<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hello,<br>
As many of you know there were various hardening patches to
IceWeasel and IceDove recently. These patches were done by myself
and gleaned from other reliable sources such as TBB and
PrivacyTools.io[1], as well as consulting the Mozilla wiki.<br>
</p>
<p>Unfortunately, it has caused breakage on some websites[2][3] and
degraded user experience. This is to be expected, as the web
becomes less privacy-friendly, and more centralized/data-centric.</p>
<p>A quick run down of notable patches[4]:</p>
<p>1) Disable Telemetry for good (it was previously storing all the
telemetry data and probing your OS ever 2 minutes or so, including
open tabs and websites for 'analytical purposes')</p>
<p>2) Disable Balrog/AUS5, Mozilla's new non-transparent remote
update mechanism that fingerprints the user.</p>
<p>3) Disable Facial Recognition, Speech Recognition, and Virtual
Reality API.</p>
<p>4) Disable various data leaks and remote updates, attempt to
completely stop Google from being queried and downloading their
"safe-browsing" list for every page you visit.</p>
<p>5) Stop IP leaks caused by WebRTC, WebSockets, and Captive Portal
Detection.</p>
<p>6) Disable DOM Storage due to many privacy concerns and it being
off in all modern versions of TBB.</p>
<p>7) Disable weak hash and broken SSL implementation which do not
prevent eaves droppers from reading the page.</p>
<p><br>
</p>
<p><u>- So this puts the nonprism projects at a crossroads. Do we
want to favour accessibility and "features" over "privacy"?</u></p>
<p>From my personal opinion, nonprism should provide security and
privacy by default. Users can choose to opt-out of nonprism if
they wish. This is easily done by A) not using nonprism, or B)
using <a class="moz-txt-link-freetext" href="about:config">about:config</a> and/or user.js to override the settings.<br>
</p>
<p>Meanwhile, some users have questioned why nonprism is not on by
default[5], and I think this is a valid point from a security
standpoint. Users may be using Parabola under the impression they
are experiencing the safest possible defaults, and this is
currently not the case.<br>
</p>
<p>1. <a class="moz-txt-link-freetext" href="https://www.privacytools.io/#about_config">https://www.privacytools.io/#about_config</a><br>
</p>
<p>2. <a class="moz-txt-link-freetext" href="https://labs.parabola.nu/issues/1113">https://labs.parabola.nu/issues/1113</a></p>
<p>3. <a class="moz-txt-link-freetext" href="https://labs.parabola.nu/issues/1114">https://labs.parabola.nu/issues/1114</a></p>
<p>4.
<a class="moz-txt-link-freetext" href="https://git.parabola.nu/abslibre.git/tree/nonprism/iceweasel/vendor.js">https://git.parabola.nu/abslibre.git/tree/nonprism/iceweasel/vendor.js</a>
/
<a class="moz-txt-link-freetext" href="https://git.parabola.nu/abslibre.git/plain/nonprism-testing/iceweasel/vendor.js">https://git.parabola.nu/abslibre.git/plain/nonprism-testing/iceweasel/vendor.js</a><br>
</p>
<p>5. <a class="moz-txt-link-freetext" href="https://labs.parabola.nu/issues/1093#note-3">https://labs.parabola.nu/issues/1093#note-3</a></p>
<p><br>
</p>
<p>Now that everyone is aware of the issues, please discuss. I do
not feel [nonprism] should become "privacy-lite" and libre become
"no protection at all".<br>
</p>
<p><br>
</p>
<p>Luke<br>
</p>
</body>
</html>