Felix Mikolasch, data protection lawyer at noyb: “Mozilla has just bought into the narrative that the advertising industry has a right to track users by turning Firefox into an ad measurement tool. While Mozilla may have had good intentions, it is very unlikely that ‘privacy preserving attribution’ will replace cookies and other tracking tools. It is just a new, additional means of tracking users.”

Sigh… I cannot for the life of me figure how anyone could think that enabling PPA (even by default) means that advertising industry has somehow right to track folks. Like dude, the entire point of PPA is that advertisers could then get to know if/when their adverts are working without tracking people.

The argument that “It is just a new, additional means of tracking users” also doesn’t really make sense - even if we assume that this is new means of tracking. I mean, sure it technically is new addition, but it’s like infinity+1 is still infinity - it doesn’t make a difference. The magnitude of this one datapoint is about the same as addition of any new web api (I mean there are lots that shouldn’t exist - looking at you chromium… but that’s besides the point).

File a complaint over use of third-party cookies and actual tracking if you want to be useful - this complaint just makes you look like an idiot.

Also, Servo was originally more or less a testbed for new rendering pathway (webrender) which, when ready, was then integrated into Firefox.

True, and I agree - for this feature to be effective the site-specific rules need to be maintained properly.

All I’m saying is that it leaving some query parameters unremoved is not indicative of the feature not working. If you want to add more query parameters to the removed list then feel free to open a bug about it.

That feature removes parameters that are known to be used for tracking. It does not remove all query parameters willy-nilly. For example on youtube it should remove si, feature and kw parameters as well as a set of parameters on a list that applies to all websites. However, pp parameter is not in that to-be-removed list.

As an example v parameter is for video id on youtube, it would be kinda silly if that was removed, so the feature kinda has to do some site specific action.

Reader mode can show images as well though. I mean, it isn’t always successful in doing so - probably because there’s about a million different ways a random website could show an image - but reader mode can show images that it thinks are part of the actual content.

I’m not seeing any such issue with Nightly on my Fedora system.

Indeed. Also, the auto-open PiP is super nice feature I’ve been using a lot.

I don’t think Firefox Color can do that. At best you could test and set colors using Color, and then export the settings for both as a theme .zip or .xpi files, and then combine the two to a single manifest.json file. Inside the manifest, a "theme" key would be color properties for “normal” theme and "dark_theme" would be for dark-theme. After that you would submit the theme package to get it signed after which it can be installed as a real theme.

Yes. Firefox doesn’t create user.js file itself - if you want one then you need to create it yourself either manually or with some tool. Also, I’ve seen some “security” software create user.js file without notifying the user about it…

What I’m trying to point out here, is that prefs declared in user.js (whether they are put there using scripting or otherwise) cannot be persistently modified at runtime from within Firefox. That may or may not be a huge problem, but something to be aware of.

Sure. For simplified example have only the following in your user.js file:

user_pref("browser.tabs.warnOnClose",true);

1. Start Firefox
2. Observe that the pref is indeed true
3. Go to Setting > General, observe that Confirm before closing multiple tabs is checked
4. Uncheck the option
5. In about:config observe that browser.tabs.warnOnClose is now false
6. Restart Firefox
7. Observe that the pref is again set to true

The reason is also very simple. Firefox will never write anything to user.js - thus any changes you do at runtime will only be stored to prefs.js. However, user.js always overrides prefs.js at startup.

Yes, but that is not what I’m talking about. What I mean is that when Firefox is running and you go to change some setting in say, Settings page, then the new value for that preference is stored into prefs.js (at latest on Firefox shutdown, it might remain only in-memory for some time I’m not sure). Anyway, the new value persists only for that browser session, because on next startup whatever value was set by user.js will override it.

I don’t think that could work. Not unless we are talking about different things, or unless you run their updater script everytime before starting Firefox.

In addition, if you use user.js then you essentially cannot change those settings at runtime (via about:config or otherwise), because your user.js will override the settings on next startup. Maybe that’s desired for some, but good to keep in mind nonetheless.

Yeah… It’s a bit hard to balance things like this though, I’ve seen lot’s of folks complain about how their Firefox is apparently “broken” because it now suddenly has this empty margin around web-content seemingly wasting space for no reason - and then it turns out that they have deliberately turned this very feature on. And that is even if the feature is completely hidden - I wonder how many more complaints there would be if options like this are made more accessible.

The letterboxing feature has been in Firefox since 2019 - starting from Firefox 67 I think. The preference for it might have been hidden though so maybe it’s just relatively unknown feature - I don’t know if or how visible LibreWolf makes makes it for the user. But regardless, any modern Firefox variant probably has that capability.

Sounds like you are talking about Firefox’s letterboxing feature which you can enable/disable independently from full fingerprinting resistance.

I’m not sure if resistFingerprinting does anything to stop websites from uploading whatever data they can get though, I don’t think it does that. And I don’t think it could really do that in the first place since the website could just obfuscate the data and browser wouldn’t know what is sent.

That’s not necessarily a good solution either, because a service could figure out that the source of random fingerprint data likely comes from the same user. Especially if your ip is not changing. It might perhaps be effective if a substantial amount of people were doing it though.

But to generate such random fingerprint is difficult because it consists of many parts and services don’t all build fingerprints the aame way. You could easily randomize e.g. canvas data, but the issue is that if you only randomize one data point then that one random data point pretty uniquely identifies you if your other datapoints are stable. So to be effective you would really need to randomize several different datapoints and that may not be such an easy task since websites could build them in all sorts of ways.