Update user.js

✅ Enabled addons autoupdate (need tests)
✅ Sanitized FFox blocklist URL (so it won't send identifiable information)
✅ Enforced the proxy server to do any DNS lookups when using SOCKS
✅ Added some descriptions into OCSP section
✅ Enabled require a valid OCSP
✅ Added OrangeManBad in credits
✅ Sorted and fixed some prefs response for OCSP enabled certificates
⛔️ Disabled more webspeech prefs
⛔️ Disabled some more webgl prefs

user.js

@@ -11,26 +11,19 @@
 // Based on  : gHacks: https://github.com/ghacksuserjs/ghacks-user.js
 //             Librefox: https://github.com/intika/Librefox
 //             pyllyukko: https://github.com/pyllyukko/user.js 
+//             OrangeManBad: https://git.nixnet.xyz/OrangeManBad/user.js
 //           
 // License   : https://github.com/quindecim/fennec_user.js/blob/master/LICENSE.txt         
 // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 // Section : Quiet Fox
 // >>>>>>>>>>>>>>>>>>>>>
-// Pref : Disable auto-CHECKING for extension and theme updates
-// user_pref("extensions.update.enabled", false);
-// -------------------------------------
 // Pref : Disable app from auto-update
-user_pref("app.update.auto", false);
 user_pref("app.update.autodownload", "");
 user_pref("app.update.channel", "");
 user_pref("app.update.timerFirstInterval", -1);
 user_pref("app.update.timerMinimumDelay", -1);
 user_pref("app.update.url.android", "");
 // -------------------------------------
-// Pref : Opt-out of add-on metadata updates
-// https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
-user_pref("extensions.getAddons.cache.enabled", false);
-// -------------------------------------
 // Pref : Never check updates for search engines
 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking
 user_pref("browser.search.update", false);
@@ -129,10 +122,6 @@ user_pref("browser.chromeURL", "");
 user_pref("general.useragent.updates.url", "");
 // -------------------------------------
 // Pref : Block unwanted connections
-user_pref("extensions.getAddons.compatOverides.url", "");
-user_pref("extensions.getAddons.get.url", "");
-user_pref("extensions.getAddons.langpacks.url", "");
-user_pref("extensions.getAddons.search.browseURL", "");
 user_pref("extensions.getLocales.get.url", "");
 user_pref("identity.sync.tokenserver.uri", "");
 user_pref("media.decoder-doctor.new-issue-endpoint", "");
@@ -172,13 +161,9 @@ user_pref("layout.accessiblecaret.hapticfeedback", false); // [DEFAULT: true]
 // Pref :
 user_pref("dom.registerProtocolHandler.insecure.enabled", true);
 // -------------------------------------
-// Pref : Block list url disabled
+// Pref : Updates addons automatically
-user_pref("extensions.blocklist.url", "");
+// https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/
-user_pref("extensions.blocklist.detailsURL", "");
+user_pref("extensions.update.enabled", true);
-user_pref("extensions.blocklist.itemURL", "");
-user_pref("extensions.update.url", "");
-user_pref("extensions.update.background.url", "");
-user_pref("extensions.getAddons.browseAddons", "");
 // -------------------------------------
 // Pref : Disable Firefox Accounts and Sync
 user_pref("identity.fxaccounts.auth.uri", "");
@@ -230,7 +215,11 @@ user_pref("beacon.enabled", false);
 // https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html
 // https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition
 // https://wiki.mozilla.org/HTML5_Speech_API
-user_pref("media.webspeech.recognition.enable", false);
+user_pref("media.webspeech.recognition.enable", false); // [DEFAULT: true]
+user_pref("media.webspeech.recognition.force_enable", false); // [DEFAULT: false]
+user_pref("media.webspeech.test.enable", false); // [DEFAULT: false]
+user_pref("media.webspeech.test.fake_fsm_events", false); // [DEFAULT: false]
+user_pref("media.webspeech.test.fake_recognition_service", false); // [DEFAULT: false]
 // -------------------------------------
 // Pref : Don't use Mozilla-provided location-specific search engines
 user_pref("browser.search.geoSpecificDefaults", false);
@@ -449,8 +438,10 @@ user_pref("webgl.disabled", true);
 user_pref("webgl.enable-webgl2", false);
 user_pref("webgl.min_capability_mode", true);
 user_pref("pdfjs.enableWebGL", false);
-user_pref("webgl.disable-extensions", true);
+user_pref("webgl.disable-extensions", true); // [DEFAULT: false]
+user_pref("webgl.disable-wgl", true); // [DEFAULT: false]
 user_pref("webgl.disable-fail-if-major-performance-caveat", true);
+user_pref("webgl.can-lose-context-in-foreground", false); // [DEFAULT: true]
 // -------------------------------------
 // Pref : Disable audiocapture
 user_pref("media.getusermedia.browser.enabled", false);
@@ -611,7 +602,7 @@ user_pref("network.dns.disableIPv6", true);
 // e.g. in Tor, this stops your local DNS server from knowing your Tor destination as a remote Tor node will handle the DNS request
 // http://kb.mozillazine.org/Network.proxy.socks_remote_dns
 // https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers
-// user_pref("network.proxy.socks_remote_dns", true);
+user_pref("network.proxy.socks_remote_dns", true);
 // -------------------------------------
 // Pref : Remove paths when sending URLs to PAC scripts
 // CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)
@@ -667,12 +658,33 @@ user_pref("security.ssl.errorReporting.url", "");
 // https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/
 user_pref("security.tls.enable_0rtt_data", false);
 // -------------------------------------
-// Pref : Check disabled section
+// Pref : Require a valid OCSP response for OCSP enabled certificates
-// OCSP Leaks the visited sited exactly same issue as safebrowsing.
+// https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA
-// Stapling have the site itself proof that his certificate is good through the CA so apparently nothing is leaked in this case.
+// Disabling this will make OCSP bypassable by MitM attacks suppressing OCSP responses
-// https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ 
+// [NOTE] `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable
+// [NOTE] `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)
+user_pref("security.OCSP.require", true);
+// -------------------------------------
+// Pref : Enable OSCP (Online Certificate Status Protocol)
+// https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
+// https://www.imperialviolet.org/2014/04/19/revchecking.html
+// https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/
+// https://wiki.mozilla.org/CA:RevocationPlan
+// https://wiki.mozilla.org/CA:ImprovingRevocation
+// https://wiki.mozilla.org/CA:OCSP-HardFail
+// https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html
+// https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
+// [NOTE] OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
+// [NOTE] OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder
+// [NOTE] OCSP adds latency (performance)
+// [NOTE] Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)
+// CIS Version 1.2.0 October 21st, 2011 2.2.4
 user_pref("security.OCSP.enabled", 0);
-user_pref("security.OCSP.require", false);
+// -------------------------------------
+// Pref : Enable OCSP Stapling support
+// Stapling have the site itself proof that his certificate is good through the CA so apparently nothing is leaked in this case.
+// https://en.wikipedia.org/wiki/OCSP_stapling
+// https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
 user_pref("security.ssl.enable_ocsp_stapling", true);
 // -------------------------------------
 // Pref : Disallow SHA-1
@@ -887,7 +899,7 @@ user_pref("browser.cache.disk.smart_size.enabled", false);
 user_pref("browser.cache.disk.smart_size.first_run", false);
 // -------------------------------------
 // Pref : Disable disk cache for SSL pages
-//http://kb.mozillazine.org/Browser.cache.disk_cache_ssl
+// http://kb.mozillazine.org/Browser.cache.disk_cache_ssl
 user_pref("browser.cache.disk_cache_ssl", false);
 // -------------------------------------
 // Pref : Disable memory cache
@@ -948,7 +960,7 @@ user_pref("intl.locale.os", "en-US");
 // If set to empty, the OS locales are used. If not set at all, default locale is used
 user_pref("intl.locale.requested", "en-US");
 // -------------------------------------
-// Pref: Set language to match
+// Pref : Set language to match
 user_pref("intl.accept_languages", "en-US, en");
 // -------------------------------------
 // Pref : Use APP locale over OS locale in regional preferences
@@ -963,7 +975,7 @@ user_pref("intl.regional_prefs.use_os_locales", false);
 // [NOTE] Disabling fonts can uglify the web a fair bit.
 user_pref("browser.display.use_document_fonts", 0);
 // -------------------------------------
-// Pref: Set more legible default fonts
+// Pref : Set more legible default fonts
 // [NOTE] Example below for Windows/Western only
 // user_pref("font.name.serif.x-unicode", "Georgia");
 // user_pref("font.name.serif.x-western", "Georgia"); // [DEFAULT: Times New Roman]
@@ -972,33 +984,33 @@ user_pref("browser.display.use_document_fonts", 0);
 // user_pref("font.name.monospace.x-unicode", "Lucida Console");
 // user_pref("font.name.monospace.x-western", "Lucida Console"); // [DEFAULT: Courier New]
 // -------------------------------------
-// Pref: Disable icon fonts (glyphs) and local fallback rendering
+// Pref : Disable icon fonts (glyphs) and local fallback rendering
 // https://bugzilla.mozilla.org/789788
 // https://trac.torproject.org/projects/tor/ticket/8455
 user_pref("gfx.downloadable_fonts.enabled", false);
 user_pref("gfx.downloadable_fonts.fallback_delay", -1);
 // -------------------------------------
-// Pref: Disable rendering of SVG OpenType fonts
+// Pref : Disable rendering of SVG OpenType fonts
 // https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this
 user_pref("gfx.font_rendering.opentype_svg.enabled", false);
 // -------------------------------------
-// Pref: Disable WOFF2 (Web Open Font Format)
+// Pref : Disable WOFF2 (Web Open Font Format)
 user_pref("gfx.downloadable_fonts.woff2.enabled", false);
 // -------------------------------------
-// Pref: Disable CSS Font Loading API
+// Pref : Disable CSS Font Loading API
 // [NOTE] Disabling fonts can uglify the web a fair bit.
 user_pref("layout.css.font-loading-api.enabled", false);
 // -------------------------------------
-// Pref: Disable special underline handling for a few fonts which you will probably never use
+// Pref : Disable special underline handling for a few fonts which you will probably never use
 // Any of these fonts on your system can be enumerated for fingerprinting.
 // http://kb.mozillazine.org/Font.blacklist.underline_offset
 user_pref("font.blacklist.underline_offset", "");
 // -------------------------------------
-// Pref: Disable graphite which turned back on by default
+// Pref : Disable graphite which turned back on by default
 // https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778
 user_pref("gfx.font_rendering.graphite.enabled", false);
 // -------------------------------------
-// Pref: Limit system font exposure to a whitelist [RESTART]
+// Pref : Limit system font exposure to a whitelist [RESTART]
 // If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
 // [WARNING] Creating your own probably highly-unique whitelist will raise your entropy. Eventually privacy.resistFingerprinting will cover this.
 // https://bugzilla.mozilla.org/1121643
@@ -1007,7 +1019,7 @@ user_pref("gfx.font_rendering.graphite.enabled", false);
 // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 // Section : Plugins
 // >>>>>>>>>>>>>>>>>>>>
-// Pref: Set default plugin state (i.e. new plugins on discovery) to never activate
+// Pref : Set default plugin state (i.e. new plugins on discovery) to never activate
 // 0=disabled, 1=ask to activate, 2=active - you can override individual plugins
 user_pref("plugin.default.state", 0);
 // -------------------------------------
@@ -1040,38 +1052,24 @@ user_pref("media.mediadrm-widevinecdm.visible", false); // [DEFAULT: true]
 // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 // Section : Blocklists / Safe Browsing / Tracking Protection
 // >>>>>>>>>>>>>>>>>>>>
-// This section has security & tracking protection implications vs privacy concerns vs effectiveness vs 3rd party 'censorship'. If you disable Tracking Protection (TP) and/or Safe Browsing (SB), REQUIRES YOU HAVE uBLOCK ORIGIN INSTALLED.
 // Pref : Enable add-on and certificate blocklists (OneCRL) from Mozilla
-// Updated at interval defined in extensions.blocklist.interval
+// https://wiki.mozilla.org/Blocklisting
-user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 0);
+// https://blocked.cdn.mozilla.net/
-user_pref("extensions.blocklist.enabled", false);
+// http://kb.mozillazine.org/Extensions.blocklist.enabled
-user_pref("extensions.blocklist.interval", 0);
+// http://kb.mozillazine.org/Extensions.blocklist.url
-user_pref("extensions.blocklist.level", 0);
+// https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
-user_pref("extensions.blocklist.pingCountTotal", 0);
+// Updated at interval defined in extensions.blocklist.interval (default: 86400)
-user_pref("extensions.blocklist.pingCountVersion", 0);
+user_pref("extensions.blocklist.enabled", true);
-user_pref("extensions.blocklist.url", "");
-user_pref("services.blocklist.addons.signer", ""); // [DEFAULT: remote-settings.content-signature.mozilla.org]
-user_pref("services.blocklist.bucket", "");
-user_pref("services.blocklist.plugins.signer", "");
-user_pref("services.blocklist.pinning.signer", ""); // [DEFAULT: pinning-preload.content-signature.mozilla.org]
-user_pref("services.blocklist.pinning.bucket", "");
-user_pref("services.blocklist.pinning.checked", 0);
-user_pref("services.blocklist.pinning.collection", "");
-user_pref("services.blocklist.pinning.enabled", false);
-user_pref("services.blocklist.plugins.checked", 0);
-user_pref("services.blocklist.plugins.collection", "");
 // -------------------------------------
-// Pref : Disable individual unwanted/unneeded parts of the Kinto blocklists
+// Pref : Decrease system information leakage to Mozilla blocklist update servers
-// What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications
+// https://trac.torproject.org/projects/tor/ticket/16931
-// As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes
+// https://www.reddit.com/r/firefox/comments/9v5lue/firefox_tip_sanitize_firefox_blocklist_url_so_it/
-user_pref("services.blocklist.onecrl.signer", ""); // [DEFAULT: onecrl.content-signature.mozilla.org]
+user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%20/%20/"); // [URL SANITIZED]
-user_pref("services.blocklist.onecrl.checked", 0);
+// -------------------------------------
-user_pref("services.blocklist.onecrl.collection", "");
+// Pref : Opt-out of add-on metadata updates
-user_pref("services.blocklist.addons.checked", 0);
+// https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
-user_pref("services.blocklist.addons.collection", "");
+user_pref("extensions.getAddons.cache.enabled", false)
-user_pref("services.blocklist.gfx.signer", ""); // [DEFAULT: remote-settings.content-signature.mozilla.org]
+user_pref("extensions.getAddons.search.browseURL", "");
-user_pref("services.blocklist.gfx.checked", 0);
-user_pref("services.blocklist.gfx.collection", "");
 // -------------------------------------
 // Pref : Disable Google Safe Browsing (Block dangerous and deceptive contents)
 user_pref("browser.safebrowsing.allowOverride", false);
@@ -1184,7 +1182,7 @@ user_pref("browser.cache.offline.capacity", 0);
 // https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/ 
 user_pref("browser.cache.offline.insecure.enable", false);
 // -------------------------------------
-// Pref: Display a notification bar when websites offer data for offline use
+// Pref : Display a notification bar when websites offer data for offline use
 // http://kb.mozillazine.org/Browser.offline-apps.notify
 user_pref("browser.offline-apps.notify", true); // [DEFAULT: true]
 // -------------------------------------
@@ -1308,15 +1306,18 @@ user_pref("dom.netinfo.enabled", false); // [DEFAULT: true]
 // https://developer.mozilla.org/docs/Web/API/SpeechSynthesis
 // https://wiki.mozilla.org/HTML5_Speech_API
 user_pref("media.webspeech.synth.enabled", false); // [DEFAULT: false]
+user_pref("media.webspeech.synth_force_global_queue", false); // [DEFAULT: false]
 // -------------------------------------
 // Pref : Disable video statistics - JS performance fingerprinting
 // https://trac.torproject.org/projects/tor/ticket/15757
 // https://bugzilla.mozilla.org/654550
 user_pref("media.video_stats.enabled", false); // [DEFAULT: true]
 // -------------------------------------
-// Pref : Disable touch events
+// Pref : Force touch events enabled by default
-// Fingerprinting attack vector - leaks screen res & actual screen coordinates
+// Fingerprinting attack vector - leaks screen res & actual screen coordinates.
 // 0=disabled, 1=enabled, 2=autodetect
+// This pref is set to 2 by default, which results in the Touch API being exposed only when touch hardware is present. So we should either set it to "1" (enable) or "0" (disable) to ensure that JS code can't fingerprint the user's hardware.
+// [FENNEC - BUG] If disabled, unables you to copy or paste any text.
 // https://developer.mozilla.org/docs/Web/API/Touch_events
 // https://trac.torproject.org/projects/tor/ticket/10286
 user_pref("dom.w3c_touch_events.enabled", 1); // [DEFAULT: 2]
@@ -1379,4 +1380,5 @@ user_pref("browser.ui.zoom.force-user-scalable", true); // [DEFAULT: false]
 // https://bugzilla.mozilla.org/1502392
 // http://kb.mozillazine.org/Disabling_autocomplete_-_Firefox#Firefox_3.5
 user_pref("browser.urlbar.autocomplete.enabled", false); // [DEFAULT: true]
-// -------------------------------------
+//
+//