Skip to content

Review RemoteSettings usages in esr68

RemoteSettings (https://firefox-source-docs.mozilla.org/main/68.0/services/common/services/RemoteSettings.html) is now used for several features as a way to synchronize some local state (collections, sets of records) with some remote state that Mozilla controls. I did not review the protocol, but the way I understand it is that there are periodical polls to the server with an etag header (last_timestamp, returned by the server in a previous poll) which return the list of changes since that timestamp. I think this etag may be quite close to a user identifier, so Mozilla's servers could probably link together all the RemoteSettings request can get is the sequence of all 'RemoteSettings polls' for a user. Not sure how much you can guess about the user with that, though.

In any case, opening this to decide/review which ones of the usages of RemoteSettings we need or not. The RemoteSettings one is probably a subset of the requests happening in background, but I guess it's a start. I'm listing files where RemoteSettings are used. My understanding is that just calling RemoteSettings('acollectionname') will start the syncing mechanism, meaning that there will be requests polling in background 'from time to time'.

  • browser/components/newtab/{lib/ASRouter.jsm, lib/FaviconFeed.jsm, lib/PersonalityProvider.jsm, lib/SiteClassifier.jsm}

  • toolkit/components/normandy/lib/RecipeRunner.jsm

    • I think this will not be run, since the RemoteSettings is created lazily when gRemoteSettingsClient is accessed, and that should not happen since we have datareporting.healthreport.uploadEnabled = false.

  • toolkit/components/search/SearchService.jsm

    • Used to update the "ignore list settings" which can be used to remotely "ignore" search engines? I think we can remove this one.

  • browser/components/preferences/browserLanguages.js

    • There is a dump for this one in services/settings/dumps/main/language-dictionaries.json. It seems to be a mapping of locale to dictionary ids. We probably have to keep this one if we want to allow changing UI language in about:preferences, via Mozilla's language packs.

  • netwerk/url-classifier/UrlClassifierSkipListService.jsm

    • If I understand it correctly, this is used for content blocking, to be able to skip some steps ("features") for specific urls. I guess to be able to fix antitracking breakage remotely? We should not need this one if we don't plan to make it possible to enable content blocking/mozilla's antitracking.

  • security/manager/ssl/RemoteSecuritySettings.jsm

Finally some blocklists, I think some of them we already have in esr60, but not all? Not completely sure, but I would say it's better to keep these?

  • services/common/blocklist-clients.js

    • onecrl (already in esr60).
    • pinning blocklist (related to HPKP? not sure if it's in esr60).

  • toolkit/mozapps/extensions/Blocklist.jsm (these were already in esr60)

    • extensions blocklist
    • plugins blocklist
    • gfx blocklist