From 1a9e0bb6dc723f8865410f60732375856d23e0df Mon Sep 17 00:00:00 2001 From: Thorin-Oakenpants Date: Tue, 2 Jun 2026 02:01:57 +0000 Subject: [PATCH 1/7] v151 @tomrittervg added a link to your blog about telemetry --- user.js | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/user.js b/user.js index df733227..7cfd4e20 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: arkenfox user.js -* date: 21 April 2026 -* version: 144 +* date: 30 June 2026 +* version: 151 * urls: https://github.com/arkenfox/user.js [repo] * : https://arkenfox.github.io/gui/ [interactive] * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt @@ -394,7 +394,7 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); * but the problem is that the browser can't know that. Setting this pref to true is the only way for the * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? - * [STATS] SSL Labs (Nov 2025) reports almost 99.85% of top sites have secure renegotiation [4] + * [STATS] SSL Labs (June 2025) reports almost 99.85% of top sites have secure renegotiation [4] * [1] https://wiki.mozilla.org/Security:Renegotiation * [2] https://datatracker.ietf.org/doc/html/rfc5746 * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 @@ -1064,7 +1064,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF150] // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); @@ -1191,6 +1191,8 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below. But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides. + READ: https://ritter.vg/blog-telemetry.html + Opt-out - Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain - Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading From 7602fda9fc4058f53abe5e528942a2afe0bccf74 Mon Sep 17 00:00:00 2001 From: Thorin-Oakenpants Date: Tue, 7 Jul 2026 06:27:57 +0000 Subject: [PATCH 2/7] remove privacy.partition.network_state.ocsp_cache FF151+ https://bugzilla.mozilla.org/show_bug.cgi?id=1874169 it's in the DON'T TOUCH section so no need to keep around for resetting --- user.js | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/user.js b/user.js index 7cfd4e20..e9cc5c8e 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: arkenfox user.js -* date: 30 June 2026 -* version: 151 +* date: 20 July 2026 +* version: 152 * urls: https://github.com/arkenfox/user.js [repo] * : https://arkenfox.github.io/gui/ [interactive] * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt @@ -797,6 +797,8 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); 1984333 - spoof navigator.hardwareConcurrency as 4 except mac return 8 (FF143) previously FF55+ it returned 2 1999126 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF147) + 2047612 - enforce IME styling in EditContext API (FF154) + 2045882 - enforce sRGB in canvas (FF154?) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); /* 4501: enable RFP @@ -961,7 +963,7 @@ user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); * [1] http://asmjs.org/ * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ - // user_pref("javascript.options.asmjs", false); + // user_pref("javascript.options.asmjs", false); // [DEFAULT: false FF148+] /* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART] * [NOTE] When both Ion and JIT are disabled, and trustedprincipals * is enabled, then Ion can still be used by extensions (1599226) @@ -1064,7 +1066,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF150] + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF150+] // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); @@ -1123,7 +1125,6 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] // user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+] // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+] - // user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true] // user_pref("privacy.query_stripping.enabled", true); // [FF101+] // user_pref("privacy.trackingprotection.enabled", true); // user_pref("privacy.trackingprotection.socialtracking.enabled", true); From b0a5a619ee9ab53f76876b8e7d4684d24c8b2908 Mon Sep 17 00:00:00 2001 From: Thorin-II <16656956+Thorin-II@users.noreply.github.com> Date: Sun, 12 Jul 2026 05:42:39 +0000 Subject: [PATCH 3/7] fix spelling, remove optInPartitioning #2017 see https://bugzilla.mozilla.org/show_bug.cgi?id=1951443 - not used in ETP Strict since 137- in the DON'T BOTHER section, so no need to keep around for prefsCleaner --- user.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/user.js b/user.js index e9cc5c8e..eda24af3 100644 --- a/user.js +++ b/user.js @@ -941,7 +941,7 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow // user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); /* 5019: disable page thumbnail collection ***/ // user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] -/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/ +/* 5020: disable Windows native notifications and use app notifications instead [FF111+] [WINDOWS] ***/ // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false); /*** [SECTION 5500]: OPTIONAL HARDENING @@ -1120,7 +1120,6 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5] - // user_pref("network.cookie.cookieBehavior.optInPartitioning", true); // [ETP FF132+] // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] // user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+] From 0f478629be7fc6f895aec7c116a71e972324a1dd Mon Sep 17 00:00:00 2001 From: Thorin-II <16656956+Thorin-II@users.noreply.github.com> Date: Tue, 14 Jul 2026 04:27:51 +0000 Subject: [PATCH 4/7] ecdhe_ecdsa_aes_256_sha https://bugzilla.mozilla.org/show_bug.cgi?id=2052302 --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index eda24af3..96016c75 100644 --- a/user.js +++ b/user.js @@ -1067,7 +1067,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF150+] - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT: false FF154+] // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS From 60f3ab692b389475f6b9d33e1ef16983eb7a01b3 Mon Sep 17 00:00:00 2001 From: Thorin-II <16656956+Thorin-II@users.noreply.github.com> Date: Wed, 22 Jul 2026 14:22:00 +0000 Subject: [PATCH 5/7] containers are default true in FF153+ ... every day, in little ways ... FF wants to be like arkenfox ~p --- user.js | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/user.js b/user.js index 96016c75..2aad278d 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: arkenfox user.js -* date: 20 July 2026 -* version: 152 +* date: 30 July 2026 +* version: 153 * urls: https://github.com/arkenfox/user.js [repo] * : https://arkenfox.github.io/gui/ [interactive] * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt @@ -469,11 +469,6 @@ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); /*** [SECTION 1700]: CONTAINERS ***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); -/* 1701: enable Container Tabs and its UI setting [FF50+] - * [SETTING] General>Tabs>Enable Container Tabs - * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ -user_pref("privacy.userContext.enabled", true); -user_pref("privacy.userContext.ui.enabled", true); /* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+] * [NOTE] The menu is always shown on long press and right click * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ @@ -1042,6 +1037,9 @@ user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] // user_pref("browser.urlbar.fakespot.featureGate", ""); // user_pref("security.OCSP.enabled", ""); // user_pref("security.OCSP.require", ""); +/* 6051: prefsCleaner: reset previously active items removed from arkenfox FF153+ ***/ + // user_pref("privacy.userContext.enabled", ""); + // user_pref("privacy.userContext.ui.enabled", ""); /*** [SECTION 7000]: DON'T BOTHER ***/ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); From 26adb5fd9e553ed13404103f07b6a0306d23becc Mon Sep 17 00:00:00 2001 From: Thorin-II <16656956+Thorin-II@users.noreply.github.com> Date: Wed, 22 Jul 2026 14:25:13 +0000 Subject: [PATCH 6/7] FF153+ containers are default true --- scratchpad-scripts/arkenfox-cleanup.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scratchpad-scripts/arkenfox-cleanup.js b/scratchpad-scripts/arkenfox-cleanup.js index 298e6367..105a526c 100644 --- a/scratchpad-scripts/arkenfox-cleanup.js +++ b/scratchpad-scripts/arkenfox-cleanup.js @@ -6,7 +6,7 @@ There is an archived version at https://github.com/arkenfox/user.js/issues/123 if you want the full list since jesus - Last updated: 19-December-2025 + Last updated: 23-July-2026 Instructions: - [optional] close Firefox and backup your profile @@ -83,6 +83,8 @@ 'browser.display.use_system_colors', 'browser.urlbar.fakespot.featureGate', 'keyword.enabled', + 'privacy.userContext.enabled', + 'privacy.userContext.ui.enabled', 'security.OCSP.enabled', 'security.OCSP.require', /* 129-140 */ From 5b799c78b926437776fde80603c965636229e7e1 Mon Sep 17 00:00:00 2001 From: Thorin-II <16656956+Thorin-II@users.noreply.github.com> Date: Tue, 4 Aug 2026 05:33:43 +0000 Subject: [PATCH 7/7] tweak RFP info, #2068 --- user.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 2aad278d..40d8e02e 100644 --- a/user.js +++ b/user.js @@ -764,7 +764,8 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) - 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102) + 1692609 - reduce timing precision via rAF (requestAnimationFrame) to 16.67ms | i.e FPS are 60hz (FF102) + previously FF55+ javascript/timestamps/some animations were restricted to 100ms 1422237 - return "srgb" with color-gamut (FF110) 1794628 - return "none" with inverted-colors (FF114) 1787790 - normalize system fonts (FF128) @@ -793,7 +794,8 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); previously FF55+ it returned 2 1999126 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF147) 2047612 - enforce IME styling in EditContext API (FF154) - 2045882 - enforce sRGB in canvas (FF154?) + 2059465 - disable ScreenOrientation lock on Windows (156?) + 2045882 - enforce sRGB in canvas (FF156?) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); /* 4501: enable RFP