[Guide] Automatically install extensions and configure new (dispvm) hardened Firefox profiles with arkenfox user.js and policies

ruedi · December 9, 2022, 8:36am

I do not know in which direction your reply goes. At least someone who works in internet businesses HAS to pay his rent and buy some food. What is your idea, where the money should come from?

enmus · December 9, 2022, 3:16pm

This is completely offtopic.

@deeplow, please split topic from here into All Around Qubes or elswhere. Possible subject - “Is it moral and/or legal to use addblocks and other SPA tools in Qubes”

deeplow · December 9, 2022, 3:20pm

@ruedi this forum is exclusively for Qubes-related discussions. Other venues like reddit.com/r/privacy may be more suited.

ruedi · December 9, 2022, 5:42pm

Hi, since I am new to forum regulations I do make mistakes, but I should have known better.
I deleted the off-topic section. Hope that’s ok.

vxc · December 17, 2022, 12:41am

Thanks BEBF738VD for the guide.
Have any Fedora template users figured out an elegant way to integrate updater.sh and user-overrides.js into this process? It would be nice to have a way to automatically check if user.js is up to date, then update user.js if it is not, and finally apply user-overrides.js. Having to manually maintain each VM sounds like a lot of work. I am still a bit new to linux so I am not sure how to accomplish this.

edit: I might switch to firefox-esr to have more supported options in policies.json and to reduce amount of maintenance required. Please correct me if I am wrong, but it looks like the commands in the OP do not include a method to activate deprecated user.js prefs that ESR uses. edit2: turns out the commands DO activate deprecated user.js prefs for ESR.

vxc · December 18, 2022, 7:18pm

@Vr3th @clarinetthelionking The link that Vr3th provided is accurate. I checked it against mozilla’s documentation. I only had issues including my ublock config in policies.json. However this article helped solve these issues. I configured ublock to my liking in an existing browser, then used ublock’s “Back up to file” setting to generate a backup file. Pasted this backup into the adminSetting utility mentioned in the article. Then pasted the output plain string value into policies.json like so:

{
  "3rdparty": {
    "Extensions": {
      "ublock0@raymondhill.net":  {
        "adminSettings": {"userSettings":{"OTHER/SETTINGS/HERE"..."}
      }
    }
  }
}

Now everything is working in all VMs based on the Fedora template.

deeplow · December 20, 2022, 9:08am

No worries!

anon11917472 · January 5, 2023, 5:53pm

Interesting.

If they are trying to fingerprint based on the speed a GPU renders whatever would a way to mask this be to randomize the clock speed of your GPU? I don’t know much but about this sort of thing but I would assume it would be hard to impossible to make any judgements based of render speed if the clock speed and maybe ram timing of a GPU was randomized or at least changed from time to time.
Just a thought.

arkenoi · May 29, 2023, 10:18am

How can I make extensions to get “silently” granted with all the necessary permissions not requiring to me to see any splash screens about first use etc?

1choice · June 4, 2023, 3:46pm

Here’s an addition of caching Firefox addons to install addons using policies.json.

The new DispVMs on boot will request caching VM to get the Firefox addons before Firefox will start.
Caching VM on receiving request will get the latest addon version info and check the addon on disk if it’s the latest version. It’ll download the addon if the version on disk is not the latest. Then it’ll send the latest addon to the requester.

Example for uBlock Origins.
Change sys-whonix in /usr/local/bin/firefox-get-addons in disposable template and in /etc/qubes/policy.d/30-user.policy in dom0 to your desired VM that will be processing the requests to get the Firefox addons.
Change debian-11-dvm in dom0 qvm-tags to your desired disposable template.

To make disposable VMs based on other disposable templates use the caching VM you need to repeat step 1 in new disposable template and add firefox tag to it in dom0:
qvm-tags debian-11-firefox-dvm add tag firefox

1. In disposable template (debian-11-dvm in this example):

Run as user:

mkdir -p /home/user/.config/systemd/user
cat << 'EOF' | sudo tee /usr/local/bin/firefox-get-addons
#!/bin/sh
qubes_vm_name="$(qubesdb-read /name)"
# Check that we're not running inside Disposable Template
if echo "$qubes_vm_name" | grep -q --invert-match "\-dvm" ; then
    /usr/lib/qubes/qrexec-client-vm --filter-escape-chars-stderr -- sys-whonix user.FirefoxGetAddon+uBlockOrigin /usr/lib/qubes/qfile-unpacker
fi
EOF
sudo chmod +x /usr/local/bin/firefox-get-addons 
mkdir -p /home/user/.config/systemd/user
cat << 'EOF' > /home/user/.config/systemd/user/firefox-get-addons.service
[Unit]
Description=Get Firefox Add-ons
Before=basic.target
DefaultDependencies=no

[Service]
Type=oneshot
Environment=QREXEC_REMOTE_DOMAIN=dom0
ExecStart=/usr/local/bin/firefox-get-addons

[Install]
WantedBy=basic.target
EOF
systemctl --user daemon-reload
systemctl --user enable firefox-get-addons.service

Add extension to install in ExtensionSettings in policies.json file:

        "ExtensionSettings": {
            "*": {
                "installation_mode": "blocked"
            },
            "uBlock0@raymondhill.net": {
                "installation_mode": "normal_installed",
                "install_url": "file:///home/user/QubesIncoming/dom0/ublock_origin-latest.xpi"
            }
        },

2. In your caching VM (sys-whonix in this example):

Run as user:

sudo mkdir -p /usr/local/etc/qubes-rpc
cat << 'EOF' | sudo tee /usr/local/etc/qubes-rpc/user.FirefoxGetAddon+uBlockOrigin 
#!/usr/bin/env python3
import os
import sys
import json
import requests
import shutil
import hashlib
import subprocess as s

def download_file(url,proxies,filename):
    with requests.get(url, proxies=proxies, stream=True) as r:
        with open(filename, 'wb') as f:
            shutil.copyfileobj(r.raw, f)

def sha256sum(filename):
    h  = hashlib.sha256()
    b  = bytearray(128*1024)
    mv = memoryview(b)
    with open(filename, 'rb', buffering=0) as f:
        while n := f.readinto(mv):
            h.update(mv[:n])
    return h.hexdigest()

def main():
    # Set Tor proxy if we're running in Whonix VM
    if os.path.exists('/usr/share/whonix/marker'):
        proxy = 'socks5h://127.0.0.1:9050'
    else:
        proxy = ''
    proxies = {
       'http': proxy,
       'https': proxy
    }
    url = 'https://addons.mozilla.org/api/v5/addons/addon/ublock-origin/versions/?page_size=1'
    response = requests.get(url, proxies=proxies)
    addon_latest_json = response.json()['results'][0]
    addon_dest_file = '/home/user/Downloads/firefox-extensions/ublock_origin-latest.xpi'
    os.makedirs(os.path.dirname(addon_dest_file), exist_ok=True)
    if not os.path.exists(addon_dest_file) or sha256sum(addon_dest_file) != addon_latest_json['file']['hash'].split(':')[1]:
        download_file(addon_latest_json['file']['url'], proxies, addon_dest_file)
        if not os.path.exists(addon_dest_file) or sha256sum(addon_dest_file) != addon_latest_json['file']['hash'].split(':')[1]:
            s.call(['notify-send','Failed to get latest uBlock Origin Firefox addon','--icon=dialog-error'])
            sys.exit(1)
    s.call(['/usr/lib/qubes/qfile-agent',addon_dest_file])
    sys.exit(0)
if __name__ == '__main__':
    main()
EOF

3. In dom0:

Run as user:

cat << 'EOF' | sudo tee -a /etc/qubes/policy.d/30-user.policy
user.FirefoxGetAddon +uBlockOrigin @tag:firefox sys-whonix allow
EOF
qvm-tags debian-11-dvm add tag firefox

1choice · June 4, 2023, 9:28pm

Fixed to use ExtensionSettings instead of Extensions in policies.json:

Updated copy here

Here’s an addition of caching Firefox addons to install addons using policies.json.

The new DispVMs on boot will request caching VM to get the Firefox addons before Firefox will start.
Caching VM on receiving request will get the latest addon version info and check the addon on disk if it’s the latest version. It’ll download the addon if the version on disk is not the latest. Then it’ll send the latest addon to the requester.

Example for uBlock Origins.
Change sys-whonix in /usr/local/bin/firefox-get-addons in disposable template and in /etc/qubes/policy.d/30-user.policy in dom0 to your desired VM that will be processing the requests to get the Firefox addons.
Change debian-11-dvm in dom0 qvm-tags to your desired disposable template.

To make disposable VMs based on other disposable templates use the caching VM you need to repeat step 1 in new disposable template and add firefox tag to it in dom0:
qvm-tags debian-11-firefox-dvm add tag firefox

1. In disposable template (debian-11-dvm in this example):

Run as user:

mkdir -p /home/user/.config/systemd/user
cat << 'EOF' | sudo tee /usr/local/bin/firefox-get-addons
#!/bin/sh
qubes_vm_name="$(qubesdb-read /name)"
# Check that we're not running inside Disposable Template
if echo "$qubes_vm_name" | grep -q --invert-match "\-dvm" ; then
    /usr/lib/qubes/qrexec-client-vm --filter-escape-chars-stderr -- sys-whonix user.FirefoxGetAddon+uBlockOrigin /usr/lib/qubes/qfile-unpacker
fi
EOF
sudo chmod +x /usr/local/bin/firefox-get-addons 
mkdir -p /home/user/.config/systemd/user
cat << 'EOF' > /home/user/.config/systemd/user/firefox-get-addons.service
[Unit]
Description=Get Firefox Add-ons
Before=default.target

[Service]
Type=oneshot
Environment=QREXEC_REMOTE_DOMAIN=dom0
ExecStart=/usr/local/bin/firefox-get-addons

[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload
systemctl --user enable firefox-get-addons.service

Add extension to install in ExtensionSettings in policies.json file:

        "ExtensionSettings": {
            "*": {
                "installation_mode": "blocked"
            },
            "uBlock0@raymondhill.net": {
                "installation_mode": "normal_installed",
                "install_url": "file:///home/user/QubesIncoming/dom0/ublock_origin-latest.xpi"
            }
        },

2. In your caching VM (sys-whonix in this example):

Run as user:

sudo mkdir -p /usr/local/etc/qubes-rpc
cat << 'EOF' | sudo tee /usr/local/etc/qubes-rpc/user.FirefoxGetAddon+uBlockOrigin 
#!/usr/bin/env python3
import os
import sys
import json
import requests
import shutil
import hashlib
import subprocess as s

def download_file(url,proxies,filename):
    with requests.get(url, proxies=proxies, stream=True) as r:
        with open(filename, 'wb') as f:
            shutil.copyfileobj(r.raw, f)

def sha256sum(filename):
    h  = hashlib.sha256()
    b  = bytearray(128*1024)
    mv = memoryview(b)
    with open(filename, 'rb', buffering=0) as f:
        while n := f.readinto(mv):
            h.update(mv[:n])
    return h.hexdigest()

def main():
    # Set Tor proxy if we're running in Whonix VM
    if os.path.exists('/usr/share/whonix/marker'):
        proxy = 'socks5h://127.0.0.1:9050'
    else:
        proxy = ''
    proxies = {
       'http': proxy,
       'https': proxy
    }
    url = 'https://addons.mozilla.org/api/v5/addons/addon/ublock-origin/versions/?page_size=1'
    response = requests.get(url, proxies=proxies)
    addon_latest_json = response.json()['results'][0]
    addon_dest_file = '/home/user/Downloads/firefox-extensions/ublock_origin-latest.xpi'
    os.makedirs(os.path.dirname(addon_dest_file), exist_ok=True)
    if not os.path.exists(addon_dest_file) or sha256sum(addon_dest_file) != addon_latest_json['file']['hash'].split(':')[1]:
        download_file(addon_latest_json['file']['url'], proxies, addon_dest_file)
        if not os.path.exists(addon_dest_file) or sha256sum(addon_dest_file) != addon_latest_json['file']['hash'].split(':')[1]:
            s.call(['notify-send','Failed to get latest uBlock Origin Firefox addon','--icon=dialog-error'])
            sys.exit(1)
    s.call(['/usr/lib/qubes/qfile-agent',addon_dest_file])
    sys.exit(0)
if __name__ == '__main__':
    main()
EOF

3. In dom0:

Run as user:

cat << 'EOF' | sudo tee -a /etc/qubes/policy.d/30-user.policy
user.FirefoxGetAddon +uBlockOrigin @tag:firefox sys-whonix allow
EOF
qvm-tags debian-11-dvm add tag firefox

1choice · June 5, 2023, 11:42am

Fixed systemd service so Firefox won’t start before all addons were received.

Updated copy here

Here’s an addition of caching Firefox addons to install addons using policies.json.

The new DispVMs on boot will request caching VM to get the Firefox addons before Firefox will start.
Caching VM on receiving request will get the latest addon version info and check the addon on disk if it’s the latest version. It’ll download the addon if the version on disk is not the latest. Then it’ll send the latest addon to the requester.

Example for uBlock Origins.
Change sys-whonix in /usr/local/bin/firefox-get-addons in disposable template and in /etc/qubes/policy.d/30-user.policy in dom0 to your desired VM that will be processing the requests to get the Firefox addons.
Change debian-11-dvm in dom0 qvm-tags to your desired disposable template.

To make disposable VMs based on other disposable templates use the caching VM you need to repeat step 1 in new disposable template and add firefox tag to it in dom0:
qvm-tags debian-11-firefox-dvm add tag firefox

1. In disposable template (debian-11-dvm in this example):

Run as user:

mkdir -p /home/user/.config/systemd/user
cat << 'EOF' | sudo tee /usr/local/bin/firefox-get-addons
#!/bin/sh
qubes_vm_name="$(qubesdb-read /name)"
# Check that we're not running inside Disposable Template
if echo "$qubes_vm_name" | grep -q --invert-match "\-dvm" ; then
    /usr/lib/qubes/qrexec-client-vm --filter-escape-chars-stderr -- sys-whonix user.FirefoxGetAddon+uBlockOrigin /usr/lib/qubes/qfile-unpacker
fi
EOF
sudo chmod +x /usr/local/bin/firefox-get-addons 
mkdir -p /home/user/.config/systemd/user
cat << 'EOF' > /home/user/.config/systemd/user/firefox-get-addons.service
[Unit]
Description=Get Firefox Add-ons
Before=basic.target
DefaultDependencies=no

[Service]
Type=oneshot
Environment=QREXEC_REMOTE_DOMAIN=dom0
ExecStart=/usr/local/bin/firefox-get-addons

[Install]
WantedBy=basic.target
EOF
systemctl --user daemon-reload
systemctl --user enable firefox-get-addons.service

Add extension to install in ExtensionSettings in policies.json file:

        "ExtensionSettings": {
            "*": {
                "installation_mode": "blocked"
            },
            "uBlock0@raymondhill.net": {
                "installation_mode": "normal_installed",
                "install_url": "file:///home/user/QubesIncoming/dom0/ublock_origin-latest.xpi"
            }
        },

2. In your caching VM (sys-whonix in this example):

Run as user:

sudo mkdir -p /usr/local/etc/qubes-rpc
cat << 'EOF' | sudo tee /usr/local/etc/qubes-rpc/user.FirefoxGetAddon+uBlockOrigin 
#!/usr/bin/env python3
import os
import sys
import json
import requests
import shutil
import hashlib
import subprocess as s

def download_file(url,proxies,filename):
    with requests.get(url, proxies=proxies, stream=True) as r:
        with open(filename, 'wb') as f:
            shutil.copyfileobj(r.raw, f)

def sha256sum(filename):
    h  = hashlib.sha256()
    b  = bytearray(128*1024)
    mv = memoryview(b)
    with open(filename, 'rb', buffering=0) as f:
        while n := f.readinto(mv):
            h.update(mv[:n])
    return h.hexdigest()

def main():
    # Set Tor proxy if we're running in Whonix VM
    if os.path.exists('/usr/share/whonix/marker'):
        proxy = 'socks5h://127.0.0.1:9050'
    else:
        proxy = ''
    proxies = {
       'http': proxy,
       'https': proxy
    }
    url = 'https://addons.mozilla.org/api/v5/addons/addon/ublock-origin/versions/?page_size=1'
    response = requests.get(url, proxies=proxies)
    addon_latest_json = response.json()['results'][0]
    addon_dest_file = '/home/user/Downloads/firefox-extensions/ublock_origin-latest.xpi'
    os.makedirs(os.path.dirname(addon_dest_file), exist_ok=True)
    if not os.path.exists(addon_dest_file) or sha256sum(addon_dest_file) != addon_latest_json['file']['hash'].split(':')[1]:
        download_file(addon_latest_json['file']['url'], proxies, addon_dest_file)
        if not os.path.exists(addon_dest_file) or sha256sum(addon_dest_file) != addon_latest_json['file']['hash'].split(':')[1]:
            s.call(['notify-send','Failed to get latest uBlock Origin Firefox addon','--icon=dialog-error'])
            sys.exit(1)
    s.call(['/usr/lib/qubes/qfile-agent',addon_dest_file])
    sys.exit(0)
if __name__ == '__main__':
    main()
EOF

3. In dom0:

Run as user:

cat << 'EOF' | sudo tee -a /etc/qubes/policy.d/30-user.policy
user.FirefoxGetAddon +uBlockOrigin @tag:firefox sys-whonix allow
EOF
qvm-tags debian-11-dvm add tag firefox

neoniobium · January 19, 2024, 1:16pm

I made salt script for setting up firefox in with policies and firefox.cfg. This might have some use for somebody else too.

Note that you have to provide your own configuration files. Furthermore this script is made for using conventional user.js files as input file. All syntax corrections are handed by this salt script itself.

##
# firefox
# ===================================
#
# configures firefox for usage in disposable template
##

##
{% set folder = "salt://<PATH TO FILES>" %}
{% set userjs_file = "arkenfox_user.js" %}
{% set policy_file = "policies.json" %}

{% if grains['id'] != 'dom0' %}
install-firefox-esr:
  pkg.installed:
    - refresh: true
    - install_recommends: false
    - pkgs:
      - firefox-esr

## https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig
## Firefox Policies: https://github.com/mozilla/policy-templates
## enable firefox configuration via autoconfig
enable-policies:
  file.managed:
    - name: /usr/share/firefox-esr/browser/defaults/preferences/autoconfig.js
    - user: root
    - group: root
    - mode: '0644'
    - makedirs: true
    - content: |
        # /usr/share/firefox-esr/browser/defaults/preferences/autoconfig.js
        pref("general.config.filename", "firefox.cfg");
        pref("general.config.obscure_value", 0);
    - require:
      - install-firefox-esr

## configure firefox polices
deploy-policies:
  file.managed:
    - name: /usr/lib/firefox-esr/distribution/policies.json
    - source: {{ folder }}/{{ policy_file }}
    - user: root
    - group: root
    - mode: '0644'
    - makedirs: true
    - require:
      - enable-policies

## configure user.js in template
deploy-userjs:
  file.managed:
    - name: /usr/lib/firefox-esr/firefox.cfg
    - source: {{ folder }}/{{ userjs_file }}
    - user: root
    - group: root
    - mode: '0644'
    - makedirs: true
    - require:
      - install-firefox-esr

prepend-line:
  file.prepend:
    - name: /usr/lib/firefox-esr/firefox.cfg
    - text: "// IMPORTANT: Start your code on the 2nd line"
    - require:
      - deploy-userjs

replace-adapt-syntax:
  file.replace:
    - name: /usr/lib/firefox-esr/firefox.cfg
    - pattern: "^user_pref"
    - repl: "pref"
    - require:
      - deploy-userjs
{% endif %}

adrelanos · June 7, 2024, 7:29pm

We need something better than arkenfox. Unresolved, rejected ticket:

github.com/arkenfox/user.js

Feature Request: Radio Silence by Default for Browser Startup and Background Connections aka "Disable Phone Home"

opened 04:19PM - 14 Feb 24 UTC

closed 10:20PM - 14 Feb 24 UTC

adrelanos

invalid

## Introduction **Radio Silence:** No background connections should be initia…ted without the user's knowledge and explicit consent. If the user opens the browser and does not visit a website, no data should be transmitted. This, in my opinion, should be the core philosophy of a privacy-focused browser. The concept of 'Radio Silence' aligns with this principle, ensuring that users have complete control over their data and privacy. A [comparable perspective](https://www.unixsheikh.com/articles/choose-your-browser-carefully.html) advocates for this stringent approach to user privacy. Similarly, Mullvad Browser echoes a similar sentiment in its blog post: [Telemetry: don’t let your browser ‘call home’ and betray you.](https://mullvad.net/en/browser/things-to-look-for-when-choosing-a-browser) Radio Silence simply put for the user means "no Phone Home". This should be the browser default setting. LibreFox (nowadays abandoned) also had this feature. > [IJWY (I Just Want You To Shut Up)](https://github.com/intika/Librefox/tree/master?tab=readme-ov-file#ijwy-i-just-want-you-to-shut-up ) > This is a set of settings that aim to remove all the server links embedded in Firefox and other calling home functions in the purpose of blocking un-needed connections. The objective is zero unauthorized connection (ping/telemetry/Mozilla/Google...). ``` // Section : IJWY To Shut Up // I Just Want You To Shut Up : Closing all non necessary communication to mozilla.org etc. // Thoses settings are not used in gHacks for the moment. // Will be upstreamed once stable in final version. ``` [Unfortunately, after LibreFox was deprecated, the LibreWolf developers (fork of LibreFox) removed this feature.](https://codeberg.org/librewolf/issues/issues/1779) This is a development goal / feature request for users who want privacy not only on random websites but want also privacy from the browser vendor, Mozilla. ## Connections upon browser startup See these screenshots of OpenSnitch. It was done using LibreWolf but this would be similar for `user.js`. Since I wanted to find out if no phone home would be considered a worthwhile development goal, I didn't re-create this for `user.js` specifically yet, which could be done later if there is any interest. This happens just after starting the browser. ![librewolf-connections-at-startup-1](https://github.com/arkenfox/user.js/assets/1985040/2f9415c7-6936-4575-acef-b03fe25d87a0) ![librewolf-connections-at-startup-2](https://github.com/arkenfox/user.js/assets/1985040/1b940a90-141b-4a5d-8950-faefcff1d1fb) Pretty ironic, Firefox sends ~ 13 tracking signals to `tracking-protection.cdn.mozilla.net`. ## Why are these connections a privacy issue? Let's consider the implications of a simple network connection from an IP address and its potential impact on user privacy: 1. **Data Conveyed by IP Connections:** Companies like Google, Mozilla, and Cloudflare receive the IP addresses of users every time a browser (primarily Firefox or Chromium-based) is launched. Every time a browser is initiated, it generally makes an connection from a specific IP address. This action is typically human-driven, suggesting someone is active at that IP location. 2. **Behavioral Patterns:** Regular habits, like opening a browser at 7:00 AM to read news, create recognizable patterns. Any deviation from this routine, like not accessing the browser at the usual time, could indicate a change in the user's behavior or circumstances. This kind of personal detail is none of the companies business. 3. **Browser Usage as a Routine Activity:** Most people tend to start a browser as one of the first activities when they use a computer. The only exception might be if the computer is left on with the browser continuously open. 4. **IP Addresses and User Identification:** Services like Google, which receive connections from numerous browsers worldwide, might be able to convert an IP address from just "some computer or network" to a "particular user." This capability depends on factors like Network Address Translation (NAT) and the extensive databases that can link IP addresses to complete user information. 5. **Determining Individual Users:** Even in cases of shared IP addresses, metadata sent with browser queries can help in distinguishing individual users from a small set of potential users. Cloud providers have technologies to differentiate between real persons and bots. 6. **The Nature of 'Pings':** Imagine if these companies openly stated, "We want to collect everyone's IP address each time they start their browser." That would sound creepy but this is what is happening. A simple ping sent each time a browser starts can equate to telling a company, "Hey, it's me [User's Name], currently at [specific location], using [specific computer]." Over time, this data reveals patterns of behavior, like where a person lives and works, their habits, and their social interactions. 7. **Statistical Analysis:** Even if the data isn't always specific, statistical analysis over time can reveal a lot about a user, even from sporadic data. 8. **Privacy Concerns and Trust Issues:** There's a general distrust towards companies regarding their use of user data. The safest assumption is that they will utilize whatever data they receive to its fullest extent, regardless of their public statements on privacy. 9. **Protecting Privacy:** The only way to ensure privacy is to avoid sending sensitive data in the first place. Pings that are specific to certain user events and carry uniquely identifiable information are extremely detrimental to privacy. 10. **Geolocation and Device Mapping:** Open Source and private databases can convert IP addresses to near-exact geographical positions. For instance, Android phones with "enhanced" GPS actively scan and map WiFi and Bluetooth networks, which can lead to an invasion of privacy on a massive scale. This is mentioned because it is prudent to assume that all of this data is being merged. 11. **The Siege of Modern Technology:** The widespread use of devices that constantly scan for other devices, akin to wardriving, means companies like Google have extensive data on our movements and interactions. 12. **No Harmless Network Connections:** All outgoing signals and network connections provide specific information about the user. This data, when correlated with information in massive databases, can reveal intimate details about a person's life. 13. **Implications for Technology Users:** The reality that every web interaction divulges significant information about a user challenges the notion of deploying technology that automatically does things for the user without their explicit interaction. 14. **Combination with other Tracking Technologies:** This data, when combined with other information gathered during normal browsing and browser fingerprinting, becomes quite revealing. 15. **Long-Term Data Collection and Monetization**: Such data collection can continue for decades, with dedicated employees constantly thinking of ways to monetize and (ab)use this information, not for the benefit of the user. It's wise to assume that this data will be, or could be, used to its maximum potential. 16. **Preventing Data Misuse**: The primary defense against this is to prevent such data from falling into the wrong hands. Certainly no privacy policies should be relied upon. 17. **The Only True Privacy Measure: Radio Silence:** If privacy is a genuine concern, the only effective approach is complete radio silence. At the very least, disabling default browser signals that are sent upon opening can help protect privacy. ## Excursion on Cloudflare's Capabilities Cloudflare is relevant because many of the browser's background connections are probably proxies by Cloudflare. The CDN provider Cloudflare is used by millions of websites. [1] [2] This is 18.9% of all websites. Or almost 1 in 5 websites. If we look at these [https://trends.builtwith.com/cdn/Cloudflare](https://trends.builtwith.com/cdn/Cloudflare) it's 32 % of the top 100 K websites. Most websites today utilize Cloudflare or some different CDN (content delivery network) with similar features and tracking capabilities for its anti spambot features, anti-DDOS and performance enhancements. CDNs acts as man-in-the-middle (MiTM) between a website and its visitors. Here are selected excerpts that illustrate the determination and sophistication of full-time professionals dedicated to advancing tracking technologies. These examples highlight the challenges and complexities faced when developing privacy-preserving software, emphasizing the level of expertise and resources one must contend with in this field. Quote Cloudflare blog posts: * [Multi-User IP Address Detection](https://blog.cloudflare.com/multi-user-ip-address-detection/): > By adding multi-user IP address detection to Cloudflare products, we're improving the quality of our detection techniques and reducing false positives for our customers. > There are some tradeoffs to this approach: some users may use multiple web browsers and some other users may have exactly the same user agent. Nevertheless, past research has shown that the number of unique web browser user agents is the best tradeoff to most accurately determine CG-NAT usage. > When an Internet user visits a website, the underlying TCP stack opens a number of connections in order to send and receive data from remote servers. Each connection is identified by a 4-tuple (source IP, source port, destination IP, destination port). Repeating requests from the same web client will likely be mapped to the same source port, so the number of distinct source ports can serve as a good indication of the number of distinct client applications. By counting the number of open source ports for a given IP address, you can estimate whether this address is shared by multiple users. > User agents provide device-reported information about themselves such as browser and operating system versions. For multi-user IP detection, you can count the number of distinct user agents in requests from a given IP. > Our service also uses other publicly available data sources to further refine the accuracy of our identification and to classify the type of multi-user IP address. For example, we collect data from PeeringDB, which is a database where network operators self-identify their network type, traffic levels, interconnection points, and peering policy. This data only covers a fraction of the Internet's autonomous systems (ASes). To overcome this limitation, we use this data and our own data (number of requests per AS, number of websites in each AS) to infer AS type. We also use external data sources such as IRR to identify requests from VPNs and proxy servers. > One method we used was running traceroute queries through RIPE Atlas, from each RIPE Atlas probe to the probe's public IP address. By examining the traceroute hops, we can determine if an IP is behind a CG-NAT or another middlebox. * [Cloudflare Bot Management: machine learning and more](https://blog.cloudflare.com/cloudflare-bot-management-machine-learning-and-more/) ([product](https://www.cloudflare.com/application-services/products/bot-management/)] * **machine learning:** "Cloudflare's Machine Learning trains on a curated subset of hundreds of billions of requests per day to create a reliable bot score for every request." * **heuristic engine** * **behavioral analysis:** "Cloudflare analyzes behavior and detects anomalies in your Internet property's specific traffic, scoring every request by how different it is from the baseline." * **verified bots** * **(JS) fingerprinting:** "Cloudflare uses fingerprinting from millions of Internet properties to accurately classify bots. They do not generate or store device fingerprints, eliminating the risk of user privacy being compromised." Also: * Characteristics of the home router, software version, which users often do not update (or no updates being provided by the hardware producer). * Characteristics of the user's network hardware, operating system It's reasonable to assume that Cloudflare takes advantage of the pings sent by nearly all browsers globally at the start of each browsing session. **JS Fingerprinting** > When it comes to Bot Management detection quality it's all about the signal quality and quantity. All previously described detections use request attributes sent over the network and analyzed on the server side using different techniques. Are there more signals available, which can be extracted from the client to improve our detections? > > As a matter of fact there are plenty, as every browser has unique implementation quirks. Every web browser graphics output such as canvas depends on multiple layers such as hardware (GPU) and software (drivers, operating system rendering). This highly unique output allows precise differentiation between different browser/device types. Moreover, this is achievable without sacrificing website visitor privacy as it's not a supercookie, and it cannot be used to track and identify individual users, but only to confirm that request's user agent matches other telemetry gathered through browser canvas API. [1] https://community.cloudflare.com/t/statistically-speaking-whats-the-percentage-of-total-sites-that-use-cf/372054 [2] https://blog.cloudflare.com/application-security/ ## Excursion on Mobile Phone Data Harvesting * Google operates servers dedicated to testing Android connectivity. * Android devices routinely send requests to these servers in response to certain events related to phone connectivity. Although the specifics of these events may not be widely known, it is common knowledge that these devices frequently "call home" to verify connectivity. * Through this process, Google collects user data, including IP addresses and other personal information. * It is prudent to assume that data brokers engage in daily transactions, buying and selling this kind of information. * There is [massive data harvesting](https://www.kicksecure.com/wiki/Mobile_Phone_Security) by phones. Conclusions from this data: * Google is most likely capable of associating an IP address with a specific individual in many cases. * By analyzing the timing and frequency of these requests, especially when they correlate with specific user events, the recipient of this information can deduce significant insights into user behavior. It is prudent to assume that this data is (or at least can be) combined with what browsers reveal during startup due to the default background connections. This is why it is mentioned here. ## Blocklist Downloads as a Security Risk Downloading blocklists from web servers all over the place increases the attack surface and makes the user more vulnerable to targeted attacks. There is a risk that an attacker could compel or hack Mozilla to selectively target particular users with malware. Parsing downloaded blocklists is a security risk due to string parsing. ## Likelihood of Complex Targeted Attacks The recent iPhone backdoor was not necessarily a state-sponsored adversary. I highly recommend the video [Operation Triangulation: What You Get When Attacking iPhones of Researchers](https://www.youtube.com/watch?v=7VWNUUldBEE) because it: * shows the lengths attackers go to and how much effort they spend to compromise user services. * serves as a reminder of how important it is to have as few as possible code for connection handling and string parsing. Compromising a browser is a high reward for the attacker and a high risk for the user. ## But Mozilla is trusted? Even if you trust Mozilla and other servers being contacted, any good actor with lots of trust and privileges can potentially be transformed into a bad actor at any point. So, let's reduce the attack surface. ## Local Blocklists as a Security Feature The blog post [Revocation Checking is Pointless](https://scotthelme.co.uk/revocation-checking-is-pointless/) explains that a man-in-the-middle capable of swapping out certificates obviously is also capable of disallowing or redirecting revocation list downloads. Therefore, if these lists were locally available and updated through the normal system package management, there would be no additional reliance on yet another web service providing these. ## But the phone home features are part of the normal browser operation? There is way too much browser source code. Literally millions of lines. Has all the phone home code been thoroughly reviewed? Does the community have this ability? Even if someone had this capability, one would need to keep up with all the constantly ongoing changes. Tickets such as [user.js: Can't stop Firefox background connections](https://github.com/pyllyukko/user.js/issues/509) show how difficult it is to disable all browser phone home features. If the community even has trouble with that, why would one assume that the browser's phone home features are free of privacy and/or security issues? The safe choice is to disable these features by default. ## But this is anonymized data only? Please refer to the blog post [Commercial mass surveillance: The collected data can’t be kept anonymous, Organizations that collect data often claim it’s anonymous. Research shows this is impossible.](https://mullvad.net/en/why-privacy-matters/collected-data-cant-be-kept-anonymous). ## Open Source in Name Only Downloading a lot of blocklists, in my opinion, is only Open Source in name but not in spirit. Since the blocklists are in different repositories, there is no audit trail in the source code versioning system (git) to show which exact blocklist file was shipped with a particular browser version. Perhaps all the needed lists should be in a separate repository or package, which gets updated more frequently than the browser itself. Then everything would be in a reasonable number of places and not downloaded by each user from many different servers all the time. Lots of file downloads also complicate software forks as they would not only have to provide software but also host a lot of web services with all the different downloaded files. The ideal state would be if the browser was fully set up after initial installation, not requiring any additional background connections. ## The Principled Approach Even if one disregards all privacy and security arguments, a user may simply not want their browser to connect to GitHub, Microsoft, Cloudflare, or similar services upon startup. The question then arises: How difficult can it be to accommodate such a preference? ## Practical Implementation From a practical standpoint, implementing this feature would require bundling all necessary components for a basic startup with the browser itself. This approach ensures that the browser does not need to make external connections to retrieve essential resources during or immediately after installation. ## Centralization vs. Decentralization in Privacy The debate on whether to download filter lists from multiple sources encapsulates a larger conversation about centralization versus decentralization related to privacy. While decentralization offers the advantage of spreading trust among a variety of entities, it paradoxically introduces complexities into privacy management. Users find themselves in the challenging position of evaluating the credibility of numerous parties, each with their own privacy philosophies. In contrast, centralization through a transparent, unified entity with clearly defined privacy and value policies offers a more streamlined approach. A project like this one could serve as a trusted intermediary, aligning disparate privacy standards into a cohesive, dependable privacy framework. The introduction of a Radio Silence feature, designed to minimize unsolicited background communications, represents a significant step towards achieving a centralized privacy model. Distributing and updating filter lists through the browser vendor’s own software delivery mechanisms—rather than relying on third-party downloads—simplifies the process considerably. This approach necessitates securing and auditing only one updating mechanism: the system's package manager, thereby streamlining the security and trust model. ## Disclaimer These views are my personal opinions only. ## Conclusion The website [privacytests.org](https://privacytests.org) highlights a crucial issue: despite significant efforts invested in enhancing privacy features, browsers continue to expose users to centralized services upon each launch. The Radio Silence feature represents an attempt to address this concern by offering users greater control over their privacy. Its implementation poses challenges, yet it embodies an ambitious goal to elevate privacy standards in web browsing. ## Feasibility and Importance While the implementation of Radio Silence could be considered a daunting task, potentially verging on impractical, its significance cannot be understated for a browser committed to respecting user privacy. An honest acknowledgment of the feature's complexity, coupled with an invitation for community contributions ("Patches welcome"), might be a pragmatic approach to advancing this initiative. ## Question for Consideration Given the complexities and potential benefits, do you agree that pursuing the Radio Silence feature is a laudable goal for a browser dedicated to enhancing user privacy?

Cracked_Tessaract · January 8, 2025, 2:55am

Quick Tip:
If you cannot get your policies.json to load under Firefox-ESR, try going to “about:policies” and checking the “Errors” tab on the left. It should give you a line number to review for errors/typos/missing-commas.

rzg · August 24, 2025, 12:02am

Full-auto script to create a disposable custom firefox-esr based on debian-12-minimal template.

Arkenfox user.js with custom Firefox policies, improve it as you need:

Named disposable version:

debian-minimal-arkenfox-named-disposable.sh



#!/bin/bash

#######################################################################
# File Name    : debian-minimal-arkenfox-named-disposable.sh
# Description  : This script creates a named disposable Firefox ESR
#                qube based on Debian minimal template with hardened
#                user.js, policies and extensions.
# Dependencies : curl
# Usage        : • Transfer this script from appvm to dom0 with:
#                [user@dom0 ~]$ qvm-run --pass-io appvm 'cat ~/debian-minimal-arkenfox-named-disposable.sh' > ~/debian-minimal-arkenfox-named-disposable.sh
#                • Make the script executable with:
#                [user@dom0 ~]$ chmod +x ~/debian-minimal-arkenfox-named-disposable.sh
#                • Run the script with:
#                [user@dom0 ~]$ bash ~/debian-minimal-arkenfox-named-disposable.sh
# Author       : Me and the bois
# License      : Free of charge, no warranty
# Last edited  : 2025-09-02
#######################################################################

# Safety check
set -eu

# Configuration
BASE_TEMPLATE="debian-12-minimal"
CUSTOM_TEMPLATE="debian-arkenfox-template"
DISP_TEMPLATE="debian-arkenfox-dvm"
NAMED_DISP_VM="disp-arkenfox"
NET_VM="sys-firewall"
BROWSER_PKG="firefox-esr"

# Arkenfox user.js URL (ajust as you need)
USER_JS="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
# USER_JS="https://www.privacy-handbuch.de/download/moderat/user.js"

# Generate policies.json content (ajust as you need)
generate_policies_json() {
    cat < [href]\n",
            "selectedFilterLists": [
              "ublock-quick-fixes",
              "user-filters",
              "ublock-filters",
              "ublock-badware",
              "ublock-privacy",
              "ublock-abuse",
              "ublock-unbreak",
              "adguard-generic",
              "adguard-mobile",
              "easylist",
              "easyprivacy",
              "urlhaus-1",
              "adguard-annoyance",
              "fanboy-annoyance",
              "ublock-annoyances",
              "plowe-0",
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ]
          }
        }
      }
    },
    "FirefoxHome": {
      "Search": true,
      "TopSites": false,
      "SponsoredTopSites": false,
      "Highlights": false,
      "Pocket": false,
      "SponsoredPocket": false,
      "Snippets": false,
      "Locked": false
    },
    "HardwareAcceleration": false,
    "Homepage": {
      "URL": "about:home",
      "Locked": false,
      "StartPage": "homepage"
    },
    "SearchEngines": {
      "Add": [
        {
          "Name": "DuckDuckGo",
          "URLTemplate": "https://duckduckg.com/q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://duckduckgo.com.org/favicon.ico",
          "Alias": "duckduckgo",
          "Description": "Duck Duck Go",
          "SuggestURLTemplate": "https://duckduckg.com/q={searchTerms}"
        },
        {
          "Name": "Startpage",
          "URLTemplate": "https://www.startpage.com/sp/search?query={searchTerms}",
          "Method": "GET",
          "IconURL": "https://www.startpage.com/sp/cdn/favicons/favicon--dark.ico",
          "Alias": "@startpage",
          "Description": "Startpage",
          "SuggestURLTemplate": "https://www.startpage.com/sp/search?query={searchTerms}"
        },
        {
          "Name": "Random SearX",
          "URLTemplate": "https://searx.neocities.org/#?q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://searx.neocities.org/favicon.ico",
          "Alias": "searx",
          "Description": "Random SearX",
          "SuggestURLTemplate": "https://searx.neocities.org/#?q={searchTerms}"
        },
        {
          "Name": "SearX",
          "URLTemplate": "https://searx.be/search?q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://searx.be/favicon.ico",
          "Alias": "searxbe",
          "Description": "SearX",
          "SuggestURLTemplate": "https://searx.be/search?q={searchTerms}"
        },
        {
          "Name": "Brave",
          "URLTemplate": "https://.search.brave.com/search?q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://cdn.search.brave.com/serp/v1/static/brand/16c26cd189da3f0f7ba4e55a584ddde6a7853c9cc340ff9f381afc6cb18e9a1e-favicon-32x32.png",
          "Alias": "brave",
          "Description": "Brave Search",
          "SuggestURLTemplate": "https://.search.brave.com/search?q={searchTerms}"
        }
      ],
      "Remove": [
        "Amazon",
        "Bing",
        "Google",
        "Twitter",
        "Wikipedia",
        "Yahoo"
      ],
      "Default": "DuckDuckGo"
    }
  }
}
EOF
}

# Step 1: Install and update the Qubes Template
echo -e "\n[1/6] Checking for Qubes template..."
if ! qvm-check "$BASE_TEMPLATE" 2>/dev/null; then
    echo "Installing $BASE_TEMPLATE..."
    sudo qubes-dom0-update qubes-template-$BASE_TEMPLATE
fi

# Ensure template is shut down before updating
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Update the template whether it was just installed or already existed
echo "Updating $BASE_TEMPLATE..."
sudo qubesctl --show-output --skip-dom0 --targets=$BASE_TEMPLATE state.sls update.qubes-vm

# Ensure Qubes base template is shut down before create
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Step 2: Create custom base template
echo -e "\n[2/6] Creating custom template by cloning..."
qvm-clone "$BASE_TEMPLATE" "$CUSTOM_TEMPLATE"
qvm-prefs "$CUSTOM_TEMPLATE" label black

# Step 3: Install LibreWolf and dependencies
echo -e "\n[3/6] Installing LibreWolf and dependencies..."
qvm-run -p -u root "$CUSTOM_TEMPLATE" "echo 'TERM=xterm' >> /etc/environment"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "locale-gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    apt-get update && apt-get install -y --no-install-recommends \
    dialog \
    qubes-core-agent-networking \
    ca-certificates \
    pulseaudio-qubes \
    curl \
    zenity \
    thunar \
    qubes-core-agent-thunar \
    nautilus \
    qubes-core-agent-nautilus \
    xfce4-terminal \
    xfce4-notifyd \
    qubes-core-agent-passwordless-root \
    $BROWSER_PKG
"

# Shutdown template to apply changes
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 4: Configure Firefox in the custom template
echo -e "\n[4/7] Configuring Firefox..."

# Download user.js
echo "Downloading user.js..."
qvm-run -p "$CUSTOM_TEMPLATE" "curl --tlsv1.2 -x http://127.0.0.1:8082/ -L '$USER_JS' -o /tmp/user.js"

# Create directories
qvm-run -p -u root "$CUSTOM_TEMPLATE" "mkdir -p /usr/lib/firefox-esr/defaults/pref /usr/lib/firefox-esr/distribution"

# Create firefox.cfg
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// IMPORTANT: Start your code on the 2nd line' > /usr/lib/firefox-esr/firefox.cfg
    grep -E '^user_pref\(' /tmp/user.js | grep -v '^//' | sed 's/user_pref/pref/' >> /usr/lib/firefox-esr/firefox.cfg
"

# Create autoconfig.js
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// Enable autoconfig' > /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.filename\", \"firefox.cfg\");' >> /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.obscure_value\", 0);' >> /usr/lib/firefox-esr/defaults/pref/autoconfig.js
"

# Create policies.json with the full configuration
echo "Creating policies.json..."
generate_policies_json | qvm-run -p -u root "$CUSTOM_TEMPLATE" "cat > /usr/lib/firefox-esr/distribution/policies.json"

# Set permissions
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    chmod 644 /usr/lib/firefox-esr/firefox.cfg \
              /usr/lib/firefox-esr/defaults/pref/autoconfig.js \
              /usr/lib/firefox-esr/distribution/policies.json
"

# Finalize Firefox configuration
echo "Firefox configuration completed..."
qvm-run -p "$CUSTOM_TEMPLATE" "rm -f /tmp/user.js"
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 5: Create DVM template based on custom template
echo -e "\n[5/7] Creating DVM template..."
qvm-create --template "$CUSTOM_TEMPLATE" --label red "$DISP_TEMPLATE"
qvm-prefs "$DISP_TEMPLATE" template_for_dispvms True

# Step 6: Create named disposable VM instance
echo -e "\n[6/7] Creating named disposable VM instance..."
qvm-create --class DispVM --template "$DISP_TEMPLATE" --label red \
    --property netvm="$NET_VM" \
    --property include_in_backups=False \
    "$NAMED_DISP_VM"
qvm-features "$NAMED_DISP_VM" appmenus-dispvm 1

# Step 7: Configure menu items
echo -e "\n[7/7] Configuring menu items..."
qvm-features "$CUSTOM_TEMPLATE" menu-items "debian-xterm.desktop"
qvm-features "$NAMED_DISP_VM" menu-items "librewolf.desktop thunar.desktop"

# Finalize
echo -e "\nFinish!"

Regular disposable version:

debian-minimal-arkenfox-regular-disposable.sh



#!/bin/bash

#######################################################################
# File Name    : debian-minimal-arkenfox-regular-disposable.sh
# Description  : This script creates a regular disposable Firefox ESR
#                qube based on Debian minimal template with hardened
#                user.js, policies and extensions.
# Dependencies : curl
# Usage        : • Transfer this script from appvm to dom0 with:
#                [user@dom0 ~]$ qvm-run --pass-io appvm 'cat ~/debian-minimal-arkenfox-regular-disposable.sh' > ~/debian-minimal-arkenfox-regular-disposable.sh
#                • Make the script executable with:
#                [user@dom0 ~]$ chmod +x ~/debian-minimal-arkenfox-regular-disposable.sh
#                • Run the script with:
#                [user@dom0 ~]$ bash ~/debian-minimal-arkenfox-regular-disposable.sh
# Author       : Me and the bois
# License      : Free of charge, no warranty
# Last edited  : 2025-09-02
#######################################################################

# Safety check
set -eu

# Configuration
BASE_TEMPLATE="debian-12-minimal"
CUSTOM_TEMPLATE="debian-arkenfox-template"
DVM_TEMPLATE="debian-arkenfox-dvm"
NET_VM="sys-firewall"
BROWSER_PKG="firefox-esr"

# Arkenfox user.js URL (ajust as you need)
USER_JS="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
# USER_JS="https://www.privacy-handbuch.de/download/moderat/user.js"

# Generate policies.json content (ajust as you need)
generate_policies_json() {
    cat < [href]\n",
            "selectedFilterLists": [
              "ublock-quick-fixes",
              "user-filters",
              "ublock-filters",
              "ublock-badware",
              "ublock-privacy",
              "ublock-abuse",
              "ublock-unbreak",
              "adguard-generic",
              "adguard-mobile",
              "easylist",
              "easyprivacy",
              "urlhaus-1",
              "adguard-annoyance",
              "fanboy-annoyance",
              "ublock-annoyances",
              "plowe-0",
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ]
          }
        }
      }
    },
    "FirefoxHome": {
      "Search": true,
      "TopSites": false,
      "SponsoredTopSites": false,
      "Highlights": false,
      "Pocket": false,
      "SponsoredPocket": false,
      "Snippets": false,
      "Locked": false
    },
    "HardwareAcceleration": false,
    "Homepage": {
      "URL": "about:home",
      "Locked": false,
      "StartPage": "homepage"
    },
    "SearchEngines": {
      "Add": [
        {
          "Name": "DuckDuckGo",
          "URLTemplate": "https://duckduckg.com/q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://duckduckgo.com.org/favicon.ico",
          "Alias": "duckduckgo",
          "Description": "Duck Duck Go",
          "SuggestURLTemplate": "https://duckduckg.com/q={searchTerms}"
        },
        {
          "Name": "Startpage",
          "URLTemplate": "https://www.startpage.com/sp/search?query={searchTerms}",
          "Method": "GET",
          "IconURL": "https://www.startpage.com/sp/cdn/favicons/favicon--dark.ico",
          "Alias": "@startpage",
          "Description": "Startpage",
          "SuggestURLTemplate": "https://www.startpage.com/sp/search?query={searchTerms}"
        },
        {
          "Name": "Random SearX",
          "URLTemplate": "https://searx.neocities.org/#?q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://searx.neocities.org/favicon.ico",
          "Alias": "searx",
          "Description": "Random SearX",
          "SuggestURLTemplate": "https://searx.neocities.org/#?q={searchTerms}"
        },
        {
          "Name": "SearX",
          "URLTemplate": "https://searx.be/search?q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://searx.be/favicon.ico",
          "Alias": "searxbe",
          "Description": "SearX",
          "SuggestURLTemplate": "https://searx.be/search?q={searchTerms}"
        },
        {
          "Name": "Brave",
          "URLTemplate": "https://.search.brave.com/search?q={searchTerms}",
          "Method": "GET",
          "IconURL": "https://cdn.search.brave.com/serp/v1/static/brand/16c26cd189da3f0f7ba4e55a584ddde6a7853c9cc340ff9f381afc6cb18e9a1e-favicon-32x32.png",
          "Alias": "brave",
          "Description": "Brave Search",
          "SuggestURLTemplate": "https://.search.brave.com/search?q={searchTerms}"
        }
      ],
      "Remove": [
        "Amazon",
        "Bing",
        "Google",
        "Twitter",
        "Wikipedia",
        "Yahoo"
      ],
      "Default": "DuckDuckGo"
    }
  }
}
EOF
}

# Step 1: Install and update the Qubes Template
echo -e "\n[1/7] Checking for Qubes template..."
if ! qvm-check "$BASE_TEMPLATE" 2>/dev/null; then
    echo "Installing $BASE_TEMPLATE..."
    sudo qubes-dom0-update qubes-template-$BASE_TEMPLATE
fi

# Ensure template is shut down before updating
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Update the template whether it was just installed or already existed
echo "Updating $BASE_TEMPLATE..."
sudo qubesctl --show-output --skip-dom0 --targets=$BASE_TEMPLATE state.sls update.qubes-vm

# Ensure Qubes base template is shut down before create
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Step 2: Create custom base template
echo -e "\n[2/7] Creating custom template by cloning..."
qvm-clone "$BASE_TEMPLATE" "$CUSTOM_TEMPLATE"
qvm-prefs "$CUSTOM_TEMPLATE" label black

# Step 3: Install template dependencies
echo -e "\n[3/7] Installing template dependencies..."
qvm-run -p -u root "$CUSTOM_TEMPLATE" "echo 'TERM=xterm' >> /etc/environment"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "locale-gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    apt-get update && apt-get install -y --no-install-recommends \
    dialog \
    qubes-core-agent-networking \
    ca-certificates \
    pulseaudio-qubes \
    curl \
    zenity \
    thunar \
    qubes-core-agent-thunar \
    nautilus \
    qubes-core-agent-nautilus \
    xfce4-terminal \
    xfce4-notifyd \
    qubes-core-agent-passwordless-root \
    $BROWSER_PKG
"

# Shutdown template to apply changes
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 4: Configure Firefox in the custom template
echo -e "\n[4/7] Configuring Firefox..."

# Download user.js
echo "Downloading user.js..."
qvm-run -p "$CUSTOM_TEMPLATE" "curl --tlsv1.2 -x http://127.0.0.1:8082/ -L '$USER_JS' -o /tmp/user.js"

# Create directories
qvm-run -p -u root "$CUSTOM_TEMPLATE" "mkdir -p /usr/lib/firefox-esr/defaults/pref /usr/lib/firefox-esr/distribution"

# Create firefox.cfg
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// IMPORTANT: Start your code on the 2nd line' > /usr/lib/firefox-esr/firefox.cfg
    grep -E '^user_pref\(' /tmp/user.js | grep -v '^//' | sed 's/user_pref/pref/' >> /usr/lib/firefox-esr/firefox.cfg
"

# Create autoconfig.js
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// Enable autoconfig' > /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.filename\", \"firefox.cfg\");' >> /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.obscure_value\", 0);' >> /usr/lib/firefox-esr/defaults/pref/autoconfig.js
"

# Create policies.json with the full configuration
echo "Creating policies.json..."
generate_policies_json | qvm-run -p -u root "$CUSTOM_TEMPLATE" "cat > /usr/lib/firefox-esr/distribution/policies.json"

# Set permissions
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    chmod 644 /usr/lib/firefox-esr/firefox.cfg \
              /usr/lib/firefox-esr/defaults/pref/autoconfig.js \
              /usr/lib/firefox-esr/distribution/policies.json
"

# Finalize Firefox configuration
echo "Firefox configuration completed..."
qvm-run -p "$CUSTOM_TEMPLATE" "rm -f /tmp/user.js"
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 5: Create DVM template based on custom template
echo -e "\n[5/7] Creating DVM template..."
qvm-create --template "$CUSTOM_TEMPLATE" --label red \
    --property netvm="$NET_VM" \
    --property include_in_backups=False \
    "$DVM_TEMPLATE"
qvm-prefs "$DVM_TEMPLATE" template_for_dispvms True

# Step 6: Create regular disposable VM instance
echo -e "\n[6/7] Creating regular disposable VM instance..."
qvm-features "$DVM_TEMPLATE" appmenus-dispvm 1

# Step 7: Configure menu items
echo -e "\n[7/7] Configuring menu items..."
qvm-features "$CUSTOM_TEMPLATE" menu-items "debian-xterm.desktop"
qvm-features "$DVM_TEMPLATE" menu-items "firefox-esr.desktop thunar.desktop"

# Finalize
echo -e "\nFinish!"

Librewolf disposable based on debian-12-minimal template:

Named disposable version:

debian-minimal-librewolf-named-disposable.sh



#!/bin/bash

#######################################################################
# File Name    : debian-minimal-librewolf-named-disposable.sh
# Description  : This script creates a named disposable LibreWolf qube
#                based on Debian minimal template. LibreWolf already
#                includes hardened settings and extensions.
# Dependencies : curl
# Usage        : • Transfer this script from appvm to dom0 with:
#                [user@dom0 ~]$ qvm-run --pass-io appvm 'cat ~/debian-minimal-librewolf-named-disposable.sh' > ~/debian-minimal-librewolf-named-disposable.sh
#                • Make the script executable with:
#                [user@dom0 ~]$ chmod +x ~/debian-minimal-librewolf-named-disposable.sh
#                • Run the script with:
#                [user@dom0 ~]$ bash ~/debian-minimal-librewolf-named-disposable.sh
# Author       : Me and the bois
# License      : Free of charge, no warranty
# Last edited  : 2025-09-02
#######################################################################

# Safety check
set -eu

# Configuration
BASE_TEMPLATE="debian-12-minimal"
CUSTOM_TEMPLATE="debian-librewolf-template"
DISP_TEMPLATE="debian-librewolf-dvm"
NAMED_DISP_VM="disp-librewolf"
NET_VM="sys-firewall"
BROWSER_PKG="librewolf"

# Step 1: Install and update the Qubes Template
echo -e "\n[1/6] Checking for Qubes template..."
if ! qvm-check "$BASE_TEMPLATE" 2>/dev/null; then
    echo "Installing $BASE_TEMPLATE..."
    sudo qubes-dom0-update qubes-template-$BASE_TEMPLATE
fi

# Ensure template is shut down before updating
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Update the template whether it was just installed or already existed
echo "Updating $BASE_TEMPLATE..."
sudo qubesctl --show-output --skip-dom0 --targets=$BASE_TEMPLATE state.sls update.qubes-vm

# Ensure Qubes base template is shut down before create
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Step 2: Create custom base template
echo -e "\n[2/6] Creating custom template by cloning..."
qvm-clone "$BASE_TEMPLATE" "$CUSTOM_TEMPLATE"
qvm-prefs "$CUSTOM_TEMPLATE" label black

# Step 3: Install LibreWolf and dependencies
echo -e "\n[3/6] Installing LibreWolf and dependencies..."
qvm-run -p -u root "$CUSTOM_TEMPLATE" "echo 'TERM=xterm' >> /etc/environment"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "locale-gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    # Set up proxy for network access in custom template
    export http_proxy=http://127.0.0.1:8082
    export https_proxy=http://127.0.0.1:8082

    # Install required packages
    apt-get update && apt-get install -y --no-install-recommends \
        curl \
        dialog \
        gnupg \
        ca-certificates \
        qubes-core-agent-networking \
        pulseaudio-qubes \
        thunar \
        qubes-core-agent-thunar \
        zenity \
        nautilus \
        qubes-core-agent-nautilus \
        xfce4-terminal \
        xfce4-notifyd \
        qubes-core-agent-passwordless-root

    # Install extrepo and enable LibreWolf repository
    apt-get install -y extrepo
    extrepo enable librewolf

    # Update and install LibreWolf
    apt-get update
    apt-get install -y $BROWSER_PKG
"

# Shutdown custom template to apply changes
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 4: Create DVM template based on custom template
echo -e "\n[4/6] Creating DVM template..."
qvm-create --template "$CUSTOM_TEMPLATE" --label red "$DISP_TEMPLATE"
qvm-prefs "$DISP_TEMPLATE" template_for_dispvms True

# Step 5: Create named diposable VM instance
echo -e "\n[5/6] Creating named disposable VM instance..."
qvm-create --class DispVM --template "$DISP_TEMPLATE" --label red \
    --property netvm="$NET_VM" \
    --property include_in_backups=False \
    "$NAMED_DISP_VM"
qvm-features "$NAMED_DISP_VM" appmenus-dispvm 1

# Step 6: Configure menu items
echo -e "\n[6/6] Configuring menu items..."
qvm-features "$CUSTOM_TEMPLATE" menu-items "debian-xterm.desktop"
qvm-features "$NAMED_DISP_VM" menu-items "librewolf.desktop thunar.desktop"

# Finalize
echo -e "\nFinish!"

Regular disposable version:

debian-minimal-librewolf-regular-disposable.sh



#!/bin/bash

#######################################################################
# File Name    : debian-minimal-librewolf-regular-disposable.sh
# Description  : This script creates a regular disposable LibreWolf qube
#                based on Debian minimal template. LibreWolf already
#                includes hardened settings and extensions.
# Dependencies : curl
# Usage        : • Transfer this script from appvm to dom0 with:
#                [user@dom0 ~]$ qvm-run --pass-io appvm 'cat ~/debian-minimal-librewolf-regular-disposable.sh' > ~/debian-minimal-librewolf-regular-disposable.sh
#                • Make the script executable with:
#                [user@dom0 ~]$ chmod +x ~/debian-minimal-librewolf-regular-disposable.sh
#                • Run the script with:
#                [user@dom0 ~]$ bash ~/debian-minimal-librewolf-regular-disposable.sh
# Author       : Me and the bois
# License      : Free of charge, no warranty
# Last edited  : 2025-09-02
#######################################################################

# Safety check
set -eu

# Configuration
BASE_TEMPLATE="debian-12-minimal"
CUSTOM_TEMPLATE="debian-librewolf-template"
DVM_TEMPLATE="debian-librewolf-dvm"
NET_VM="sys-firewall"
BROWSER_PKG="librewolf"

# Step 1: Install and update the Qubes Template
echo -e "\n[1/6] Checking for Qubes template..."
if ! qvm-check "$BASE_TEMPLATE" 2>/dev/null; then
    echo "Installing $BASE_TEMPLATE..."
    sudo qubes-dom0-update qubes-template-$BASE_TEMPLATE
fi

# Ensure template is shut down before updating
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Update the template whether it was just installed or already existed
echo "Updating $BASE_TEMPLATE..."
sudo qubesctl --show-output --skip-dom0 --targets=$BASE_TEMPLATE state.sls update.qubes-vm

# Ensure Qubes base template is shut down before create
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Step 2: Create custom base template
echo -e "\n[2/6] Creating custom template by cloning..."
qvm-clone "$BASE_TEMPLATE" "$CUSTOM_TEMPLATE"
qvm-prefs "$CUSTOM_TEMPLATE" label black

# Step 3: Install template dependencies
echo -e "\n[3/6] Installing template dependencies..."
qvm-run -p -u root "$CUSTOM_TEMPLATE" "echo 'TERM=xterm' >> /etc/environment"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "locale-gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    # Set up proxy for network access in custom template
    export http_proxy=http://127.0.0.1:8082
    export https_proxy=http://127.0.0.1:8082

    # Install required packages
    apt-get update && apt-get install -y --no-install-recommends \
        curl \
        dialog \
        gnupg \
        ca-certificates \
        qubes-core-agent-networking \
        pulseaudio-qubes \
        thunar \
        qubes-core-agent-thunar \
        zenity \
        nautilus \
        qubes-core-agent-nautilus \
        xfce4-terminal \
        xfce4-notifyd \
        qubes-core-agent-passwordless-root

    # Install extrepo and enable LibreWolf repository
    apt-get install -y extrepo
    extrepo enable librewolf

    # Update and install LibreWolf
    apt-get update
    apt-get install -y $BROWSER_PKG
"

# Shutdown custom template to apply changes
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 4: Create DVM template based on custom template
echo -e "\n[4/6] Creating DVM template..."
qvm-create --template "$CUSTOM_TEMPLATE" --label red \
    --property netvm="$NET_VM" \
    --property include_in_backups=False \
    "$DVM_TEMPLATE"
qvm-prefs "$DVM_TEMPLATE" template_for_dispvms True

# Step 5: Create regular disposable VM instance
echo -e "\n[5/6] Creating regular disposable VM instance..."
qvm-features "$DVM_TEMPLATE" appmenus-dispvm 1

# Step 6: Configure menu items
echo -e "\n[6/6] Configuring menu items..."
qvm-features "$CUSTOM_TEMPLATE" menu-items "debian-xterm.desktop"
qvm-features "$DVM_TEMPLATE" menu-items "librewolf.desktop thunar.desktop"

# Finalize
echo -e "\nFinish!"

At the end of the day, we need to use Dildofox browser. Looks like its more suitable for girls, but is DoD approved.

arkenoi · August 26, 2025, 3:56pm

Still no solution to splash screen problem?

rzg · August 31, 2025, 6:09pm

Relevant point for this topic and for those who don’t want to be on the watch list for using Linux:

Also in case of a web browsing qube restricted to a list of websites:

About “extrepo” and “https_proxy=http://localhost:8082” when installing Librewolf. Proxy with static port is considered risky.

rzg · October 30, 2025, 11:22pm

I can't do more changes in this post, I'm doing an update here.

TLDR

Use Tor Browser for anonymity and advanced fingerprinting protection. See here:
What about privacy in non-Whonix qubes? - Qubes Documentation
If both user.js and policies.json are present, user.js configurations typically take precedence. See here:
Definitive answer to settings precedence? #1015 - Mozilla Firefox (GitHub).

Full-auto script to create a disposable custom firefox-esr based on debian-12-minimal template with Arkenfox user.js and custom Firefox policies, change it as you need:

Named disposable version:

debian-minimal-arkenfox-named-disposable.sh


#!/bin/bash

#######################################################################
# File Name    : debian-minimal-arkenfox-named-disposable.sh
# Description  : This script creates a named disposable Firefox ESR
#                qube based on Debian minimal template with hardened
#                user.js, policies and extensions.
# Dependencies : curl
# Usage        : • Transfer this script from appvm to dom0 with:
#                [user@dom0 ~]$ qvm-run --pass-io appvm 'cat ~/debian-minimal-arkenfox-named-disposable.sh' > ~/debian-minimal-arkenfox-named-disposable.sh
#                • Make the script executable with:
#                [user@dom0 ~]$ chmod +x ~/debian-minimal-arkenfox-named-disposable.sh
#                • Run the script with:
#                [user@dom0 ~]$ bash ~/debian-minimal-arkenfox-named-disposable.sh
# Author       : Me and the bois
# License      : Free of charge, no warranty
# Last edited  : 2025-11-08
#######################################################################

# Safety check
set -eu

# Configuration
BASE_TEMPLATE="debian-12-minimal"
CUSTOM_TEMPLATE="debian-arkenfox-template"
DISP_TEMPLATE="debian-arkenfox-template-dvm"
NAMED_DISP_VM="disp-arkenfox"
NET_VM="sys-firewall"
BROWSER_PKG="firefox-esr"

# Arkenfox user.js URL (ajust as you need)
USER_JS="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
# USER_JS="https://www.privacy-handbuch.de/download/moderat/user.js"

# Generate policies.json content (ajust as you need)
generate_policies_json() {
    cat <<'EOF'
{
  "policies":{
    "SSLVersionMin":"tls1.2",
    "EnableTrackingProtection":{
      "Value":true,
      "Locked":true,
      "Cryptomining":true,
      "Fingerprinting":true
    },
    "Cookies":{
      "AcceptThirdParty":"never",
      "Behavior":"reject-tracker-and-partition-foreign",
      "BehaviorPrivateBrowsing":"reject-tracker-and-partition-foreign",
      "Locked":false
    },
    "DisabledCiphers":{
      "TLS_RSA_WITH_3DES_EDE_CBC_SHA":true
    },
    "Bookmarks":[
      {
        "Title":"Qubes OS forum",
        "URL":"https://forum.qubes-os.org/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Qubes OS Documentation",
        "URL":"https://doc.qubes-os.org/en/latest/index.html",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Wired",
        "URL":"https://www.wired.com/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"EFF",
        "URL":"https://www.eff.org/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Internet Archive",
        "URL":"https://www.archive.org/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Invidious",
        "URL":"https://docs.invidious.io/instances/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Odysee",
        "URL":"https://odysee.com/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"DNSLeakTest",
        "URL":"https://dnsleaktest.com/",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Utilities"
      },
      {
        "Title":"BrowserLeaks",
        "URL":"https://browserleaks.com",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Utilities"
      },
      {
        "Title":"LibreTranslate",
        "URL":"https://libretranslate.com/",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Translators"
      },
      {
        "Title":"DeepL",
        "URL":"https://www.deepl.com/en/translator",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Translators"
      },
      {
        "Title":"dict.cc",
        "URL":"https://www.dict.cc",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Translators"
      }
    ],
    "AppAutoUpdate":false,
    "BackgroundAppUpdate":false,
    "CaptivePortal":false,
    "DefaultDownloadDirectory":"${home}/Downloads",
    "DisableAppUpdate":true,
    "DisableDeveloperTools":false,
    "DisableEncryptedClientHello":false,
    "DisableFeedbackCommands":true,
    "DisableFirefoxAccounts":true,
    "DisableFirefoxScreenshots":false,
    "DisableFirefoxStudies":true,
    "DisableForgetButton":true,
    "DisableFormHistory":true,
    "DisableMasterPasswordCreation":true,
    "DisablePasswordReveal":true,
    "DisablePocket":true,
    "DisablePrivateBrowsing":true,
    "DisableProfileImport":false,
    "DisableProfileRefresh":true,
    "DisableSetDesktopBackground":true,
    "DisableSystemAddonUpdate":true,
    "DisableTelemetry":true,
    "DisplayBookmarksToolbar":"newtab",
    "DisplayMenuBar":"default-off",
    "DontCheckDefaultBrowser":true,
    "DownloadDirectory":"${home}/Downloads",
    "ExtensionUpdate":true,
    "NetworkPrediction":false,
    "NoDefaultBookmarks":true,
    "OfferToSaveLogins":false,
    "OverrideFirstRunPage":"",
    "OverridePostUpdatePage":"",
    "PasswordManagerEnabled":false,
    "PrintingEnabled":false,
    "PromptForDownloadLocation":false,
    "RequestedLocales":"en-US",
    "SearchSuggestEnabled":false,
    "ShowHomeButton":true,
    "SkipTermsOfUse":true,
    "TranslateEnabled":false,
    "UseSystemPrintDialog":false,
    "PDFjs":{
      "Enabled":false,
      "EnablePermissions":false
    },
    "PictureInPicture":{
      "Enabled":false,
      "Locked":false
    },
    "FirefoxSuggest":{
      "WebSuggestions":false,
      "SponsoredSuggestions":false,
      "ImproveSuggest":false,
      "Locked":false
    },
    "DNSOverHTTPS":{
      "Enabled":false,
      "Locked":true
    },
    "UserMessaging":{
      "ExtensionRecommendations":false,
      "FeatureRecommendations":false,
      "UrlbarInterventions":false,
      "SkipOnboarding":false,
      "MoreFromMozilla":false,
      "FirefoxLabs": false,
      "Locked":false
    },
    "Permissions":{
      "Location":{
        "BlockNewRequests":true
      },
      "Camera":{
        "BlockNewRequests":true
      },
      "Microphone":{
        "BlockNewRequests":true
      },
      "EncryptedMediaExtensions":{
        "Enabled":false,
        "Locked":true
      }
    },
    "ExtensionSettings":{
      "uBlock0@raymondhill.net":{
        "installation_mode":"force_installed",
        "install_url":"https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
      },
      "{73a6fe31-595d-460b-a920-fcc0f8843232}":{
        "installation_mode":"force_installed",
        "install_url":"https://addons.mozilla.org/firefox/downloads/latest/noscript/latest.xpi"
      }
    },
    "3rdparty":{
      "Extensions":{
        "uBlock0@raymondhill.net":{
          "adminSettings":{
            "advancedSettings":[
              [
                "disableWebAssembly",
                "true"
              ]
            ],
            "advancedUserEnabled":"true",
            "externalLists":[
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ],
            "importedLists":[
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ],
            "dynamicFilteringEnabled":"true",
            "dynamicFilteringString":"* google-analytics.com * block\n* googletagmanager.com * block\n* * 3p-script block*\n* * 3p-frame block",
            "popupPanelSections":"31",
            "hostnameSwitchesString":"no-large-media: behind-the-scene false\nno-csp-reports: * true",
            "userFilters":"! fonts\n!*$font,third-party\n!*$font,third-party,domain=~example.com|~example2.net\n\n! all stackoverflow annoying consent banners\n##.js-consent-banner\n\n! some annoying banners\n##.banner > [href]\n",
            "selectedFilterLists":[
              "ublock-quick-fixes",
              "user-filters",
              "ublock-filters",
              "ublock-badware",
              "ublock-privacy",
              "ublock-abuse",
              "ublock-unbreak",
              "adguard-generic",
              "adguard-mobile",
              "easylist",
              "easyprivacy",
              "urlhaus-1",
              "adguard-annoyance",
              "fanboy-annoyance",
              "ublock-annoyances",
              "plowe-0",
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ]
          }
        }
      }
    },
    "FirefoxHome":{
      "Highlights":false,
      "Pocket":false,
      "Search":false,
      "Snippets":false,
      "SponsoredPocket":false,
      "SponsoredStories":false,
      "SponsoredTopSites":false,
      "Stories":false,
      "TopSites":false,
      "Locked":true
    },
    "GenerativeAI": {
      "Enabled":false,
      "Chatbot":false,
      "LinkPreviews":false,
      "TabGroups":false,
      "Locked":false
    },
    "HardwareAcceleration":false,
    "Homepage":{
      "URL":"about:blank",
      "Locked":false,
      "StartPage":"none"
    },
    "SearchEngines":{
      "Add":[
        {
          "Name": "DuckDuckGo Lite",
          "Alias": "@duckduckgo",
          "Method": "POST",
          "URLTemplate": "https://start.duckduckgo.com/lite/?q={searchTerms}",
          "PostData": "q={searchTerms}",
          "IconURL": ""
        },
        {
          "Name":"DuckDuckGo Custom",
          "Alias":"@custom",
          "Method": "POST",
          "URLTemplate":"https://duckduckgo.com/?q={searchTerms}&kl=wt-wt&kp=-2&kg=p&k5=1&kae=d&ks=l&k1=-1",
          "PostData": "q={searchTerms}",
          "IconURL":""
        },
        {
          "Name":"SearXNG - searx.be",
          "Alias":"@searx",
          "Method":"POST",
          "URLTemplate":"https://searx.be/?q={searchTerms}",
          "PostData": "q={searchTerms}&category_general=on",
          "IconURL":""
        },
        {
          "Name":"Qwant",
          "Alias":"@qwant",
          "Method":"GET",
          "URLTemplate":"https://www.qwant.com/?q={searchTerms}",
          "IconURL":""
        },
        {
          "Name": "MetaGer",
          "Alias": "@metager",
          "Method": "GET",
          "URLTemplate": "https://metager.org/meta/meta.ger3?eingabe={searchTerms}",
          "IconURL": ""
        },
        {
          "Name": "Mojeek",
          "Alias": "@mojeek",
          "Method": "GET",
          "URLTemplate": "https://www.mojeek.com/search?q={searchTerms}",
          "IconURL": ""
        },
        {
          "Name":"Startpage",
          "Alias":"@startpage",
          "URLTemplate":"https://www.startpage.com/sp/search?query={searchTerms}",
          "Method":"GET",
          "IconURL":""
        },
        {
          "Name":"Brave Search",
          "Alias":"@brave",
          "Method":"GET",
          "URLTemplate":"https://search.brave.com/search?q={searchTerms}",
          "IconURL":""
        },
        {
          "Name":"LibreTranslate",
          "Alias":"@libre",
          "Method":"GET",
          "URLTemplate":"https://libretranslate.com/?source=de&target=en&q={searchTerms}",
          "IconURL":""
        },
        {
          "Name":"DeepL",
          "Alias":"@deepl",
          "Method":"GET",
          "URLTemplate":"https://deepl.com/en/translator#de/en/{searchTerms}",
          "IconURL":""
        },
        {
          "Name":"dict.cc",
          "Alias":"@dict",
          "Method":"GET",
          "URLTemplate":"https://www.dict.cc/?s={searchTerms}",
          "IconURL":""
        }
      ],
      "Remove":[
        "Google",
        "Bing",
        "Amazon.com",
        "eBay",
        "Ecosia",
        "Twitter",
        "Wikipedia"
      ],
      "Default":"DuckDuckGo"
    },
    "Preferences":{
      "dom.disable_window_flip":{
        "Value":true,
        "Status":"user"
      },
      "dom.disable_window_move_resize":{
        "Value":true,
        "Status":"user"
      },
      "extensions.htmlaboutaddons.recommendations.enabled":{
        "Value":false,
        "Status":"user"
      },
      "security.default_personal_cert":{
        "Value":"Ask Every Time",
        "Status":"user"
      },
      "browser.contentblocking.category":{
        "Value":"strict",
        "Status":"user"
      },
      "browser.search.update":{
        "Value":false,
        "Status":"user"
      },
      "accessibility.force_disabled":{
        "Value":1,
        "Status":"user"
      },
      "browser.tabs.warnOnClose":{
        "Value":false,
        "Status":"user"
      },
      "ui.systemUsesDarkTheme":{
        "Value":1,
        "Status":"user"
      },
      "extensions.activeThemeID":{
        "Value":"firefox-compact-dark@mozilla.org",
        "Status":"user"
      },
      "browser.theme.dark-private-windows":{
        "Value":true,
        "Status":"user"
      },
      "layout.css.light-dark.enabled":{
        "Value":true,
        "Status":"user"
      },
      "widget.non-native-theme.scrollbar.dark-themed":{
        "Value":true,
        "Status":"user"
      },
      "browser.in-content.dark-mode":{
        "Value":true,
        "Status":"user"
      },
      "widget.disable-dark-scrollbar":{
        "Value":false,
        "Status":"user"
      },
      "browser.theme.dark-toolbar-theme":{
        "Value":true,
        "Status":"user"
      },
      "browser.theme.toolbar-theme":{
        "Value":1,
        "Status":"user"
      }
    }
  }
}
EOF
}

# Step 1: Install and update the Qubes Template
echo -e "\n[1/6] Checking for Qubes template..."
if ! qvm-check "$BASE_TEMPLATE" 2>/dev/null; then
    echo "Installing $BASE_TEMPLATE..."
    sudo qubes-dom0-update qubes-template-$BASE_TEMPLATE
fi

# Ensure template is shut down before updating
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Update the template whether it was just installed or already existed
echo "Updating $BASE_TEMPLATE..."
sudo qubesctl --show-output --skip-dom0 --targets=$BASE_TEMPLATE state.sls update.qubes-vm

# Ensure Qubes base template is shut down before create
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Step 2: Create custom base template
echo -e "\n[2/6] Creating custom template by cloning..."
qvm-clone "$BASE_TEMPLATE" "$CUSTOM_TEMPLATE"
qvm-prefs "$CUSTOM_TEMPLATE" label black

# Step 3: Install dependencies
echo -e "\n[3/6] Installing dependencies..."
qvm-run -p -u root "$CUSTOM_TEMPLATE" "echo 'TERM=xterm' >> /etc/environment"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "locale-gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    apt-get update && apt-get install -y --no-install-recommends \
    dialog \
    qubes-core-agent-networking \
    ca-certificates \
    pulseaudio-qubes \
    curl \
    thunar \
    qubes-core-agent-thunar \
    xfce4-terminal \
    qubes-core-agent-passwordless-root \
    $BROWSER_PKG
"

# Shutdown template to apply changes
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 4: Configure Firefox in the custom template
echo -e "\n[4/7] Configuring Firefox..."

# Download user.js
echo "Downloading user.js..."
qvm-run -p "$CUSTOM_TEMPLATE" "curl --tlsv1.2 -x http://127.0.0.1:8082/ -L '$USER_JS' -o /tmp/user.js"

# Create directories
qvm-run -p -u root "$CUSTOM_TEMPLATE" "mkdir -p /usr/lib/firefox-esr/defaults/pref /usr/lib/firefox-esr/distribution"

# Create firefox.cfg
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// IMPORTANT: Start your code on the 2nd line' > /usr/lib/firefox-esr/firefox.cfg
    grep -E '^user_pref\(' /tmp/user.js | grep -v '^//' | sed 's/user_pref/pref/' >> /usr/lib/firefox-esr/firefox.cfg
"

# Create autoconfig.js
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// Enable autoconfig' > /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.filename\", \"firefox.cfg\");' >> /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.obscure_value\", 0);' >> /usr/lib/firefox-esr/defaults/pref/autoconfig.js
"

# Create policies.json with the full configuration
echo "Creating policies.json..."
generate_policies_json | qvm-run -p -u root "$CUSTOM_TEMPLATE" "cat > /usr/lib/firefox-esr/distribution/policies.json"

# Set permissions
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    chmod 644 /usr/lib/firefox-esr/firefox.cfg \
              /usr/lib/firefox-esr/defaults/pref/autoconfig.js \
              /usr/lib/firefox-esr/distribution/policies.json
"

# Finalize Firefox configuration
echo "Firefox configuration completed..."
qvm-run -p "$CUSTOM_TEMPLATE" "rm -f /tmp/user.js"
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 5: Create DVM template based on custom template
echo -e "\n[5/7] Creating DVM template..."
qvm-create --template "$CUSTOM_TEMPLATE" --label red "$DISP_TEMPLATE"
qvm-prefs "$DISP_TEMPLATE" template_for_dispvms True

# Step 6: Create named disposable VM instance
echo -e "\n[6/7] Creating named disposable VM instance..."
qvm-create --class DispVM --template "$DISP_TEMPLATE" --label red \
    --property netvm="$NET_VM" \
    --property include_in_backups=False \
    "$NAMED_DISP_VM"
qvm-features "$NAMED_DISP_VM" appmenus-dispvm 1

# Step 7: Configure menu items
echo -e "\n[7/7] Configuring menu items..."
qvm-features "$CUSTOM_TEMPLATE" menu-items "debian-xterm.desktop xfce4-terminal.desktop"
qvm-features "$NAMED_DISP_VM" menu-items "firefox-esr.desktop thunar.desktop xfce4-terminal.desktop"

# Finalize
echo -e "\nFinish!"

debian-minimal-arkenfox-named-disposable.sh.log (17.5 KB)

Regular disposable version:

debian-minimal-arkenfox-regular-disposable.sh


#!/bin/bash

#######################################################################
# File Name    : debian-minimal-arkenfox-regular-disposable.sh
# Description  : This script creates a regular disposable Firefox ESR
#                qube based on Debian minimal template with hardened
#                user.js, policies and extensions.
# Dependencies : curl
# Usage        : • Transfer this script from appvm to dom0 with:
#                [user@dom0 ~]$ qvm-run --pass-io appvm 'cat ~/debian-minimal-arkenfox-regular-disposable.sh' > ~/debian-minimal-arkenfox-regular-disposable.sh
#                • Make the script executable with:
#                [user@dom0 ~]$ chmod +x ~/debian-minimal-arkenfox-regular-disposable.sh
#                • Run the script with:
#                [user@dom0 ~]$ bash ~/debian-minimal-arkenfox-regular-disposable.sh
# Author       : Me and the bois
# License      : Free of charge, no warranty
# Last edited  : 2025-11-08
#######################################################################

# Safety check
set -eu

# Configuration
BASE_TEMPLATE="debian-12-minimal"
CUSTOM_TEMPLATE="debian-arkenfox-template"
DVM_TEMPLATE="debian-arkenfox-dvm"
NET_VM="sys-firewall"
BROWSER_PKG="firefox-esr"

# Arkenfox user.js URL (ajust as you need)
USER_JS="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
# USER_JS="https://www.privacy-handbuch.de/download/moderat/user.js"

# Generate policies.json content (ajust as you need)
generate_policies_json() {
    cat <<'EOF'
{
  "policies":{
    "SSLVersionMin":"tls1.2",
    "EnableTrackingProtection":{
      "Value":true,
      "Locked":true,
      "Cryptomining":true,
      "Fingerprinting":true
    },
    "Cookies":{
      "AcceptThirdParty":"never",
      "Behavior":"reject-tracker-and-partition-foreign",
      "BehaviorPrivateBrowsing":"reject-tracker-and-partition-foreign",
      "Locked":false
    },
    "DisabledCiphers":{
      "TLS_RSA_WITH_3DES_EDE_CBC_SHA":true
    },
    "Bookmarks":[
      {
        "Title":"Qubes OS forum",
        "URL":"https://forum.qubes-os.org/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Qubes OS Documentation",
        "URL":"https://doc.qubes-os.org/en/latest/index.html",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Wired",
        "URL":"https://www.wired.com/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"EFF",
        "URL":"https://www.eff.org/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Internet Archive",
        "URL":"https://www.archive.org/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Invidious",
        "URL":"https://docs.invidious.io/instances/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"Odysee",
        "URL":"https://odysee.com/",
        "Favicon":"",
        "Placement":"toolbar"
      },
      {
        "Title":"DNSLeakTest",
        "URL":"https://dnsleaktest.com/",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Utilities"
      },
      {
        "Title":"BrowserLeaks",
        "URL":"https://browserleaks.com",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Utilities"
      },
      {
        "Title":"LibreTranslate",
        "URL":"https://libretranslate.com/",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Translators"
      },
      {
        "Title":"DeepL",
        "URL":"https://www.deepl.com/en/translator",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Translators"
      },
      {
        "Title":"dict.cc",
        "URL":"https://www.dict.cc",
        "Favicon":"",
        "Placement":"toolbar",
        "Folder":"Translators"
      }
    ],
    "AppAutoUpdate":false,
    "BackgroundAppUpdate":false,
    "CaptivePortal":false,
    "DefaultDownloadDirectory":"${home}/Downloads",
    "DisableAppUpdate":true,
    "DisableDeveloperTools":false,
    "DisableEncryptedClientHello":false,
    "DisableFeedbackCommands":true,
    "DisableFirefoxAccounts":true,
    "DisableFirefoxScreenshots":false,
    "DisableFirefoxStudies":true,
    "DisableForgetButton":true,
    "DisableFormHistory":true,
    "DisableMasterPasswordCreation":true,
    "DisablePasswordReveal":true,
    "DisablePocket":true,
    "DisablePrivateBrowsing":true,
    "DisableProfileImport":false,
    "DisableProfileRefresh":true,
    "DisableSetDesktopBackground":true,
    "DisableSystemAddonUpdate":true,
    "DisableTelemetry":true,
    "DisplayBookmarksToolbar":"newtab",
    "DisplayMenuBar":"default-off",
    "DontCheckDefaultBrowser":true,
    "DownloadDirectory":"${home}/Downloads",
    "ExtensionUpdate":true,
    "NetworkPrediction":false,
    "NoDefaultBookmarks":true,
    "OfferToSaveLogins":false,
    "OverrideFirstRunPage":"",
    "OverridePostUpdatePage":"",
    "PasswordManagerEnabled":false,
    "PrintingEnabled":false,
    "PromptForDownloadLocation":false,
    "RequestedLocales":"en-US",
    "SearchSuggestEnabled":false,
    "ShowHomeButton":true,
    "SkipTermsOfUse":true,
    "TranslateEnabled":false,
    "UseSystemPrintDialog":false,
    "PDFjs":{
      "Enabled":false,
      "EnablePermissions":false
    },
    "PictureInPicture":{
      "Enabled":false,
      "Locked":false
    },
    "FirefoxSuggest":{
      "WebSuggestions":false,
      "SponsoredSuggestions":false,
      "ImproveSuggest":false,
      "Locked":false
    },
    "DNSOverHTTPS":{
      "Enabled":false,
      "Locked":true
    },
    "UserMessaging":{
      "ExtensionRecommendations":false,
      "FeatureRecommendations":false,
      "UrlbarInterventions":false,
      "SkipOnboarding":false,
      "MoreFromMozilla":false,
      "FirefoxLabs": false,
      "Locked":false
    },
    "Permissions":{
      "Location":{
        "BlockNewRequests":true
      },
      "Camera":{
        "BlockNewRequests":true
      },
      "Microphone":{
        "BlockNewRequests":true
      },
      "EncryptedMediaExtensions":{
        "Enabled":false,
        "Locked":true
      }
    },
    "ExtensionSettings":{
      "uBlock0@raymondhill.net":{
        "installation_mode":"force_installed",
        "install_url":"https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
      },
      "{73a6fe31-595d-460b-a920-fcc0f8843232}":{
        "installation_mode":"force_installed",
        "install_url":"https://addons.mozilla.org/firefox/downloads/latest/noscript/latest.xpi"
      }
    },
    "3rdparty":{
      "Extensions":{
        "uBlock0@raymondhill.net":{
          "adminSettings":{
            "advancedSettings":[
              [
                "disableWebAssembly",
                "true"
              ]
            ],
            "advancedUserEnabled":"true",
            "externalLists":[
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ],
            "importedLists":[
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ],
            "dynamicFilteringEnabled":"true",
            "dynamicFilteringString":"* google-analytics.com * block\n* googletagmanager.com * block\n* * 3p-script block*\n* * 3p-frame block",
            "popupPanelSections":"31",
            "hostnameSwitchesString":"no-large-media: behind-the-scene false\nno-csp-reports: * true",
            "userFilters":"! fonts\n!*$font,third-party\n!*$font,third-party,domain=~example.com|~example2.net\n\n! all stackoverflow annoying consent banners\n##.js-consent-banner\n\n! some annoying banners\n##.banner > [href]\n",
            "selectedFilterLists":[
              "ublock-quick-fixes",
              "user-filters",
              "ublock-filters",
              "ublock-badware",
              "ublock-privacy",
              "ublock-abuse",
              "ublock-unbreak",
              "adguard-generic",
              "adguard-mobile",
              "easylist",
              "easyprivacy",
              "urlhaus-1",
              "adguard-annoyance",
              "fanboy-annoyance",
              "ublock-annoyances",
              "plowe-0",
              "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt",
              "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
            ]
          }
        }
      }
    },
    "FirefoxHome":{
      "Highlights":false,
      "Pocket":false,
      "Search":false,
      "Snippets":false,
      "SponsoredPocket":false,
      "SponsoredStories":false,
      "SponsoredTopSites":false,
      "Stories":false,
      "TopSites":false,
      "Locked":true
    },
    "GenerativeAI": {
      "Enabled":false,
      "Chatbot":false,
      "LinkPreviews":false,
      "TabGroups":false,
      "Locked":false
    },
    "HardwareAcceleration":false,
    "Homepage":{
      "URL":"about:blank",
      "Locked":false,
      "StartPage":"none"
    },
    "SearchEngines":{
      "Add":[
        {
          "Name": "DuckDuckGo Lite",
          "Alias": "@duckduckgo",
          "Method": "POST",
          "URLTemplate": "https://start.duckduckgo.com/lite/?q={searchTerms}",
          "PostData": "q={searchTerms}",
          "IconURL": ""
        },
        {
          "Name":"DuckDuckGo Custom",
          "Alias":"@custom",
          "Method": "POST",
          "URLTemplate":"https://duckduckgo.com/?q={searchTerms}&kl=wt-wt&kp=-2&kg=p&k5=1&kae=d&ks=l&k1=-1",
          "PostData": "q={searchTerms}",
          "IconURL":""
        },
        {
          "Name":"SearXNG - searx.be",
          "Alias":"@searx",
          "Method":"POST",
          "URLTemplate":"https://searx.be/?q={searchTerms}",
          "PostData": "q={searchTerms}&category_general=on",
          "IconURL":""
        },
        {
          "Name":"Qwant",
          "Alias":"@qwant",
          "Method":"GET",
          "URLTemplate":"https://www.qwant.com/?q={searchTerms}",
          "IconURL":""
        },
        {
          "Name": "MetaGer",
          "Alias": "@metager",
          "Method": "GET",
          "URLTemplate": "https://metager.org/meta/meta.ger3?eingabe={searchTerms}",
          "IconURL": ""
        },
        {
          "Name": "Mojeek",
          "Alias": "@mojeek",
          "Method": "GET",
          "URLTemplate": "https://www.mojeek.com/search?q={searchTerms}",
          "IconURL": ""
        },
        {
          "Name":"Startpage",
          "Alias":"@startpage",
          "URLTemplate":"https://www.startpage.com/sp/search?query={searchTerms}",
          "Method":"GET",
          "IconURL":""
        },
        {
          "Name":"Brave Search",
          "Alias":"@brave",
          "Method":"GET",
          "URLTemplate":"https://search.brave.com/search?q={searchTerms}",
          "IconURL":""
        },
        {
          "Name":"LibreTranslate",
          "Alias":"@libre",
          "Method":"GET",
          "URLTemplate":"https://libretranslate.com/?source=de&target=en&q={searchTerms}",
          "IconURL":""
        },
        {
          "Name":"DeepL",
          "Alias":"@deepl",
          "Method":"GET",
          "URLTemplate":"https://deepl.com/en/translator#de/en/{searchTerms}",
          "IconURL":""
        },
        {
          "Name":"dict.cc",
          "Alias":"@dict",
          "Method":"GET",
          "URLTemplate":"https://www.dict.cc/?s={searchTerms}",
          "IconURL":""
        }
      ],
      "Remove":[
        "Google",
        "Bing",
        "Amazon.com",
        "eBay",
        "Ecosia",
        "Twitter",
        "Wikipedia"
      ],
      "Default":"DuckDuckGo"
    },
    "Preferences":{
      "dom.disable_window_flip":{
        "Value":true,
        "Status":"user"
      },
      "dom.disable_window_move_resize":{
        "Value":true,
        "Status":"user"
      },
      "extensions.htmlaboutaddons.recommendations.enabled":{
        "Value":false,
        "Status":"user"
      },
      "security.default_personal_cert":{
        "Value":"Ask Every Time",
        "Status":"user"
      },
      "browser.contentblocking.category":{
        "Value":"strict",
        "Status":"user"
      },
      "browser.search.update":{
        "Value":false,
        "Status":"user"
      },
      "accessibility.force_disabled":{
        "Value":1,
        "Status":"user"
      },
      "browser.tabs.warnOnClose":{
        "Value":false,
        "Status":"user"
      },
      "ui.systemUsesDarkTheme":{
        "Value":1,
        "Status":"user"
      },
      "extensions.activeThemeID":{
        "Value":"firefox-compact-dark@mozilla.org",
        "Status":"user"
      },
      "browser.theme.dark-private-windows":{
        "Value":true,
        "Status":"user"
      },
      "layout.css.light-dark.enabled":{
        "Value":true,
        "Status":"user"
      },
      "widget.non-native-theme.scrollbar.dark-themed":{
        "Value":true,
        "Status":"user"
      },
      "browser.in-content.dark-mode":{
        "Value":true,
        "Status":"user"
      },
      "widget.disable-dark-scrollbar":{
        "Value":false,
        "Status":"user"
      },
      "browser.theme.dark-toolbar-theme":{
        "Value":true,
        "Status":"user"
      },
      "browser.theme.toolbar-theme":{
        "Value":1,
        "Status":"user"
      }
    }
  }
}
EOF
}

# Step 1: Install and update the Qubes Template
echo -e "\n[1/7] Checking for Qubes template..."
if ! qvm-check "$BASE_TEMPLATE" 2>/dev/null; then
    echo "Installing $BASE_TEMPLATE..."
    sudo qubes-dom0-update qubes-template-$BASE_TEMPLATE
fi

# Ensure template is shut down before updating
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Update the template whether it was just installed or already existed
echo "Updating $BASE_TEMPLATE..."
sudo qubesctl --show-output --skip-dom0 --targets=$BASE_TEMPLATE state.sls update.qubes-vm

# Ensure Qubes base template is shut down before create
qvm-shutdown --wait "$BASE_TEMPLATE" 2>/dev/null || true

# Step 2: Create custom base template
echo -e "\n[2/7] Creating custom template by cloning..."
qvm-clone "$BASE_TEMPLATE" "$CUSTOM_TEMPLATE"
qvm-prefs "$CUSTOM_TEMPLATE" label black

# Step 3: Install template dependencies
echo -e "\n[3/7] Installing template dependencies..."
qvm-run -p -u root "$CUSTOM_TEMPLATE" "echo 'TERM=xterm' << /etc/environment"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "locale-gen en_US.UTF-8"
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    apt-get update && apt-get install -y --no-install-recommends \
    dialog \
    qubes-core-agent-networking \
    ca-certificates \
    pulseaudio-qubes \
    curl \
    thunar \
    qubes-core-agent-thunar \
    xfce4-terminal \
    qubes-core-agent-passwordless-root \
    $BROWSER_PKG
"

# Shutdown template to apply changes
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 4: Configure Firefox in the custom template
echo -e "\n[4/7] Configuring Firefox..."

# Download user.js
echo "Downloading user.js..."
qvm-run -p "$CUSTOM_TEMPLATE" "curl --tlsv1.2 -x http://127.0.0.1:8082/ -L '$USER_JS' -o /tmp/user.js"

# Create directories
qvm-run -p -u root "$CUSTOM_TEMPLATE" "mkdir -p /usr/lib/firefox-esr/defaults/pref /usr/lib/firefox-esr/distribution"

# Create firefox.cfg
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// IMPORTANT: Start your code on the 2nd line' < /usr/lib/firefox-esr/firefox.cfg
    grep -E '^user_pref\(' /tmp/user.js | grep -v '^//' | sed 's/user_pref/pref/' << /usr/lib/firefox-esr/firefox.cfg
"

# Create autoconfig.js
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    echo '// Enable autoconfig' < /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.filename\", \"firefox.cfg\");' << /usr/lib/firefox-esr/defaults/pref/autoconfig.js
    echo 'pref(\"general.config.obscure_value\", 0);' << /usr/lib/firefox-esr/defaults/pref/autoconfig.js
"

# Create policies.json with the full configuration
echo "Creating policies.json..."
generate_policies_json | qvm-run -p -u root "$CUSTOM_TEMPLATE" "cat > /usr/lib/firefox-esr/distribution/policies.json"

# Set permissions
qvm-run -p -u root "$CUSTOM_TEMPLATE" "
    chmod 644 /usr/lib/firefox-esr/firefox.cfg \
              /usr/lib/firefox-esr/defaults/pref/autoconfig.js \
              /usr/lib/firefox-esr/distribution/policies.json
"

# Finalize Firefox configuration
echo "Firefox configuration completed..."
qvm-run -p "$CUSTOM_TEMPLATE" "rm -f /tmp/user.js"
qvm-shutdown --wait "$CUSTOM_TEMPLATE"

# Step 5: Create DVM template based on custom template
echo -e "\n[5/7] Creating DVM template..."
qvm-create --template "$CUSTOM_TEMPLATE" --label red \
    --property netvm="$NET_VM" \
    --property include_in_backups=False \
    "$DVM_TEMPLATE"
qvm-prefs "$DVM_TEMPLATE" template_for_dispvms True

# Step 6: Create regular disposable VM instance
echo -e "\n[6/7] Creating regular disposable VM instance..."
qvm-features "$DVM_TEMPLATE" appmenus-dispvm 1

# Step 7: Configure menu items
echo -e "\n[7/7] Configuring menu items..."
qvm-features "$CUSTOM_TEMPLATE" menu-items "debian-xterm.desktop xfce4-terminal.desktop"
qvm-features "$DVM_TEMPLATE" menu-items "firefox-esr.desktop thunar.desktop xfce4-terminal.desktop"

# Finalize
echo -e "\nFinish!"

debian-minimal-arkenfox-regular-disposable.sh.log (17.4 KB)

Policies features

Dark theme

Bookmarks

Some STIG v6 used

policies.json

{ "policies":{ "SSLVersionMin":"tls1.2", "EnableTrackingProtection":{ "Value":true, "Locked":true, "Cryptomining":true, "Fingerprinting":true }, "Cookies":{ "AcceptThirdParty":"never", "Behavior":"reject-tracker-and-partition-foreign", "BehaviorPrivateBrowsing":"reject-tracker-and-partition-foreign", "Locked":false }, "DisabledCiphers":{ "TLS_RSA_WITH_3DES_EDE_CBC_SHA":true }, "Bookmarks":[ { "Title":"Qubes OS forum", "URL":"https://forum.qubes-os.org/", "Favicon":"", "Placement":"toolbar" }, { "Title":"Qubes OS Documentation", "URL":"https://doc.qubes-os.org/en/latest/index.html", "Favicon":"", "Placement":"toolbar" }, { "Title":"Wired", "URL":"https://www.wired.com/", "Favicon":"", "Placement":"toolbar" }, { "Title":"EFF", "URL":"https://www.eff.org/", "Favicon":"", "Placement":"toolbar" }, { "Title":"Internet Archive", "URL":"https://www.archive.org/", "Favicon":"", "Placement":"toolbar" }, { "Title":"Invidious", "URL":"https://docs.invidious.io/instances/", "Favicon":"", "Placement":"toolbar" }, { "Title":"Odysee", "URL":"https://odysee.com/", "Favicon":"", "Placement":"toolbar" }, { "Title":"DNSLeakTest", "URL":"https://dnsleaktest.com/", "Favicon":"", "Placement":"toolbar", "Folder":"Utilities" }, { "Title":"BrowserLeaks", "URL":"https://browserleaks.com", "Favicon":"", "Placement":"toolbar", "Folder":"Utilities" }, { "Title":"LibreTranslate", "URL":"https://libretranslate.com/", "Favicon":"", "Placement":"toolbar", "Folder":"Translators" }, { "Title":"DeepL", "URL":"https://www.deepl.com/en/translator", "Favicon":"", "Placement":"toolbar", "Folder":"Translators" }, { "Title":"dict.cc", "URL":"https://www.dict.cc", "Favicon":"", "Placement":"toolbar", "Folder":"Translators" } ], "AppAutoUpdate":false, "BackgroundAppUpdate":false, "CaptivePortal":false, "DefaultDownloadDirectory":"${home}/Downloads", "DisableAppUpdate":true, "DisableDeveloperTools":false, "DisableEncryptedClientHello":false, "DisableFeedbackCommands":true, "DisableFirefoxAccounts":true, "DisableFirefoxScreenshots":false, "DisableFirefoxStudies":true, "DisableForgetButton":true, "DisableFormHistory":true, "DisableMasterPasswordCreation":true, "DisablePasswordReveal":true, "DisablePocket":true, "DisablePrivateBrowsing":true, "DisableProfileImport":false, "DisableProfileRefresh":true, "DisableSetDesktopBackground":true, "DisableSystemAddonUpdate":true, "DisableTelemetry":true, "DisplayBookmarksToolbar":"newtab", "DisplayMenuBar":"default-off", "DontCheckDefaultBrowser":true, "DownloadDirectory":"${home}/Downloads", "ExtensionUpdate":true, "NetworkPrediction":false, "NoDefaultBookmarks":true, "OfferToSaveLogins":false, "OverrideFirstRunPage":"", "OverridePostUpdatePage":"", "PasswordManagerEnabled":false, "PrintingEnabled":false, "PromptForDownloadLocation":false, "RequestedLocales":"en-US", "SearchSuggestEnabled":false, "ShowHomeButton":true, "SkipTermsOfUse":true, "TranslateEnabled":false, "UseSystemPrintDialog":false, "PDFjs":{ "Enabled":false, "EnablePermissions":false }, "PictureInPicture":{ "Enabled":false, "Locked":false }, "FirefoxSuggest":{ "WebSuggestions":false, "SponsoredSuggestions":false, "ImproveSuggest":false, "Locked":false }, "DNSOverHTTPS":{ "Enabled":false, "Locked":true }, "UserMessaging":{ "ExtensionRecommendations":false, "FeatureRecommendations":false, "UrlbarInterventions":false, "SkipOnboarding":false, "MoreFromMozilla":false, "FirefoxLabs": false, "Locked":false }, "Permissions":{ "Location":{ "BlockNewRequests":true }, "Camera":{ "BlockNewRequests":true }, "Microphone":{ "BlockNewRequests":true }, "EncryptedMediaExtensions":{ "Enabled":false, "Locked":true } }, "ExtensionSettings":{ "uBlock0@raymondhill.net":{ "installation_mode":"force_installed", "install_url":"https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi" }, "{73a6fe31-595d-460b-a920-fcc0f8843232}":{ "installation_mode":"force_installed", "install_url":"https://addons.mozilla.org/firefox/downloads/latest/noscript/latest.xpi" } }, "3rdparty":{ "Extensions":{ "uBlock0@raymondhill.net":{ "adminSettings":{ "advancedSettings":[ [ "disableWebAssembly", "true" ] ], "advancedUserEnabled":"true", "externalLists":[ "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt", "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt" ], "importedLists":[ "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt", "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt" ], "dynamicFilteringEnabled":"true", "dynamicFilteringString":"* google-analytics.com * block\n* googletagmanager.com * block\n* * 3p-script block*\n* * 3p-frame block", "popupPanelSections":"31", "hostnameSwitchesString":"no-large-media: behind-the-scene false\nno-csp-reports: * true", "userFilters":"! fonts\n!*$font,third-party\n!*$font,third-party,domain=~example.com|~example2.net\n\n! all stackoverflow annoying consent banners\n##.js-consent-banner\n\n! some annoying banners\n##.banner > [href]\n", "selectedFilterLists":[ "ublock-quick-fixes", "user-filters", "ublock-filters", "ublock-badware", "ublock-privacy", "ublock-abuse", "ublock-unbreak", "adguard-generic", "adguard-mobile", "easylist", "easyprivacy", "urlhaus-1", "adguard-annoyance", "fanboy-annoyance", "ublock-annoyances", "plowe-0", "https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_17_TrackParam/filter.txt", "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt" ] } } } }, "FirefoxHome":{ "Highlights":false, "Pocket":false, "Search":false, "Snippets":false, "SponsoredPocket":false, "SponsoredStories":false, "SponsoredTopSites":false, "Stories":false, "TopSites":false, "Locked":true }, "GenerativeAI": { "Enabled":false, "Chatbot":false, "LinkPreviews":false, "TabGroups":false, "Locked":false }, "HardwareAcceleration":false, "Homepage":{ "URL":"about:blank", "Locked":false, "StartPage":"none" }, "SearchEngines":{ "Add":[ { "Name": "DuckDuckGo Lite", "Alias": "@duckduckgo", "Method": "POST", "URLTemplate": "https://start.duckduckgo.com/lite/?q={searchTerms}", "PostData": "q={searchTerms}", "IconURL": "" }, { "Name":"DuckDuckGo Custom", "Alias":"@custom", "Method": "POST", "URLTemplate":"https://duckduckgo.com/?q={searchTerms}&kl=wt-wt&kp=-2&kg=p&k5=1&kae=d&ks=l&k1=-1", "PostData": "q={searchTerms}", "IconURL":"" }, { "Name":"SearXNG - searx.be", "Alias":"@searx", "Method":"POST", "URLTemplate":"https://searx.be/?q={searchTerms}", "PostData": "q={searchTerms}&category_general=on", "IconURL":"" }, { "Name":"Qwant", "Alias":"@qwant", "Method":"GET", "URLTemplate":"https://www.qwant.com/?q={searchTerms}", "IconURL":"" }, { "Name": "MetaGer", "Alias": "@metager", "Method": "GET", "URLTemplate": "https://metager.org/meta/meta.ger3?eingabe={searchTerms}", "IconURL": "" }, { "Name": "Mojeek", "Alias": "@mojeek", "Method": "GET", "URLTemplate": "https://www.mojeek.com/search?q={searchTerms}", "IconURL": "" }, { "Name":"Startpage", "Alias":"@startpage", "URLTemplate":"https://www.startpage.com/sp/search?query={searchTerms}", "Method":"GET", "IconURL":"" }, { "Name":"Brave Search", "Alias":"@brave", "Method":"GET", "URLTemplate":"https://search.brave.com/search?q={searchTerms}", "IconURL":"" }, { "Name":"LibreTranslate", "Alias":"@libre", "Method":"GET", "URLTemplate":"https://libretranslate.com/?source=de&target=en&q={searchTerms}", "IconURL":"" }, { "Name":"DeepL", "Alias":"@deepl", "Method":"GET", "URLTemplate":"https://deepl.com/en/translator#de/en/{searchTerms}", "IconURL":"" }, { "Name":"dict.cc", "Alias":"@dict", "Method":"GET", "URLTemplate":"https://www.dict.cc/?s={searchTerms}", "IconURL":"" } ], "Remove":[ "Google", "Bing", "Amazon.com", "eBay", "Ecosia", "Twitter", "Wikipedia" ], "Default":"DuckDuckGo" }, "Preferences":{ "dom.disable_window_flip":{ "Value":true, "Status":"user" }, "dom.disable_window_move_resize":{ "Value":true, "Status":"user" }, "extensions.htmlaboutaddons.recommendations.enabled":{ "Value":false, "Status":"user" }, "security.default_personal_cert":{ "Value":"Ask Every Time", "Status":"user" }, "browser.contentblocking.category":{ "Value":"strict", "Status":"user" }, "browser.search.update":{ "Value":false, "Status":"user" }, "accessibility.force_disabled":{ "Value":1, "Status":"user" }, "browser.tabs.warnOnClose":{ "Value":false, "Status":"user" }, "ui.systemUsesDarkTheme":{ "Value":1, "Status":"user" }, "extensions.activeThemeID":{ "Value":"firefox-compact-dark@mozilla.org", "Status":"user" }, "browser.theme.dark-private-windows":{ "Value":true, "Status":"user" }, "layout.css.light-dark.enabled":{ "Value":true, "Status":"user" }, "widget.non-native-theme.scrollbar.dark-themed":{ "Value":true, "Status":"user" }, "browser.in-content.dark-mode":{ "Value":true, "Status":"user" }, "widget.disable-dark-scrollbar":{ "Value":false, "Status":"user" }, "browser.theme.dark-toolbar-theme":{ "Value":true, "Status":"user" }, "browser.theme.toolbar-theme":{ "Value":1, "Status":"user" } } } }

Web Browser References

Mozilla Firefox Documentation

Mozilla Firefox - Official policy templates documentation

Mozilla Firefox - Official release versions

Mozilla Firefox - Linux olicy templates (GitHub)

Mozilla Firefox - Definitive answer to settings precedence? #1015 (GitHub)

Mozilla Firefox - Policy templates discussions

Mozilla Firefox - Enterprise development - How to add policy support

Mozilla - MDN Web Docs - Navigator - Instance properties - Language property

Mozilla Firefox - Searchfox - /firefox-main/source/toolkit/components

Mozilla Firefox Topics

DISA STIGs - Mozilla Firefox Security Technical Implementation Guide

opticmelody - firefox-stig-policy - This contains the Firefox policies.json for implementing the Mozilla Firefox STIG version 6

Tor Browser 12.0 does not respect `user.js`/default settings on first start - Open - Issue created Dec 13, 2022 by ChrisK

How to remove hard-coded suggestions from URL bar drop-down ? - Reddit

Mozilla Firefox - Enterprise Policy Generator

Security and Privacy Topics

Arkenfox Wiki

Betterfox Wiki

Privacy-Handbuch - Firefox user.js

How does Qubes OS provide security?

What about privacy in non-Whonix qubes?

Librewolf - Feature Request: Radio Silence by Default for Browser Startup and Background Connections aka "Disable Phone Home" #1779 - Opened by adrelanos (2024)

Kicksecure Default Browser - Development Considerations

OS Detection Techniques - Jonathans Blog

Nmap Network Scanning - Chapter 15. Nmap - Reference Guide - OS Detection

Mozilla Foundation - Security Advisories

Firefox ESR Vulnerabilities

CVE Details - Mozilla Vulnerabilities

CVE Details - Chromium Vulnerabilities

Qubes Forum Discussion

Is Firefox really an appropriate default browser for Qubes?

Can websites track me across different qubes?

Hardware information masking and spoofing with hypervisor

Stop telling VMs the exact physical CPU model in the computer #1142

About plugins, add-ons, or extensions

uBlock Wiki - Blocking mode - Medium mode (optimal for advanced users)

Tor Project - Can I use plugins, add-ons, or extensions in Tor Browser?

quBO: Manage uBlock Origin and Tor Browser "the qubes way"

Should I install a new add-on or extension in Tor Browser like Adblock Plus or uBlock Origin?

Others

URL Parameters - DuckDuckGo

Advanced syntax - DuckDuckGo

‘t’ URL parameter - DuckDuckGo

Non-JavaScript Version - DuckDuckGo

How are parameters sent in an HTTP POST request? - Stack Overflow

Web Browser Privacy Tools

Web Browser Privacy Comparison

Comparison of web browsers - Wikipedia

Privacy Tests

Browser Comparison Tool - Avoid the Hack

Comparison of Web Browsers - Eylenburg

Other Browsers

The Servo Parallel Browser Engine Project

The WebKitGTK Project

List of web browsers - Wikipedia

IceCat

Mullvad Browser

Midori Browser (WebkitGTK) - GitHub

Midori Browser (WebkitGTK) - Alpine

Falkon (formerly QupZilla) (QtWebEngine)

Dillo (FLTK)

Pale Moon

GNOME Web (also known as Epiphany) (WebkitGTK)

Lynx (Text browser)

Links2 (Text browser)

w3m (Text browser)

Browser Fingerprinting Test

NoScript Fingerprint

FingerprintJS, Inc

BrowserLeaks

BrowserLeaks - Fonts

BrowserLeaks - Features

BrowserLeaks - JavaScript

BrowserLeaks - Canvas

Cover Your Tracks - EFF

Browserscan

AmIUnique

Device Info

Browser Audit

Fingerprint Test - Pet Portal

Privacy Analyzer - Privacy.net

Canvas Fingerprint - WebBrowserTools.com

Browser Checker - BrowserScan.net

WHOER

Pixelscan

Cloudflare Turnstile - NopeCHA

CreepJS (Github)

OS Detection Font CSS (Github)

User-Agent Switcher (Gitlab)

Browser Adblock Test

uBlock Tests

Adblock Tester

Can You Block It?

Block Ads

Adblock Tool (Github)

IP and DNS Leak Test

DNS Leak Test

IPLeak.net

IPLeak.net - json

zx2c4 - Jason A. Donenfeld - json

ipify API

ipify API - json

IPinfo

Mullvad - Connection check

GeoPlugin

Useful list of “about” pages

about:policies

about:support

about:config

about:preferences#search

about:networking

about:logging

about:about

about:robots

Rendering issue fixed using html encoding, duh !!!