1.3 Implementation

🔸 Before you do anything...

• Read the overview. It is important to understand how a user.js works with Firefox and what it can do.
• Learn how to find and back up your profile(s)
• If you already have a user.js, consider using Compare-UserJS, an excellent tool to compare user.js files and output the diffs in detailed breakdown - developed by our very own resident cat, claustromaniac 🐈

⭐ Do not just take the user.js and use it as is. It's a template, treat it as such. Much has gone into making the defaults responsible and to not put anyone at risk. At worst, you will only get some inconvenience and breakage, and that's to be expected with a fairly hardened setup. Everyone's mileage will differ, and you can undo things that "break".

🔸 Tags

While not 100% definitive, we have included [SETUP* tags for troubleshooting and setting up. Choose wisely, there is always a trade-off. Some examples

• [SETUP-WEB] can cause some websites to break
• [SETUP-CHROME] changes how Firefox itself behaves (i.e. NOT directly website related)
• [SETUP-PERF] may impact performance

🔸 Very important, check these first...

❗ ULTRA UBER IMPORTANT: Pay attention!

• FYI: Auto-INSTALLING of Firefox updates is disabled (0302a)
  • ⭐ You will always get prompts and reminders from Firefox
  • Please keep your software up to date in a timely fashion.
• FYI: We provide information on Tracking Protection (TP) and Safe Browsing (SB)
  • The only part we have ever disabled, are the real-time binary checks with Google (0414)
  • ⭐ Disable TP and the rest of SB at your own risk
• We delete cookies and history (download, form and browsing histories)
  • ⭐ Make changes to section 2800 to your liking
• We disable search & form history (0860)
  • ⭐ Form data can easily be stolen by third parties. The PoC (Proof of Concept) linked in this 2011 article is still not mitigated almost 8 years later

❗ SUPER IMPORTANT: First Party Isolation (FPI), privacy.resistFingerprinting (RFP)

• FPI is enabled (4001)
  • It is recommended that you clear (Ctrl-Shift-Del) everything (except passwords and site preferences) when first enabling (or permanently disabling) this, so orphaned Origin Attribute data is cleared
• RFP is enabled (section 4500)
  • As RFP patches land in stable, alternative existing preferences are moved to section 4600 and made inactive
  • ⭐ non-RFP users may want to enable section 4600
  • ⭐ RFP users should reset items in 4600 in about:config, as some cause RFP to not behave as you would expect and alter your fingerprint

❗ RATHER IMPORTANT: Miscellaneous

• HTTP2 (0702)
• AltSvc (0703)
• Cache (1001)

❗ QUITE IMPORTANT: Other preferences may cause site breakage, but nothing that can't be fixed. You won't "lose" anything...- it's not the end of the world.

• Search for [SETUP tags in the user.js
• There is a deprecated (section 9999)
  • ESR users will want to switch on the relevant ESR section
  • STABLE users will want to reset these prefs in about:config

🔸 Decide on a strategy...

So you have a user.js, you know how it all works, and you have checked and made a few changes. Now you can choose what profile to use. You can read all about working with profiles and portable profiles and also how to run concurrent profiles right here in this wiki.

• You could:
  • Use a clone of your current profile (name it something meaningful)
  • Use a new default profile
  • Use your current profile (Back it up first)

If you use a clone of your current profile, then you already have everything set up (bookmarks, extensions, etc) and you would be able to use your original profile if anything "broke".

The only other consideration would be how much of the user.js to introduce. You could either add the whole thing in one hit, or just add a few sections every so often. To be honest, there are probably less than a dozen settings that "break" a few sites functionality and they are easily reset.

Good luck, and don't be afraid to ask for help.