change 4600s into do not use, #1221 #1225
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is a draft - merge 4700's into 4600s - remove old numbers in the square brackets - remove notation of when RFP kicked in (that info is in 4500s) - since we now do not recommend this section - cleanup info on each release in README section - do away with one char flip - move 4616 to deprecated where it belongs - remove "optional if..." lines - start cleaning up references, descriptions to shorten the section - will list what I removed: e.g. bugzillas to when the pref was added are a bit useless todo / consider - 4600 title - 4600 section description can be a lot better - 4600 link to wiki page on RFP ( issue #1218 - that is, if RFP is not for you, then just use Canvas Blocker, which can leak but should fool naive scripts if any get thru etc ) - do we want to add dom.enable_performance_navigation_timing while these all fit together as "covered by RFP", some of these seem out of place - maybe we could split this into two - 4600: "optional without RFP" - these won't hurt RFP but they also won't help your fingerprinting - e.g. font vis, prefers-color, prefers-reduced-motion - 4700: "do not use EVER especially with RFP" - these will affect RFP, can break shit, etc, and won't help your fingerprinting - e.g. all the timing stuff, disabling APIs, etc - also. the webgl one seems a bit out of place since we disable webgl - we could always move some items back to their relevant sections as inactive with some sort of RFP tag/warning I'm not sure what's the cleanest way to convey this. Anyway, pushing a PR to get some discussion going
|
references removed so far 4601: spoof number of CPU cores [FF48+]
4607: disable giving away network info [FF31+]
4619: [2510] disable Web Audio API [FF51+]
|
we can make prefs inactive which aren't deprecated
work in progress, prototyping - 4604 - 1357733 is a duplicate of [1359076](https://bugzilla.mozilla.org/show_bug.cgi?id=1359076) which was non-stable -> [1462308](https://bugzilla.mozilla.org/show_bug.cgi?id=1462308) which I listed for now, where certain Sensor APIs were disabled in FF62+ - see [this](https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/62#APIs_2) - so swap 1357733 with 1462308 - remove tor ticket: it adds nothing: it just says, ooh, flip this pref - 4604: part two: we need to update what the threat is - added MDN Sensor API status page - I need to check but AFAIK, only orientation and motion is left: motion has some precision (that's the 1292751 bugzilla) - left in for now: the PoC - but 99% sure (see above bullet point) it doesn't apply anymore to FF - 4606: we don't need the tor issue: the FP info is listed in the description (USB device ID enumeration) - 4607: wicg is all we need - 4610: bugzilla adds nothing, it's just a reference to the pref being added, tor ticket also adds nothing: FPing issue is in description anyway, that's four more lines less noise
5 more lines gone - 4604: PoC does not apply - 4605: make title more accurate, trim description into one line - 4613: https://developer.mozilla.org/docs/Web/Events/devicechange adds nothing - 4614: we don't need the bugzilla of when this was added to the API
20 more lines gone - wiki links are old: e.g. last updated 2012, 2015 - some MDN links can be replaced by using the API name in the item title, and some links don't really add anything - effectively remove all references: not here to explain the issue, we do not recommend using these - if a user wants to know what the threat is, they are already linked to the RFP tickets that each one addresses
|
I consider this ready to push
Edit: Ahhh, I was wondering what the missing 4609 was: it was |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a draft
todo / consider
while these all fit together as "covered by RFP", some of these seem out of place
I'm not sure what's the cleanest way to convey this. Anyway, pushing a PR to get some discussion going