upcoming change: AF won't sanitize history on close [update your overrides]

[Thorin-Oakenpants]

updated post

arkenfox currently has the following

// 2812
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true); 
user_pref("privacy.clearOnShutdown_v2.downloads", true);

// 2821
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true);

// 2831
user_pref("privacy.clearHistory.browsingHistoryAndDownloads", true);

2812 is what is cleared when you close Firefox, and the other two are manual clearing dialog settings to match

For reasons already stated (below in original post etc), AF will change these three to false in an upcoming release, likely FF142'ish - so in six weeks or so. Depends on when I do the next AF release.

⭐ So if you WANT your history cleared on shutdown and EXPECT that to auto happen then you will want to add these to your overrides (in advance if possible)

---

original post

One thing I might do, and I've had this thought before .. is to not delete history on close by default in the user.js. It has nothing to with web site tracking/privacy - it's an OS/disk-leak type thing which is mostly out of scope for a general threat model (but users can override)

I'll open a new issue to get feedback on this and implement once ESR128 is end of life

Originally posted by @Thorin-Oakenpants in #1971

---

so to be clear, I am talking about "history and downloads" (they are tied together), not formdata

there's also a pref somewhere about sanitizing old history older than x days - we could add that for info

I think default keeping history is a good usability thing, e.g. search from urlbar to find a site you visited last week .. yada yada yada. Those who need it or want it can add an override - e.g. teenager wanting to hide traffic from parents

class .. discuss!!

[theltalpha]

Not much to say, but I am in favour that history should be retained.

[de-es]

I always flipped those keep history and download prefs anyway. So yes.

[Thorin-Oakenpants]

the good news is it wouldn't be a destructive change (i.e users won't be affected by the change with irrevocable data loss) - but we would have to give users a sticky pinned topic for a few months and a heads up so those who expect history cleared are forewarned

I think I'll just do that now (sticky, change topic title) for some exposure to get a head start because I see no reason not to do it - we've relaxed a number of things over the years because arkenfox is a template and I think starting from a more usable state and allowing users to harden is a better fit (it's why I switched to FPP once it was ready but I did that in an ESR change). History is not a web-compat / tracking thing, so the arkenfox version isn't as important.

I'm almost tempted to do it without notice :)

edit:

starting from a more usable state and allowing users to harden is a better fit (it's why I switched to FPP once it was ready

just to be clear that's a general statement and the key part of it was usable - I am not saying that RFP hardens over FPP - that's not really the case in a Firefox user's threat model - randomizing canvas like RFP was the main benefit of RFP, and you still get that in FPP - anyway, none of it is measurable, so just take my word for it!

[git70]

+1!

[Tiagoquix]

Personally, I prefer automatic history clean-up as to like type "git" expecting to auto-complete to "github.com" instead of auto-completing with a totally random website that I acessed a single time in my browser.

I like the idea of Arkenfox making things clean by default instead of keeping them (such as deleting form data, website cache etc.).

I would prefer to keep the current prefs and let users override them if they so desire.

If this gets changed, remember to add it in bold in release notes. Thanks!

[rusty-snake]

Personally, I prefer automatic history clean-up as to like type "git" expecting to auto-complete to "github.com" instead of auto-completing with a totally random website that I acessed a single time in my browser.

(Ab)using history sanitize for browser.urlbar.suggest.history ...

[travankor]

The sticky needs to be updated #1080. I got hit by this when upgrading to 140+

[Thorin-Oakenpants]

there's nothing to be changed in the sticky - if you got hit by something in upgrading to Ff140 - take it up with mozilla, sorry

[dezza]

Very welcome change imo. I'm just now spending time undoing this again for new 140esr branch.