Commit a5ac2187 authored by Tails developers's avatar Tails developers
Browse files

Merge branch 'feature/tor-browser-bundle' into devel

Conflicts:
	features/step_definitions/unsafe_browser.rb
parents a73c516e b0344d8b
......@@ -222,6 +222,11 @@ Package: xul-ext-noscript
Pin: release o=Debian Backports,n=wheezy-backports
Pin-Priority: 999
Explanation: Block installation of iceweasel until it has been removed from our APT repo
Package: iceweasel
Pin: origin deb.tails.boum.org
Pin-Priority: -1
Explanation: weirdness in chroot_apt install-binary
Package: *
Pin: release o=chroot_local-packages
......@@ -231,10 +236,6 @@ Package: *
Pin: origin deb.tails.boum.org
Pin-Priority: 1005
Package: *
Pin: origin mozilla.debian.net
Pin-Priority: 990
Package: *
Pin: release o=Debian,n=wheezy-updates
Pin-Priority: 990
......
#!/bin/sh
set -eu
echo "Install the Tor Browser"
# Get the below with `grep "tor-browser-linux32-.*\.tar.xz" sha256sums.txt`
BUNDLES="$(cat <<EOF
473780a5145859a8d516e76cb27be25b0baf16007ba50cd8ba78a536bc806fc5 tor-browser-linux32-tbb-nightly_ar.tar.xz
3e3d6fd1ea47067fc00625b8cd62d23079ef71dc91734bfb823542c26ce192cf tor-browser-linux32-tbb-nightly_en-US.tar.xz
df4745725e7b3fe99c218166ffbe38eef8e9d636c42b72c8a2b8229fc3bdd83b tor-browser-linux32-tbb-nightly_ru.tar.xz
b624b1f9a16e4ff4cffb3478f63249ed73ae902732b64fca0f183ad73ed1b5ac tor-browser-linux32-tbb-nightly_zh-CN.tar.xz
EOF
)"
MAIN_BUNDLE="$(echo "${BUNDLES}" | grep -o "tor-browser-linux32-.*_en-US.tar.xz")"
#VERSION="$(echo "${MAIN_BUNDLE}" | sed 's/tor-browser-linux32-\(.*\)_en-US.tar.xz/\1/')"
VERSION=tbb-nightly-2014-10-07
# Note that we cannot use https here since apt-cacher-ng (used by vagrant)
# gets confused and throws a 403. It doesn't matter, though, since we verify
# the checksums of each file downloaded.
#TBB_DIST_URL="http://archive.torproject.org/tor-package-archive/torbrowser/${VERSION}"
#TBB_DIST_URL="http://www.torproject.org/dist/torbrowser/${VERSION}/"
#TBB_DIST_URL="http://people.torproject.org/~mikeperry/builds/${VERSION}/"
#TBB_DIST_URL="http://people.torproject.org/~gk/testbuilds/${VERSION}"
TBB_DIST_URL="http://people.torproject.org/~linus/builds/${VERSION}"
# Import the TBB_INSTALL, TBB_PROFILE and TBB_EXT variables, which
# contains the paths we will split TBB's actual browser (binaries
# etc), user data and extension into. While this differs from how the
# TBB organizes the files, the end result will be the same, and it's
# practical since when creating a new browser profile we can simply
# copy the profile directory without duplicating all extensions.
. /usr/local/lib/tails-shell-library/tor-browser.sh
mkdir -p "${TBB_INSTALL}" "${TBB_PROFILE}" "${TBB_EXT}"
# Use the builder's caching APT proxy, if any
APT_PROXY="$(apt-config --format '%v' dump Acquire::http::Proxy)"
if [ -n "${APT_PROXY}" ]; then
export HTTP_PROXY="${APT_PROXY}"
export http_proxy="${APT_PROXY}"
export HTTPS_PROXY="${APT_PROXY}"
export https_proxy="${APT_PROXY}"
fi
TMP="$(mktemp -d)"
echo "${BUNDLES}" | while read expected_sha256 tarball; do
(
cd "${TMP}"
echo "Fetching ${TBB_DIST_URL}/${tarball} ..."
curl --remote-name "${TBB_DIST_URL}/${tarball}"
)
actual_sha256="$(sha256sum "${TMP}/${tarball}" | cut -d' ' -f1)"
if [ "${actual_sha256}" != "${expected_sha256}" ]; then
echo "SHA256 mismatch for ${tarball}" >&2
exit 1
fi
done
# We'll use the en-US bundle as our basis...
tar -xf "${TMP}/${MAIN_BUNDLE}" -C "${TMP}" tor-browser_en-US
TBB_PREP="${TMP}"/tor-browser_en-US
# ... only extracting the localization addon from the other ones, which
# we'll put in a global extensions directory that we'll symlink to so
# we don't have to deal with wasteful copies.
for tarball in "${TMP}"/tor-browser-*.tar.xz; do
locale="$(echo "${tarball}" | sed "s@^.*/tor-browser-.*_\(.*\)\.tar\.xz@\1@")"
if [ "${locale}" = en-US ]; then
continue
fi
xpi="tor-browser_${locale}/Browser/TorBrowser/Data/Browser/profile.default/extensions/langpack-${locale}@firefox.mozilla.org.xpi"
(
cd "${TMP}"
tar -xf "${tarball}" "${xpi}"
mv "${xpi}" "${TBB_EXT}"
)
done
# Enable our myspell/hunspell dictionaries. TBB only provides the one
# for en-US, but Debian's seems more comprehensive, so we'll only use
# Debian's dictionaries.
rm -f "${TBB_PREP}"/Browser/dictionaries/*
for f in /usr/share/hunspell/*.aff /usr/share/hunspell/*.dic; do
name="$(basename "${f}")"
ln -s "${f}" "${TBB_PREP}"/Browser/dictionaries/"${name}"
done
# We don't want tor-launcher to be part of the regular browser
# profile. Moreover, for the stand-alone tor-launcher we use, we need
# our patched version. So, the version shipped in the TB really is not
# useful for us.
rm "${TBB_PREP}/Browser/TorBrowser/Data/Browser/profile.default/extensions/tor-launcher@torproject.org.xpi"
# Remove TBB's torbutton since the "Tor test" will fail and about:tor
# will report an error. We'll install our own Torbutton later, which
# has the extensions.torbutton.test_enabled boolean pref as a workaround.
rm "${TBB_PREP}/Browser/TorBrowser/Data/Browser/profile.default/extensions/torbutton@torproject.org.xpi"
# See comment below why we need the Browser sub-dir
mv "${TBB_PREP}/Browser" "${TBB_INSTALL}"/Browser
# The Tor Browser will fail, complaining about an incomplete profile,
# unless there's a readable Browser/TorBrowser/Data/Browser/Caches
# in the directory where the firefox executable is located.
mkdir -p "${TBB_INSTALL}"/Browser/TorBrowser/Data/Browser/Caches
# Let's put all the bundled extensions in the global extensions directory
mv "${TBB_INSTALL}"/Browser/TorBrowser/Data/Browser/profile.default/extensions/* "${TBB_EXT}"
rmdir "${TBB_INSTALL}"/Browser/TorBrowser/Data/Browser/profile.default/extensions
# Create and install a fake iceweasel package so we can install our
# desired Debian-packaged Iceweasel addons
apt-get install --yes equivs
FAKE_ICEWEASEL_VERSION=$(sed -n 's/^Version=\(.*\)$/\1/p' "${TBB_INSTALL}"/Browser/application.ini)+fake1
cat > "${TMP}"/iceweasel.control << EOF
Section: web
Priority: optional
Homepage: https://tails.boum.org/
Standards-Version: 3.6.2
Package: iceweasel
Version: ${FAKE_ICEWEASEL_VERSION}
Maintainer: Tails developers <amnesia@boum.org>
Architecture: all
Description: (Fake) Iceweasel
Make it possible to install Debian's Iceweasel addons without having to
install a real Iceweasel.
EOF
(
cd "${TMP}"
equivs-build "${TMP}"/iceweasel.control
dpkg -i "${TMP}"/iceweasel_"${FAKE_ICEWEASEL_VERSION}"_all.deb
)
apt-get install --yes xul-ext-adblock-plus xul-ext-foxyproxy-standard xul-ext-torbutton
ln -s /usr/share/xul-ext/adblock-plus/ "${TBB_EXT}"/'{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}'
ln -s /usr/share/xul-ext/foxyproxy-standard/ "${TBB_EXT}"/foxyproxy@eric.h.jung
ln -s /usr/share/xul-ext/torbutton/ "${TBB_EXT}"/torbutton@torproject.org
rsync -a --exclude bookmarks.html --exclude extensions \
"${TBB_INSTALL}"/Browser/TorBrowser/Data/Browser/profile.default/ \
"${TBB_PROFILE}"/
# Remove TBB's default bridges
sed -i '/extensions\.torlauncher\.default_bridge\./d' "${TBB_PROFILE}"/preferences/extension-overrides.js
mkdir -p "${TBB_PROFILE}"/extensions
for ext in "${TBB_EXT}"/*; do
ln -s "${ext}" "${TBB_PROFILE}"/extensions/
done
chown -R root:root "${TBB_INSTALL}" "${TBB_PROFILE}" "${TBB_EXT}"
chmod -R a+rX "${TBB_INSTALL}" "${TBB_PROFILE}" "${TBB_EXT}"
rm -r "${TMP}"
update-alternatives --install /usr/bin/x-www-browser x-www-browser /usr/local/bin/tor-browser 99
update-alternatives --install /usr/bin/gnome-www-browser gnome-www-browser /usr/local/bin/tor-browser 99
#!/bin/sh
set -e
# Remove unwanted browser search plugins.
echo "Removing unwanted browser search plugins"
# Import the TBB_INSTALL variable
. /usr/local/lib/tails-shell-library/tor-browser.sh
PLUGIN_DIR="${TBB_INSTALL}"/Browser/browser/searchplugins
rm "${PLUGIN_DIR}"/amazon*.xml
rm "${PLUGIN_DIR}"/bing*.xml
rm "${PLUGIN_DIR}"/eBay*.xml
rm "${PLUGIN_DIR}"/yahoo*.xml
#!/bin/sh
set -e
# Remove unwanted iceweasel search plugins.
echo "Removing unwanted iceweasel search plugins"
rm /etc/iceweasel/searchplugins/common/duckduckgo.xml
rm /etc/iceweasel/searchplugins/locale/*/amazon*.xml
rm /etc/iceweasel/searchplugins/locale/*/answers.xml
rm /etc/iceweasel/searchplugins/locale/*/bing*.xml
rm /etc/iceweasel/searchplugins/locale/*/eBay*.xml
rm /etc/iceweasel/searchplugins/locale/*/yahoo*.xml
#!/bin/sh
set -e
# Build binary sqlite iceweasel files from plain text SQL files.
echo "Building iceweasel sqlite files"
INSTALLED_PACKAGES="sqlite3"
SQL_SRC_DIR=/usr/share/amnesia/iceweasel/sql
ICEWEASEL_PROFILE_DIR=/etc/iceweasel/profile
[ -d "${SQL_SRC_DIR}" ] || exit 11
apt-get install --yes $INSTALLED_PACKAGES
for sql_src_file in ${SQL_SRC_DIR}/*.sql ; do
db="$(basename ${sql_src_file} | sed -e 's|\.sql$||')"
dst_file="${ICEWEASEL_PROFILE_DIR}/${db}.sqlite"
sqlite3 "${dst_file}" < "${sql_src_file}"
done
rm -rf ${SQL_SRC_DIR}
apt-get --yes purge $INSTALLED_PACKAGES
......@@ -6,5 +6,5 @@ echo "Overriding TBB branding with our own"
install --owner root --group root --mode 0755 --directory /etc/xul-ext
install --owner root --group root --mode 0644 \
/etc/iceweasel/profile/extensions/branding@amnesia.boum.org/defaults/preferences/prefs.js \
/etc/tor-browser/profile/extensions/branding@amnesia.boum.org/defaults/preferences/prefs.js \
/etc/xul-ext/torbutton.js
#!/bin/sh
set -e
echo "Setting up localized browser search plugins"
# Link localized Tails searchplugins to the proper localization directories:
# e.g. files in '/usr/share/amnesia/browser/searchplugins/locale/es' will be
# linked in '/etc/tor-browser/profile/searchplugins/locale/es-AR',
# '/etc/tor-browser/profile/searchplugins/locale/es-ES', etc.
# Import the TBB_INSTALL and TBB_EXT variables
. /usr/local/lib/tails-shell-library/tor-browser.sh
locales_for_lang() {
local locale="$1"
local langpacks
find "${TBB_EXT}" -maxdepth 1 -type f -name 'langpack-*@firefox.mozilla.org.xpi' -printf "%P\n" |
sed -n -e "s/^langpack-\($locale\)\(-[A-Z]\+\)\?@firefox.mozilla.org.xpi/\1\2/p"
}
for LANGUAGE in $(find /usr/share/amnesia/browser/searchplugins/locale -maxdepth 1 -type d -printf "%P\n"); do
LOCALES="$(locales_for_lang "$LANGUAGE")"
if [ -z "$LOCALES" ]; then
echo "Unable to find a matching locale for $LANGUAGE." >&2
continue
fi
for LOCALE in $LOCALES; do
mkdir -p "${TBB_INSTALL}"/Browser/distribution/searchplugins/locale/$LOCALE
for SEARCHPLUGIN in $(find "/usr/share/amnesia/browser/searchplugins/locale/$LANGUAGE" -maxdepth 1 -type f); do
ln -s "$SEARCHPLUGIN" "${TBB_INSTALL}"/Browser/distribution/searchplugins/locale/$LOCALE
done
done
done
#!/bin/sh
set -e
echo "Setting up localized iceweasel search plugins"
# Link localized Tails searchplugins to the proper localization directories:
# e.g. files in '/usr/share/amnesia/iceweasel/searchplugins/locale/es' will be
# linked in '/etc/iceweasel/searchplugins/locale/es-AR',
# '/etc/iceweasel/searchplugins/locale/es-ES', etc.
locales_for_lang() {
local locale="$1"
local langpacks
find /usr/lib/iceweasel/browser/extensions -maxdepth 1 -type f -name 'langpack-*@iceweasel.mozilla.org.xpi' -printf "%P\n" |
sed -n -e "s/^langpack-\($locale\)\(-[A-Z]\+\)\?@iceweasel.mozilla.org.xpi/\1\2/p"
}
for LANGUAGE in $(find /usr/share/amnesia/iceweasel/searchplugins/locale -maxdepth 1 -type d -printf "%P\n"); do
LOCALES="$(locales_for_lang "$LANGUAGE")"
if [ -z "$LOCALES" ]; then
echo "Unable to find a matching locale for $LANGUAGE." >&2
exit 1
fi
for LOCALE in $LOCALES; do
mkdir -p /etc/iceweasel/searchplugins/locale/$LOCALE
for SEARCHPLUGIN in $(find "/usr/share/amnesia/iceweasel/searchplugins/locale/$LANGUAGE" -maxdepth 1 -type f); do
ln -s "$SEARCHPLUGIN" /etc/iceweasel/searchplugins/locale/$LOCALE
done
done
done
#!/bin/sh
echo "Generating iceweasel profile"
#generate iceweasel profile at build time, so that it has a fixed name
set -e
apt-get --yes install xvfb
TOR_SOCKS_HOST='127.0.0.1' TOR_SOCKS_PORT='9151' xvfb-run /usr/bin/iceweasel -CreateProfile default
mv ~/.mozilla/firefox/*.default ~/.mozilla/firefox/default
sed -i "s@Path=.*\.default@Path=default@" ~/.mozilla/firefox/profiles.ini
mv ~/.mozilla /etc/skel
apt-get --yes purge xvfb
#!/bin/sh
echo "Generating Tor Browser profile"
# Generate Tor Browser profile at build time so it won't reside in RAM
set -e
/usr/local/bin/generate-tor-browser-profile
mv ~/.tor-browser /etc/skel
#!/bin/sh
echo "Creating symbolic link for potentially persistent iceweasel bookmarks"
echo "Creating symbolic link for potentially persistent browser bookmarks"
#create a symlink to places.sqlite in iceweasel profile
#create a symlink to places.sqlite in browser profile
#from a dedicated "bookmarks" directory, so that
#it can be easily made persistent
set -e
ln -s /home/amnesia/.mozilla/firefox/bookmarks/places.sqlite /etc/skel/.mozilla/firefox/default/places.sqlite
mkdir /etc/skel/.mozilla/firefox/bookmarks
ln -s /home/amnesia/.mozilla/firefox/bookmarks/places.sqlite /etc/skel/.tor-browser/profile.default/places.sqlite
mkdir -p /etc/skel/.mozilla/firefox/bookmarks
......@@ -31,12 +31,11 @@ done
# Launcher is still running, we can just kill it and make sure it
# won't start next network reconnect. A reason for this happening is
# if Tor was restarted by tordate, e.g. if the clock was to incorrect.
if pgrep -f "iceweasel --app.*tor-launcher-standalone"; then
pkill -f "iceweasel --app.*tor-launcher-standalone"
for p in /home/tor-launcher/.torproject/torlauncher/*.default/prefs.js; do
sed -i '/^user_pref("extensions.torlauncher.prompt_at_startup"/d' "${p}"
echo 'user_pref("extensions.torlauncher.prompt_at_startup", false);' >> "${p}"
done
if pgrep -f "firefox --app.*tor-launcher-standalone"; then
pkill -f "firefox --app.*tor-launcher-standalone"
pref=/user/Data/Browser/profile.default/prefs.js
sed -i '/^user_pref("extensions\.torlauncher\.prompt_at_startup"/d' "${pref}"
echo 'user_pref("extensions.torlauncher.prompt_at_startup", false);' >> "${pref}"
fi
/usr/local/sbin/tails-notify-user \
......
......@@ -35,7 +35,7 @@ domain ip {
mod owner uid-owner proxy ACCEPT;
mod owner uid-owner nobody ACCEPT;
}
daddr 127.0.0.1 proto tcp syn mod multiport destination-ports (9050 9061 9062 9151) {
daddr 127.0.0.1 proto tcp syn mod multiport destination-ports (9050 9061 9062 9150) {
mod owner uid-owner amnesia ACCEPT;
}
daddr 127.0.0.1 proto tcp syn dport 9062 {
......
# Default Preferences
# Tor Browser Bundle
# Do not edit this file.
// Disable browser auto updaters and associated homepage notifications
pref("app.update.auto", false);
pref("app.update.enabled", false);
pref("browser.search.update", false);
pref("browser.rights.3.shown", true);
pref("browser.startup.homepage_override.mstone", "ignore");
pref("startup.homepage_welcome_url", "");
pref("startup.homepage_override_url", "");
// Disk activity: Disable Browsing History Storage
pref("browser.privatebrowsing.autostart", true);
pref("browser.cache.disk.enable", false);
pref("browser.cache.offline.enable", false);
pref("dom.indexedDB.enabled", false);
pref("permissions.memory_only", true);
pref("network.cookie.lifetimePolicy", 2);
pref("browser.download.manager.retention", 1);
// Disk activity: TBB Directory Isolation
pref("browser.download.useDownloadDir", false);
pref("browser.shell.checkDefaultBrowser", false);
pref("browser.download.manager.addToRecentDocs", false);
// Misc privacy: Disk
pref("signon.rememberSignons", false);
pref("browser.formfill.enable", false);
pref("signon.autofillForms", false);
pref("browser.sessionstore.privacy_level", 2);
pref("media.cache_size", 0);
// Misc privacy: Remote
pref("browser.send_pings", false);
pref("geo.enabled", false);
pref("geo.wifi.uri", "");
pref("browser.search.suggest.enabled", false);
pref("browser.safebrowsing.enabled", false);
pref("browser.safebrowsing.malware.enabled", false);
pref("browser.download.manager.scanWhenDone", false); // prevents AV remote reporting of downloads
pref("extensions.ui.lastCategory", "addons://list/extension");
pref("datareporting.healthreport.service.enabled", false); // Yes, all three of these must be set
pref("datareporting.healthreport.uploadEnabled", false);
pref("datareporting.policy.dataSubmissionEnabled", false);
pref("security.mixed_content.block_active_content", false); // Disable until https://bugzilla.mozilla.org/show_bug.cgi?id=878890 is patched
pref("browser.syncPromoViewsLeftMap", "{\"addons\":0, \"passwords\":0, \"bookmarks\":0}"); // Don't promote sync
pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs with other browsers
pref("services.sync.engine.addons", false);
pref("services.sync.engine.tabs", false);
pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
// Fingerprinting
pref("webgl.min_capability_mode", true);
pref("webgl.disable-extensions", true);
pref("dom.battery.enabled", false); // fingerprinting due to differing OS implementations
pref("dom.network.enabled",false); // fingerprinting due to differing OS implementations
pref("browser.display.max_font_attempts",10);
pref("browser.display.max_font_count",10);
pref("gfx.downloadable_fonts.fallback_delay", -1);
pref("general.appname.override", "Netscape");
pref("general.appversion.override", "5.0 (Windows)");
pref("general.oscpu.override", "Windows NT 6.1");
pref("general.platform.override", "Win32");
pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0");
pref("general.productSub.override", "20100101");
pref("general.buildID.override", "20100101");
pref("browser.startup.homepage_override.buildID", "20100101");
pref("general.useragent.vendor", "");
pref("general.useragent.vendorSub", "");
pref("dom.enable_performance", false);
pref("plugin.expose_full_path", false);
pref("browser.zoom.siteSpecific", false);
pref("intl.charset.default", "windows-1252");
pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups)
// pref("intl.accept_languages", "en-us, en"); // Set by Torbutton
// pref("intl.accept_charsets", "iso-8859-1,*,utf-8"); // Set by Torbutton
// pref("intl.charsetmenu.browser.cache", "UTF-8"); // Set by Torbutton
// Third party stuff
pref("network.cookie.cookieBehavior", 1);
pref("security.enable_tls_session_tickets", false);
pref("network.http.spdy.enabled", false); // Stores state and may have keepalive issues (both fixable)
pref("network.http.spdy.enabled.v2", false); // Seems redundant, but just in case
pref("network.http.spdy.enabled.v3", false); // Seems redundant, but just in case
// Proxy and proxy security
pref("network.proxy.socks", "127.0.0.1");
pref("network.proxy.socks_port", 9150);
pref("network.proxy.socks_remote_dns", true);
pref("network.proxy.no_proxies_on", ""); // For fingerprinting and local service vulns (#10419)
pref("network.proxy.type", 1);
pref("network.security.ports.banned", "9050,9051,9150,9151");
pref("network.dns.disablePrefetch", true);
pref("network.protocol-handler.external-default", false);
pref("network.protocol-handler.external.mailto", false);
pref("network.protocol-handler.external.news", false);
pref("network.protocol-handler.external.nntp", false);
pref("network.protocol-handler.external.snews", false);
pref("network.protocol-handler.warn-external.mailto", true);
pref("network.protocol-handler.warn-external.news", true);
pref("network.protocol-handler.warn-external.nntp", true);
pref("network.protocol-handler.warn-external.snews", true);
pref("plugins.click_to_play", true);
pref("plugin.state.flash", 1);
pref("plugins.hide_infobar_for_missing_plugin", true);
pref("media.peerconnection.enabled", false); // Disable WebRTC interfaces
// Network and performance
pref("network.http.pipelining", true);
pref("network.http.pipelining.aggressive", true);
pref("network.http.pipelining.maxrequests", 12);
pref("network.http.pipelining.ssl", true);
pref("network.http.proxy.pipelining", true);
pref("security.ssl.enable_false_start", true);
pref("network.http.keep-alive.timeout", 20);
pref("network.http.connection-retry-timeout", 0);
pref("network.http.max-persistent-connections-per-proxy", 256);
pref("network.http.pipelining.reschedule-timeout", 15000);
pref("network.http.pipelining.read-timeout", 60000);
// Hacked pref: Now means "Attempt to pipeline at least this many requests together"
pref("network.http.pipelining.max-optimistic-requests", 3);
// Extension support
pref("extensions.autoDisableScopes", 0);
pref("extensions.bootstrappedAddons", "{}");
pref("extensions.checkCompatibility.4.*", false);
pref("extensions.databaseSchema", 3);
pref("extensions.enabledAddons", "https-everywhere%40eff.org:3.1.4,%7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.1,torbutton%40torproject.org:1.5.2,ubufox%40ubuntu.com:2.6,tor-launcher%40torproject.org:0.1.1pre-alpha,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.5");
pref("extensions.enabledItems", "langpack-en-US@firefox.mozilla.org:,{73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.57,{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.4,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.8");
pref("extensions.enabledScopes", 1);
pref("extensions.pendingOperations", false);
pref("xpinstall.whitelist.add", "");
pref("xpinstall.whitelist.add.36", "");
// Omnibox settings
pref("keyword.URL", "https://startpage.com/do/search?q=");
// Hacks/workarounds: Direct2D seems to crash w/ lots of video cards w/ MinGW?
// Nvida cards also experience crashes without the second pref set to disabled
pref("gfx.direct2d.disabled", true);
pref("layers.acceleration.disabled", true);
// Security enhancements
// https://trac.torproject.org/projects/tor/ticket/9387#comment:17
pref("javascript.options.ion.content", false);
pref("javascript.options.baselinejit.content", false);
pref("javascript.options.asmjs", false);
pref("javascript.options.typeinference", false);
// Audio_data is deprecated in future releases, but still present
// in FF24. This is a dangerous combination (spotted by iSec)
pref("media.audio_data.enabled", false);
// Enable TLS 1.1 and 1.2:
// https://trac.torproject.org/projects/tor/ticket/11253
pref("security.tls.version.max", 3);
// Version placeholder
pref("torbrowser.version", "UNKNOWN");
// This is the Debian specific preferences file for Iceweasel
// You can make any change in here, it is the purpose of this file.
// You can, with this file and all files present in the
// /etc/iceweasel/pref directory, override any preference that is
// present in /usr/lib/iceweasel/defaults/preferences directory.
// While your changes will be kept on upgrade if you modify files in
// /etc/iceweasel/pref, please note that they won't be kept if you
// do make your changes in /usr/lib/iceweasel/defaults/preferences.
//
// Note that lockPref is allowed in these preferences files if you
// don't want users to be able to override some preferences.
// Use LANG environment variable to choose locale
pref("intl.locale.matchOS", true);
// Extension support
pref("xpinstall.whitelist.add.103", "");
// Unsorted prefs
pref("network.cookie.prefsMigrated", true);
pref("spellchecker.dictionary", "en_US");
<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/" xmlns:os="http://a9.com/-/spec/opensearch/1.1/">
<os:ShortName>DuckDuckGo HTML</os:ShortName>
<os:Description>Search DuckDuckGo (non-JS)</os:Description>
<os:InputEncoding>UTF-8</os:InputEncoding>
<os:Image width="16" height="16">data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAANcNAADXDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJyDsJmlk8pf6+v3s/v7+++zr/fcnIOyzJyDsgCcg7CYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnIOwBJyDscCcg7PZttJ7/7Pfs//////++xO7/S5GA/ycg7P8nIOz2JyDscCcg7AEAAAAAAAAAAAAAAAAnIOwBJyDstScg7P8nIOz/Y8p5/2fHZf9Yv0z/YcF2/1rBUv8nIOz/JyDs/ycg7P8nIOy1JyDsAQAAAAAAAAAAJyDscCcg7P8nIOz/JyDs/4jQoP/p9+n//////05X3v9LkYD/JyDs/ycg7P8nIOz/JyDs/ycg7HAAAAAAJyDsJicg7PYnIOz/JyDs/zUu7f/+/v////////////89N+7/JyDs/yUo7f8nIOz/JyDs/ycg7P8nIOz2JyDsJicg7IAnIOz/JyDs/ycg7P9hXPH////////////t/P//GIr2/wfD+/8Gyfz/DKv5/yM57/8nIOz/JyDs/ycg7H8nIOyzJyDs/ycg7P8nIOz/jov1////////////Otz9/w3G/P8cWfH/JSvt/ycg7P8nIOz/JyDs/ycg7P8nIOyzJyDs5icg7P8nIOz/JyDs/7u5+f///////////27l/v8E0v3/BNL9/wTQ/f8Oofn/IT7v/ycg7P8nIOz/JyDs5icg7OYnIOz/JyDs/ycg7P/p6P3/uWsC////////////5fr//6Po/f8Thfb/DKv5/w6f+f8nIOz/JyDs/ycg7OYnIOyzJyDs/ycg7P8nIOz/9/b+/////////////////7lrAv/V1Pv/JyDs/ycg7P8nIOz/JyDs/ycg7P8nIOyzJyDsgCcg7P8nIOz/JyDs/8/N+///////////////////////iIX1/ycg7P8nIOz/JyDs/ycg7P8nIOz/JyDsfycg7CYnIOz2JyDs/ycg7P9FP+7/q6n4/+7u/f/n5v3/fXn0/yoj7P8nIOz/JyDs/ycg7P8nIOz/JyDs9icg7CYAAAAAJyDscCcg7P8nIOz/wsD6/+no/f/Y1/z/eHTz/ycg7P8nIOz/JyDs/ycg7P8nIOz/JyDs/ycg7HAAAAAAAAAAACcg7AEnIOy1JyDs/ycg7P8nIOz/JyDs/ycg7P8nIOz/JyDs/ycg7P8