Dear Maintainer,

The Mozilla Privacy Task Force develop(ed)? a wiki page[1] that informs users
of some ways to increase the privacy posture of their Firefox browser.

I'd like to request that the Debian firefox-esr package be updated to apply
some of those privacy settings in its configuration defaults.

Please find attached a patch to set the following preferences by default:

  * privacy.firstparty.isolate = true
  * privacy.resistFingerprinting = true
  * browser.urlbar.speculativeConnect.enabled = false
  * browser.places.speculativeConnect.enabled = false


Apart from the last item, I've sourced all of these from the wiki page; they
are a subset of the options listed there.

The last item, 'browser.places.speculativeConnect.enabled', is a setting that I
found while writing this bugreport (during a search in the about:config dialog)
and that is not currently mentioned on the Mozilla Privacy Task Force wiki
page.

I have not included any settings that I think would be likely to negatively
affect user experience on websites based on my knowledge of cases where Firefox
already requests consent for access to device sensors (for example, geolocation
and microphone permissions) -- nor have I included any referer-related
settings.

The 'dom.battery.enabled' setting initially appeared to be a good candidate to
modify; however upon inspection of recent versions of the Firefox codebase, it
has become tagged 'ChromeOnly' (not a reference to the Chrome browser!  instead
an indication that the setting only provides access from Firefox's own user
interface components) indicating that it does not provide access that websites
can use via the DOM.  I can imagine that displaying the battery status in
browser UI elements could make sense under some circumstances (during
presentations, for example), and with that in mind the UI-only constraint seems
reasonable to me.

I've been using these settings myself for a few days, and while I have to admit
that I probably use more privacy-orientated settings than many others, I have
not encountered problems using the web with them configured in Firefox.  Even
so, it might make sense for any subsequent upload of the Debian package to go
into the experimental release for a while, if this patch is applied.

Thank you,
James

[1] - https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks