how to disable built-in personas on firefox 3.6 completely?

[Frank Lion]

IMHO there's a difference between a UI change and a feature that has no visibility unless it's actually used.

Like Geolocation? ...which we also disabled for people when they asked.

IMHO your IMHO doesn't matter. This is release time, answer the questions put to us and move on...and please do not offend our fellow users whilst doing so.

No one should have to tread through treacle just to get a simple answer to a simple question. This is not the 'Oscar Wilde Debating Society'.

[guid]

don't like "personas", not understand why they did not integrate "tab mix plus" or other add-ons may help in productivity or security, that will be more handy for users

btw, before 3.6 if you like personas you can install an add-on, in 3.6 if you don't like it, you can't remove or disable it. yes, you guys can say "hey if you don't like that, don't use firefox". but that is how you help spreading firefox or helping people?

why I use firefox? coz I have lot of choice of add-ons. yes, CHOICE

thanks for reading this

[Bluefang]

Geolocation is different because it is both a privacy concern (to some) and an active service. Personas is neither.

No one should have to tread through treacle just to get a simple answer to a simple question.

I agree.

My only point is that, in this case, the simplest answer would have been that there is nothing worth disabling. Unless you're using or trying to install a persona, it pretty much is already disabled.

[Scorzonera]

That's why I don't understand.

I noticed, yes.

My only point is that, in this case, the simplest answer would have been that there is nothing worth disabling.

It's not an answer to the question, merely a personal POV on the matter that you have made clear more than once, here. Thanks for sharing it so abundantly.

Unless you're using or trying to install a persona, it pretty much is already disabled.

Well... There's that little thing that the 'get more themes' link doesn't actually bring you to more themes but to some sort of personas gallery. (Which actually gave me an genuine WTF moment.) Got that sorted out with altering the URL in extensions.getMoreThemesURL in about:config, so no worries, personas is pretty much disabled here (instead of dormant, ready to wake up at any given moment).

If anyone else has even more tips as to silence personas even further and forever, please feel free to contribute!

[gdot179]

Scorzonera brings up an excellent point. In the early days of Mozillazine I
asked a question concerning the constant background activity in FF. I was
stonewalled by the mods and others. To make a long story short, I simply removed
ALL links in about:config. Being on Linux, a bunch of stuff doesn't apply
anyhow. Updates are done through Debian. No problems what-so-ever in normal
operation. If you are the paranoid type that needs to have every
keystroke/site/whatever checked then ignore this. This thread could go on
forever and finally you will take matters into your own hands as I did. As I've
said SOOOOO many times: FF is eminently prunable to satisfy your own desires. Do
it! Cause Mozilla ain't!

[lbdwag]

The add-on & extension system in FF is what makes it great. So why not leave a truly BS feature like this as one; as it has been in the past!

Removing the getpersonas.com site from the warn-on-addon-install suggestion worked; as long as nothing else gets put in there (which that one is the default) there "shouldn't" be an issue... for now. Give it a few months and I would bet there will be a BIG issue.

technical reasoning behind why I think there will be an issue:
The data that will be displayed as a persona is being interpreted by FF, so once there is a flaw discovered in how that is done, your system is compromised.

I run FF with dropmyrights so it is not running as an admin so it should not (hopefully) cause my system to be infected once this happens.

[slisir]

So I got tired of waiting for someone else to come up with a sure fire way to disable it. I ripped out the module so I don't have to worry about if it's disabled or not, since everything I tried didn't disable the mouse over java functions.

Now I am no expert, so any suggestions on changes please comment. This is for Windows obviously, I set this up so that I can do this as a mass deployment to users in a company, thus the LockPref usage. user_pref will work just fine if you want to put it in the Profile prefs.js file instead.

Here are the steps to remove the module:
1. (This is so that the Default theme is on, and no Persona is selected.)
Add to Mozilla Firefox\defaults\autoconfig\prefcalls.js:
lockPref("lightweightThemes.isThemeSelected", false);
lockPref("lightweightThemes.persisted.footerURL", false);
lockPref("lightweightThemes.persisted.headerURL", false);
lockPref("lightweightThemes.usedThemes", "");

2. (Prevents any updates to the Module)
Change in Mozilla Firefox\defaults\pref\firefox.js:
pref("lightweightThemes.update.enabled", false);

3. (This removes the Module)
Delete these files in Mozilla Firefox\modules:
LightweightThemeConsumer.jsm

Also you may want to check in your Profile folder to make sure the Footer and Header files aren't there, if they are there just delete them. They won't show up again even if you try selecting a persona.

[Frank Lion]

So I got tired of waiting for someone else to come up with a sure fire way to disable it. I ripped out the module so I don't have to worry about if it's disabled or not, since everything I tried didn't disable the mouse over java functions.

What are you defining as 'everything I tried'? You only have to disable JavaScript on that site.

This fix of yours is overcomplicated and the following would wreck the functionality of the entire Addons Manager.

4. (This removes the Module)
Delete these files in Mozilla Firefox\modules:
LightweightThemeConsumer.jsm
LightweightThemeManager.jsm

[slisir]

Ahhh good catch, I edited previous post and removed the step to remove LightweightThemeManager so addons manager still works.

However if you disable JavaScript only on that site, it's not disabling the actual function of Personas, right? That's where I feel like it's only a matter of time that there is an exploit so it functions outside of the website, I know others don't feel that way.

As for the everything I tried, I was referring to settings we can set within the prefcalls.js or firefox.js that normally we can use to disable or lock a feature in FF. Unless there is a setting I missed to do this.

I saw the option using userChrome, but problem with the userChrome.js is that the user still has rights to change that setting, even if the user doesn't have admin rights. So I was looking for an alternative from a standpoint of doing this for 200+ people and locking it so they can't edit it and turn it back on, it's also a pain to create/copy this file to each persons mozilla profile directory.

[Frank Lion]

However if you disable JavaScript only on that site, it's not disabling the actual function of Personas, right?

Well, effectively it is. At this point in time there is only one website that will 'react', so break the JS link and for all intents and purposes, you have disabled the functionality. Yes, other sites could, and may well offer, the same but they would have to get through the security whitelist first.

As for the everything I tried, I was referring to settings we can set within the prefcalls.js or firefox.js that normally we can use to disable or lock a feature in FF. Unless there is a setting I missed to do this.

Playing around with the app itself is possibly unwise. Especially as any update will wipe out any changes.

I saw the option using userChrome, but problem with the userChrome.js is that the user still has rights to change that setting, even if the user doesn't have admin rights. So I was looking for an alternative from a standpoint of doing this for 200+ people and locking it so they can't edit it and turn it back on, it's also a pain to create/copy this file to each persons mozilla profile directory.

Hmm, 200+, eh? Profile prefs.js would do it (in about 4 lines) as would a quick extension. You could even try a fake lightweighttheme-header and footer in the profile (they are .jpg, so put in a blank.jpg, rename and delete file extension) and set to read only - but that, if it worked, would only stop install, not js mouseover on the site.

Either way, tough call for 200+. Block site in hosts?

[slisir]

Ok, thanks for the info and ideas, appreciate it.

[Frank Lion]

Ok, thanks for the info and ideas, appreciate it.

No problem.

If it were me, I'd go down the nojs prefs route - http://www.mozilla.org/projects/securit ... olicy.html

[paj1234]

I too have been attempting to disable the Personas functionality in Firefox 3.6 completely. The best I could manage is:

1. Click Tools menu
2. Click Options
3. Click Security tab
4. To the right of "Warn me when sites try to install add-ons" click Exceptions
5. Click site "www.getpersonas.com"
6. Click Remove Site
7. Click Close, then OK.

To verify the change has taken effect:

1. Visit http://www.mozilla.com/en-US/firefox/3.6/whatsnew/
2. Mouse over the example images to the right of "Choose your persona". Nothing will happen - the background of the Firefox menu bar, main toolbar and status bar will remain the same.
3. Click one of the personas. The first one is called "Japanese Tattoo". The Firefox Information bar will appear under the Location bar with the message "The site (http://www.getpersonas.com) attempted to install a theme" and no change will occur. The page in the browser window will say "Now you're wearing" but nothing will actually happen.

I don't know how to get rid of the Information bar message in step 3. Perhaps someone more enlightened will help. I tried changing the preference "xpinstall.enabled" to "false" in about:config but that did not help, it only affected the installation of extensions such as Flashblock.

[everready]

Its this way I uninstalled Fire Fox leaving all my baggage behind including Persona's. Then reloaded with a fresh copy. This morning I click on themes its Persona's again.. did Mozilla team create this, it
says they did.. Whats up with this guys?

Thanks in advance..

everready

[Ngamer01]

everready, see this thread: viewtopic.php?f=7&t=1688435