Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

changelog v135 #1941

Open
Thorin-Oakenpants opened this issue Mar 6, 2025 · 29 comments
Open

changelog v135 #1941

Thorin-Oakenpants opened this issue Mar 6, 2025 · 29 comments

Comments

@Thorin-Oakenpants
Copy link
Contributor

🟩 v133

FF134 release notes | for developers | security advisories
FF135 release notes | for developers | security advisories


CHANGELOG


There was nothing to add from 134 or 135

These changes all stem from 1888466 in 136 and sanitizing choices

  • the migration in FF128 merged items to simply things
  • feedback from users was they wanted "history" separate from "forms"
  • so for all three dialogs (clearHistory, clearOnShutdown_v2, clearSiteData) we have another migration
  • for each the *historyFormDataAndDownloads pref migrates to the relevant prefs below
  • whilst I was at it, I cleaned up all the legacy sanitizing prefs as it was section 2800 was getting messy and confusing

⭐ 136 is here (don't ever wait for arkenfox before updating Firefox!) so my bad, sue me, I should have had this out before FF136 stable was released. Suggest y'all check/update your sanitizing overrides: make sure to open each dialog to ensure migration

  • new in user.js v135
    • these prefs are added in FF136
    • not entirely sure about the v2.downloads pref, it doesn't seem to be controlled by the UI
user_pref("privacy.clearHistory.browsingHistoryAndDownloads", true);
user_pref("privacy.clearHistory.formdata", true);
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true);
user_pref("privacy.clearOnShutdown_v2.downloads", true);
user_pref("privacy.clearOnShutdown_v2.formdata", true);
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true);
user_pref("privacy.clearSiteData.formdata", true);
  • removed inactive in user.js v135
    • legacy sanitizing prefs that we've always had inactive and at defaults
      • legacy because in FF128 you should have migrated to the new prefs
      • cpd to clearHistory migration may have required you to open the clear history dialog: see comments in 9bba578
   // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false]
   // user_pref("privacy.cpd.downloads", true); // not used: controlled by another pref
   // user_pref("privacy.cpd.openWindows", false);
   // user_pref("privacy.cpd.passwords", false);
   // user_pref("privacy.cpd.siteSettings", false);
  • made inactive in user.js v135 (and moved to 6050 for prefsCleaner)
    • legacy sanitizing prefs: see above
   // user_pref("privacy.clearOnShutdown.cache", "");
   // user_pref("privacy.clearOnShutdown.cookies", "");
   // user_pref("privacy.clearOnShutdown.downloads", "");
   // user_pref("privacy.clearOnShutdown.formdata", "");
   // user_pref("privacy.clearOnShutdown.history", "");
   // user_pref("privacy.clearOnShutdown.offlineApps", "");
   // user_pref("privacy.clearOnShutdown.sessions", "");
   // user_pref("privacy.cpd.cache", "");
   // user_pref("privacy.cpd.cookies", "");
   // user_pref("privacy.cpd.formdata", "");
   // user_pref("privacy.cpd.history", "");
   // user_pref("privacy.cpd.offlineApps", "");
   // user_pref("privacy.cpd.sessions", "");

NOTE: the STATs section excludes the new 8500 TELEMETRY section

  • that section has 14 prefs moved into it
  • these prefs have bearing on web sites and the numbers are quite meaningless
 STATS v135: up to and including section 4500, minus the parrots
 =========
    total: 168
 inactive:  46
      n/a    3 (v2 migration sanitizing prefs)
           ---
   active: 119
  default:  19 (at least)
      n/a:   2 (of the three prefs in 0202, only one will apply)
           ---
  flipped:  98 (at most)

ALL HAIL PANTS

@Tiagoquix
Copy link
Contributor

Tiagoquix commented Mar 6, 2025

/* 0335: disable Firefox Home (Activity Stream) telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);

Why weren't these telemetry-related prefs also moved with the others to section 8500?

Also, regarding the new sanitize prefs, I assume you just updated it to the same values as before for the new prefs?
If so, is it safe to migrate while in version 135.0.1 or should I wait version 136? (My Linux distro hasn't updated to it yet.)

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 6, 2025

You can't migrate until 136 because the code wasn't added until then - see comments in 9bba578

but you can add all your pref overrides and get rid of the legacy crap before then

So likely steps

  • 135 you update your overrides and user.js to v136
    • the new prefs have no relevance
  • you update to 136
    • the new prefs still have no relevance until the migration (FF code) takes place
    • the migration for at least some dialogs requires you to open them
    • the new prefs may not match your overrides because it's a migration and I can't check everything
  • open/close Firefox and everything should now be in sync

those 2 telemetry prefs not in 8500 .. IDK if i missed them (unlikely) or because it doesn't matter as we disable AS

@Thorin-Oakenpants
Copy link
Contributor Author

I assume you just updated it to the same values as before for the new prefs

Yes. On shutdown, AF has always sanitized everything except site settings and passwords. For manual sanitizing AF (at least since site exceptions were added in I think FF102 ) also excludes cookies and site data since that doesn't respect the site exception (and we wouldn't want users to go ctrl-shift-del and hit enter and lose all their logins)

@Thorin-Oakenpants
Copy link
Contributor Author

Why weren't these telemetry-related prefs also moved with the others to section 8500?

those 2 telemetry prefs not in 8500 .. IDK if i missed them (unlikely) or because it doesn't matter as we disable AS

Ahh, I know. Because the 8500 section header is explaining that FF telemetry is not a privacy or security concern. Activity stream I can't really say that because it's entangled with pocket etc

@icpantsparti2
Copy link
Contributor

allhail-AF

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 6, 2025

Also, all you mac and linux RFP users ... all hail me for getting this over the line after 3 years or so ... and also give a wave (no hailing) to @PieroV for the patch

user.js/user.js

Lines 732 to 734 in 3d76c74

1333651 - spoof User Agent & Navigator API
JS: spoofed as Windows 10, OS 10.15, Android 10, or Linux
HTTP Header: spoofed as Windows 10 or Android 10.15 until FF136 then matches JS spoof

edit: i know this is v135 but FF136 has been released .. so start hailing

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 6, 2025

how am I supposed to put in any warning - I already added the info in the release notes?

For the record - the migration code from Firefox should preserve what you set and/or override in the v2 settings (AFAICT). Even if it didn't and it read that the new pref is already set (and you said your overwrote it with your value) - it won't take affect until you close (for sanitize on close) or do it manually (when you clear site data, or clear history)

I said you need to 1) add overrides to suit and 2 open the dialogs to make sure the migration happens and to check your values

There is nothing more I could do (except have gotten this out before v136 and even that may not have helped some people) - the defaults in AF are to sanitize

Not blaming you - but do you have a backup and if not why not? Session restore (open tabs) is not a backup and shouldn't be treated as one.

@Tiagoquix
Copy link
Contributor

but you can add all your pref overrides and get rid of the legacy crap before then

I'm not sure, as this is not clear to me. I guess it's safer for me to keep the legacy crap and only update the user.js only after updating to Firefox 136 then?

I see that you removed the legacy prefs in user.js v135. Do the new prefs already exist in 135 to make it safer for them to be removed before installing version 136?

BTW, WDYM by "It pays to open each dialog to ensure the migration happens."? Which dialogs?

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 6, 2025

You should put a warning in the update. The update deleted my browser history and my open tabs, although I switched off the deletion via override. Thanks for nothing.

This doesn't make sense to me. The migration updates using your v2 pref from FF128. Meanwhile the user js sets the v3 prefs for FF136+ as per your override. If the migration says, oh this is user modified lets not touch it (IDK if it does this), then the value would be as per your override. So arkenfox's default is not used, it literally can't be used, you overrode it.

So blame the migration code or maybe your override is not correct. I did say to open the dialog and check

edit: knew it

@theltalpha
Copy link

So blame the migration code or maybe your override is not correct. I did say to open the dialog and check

Hi, could you please clarify which dialogs you are referring here to?

@Thorin-Oakenpants
Copy link
Contributor Author

user.js/user.js

Line 626 in 3d76c74

* [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes | Settings ***/

user.js/user.js

Line 655 in 3d76c74

* [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/

user.js/user.js

Line 667 in 3d76c74

* [SETTING] Privacy & Security>History>Custom Settings>Clear History ***/

@shadow-absorber
Copy link

shadow-absorber commented Mar 6, 2025

user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("privacy.spoof_english", 2);


/* override recipe: enable session restore ***/
user_pref("browser.startup.page", 3); // 0102
  // user_pref("browser.privatebrowsing.autostart", false); // 0110 required if you had it set as true
  // user_pref("browser.sessionstore.privacy_level", 0); // 1003 optional to restore cookies/formdata
user_pref("privacy.clearOnShutdown.history", false); // 2811 FF127 or lower
user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", false); // 2811 FF128+

// 2820 optional to match when you use settings>Cookies and Site Data>Clear Data
  // user_pref("privacy.clearSiteData.historyFormDataAndDownloads", false); // FF128+

// 2830 optional to match when you use Ctrl-Shift-Del (settings>History>Custom Settings>Clear History)
  // user_pref("privacy.cpd.history", false); // FF127 or lower
  // user_pref("privacy.clearHistory.historyFormDataAndDownloads", false); // FF128+

Image

this is shadows useroveride and an image of the parrot message.... can't figure out what to change to keep the browsing history between each restart... kinda miffed it nuked shadows tab list that they had setup... but not a super big deal just want a working way to keep the tabs open with history between reboots

@shadow-absorber
Copy link

and figured it out:

// heavy resist fingerprinting
user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("privacy.spoof_english", 2);

// keep tabs and history between reboots 
user_pref("privacy.clearHistory.browsingHistoryAndDownloads", false);
user_pref("privacy.clearHistory.formdata", true);
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", false);
user_pref("privacy.clearOnShutdown_v2.downloads", true);
user_pref("privacy.clearOnShutdown_v2.formdata", true);
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", false);
user_pref("privacy.clearSiteData.formdata", true);

and it works again

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 7, 2025

edit: for all readers who may be struggling to understand

can't figure out what to change

it's really quite simple: to quote myself from the OP

  • so for all three dialogs (clearHistory, clearOnShutdown_v2, clearSiteData) we have another migration
  • for each the *historyFormDataAndDownloads pref migrates to the relevant prefs below

so taking clearOnShutdown_v2 [1]

// the pref you've been using since FF128
user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", true); // history (+ download history) and forms

// the prefs migrated to
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true); // history (+ download history)
user_pref("privacy.clearOnShutdown_v2.downloads", true);
user_pref("privacy.clearOnShutdown_v2.formdata", true); // forms

and clearSiteData

// the pref you've been using since FF128
user_pref("privacy.clearSiteData.historyFormDataAndDownloads", true);  // history (+ download history) and forms

// the prefs migrated to
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true); // history (+ download history)
user_pref("privacy.clearSiteData.formdata", true); // forms

and clearHistory the same idea

and figured it out:

good :)

  • 3 x false to keep history for 1) sanitizing on close, 2) manual sanitizing (ctrl-shift-del) and 3) clear site data button in the settings
  • the 4 set to true (3 x forms and that 1 download item) are the arkenfox defaults, so you don't need them in your overrides

[1] IDK exactly why they have a downloads pref just for clearOnShutdown_v2 , it's doesn't seem to change with anything in the UI and I can't guarantee it's behavior. The old legacy prefs from FF127 and earlier had something similar

  • user.js/user.js

    Line 657 in 9bba578

    * [NOTE] If "history" is true, downloads will also be cleared ***/
  • user.js/user.js

    Lines 698 to 699 in 9bba578

    * [NOTE] Regardless of what you set "downloads" to, as soon as the dialog
    * for "Clear Recent History" is opened, it is synced to the same as "history"

^ this refers to the old legacy code prior to FF128 in case anyone

@Tiagoquix
Copy link
Contributor

Tiagoquix commented Mar 7, 2025

@Thorin-Oakenpants My question is whetever or not it is safe to migrate to user.js v135 before updating to Firefox v136. I belive the better solution would be to keep the legacy crap (old migration prefs) until v137 before safely removing them?

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 7, 2025

if i were you I would do if before updating. And after you update, open each dialog and check what you have - and if it;s not right change it in the dialog. Then close and restart and check the dialogs are correct - and if they're not then change them in the dialog and edit the user.js and close and restart and check.... until you get it right (it's really not that complicated)

I'm not 100% certain about having to open the dialogs to force the migration, but I had some weird things in mine but i didn't record the order in which i was looking at prefs in about:config or checking UI etc - but some things didn't add up as I thought they would - didn't take notes. Honestly I think the migration is not as straightforward as migrating your values (and I'm not going to check), for example. And the default are not the same across the three dialogs

The point was you should open the dialogs anyway to check

As to your question - I am 100% sure the legacy pre-FF128 prefs are not used/consulted, because that wouldn't be respecting the user's current choices when migrating and all hell would break loose with complaints

@Tiagoquix
Copy link
Contributor

Tiagoquix commented Mar 7, 2025

@Thorin-Oakenpants For me two things are still not clear:

(1) Why can't we keep all the legacy FF128 prefs together with the new non-V2 and V2 prefs? I believe keeping all of them until version 137 or so makes it safer to upgrade Arkenfox. I use Arkenfox's defaults in regards to clear on shutdown and so on, but I still don't think it's safe to migrate somehow.

(2) Regarding migration, should someone with default values worry about it?

I have the following values in my Firefox 135.0.1 (all are Arkenfox defaults; I do not have override for them):

image

image

image

image

image

So, if I understand it correctly:

privacy.cpd* prefs have not been used since 128.
Non-V2 privacy.clearOnShutdown* prefs are not used in Firefox version 136.
Both non-V2 and V2 privacy.clearOnShutdown* prefs are used in both versions 135 and 136.

For me it's not clear if applying the prefs now in version 135 will be invalid because as I understand it the V2 prefs are only relevant in 136, so if I apply the v135 update now it would basically be the same as not having Arkenfox after applying the update.

I don't wanna risk it, so commenting here to be sure.

@Thorin-Oakenpants
Copy link
Contributor Author

Why can't we keep all the legacy FF128 prefs together

because the section explaining it was getting out of control and too fucking messy and the prefs are no longer used - by now in FF136 you should have done the migration in 128

@flutagh
Copy link

flutagh commented Mar 10, 2025

Also, all you mac and linux RFP users ... all hail me for getting this over the line after 3 years or so ... and also give a wave (no hailing) to @PieroV for the patch

user.js/user.js

Lines 732 to 734 in 3d76c74
1333651 - spoof User Agent & Navigator API
JS: spoofed as Windows 10, OS 10.15, Android 10, or Linux
HTTP Header: spoofed as Windows 10 or Android 10.15 until FF136 then matches JS spoof

edit: i know this is v135 but FF136 has been released .. so start hailing

I updated my user.js today and (as per usual) have these settings:

user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("privacy.spoof_english", 2);

I noticed that that doesn't do the trick anymore – did I correctly gather that this is an FF136 issue and has not yet been patched? I apologize, I am not that savy in terms of in-depth tech talk.

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 10, 2025

The user.js is immaterial - the change for RFP comes in FF136, which you should be on by now

@flutagh
Copy link

flutagh commented Mar 10, 2025

The user.js is immaterial - the change for RFP comes in FF136, which you should be on by now

* the bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1840385

Thank you very much for the insight! Do you think they will ever "fix" this on their end?

@Thorin-Oakenpants
Copy link
Contributor Author

It is fixed - in FF136

@flutagh
Copy link

flutagh commented Mar 10, 2025

It is fixed - in FF136

Sorry to be bugging you with this, but it doesn't seem to be working anymore for me. For example when logging into Github and getting the "Please verify your device" mail, it shows the actual operating system, which before it never did.

@Thorin-Oakenpants
Copy link
Contributor Author

Thorin-Oakenpants commented Mar 10, 2025

That's what the fix is - https://bugzilla.mozilla.org/show_bug.cgi?id=1840385#c4 Do not spoof the OS in HTTP User Agent

the patch description is a little misleading. We do spoof by ensuring the string is the same per OS

  • e.g. linux: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
  • ignoring the version number, this can differ if the architecture differs or the distro modifies it by sticking their name it in

Before

  • JS: OS returned as windows, linux, mac or android
    • because otherwise there are compat issues if limited to windows + android, and with JS it's impossible to hide the OS
  • HTTP Header: userAgent: spoofed as the windows or android string
    • because this was the original patch and they only changed JS to four OSes, which seemed to fix most compat issues. And the header is passive and it was thought this would be good (for Tor Browser) to limit data in ubiquitous logging

Now

  • JS + HTTP Header: returned as window, linux, mac or android

@Tiagoquix
Copy link
Contributor

@Thorin-Oakenpants One thing is still not clear to me: is it safe to use the new user.js in version 135.0.1 considering that it only includes the new v2 clearOnShutdown prefs and resets previous ones? As I understand it, the v2 prefs will only be used in version 136, so if I update my user.js now in version 135.0.1, the clearOnShutdown prefs will have no effect until version 136.

@Thorin-Oakenpants
Copy link
Contributor Author

FYI: https://bugzilla.mozilla.org/show_bug.cgi?id=1952564#c2 - the migration is messed up - CHECK YOUR DIALOGS

@Tiagoquix
Copy link
Contributor

Sorry, but that doesn't not clarify my question.

The thing is that prefsCleaner will run when I update the user.js to version 135 while being on Firefox version 135. That will make the old clearonShutdown prefs inactive and then only set the v2 prefs. How would they be migrated if prefsCleaner removes them?

@Thorin-Oakenpants
Copy link
Contributor Author

Sorry, but that doesn't not clarify my question.

that wasn't an answer to your question, which I have answered at least three times, along with instructions on the release notes. I cannot help you any more.

it was so people can blame the migration code for their woes, despite the instructions (which not everyone will read, but there was nothing else I could do), not arkenfox

@Tiagoquix
Copy link
Contributor

Tiagoquix commented Mar 11, 2025

For anyone out there, here's what I did:

Updated to Firefox 136.

Updated user.js to the latest version before starting Firefox 136 (and also used prefsCleaner).
Since I use Arkenfox's defaults in regards to cleaning history, I didn't had to change my overrides.

Then, I opened all those dialogs here: #1941 (comment)

Afterwards, I manually checked about:config for all entries: privacy.sanitize*, privacy.clearOnShutdown_v2*, privacy.clearSiteData* and privacy.clearHistory*.

I also checked the migration prefs, which are as follows for me (I hadn't opened the dialogs in the previous migration because I didn't even know about it):
image

From my checks of the new entries regarding privacy.* prefs, I noticed they were all in order, with the exception of privacy.clearHistory.cookiesAndStorage, which was true despite Arkenfox setting it to false. So, I went to about:config and set privacy.sanitize.sanitizeOnShutdown to false to ignore all of the sanitize-related prefs temporarily. Then, I restarted Firefox and in the new launch privacy.clearHistory.cookiesAndStorage was correctly set to the Arkenfox value (true). And I believe everything is now correct and in place. (The restart also sets privacy.sanitize.sanitizeOnShutdown back to true, so don't worry about that.)

Hope this helps anyone out there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

7 participants
@theltalpha @shadow-absorber @Thorin-Oakenpants @Tiagoquix @icpantsparti2 @flutagh and others