Librefox : Official Firefox With Freedom [](https://twitter.com/intent/tweet?text=Librefox%2C%20official%20firefox%20with%20a%20better%20privacy%2C%20security%20and%20performance&url=https://github.com/intika/Librefox-Firefox&via=intika&hashtags=firefox,librefox,browser,privacy,developers)
Librefox : Official Firefox With Freedom [](https://twitter.com/intent/tweet?text=Librefox%2C%20official%20firefox%20with%20a%20better%20privacy%2C%20security%20and%20performance&url=https://github.com/intika/Librefox-Firefox&via=intika&hashtags=firefox,librefox,browser,privacy,developers)
----------------------------------------
----------------------------------------
This project aim to fix privacy and security issues related to firefox without losing performances nor forking the project. It uses `local-settings.js`, `mozilla.cfg` and `policies.json`.
This project aims to fix privacy and security issues related to Firefox without losing performance nor forking the project. It uses `local-settings.js`, `mozilla.cfg` and `policies.json`.
Features :
Features :
----------
----------
Librefox uses [gHacks](https://github.com/ghacksuserjs/ghacks-user.js) settings, additional privacy, performance settings and a cleaned bundle of firefox (updater, crashreporter and integrated addons that don't respect privacy are removed) to provide:
Librefox uses [gHacks](https://github.com/ghacksuserjs/ghacks-user.js) settings, additional privacy, performance settings and a cleaned bundle of Firefox (updater, crashreporter and integrated addons that don't respect privacy are removed) to provide:
Librefox addons are not bundeled and need to be installed manually
Librefox addons are not bundled and need to be installed manually
- [Librefox Dark Theme](https://addons.mozilla.org/en-US/firefox/addon/librefox-dark-theme/) : Dark theme
- [Librefox Dark Theme](https://addons.mozilla.org/en-US/firefox/addon/librefox-dark-theme/) : Dark theme
- [Librefox HTTP Watcher](https://addons.mozilla.org/en-US/firefox/addon/librefox-http-watcher-red-flag/) : Change the url bar color on http sites
- [Librefox HTTP Watcher](https://addons.mozilla.org/en-US/firefox/addon/librefox-http-watcher-red-flag/) : Change the url bar color on HTTP sites
- [Librefox Reload Button](https://addons.mozilla.org/en-US/firefox/addon/librefox-reload-button-url-bar/) : Add a reload button to url bar
- [Librefox Reload Button](https://addons.mozilla.org/en-US/firefox/addon/librefox-reload-button-url-bar/) : Add a reload button to the URL bar
Recommended Addons :
Recommended Addons :
--------------------
--------------------
Recommended addons are not bundeled and need to be installed manually
Recommended addons are not bundeled and need to be installed manually
- [Cookie Master](https://addons.mozilla.org/en-US/firefox/addon/cookiemaster/) : Block all cookies and only allow authorised sites
- [Cookie Master](https://addons.mozilla.org/en-US/firefox/addon/cookiemaster/) : Block all cookies and only allow authorized sites
- [First Party Isolation](https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/) : Enable/Disable FPI with a button
- [First Party Isolation](https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/) : Enable/Disable FPI with the click of a button
- [User Agent Platform Spoofer](https://addons.mozilla.org/en-US/firefox/addon/user-agent-platform-spoofer/) : Invert UserAgent OS Linux/Windows/Mac
- [User Agent Platform Spoofer](https://addons.mozilla.org/en-US/firefox/addon/user-agent-platform-spoofer/) : Spoof UserAgent OS (Linux/Windows/Mac)
- [Browser Plugs Privacy Firewall](https://addons.mozilla.org/en-US/firefox/addon/browser-plugs-privacy-firewall/) : Sets of settings to prevent fingerprintings and security issues
- [Browser Plugs Privacy Firewall](https://addons.mozilla.org/en-US/firefox/addon/browser-plugs-privacy-firewall/) : Sets of settings to prevent fingerprinting and security issues
- [uBock Origin](https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/) [+ IDCAC List](https://www.i-dont-care-about-cookies.eu/) [+ Nano-Defender List](https://jspenguin2017.github.io/uBlockProtector/#extra-installation-steps-for-ublock-origin) : Block web advertisement and tracking
- [uBock Origin](https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/) [+ IDCAC List](https://www.i-dont-care-about-cookies.eu/) [+ Nano-Defender List](https://jspenguin2017.github.io/uBlockProtector/#extra-installation-steps-for-ublock-origin) : Block web advertisement and tracking
Recommended Addons Settings :
Recommended Addons Settings :
-----------------------------
-----------------------------
`uBlock` : Additional filters are availables here https://filterlists.com/ (don't surcharge it to avoid performances loss)
`uBlock` : Additional filters are available here: https://filterlists.com/ (don't surcharge it to avoid performance loss)
`Browser Plugs Privacy Firewall` : Keep settings light to make `privacy.resistFingerprinting` efficient because too much customization lead to uniqueness thus easy fingerprinting.
`Browser Plugs Privacy Firewall` : Keep settings light to make `privacy.resistFingerprinting` efficient because too much customization will lead to uniqueness and therefore easy fingerprinting.
```
```
- Privacy / Fingerprint / Fake values for getClientRects
- Privacy / Fingerprint / Fake values for getClientRects
- Enforcing/Defaulting Settings (Cannot/Can be changed within firefox)
- Enforcing/Defaulting Settings (Cannot/Can be changed within firefox)
- "IJWY To Shut Up" settings ([details](https://github.com/intika/Librefox-Firefox/#ijwy-i-just-want-you-to-shut-up-))
- "IJWY To Shut Up" Settings ([details](https://github.com/intika/Librefox-Firefox/#ijwy-i-just-want-you-to-shut-up-))
- Limit internet access for extensions ([test-feature](https://github.com/intika/Librefox-Firefox/#extensions-firewall-))
- Limit internet access for extensions ([test-feature](https://github.com/intika/Librefox-Firefox/#extensions-firewall-))
- Performances aware settings
- Performance aware settings
- Disabling telemetry
- Disable telemetry
- Disabling call
- Disable call
...
...
Reviewing Extensions Code :
Reviewing Extensions Code :
---------------------------
---------------------------
Recommended extensions code have been reviewed for potential unwanted behaviour... reviewed version are available under [extensions](https://github.com/intika/Librefox-Firefox/tree/master/extensions) directory
Recommended extensions code have been reviewed for potential unwanted behaviour... reviewed version are available under [extensions](https://github.com/intika/Librefox-Firefox/tree/master/extensions) directory.
Extensions Firewall :
Extensions Firewall :
---------------------
---------------------
**Description :**
**Description :**
*This is a test experiment feature and it is disabled by default !!!* A new section `Extensions Manager` is added to mange addons globally (and addons networking in the subsection `Extensions Firewalling`). Firewalling the network for addons is doable, but it require a considerable additional work in Librefox to make it usable through a button or in a per addon basis (this may or may not be added in a future version, it also could be abandoned as it is a test feature). Currently you can block a list of domains or block the whole network for all the extensions.
*This is a test experiment feature and it is disabled by default !!!* A new section `Extensions Manager` is added to manage addons globally (and addons networking in the subsection `Extensions Firewalling`). Firewalling the network for addons is doable, but it requires a considerable amount of additional work in Librefox to make it usable through a button or in a per addon basis (this may or may not be added in a future version, it also could be abandoned as it is a test feature). Currently you can block a list of domains or block the whole network for all the extensions.
**Quickly Enable It :**
**Quickly Enable It :**
To enable the feature and block the network for all the extensions open `mozilla.cfg` search for `Enable-Firewall-Feature-In-The-Next-Line` en remove the `//` in the next line
To enable the feature and block the network for all the extensions open `mozilla.cfg` search for `Enable-Firewall-Feature-In-The-Next-Line` and remove the `//` in the next line
**The Settings :**
**The Settings :**
Available native network restriction settings for addons :
Available native network restriction settings for addons :
- Restricted domains list : `extensions.webextensions.restrictedDomains` this is a list of restricted domains that will be used to block some hosts for all the extensions, firefox uses this setting to block extensions from accessing mozilla's domains/sites, by default in Librefox this setting is set to allow extensions to access all the web (You can edit that list to match your needs or to block a specific domain, note that the domain name have to be 'exact' for instance facebook.com will only block facebook.com not mobile.fabcebook.com)
- Restricted domains list : `extensions.webextensions.restrictedDomains` this is a list of restricted domains that will be used to block some hosts for all the extensions, firefox uses this setting to block extensions from accessing mozilla's domains/sites, by default in Librefox this setting is set to allow extensions to access all the web (You can edit that list to match your needs or to block a specific domain, note that the domain name has to be 'exact' (for instance facebook.com will only block facebook.com not mobile.facebook.com)
- Content security policy : `extensions.webextensions.base-content-security-policy` and `extensions.webextensions.default-content-security-policy` the later settings can be redefined/changed within an extension so it's not efficient for a firewalling purpose. CSP settings are used in firefox as an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware; In short words CSP settings block and allow certain domains under certain circumstances and thus could be used to firewall the extensions ([CSP Documentations](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), its [sources code](https://code.compassfoundation.io/general/mozilla-central/commit/623a4f866576815dfcbab26323d13b7144806bdf?view=inline&w=1) and [implementation](https://github.com/mozilla/gecko/blob/central/toolkit/components/extensions/ExtensionPolicyService.cpp))
- Content security policy : `extensions.webextensions.base-content-security-policy` and `extensions.webextensions.default-content-security-policy` the later settings can be redefined/changed within an extension so it's not efficient for firewall purposes. CSP settings are used in firefox as an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware; In short: CSP settings block and allow certain domains under certain circumstances and thus could be used to firewall the extensions ([CSP Documentations](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), its [sources code](https://code.compassfoundation.io/general/mozilla-central/commit/623a4f866576815dfcbab26323d13b7144806bdf?view=inline&w=1) and [implementation](https://github.com/mozilla/gecko/blob/central/toolkit/components/extensions/ExtensionPolicyService.cpp))
**Wiki - Blocking a domain :**
**Wiki - Blocking a domain :**
Edit the restricted domains setting as follow under the `about:config` page :
Edit the restricted domains setting as follow under the `about:config` page :
- Restricted Domains Setting : `extensions.webextensions.restrictedDomains` Value : `ExactDomains1,ExactDomains2,ExactDomains3` etc.
- Restricted Domains Setting : `extensions.webextensions.restrictedDomains` Value : `ExactDomains1,ExactDomains2,ExactDomains3` etc.
**Wiki - Blocking the network :**
**Wiki - Blocking the network :**
Note that this will block the network access for all the extensions and a lot of extensions needs to be connected to work. In the current version of Librefox you can block the network for all the extensions or allow it for all of them, a future version may provide additional features like "per addon" setting (By default Librefox allow networking for extensions).
Note that this will block the network access for all the extensions and a lot of extensions needs to be connected in order to work. In the current version of Librefox you can block the network for all the extensions or allow it for all of them, a future version may provide additional features like "per addon" setting (By default Librefox allows networking for extensions).
To block or allow the network access for the extensions change the following settings according to your needs in `about:config` :
To block or allow the network access for the extensions change the following settings according to your needs in `about:config` :
- Allow : CSP Setting : `extensions.webextensions.base-content-security-policy` Value : default (right click and reset)
- Allow : CSP Setting : `extensions.webextensions.base-content-security-policy` Value : default (right click and reset)
**Wiki - More infos :**
**Wiki - More infos :**
Check `debug-check-todo.log` for additional infos about future version and researches about the subject. Also check [CSP Documentations](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), its [sources code](https://code.compassfoundation.io/general/mozilla-central/commit/623a4f866576815dfcbab26323d13b7144806bdf?view=inline&w=1) and [implementation](https://github.com/mozilla/gecko/blob/central/toolkit/components/extensions/ExtensionPolicyService.cpp)
Check `debug-check-todo.log` for additional info about future version and researches about the subject. Also check [CSP Documentations](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), its [sources code](https://code.compassfoundation.io/general/mozilla-central/commit/623a4f866576815dfcbab26323d13b7144806bdf?view=inline&w=1) and [implementation](https://github.com/mozilla/gecko/blob/central/toolkit/components/extensions/ExtensionPolicyService.cpp)
IJWY (I Just Want You To Shut Up) :
IJWY (I Just Want You To Shut Up) :
-----------------------------------
-----------------------------------
This is a set of settings that aim to remove all the servers links embedded in firefox and other calling home functions in the purpose of blocking un-needed connections. The objective is zero unauthorized connection (ping/telemetry/mozilla/google...).
This is a set of settings that aim to remove all the server links embedded in Firefox and other calling home functions in the purpose of blocking un-needed connections. The objective is zero unauthorized connections (ping/telemetry/Mozilla/Google...).
Changelog :
Changelog :
-----------
-----------
Available in the [releases page](https://github.com/intika/Librefox-Firefox/releases)
Available in the [releases page](https://github.com/intika/Librefox-Firefox/releases)
Apply Librefox Manually :
Apply Librefox Manually :
-------------------------
-------------------------
- Copy `mozilla.cfg` to `/firefox-install-dir/`
- Copy `mozilla.cfg` to `/firefox-install-dir/`
- Copy `local-settings.js` to `/firefox-install-dir/defaults/pref/`
- Copy `local-settings.js` to `/firefox-install-dir/defaults/pref/`
- Copy `policies.json` to `/firefox-install-dir/distribution/`
- Copy `policies.json` to `/firefox-install-dir/distribution/`
- If destination directories does not exist create them
- If destination directories does not exist create them
- Setup the rest of the settings as you wish in `about:preferences`
- Setup the rest of the settings as you wish in `about:preferences`
Just edit `mozilla.cfg`, save and restart Firefox.
Browser Tests : Security/Fingerprint :
Browser Tests : Security/Fingerprint :
----------------------------------------------
----------------------------------------------
Firefox 60 and `privacy.resistFingerprinting` are relatively new give it sometimes to be more widely used and thus less finger-printable; If you are using an other site to analyse your browser make sure to read and understand what the test is about.
Firefox 60 and `privacy.resistFingerprinting` are relatively new, please give it sometime to be more widely used and thus less finger-printable; If you are using a different site to analyze your browser make sure to read and understand what the test is about.
Performance tests can be done here [LVP Octane](https://intika.github.io/lvp-octane/), it needs to be launched alone with other applications closed and with no other activity but the benchmark, also it's recommended to lunch it many times and then make an average.
Performance tests can be done here [LVP Octane](https://intika.github.io/lvp-octane/), it needs to be launched alone with other applications closed and with no other activity but the benchmark, also it's recommended to launch it many times and then calculate the average.
Browser Tests : DNS/VPN/Proxy Leak :
Browser Tests : DNS/VPN/Proxy Leak :
------------------------------------
------------------------------------
- [IPLeak](https://ipleak.net/)
- [IPLeak](https://ipleak.net/)
- [Tenta-Test](https://tenta.com/test/)
- [Tenta-Test](https://tenta.com/test/)
- [IP-Browserleaks](https://browserleaks.com/ip)
- [IP-Browserleaks](https://browserleaks.com/ip)
About :
About :
-------
-------
**Autor :** Intika - intikadev (at) gmail.com
**Author :** Intika - intikadev (at) gmail.com
**Donation :** Paypal : intikadev (at) gmail.com
**Donation :** Paypal : intikadev (at) gmail.com
**Based on :** [User.js](https://github.com/pyllyukko/user.js/), [PrivaConf](https://addons.mozilla.org/en-US/firefox/addon/privaconf/) and [Ghacks-user.js](https://github.com/ghacksuserjs/ghacks-user.js) big thanks to all of them
**Based on :** [User.js](https://github.com/pyllyukko/user.js/), [PrivaConf](https://addons.mozilla.org/en-US/firefox/addon/privaconf/) and [Ghacks-user.js](https://github.com/ghacksuserjs/ghacks-user.js) big thanks to all of them
Librefox Roadmap :
Librefox Roadmap :
------------------
------------------
**Objectives for future versions of librefox (this may change) :**
**Objectives for future versions of Librefox (this may change) :**
- Develop an all-in-one Librefox addon to rule them all ? (Normal & Tor Version… this would simplify Librefox)
- Develop an all-in-one Librefox addon to rule them all ? (Normal & Tor Version… this would simplify Librefox)
- Develop an easy to use firewall system for extensions (button/hosts/allow/deny/per-addon)
- Develop an easy to use firewall system for extensions (button/hosts/allow/deny/per-addon)
- Update checker extension (feature in the full extension ?)
- Update checker extension (feature in the full extension ?)
- Advert for the project to reach more users ?
- Advertisement for the project to reach more users ?
**Todo for future versions of librefox (this may change) :**
**Todo for future versions of Librefox (this may change) :**
- Improve hd-video playback performances
- Improve HD-video playback performance.
- Testing compatibility on those [sites](https://developer.mozilla.org/en-US/docs/Web/Demos_of_open_web_technologies) and adjust the related settings.
- Testing compatibility on those [sites](https://developer.mozilla.org/en-US/docs/Web/Demos_of_open_web_technologies) and adjust the related settings.
Using different web services without cookies is impossible and cookies settings in a browser are very important when it come to privacy, in Librefox the settings are locked to avoid unwanted changes in such important setting, but they can be easily changed in `mozilla.cfg` under `User Settings : Cookies settings`
Using different web services without cookies is impossible and cookie settings in a browser are very important when it come to privacy, in Librefox the settings are locked to avoid unwanted changes in such an important setting, but they can be easily changed in `mozilla.cfg` under `User Settings : Cookies settings`.
Tracking Protection :
Tracking Protection :
---------------------
---------------------
Firefox now integrate a tracking protection feature (based on disconnect.me) it's a light list content blocking, listing can not be edited, this feature is disabled in Librefox. it's recommended to use ublock instead. This feature is disabled :
Firefox now integrates a tracking protection feature (based on disconnect.me) it's a small content blocking list, the listing can not be edited, this feature is disabled in Librefox. It's recommended to use uBlock Origin instead. This feature is disabled :
- Until it evolve and integrate at least list editing
- Until it evolves and integrates at least list editing.
- Because double filtering (this + ublock) is not suitable for performances.
- Because double filtering (this + ublock) is not suitable for performance.
You can however easily enable this feature in `mozilla.cfg` under `User Settings : Track Protection` (just comment active lines with `//` or remove the section).
You can however easily enable this feature in `mozilla.cfg` under `User Settings : Track Protection` (just comment active lines with `//` or remove the entire section).
Comparing Changes And Updates :
Comparing Changes And Updates :
-------------------------------
-------------------------------
If you want to compare changes over updates or if you already have a `user.js`/`mozilla.cfg`/`policies.json`. consider using [Compare-UserJS](https://github.com/claustromaniac/Compare-UserJS), an amazing tool to compare user.js files and output the diffs in detailed breakdown, developed by gHack's very own resident cat, [claustromaniac](https://github.com/claustromaniac) :cat:
If you want to compare changes over updates or if you already have a `user.js`/`mozilla.cfg`/`policies.json`. consider using [Compare-UserJS](https://github.com/claustromaniac/Compare-UserJS), it's an amazing tool to compare user.js files and output the diffs in detailed breakdown, developed by gHack's very own resident cat, [claustromaniac](https://github.com/claustromaniac) :cat:
Usage : If not on windows install [PowerShell](https://github.com/PowerShell/PowerShell) then for example `pwsh Compare-UserJS.ps1 mozilla.cfg user.js` (Warning that PowerShell connect to MS sometimes)
Usage : If not on windows install [PowerShell](https://github.com/PowerShell/PowerShell) then (for example) `pwsh Compare-UserJS.ps1 mozilla.cfg user.js` (Warning that PowerShell connects to Microsoft sometimes)
**Policies.json** : The policies.json is cross-platform compatible, making it preferred method for enterprise environments that have workstations running various operating systems (the settings availables with `policies.json` are limited right now because this is a new feature of firefox)
**Policies.json** : The policies.json is cross-platform compatible, making it preferred method for enterprise environments that have workstations running various operating systems (the settings availables with `policies.json` are limited right now because this is a new feature of Firefox)
**Bench diff** : Impact on the performances of firefox can be a gain or a loss of performance +100/5000 stand for 2% gained performance and -1500/5000 stand for -30% performance loss
**Bench diff** : Impact on the performance of firefox can be a gain or a loss of performance +100/5000 stand for 2% gained performance and -1500/5000 stand for -30% performance loss
**lockPref** : Locked preference can not be changed on firefox, nor by extensions, can only be changed here
**lockPref** : Locked preference can not be changed on Firefox, nor by extensions, they can only be chan
**Section** : Description of the settings section separated by ">>>..."