MrOtherGuy

Doesn't really sound like a company that I would want to do any business with then.

You can modify prefs at runtime and have them persist - except those prefs that are also declared in user.js. The problem arises when folks apply whole list of prefs via user.js from one repository or another, which could be hundreds, without acknowledging what prefs they set and without checking what those prefs do. If they then have some reason to change any one of those prefs - their change won't persist if that particular pref is in user.js

A thing you could do is to just start Firefox once with a user.js file, and then remove that file. On that single startup Firefox sets prefs according to user.js, and all those changes persist to prefs.js when Firefox is shutdown. You are then able to also persist changes to all prefs because by removing user.js Firefox won't try to override the your session saved prefs with user.js at startup.

Yes. Firefox doesn't create user.js file itself - if you want one then you need to create it yourself either manually or with some tool. Also, I've seen some "security" software create user.js file without notifying the user about it...

What I'm trying to point out here, is that prefs declared in user.js (whether they are put there using scripting or otherwise) cannot be persistently modified at runtime from within Firefox. That may or may not be a huge problem, but something to be aware of.

Sure. For simplified example have only the following in your user.js file:

user_pref("browser.tabs.warnOnClose",true);

1. Start Firefox
2. Observe that the pref is indeed true
3. Go to Setting > General, observe that Confirm before closing multiple tabs is checked
4. Uncheck the option
5. In about:config observe that browser.tabs.warnOnClose is now false
6. Restart Firefox
7. Observe that the pref is again set to true

The reason is also very simple. Firefox will never write anything to user.js - thus any changes you do at runtime will only be stored to prefs.js. However, user.js always overrides prefs.js at startup.

Yes, but that is not what I'm talking about. What I mean is that when Firefox is running and you go to change some setting in say, Settings page, then the new value for that preference is stored into prefs.js (at latest on Firefox shutdown, it might remain only in-memory for some time I'm not sure). Anyway, the new value persists only for that browser session, because on next startup whatever value was set by user.js will override it.

I don't think that could work. Not unless we are talking about different things, or unless you run their updater script everytime before starting Firefox.

In addition, if you use user.js then you essentially cannot change those settings at runtime (via about:config or otherwise), because your user.js will override the settings on next startup. Maybe that's desired for some, but good to keep in mind nonetheless.

Yeah... It's a bit hard to balance things like this though, I've seen lot's of folks complain about how their Firefox is apparently "broken" because it now suddenly has this empty margin around web-content seemingly wasting space for no reason - and then it turns out that they have deliberately turned this very feature on. And that is even if the feature is completely hidden - I wonder how many more complaints there would be if options like this are made more accessible.

The letterboxing feature has been in Firefox since 2019 - starting from Firefox 67 I think. The preference for it might have been hidden though so maybe it's just relatively unknown feature - I don't know if or how visible LibreWolf makes makes it for the user. But regardless, any modern Firefox variant probably has that capability.

Sounds like you are talking about Firefox's letterboxing feature which you can enable/disable independently from full fingerprinting resistance.

Absolutely not. If anything, public officials would be the one group whose messaging I would understand being scanned so that the people can sort of keep them on check. But again, implementing such possibility that would still weaken security of everyone else as well so of course it should not actually be done.