom.security.https_only_mode", true); // only allow https in all windows, including private browsing
defaultPref("network.auth.subresource-http-auth-allow", 1); // stop cross-origin resources from using HTTP authentication
defaultPref("security.insecure_connection_text.enabled", true); // display http websites as insecure in the ui
defaultPref("security.mixed_content.block_display_content", true); // block insecure passive content

defaultPref("network.dns.disableIPv6", true); // disable ipv6

// always send xorigin referer but trim them
defaultPref("network.http.referer.XOriginPolicy", 0); // default, might be worth changing to 2
defaultPref("network.http.referer.XOriginTrimmingPolicy", 2); // trim referer to only send scheme, host and port

defaultPref("network.file.disable_unc_paths", true); // hidden, disable using uniform naming convention
defaultPref("network.IDN_show_punycode", true); // use punycode in idn to prevent spoofing

// proxy
defaultPref("network.proxy.socks_remote_dns", true); // forces dns query through the proxy when using one
defaultPref("network.gio.supported-protocols", ""); // disable gio as it could bypass proxy

// doh
defaultPref("network.trr.confirmationNS", "skip"); // skip undesired doh test connection
/**
 0 = default
 1 = browser picks faster
 2 = DoH with system dns fallback
 3 = DoH without fallback
 5 = DoH is off, default currently
 
 below prefs must be applied with pref in order to work
*/
// pref("network.trr.mode", 2);
// pref("network.trr.uri", "https://dns.quad9.net/dns-query");

// prefetching
defaultPref("network.dns.disablePrefetch", true); // disable dns prefetching
lockPref("network.predictor.enabled", false); // disable predictor
lockPref("network.prefetch-next", false); // disable link prefetching
lockPref("network.http.speculative-parallel-limit", 0); // disable prefetching on mouse over

defaultPref("network.manage-offline-status", false); // let user control the offline behavior

// ------------
// # DOM
// ------------

// pop-ups and window related preferences
defaultPref("dom.disable_beforeunload", true); // disable "confirm you want to leave" pop-ups on close
defaultPref("dom.disable_open_during_load", true); // block pop-ups windows
defaultPref("dom.popup_maximum", 4); // limit maximum number of pop-ups 
defaultPref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); // limit events that cause pop-ups
defaultPref("dom.disable_window_move_resize", true); // block scripts from resizing windows
defaultPref("browser.link.open_newwindow", 3); // open 'new windows' targeted links in 'new tab'
defaultPref("browser.link.open_newwindow.restriction", 0); // ignore the size when applying the above pref

// push notifications and service workeers
defaultPref("dom.push.enabled", false); // disable push notifications
defaultPref("dom.push.serverURL", ""); // default "wss://push.services.mozilla.com/"
defaultPref("dom.serviceWorkers.enabled", false); // disable service workers, must enable for push notifications

// --------------------------------
// # CACHE AND TEMPORARY FILES
// --------------------------------

defaultPref("browser.cache.disk.enable", false); // disable disk cache
defaultPref("browser.privatebrowsing.forceMediaMemoryCache", true); // block media cache from writing to disk in pb mode
defaultPref("media.memory_cache_max_size", 65536); // increase max cache size to avoid playback issues caused by above setting

defaultPref("browser.shell.shortcutFavicons", false); // disable shortcut favicons from being stored in profile
defaultPref("browser.helperApps.deleteTempFileOnExit", true); // delete temporary files opened with external apps
defaultPref("browser.pagethumbnails.capturing_disabled", true); // disable page thumbnails capturing

// ----------------------
// # MEDIA
// ----------------------

// disable webrtc
defaultPref("media.peerconnection.enabled", false); // master switch

// limit potential IP leaks for webrtc users
defaultPref("media.peerconnection.ice.default_address_only", true); // use public IP for ICE candidates
defaultPref("media.peerconnection.ice.no_host", true); // don't use local IP for ICE candidates
defaultPref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // force webrtc inside proxy for proxy users

// autoplay
defaultPref("media.autoplay.blocking_policy", 2); // only allow to play when a certain element is clicked
defaultPref("media.autoplay.default", 5); // personal preference, currently apply blocking policy to all autplay including muted

// --------------------------------------
// # FINGERPRINTING
// --------------------------------------

defaultPref("privacy.resistFingerprinting", true); // master switch

// rfp compatibility settings
defaultPref("privacy.resistFingerprinting.block_mozAddonManager", true); // prevents rfp from breaking AMO
defaultPref("browser.startup.blankWindow", false); // if set to true it breaks RFP windows resizing
defaultPref("browser.display.use_system_colors", false); // default but enforced due to RFP

// librewolf specifc pref that prevents rfp from forcing light theme, review
lockPref("privacy.override_rfp_for_color_scheme", false);

defaultPref("webgl.disabled", true); // master switch, disable webgl

// --------------------------------
// # SECURITY
// --------------------------------

// certificates
defaultPref("security.cert_pinning.enforcement_level", 2); // enable strict public key pinning
defaultPref("security.pki.sha1_enforcement_level", 1); // disable sha-1 certificates
defaultPref("security.OCSP.enabled", 0); // disable OCSP fetching

// crl with no OCSP fallback. commented for now but review
// defaultPref("security.remote_settings.crlite_filters.enabled", true);
// defaultPref("security.pki.crlite_mode", 2);

// safe negotiation
defaultPref("security.ssl.require_safe_negotiation", true); // block websites that do not support safe negotiation, occasional breakage
defaultPref("security.ssl.treat_unsafe_negotiation_as_broken",	true); // show warning when safe negotiation is not enable and website is accessed

// tls behavior
lockPref("security.tls.enable_0rtt_data", false); // disable 0 round trip time to improve tls 1.3 security
defaultPref("security.tls.version.enable-deprecated", false); // default but helps resetting the preference
defaultPref("browser.ssl_override_behavior", 1); // prepopulate url on ssl warning screens
defaultPref("browser.xul.error_pages.expert_bad_cert", true); // advanced ui infos for broken connections

// permissions
lockPref("permissions.delegation.enabled", false); // force permission request to show the real origin
lockPref("permissions.manager.defaultsUrl", ""); // revoke special permissions from some mozilla domains

defaultPref("gfx.font_rendering.opentype_svg.enabled", false); // disale svg opentype fonts

defaultPref("browser.download.useDownloadDir", false); // force user interaction on downloads, by always asking location

lockPref("security.csp.enable", true); // default

// ---------------------------------
// # SAFE BROWSING
// ---------------------------------

// disable safe browsing, including the fetch of updates and all outgoing connections 
defaultPref("browser.safebrowsing.malware.enabled", false);
defaultPref("browser.safebrowsing.phishing.enabled", false);
defaultPref("browser.safebrowsing.blockedURIs.enabled", false);
defaultPref("browser.safebrowsing.provider.google4.gethashURL", "");
defaultPref("browser.safebrowsing.provider.google4.updateURL", "");
defaultPref("browser.safebrowsing.provider.google.gethashURL", "");
defaultPref("browser.safebrowsing.provider.google.updateURL", "");

// disable safe browsing checks on downloads, both local and remote
defaultPref("browser.safebrowsing.downloads.enabled", false);
lockPref("browser.safebrowsing.downloads.remote.enabled", false);
lockPref("browser.safebrowsing.downloads.remote.url", "");
lockPref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
lockPref("browser.safebrowsing.downloads.remote.block_uncommon", false);

// other safe browsing options, all default but enforce
lockPref("browser.safebrowsing.passwords.enabled", false);
lockPref("browser.safebrowsing.provider.google4.dataSharing.enabled", false);
lockPref("browser.safebrowsing.provider.google4.dataSharingURL", "");

// -----------------------
// # DRM
// -----------------------

defaultPref("media.eme.enabled", false); // disable drm content, master switch that also controls widevine plugin
defaultPref("media.gmp-manager.url", "data:text/plain,"); // prevent outgoing connections when DRM is disabled

// disable the openh264 plugin
defaultPref("media.gmp-provider.enabled", false);
defaultPref("media.gmp-gmpopenh264.enabled", false);

// ---------------------------------------------
// # LOCATION, LANGUAGE AND REGION
// ---------------------------------------------

defaultPref("geo.enabled", false); // block geo api, behind a prompt so review
defaultPref("permissions.default.geo", 2); // review as well

// use mozilla geo service as deault
defaultPref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");

// prevent use of OS location services
lockPref("geo.provider.ms-windows-location", false); // [WINDOWS]
lockPref("geo.provider.use_corelocation", false); // [MAC]
lockPref("geo.provider.use_gpsd", false); // [LINUX]

// show language as en-US for all users, regardless of their OS language and local version, to avoid leaking
defaultPref("javascript.use_us_english_locale", true);
defaultPref("intl.locale.requested", "en-US");
defaultPref("privacy.spoof_english", 2);

// disable region updates
lockPref("browser.region.network.url", "");
lockPref("browser.region.update.enabled", false);

// --------------------------------
// # SEARCH AND URLBAR
// --------------------------------

// disable search suggestions
defaultPref("browser.urlbar.suggest.searches", false);
defaultPref("browser.search.suggest.enabled", false);
pref("browser.urlbar.quicksuggest.scenario", ""); // disable firefox suggests and hide its UI

defaultPref("browser.search.region", "US"); // set a default search region for all users
defaultPref("browser.search.update", false); // do not update open search search engines
defaultPref("browser.urlbar.trimURLs", false); // do not trim urls in the urlbar

// urlbar-dns interactions, avoid unwanted and speculative connections
defaultPref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
defaultPref("browser.urlbar.speculativeConnect.enabled", false);
lockPref("browser.fixup.alternate.enabled", false);

// ----------------------------------
// # BROWSER BEHAVIOR
// ----------------------------------

lockPref("app.update.auto", false); // disable update auto installs

// password manager
defaultPref("signon.rememberSignons", false); // disable saving passwords in the browser
defaultPref("signon.autofillForms", false); // disable username and password autofills
defaultPref("signon.formlessCapture.enabled", false); // disable formless login capture

// autofill
defaultPref("extensions.formautofill.available", "off");
defaultPref("extensions.formautofill.addresses.enabled", false);
defaultPref("extensions.formautofill.creditCards.enabled", false);
defaultPref("extensions.formautofill.creditCards.available", false);
defaultPref("extensions.formautofill.heuristics.enabled", false);

// mouse and input
defaultPref("general.autoScroll", false); // prevent mouse middle click from triggering scrolling
defaultPref("middlemouse.contentLoadURL", false); // prevent mouse middle click from opening links
defaultPref("clipboard.autocopy", false); // disable autocopy to clibpboard

// containers
defaultPref("privacy.userContext.enabled", true); // enable containers
defaultPref("privacy.userContext.ui.enabled", true);  // enable containers ui

defaultPref("pdfjs.enableScripting", false); // block pdf js scripting

defaultPref("accessibility.force_disabled", 1); // block accessibility services

// devtools
defaultPref("devtools.chrome.enabled", false); // disable chrome debugging tools
defaultPref("devtools.debugger.remote-enabled", false); // default, disable remote debugging
defaultPref("devtools.remote.adb.extensionURL", ""); // url to download ad extension
defaultPref("devtools.selfxss.count", 0); // see https://gitlab.com/librewolf-community/browser/linux/-/issues/80

// misc
defaultPref("browser.shell.checkDefaultBrowser", false); // do not check if default browser
defaultPref("browser.tabs.drawInTitlebar", true); // hide titlebar
defaultPref("browser.aboutConfig.showWarning", false); // disable about:config warning
defaultPref("browser.download.autohideButton", false); // hide download button automatically
defaultPref("browser.download.manager.addToRecentDocs", false); // do not add downloads to recents
defaultPref("browser.tabs.loadBookmarksInTabs", true); // always open bookmarks in new tab

// -----------------------------------
// # TRACKING PROTECTION
// -----------------------------------

pref("browser.contentblocking.category", "custom"); // set tracking protection category, using pref solves the UI bug

// enable / disable TP in normal and private browsing
lockPref("privacy.trackingprotection.enabled", false);
lockPref("privacy.trackingprotection.pbmode.enabled", false);

lockPref("privacy.trackingprotection.annotate_channels", false); // reduce priority of trackers, remove if TP is on

// remove urls to fetch contentblocking lists.
// without these urls TP cannot work. the lists are not shipped with the browser but download on first launch.
defaultPref("browser.safebrowsing.provider.mozilla.updateURL", "");
defaultPref("browser.safebrowsing.provider.mozilla.gethashURL", "");

// disable blocking lists and hide ui elements in custom mode UI, if TP is enabled revert to true
defaultPref("privacy.trackingprotection.cryptomining.enabled", false);
defaultPref("privacy.trackingprotection.fingerprinting.enabled", false);
defaultPref("browser.contentblocking.cryptomining.preferences.ui.enabled", false);
defaultPref("browser.contentblocking.fingerprinting.preferences.ui.enabled", false);

// hide annoying ui elements from about:protections
defaultPref("browser.contentblocking.report.lockwise.enabled", false);
defaultPref("browser.contentblocking.report.monitor.enabled", false);
lockPref("browser.contentblocking.report.hide_vpn_banner", true);
lockPref("browser.contentblocking.report.vpn.enabled", false);
lockPref("browser.contentblocking.report.show_mobile_app", false);

// --------------------------------------
// # EXTENSIONS
// --------------------------------------

/**
 allow extensions to work on all domains.
 default is "debug-notes.log"
 */
 defaultPref("extensions.webextensions.restrictedDomains", "");

 // set extensions scopes
 defaultPref("extensions.enabledScopes", 5);
 defaultPref("extensions.autoDisableScopes", 11);
 
 defaultPref("extensions.postDownloadThirdPartyPrompt", false); // force install prompt for thrid party extensions 
 
 /**
  prevent users from adding lang packs, which would cause leaks.
  default is https://services.addons.mozilla.org/api/v3/addons/language-tools/?app=firefox&type=language&appversion=%VERSION%
 */ 
 defaultPref("extensions.getAddons.langpacks.url", "");
 
 // about:addons ui
 defaultPref("extensions.getAddons.showPane", false); // disable recommendations section
 defaultPref("extensions.htmlaboutaddons.recommendations.enabled", false); // disable recommendations from addons list
 defaultPref("lightweightThemes.getMoreURL", ""); // disable button to get more themes
 
 // background checking and updating of extensions
 defaultPref("extensions.update.enabled", false); // disable automatic checks for extension updates
 defaultPref("extensions.update.autoUpdateDefault", false); // disable automatic installs of extension updates
 defaultPref("extensions.getAddons.cache.enabled", false); // disable fetching of extension metadata
 
 // extension firewall, disabled by default
 // defaultPref("extensions.webextensions.base-content-security-policy", "default-src 'none'; script-src 'none'; object-src 'none';");
 // defaultPref("extensions.webextensions.base-content-security-policy.v3", "default-src 'none'; script-src 'none'; object-src 'none';");
 
 // report site issue, disable button and url for in depth defense
 lockPref("extensions.webcompat-reporter.enabled", false);
 lockPref("extensions.webcompat-reporter.newIssueEndpoint", "");
 
 // system addons, prevent updates and strip url for in depth defense
 defaultPref("extensions.systemAddon.update.enabled", false);
 defaultPref("extensions.systemAddon.update.url", "");

// --------------------------------
// # URLS AND ANNOYANCES
// --------------------------------

// set librewolf support and releases urls
defaultPref("app.support.baseURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support#");
defaultPref("browser.search.searchEnginesURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support#search");
defaultPref("browser.geolocation.warning.infoURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support#location");
defaultPref("app.feedback.baseURL", "https://gitlab.com/librewolf-community/settings/-/wikis/support");
defaultPref("app.releaseNotesURL", "https://gitlab.com/librewolf-community/browser");
defaultPref("app.releaseNotesURL.aboutDialog", "https://gitlab.com/librewolf-community/browser");
defaultPref("app.update.url.details", "https://gitlab.com/librewolf-community/browser");
defaultPref("app.update.url.manual", "https://gitlab.com/librewolf-community/browser");

// remove default handlers and translation engine
lockPref("gecko.handlerService.schemes.mailto.0.uriTemplate", "");
lockPref("gecko.handlerService.schemes.mailto.0.name", "");
lockPref("gecko.handlerService.schemes.mailto.1.uriTemplate", "");
lockPref("gecko.handlerService.schemes.mailto.1.name", "");
lockPref("gecko.handlerService.schemes.irc.0.uriTemplate", "");
lockPref("gecko.handlerService.schemes.irc.0.name", "");
lockPref("gecko.handlerService.schemes.ircs.0.uriTemplate", "");
lockPref("gecko.handlerService.schemes.ircs.0.name", "");
lockPref("browser.translation.engine", "");

// disable welcome, what's new pages and ui tour
defaultPref("browser.startup.homepage_override.mstone", "ignore");
defaultPref("startup.homepage_override_url", "about:blank");
defaultPref("startup.homepage_welcome_url", "about:blank");
defaultPref("startup.homepage_welcome_url.additional", "");
lockPref("browser.messaging-system.whatsNewPanel.enabled", false);
lockPref("browser.uitour.enabled", false);
lockPref("browser.uitour.url", "");

// ------------------------------------
// # NEW TAB PAGE
// ------------------------------------

defaultPref("browser.newtab.preload", false);
defaultPref("browser.newtabpage.activity-stream.section.highlights.includeDownloads", false);
defaultPref("browser.newtabpage.activity-stream.section.highlights.includeVisited", false);
defaultPref("browser.newtabpage.activity-stream.feeds.topsites",	false);

// hide pocket and sponsored content, from new tab page and search bar
lockPref("browser.newtabpage.activity-stream.feeds.section.topstories",	false);
lockPref("browser.newtabpage.activity-stream.feeds.system.topstories",	false);
lockPref("browser.newtabpage.activity-stream.feeds.telemetry", false);
lockPref("browser.newtabpage.activity-stream.feeds.section.topstories.options", "{\"hidden\":true}"); // hide buggy pocket section from about:preferences#home
lockPref("browser.newtabpage.activity-stream.showSponsored", false);
lockPref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);
lockPref("browser.newtabpage.activity-stream.telemetry", false);
lockPref("browser.newtabpage.activity-stream.default.sites", "");
lockPref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false);
lockPref("browser.newtabpage.activity-stream.discoverystream.enabled", false);
lockPref("browser.newtabpage.activity-stream.feeds.snippets", false); // default

// disable recommend as you browse
lockPref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
lockPref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);

// --------------------------------
// # TELEMETRY
// --------------------------------

lockPref("toolkit.telemetry.unified", false); // master switch
lockPref("toolkit.telemetry.enabled", false);  // master switch
lockPref("toolkit.telemetry.server", "data:,");
lockPref("toolkit.telemetry.archive.enabled", false);
lockPref("toolkit.telemetry.newProfilePing.enabled", false);
lockPref("toolkit.telemetry.updatePing.enabled", false);
lockPref("toolkit.telemetry.firstShutdownPing.enabled", false);
lockPref("toolkit.telemetry.shutdownPingSender.enabled", false);
lockPref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false); // default
lockPref("toolkit.telemetry.bhrPing.enabled", false);
lockPref("toolkit.telemetry.reportingpolicy.firstRun", false); // default
lockPref("toolkit.telemetry.cachedClientID", "");
lockPref("toolkit.telemetry.previousBuildID", "");
lockPref("toolkit.telemetry.server_owner", "");
lockPref("toolkit.coverage.opt-out", true); // [HIDDEN PREF]
lockPref("toolkit.coverage.enabled", false);
lockPref("toolkit.coverage.endpoint.base", "");
lockPref("toolkit.crashreporter.infoURL", "");
lockPref("datareporting.healthreport.uploadEnabled", false);
lockPref("datareporting.policy.dataSubmissionEnabled", false);
lockPref("security.protectionspopup.recordEventTelemetry", false);
lockPref("browser.ping-centre.telemetry", false);

// crash report
lockPref("breakpad.reportURL", "");
lockPref("browser.tabs.crashReporting.sendReport", false);

// normandy and studies
lockPref("app.normandy.enabled", false);
lockPref("app.normandy.api_url", "");
lockPref("app.shield.optoutstudies.enabled", false);

// personalized extension recommendations
lockPref("browser.discovery.enabled", false);
lockPref("browser.discovery.containers.enabled", false);
lockPref("browser.discovery.sites", "");

// connectivity checks
lockPref("network.connectivity-service.enabled", false);

// captive portal
lockPref("network.captive-portal-service.enabled", false);
lockPref("captivedetect.canonicalURL", "");

// prevent sending server side analytics
lockPref("beacon.enabled", false);

// --------------------------------
// # WINDOWS
// --------------------------------

// disable windows specific background update service
lockPref("app.update.service.enabled", false);
defaultPref("app.update.background.scheduling.enabled", false);

defaultPref("network.protocol-handler.external.ms-windows-store", false); // disable links launching windows store

lockPref("toolkit.winRegisterApplicationRestart", false); // disable automatic Firefox start and session restore after reboot

lockPref("security.family_safety.mode", 0); // disable win8.1 family safety cert

lockPref("default-browser-agent.enabled", false); // disable windows specific telemetry

defaultPref("network.http.windows-sso.enabled", false); // disable MS auto authentication via sso

// -----------------------------------
// # OVERRIDES
// -----------------------------------

// allow settings to be overriden with a file at `~/.librewolf/librewolf.overrides.cfg`
// or `~/.var/app/io.gitlab.librewolf-community/.librewolf/librewolf.overrides.cfg` (Flatpak).
let profile_directory;
if (profile_directory = getenv('USERPROFILE') || getenv('HOME')) {
  pref('autoadmin.global_config_url', `file://${profile_directory}/.librewolf/librewolf.overrides.cfg`);
}