1862195 - Consider allowing user the option to override fpp granularOverrides

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[aoia7rz7l]

After upgrading my test profile to 120.0beta I noticed Firefox attempting make an extra connection to firefox.settings.services.mozilla.com at startup. I wasn't able to disable it via random pref flips and about:logging didn't seem to be able to log startup connections, so I ended up mitm-ing myself to catch the full URL.

These URLs are

https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?collection=fingerprinting-protection-overrides&bucket=main&_expected=0

and

https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/fingerprinting-protection-overrides/changeset?expected=%last_modified_timestamp%

While the list seems to be currently empty, AFAICT from the test case here privacy.fingerprintingProtection.granularOverrides will override privacy.fingerprintingProtection.overrides, and privacy.fingerprintingProtection.granularOverrides will be updated via RemoteSettings.

Personally, I was really looking forward to testing out fpp because some RFP protections can really trip users up if they didn't expect it beforehand. However, I am not prepared to migrate to fpp if, for example, that +CanvasImageExtractionPrompt can be silently disabled via RemoteSettings for compatibility reasons. I would rather deal with potential breakages myself (or even leave and not use the site). I understand why the fingerprinting-protection-overrides bucket is implemented, but it would be nice if users can decide whether they wanted to use the overrides provided and maintained by Mozilla (or even customize their own), or at least some sort of warning that some fpp protections will be disabled before connecting to a particular domain.

Mozregression returned

Last good revision: 42b4fa32b69deff886ea9bc4f4f7fb94391b751a
First bad revision: d88c766a920050b2f3366773a656accf588cbdf8
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=42b4fa32b69deff886ea9bc4f4f7fb94391b751a&tochange=d88c766a920050b2f3366773a656accf588cbdf8

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Privacy: Anti-Tracking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco]]

Setting Regressed by field after analyzing regression range found by mozregression in comment #0.

Comment 3

[BugBot [:suhaib / :marco]]

:timhuang, since you are the author of the regressor, bug 1834274, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Tom Ritter [:tjr]]

Yeah, that seems reasonable. There's probably a pref to disable Remote Settings entirely, but if you wanted to disable just this bucket, we could do that.

We still want to honor the local pref, so it might be as simple as doing a pref check right here

Comment 5

[Tim Huang[:timhuang]]

Weird. I cannot set the type here back to enhancement.

Comment 6

[BugBot [:suhaib / :marco]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1834274

Comment 8

[Fatih Kilic [:fklc]]

Attachment: Bug 1862195: Implement privacy.fingerprintingProtection.remoteOverrides.enabled option to disable remote FPP overrides. r?tjr

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/72e7fb94fb60
Implement privacy.fingerprintingProtection.remoteOverrides.enabled option to disable remote FPP overrides. r=tjr

Comment 10

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/72e7fb94fb60