Merging some of Librewolf's privacy-oriented changes

[doctorsangria]

Hello, I was wondering if it would be possible to lift some of LibreWolf's privacy hardening changes into the Zen project; and I guess as a side question, which (if any) of these features does Zen have, and which does it not?

https://librewolf.net/docs/features/

For me personally, I was wondering if we could have "RFP" (unless that's just privacy.resistfingerprinting?), easily accessible options to disable WebGL and WebRTC, OCSP hard-failing, and the optional extension firewall (and of course letterboxing which I understand is present but broken at the moment). Theres plenty of other stuff too though.

P.S. thanks for all the hard work you guys do on the browser <3 It's really beginning to mature into a great product and I'm excitedly anticipating the day I can comfortably daily drive it over LibreWolf.

[dosubot[bot]]

Hi @doctorsangria! I'm Dosu and I’m helping the desktop team.

Here's a quick rundown of how Zen compares to LibreWolf on the privacy features you mentioned:

• RFP (Resist Fingerprinting): Zen supports privacy.resistFingerprinting (RFP). Users have successfully applied Arkenfox user.js configs, and maintainers reference its use source.
• Letterboxing: Zen implements privacy.resistFingerprinting.letterboxing, but there are known bugs—on macOS, enabling letterboxing can cause viewport resizing issues (like a +1 pixel offset or the viewport not shrinking when the window size decreases). These are recent and acknowledged by maintainers source, source.
• WebGL/WebRTC disabling: There’s no clear evidence that Zen currently offers easily accessible options to disable WebGL or WebRTC by default or in the UI, though users have requested these features source, source.
• OCSP hard-failing: Zen maintains connections to OCSP servers for certificate validation, but doesn’t appear to support OCSP hard-failing as a configurable privacy feature. Users have discussed the pros and cons, but it’s not exposed as a user-facing option source.
• Extension firewall: Zen does not currently provide an extension firewall feature like LibreWolf’s source.

Zen aims to balance privacy and usability, learning from LibreWolf and Tor, but doesn’t clone all their features. Some privacy hardening (like stricter onboarding presets or UI toggles for WebGL/WebRTC) is a common user request, but for now, most advanced privacy tweaks require manual configuration via about:config.

If you want stricter privacy, you can apply user.js configs (like Arkenfox) or track the relevant issues for updates. The maintainers are aware of these requests, and community feedback is helping shape future improvements.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[doctorsangria]

I checked out one of the linked discussions and I also want to ask, are there still plans to address the issue of certain social media trackers being explicitly whitelisted through ETP? I can still see the same config lines in the latest twilight build as were mentioned in #7000 even though that issue has since been closed (unless I'm misunderstanding what I'm looking at here which is totally possible).

[dosubot[bot]]

There’s no public evidence of plans to remove or modify the social media tracker whitelist in ETP—those config lines are still present in the latest builds, and the closure of #7000 didn’t result in code changes addressing this. Recent issues and discussions show ongoing community concern about privacy inconsistencies, but there’s no indication from maintainers that this specific whitelist will be changed or removed soon. Some users have interpreted the closure of related issues without clear resolution as a possible “wontfix” stance from the project on this topic source.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}