Fix open issues/PRs #197 #108 #111 #236 #238 #239

nodiscc · 2017-03-14T14:45:34Z

~~Incomplete PR in the current state (#238 work still going on) but the~~ first commits can be reviewed/merged independently (see commit messages):

add firefox version indication for battery api (fixes Remove battery API option when Firefox 52 is released #197)
add commented out prefs for effective default search engine choice (closes Update user.js - DuckDuckGo #108)
document disabling push notifications (references in commit message, closes Disable WebPush? #111)
Add missing preferences descriptions (Fixes Write descriptions to the rest of the prefs #236)
set security.ask_for_password to 2 (lock password storage periodically), set password storage lock timeout to 1 minute (fixes Change value of security.ask_for_password #235)
improve and reorder FAQ d1e4b6d
rename LICENSE.txt file to LICENSE, link to it from README eb45fd7
more explicit NOTICE: fields 581309b
gen-readme.sh: add 'known problems and limitations' section generation 930967b
run make, generate 'kwown problems and limitations' readme section, fixes Move 'Known problems' to NOTICE: fields alongside relevant prefs #238 b70f602

fixes #197

closes #108

Other references: #111 https://hacks.mozilla.org/2016/01/web-push-arrives-in-firefox-44/ https://developer.mozilla.org/en-US/docs/Archive/Firefox_OS/API/Simple_Push_API https://support.mozilla.org/t5/Firefox/How-to-disable-web-push-notifications-in-Firefox/m-p/1281001 https://en.wikipedia.org/wiki/Push_technology https://trac.torproject.org/projects/tor/ticket/18801 https://support.mozilla.org/t5/Basic-Browsing/Web-Push-notifications-in-Firefox/ta-p/28744 https://support.mozilla.org/t5/Firefox/How-to-stop-the-webpush-notifications/m-p/1292770 https://developer.mozilla.org/en/docs/Web/API/Push_API https://github.com/chrisdavidmills/push-api-demo Closes #111

Fixes #236

set password storage lock timeout to 1 minute fixes #235

… add TODOs

… NOTICE: fields, prepapre work on #238 (automate section generation)

nodiscc · 2017-03-14T17:26:07Z

Done. Check out https://github.com/nodiscc/user.js/tree/2017-mar#known-problems-and-limitations

Fixes #238

…fing: Users wanting to disable referer spoofing to workaround listed problems will still be protected against disclosing previously visited pages to target domains when clicking on a link

nodiscc · 2017-03-17T14:06:17Z

@pyllyukko ping, waiting for review.

pyllyukko · 2017-03-18T09:37:06Z

@pyllyukko ping, waiting for review.

Pong. Sorry about that. I've been quite busy this week and have had zero time to look into these. Will get working on these ASAP, but it might still take few days.

pyllyukko

👍

pyllyukko · 2017-03-18T09:53:01Z

I seem to be unable to figure out how the review functionality works 😛 Tried to do one commit at a time but failed.

pyllyukko · 2017-03-18T10:01:02Z

user.js

 user_pref("security.ssl.treat_unsafe_negotiation_as_broken",	true);

-// PREF: ?? (disabled)
+// PREF: Disallow connection to servers not supporting safe renegotiation


Shouldn't this have the "(disabled)" suffix, as the setting is still disabled.

pyllyukko · 2017-03-18T10:54:39Z

README.md

@@ -596,6 +596,12 @@ For more information, see [CONTRIBUTING](https://github.com/pyllyukko/user.js/bl

 --------------------------------------------------------------------------

+## License


This is already quite evident at least when browsing the README through GitHub:

pyllyukko · 2017-03-18T10:55:57Z

user.js

@@ -506,19 +506,19 @@ user_pref("security.sri.enable",				true);
 // https://en.wikipedia.org/wiki/Do_not_track_header
 // https://dnt-dashboard.mozilla.org
 // https://github.com/pyllyukko/user.js/issues/11
-// NOTICE: DNT must be enabled manually
+// NOTICE: Do No Track must be enabled manually


Could be "Do Not Track (DNT)"

pyllyukko · 2017-03-18T10:57:47Z

user.js

 // TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs
 user_pref("network.http.referer.spoofSource",			true);

 // PREF: Accept Only 1st Party Cookies
 // http://kb.mozillazine.org/Network.cookie.cookieBehavior#1
-// NOTICE: Breaks a number of payment gateways
+// NOTICE: Blocking 3rd-party cookies breaks a number of payment gateways


We should have some refs to back this up

pyllyukko · 2017-03-18T11:01:56Z

README.md

-
+* Disabling DOM storage is known to cause`TypeError: localStorage is null` errors
+* IndexedDB could be used for tracking purposes, but is required for some add-ons to work (notably uBlock), so is left enabled
+* Firefox Hello requires setting `media.peerconnection.enabled` and `media.getusermedia.screensharing.enabled` to true, `security.OCSP.require` to false to work.


Maybe we should get rid of this, as Firefox Hello is no more?

pyllyukko · 2017-03-18T11:06:06Z

README.md

+* OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
+* OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder
+* OCSP adds latency (performance)
+* Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)


pyllyukko · 2017-03-18T11:15:01Z

user.js

 // TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs
 user_pref("network.http.referer.spoofSource",			true);

+// PREF: Don't send referer headers when following links across different domains
+// https://github.com/pyllyukko/user.js/issues/227
+user_pref("network.http.referer.XOriginPolicy",		2);


See here: #227 (comment)

pyllyukko · 2017-03-18T11:34:32Z

README.md

@@ -369,13 +370,11 @@ See also:

 ## Known problems

-There are plenty! Hardening your browser will break your interwebs. Here's some examples:
+Hardening your often implies a trade-off with ease-of-use and comes with reduced functionality. Here is a list of known problems/limitations:


"Hardening your"... what?

pyllyukko · 2017-03-18T11:37:14Z

README.md

+* Spoofing referers breaks visualisation of 3rd-party sites on the Lightbeam addon
+* Blocking 3rd-party cookies breaks a number of payment gateways
+* You can not view or inspect cookies when in private browsing: https://bugzilla.mozilla.org/show_bug.cgi?id=823941
+* Installing user.js will **remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)


Maybe we should have similar refs parsing as in "what does it do" section?

add missing (disabled) suffix remove license section from readme add notice about serviceworkers breakage

nodiscc · 2017-03-18T14:05:40Z

Fixed all points mentioned in the review f14e293

nodiscc added 6 commits March 14, 2017 14:37

add firefox version indication for battery api

02ec264

fixes #197

add commented out prefs for *effective* default search engine choice

621c4e2

closes #108

Add missing preferences descriptions

9ad47f9

Fixes #236

set security.ask_for_password to 2 (lock password storage periodically),

854e5de

set password storage lock timeout to 1 minute fixes #235

start moving some known problems/limitations to user.js, work on #238,…

0e23e4b

… add TODOs

nodiscc mentioned this pull request Mar 14, 2017

Detail causes for sec_error_ocsp_invalid_signing_cert error #240

Closed

nodiscc added 7 commits March 14, 2017 18:07

README: remove TODOs (moved to issues)

17f44ce

README: rename 'known problems' to 'known problems and limitations'

dd2f73b

README: move known problems and limitations to relevant user.js prefs…

bb2bdc5

… NOTICE: fields, prepapre work on #238 (automate section generation)

README: improve and reorder FAQ

d1e4b6d

rename LICENSE.txt file to LICENSE, link to it from README

eb45fd7

more explicit NOTICE: fields

581309b

gen-readme.sh: add 'known problems and limitations' section generation

930967b

run make, generate 'kwown problems and limitations' readme section

b70f602

Fixes #238

nodiscc changed the title ~~Fix open issues/PRs 197 108 111 236, work on #238~~ Fix open issues/PRs #197 #108 #111 #236 #238 Mar 14, 2017

This was referenced Mar 14, 2017

README: separate CAs hardening documentation #242

Merged

Use spaces instead of tabs for spacing #243

Closed

add network.http.referer.XOriginPolicy: 2 in addition to referer spoo…

fe7555a

…fing: Users wanting to disable referer spoofing to workaround listed problems will still be protected against disclosing previously visited pages to target domains when clicking on a link

nodiscc mentioned this pull request Mar 15, 2017

Rewrite Referer preferences/section #227

Closed

pyllyukko reviewed Mar 18, 2017

View reviewed changes

disable network.http.referer.XOriginPolicy

f14e293

add missing (disabled) suffix remove license section from readme add notice about serviceworkers breakage

tests: add badssl

4659c95

pyllyukko merged commit 4659c95 into pyllyukko:master Mar 19, 2017

nodiscc deleted the 2017-mar branch March 19, 2017 14:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix open issues/PRs #197 #108 #111 #236 #238 #239

Fix open issues/PRs #197 #108 #111 #236 #238 #239

nodiscc commented Mar 14, 2017 •

edited

Loading

nodiscc commented Mar 14, 2017

nodiscc commented Mar 17, 2017

pyllyukko commented Mar 18, 2017

pyllyukko left a comment

pyllyukko commented Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

pyllyukko Mar 18, 2017

nodiscc commented Mar 18, 2017

		@@ -596,6 +596,12 @@ For more information, see [CONTRIBUTING](https://github.com/pyllyukko/user.js/bl

		--------------------------------------------------------------------------

		## License

Fix open issues/PRs #197 #108 #111 #236 #238 #239

Fix open issues/PRs #197 #108 #111 #236 #238 #239

Conversation

nodiscc commented Mar 14, 2017 • edited Loading

nodiscc commented Mar 14, 2017

nodiscc commented Mar 17, 2017

pyllyukko commented Mar 18, 2017

pyllyukko left a comment

Choose a reason for hiding this comment

pyllyukko commented Mar 18, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nodiscc commented Mar 18, 2017

nodiscc commented Mar 14, 2017 •

edited

Loading