{ ffLib }: {
  meta.description = ''
    Prevent unnecessary connections while browsing.

    This profile assumes:
      - The user does not move the device into a network where it may be held captive
        before agreeing to usage terms.
      - We have otherwise blocked the installation of arbitrary extensions.
  '';

  # Sources:
  # https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections
  # https://github.com/intika/Librefox/blob/45a4d3ce647b8c896e81ce3e5ac5ddc95ff045e0/librefox/mozilla.cfg#L1167
  policies = {
    CaptivePortal = false;
    DisableTelemetry = true;
    NetworkPrediction = false;
    SearchSuggestEnabled = false;

    Preferences = ffLib.flattenAttrs {
      extensions = {
        blocklist.enabled = false;
        getAddons.showPane = false;
        htmlaboutaddons.recommendations.enabled = false;
      };
    };
  };

  preferences = {
    toolkit.telemetry = {
      enabled = false;
      server = "";
      unified = false;
      archive.enabled = false;

      newProfilePing.enabled = false;
      firstShutdownPing.enabled = false;
      shutdownPing.enabled = false;
      shutdownPingSender.enabled = false;

      # background hang reporting
      bhrPing.enabled = false;
      updatePing.enabled = false;
    };

    extensions = {
      blocklist.enabled = false;
      getAddons.showPane = false;
      getAddons.cache.enabled = false;
      htmlaboutaddons.recommendations.enabled = false;

      abuseReport = {
        url = "";
        amoDetailsURL = "";
      };
    };

    network = {
      predictor = {
        enable-prefetch = false;
        prefetch-next = false;
      };

      # Prevent FF from establishing connections on mouse-hover
      http.speculative-parallel-limit = 0;
    };

    services.settings.server = "";

    # TODO: what exactly does this block?
    services.blocklist.pinning.enabled = false;

    # don't send single words to search engine
    browser.fixup.dns_first_for_single_words = true;

    beacon.enabled = false;
    browser.send_pings = false;
  };
}