changelog v135

[Thorin-Oakenpants]

🟩 v133

FF134 release notes | for developers | security advisories
FF135 release notes | for developers | security advisories

---

CHANGELOG

• all changes
• ToDo diffs: FF133-FF134 | FF134-FF135
• v135 PR is at v135 #1929

---

There was nothing to add from 134 or 135

These changes all stem from 1888466 in 136 and sanitizing choices

• the migration in FF128 merged items to simply things
• feedback from users was they wanted "history" separate from "forms"
• so for all three dialogs (clearHistory, clearOnShutdown_v2, clearSiteData) we have another migration
• for each the *historyFormDataAndDownloads pref migrates to the relevant prefs below
• whilst I was at it, I cleaned up all the legacy sanitizing prefs as it was section 2800 was getting messy and confusing

⭐ 136 is here (don't ever wait for arkenfox before updating Firefox!) so my bad, sue me, I should have had this out before FF136 stable was released. Suggest y'all check/update your sanitizing overrides: make sure to open each dialog to ensure migration

• new in user.js v135
  • these prefs are added in FF136
  • not entirely sure about the v2.downloads pref, it doesn't seem to be controlled by the UI

user_pref("privacy.clearHistory.browsingHistoryAndDownloads", true);
user_pref("privacy.clearHistory.formdata", true);
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true);
user_pref("privacy.clearOnShutdown_v2.downloads", true);
user_pref("privacy.clearOnShutdown_v2.formdata", true);
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true);
user_pref("privacy.clearSiteData.formdata", true);

• removed inactive in user.js v135
  • legacy sanitizing prefs that we've always had inactive and at defaults
    • legacy because in FF128 you should have migrated to the new prefs
    • cpd to clearHistory migration may have required you to open the clear history dialog: see comments in 9bba578

   // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false]
   // user_pref("privacy.cpd.downloads", true); // not used: controlled by another pref
   // user_pref("privacy.cpd.openWindows", false);
   // user_pref("privacy.cpd.passwords", false);
   // user_pref("privacy.cpd.siteSettings", false);

• made inactive in user.js v135 (and moved to 6050 for prefsCleaner)
  • legacy sanitizing prefs: see above

   // user_pref("privacy.clearOnShutdown.cache", "");
   // user_pref("privacy.clearOnShutdown.cookies", "");
   // user_pref("privacy.clearOnShutdown.downloads", "");
   // user_pref("privacy.clearOnShutdown.formdata", "");
   // user_pref("privacy.clearOnShutdown.history", "");
   // user_pref("privacy.clearOnShutdown.offlineApps", "");
   // user_pref("privacy.clearOnShutdown.sessions", "");
   // user_pref("privacy.cpd.cache", "");
   // user_pref("privacy.cpd.cookies", "");
   // user_pref("privacy.cpd.formdata", "");
   // user_pref("privacy.cpd.history", "");
   // user_pref("privacy.cpd.offlineApps", "");
   // user_pref("privacy.cpd.sessions", "");

---

NOTE: the STATs section excludes the new 8500 TELEMETRY section

• that section has 14 prefs moved into it
• these prefs have bearing on web sites and the numbers are quite meaningless

 STATS v135: up to and including section 4500, minus the parrots
 =========
    total: 168
 inactive:  46
      n/a    3 (v2 migration sanitizing prefs)
           ---
   active: 119
  default:  19 (at least)
      n/a:   2 (of the three prefs in 0202, only one will apply)
           ---
  flipped:  98 (at most)

ALL HAIL PANTS

[Tiagoquix]

/* 0335: disable Firefox Home (Activity Stream) telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);

Why weren't these telemetry-related prefs also moved with the others to section 8500?

Also, regarding the new sanitize prefs, I assume you just updated it to the same values as before for the new prefs?
If so, is it safe to migrate while in version 135.0.1 or should I wait version 136? (My Linux distro hasn't updated to it yet.)

[Thorin-Oakenpants]

You can't migrate until 136 because the code wasn't added until then - see comments in 9bba578

but you can add all your pref overrides and get rid of the legacy crap before then

So likely steps

• 135 you update your overrides and user.js to v136
  • the new prefs have no relevance
• you update to 136
  • the new prefs still have no relevance until the migration (FF code) takes place
  • the migration for at least some dialogs requires you to open them
  • the new prefs may not match your overrides because it's a migration and I can't check everything
• open/close Firefox and everything should now be in sync

those 2 telemetry prefs not in 8500 .. IDK if i missed them (unlikely) or because it doesn't matter as we disable AS

[Thorin-Oakenpants]

I assume you just updated it to the same values as before for the new prefs

Yes. On shutdown, AF has always sanitized everything except site settings and passwords. For manual sanitizing AF (at least since site exceptions were added in I think FF102 ) also excludes cookies and site data since that doesn't respect the site exception (and we wouldn't want users to go ctrl-shift-del and hit enter and lose all their logins)

[Thorin-Oakenpants]

Why weren't these telemetry-related prefs also moved with the others to section 8500?

those 2 telemetry prefs not in 8500 .. IDK if i missed them (unlikely) or because it doesn't matter as we disable AS

Ahh, I know. Because the 8500 section header is explaining that FF telemetry is not a privacy or security concern. Activity stream I can't really say that because it's entangled with pocket etc

[icpantsparti2]

[Thorin-Oakenpants]

Also, all you mac and linux RFP users ... all hail me for getting this over the line after 3 years or so ... and also give a wave (no hailing) to @PieroV for the patch

user.js/user.js

Lines 732 to 734 in 3d76c74

	1333651 - spoof User Agent & Navigator API
	JS: spoofed as Windows 10, OS 10.15, Android 10, or Linux
	HTTP Header: spoofed as Windows 10 or Android 10.15 until FF136 then matches JS spoof

edit: i know this is v135 but FF136 has been released .. so start hailing

[x9cf9w73cv7y]

You should put a warning in the update. The update deleted my browser history and my open tabs, although I switched off the deletion via override. Thanks for nothing.

[Thorin-Oakenpants]

how am I supposed to put in any warning - I already added the info in the release notes?

For the record - the migration code from Firefox should preserve what you set and/or override in the v2 settings (AFAICT). Even if it didn't and it read that the new pref is already set (and you said your overwrote it with your value) - it won't take affect until you close (for sanitize on close) or do it manually (when you clear site data, or clear history)

I said you need to 1) add overrides to suit and 2 open the dialogs to make sure the migration happens and to check your values

There is nothing more I could do (except have gotten this out before v136 and even that may not have helped some people) - the defaults in AF are to sanitize

Not blaming you - but do you have a backup and if not why not? Session restore (open tabs) is not a backup and shouldn't be treated as one.

[Tiagoquix]

but you can add all your pref overrides and get rid of the legacy crap before then

I'm not sure, as this is not clear to me. I guess it's safer for me to keep the legacy crap and only update the user.js only after updating to Firefox 136 then?

I see that you removed the legacy prefs in user.js v135. Do the new prefs already exist in 135 to make it safer for them to be removed before installing version 136?

BTW, WDYM by "It pays to open each dialog to ensure the migration happens."? Which dialogs?