max / alloy
| 1 | // Alloy's Firefox configuration. |
| 2 | // |
| 3 | // Firefox is Alloy's browser, ruled 2026-08-18 (wiki `alloy-byo-principle`). |
| 4 | // A default has to earn it under rule 3 of `alloy-packaging-policy`, and stock |
| 5 | // Firefox does not: it arrives with defaults that serve someone other than the |
| 6 | // person running it. This file is what pays for the pick, and it is the whole |
| 7 | // of what Alloy does to a browser. There is no policy file, no autoconfig, no |
| 8 | // profiles.ini, and no userChrome.css. Those were deleted on 2026-07-30 and |
| 9 | // they are not coming back. |
| 10 | // |
| 11 | // THESE ARE DEFAULTS, NOT LOCKS. `pref` rather than `lockPref` is deliberate: |
| 12 | // every line here is a starting position the user can change in Settings, and |
| 13 | // a locked pref would be Alloy hiding a control while claiming to object to |
| 14 | // hidden controls. See wiki `irreducible-complexity-principle`. |
| 15 | // |
| 16 | // WHAT MAY GO IN HERE, in order. Wiki `alloy-byo-principle`, "Exposing a |
| 17 | // hidden control beats setting a value": |
| 18 | // |
| 19 | // 1. Restore a control the vendor hid. Sets no value, so Alloy's opinion |
| 20 | // never enters. |
| 21 | // 2. Remove an anti-feature. The test is who the default serves: if the |
| 22 | // answer is anyone but the user, it goes. |
| 23 | // 3. Set a value to Alloy's preference. Forbidden here. Nothing on this |
| 24 | // rung has ever been in this file and the Containerfile asserts it. |
| 25 | // 4. Take off a confirm-style gate the vendor put in front of a capability. |
| 26 | // It comes off when the act behind it is reversible and the user |
| 27 | // navigated there deliberately. It stays when the act is irreversible or |
| 28 | // changes the machine's security posture. The test is what the click |
| 29 | // costs if the user was wrong, not how expert the user is. |
| 30 | // |
| 31 | // Rung 4 removes one gate in this file and keeps three, which is what makes |
| 32 | // it a rule rather than a licence. The three that stay, named so the next |
| 33 | // survey does not re-file them: |
| 34 | // |
| 35 | // - Installing an unsigned extension. Changes the security posture. |
| 36 | // - Setting or clearing the primary password. Security posture. |
| 37 | // - Clearing history. Irreversible. |
| 38 | // |
| 39 | // So this file contains no appearance, no layout, no density and no tab |
| 40 | // behaviour. If a diff to it argues about how Firefox should look, the diff |
| 41 | // is wrong rather than the rule. |
| 42 | // |
| 43 | // Pref names and their shipped defaults were read out of Firefox 153.0's |
| 44 | // omni.ja on 2026-08-18 rather than remembered. Re-measure when Fedora moves |
| 45 | // a major version: Mozilla renames these, and a pref that no longer exists |
| 46 | // fails silently, which is the failure mode this file can least afford. |
| 47 | |
| 48 | // --------------------------------------------------------------------- |
| 49 | // Rung 1: controls Mozilla built, supports, and hid. |
| 50 | // --------------------------------------------------------------------- |
| 51 | |
| 52 | // Ships false, which hides the density control in Customize. True puts the |
| 53 | // control back and says nothing about which density is right. Compact is one |
| 54 | // visible click away and Alloy does not click it: `browser.uidensity` is rung |
| 55 | // 3 and stays out of this file. |
| 56 | ; |
| 57 | |
| 58 | // --------------------------------------------------------------------- |
| 59 | // Rung 4: a gate in front of a reversible act the user asked for. |
| 60 | // --------------------------------------------------------------------- |
| 61 | |
| 62 | // Ships true (Firefox 153.0, defaults/preferences/firefox.js:1140), so |
| 63 | // about:config puts an "accept the risk" screen in front of a page the user |
| 64 | // typed the address of. Every value behind it is a pref the same user can set |
| 65 | // back, and nothing there changes what the machine will run. Off by the rung-4 |
| 66 | // test. The gates on unsigned extensions, the primary password and clearing |
| 67 | // history are the same shape and stay, for the reasons in the header. |
| 68 | ; |
| 69 | |
| 70 | // --------------------------------------------------------------------- |
| 71 | // Rung 2: the AI block. |
| 72 | // --------------------------------------------------------------------- |
| 73 | // Every pref below ships ON, downloads models, and was never opted into: |
| 74 | // browser.ml.linkPreview.optin and browser.tabs.groups.smart.optin are both |
| 75 | // false in the shipped defaults, which is the tell. Off by the who-does-this- |
| 76 | // serve test, and a user who wants any of it turns it back on in Settings. |
| 77 | // |
| 78 | // The master switch is set AND the feature switches are set. That is not |
| 79 | // redundancy: it is the guard against a release that re-gates a feature onto |
| 80 | // its own pref, which would silently re-enable it here. |
| 81 | |
| 82 | // The master switch: the ML runtime and every model download behind it. |
| 83 | ; |
| 84 | |
| 85 | // The chatbot sidebar, its context-menu entry, and the two badges that exist |
| 86 | // to advertise it. |
| 87 | ; |
| 88 | ; |
| 89 | ; |
| 90 | ; |
| 91 | ; |
| 92 | |
| 93 | // Link previews, including the long-press gesture that triggers them. |
| 94 | ; |
| 95 | ; |
| 96 | |
| 97 | // Model-driven tab grouping. Both halves: `enabled` is the feature and |
| 98 | // `userEnabled` is the surface that offers it. |
| 99 | ; |
| 100 | ; |
| 101 | |
| 102 | // --------------------------------------------------------------------- |
| 103 | // Rung 2: telemetry. |
| 104 | // --------------------------------------------------------------------- |
| 105 | // Serves the vendor. The two datareporting prefs are the real handles, since |
| 106 | // they gate submission itself rather than collection. |
| 107 | ; |
| 108 | ; |
| 109 | ; |
| 110 | |
| 111 | // Studies ship experiments to a machine that did not ask for one. |
| 112 | ; |
| 113 | |
| 114 | // Add-on recommendations built from a profile of what the user browses. |
| 115 | ; |
| 116 | |
| 117 | // --------------------------------------------------------------------- |
| 118 | // Rung 2: advertising. |
| 119 | // --------------------------------------------------------------------- |
| 120 | // Serves advertisers. Sponsored placements on the new tab page and in the |
| 121 | // address bar. `system.showSponsored` is the feed itself rather than the |
| 122 | // checkbox, so it goes too, and the unifiedAds pair is the newer delivery |
| 123 | // path for the same thing. |
| 124 | ; |
| 125 | ; |
| 126 | ; |
| 127 | ; |
| 128 | ; |
| 129 | |
| 130 | // Sponsored address-bar suggestions. |
| 131 | ; |
| 132 | ; |
| 133 | |
| 134 | // --------------------------------------------------------------------- |
| 135 | // Rung 2: tracking protection. |
| 136 | // --------------------------------------------------------------------- |
| 137 | // Ships at "standard", which serves the ad industry rather than the user. |
| 138 | // Strict is the category Firefox already offers; this picks the one that |
| 139 | // protects, not a setting Mozilla does not support. |
| 140 | ; |
| 141 | |
| 142 | // --------------------------------------------------------------------- |
| 143 | // NOT HERE, and each for a reason |
| 144 | // --------------------------------------------------------------------- |
| 145 | // Pocket. Gone from Firefox: Mozilla shut the service down and 153 carries no |
| 146 | // `extensions.pocket` pref at all. It was on Alloy's list from the 2026-07-30 |
| 147 | // estate and would have been a dead line. |
| 148 | // |
| 149 | // browser.uidensity. Rung 3. `browser.compactmode.show` above already puts |
| 150 | // the user one control away, which is the cheaper move and the honest one. |
| 151 | // |
| 152 | // userChrome.css, the fifty-preference estate, the enterprise policy. Deleted |
| 153 | // 2026-07-30 and out of scope by guard 1. |
| 154 |