firefox: return to Quad9 ECS, disable Pocket (I don't actually use it), fix search engine typo

It looks fancy, while not exactly for me.

conf/librewolf.overrides.cfg

@@ -112,8 +112,8 @@ pref("reader.parse-on-load.force-enabled", true);
 //pref("network.trr.mode", 2);
 defaultPref("network.trr.mode", 3);
 pref("network.trr.early-AAAA", true);
-defaultPref("network.trr.uri", "https://dns0.eu/");
-//defaultPref("network.trr.uri"), "https://dns11.quad9.net/dns-query");
+//defaultPref("network.trr.uri", "https://dns0.eu/");
+defaultPref("network.trr.uri"), "https://dns11.quad9.net/dns-query");
 //defaultPref("network.trr.uri", "https://dns.adguard-dns.com/dns-query");
 // NOTE: ECH requires TRR, so mode 2 may not use it.
 defaultPref("network.trr.disable-ECS", false);

etc/firefox/policies/policies.json

@@ -70,10 +70,10 @@
     "DNSOverHTTPS": {
       "Enabled": true,
       "Locked": false,
-      "ProviderURL": "https://dns.quad9.net/dns-query"
+      "ProviderURL": "https://dns11.quad9.net/dns-query"
     },
     "DisableEncryptedClientHello": false,
-    "DisablePocket": false,
+    "DisablePocket": true,
     "EnableTrackingProtection": {
       "Cryptomining": true,
       "Fingerprinting": true,
@@ -101,6 +101,10 @@
         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/peertube-companion/latest.xpi",
         "installation_mode": "force_installed"
       },
+      "plasma-browser-integration@kde.org": {
+        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/plasma-integration/latest.xpi",
+        "installation_mode": "force_installed"
+      },
       "uBlock0@raymondhill.net": {
         "blocked_install_message": "uBlock Origin on integroitu AdNauseamiin, joka on forkki siitä.",
         "installation_mode": "blocked"
@@ -208,7 +212,7 @@
           "URLTemplate": "https://search.brave.com/goggles?q={searchTerms}"
         }
       ],
-      "Default": "Ecosia Search Engine"
+      "Default": "Ecosia"
     },
     "SearchSuggestEnabled": false
   }

etc/hosts/dns

@@ -102,6 +102,30 @@
 ::ffff:94.140.14.14 dns.adguard-dns.com
 ::ffff:94.140.15.15 dns.adguard-dns.com
 
+# AdGuard Unfiltered
+94.140.14.140 unfiltered.adguard-dns.com
+94.140.14.141 unfiltered.adguard-dns.com
+# Uses private ECS, which gets inaccurate with IPv6 directing traffic to
+# other side of the country at best and different country at worst. Thus
+# attempt to make everything only use it for IPv4 (browser fallback is system
+# resolver which does IPv6 if IPv4 breaks, even if ECH will break).
+#2a10:50c0::1:ff unfiltered.adguard-dns.com
+#2a10:50c0::2:ff unfiltered.adguard-dns.com
+::ffff:94.140.14.140 unfiltered.adguard-dns.com
+::ffff:94.140.14.141 unfiltered.adguard-dns.com
+
+# AdGuard Family
+94.140.14.15 family.adguard-dns.com
+94.140.15.16 family.adguard-dns.com
+# Uses private ECS, which gets inaccurate with IPv6 directing traffic to
+# other side of the country at best and different country at worst. Thus
+# attempt to make everything only use it for IPv4 (browser fallback is system
+# resolver which does IPv6 if IPv4 breaks, even if ECH will break).
+#2a10:50c0::bad1:ff family.adguard-dns.com
+#2a10:50c0::bad2:ff family.adguard-dns.com
+::ffff:94.140.14.15 family.adguard-dns.com
+::ffff:94.140.15.16 family.adguard-dns.com
+
 # Google DNS
 8.8.8.8 dns.google dns.google.com
 8.8.4.4 dns.google dns.google.com

etc/opt/chromium/policies/managed/README.md

@@ -8,8 +8,10 @@
 <!-- START doctoc generated TOC please keep comment here to allow auto update -->
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 
+- [`amber-theme-colour.json.sample`](#amber-theme-colourjsonsample)
 - [`aminda-extensions.json`](#aminda-extensionsjson)
   - [Silk - Privacy Pass Client for the browser](#silk---privacy-pass-client-for-the-browser)
+  - [Plasma Integration](#plasma-integration)
   - [uBlock Origin](#ublock-origin)
   - [HTTP Indicator](#http-indicator)
   - [Fedora User Agent](#fedora-user-agent)
@@ -39,13 +41,12 @@
 - [`edge-screenshots.json`](#edge-screenshotsjson)
 - [`enable-chromecast.json`](#enable-chromecastjson)
 - [`enable-ech-ocsp.json`](#enable-ech-ocspjson)
-- [`enable-google-safebrowsing.json`](#enable-google-safebrowsingjson)
-- [`enable-google-safebrowsing-less-private.json.sample`](#enable-google-safebrowsing-less-privatejsonsample)
 - [`enable-labs.json`](#enable-labsjson)
 - [`enable-passwordleakdetection.json`](#enable-passwordleakdetectionjson)
 - [`enable-tab-suspend.json`](#enable-tab-suspendjson)
 - [`fix-edge-search.json`](#fix-edge-searchjson)
 - [`force-incognito.json.badidea`](#force-incognitojsonbadidea)
+- [`generative-ai.json`](#generative-aijson)
 - [`https-everywhere.json`](#https-everywherejson)
 - [`README.md`](#readmemd)
 
@@ -54,6 +55,11 @@
 <!-- prettier-ignore-end -->
 <!-- editorconfig-checker-enable -->
 
+## `amber-theme-colour.json.sample`
+
+Automatically generated theme colour based on "amber" (`#ffb700`), it looks
+kind of fancy, but doesn't feel like it's for me.
+
 ## `aminda-extensions.json`
 
 As I cannot separate the keys to multiple files I am forced to keep them in
@@ -80,6 +86,14 @@ To intentionally trigger it and what should be allowed in NoScript:
 - https://captcha.website
 - https://issuance.privacypass.cloudflare.com
 
+### [Plasma Integration](https://chrome.google.com/webstore/detail/cimiefiiaegbelhefglklhhakcgmhkai)
+
+- `cimiefiiaegbelhefglklhhakcgmhkai`
+
+Does a lot of small things on KDE Plasma which my family uses (and me too,
+when I am not on Sway). For example media player integration to Plasma,
+downloads indicator/control, KDE Connect, alt-f2, etc.
+
 ### uBlock Origin
 
 - `cjpalhdlnbpafiamejdnhcphjbkeiagm`
@@ -246,17 +260,6 @@ However ECH requires `"DnsOverHttpsMode": "secure"` which will break things
 or it will occassionally get disabled (I hope they implement it with system
 resolver soon).
 
-## `enable-google-safebrowsing.json`
-
-Enforces Google Safe Browsing in standard mode. For advanced mode and sending data to Google, increase to 2.
-
-I just don't trust my family to not find and disable the feature, especially if there was an unfiltered DNS server.
-
-## `enable-google-safebrowsing-less-private.json.sample`
-
-This would enable Google Safebrowsing and send additional data to Google
-including downloads etc.
-
 ## `enable-labs.json`
 
 Enables the beaker button "Experiments" for easier management than `about:flags`.
@@ -279,6 +282,11 @@ stealthily sending those queries to Bing.
 
 Forces incognito mode. I don't recommend this.
 
+## `generative-ai.json`
+
+Allows using the AI features that I am not seeing anyway, but won't send data
+back to Google about them.
+
 ## `https-everywhere.json`
 
 Enforces https and attempts to upgrade http to https.

etc/opt/chromium/policies/managed/amber-theme-colour.json.sample

@@ -0,0 +1,3 @@
+{
+	"BrowserThemeColor": "#ffb700"
+}

etc/opt/chromium/policies/managed/aminda-extensions.json

@@ -73,6 +73,12 @@
       "toolbar_pin": "default_unpinned",
       "update_url": "https://clients2.google.com/service/update2/crx"
     },
+    "cimiefiiaegbelhefglklhhakcgmhkai": {
+      "installation_mode": "force_installed",
+      "override_update_url": true,
+      "toolbar_pin": "default_unpinned",
+      "update_url": "https://clients2.google.com/service/update2/crx"
+    },
     "cjpalhdlnbpafiamejdnhcphjbkeiagm": {
       "blocked_install_message": "uBlock Origin on integroitu AdNauseamiin, joka on forkki siitä.",
       "installation_mode": "blocked"

etc/opt/chromium/policies/managed/doh-adguard-family.json

@@ -0,0 +1,4 @@
+{
+  "DnsOverHttpsMode": "automatic",
+  "DnsOverHttpsTemplates": "https://family.adguard-dns.com/dns-query"
+}

etc/opt/chromium/policies/managed/doh-adguard-unfiltered.json

@@ -0,0 +1,4 @@
+{
+  "DnsOverHttpsMode": "automatic",
+  "DnsOverHttpsTemplates": "https://unfiltered.adguard-dns.com/dns-query"
+}

etc/opt/chromium/policies/managed/doh-adguard.json

@@ -0,0 +1,4 @@
+{
+  "DnsOverHttpsMode": "automatic",
+  "DnsOverHttpsTemplates": "https://dns.adguard-dns.com/dns-query"
+}

etc/opt/chromium/policies/managed/generative-ai.json

@@ -0,0 +1,6 @@
+{
+  "CreateThemesSettings": 1,
+  "GenAILocalFoundationalModelSettings": 0,
+  "HelpMeWriteSettings": 1,
+  "TabOrganizerSettings": 1
+}

etc/opt/chromium/policies/recommended/README.md

@@ -13,6 +13,8 @@
 - [`disable-default-browser-check.json`](#disable-default-browser-checkjson)
 - [`duckduckgo.json`](#duckduckgojson)
 - [`ecosia.json`](#ecosiajson)
+- [`enable-google-safebrowsing.json`](#enable-google-safebrowsingjson)
+- [`enable-google-safebrowsing-less-private.json.sample`](#enable-google-safebrowsing-less-privatejsonsample)
 - [`enable-home.json`](#enable-homejson)
 - [`no-bookmarks-bar.json`](#no-bookmarks-barjson)
 - [`README.md`](#readmemd)
@@ -45,6 +47,16 @@ Sets and displays recommendation on the use of start.duckduckgo.com as a search
 
 Sets and displays recommendation on the use of Ecosia as a search engine by default.
 
+## `enable-google-safebrowsing.json`
+
+Enforces Google Safe Browsing in standard mode. For advanced mode and
+sending data to Google, increase to 2 or see the sample below.
+
+## `enable-google-safebrowsing-less-private.json.sample`
+
+This would enable Google Safebrowsing and send additional data to Google
+including downloads etc.
+
 ## `enable-home.json`
 
 Enables home button by default.