How to remove all bars in fullscreen mode in Firefox on MacOS/OSX ("kiosk mode")

Procedure

If you want to remove all toolbars from Firefox in fullscreen mode on Mac, this is the procedure:

1. Type about:config: in the location bar to open advanced settings. (If it is the first time you do it, you might have to click "confirm" or something like that in the scary screen that comes up first.)
2. search for full-screen-api.allow-trusted-requests-only and double-click the line that is found, so the value changes to false
3. Bring up the Bookmark Toolbar if you don't have it (menu View -> Toolbars -> Bookmark Toolbar)
4. Right-click on empty space in the Bookmark Toolbar, and select New Bookmark...
5. In the Name field, type something like "Enter Fullscreen" (it doesn't really matter, just don't leave it blank)
6. In the Location field, enter the following line:

   javascript:document.getElementsByTagName('html')[0].mozRequestFullScreen();void(0)

7. Click Add to save the bookmark.

Now, when you click on that bookmark, Firefox will go "real fullscreen", hiding all toolbars. To get them back, you will have to press ESC.

Now, there is a bit of a snag. That preference in about:config: is set to true by default for a reason: it is a bit unsafe to allow any website to use fullscreen-enabling javascript. For this reason I would suggest to only do this for limited periods, then switch it back once you're done.

Long-winded explanation

FF has a preference, browser.fullscreen.autohide, that in theory should govern the behaviour of toolbars when going fullscreen. It is set to true by default, meaning toolbars should disappear. However, for some reason this property has (almost) always failed to work on MacOS/OSX builds of Firefox.

There used to be a few extensions that corrected that behaviour, but they've all gone away when Firefox switched to WebExtension APIs, which basically sandboxed extensions more rigidly and blocked them from changing the browser interface as deeply as they could before. This was the price for the dramatic performance improvement seen in Firefox 57+.

This workaround hence relies on the new Fullscreen WebAPI, which is supposed to be a new, standard way to enable fullscreen via Javascript on any browser (well, any browser that implements it - just a few at the moment). However, because of security concerns, this API is locked down by default; so, in order to use it, we first have to relax checks as described above. Once that is done, we can launch a bit of JS from a bookmark that triggers "real" fullscreen.

Credit to this AskDifferent post where I first found the trick.

Fighting Cliqz in Firefox

Mozilla recently announced that some of their German users downloading Firefox will receive a version that tracks some of their web activity, reporting it to Cliqz.com. In the wake of this development, which is pretty awful from a privacy perspective, I went spelunking into my version of FF to see if anything had been enabled already in my build.

To my horror, cliqz.com is already mentioned in a few places, despite me never installing anything related to it. If you enter about:config in the address bar and search for cliqz, a few entries will pop up:

Straight out of the gate, it looks like something from cliqz.com has been whitelisted. What is it?

The social.* preferences are related to SocialAPI Services, a sort of framework to integrate social networks into Firefox. It was introduced several years ago but very few people actually use it or know about it. If you look up the related preferences, a few more entries are present:

If you are a fan of this sort of thing, you can go to that address https://activations.cdn.mozilla.net and install some of the available providers. I have no idea whether they still work or not; among others, delicious.com has recently been sold and it's in read-only mode, so that's unlikely to be useful.

I personally disabled it all (that social.remote-install.enabled freaked me out) by double-clicking all boolean properties (turning them to false) and double-clicking then clearing out social.whitelist.

The other mentions of cliqz seem to be special-casing whitelists aimed at making an extension work around some of the recent changes in the Firefox extensibility framework. If I understand correctly, dom.ipc.cpows.allow-cpows-in-compat-addons allows Cross-Process Object Wrappers (an internal communication mechanism that should slowly be removed) to be used even if the extension is marked as compatible with the new multiprocess architecture; and extensions.legacy.exceptions exempts the listed extensions from being marked as Legacy.

In those whitelists, there is one called testpilot@cliqz.com. Test Pilot is an official Firefox add-on from Mozilla that will periodically publish some proposed additions to the browser, allowing users to enable them, test them out, give feedback and so on. I personally like it, some of the proposed features are actually pretty good (although it doesn't look like any of them ever made it to the main build); considering its complexity (an extension-installing extension) it makes sense that it might require some special privileges, and after all it's an official Mozilla feature so why not?

Well, it looks like Mozilla is using cliqz.com to gather remote info about TestPilot usage, which is very disappointing. TestPilot was marketed as an official Mozilla project, there was no mention of third parties involved. I won't disable TestPilot, but I am again very disappointed in their cavalier attitude with my usage data.

To conclude, it looks like the "synergy" between Mozilla and Cliqz was already underway before the latest announcement. It's likely that more defensive hacks will be required in the near future to keep user-tracking at bay in Firefox. As a long-time fan of Mozilla since the '90s, this development is disappointing.

You should update to NoScript 1.9.2.6

Quick recap:

1. NoScript is a Firefox extension. Its author makes money from ads on his webpages (from what he says, pretty much his entire income depends on those adsUPDATE: from his bio: "I'm currently teaching Web Programming at the University of Palermo"... yet another blow to his credibility UPDATE: the bio was outdated).
2. AdBlock Plus is a Firefox extension that stops ads. It also allows users to subscribe to third-party lists of sites to block.
3. The maintainer of one of those services, "EasyList", took a very zealous approach and targeted NoScript.net (and other sites from the same author) because he found that it implemented some basic workarounds to avoid AdBlock Plus.
4. Escalation ensued, and after a series of tit-for-tat eventually the NoScript developer went too far. NoScript, when installed in Firefox, would now check if AdBlock Plus was installed, and if so, force it to whitelist its sites... basically "hacking" ABP client-side.
5. The ABP developer (who up to now was not involved who apparently instigated the whole thing) got angry, and denounced the behaviour in various forums, including Slashdot.
6. The NoScript author backtracked, removed the offending code in the latest update (NoScript 1.9.2.6) and apologized

Now, I'm sympathetic to the NoScript author's circumstances -- he has a family to feed, he gives his work away for free, and NoScript really is a piece of extremely useful and complex code that most Firefox users enjoy (including me). It seems fair that he should get some compensation for his effort.

However, clearly NoScript can be (and is) used as an ad-blocker, and the developer even runs AdBlock himself, but then he gets all worked up when these technologies are used against his own sites. There is a bit of hypocrisy there.

In any case, client-side modification of other people's extensions is just unacceptable, no matter how "transparent" it is. There is a line, and the NS author crossed it. Kudos to him for the eventual backtracking, but he shouldn't have put himself in that position in the first place. NoScript is a security-related extension, and in the security world trust is precious currency. His reputation is now tarnished, and it will take time for people to forget.

All this, someone pointed out, highlights the need for a mechanism to reward extension authors. I agree. Mozilla could easily implement a micropayment system on addons.mozilla.org (like the iPhone AppStore), or build some sort of subscription infrastructure in FF (so that people can install extensions, then decide if they are worth paying). My guess is that the world of extension development would literally explode, and that would make FF even more attractive.

NoScript + PingFire = problems

Note to search engines: the PingFire extension for Firefox doesn't work when NoScript is also installed. Check the official PingFire support thread for more info.

Update: I removed PingFire and replaced it with a simple bookmark-in-sidebar hack:

1. Create a bookmark pointing to http://ping.fm/m (the "mobile" site for Ping.fm) and place it on your Bookmarks Toolbar
2. right-click on it, select Properties
3. check the option to "Load this bookmark in sidebar"

This is one of the very few occasions in which I found the Firefox sidebar quite useful.

on Atomic

The new version of Atomic is good. I can finally work properly with my blogspot feed, and the included WYSIWYG editor is good enough for my needs. I only wish it could do feed autodiscovery, at the moment you have to display the feed to trigger it; and pre-fillable automatic namespaces for categories would save a bit of time. UPDATE: uhm, it seems like there are still problems with remembering the configuration...

What else is it left in "feedland" to do? Oh yes, decent torrent integration; after the demise of WritTorrent, I don't see anyone properly doing this yet.

Firefox Add-ons :: Better Gmail

Lovely little extension containing the most useful greasemonkey scripts for GMail. Google Reader and Calendar integration is a must, the "filter assistant" is also a better way to create filters than the standard wizard. Lots of other goodies, definitely a keeper.

Technorati Tags: GMail, GoogleReader, GoogleCalendar, Firefox