From 75023b38c542ca0a46f9ec84af7ae81ce2037df4 Mon Sep 17 00:00:00 2001 From: pyllyukko Date: Sun, 23 Sep 2018 18:18:58 +0300 Subject: [PATCH] Disable system add-ons Fixes #419 --- README.md | 2 ++ user.js | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/README.md b/README.md index e2e0544b..2937b880 100644 --- a/README.md +++ b/README.md @@ -228,6 +228,7 @@ Harden preferences related to external plugins * Updates addons automatically [ [1](https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/) ] * Enable add-on and certificate blocklists (OneCRL) from Mozilla [ [1](https://wiki.mozilla.org/Blocklisting) [2](https://blocked.cdn.mozilla.net/) [3](http://kb.mozillazine.org/Extensions.blocklist.enabled) [4](http://kb.mozillazine.org/Extensions.blocklist.url) [5](https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/) ] * Decrease system information leakage to Mozilla blocklist update servers [ [1](https://trac.torproject.org/projects/tor/ticket/16931) ] +* Disable system add-ons (hidden & always-enabled add-ons from Mozilla) [ [1](https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html) [2](https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/) [3](https://github.com/pyllyukko/user.js/issues/419) [4](https://dxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1248-1257) ] ### Firefox (anti-)features / components @@ -423,6 +424,7 @@ Hardening your often implies a trade-off with ease-of-use and comes with reduced * Enabling Mixed Display Content blocking can prevent images/styles... from loading properly when connection to the website is only partially secured * Disabling SVG support breaks many UI elements on many sites * Disabling nonessential protocols breaks all interaction with custom protocols such as mailto:, irc:, magnet: ... and breaks opening third-party mail/messaging/torrent/... clients when clicking on links with these protocols +* Disabling system add-ons prevents Mozilla from "hotfixing" your browser to patch critical problems (one possible use case from the documentation) * Containers are not available in Private Browsing mode * Fully automatic updates are disabled and left to package management systems on Linux. Windows users may want to change this setting. * Update check page might incorrectly report Firefox ESR as out-of-date diff --git a/user.js b/user.js index 4f1bf487..78924c70 100644 --- a/user.js +++ b/user.js @@ -432,6 +432,14 @@ user_pref("services.blocklist.update_enabled", true); // https://trac.torproject.org/projects/tor/ticket/16931 user_pref("extensions.blocklist.url", "https://blocklist.addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/"); +// PREF: Disable system add-ons (hidden & always-enabled add-ons from Mozilla) +// https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html +// https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ +// https://github.com/pyllyukko/user.js/issues/419 +// https://dxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1248-1257 +// NOTICE: Disabling system add-ons prevents Mozilla from "hotfixing" your browser to patch critical problems (one possible use case from the documentation) +user_pref("extensions.systemAddon.update.enabled", false); + /****************************************************************************** * SECTION: Firefox (anti-)features / components * * ******************************************************************************/