Security: Disable JIT

[Rudxain]

Securefox should disable JIT-compilation, including Ion.

To avoid clashing with Fastfox's speed in the main user.js, it should be opt-in

[yokoffing]

I will add these prefs as an option in the next release.

Mozilla should add a Security Mode (like in Edge) that auto-activates in Private Browsing and heuristically in Normal Browsing. One can wish!

[yokoffing]

Betterfox/Securefox.js

Lines 1131 to 1162 in c5fca2d

	// PREF: disable asm.js [FF22+]
	// [WARNING] Disabling this pref may disrupt your browsing experience.
	// [1] http://asmjs.org/
	// [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
	// [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/
	//user_pref("javascript.options.asmjs", false);
	// PREF: disable Ion and baseline JIT to harden against JS exploits
	// [NOTE] When both Ion and JIT are disabled, and trustedprincipals
	// is enabled, then Ion can still be used by extensions [4].
	// [WARNING] Disabling these prefs will disrupt your browsing experience [6].
	// Tor Browser doesn't even ship with these disabled by default.
	// [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit
	// [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/
	// [3] https://support.microsoft.com/en-us/microsoft-edge/enhance-your-security-on-the-web-with-microsoft-edge-b8199f13-b21b-4a08-a806-daed31a1929d
	// [4] https://bugzilla.mozilla.org/show_bug.cgi?id=1599226
	// [5] https://wiki.mozilla.org/IonMonkey
	// [6] https://github.com/arkenfox/user.js/issues/1791#issuecomment-1891273681
	//user_pref("javascript.options.ion", false);
	//user_pref("javascript.options.baselinejit", false);
	//user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF]
	// PREF: disable WebAssembly [FF52+]
	// [WARNING] Disabling this pref may disrupt your browsing experience.
	// Vulnerabilities [1] have increasingly been found, including those known and fixed
	// in native programs years ago [2]. WASM has powerful low-level access, making
	// certain attacks (brute-force) and vulnerabilities more possible.
	// [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3]
	// [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm
	// [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
	// [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/
	//user_pref("javascript.options.wasm", false);