Skip to main content

max / alloy

Add a fourth rung to the Firefox ladder, for vendor confirm gates The audit had been applying this test without it being written down: remove a step that keeps a novice from a working capability, keep a step that prices an irreversible act. As a rung it reads on what the click costs if the user was wrong, not on how expert the user is. It removes one gate here and keeps three. about:config's warning goes: the page was typed on purpose, every value behind it is a pref the same user can set back, and none of it changes what the machine will run. Shipped true at defaults/preferences/firefox.js:1140 in Firefox 153.0, read out of omni.ja rather than remembered. The gates on unsigned extensions, the primary password and clearing history stay, and are named in the header so the next survey does not re-file them.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-08-28 17:57 UTC
Commit: 40de3a05a83f0837ff08d3c5ce050628e570410e
Parent: 9fc128d
2 files changed, +29 insertions, -3 deletions
M crates/alloy/src/image.rs +4 -3
@@ -217,12 +217,13 @@
217 217 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
218 218 pub(crate) enum Browser {
219 219 /// Gecko, from Fedora's own repos, configured by
220 - /// `/etc/firefox/pref/alloy.js` to remove anti-features and restore one
221 - /// control Mozilla hides.
220 + /// `/etc/firefox/pref/alloy.js` to remove anti-features, restore one
221 + /// control Mozilla hides, and take one gate off a reversible act.
222 222 #[default]
223 223 Firefox,
224 224 /// No browser in the image. Still a real answer: someone who wants to
225 - /// install their own from a flatpak remote should not pay for one they will remove.
225 + /// install their own from a flatpak remote should not pay for one they
226 + /// will remove.
226 227 None,
227 228 }
228 229
M etc/firefox/pref/alloy.js +25
@@ -22,6 +22,19 @@
22 22 // answer is anyone but the user, it goes.
23 23 // 3. Set a value to Alloy's preference. Forbidden here. Nothing on this
24 24 // rung has ever been in this file and the Containerfile asserts it.
25 + // 4. Take off a confirm-style gate the vendor put in front of a capability.
26 + // It comes off when the act behind it is reversible and the user
27 + // navigated there deliberately. It stays when the act is irreversible or
28 + // changes the machine's security posture. The test is what the click
29 + // costs if the user was wrong, not how expert the user is.
30 + //
31 + // Rung 4 removes one gate in this file and keeps three, which is what makes
32 + // it a rule rather than a licence. The three that stay, named so the next
33 + // survey does not re-file them:
34 + //
35 + // - Installing an unsigned extension. Changes the security posture.
36 + // - Setting or clearing the primary password. Security posture.
37 + // - Clearing history. Irreversible.
25 38 //
26 39 // So this file contains no appearance, no layout, no density and no tab
27 40 // behaviour. If a diff to it argues about how Firefox should look, the diff
@@ -42,6 +55,18 @@
42 55 // 3 and stays out of this file.
43 56 pref("browser.compactmode.show", true);
44 57
58 + // ---------------------------------------------------------------------
59 + // Rung 4: a gate in front of a reversible act the user asked for.
60 + // ---------------------------------------------------------------------
61 +
62 + // Ships true (Firefox 153.0, defaults/preferences/firefox.js:1140), so
63 + // about:config puts an "accept the risk" screen in front of a page the user
64 + // typed the address of. Every value behind it is a pref the same user can set
65 + // back, and nothing there changes what the machine will run. Off by the rung-4
66 + // test. The gates on unsigned extensions, the primary password and clearing
67 + // history are the same shape and stay, for the reasons in the header.
68 + pref("browser.aboutConfig.showWarning", false);
69 +
45 70 // ---------------------------------------------------------------------
46 71 // Rung 2: the AI block.
47 72 // ---------------------------------------------------------------------