<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix"><br>
<br>
<br>
</div>
<blockquote
cite="mid:72939cbf-da6f-dca5-74b3-e78ccb8bfd3c@openmailbox.org"
type="cite">
<meta http-equiv="Context-Type" content="text/html; charset=utf-8">
<p>Hello,<br>
As many of you know there were various hardening patches to
IceWeasel and IceDove recently. These patches were done by
myself and gleaned from other reliable sources such as TBB and
PrivacyTools.io[1], as well as consulting the Mozilla wiki.<br>
</p>
<p>Unfortunately, it has caused breakage on some websites[2][3]
and degraded user experience. This is to be expected, as the web
becomes less privacy-friendly, and more
centralized/data-centric.</p>
<p>A quick run down of notable patches[4]:</p>
<p>1) Disable Telemetry for good (it was previously storing all
the telemetry data and probing your OS ever 2 minutes or so,
including open tabs and websites for 'analytical purposes')</p>
<p>2) Disable Balrog/AUS5, Mozilla's new non-transparent remote
update mechanism that fingerprints the user.</p>
<p>3) Disable Facial Recognition, Speech Recognition, and Virtual
Reality API.</p>
<p>4) Disable various data leaks and remote updates, attempt to
completely stop Google from being queried and downloading their
"safe-browsing" list for every page you visit.</p>
<p>5) Stop IP leaks caused by WebRTC, WebSockets, and Captive
Portal Detection.</p>
<p>6) Disable DOM Storage due to many privacy concerns and it
being off in all modern versions of TBB.</p>
<p>7) Disable weak hash and broken SSL implementation which do not
prevent eaves droppers from reading the page.</p>
<p><br>
</p>
<p><u>- So this puts the nonprism projects at a crossroads. Do we
want to favour accessibility and "features" over "privacy"?</u></p>
<p>From my personal opinion, nonprism should provide security and
privacy by default. Users can choose to opt-out of nonprism if
they wish. This is easily done by A) not using nonprism, or B)
using <a moz-do-not-send="true" class="moz-txt-link-freetext">about:config</a>
and/or user.js to override the settings.<br>
</p>
<p>Meanwhile, some users have questioned why nonprism is not on by
default[5], and I think this is a valid point from a security
standpoint. Users may be using Parabola under the impression
they are experiencing the safest possible defaults, and this is
currently not the case.<br>
</p>
<p>1. <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://www.privacytools.io/#about_config">https://www.privacytools.io/#about_config</a><br>
</p>
<p>2. <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://labs.parabola.nu/issues/1113">https://labs.parabola.nu/issues/1113</a></p>
<p>3. <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://labs.parabola.nu/issues/1114">https://labs.parabola.nu/issues/1114</a></p>
<p>4. <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://git.parabola.nu/abslibre.git/tree/nonprism/iceweasel/vendor.js">https://git.parabola.nu/abslibre.git/tree/nonprism/iceweasel/vendor.js</a>
/
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://git.parabola.nu/abslibre.git/plain/nonprism-testing/iceweasel/vendor.js">https://git.parabola.nu/abslibre.git/plain/nonprism-testing/iceweasel/vendor.js</a><br>
</p>
<p>5. <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://labs.parabola.nu/issues/1093#note-3">https://labs.parabola.nu/issues/1093#note-3</a></p>
<p><br>
</p>
<p>Now that everyone is aware of the issues, please discuss. I do
not feel [nonprism] should become "privacy-lite" and libre
become "no protection at all".<br>
</p>
<p><br>
</p>
<p>Luke<br>
</p>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dev@lists.parabola.nu">Dev@lists.parabola.nu</a>
<a class="moz-txt-link-freetext" href="https://lists.parabola.nu/mailman/listinfo/dev">https://lists.parabola.nu/mailman/listinfo/dev</a>
</pre>
</blockquote>
<p>I have helped Emulatorman add a post-install notice to nonprism
packages to notify users of hardening and a link to this thread.<br>
Also I forgot to mention a consensus cut off date. Please reach
consensus by October 24th 2016.</p>
<p><br>
</p>
<p>Luke<br>
</p>
</body>
</html>