something something something dark side: favicons

[Thorin-Oakenpants]

from @Atavic

FF 52.0 ESR

// Show favicons in web notifications.
pref("alerts.showFavicons", false);

// No Favicons, Thanks!
pref("browser.chrome.favicons, false);

See here for browser.shell.shortcutFavicons

[Atavic]

1st:
<link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
<link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">

2nd:
<link href="favicon.ico" rel="shortcut icon" />
It's an actual .ico file, MIME Type image/x-icon

3rd: No icon link in source

[earthlng]

Steps to reproduce:

Have you restarted FF after setting it? If that doesn't fix it then browser.chrome.favicons is definitely not doing what I would expect it to do.

\profile\shortcutCache - I don't even have that folder (???) But I have cache enabled so maybe that's the reason it stores it somewhere else.

browser.shell.shortcutFavicons - I think we add it to the new 08xx section, set to false and active, fe. 0880+ for all 3 favicons prefs.
browser.chrome.favicons - set it to false and comment it out, because I like the icons too
alerts.showFavicons - has to do with notifications but IMO we should keep the Favicons stuff together, so add it as false and active (or inactive - zero fucks given ;)

[earthlng]

wait... 0800 doesn't seem like the right section. Maybe we need to split them up or can find a section where all 3 fit, idk. browser.chrome.favicons maybe fits under quiet fox or cache, but I assume with cache disabled it also doesn't store favicons, right?

and here's the contents when browser.shell.shortcutFavicons->false

so you need to pull the url to the desktop or something for this? sorry I never do that so I don't have a clue.

[earthlng]

Sorry, I should just do my own testing instead of being lazy and asking dumb questions.

[Atavic]

Pointless site has no icon link in source but the browser looks at http://www.pointless.com/favicon.ico if available. By adding an ETag header, Web Servers can fingerprint the browser. ETags allow tracking without cookies, and can be defeated by cleaning the cache (but still work during a browser's session).

http://lucb1e.com/rp/cookielesscookies/

[earthlng]

during a browser session I have the same IP so ETags are irrelevant.
When I open the browser the next day with a different IP, first it loads my previous session completely from the cache. When I reload one of those tabs, I do a force-reload and it never includes the Etag in my request header that way.
Add to that, that I use PB for most of my browsing, and my startup normal window only has the pages I still need to read or something, Etag aren't such a big problem for me.

[earthlng]

But can't you use a nilla FF for these tests?

sure, but do we even need to test this?

• browser.shell.shortcutFavicons is a nice addition and you tested it
• browser.chrome.favicons we don't want to enable anyway but can still include it
• alerts.showFavicons is false by default but we can include it too

All we need is to figure out in which section to add them.
What is there to test? It's not our problem as far as I'm concerned.

[Atavic]

@Thorin-Oakenpants Option1 for me.

browser.chrome.site_icons
http://kb.mozillazine.org/Browser.chrome.site_icons

...hope @fmarier can jump in here.

[Atavic]

The places.sqlite includes a number of tables as follows:
moz_favicons - Favourite icons - including URL of icon

http://kb.mozillazine.org/Places.sqlite#Deleting

[Atavic]

Stinky favicons fall under behind-the-scene requests in uBlock Origin and can't be blocked with user made filters: gorhill/uBlock#1732

[earthlng]

"can't be blocked with user made filters" ...

if behind-the-scene requests are whitelisted

ergo remove the whitelisting and block to your heart's content

[Atavic]

Yeah, I behind-the-scene requests are whitelisted as default there.

[earthlng]

Just add a noop rule that covers behind-the-scene requests (or only BTS requests), which will block all requests that match an entry in a filterlist. Then you can also block Favicons or whatever else falls under BTS.
for example: behind-the-scene * * noop
also read this (towards the end there)

My whitelist in uBO is empty and I only have two rules in My Rules:

no-remote-fonts: * true
* * * noop

and I use uMatrix to do all the granular control.