ToDo: diffs FF113-FF114 #1688
Comments
some bugzilla tickets
|
|
Not that it really matters, but RFP no longer seem to apply to extensions (and their outgoing connections) in 114+. Should we stick a warning somewhere reminding users to vet the code of any random extension they might have installed? |
|
As per OP, which I edited 4 hrs ago
no need for a warning - the pref was labelled experimental and we do not recommend any extensions that would be affected |
|
https://phabricator.services.mozilla.com/D174014 bool isExemptDomain = false;
// Exclude internal schemes and web extensions
if (aURI->SchemeIs("about") || aURI->SchemeIs("chrome") ||
aURI->SchemeIs("resource") || aURI->SchemeIs("view-source") ||
aURI->SchemeIs("moz-extension")) {
return false;
}extensions should be exempt. Can you elaborate on why you think they are not exempted - @Jee-Hex edit: tom ritter said it's possible there's a hole in the extension-exempting logic, so test in Nightly |
|
is there any info on |
|
I wrote something about it at #1661 (comment) |
That's what I meant– extensions are now exempted from RFP by default (not that you can override them AFAIK) and some users may not have expected that when they turned RFP on. |
|
ahh ok, and no, no warning needed - users should be vetting extensions anyway, and we only recommend a tiny few |
|
I just did a little test drive in FF115 with so I think there are better solutions/configs coming, but maybe someone would like non RFP in normal mode (maybe use CanvasBlocker for some subtle canvas rando), and RFP in PB mode |
|
so the checkbox is for the pref Is this worth exposing, or should we just wait? Should we add I'm open to a little more DoH stuff being added now it's been twenty years since the last kerfuffle and it's matured - note we can do it next release, so we don't have to hold this one up - please advise |
|
How does the warning look like
On the opposite this means it is not shown if you use mode 3 (strict mode). This mode has it's own warning. If you want to actively use DoH, you should use mode 3 like you should use https_only rather than https_first. Mode 3 has site-exceptions with a nice UI on the error page. Unlike mode 2 + warning pref which has https://bugzilla.mozilla.org/show_bug.cgi?id=1833828. TL;DR: Until https://bugzilla.mozilla.org/show_bug.cgi?id=1833828 is fixed, no. After that recommending mode 3 + site-exceptions is still better IMHO. |
|
FF114 is scheduled for release Jun. 6th
FF114 release notes
FF114 for developers
FF114 security advisories
65 diffs ( 40 new, 12 gone, 13 different )
4501pref("privacy.resistFingerprinting.pbmode", false); - cecb833removed, renamed or hidden in v114.0:
1501pref("extensions.formautofill.heuristics.enabled", true); - 18296702816pref("privacy.clearsitedata.cache.enabled", false); - 18216514505pref("privacy.resistFingerprinting.testGranularityMask", 0); - 1824235 pref remains but does nothingignore
click me for details
==NEW
==REMOVED, RENAMED or HIDDEN
==CHANGED
The text was updated successfully, but these errors were encountered: