Consider not using single char variables in docs

Summary.
I was debugging a requests example from the website here (http://docs.python-requests.org/en/master/) and was in a PDB session.  Went to inspect "r" by typing "r" and  it did not reference the variable "r".
What you expected.
I expected that it would return the object R
What happened instead.
It returned to the next method, because PDB uses hotkeys.
import requests
r = requests.get('https://api.github.com/user', auth=('user', 'pass'))
import pdb; pdb.set_trace()

Then type 'r' in PDB session, will return instead of instance of 'r'.
Suggestion.
Update the docs to not use single-char variables.  I would have sent a PR, but wanted to start here, as it's more emergent behavior of using PDB and single char vars then a direct requests issue, but is reflected in your examples.

Hi @claudijd, thanks for starting the conversation. While we want to make sure the documentation is easily accessible, I’m not sure this warrants a change. PDB has specifically added syntax to handle this issue. Whenever you’re printing a variable in the console, you should be prefixing it with an ! (e.g. !r) to avoid conflicts.
Given that we cannot control how other tools behave, the new variable could fail elsewhere and we’ll have to continue changing it. For those reasons, I think we’ll pass on this.

Thanks @nateprewitt

@nateprewitt just for the sake of argument, should the docs then use the "!r" syntax as you suggest?

You'll end up with collisions with 'r.status_code' as well.

import requests
r = requests.get('https://api.github.com/user', auth=('user', 'pass'))
import pdb; pdb.set_trace()
--Return--
(1)()->None
(Pdb) r
r.status_code
--Call--
(1)()->None
(Pdb) exit()
Traceback (most recent call last):
File "", line 1, in
File "/usr/local/Cellar/python/3.6.4_3/Frameworks/Python.framework/Versions/3.6/lib/python3.6/bdb.py", line 50, in trace_dispatch
return self.dispatch_call(frame, arg)
File "/usr/local/Cellar/python/3.6.4_3/Frameworks/Python.framework/Versions/3.6/lib/python3.6/bdb.py", line 83, in dispatch_call
if self.quitting: raise BdbQuit
bdb.BdbQuit

@claudijd no it shouldn't. The examples are (mostly) shown as if you've opened a python prompt, e.g.,
$ python
>>> import requests
>>> r = requests.get('https://httpbin.org/get')
>>> r

Not PDB


Unable to get token after latest Plex Update

My PLPP install was left unable to get a token after the last plex update. The webserver and the Plex server are on the same box and no settings had changed. So I installed a webserver and PHP on a different box, set up Plex, and I can't get it to get a token either. It had been running fine for the past few years until last week.

2FA was issue


Center hero image

Found this library through Product College's 25th publication. Nice work!

Thanks! I appreciate that!


sticky: add-ons

Use this issue for add-on announcements: new, gone-to-sh*t, recommendations for adding or dropping in the wiki list Appendix B: Firefox Add-ons. Stick to privacy and security related add-ons, and keep in mind e10s and Web Extensions.
Please note: The comments here will be regularly cleaned out to keep this sticky usable

:white_check_mark: WebExtension

Added [Web Extensions]

Link Cleaner | GitHub
Redirector | GitHub
Request Control | GitHub

Added

Smart Referer
HTTPS by default
SSleuth | GitHub
SSLPersonas | GitHub | Website
Live HTTP Headers

Pending

:white_check_mark: Cookie AutoDelete | GitHub

can't clear LocalStorage yet, work in progress, keep an eye on, looks promising

:white_check_mark: eCleaner | GitHub

looks promising, loads of cleaning various items

:white_check_mark: Referer control Chrome extension
:white_check_mark: Negotiator | GitHub

doesn't work (yet) full of bugs and errors - ask earthlng - worth revisiting

Skip Redirect e10s
:white_check_mark: Google search link fix | GitHub

google/yandex. Personally, I use a user script called "google privacy" which has been working for years - I should find a link for it, see if it's maintained, stick in the wiki for user scripts? -Thorin

:white_check_mark: Searchonymous2 | GitHub

Rejected :lemon:
If you strongly disagree, then by all means, bring it up

Downloads Window

nothing to do with privacy/security

Stop Fingerprinting

These are all already covered by preferences

Smart HTTPS | Smart HTTPS revived

sledgehammer (i.e apply-all) approach to a barely-existent problem (Firefox and other browsers will move to highlighting non HTTPS sites, and in fact addon's such as SSleuth already do). Hammering every http with an https as well is just, well, hammering. WE version also keeps forensic data by default of all http sites connected to. This whitelisting also defeats the purpose of checking/forcing https if those sites change.

No more Facebook redirect

An add-on to handle one particular redirect on a single domain? Surely there are better solutions

Better Privacy

user.js disables flash, we recommend that Flash dies

RequestPolicy <IP_ADDRESS>

this is abandoned as far as i can tell, and it and it's fork RequestPolicyContinued offer nothing that uMatrix and uBlock Origin do

https://filterlists.com

not our project or job to provide help or lists for uBo

Clean Links | Github

removed from AMO

No cross-domain referer

changes preferences rather than work with the value supplied afterwards (like Smart Referer does) via the API. Also, the values it assigns are a sledgehammer (word used especially for zymase )

WebSocket Disabler 0.1.3

no multiprocessCompatible flag, may break on April 18 2017 with FF53

Caromel SSL Validation

no multiprocessCompatible flag, may break on April 18 2017 with FF53

****UAControl https://addons.mozilla.org/en-US/firefox/addon/uacontrol/
****User-Agent JS Fixer https://addons.mozilla.org/en-US/firefox/addon/user-agent-js-fixer/

Install User-Agent JS Fixer if you have installed UAControl for a complete solution.

Thanks. Will do. When I move that section to the wiki, I plan on actually writing a short comment underneath each one. Have made a note to mention that User-Agent JS Fixer is only needed if you use an UA addon that doesn't cover JS

Just found addon "Downloads Window" (https://addons.mozilla.org/en-US/firefox/addon/downloads-window/)
What I see as an add on, is that it can remove download item from download history immediatelly after download is completed.
It has a several settings to make user happier.

@crssi : Does it have anything to do with privacy or security? If not, then it has no business being considered for our list :)

It makes various options available, as  auto_open, auto_remove, auto_close, open_on_complete, show_alert_on_complete.
Source: https://bitbucket.org/ungram/downloads_window/overview

@Roman-Nopantski: It has to do with a privacy as much as for example: 0803, 0808, 0809, 0817, 1007, 2605, 2802-2805... maybe I have forgot some, but you will see the pattern. ;)
Obviously I have failed to present it clearly but I think @Atavic got the message correcly. :)

Just for info what I use currently (filtered to privacy and security):
CanvasBlocker
Clean Links
Decetraleyes
Downloads Window
HTTPS Everywhere
No Resource URI Leak
NoRedirect (investigating)
NoScript
Pure URL
Self-Destructing Cookies
Smart HTTPS
uBlock Origin
uMatrix (for a long time now, but will reconsider possibilities)
I am open for a discussion for each of upper choices if someone interested. ;)
Cheers

I would add this ones too:
Stop Fingerprinting
Disables / modifies some browser APIs that would otherwise allow browser fingerprinting:

window.screen: emulate standard fullHD screen with 40px task bar at the bottom and devicePixelRatio = 1
window.MediaDevices: hide media devices (microphones, cameras)
window.navigator: make all properties match to the current userAgen (if modified)
navigator.plugins + mimeTypes: hide all plugins (they can still be used, just not enumerated)
font detection: add a bit of randomness to inline elements width and height to confuse font detection

Smart Referer
Send referers only when staying on the same domain.
No more Facebook redirect
prevent facebook to redirect link to facebook.com/l.php
BetterPrivacy
Better Privacy serves to protect against special longterm cookies, a new generation of 'Super-Cookie', which silently conquered the Internet. This new cookie generation offers unlimited user tracking to industry and market research. Concerning privacy Flash-cookies are most critical.

uMatrix up for reconsideration? you mad, bro?
If mozilla decided next year that Firefox will only allow one add-on, uMatrix would be my choice, no doubt about it! xD
But by all means if you find something better please let me know :)

@crssi : Not sure if you saw the wiki page (linked in post 1) before you posted that - but they are all there except:
Clean Links, Downloads Window, Smart HTTPS
I've actually tried Clean Links before, and am currently using an old version of Redirect Bypasser (the new version is buggy and sucks). I will look at Clean Links again at some stage, but as per the wiki, I am still looking for a decent comprehensible solution that is e10s compatible.

It has to do with a privacy as much as for example: 0803, 0808, 0809, 0817, 1007, 2605, 2802-2805

I fail to see what Downloads Window" has to do with privacy or security? Are you saying that the above preferences have nothing to do with privacy or security? I don't follow, sorry. There are preferences in section 3000 which are just handy (ignore those), otherwise these are all here for a reason. The ones listed above do enhance privacy in some way - eg leaking history in urlbar suggestions to nosey co-workers looking over your shoulder. Or have I misread something?

The addon "Downloads Window" is only useful for those who keep history enabled.

@Roman-Nopantski ; Sorry, haven't seen the wiki. :(
I am saying that "Downloads Window" have possibility to clear the download history item immediately after the download finishes.
@Atavic: No true. Its immediate clear, without needing to close the browser or do a manual clear.

@crssi : I really don't think it's worth it for that one feature, especially when there are other options for controlling that type of data (eg disabling its collection in the first place, or clearing it manually eg Ctrl-Shift-Del , clearing it on close, doing downloads in a private window, etc ).

@earthlng: :)
uMatrix is best addon by my opinion too, but I might get the wrong impression whats all about user.js here.
Is it for ultra paranoia or it is for best of all without breaking user experience and for wider audience with less knowledge? I have, for example, settings for my folks in mind here. ;)
So I don't block JS, XHR, FRAME all around, but only to tracking and security in question destinations.
Also I use NoScript for XSS, ABE, ClearClick and embeddings, but have JS allowed.

Does it make sense now?

@Roman-Nopantski: Aaaaa... don't kill me here. I did only mention it, since I have found it in the last day and I found nice feature for situations where more than one user frequently uses the browser (at home for example), without closing the browser. I have it now installed for observation purposes, but I am not in a paranoia mode here, so it might be uninstalled soon. ;)
When you mention it... how do you disable its collection in a real time?

@earthlng : your version can be whatever you want. The info allows you to be super-hardened and super-private.  And to some degree it already is. I find the internet totally usable, and mine is identical. That said, people can't load youtube comments, twitter is broken to some degree, dropbox won't work correctly, DRM/EME/Widevine,GMP won't work, Webcam is disabled, WebGL is off etc - trust me, we have site breakage. But its only about 20 prefs that cover all the breakage - I can live with that. End users can live with that because its not too hard to fix. Everyone's needs are different.
So the balance is as probably as little breakage (to not turn people off) but hell yeah, you earthling, can turn the dial to 11.

how do you disable its collection in a real time

There used to be a pref to remove a download from history immediately after completion, but it was deprecated way way way back. History and downloads seem to be tied together in preferences, so I would say an add-on would need to be used, so it could monitor downloads and remove select entries via sql on successful completion (but leave failed ones there?). IDK exactly.

Yes, I know the deprecated browser.download.manager.retention.
This was the reason that I mention "Downloads Window", when I have stumbled on in the last day, but that's all. If you find it useful, than that's OK. If you don't, that is OK too. Its no intentions of mine to try to convince you here, so no need to go on here at all. ;)

[https://addons.mozilla.org/en-Us/firefox/addon/requestpolicy/](RequestPolicy <IP_ADDRESS>)

Hallo! RequestPolicyContinued is the active fork.

I agree, the Request Policy Continued fork is messy (but I haven't looked at it for a long time) - it's not even on AMO is it? I've already added the suggestion to the first post.
uMatrix has a clear cache every 15 minutes (min time allowed). If someone wants to they could disable memory cache (disk cache should be off as well, doh!), but I don't think its worth the gain - unless you're a secret op spy in which case, you're using the wrong platform. I'm hoping e10s process per tab maybe and also FPI will solve eTags.

I can only recommend RequestPolicy <IP_ADDRESS>
Unlike uBlock Origin it offers some control (block/allow) over redirects.
Unlike uBlock Origin it is compatible with most FF versions (even very old versions).
Otherwise I agree uBlock Origin / uMatrix are better overall.

Just found this https://filterlists.com/.
Nice addition to uBlock and uMatrix.

Redirector is a highly versatile extension that can redirect almost any network request to any other destination.  Fully supports regex and wildcards.
It's open source, and is available here on GitHub.
Disclosure: I'm a contributor, but not the main author.

@Gitoffthelawn Nice one. :)

I will be keeping this clean, so comments will get deleted from time to time. Proposed addons get mentioned - they get added to the first post. They may be discussed, etc. Every so often I will clean out the comments, so we do not end up with a 1000+ comments and it becomes unworkable.

I have been using NoRedirect which is extremely powerful. Takes a little working out, but is quite simple. The order of entries matter, I have a .* as my bottom entry set to source which means block all. Then in about  a year of using it, I have only had to add 7 entries to override that. But it's not e10s compatible.
So I don;t have to read about it, I'll ask the source ..@Gitoffthelawn - does Redirector have a block all default? Is it e10s?

Filter lists - should I add that as a bullet point to uBlock Origin? I actually added a couple from there - Fanboy ones, otherwise I'm not sure about a lot of them (especially as you scroll down). I don't want to point people at a source of dodgy lists. Is there anything on gorhill's github that mentions it, how long has it been going, etc.

re: filter lists, I'm only using some of the lists provided by default in uB+uM.
IMO if you block 3rd-party, there's really no need to add 10s of thousands of additional blocked domains.
If you look at some of those lists, you're likely never gonna encounter 99% of them anyway.
Redirector does something completely different compared to NoRedirect.

filter lists: Yeah, default block all 3rd party for starters. I did find a couple of nice site specific one from Fanboy though .. short and sweet contents that did make a difference - they weren't 3rd party blocks. SO maybe add a link to it with a caution (not official or something?)

Since there is concern about if the add-ons will be e10s compatible, does anyone know if Self-Destructing Cookies will be compatible in the future? Right now appears as unknown in arewee10syet.com

You know as much as we do @logos88

a couple of nice site specific one from Fanboy

care to share? afaik all the fanboy lists are available by default in uB+uM.
If it's only the fanboy stuff, we could link to that directly.
https://github.com/easylist/easylist/tree/master/fanboy-addon
But searching in chrome://ublock0/content/asset-viewer.html?url=fanboy-annoyance
finds 16 mentions of easylist:fanboy-addon/, and the github has 16 lists. What's missing?

sure .. actually it was only one Fanboy and some others. I just had a browse and cherry picked, testing stuff out

https : / /ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt 1,468 used out of 1,577
facebook annoyances blocker 39 used out of 39 (yes I use FB to track a ton of bands - it's already heavily customized via my own custom feed, stylish etc - but this made a difference performance, stylish only hides shit)
- Fanboy's Anti-thirdparty Fonts 44 used out of 44
- Youtube: Pure Video Experience 21 used out of 21 (I use youtube about once a month if that, I usually flick it open in a portable chrome)

Thanks! personally no need for the FB list, but YT ones look useful.
IMO if we add links to more blocklists, we should only link to specific ones, or it might appear as if we encourage using as many as possible.
We could add links to https://ransomwaretracker.abuse.ch/blocklist/ and https://youtube.adblockplus.me/, but on the other hand it doesn't really have anything to do with our project.
IMO people who feel the need to add more lists can easily find them.

IDK the answer .. I do not want to list to a massive hodge-podge of god-only-knows filters .. i mean who maintains them etc. will that site even exist in a years time. And its just more work to maintain out list. That said, there are bound to be some gems in there. I don;t think it's our job to provide links and help for uBo. So I'm more in favor of linking nothing

u do realize that Fanboy's Anti-thirdparty Fonts wasn't in that list of 16 right? It could be this list is a snippet from a larger one, IDK

Looking at the RW_DOMBL.txt, for me personally this would only unnecessarily bloat my filterlist, because

I'm very unlikely ever gonna encounter any of those domains in the wild
if I did, it would almost certainly be 3rd-party and therefore blocked by default + no reason to allow it
even if I visited one of those sites directly, JS would be blocked and there's 0 risk to fall victim to that malware.
Anyone who uses uMatrix with a safe default config is already better protected than even a million of blocklists could ever achieve.

I'm very unlikely ever gonna encounter any of those domains in the wild

I think they're the payloads

u do realize that Fanboy's Anti-thirdparty Fonts wasn't in that list of 16 right?

well, duh, I already had my blonde moment today ;) but I have Fonts-handling covered, so I don't need a list for that.

So I'm more in favor of linking nothing

100% agree.

I'm trying to think where we have 3rd party fonts blocked in css font face or whatever it is - refresh my memory .. it is a umatrix scope?

PS: Got a nice bell curve going on here xD .. I wonder if people will think we're mad ... 2,845 ++ / 1,269 -- on a 1500 line file in 10 days .. oh well, I'll just blame you

NoScript blocks fonts (I disabled that) and uB can also block remote-fonts (I've enabled that), and add to that the 1400-er prefs, but I'm not using 1401 + 1407.
1406 (layout.css.font-loading-api.enabled) SHOULD theoretically block ALL fonts, but idk if it really does.
I'm confused on how all those Font prefs go along. Maybe I'll setup a testpage, any ideas where to host it?

So 2 1/2 questions

All this blocking of fonts .. do you still get glyphs so you can like see the icons in uBo
NS font blocking .. is that the Options>Embeddings>Forbid @font-face?
uBo .. what is the global block all fonts .. is it * * no-remote-fonts or what, can be it * * 3p ?
What site breakage do you get?
4.5 Did you know you have two different "data:, " type values in your set of 5 in your js

I do not want to list to a massive hodge-podge of god-only-knows filters .. i mean who maintains them etc. will that site even exist in a years time.

My experience is that blocklists, or lists of blocklists are extremely hard to maintain without serious manpower. I was the maintainer of https://github.com/RequestPolicyContinued/subscriptions and wish we could ditch the blocklist aspect (maintaining limited whitelists is somehow easier).
Instead you should link to reputable/well-maintained blocklists sources eg.

https://filterlists.com/
https://github.com/gorhill/uBlock/blob/master/assets/ublock/filter-lists.json
https://github.com/StevenBlack/hosts

My 2 cents.
Edit: maybe these sources should also be linked from @pyllyukko's https://github.com/pyllyukko/user.js/#tracking-protection

@Roman-Nopantski

yes, I see the glyphs for uB
1b. No, I don't see some of the glyphs on sites but I guess because I block them with uBlock
yes
no-remote-fonts: * true
some, but I don't care tbh I want to see the content not the shiny icons and shit
4.5 idk, maybe I replaced only some of them. see my comment in the other issue.

@pyllyukko @nodiscc Why don;t we build a joint ghacks & pyllyukko wiki - can one be setup so both sites can pull thru changes?

Various pluses @Roman-Nopantski for stripping the thread and for keeping various blacklists proposals out of it.
Actual step is addons, not what comes after. Abuse.ch has various little lists of C&C ips related to Zeus and other botnets, so they could be eventually listed.

@Roman-Nopantski wrote:
"So I don;t have to read about it, I'll ask the source ..@Gitoffthelawn - does Redirector have a block all default? Is it e10s?"
Redirector requires rules to be written by the user.  By default, it does nothing except use a little RAM. 😄
Redirector is e10s compatible.  It is also now coded using WebExtensions API, so it will work with future versions of Firefox (until Mozilla deprecates WebExtensions... lol).

@pyllyukko @nodiscc Why don;t we build a joint ghacks & pyllyukko wiki - can one be setup so both sites can pull thru changes?

We were just discussing about ditching the wiki and have stuff in the README + user.js.

No More FB Redirect is long-time behind, Clean Links seems left, too, while Skip Redirect is Electrolysis (e10s) compatible:
https://addons.mozilla.org/es/firefox/addon/skip-redirect/

https://blog.mozilla.org/addons/2017/02/16/the-road-to-firefox-57-compatibility-milestones/
Firefox 53, April 18th release

Firefox will run in multiprocess mode by default for all users, with some exceptions. If your add-on has the multiprocessCompatible flag set to false, Firefox will run in single process mode if the add-on is enabled.
Add-ons that are reported and confirmed as incompatible with Multiprocess Firefox (and don’t have the flag set to false) will be marked as incompatible and disabled in Firefox.
Add-ons will only be able to load binaries using the Native Messaging API.
No new legacy add-ons will be accepted on addons.mozilla.org (AMO). Updates to existing legacy add-ons will still be accepted.

That means if you have any addons that you still want to use in FF53+ that don't have the flag set to false you may want to get a copy, add the flag and get it re-signed yourself BEFORE FF53 is released!!
Or if it's still actively maintained ask the developer to do it.
I'll do that myself for NoRedirect because that's the only one (I think, but will re-check) I use that doesn't have the flag set yet. I'll share the link to the updated version somewhere around here for others to use.

Remind me (I may create a FYI issue) - what exactly is the tag to add, where does it go, and how do we allow editing and changing the addon, because signed is enforced (what was that bypass again?).

It's not just adding the flag - you also need to change 1 or 2 other things as well, but it's all very easy to do. I wrote a detailed explanation for Tom once, on how to edit an old and abandoned addon to get it signed for personal use - will see if I can find that again.
An easy way to check if an addon has the flag set already is to go the AMO page for the addon, click on View the source under Version Information (for the latest version obviously) and then look for
<em:multiprocessCompatible> in the install.rdf file.
It's possible that other formats use another file instead of install.rdf, but it would always be in one of the top-level files.

I can't find it anymore but I tried to contact Tom over on ghacks. Hopefully he will see it and still has his notes around.

As I said, I'll get a copy of NoRedirect signed with the flag added, and since I already have an AMO account I can do a few more if someone wants me to. Just not dozens of 'em please ;)

Yup - I use NoRedirect. All up I have have 7 missing the flag and two on AMO with no "view source" link, so I will unpack em later and look. Of these 9, I am prepared to right now ditch 6 of them

nvm, found it - wooohooo!
http://www.ghacks.net/2016/07/15/those-unbranded-firefox-version-coming/#comment-3941758
make sure to read my 2 follow-up comments after that too!!

^^ why dont you create a FYI: how to bypass signed restrictions, also add e10s flag

My comment there + the 2 follow-ups explain it all. Feel free to create a wiki entry or something based on that, but it won't be useful for all too long anyway.

Yeah - I know I edited my comment like 2 seconds later .. I should have taken the link first .. take the blue pill they said .. what could go wrong - Tom''s going to be screwed. He has like over 70 add-ons. I think he will have moved to ESR already.
Meanwhile, I've done some cleaning out - they'll have to go anyway when e10s is fully enforced anyway (54? 55?) , and they're not maintained. So, just looking for replacements
OT:

Add to Search Bar 2.9 - damn handy, but I think I have my search engines all set up anyway. They're just XUL (oh dear .. 57 is coming .. how will these be handled). If I disable the addon everything still exists. Will test what happens if I uninstall it. Earthlng - how do YOU add your own engines - I think I read a comment from u somewhere about doing it manually - do yu need to grab favicons etc, or do you base64 them? XUL?
AutoCopy 2 1.2.91 - I have saved myself 3.4 zillion Ctrl-C keyboard combos .. now what do? I want auto plain text copy with auto trim()
CacheViewer <IP_ADDRESS>.1-let-fixed - not essential, hardly ever use, but was handy for testing stuff (it read both disk and memory cache)

That's it. Besides NoRedirect and Speed Dial [FVD] .. and I have 400+ speed dials over 10 tabs, godamnit when that has to migrate, but they do have a chrome version that is almost identical

how do YOU add your own engines

Yes, I do it the hard way, manually :) At least I know exactly what's in there then.
And I do b64 the favicons yes, FF makes it quite easy though. You can use the Inspector to do it.

@Roman-Nopantski AutoCopy? But you have setting clipboard.autocopy ;)

Sweet .. so I'll just ditch Add To Search, because that is simply an automated process of what you did, and I doubt they will change - haven;t done anything with em for about a year.

I am not using it, but considering... so not tested yet. ;)

clipboard.autocopy - ummm, user set false. Must be set by the addon. I will play around. As long as sh*t is auto-trimmed (and yes I know there are settings) .. and I want copy as plain text (that's important)

@crssi not using what?

clipboard.autocopy

clipboard.autocopy only has an effect on Linux platforms.

Add to Search Bar 2.9

Yes, sad to see it go too. Fortunately

more and more sites are OpenSearch compatible (green + in search bar -> Add this search engine)
there is http://mycroftproject.com/

So I don't use it as much these days.

Nice approach... autocopy only when long press, to avoid copy when not needed.
https://addons.mozilla.org/en-US/firefox/addon/autocopy-webextensions/
And another with plain text functionality
https://addons.mozilla.org/en-US/firefox/addon/autocopyselection2clipboard/

Ok, so my NoRedirect (clone) is up for Review, currently Queue Position: 343 of 343.

@crssi That first one with the long press looks like complete sh*t. AutocopySelection2Clipboard does the trick, the only problem is it doesn't trim trailing spaces (which means at least two more keyboard commands - and I can do that with Copy Plain Text and Ctrl-C). Not everything I autocopy needs a trim - eg a word for search engine. While it could do with more options, its new, and It will do for now.

Idk for eather or one, didn't tried any... was just intriqued with a long press sulution, since I select many times text just for temporaray mark-up and dont't want to invoke copy to clipboard all the time, since I need what I have in clipboard for other purposes ;)
From: Roman-Nopantski<EMAIL_ADDRESS>Sent: Saturday, March 11, 2017 9:25 AM
To: ghacksuserjs/ghacks-user.js<EMAIL_ADDRESS>Cc: crssi<EMAIL_ADDRESS>Mention<EMAIL_ADDRESS>Subject: Re: [ghacksuserjs/ghacks-user.js] sticky: add-ons (#12)
@crssihttps://github.com/crssi That first one with the long press looks like complete sh*t. AutocopySelection2Clipboard does the trick, the only problem is it doesn't trim trailing spaces (which means at least two more keyboard commands - and I can do that with Copy Plain Text and Ctrl-C). Not everything I autocopy needs a trim - eg a word for search engine. While it could do with more options, its new, and It will do for now.

You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/ghacksuserjs/ghacks-user.js/issues/12#issuecomment-285852446, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AQPEl6LH-qdRplvQQRHcj3FfMDhrkKlEks5rklplgaJpZM4MFX9p.

regarding Smart Referer: my option is to to set the Mode to "Send nothing as referer, looking like a direct hit" and set a whitelist manually:

The syntax can be inferred from the default whitelist

@publicarray You don't need this extension with the latest ghacks user.js, since its working great. ;)

Pants: I have used Smart Referer before and am not convinced of the "smarts"

IMO the smarts look pretty smart.  If you remove the default whitelist, there's no more questionable smarts left that I can see and it's fully user-customizable.
It even allows for from>to. Without having ever used it before, I may give it a try, because I don't see how an addon could get it done any better than what this already does.
Hey mozilla, look there, a great add-on - go kill it ;)

@earthlng  Nice that you will double check... but; I suspect its a waste of time, since no extension can win now over your suggested settings in user.js. :)

@crssi yes, but we do recommend to use an extension as our first and "most recommended" option. But neither me nor Pants are using one. I feel like a preacher who preaches all day long not to drink alcohol, only to go back home in the evening and get completely wasted.

@earthlng LOL... but you did it perfect... isn't best to use extensions only when really needed, otherwise its just a bloat.

@crssi your right I don't need the extension but I do like to have more control and that is exactly what the extension provides. It also leaks a lot less but with more breakage. I'm currently experimenting anyway I might uninstall it it I find it too cumbersome.

@earthlng

Hey mozilla, look there, a great add-on - go kill it :(

Actually It looks like someone has already worked on making it a WebExtention: https://github.com/meh/smart-referer/pull/48

I actually use uMatrix spoof all ATM, but definitely want a better solution - with WE, there will be a wider range of choices from chrome. If something came along that allowed "same-domain" but blocked "cross-origin" with whitelisting.
Also, should we add greasemonkey to the add-ons list with a link to the user scripts?

If something came along that allowed "same-domain" but blocked "cross-origin" with whitelisting.

Oh yeah, that's a good point. Would make it a lot easier to use. I'm sure if someone (#hint) would suggest it,  they could implement that fairly easy.

Also, should we add greasemonkey to the add-ons list with a link to the user scripts?

Yes

Whats with the #hints ... I have to admit they're going right over my head. I added greasemonkey earlier in anticipation of your nod

#hint, as in "someone go file an issue for them to add this feature"
meaning I'm too lazy or can't be bothered to do it myself ;)

Ahh ok. I was looking at the snapshot from @publicarray and there's an option "Treat subdomains as different domains" - which, unless I go an ask I guess, I have no idea if that follows what Francois said about how Mozilla's code determines what is cross-domain and same-domain. I really want the add-on to match FF.

strict mode is explained at example 4 here

I found an extension called Negotiator.
Is is open-source and is available on GitHub: https://github.com/hultqvist/negotiator
The AMO page is here: https://addons.mozilla.org/firefox/addon/negotiator/
I haven't had a chance to fully explore it, but it looks quite powerful.  Negotiator has some functionality overlap with uMatrix, but Negotiator can also handle cookie requests and has other functionality that uMatrix does not include.
Thought you all might be interested.
Disclosure: I am not a contributer. ;)

Clean Links addon removed from AMO.
RIP :(

@jeriko5 Thanks, have amended the list in the first post

Is there addon to change the font fingerprints ID every time when I start the browser?
https://browserleaks.com/fonts

@jeriko5 An .exe fluxfonts
There's a list for ublock origin by fanboy discussed here.

Nope. fluxfonts for windows has many dependencies. Install Visual Studio 2017 with clang is too much.
Fanboy Anti-font Tracking list nothing changes. ID remains the same.

Installing on Windows

Run fluxfonts_installer.exe

Dependencies
https://github.com/da2x/fluxfonts/blob/master/INSTALL

Dependencies are for building from source.
https://ctrl.blog/entry/fluxfonts

I tried fluxfonts a week ago. Nothing works. ID not change.

@jeriko5. First of all, font fingerprinting is about detecting what fonts are on your system. It doesn't send them to you, that's pointless. So differentiate between 3rd party fonts (tracking, eg google's awesomefont) and local ones (FP'ing).
Fanboys font block is not a real solution IMO, for blocking third party fonts. See the wiki entry for uBo about using a global block. THEN, if you wish you can allow them thru for sites you want. 1402 is the entry we have set for allowing glyphs through. That should be the only reason for a third party font - so you can see symbols if you REALLY need to.
As for local fonts: Flash can enumerate them, but FFS, don't use flash. Uninstall it. Otherwise you need to limit the font list available for Firefox to use. Section 1400 is set up to limit fonts to the bare minimum. Seriously, I've been using 3 default fonts for well over a year and I haven't even noticed. Seriously, just disable sites setting fonts. Period. Otherwise you can wait six months to 5 years until the Tor Uplift Project gets around to enforcing and bundling a set of system fonts in 1409.

H-m. That is user_pref("browser.display.use_document_fonts", 0); should be enough?

Just FYI: Fluxfonts will currently only work on linux and Windows 10.  It will not currently work on Windows 7, 8, or 8.1.
See https://github.com/da2x/fluxfonts/issues/6

Can anyone recommend a flexible referer (aka referrer) extension that is e10s-compatible?
The most flexible referer extension is Referrer Control available at: https://github.com/muzuiget/referrer_control

Not updated since early 2015
Unresolved bugs
Not e10s-compatible
Not WebExtension

Next in line is RefControl, available at https://addons.mozilla.org/firefox/addon/refcontrol/

Very popular, but...
Not updated since 2014
Not e10s-compatible
Not WebExtension

Then there is Smart Referer, available at https://github.com/meh/smart-referer

Not updated since 2013
Not e10s-compatible
Not WebExtension

Has anyone found any e10s-compatible extensions that let you control whether or not the referer is sent on a per-domain basis?  IOW, allow referers to be sent from/to sitefoo.com, but not from/to sitebar.com?

I can be wrong but Umatrix has http referrer.

@jeriko5 wrote:
> I can be wrong but Umatrix has http referrer and many other useful functions.
Thanks for pointing that out.  uMatrix does not allow referer control directly within it's matrix (which is really too bad), so I didn't think it handled referers at all.
But you're right, it does have some handling for referers.  I need to dive into its source code to see what it is actually doing, but it might be a possibility.
uMatrix offers a rule to spoof referers, but the UI does not currently have a way to control the data used for the spoof, nor the ability to set it to null.  Once I read the source code, I'll have a better understanding of what it can really do.
Unfortunately, compared to tools like RefControl and Referrer Control, using uMatrix to quickly turn off referer spoofing involves more steps, and is much less obvious.  With those other tools, the user can just click a toolbar button, and instantly all referers are unmodified from the defaults specified by Firefox prefs.  This is real important when a site is not working properly, and the user needs it to work.
That said, I really appreciate you suggestion.  uMatrix is e10s-compatible.  The Firefox version doesn't currently use the WebExtension API, but I believe that is planned.
TL;DR uMatrix is a possibility, but its usability for controlling referers is not up to par with the tools mentioned above.  I also don't think it has the flexibility of the tools mentioned above.  Bottom line: I really appreciate the suggestion from @jeriko5 and definitely welcome additional suggestions.

Update on uMatrix and referers: I performed some testing, and from what I could initially tell (and I prefer to be mistaken), uMatrix does referer blocking sorta backwards.  It seems to only block referers to sites, but not from sites.  Please correct me if I am mistaken.

@Gitoffthelawn what is the problem with Smart Referer? There is code for the web-extension (not published on AMO I think) and even the one that is published on AMO functions fine. BTW the Last commit on github was on Jan 10, 2017.

@publicarray Thank you for posting https://github.com/meh/smart-referer/pull/52
Of all the referer extensions, I'm the least familiar with Smart Referer.  But you may be able to help.
From what I can tell, outside of 3 small commits, it has not been updated since 2013.  But since 2013, Firefox, and how it handles referers (and "secure" referers) has had significant changes.  Is Smart Referer fully functional and compatible when used with the latest Firefox stable release?  Is it compatible with all the new referer prefs that Mozilla has added to Firefox, or does it require them to be set a certain way?
Do you know where the e10s-compatible version of Smart Referer is located?  Has anyone tested it to be e10s-compatible?  https://www.arewee10syet.com/ lists Smart Referer as "unknown".
Where is the source code for the WebExtensions version?
Is there an e10s-compatible way to add a button to toggle Smart Referer on and off?  BTW, if you do fork it, it would be wonderful to have that functionality included.

Gitoffthelawn try this addon No cross-domain referer
https://addons.mozilla.org/ru/firefox/addon/no-cross-domain-referer/

@Gitoffthelawn Thanks, I'll try my best to answer all of your questions :)

From what I can tell, outside of 3 small commits

Yes, I agree the extension could use some love.

Firefox, and how it handles referers (and "secure" referers) has had significant changes.

Yes, but the extension does not use the FF prefs (white-listing would not be possible otherwise) instead it modifies the header directly (the web extension uses browser.webRequest.onBeforeSendHeaders I would assume the legacy extension does it in a similar fashion)

Is Smart Referer fully functional and compatible when used with the latest Firefox stable release?

I use FF nightly and yes no problems so far so I assume it works in stable.

Is it compatible with all the new referer prefs that Mozilla has added to Firefox?

Not sure how this works. I assume the extension has higher priority so your prefs don't matter (I will investigate tomorrow if this is the case)

Do you know where the e10s-compatible version of Smart Referer is located? Has anyone tested it to be e10s-compatible? https://www.arewee10syet.com/ lists Smart Referer as "unknown".

As you can see in the pull request all it takes is to flip the switch so yes the code seems compatible but at the moment it is still using shims: https://developer.mozilla.org/en-US/Add-ons/Install_Manifests#multiprocessCompatible
It looks like arewee10syet.com just lists the value of multiprocessCompatible.

Where is the source code for the WebExtensions version?

https://github.com/meh/smart-referer/tree/wext/webextension

Is there an e10s-compatible way to add a button to toggle Smart Referer on and off?

The web extension has the button by default. I hope it will land on AMO soon :tada:

Sorry for the brief answers but here in Australia it is close to midnight and I need some rest. I'll look into it further tomorrow.

@Gitofthelwan:

From what I can tell, outside of 3 small commits, it has not been updated since 2013.

You were looking in the wrong place :wink:. A rewrite is happening here: https://github.com/meh/smart-referer/tree/wext

But since 2013, Firefox, and how it handles referers (and "secure" referers) has had significant changes.

And none of these changes were actually relevant for Smart Referer…
Please remember that Smart Referer is a very small and intentionally simple add-on. It works, it uses stable APIs there simply wasn't any reason for any huge changes, like… ever.
By far the majority of the maintenance time was also actually spent on the whitelist. Regular commits coming up…

Is Smart Referer fully functional and compatible when used with the latest Firefox stable release?

Yes.

Is it compatible with all the new referer prefs that Mozilla has added to Firefox, or does it require them to be set a certain way?

No idea. I suppose those prefs are applied before the data is passed to the internal network layer? In that case the new Referer-values they set will what Smart Referer considers to be The Truth.

Do you know where the e10s-compatible version of Smart Referer is located? Has anyone tested it to be e10s-compatible? https://www.arewee10syet.com/ lists Smart Referer as "unknown".

On AMO, it NEVER WAS NOT e10s compatible. Just nobody bothered to push a new version that set the flag accordingly, yet.

Where is the source code for the WebExtensions version?

Here: https://github.com/meh/smart-referer/tree/wext
Discussion thread: https://github.com/meh/smart-referer/pull/48

Is there an e10s-compatible way to add a button to toggle Smart Referer on and off? BTW, if you do fork it, it would be wonderful to have that functionality included.

The WExt version includes a button…
Full disclosure: I'm Smart Referer's main contributor and effectively it's only developer since 2015.
I hope that clears some things up for you!

@Thorin-Oakenpants
Smart HTTPS revived is a revised version of Smart HTTPS addon and, is written with the new WebExtensions API.

@Thorin-Oakenpants Thank you for moving the referer discussions into a new issue!  A couple responses got posted here... would you mind moving them to the other issue?
@alexander255 Thank you, thank you for all the great information, and for your continued work on Smart Referer!

:exclamation: Reminder, everything in this thread gets deleted (info is added to the first post). It is only meant for mentioning new or broken add-ons. If you want a discussion, start a new issue.

Disabling Websockets has been removed Firefox 35 but an add-restores its functionality.

// 2620: (35+) disable WebSockets
   // https://developer.mozilla.org/en-US/Firefox/Releases/35
   // user_pref("network.websocket.enabled", false);

The link included in the setting leads to:

The preference network.websocket.enabled, true by default, has been removed; Websocket API cannot be deactivated anymore

I've just discovered a Firefox add-on which states:

As of Firefox 35+, the ability to disable WebSockets through about:config has been removed. This add-on restores the ability to disable WebSockets by removing the WebSocket constructor from the window object. An item is added to the Web Developer menu to toggle this feature.

WebSocket Disabler 0.1.3
And with this latest version 0.1.3 the setting is stored. I've tested it and kept it.

Hey everyone, please only suggest addons that you have tested and are working as expected.
I just tested Negotiator and it has so many errors it's ridiculous!
 Fixed the 1st one, ok, I can now add custom "New action"'s - nice.
Lets see if this works.... nope ... next error pops up immediately. Ok lets fix that one too ....ok nice, one step further but oh wait there's already the next error "trying to access dead object".
If I ever feel like punishing myself I may get back to it and try to fix all the errors but for now I hope the original authors clean it up a bit first.

So we'll refuse the Negotiator and that ain't negotiable!
So true, @earthlng let's never advise an add-on without having tested it ourselves before.

I do not think Smart HTTPS (revived) is a good choice. He for some reason keeps the visited sites in js file. This completely violates privacy so how can you see which sites the user visited. What is the purpose of the creator addon I do not understand.

Yeah, Smart HTTPS is already listed under Rejected. idk why the revived version is under Pending.

I use Smart HTTPS (revived) preferably to HTTPS Everywhere which was my choice until I noticed the increasing number of sites switching to a secured connection.
I had also tested previously Smart HTTPS and I have to say that its revived version is faster.
Smart HTTPS keeps a log of urls it has found not to support https to avoid loosing time on next connections, which is logical. This can be disabled when browsing in private mode, and the log itself may be deleted whenever. I see no problems.

@earthlng , on what basis are add-ons rejected? I read the argument for Smart HTTPS is

This is a  sledgehammer solution (besides other issues).

Sledgehammer? It's liter, faster than HTTPS Everywhere.
Other issues? Which ones?
Frankly we're used to better arguments here.

Sledgehammer - because it attempts to load EVERY SINGLE SITE as https (and I don't care about the local whitelist, that actually defeats the purpose) .. that's a sledgehammer (it has nothing to do with speed). The solution is painfully obvious. HTTPS everywhere will cover most main sites, otherwise it's up to the end user to make sure they bookmark correctly (in case sites don't auto-switch them to https). It's up to the end user to make sure they check the url and have a green padlock. It's up to the end user to take note of warnings about logins on insecure sites. What the F happened to common sense. I do not see an attempt to load https on every single site as being in any way helpful what so ever.

@zymase, Pants is in charge of this issue.

I do not see a difference in the connection speed of Smart HTTPS (revived). But the fact that he is logging the visited sites is a problem. In general, I like the add-on, but the logs discourage the use of it.

Attempting to load every site as https is the very purpose of this add-on.
The http (whitelist) is to avoid opening a page in https when it's been previously refused as such.
I still don't understand where I should find a valid argument in your quasi hatred of this add-on, earthlig.
HTTPS Everywhere lacks to include many sites in its list and includes mistakes in its rules. It is heavy and far less logical than Smart HTTPS when we all know that the sig approach is that of old schemes and that the behavioral approach is smart.

:exclamation: Reminder, everything in this thread gets deleted (info is added to the first post). It is only meant for mentioning new or broken add-ons. If you want a discussion, start a new issue.

in your quasi hatred of this add-on, earthling

What?  and I replied that I don't understand why one is rejected and the other is pending. I never said I liked it or not. And as I said, Pants is the one deciding on rejected, accepted or pending - don't drag me into this, Tom

@earthlng @zymase Sorry about the Negotiator.  I figured anything sponsored by William Shatner would be of higher quality.

My NoRedirect (clone) is up and awaiting review, currently Queue Position: 343 of 343

Only 2 weeks until 53 lands. What's the queue position now? Also, I assume I just remove the original add-on, and then install the clone? Settings are all in extensions.noredirect* prefs

currently Queue Position: 289 of 514

I assume I just remove the original add-on, and then install the clone? Settings are all in extensions.noredirect* prefs

Yes, nothing else changed, prefs remain the same and should work out of the box.
IF the addon ever makes it through Review that is. But hey it's only been 25 days ;)
Negotiator - I really like this addon, it could be the new Modify Headers and compared to that one it can even modify Response Headers. If it would work better in Firefox it could also be a great addon to handle the referer problem. You can also force a header to be added/removed but yeah it needs some work.
Atm the settings are not stored properly. When I add a new action and then later remove it again it doesn't update it and keeps showing that action as an option. The last change on github is 7 months old but I hope the author responds to my Pull Requests. If not I might just have to release my own Firefox-only version.

I'm hanging on the Smart Referrer WE for my solution at this stage (the non WE version will break in 2 weeks - no flag). PS: do you like the new sexy add-ons page look?

do you like the new sexy add-ons page look?

yes, really really nice! I see you found the github emotes :)

With 512 addons awaiting revision maybe they will have to push the deadline to FF54 OR maybe they just wait till after the deadline and can then decline everything that's not a WebExtension - "oh sorry, too late, we had to decline your Review"

lol, I used exactly the same one - am also not exactly familiar with emotes.

^^ GMTA .. now Tom will really think we're the same person

HTTPS by default bad choice. Some sites with it do not open at all and give out an error. Try to open nvidia.ru with it and without it and understand.

@jeriko5 HTTPS by default is not a bad choice, by my means is one of the best choices.
But if you choose to use it, you need to know that when you would like to open a site without SSL, you need to prefix it with http://... and http://nvidia.ru opens just fine with this plugin enabled

It is not right. Extra headache for the user. With the same success you can enter https://www.nvidia.ru/page/home.html.

It is not right. Extra headache for the user. With the same success you can enter https://www.nvidia.ru/page/home.html.

So it did it's job then. It stopped a person going to the non-secure site and make them think .. huh? So hopefully they googled it and got the https, or decided to use a bookmark from now on. Sucks that this example happens to also have a working http page.
Sooner rather than later, chrome and firefox are ramping up the warning about insecure pages. I wouldn't even be surprised if they reversed the behavior of schemeless URLs. The add-on enhances security, period. It cannot decrease it.

Https does not work correctly on nvidia.com. Some pages will still be http. You can write a script for HTTPS-Everywhere to avoid this, but downloading the driver will still be through http.
PS: Even Google gives the http page.

You're missing the point - it enhances security. It is used for schemeless URLs only. Users are not being forced to add it they make a choice and a description was given on our addons page, and the same on the AMO page.

@jeriko5 I would say this addon just isn't for you. Looks like you misunderstood the whole point of this addon.
I am using this addon and this nvidia.com page works as it should here.
The point of this addon is that it uses https where protocol is not prefixed, otherwise follows the links and it works just great as intended.

I know the essence of his work. Here is another example. Nsaneforums.com. The first page opens normally, but all other http. I do not see for myself the benefit of this addon.
I also wanted to say about HTTPS-Everywhere. Developers do it for Tor Browser they do not even hide it. Yes, it can be installed on regular browsers like Firefox, but some rules just will not work and this is normal for them. Also, they are not serious about the possibility of the user installing their own rules. Installing this addon, no one even understands that the folder HTTPSEverywhereUserRules in which the user can put their own rules, malware can use to redirect the user to phishing pages.

https://github.com/ghacksuserjs/ghacks-user.js/issues/12#issuecomment-291557747
Page uses TLS and has mixed content.
http://www.unmaskparasites.com/security-report/?page=www.nvidia.ru
http://resources.infosecinstitute.com/https-mixed-content-vulnerability/

Oh man... https://nsaneforums.com/ is redirected to http://www.nsaneforums.com/ by the web server itself and has nothing to do with this addon. It is the error of www.nsaneforums.com admin.
On the contrary www.nsaneforums.com opens just fine with this addon as secure and without this addon as non secure.

@Thorin-Oakenpants Skip redirects works fine with me 6-7 weeks now. Just saying since its on pending list.
cheers

FYI: All those add-ons (I suppose we should call them extensions when WE is all that is allowed) that want to modify preferences, you know, like Configuration Mania and the like - say bye bye. I've known about this for a while, mentioned it to Earthlng. I guess something could change, but I doubt it. WE API's will not allow access to FF internals. Get ready for the "Rise of the USER.JS"

https://discourse.mozilla-community.org/t/setting-browser-preferences-when-using-webextensions-api/8561
https://bugzilla.mozilla.org/show_bug.cgi?id=1215062
https://bugzilla.mozilla.org/show_bug.cgi?id=1215306

Any objections to adding SSleuth?

SSleuth | GitHub

I only use it for the info, I do not touch the Cipher Suites tab. So it does nothing to enhance security directly, but does of course educate and inform.

Similar add-ons include (not sure if we need everything, and I am sure there are some others)

CipherFox | GitHub

probably duplicates the info SSleuth does?

Cert Viewer Plus

not sure if this adds anything

I am sure there are a few others add-ons whose functionality is to provide security info, rather than actually enforce it.
--
also @earthlng - what about Live HTTP Headers .. maybe we could list items like this and those I just listed above under a subsection called "Add-on Tools": that is, they help see things but don't actually make any changes?

PS: I added github links to a lot of the add-ons in the wiki but a few are missing - let me know if you know them (exclude those listed as "do not recommend these")

what about Live HTTP Headers

sure, they won't last much longer but until then I don't see why we couldn't include this or other such addons

Another option for SSleuth | CipherFox  is Calomel SSL Validation.

+1 SSleuth I like how it can highlight the url bar in green, orange or red based on the score. Another option for a visual indicator is sslpersonas - AMO link - Github link
For Live HTTP Headers FF already can replay and show headers in the Dev console in the networktab:

@Atavic Caromel SSL Validation has no multiprocessCompatible flag and hasn't been updated for 10 months
@publicarray Added SSleuth & SSLPersonas. Not 100% sold on the personas idea myself as (i assume) it won't work with themes - I use FT DeepDark, and could/would clash possibly with using a theme per multiple profiles - but not insurmountable, eg there are other ways to mark your profile visually. But added as it may suit somebody.

FYI, it comes as no surprise that Mozilla has relaxed some of their e10s enforcement.
For details, see https://blog.mozilla.org/addons/2017/02/16/the-road-to-firefox-57-compatibility-milestones/

FF53

Add-ons that are reported and confirmed as incompatible with Multiprocess Firefox (and don’t have the flag set to false) will be marked as incompatible and disabled in Firefox.

So they have dropped that then. Guess we'll find out for sure in a couple days

For Live HTTP Headers, FF already can replay and show headers in the Dev console in the networktab

The NetMonitor doesn't show all requests (fe. the HSTS priming HEAD requests) but the addon does.
And sometimes it's nice to have a way to see all headers in a single place, compared to having to click on each request.

Thanks @earthlng for pointing this out. I did not know that the extension monitors all requests. :)

Stumbled on PrefBar extension a few days ago.
I don't mean that need to be added to add-on list, but by quick overview looks useful, so I decide to mention it just to let you know. ;)

@crssi Excuse my ignorance and lack of time, but what exactly does Skip Redirect do and how would it be useful. Can you give me some real world examples.

Is there any e10s-compatible extension that will add a toolbar button to clear the browser's cache/history/etc?

Not that I know of. I used to use Empty Cache Button until about a year or so ago - it has options for various caches only, but "broke" at some stage

Firefox 32 introduced a new cache engine (HTTP Cache v2).
Version 2.7 of this add-on is updated to work with this new engine, but some features are temporarily disabled (favicon cache, auto-clear and offline cache) and are coming back in next release.

So I ditched it and in fact now just use History>Clear Recent History (options for which is all set up in 2804) and hit enter (the default focus is on the "clear now" button, so no need to click anything).
I have looked before for something more comprehensive/with-options in a button, but not for a while. Meanwhile, my method above is only one extra click (and a keystroke)

Thanks.  I found that note encouraging, but the AMO queue is moving at a snail's pace (assuming it is actually in the queue).  IIRC, I saw that note several weeks ago.  Hopefully it will land sooner rather than later.

Is there any e10s-compatible extension that will add a toolbar button to clear the browser's cache/history/etc?

You could use the built-in "forget" button: https://support.mozilla.org/en-US/kb/forget-button-quickly-delete-your-browsing-history

@fmarier That's very limited (for me) and no way to customize it (err I like keeping my only ever 8 cookies), and eeek .. what's that "close all tabs and windows". I was afraid to hit the proceed button.

Here's a picture comparing the forget button settings and my current settings as per section 2800. They are clearly different. What would be nice is a button that auto cleared with no dialog (just click and forget) a wide range of items that you could configure, such as memory cache, disk cache, favicon shortcut cache, various histories (if they can be split up), cookies, and more (local storage?).

Click&Clean extension does exactly what you want, and can even run an external app when it's toolbar button is pressed.  I have it run a script that deletes more than can even be deleted within Firefox itself.
Sadly, Click&Clean is not marked as e10s-compatible, and is not a WebExtension.
BTW, what are FPI and TBB?

On AMO, is there currently any way to tell if an extension is e10s-compatible?  AMO indicates if an extension is FF57-compatible, but that's different.

FPI (first party isolation) - see sticky number 8 tor uplift
TBB (tor browser bundle) as compared to TOR which is a protocol
e10s compatible - see earthlngs post (its the 2nd or third one here in this issue) - multiprocessCompatible flag

e10s compatible - see earthlngs post (its the 2nd or third one here in this issue) - multiprocessCompatible flag

Unfortunately, AMO is still broken and you can't view the source online.  You currently have to download each extension and manually extract and open the appropriate file to check the flag.  PITA.  I've pinged Mozilla regarding fixing AMO, but they have not replied.

@Gitoffthelawn I was proactive and dumped a list of my add-ons about 6 months ago into a txt file, which I then organized into compatible/incompatible/unknown. I then removed all the stuff I really didn't need - even checking if the dev was going to move to e10s or not. I went from 55 odd down to a current 30 - I used arewee10syet and checked the flags as well, and I know exactly where I am, so I couldn't care less about AMO or about:addons displaying info. I also know exactly what I have as WE (grand total, one extension), so I have that covered as well.
You can always copy and unzip the addon from your profile rather than re-download it. Also, you profile dir will have an extensions.ini file which may be of some help. Pretty useless to me - a lot of addons are listed as guids, and not everything is listed.
Long story short: manually check everything :) have fun

Long story short: manually check everything :) have fun

Ya, that was my conclusion.  Not my idea of fun, but has to be done sooner or later... might as well do it now.  BTW, you notice any big performance difference with e10s enabled?
I created 2 identical profiles with the same extensions.  Intentionally, I enabled e10s in one, and not the other.  I don't notice a big speed difference between the two profiles.  Of course, the potentially increased security model should at least be present.

@Gitoffthelawn .. well I know what is and isn't WebExt .. but here's a list of your legacy addons... go to about:config and look at extensions.xpiState

BTW, you notice any big performance difference with e10s enabled

I do not have e10s enabled yet. I have 2 add-ons holding me up.

NoRedirect (which I will just have to drop)
FVD Speed Dial - they just need to pull finger, they already have a chrome version which is almost identical, and they have 150K+ mozilla users. But THIS is holding me back - I have 300+ speed dials, I use this every day hundreds of times.

well I know what is and isn't WebExt .. but here's a list of your legacy addons... go to about:config and look at extensions.xpiState

Hmmm... that seems to list all extensions, even WE.

What about cookie-autodelete to replace self-destruction cookies?
https://github.com/mrdokenny/Cookie-AutoDelete
https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/
https://www.ghacks.net/2017/05/15/cookie-autodelete-for-firefox-webextension/

^^OMG, this could be perfect. Need only to test if it deletes also "local storage".

Came here to suggest we keep an eye on Cookie-AutoDelete but @logos88 beat me to it.  I have a hard time recommending addons that will not make the jump to WebExtensions, so I've been avoiding Self-Destructing Cookies (author has confirmed it will not be updated) and as for Cookie Controller, I couldn't find any official word about making the transition either on AMO or on the support board; not a good sign.
All this to say that Cookie-AutoDelete is the first cookie manager addon I'm considering adding to my browser

Are We e10s Yet?

Cookie Controller
{ac2cfa60-bc96-11e0-962b-0800200c9a66}
compatible

@Atavic It's not about e10s, but WebExtensions. And yup, I read the ghacks article as well. Still a long way to go til 57, so I'm hoping something decent will pop out.
Personally, I never saw the benefit in SDC. I just block ALL cookies, f*ck em. Then I allow about 20 in total (about 8 permanently for a few login sites or for sticky prefs such as ArsTechnica dark theme, and about 12 as session only to make sites work properly). I use Cookie Controller. So much easier looking after a tiny tiny amount of cookies. FF even allows direct setting in the UI (but for CC you have to set this from the CC interface or it will not work). Cookies are so last century. It's the local dom storage bit that comes with these cookie addons that I'm after.

Some sites just doesn't work if cookies are not enabled.
I am using for non technical users SDC and leave SDC to clean up those cookies and local storage when leaving sites.
This way those sites always works without any user (pay attention to: non technical) intervention with clicking CC to allow.
At this moment WE solution does not clean local storage, but bugs were filled to mozilla.

eCleaner is an WebExtension to delete:
-> Recent Application Cache
-> Recent Browser Cache
-> Recent Cookies
-> Recent Downloads
-> Recent Stored Files
-> Recent Forms
-> Recent History
-> Recent IndexedDB Databases
-> Recent Local Storage
-> Recent Certificates
-> Recent Passwords (dangerous zone!)
-> Recent Plugins' Data
-> Recent Service Workers
It's written by Andy Portmen, who is a talented developer, and a nice guy.  The source is here on GitHub.
I have started to test it out, and I personally don't like the UI, but the extension is a great start in the right direction.  Some of the things it claims to delete I do have to question.  I thought Mozilla hadn't implemented all the needed WebExtension API's yet.  I'm planning on giving it some more testing when (if) I have a little time.

earthlng commented on 10 Mar • edited by Thorin-Oakenpants

Update Sep 20, 2019: Queue Position: 194 of 3478242

LOL! sounds about right :)
update: Queue Position: 34 of 176

@Gitoffthelawn I used Click&Clean. But it seems abandoned.

@Atavic I previously used it as well.  It does seem abandoned, but I hope it is not.
The authors have another extension that has received somewhat recent updates, so that is promising.
One of the great features of Click&Clean is the ability to run an external app/script when Firefox is closed.  Very useful.

update: Queue Position: 34 of 176

So maybe it'll be approved just after 57 lands.
PS: FYI, the resource://URIs ticket has been pushed out to 57 (at earliest), since legacy addons won't be allowed and they are problematic with this, and WebExtensions don't use resource://URIs.

@Thorin-Oakenpants Which extension is at that position in the queue?

Earthlngs repackage https://addons.mozilla.org/en-US/firefox/addon/noredirect-clone/  due to the flag for e10s, which I think is now gonna happen in 55. See the 2nd & 3rd posts in this thread

Since on the Firefox 55 addon "No Resource URI Leak" will no longer work, is there any alternative to it?

Hello,
Your add-on, NoRedirect (clone) <IP_ADDRESS>.1, has been reviewed and did not meet the criteria for being hosted in our gallery.
Comments:
This version didn't pass review because of the following problems:

Unfortunately we do not allow such duplicate add-ons to be hosted, please contact the author to have them update it.

That aside, add-ons with multiprocessCompatible=false will not be allowed in Firefox 55+. If you want to use this for personal use, you are welcome to upload it as self-hosted.

:sadface:

@earthlng Typical. The review process was horribly slow and now they're just writing off non e10s because it's taken them so long
@Rubangol In what way does "No Resource URI Leak" no longer work with F55? The add-on is e10s compatible. It will not be made into a Web Extension due to permissions/security - i.e no access to special schemes. So AFAIK, this is fine until 57, unless I'm missing something.
Ticket 863246 aims to cover the whole chrome:// resource:// issue. Web Extensions cannot use resource URIs (but legacy addons can), so in order to save a lot of issues/hassles/testing, they will not do this before 57. I am hoping it is done in time FOR 57, so we don;t have a gap in coverage

yeah kinda sucks but at least I was still able to get my version signed for "private use" ie "self-hosted".
I can upload it somewhere if you want. The download link to my addon on AMO only seems to work when I'm logged in. Any ideas where one can upload something like that, ideally without needing to register?

So let me get this straight. FF55 (at this stage) will disable legacy addons with no flag? Or will it disable legacy addons that are not e10s?
So your xpi is now "privately" signed. So we can just download a copy and install if from file? So just dump a copy in the root of one of your github repos, or does that break the terms and conditions or something?

The download link to my addon on AMO only seems to work when I'm logged in

https://addons.mozilla.org/en-US/firefox/addon/noredirect-clone/ = internal "Not Found" for me, "We're sorry, but we can't find what you're looking for."

So let me get this straight. FF55 (at this stage) will disable legacy addons with no flag? Or will it disable legacy addons that are not e10s?

I think FF55 will initially disable all addons that aren't e10s compatible but from what I read you can re-enable them. They added a pref in Nightly to re-enable the shim support for non-e10s addons but IDK if that pref will also land in Release. The first 55beta is already out and I'll create a new ToDo issue for that soonish and we will see if that pref shows up there.

So we can just download a copy and install if from file?

Yes

So just dump a copy in the root of one of your github repos, or does that break the terms and conditions or something?

I can do that. One can choose between "listed" and "unlisted". "listed" ones need to be reviewed by Mozilla and will show up on AMO, and "unlisted" ones get auto-reviewed + auto-signed immediately and need to be self-hosted

We're sorry, but we can't find what you're looking for

yeah it's the same for me, even when I'm logged in. The direct link on AMO is only available to me I guess (or maybe other AMO accounts as well IDK).
uploaded here: https://github.com/earthlng/testpages/raw/master/noredirect_clone-<IP_ADDRESS>.1-fx%2Bsm.xpi

Request Control: https://github.com/pyllyukko/user.js/issues/234#issuecomment-308496750

@Rubangol In what way does "No Resource URI Leak" no longer work with F55? The add-on is e10s compatible. It will not be made into a Web Extension due to permissions/security - i.e no access to special schemes. So AFAIK, this is fine until 57, unless I'm missing something.

Ticket 863246 aims to cover the whole chrome:// resource:// issue. Web Extensions cannot use resource URIs (but legacy addons can), so in order to save a lot of issues/hassles/testing, they will not do this before 57. I am hoping it is done in time FOR 57, so we don;t have a gap in coverage
@Thorin-Oakenpants do you test the addon on Firefox 55? The addon itself works but it does not fulfill its functions. Verification through browserleaks.com/firefox proves this.

I don't have 55. https://notabug.org/desktopd/no-resource-uri-leak/issues/14 . Not much I can do about it, sorry.

Wiki section now has a Recommended [Web Extensions] section (at the top). We'll leave the legacy add-ons section. I added two items to it. One of them is Request Cleaner. I have this installed (and it looks powerful) but it comes with SFA rules - and I'm having a really hard time nutting out how to write these.
[Note: Pure URL seems to be broken in FF54+, but Request Cleaner should do the job]
Would it be worthwhile starting a new topic on Request Cleaner rules, and even creating a wiki page for them?
eg: I would like to strip and ?ref off imdb.com/title

http://www.imdb.com/title/tt0083943/?ref_=fn_al_tt_1 => http://www.imdb.com/title/tt0083943/
note though that directly searching from the site uses this http://www.imdb.com/find?ref_=nv_sr_fn&q=firefox&s=all so the rule needs to take that into account eg limit rule to imdb.com/title

I know that example has no privacy/tracking implications, but it's a PITA when copying the url. There are loads of other cases where cleaning is required, but again, really struggling to write these.
Thoughts?

By SFA, are you referring to Super Furry Animals, or something else?
What use cases do you find for it vs using Redirector?
A new topic would be worthwhile.

SFA: Sweet F**K All
I don't use Redirector, which I think I should now add to the wiki, and that too looks like a useful wiki page for "rules"
Or maybe these two extensions are effectively the same? IDK, never used them

Ekk

Unfortunately, this add-on first visits unmodified address, and only if original page loaded, redirects to another page

dev reply

Normally it doesn't send a request to the original address. However, since FF 52 there' this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1345893 which always sends a request to the original url first. It's fixed and should be released in Firefox 55 apparently

re: imdb
Pattern=> scheme: http or http/https host: www.imdb.com path: title/*
Types: Document
Action: Filter
Filter URL Redirection: Off
Trim URL Parameters: ref_
:+1:

Definitely going to have to start up wiki script pages for these two extensions

https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.5-Request-Control
Now because of that CRLF->LF, I cannot get line breaks FFS.

maybe include links to https://github.com/tumpio/requestcontrol/wiki/Testing-page-for-redirection-filtering and https://github.com/tumpio/requestcontrol/wiki/Request-Control-Help

^^ You want to do it? See if you can do normal line breaks and have a play with the format

moz-extension://8103c00c-890a-4648-be34-7bc1c5ae8506/options/help.html = show help on the addon page = same as https://github.com/tumpio/requestcontrol/wiki/Request-Control-Help

Definitely worth looking into its features!

Now because of that CRLF->LF, I cannot get line breaks FFS.

That's the disadvantage of being popular!

Almost nothing in the wiki uses a single line break - everything is paragraphs or bullet points etc with js snippets or pictures or titles etc punctuating everything. To get a single line break, I just need to add two spaces to  the end of the line and then hit enter, unlike
in
here
which is
what
threw me

I've jazzed up the addons wiki page: https://github.com/ghacksuserjs/ghacks-user.js/wiki/Appendix-B:-Firefox-Add-ons
re-ordered the legacy addons and introduced icons for

:green_heart: Web Extension under development
:purple_heart: Web Extension maybe / depends
:broken_heart: Web Extension nah

and have added the links to confirm those icon decisions like this (ie the Web Extension link)

:purple_heart: HTTPS by default | GitHub | Web Extension & Bugzilla
:purple_heart: CanvasBlocker | GitHub | Web Extension
:broken_heart: No Resource URI Leak | Cannot be ported to WE

Still got a few to go. Feel free to help out!

Is there a reason for CanvasBlocker to get "maybe" status?

I pinged QuickJava for an update status.

Sheesh you guys - just click on the links I put in
Also: https://docs.google.com/spreadsheets/d/1TFcEXMcKrwoIAECIVyBU0GPoSmRqZ7A0VBvqeKYVSww/edit#gid=0

Maybe add a link to that spreadsheet somewhere where it won't get lost?

Added Cookie Auto Delete to the wiki. This is starting to look like the bees knees.
I block all cookies, but allow about 10 permanently, and 10 on a session basis (using cookie controller). This has a whitelist (keep) and greylist (keep for session - I think I read that right), so that's covered), and anything else I need to allow a cookie (testing, problem site etc) is auto deleted within a minute (which Cookie Controller never did).
The only downside is no WE API to control local storage yet
I am so looking forward to when all legacy addons are gone, and I get a much faster and stable FF (not that stable has ever been an issue for me). As I've removed legacy addons, I've noticed FF is much more responsive.

Side note: Am down to 22 legacy addons (and 4 WE) - 4 are UI based and I can live without them (CTR, Slim Addons Manager (seriously, how many times do I actually need to go in there), Saved Password Editor, & Findbar Tweak). I'm quite keen to remove them now and start adapting. 2 others will die very soon (NoRedirect which sucks, and Screengrab (fix version) which I should be able to use screenshots - these have no e10s flag and will be fubared). Other than that, nothing really looks like a problem for me in migrating to WE (eg CanvasBlocker and NoResource URI Leak should have their own internal FF solutions in time). There will be a couple of pains, but damn .. can't wait for 57 now.

As I've removed legacy addons, I've noticed FF is much more responsive.

Me too.
I was surprised by how much more responsive FF was when I removed Stylish.  I miss it, but I do notice a substantial difference.  It tried StylRRR (aka StyleRRR) as well, but it still caused some reduction in responsiveness.
The solution was good 'ol userChrome.css and userContent.css.  Not nearly as convenient as Stylish (I do miss Stylish), but no noticeable performance hit.

I still use Stylish - might move to Violentmonkey - still a lot of time left, but if the chrome stylish is anything to go by, fk that s*t. I'm not just removing legacy addons - I'm replacing them - but (core?) FF seems so much more responsive and snappy. I guess it will be more so when I can turn on e10s, and I also shed those UI items such as CTR, and even FT Deep Dark theme.
BTW, yeah, stylish doesn't slow me down - I have zero scripts for * - they are all specific custom tweaks I wrote for specific sites - about 30 of them. I doubt it makes any diff to me speed wise.

doh .. VM is an optional replacement for Greasemonkey, not Stylish :facepalm:

Lol... I was wondering what you were talking about. ;)

@Thorin-Oakenpants and the rest of the motley crew (crue?): You might be interested in https://www.reddit.com/r/firefox/comments/6i1fu2/webext_equivalents_to_legacy_addons/

Modify Header Value web extension - I was just trying it to see if I could alter/strip DNT headers (maybe I'm not doing it right - add works but modify or remove don't). I suspect a user script is still needed to plug navigator.doNotTrack
Object.defineProperty(navigator, 'doNotTrack', {
  value: '',
  configurable: true // necessary to change value more than once
});

or value '0' or undefined (no apostrophies) etc
However both of these don't produce the desired result
With no TP

HTTP Header method to detect Do Not Track

DNT × False

JavaScript ways to detect Do Not Track

navigator.doNotTrack × False (unspecified)

With TP (using script and WE)

HTTP Header method to detect Do Not Track

DNT ✔ False (0)

JavaScript ways to detect Do Not Track

navigator.doNotTrack	× False ()

Anyway, the WE looks worthwhile

Strip DNT headers

You can strip HTTP headers with Privoxy.
Example usage of CLIENT-HEADER-FILTER:
# Hide Tor exit notation in Host and Referer Headers
{+client-header-filter{hide-tor-exit-notation}}
/

Sorry to bump in here @Atavic I just changed the Privoxy link to include https

Referer control is on AMO

Don't know if that one takes place here, but a way to test Chrome extensions :
https://addons.mozilla.org/en-US/firefox/addon/chrome-store-foxified/

Cookie AutoDelete don't allow logins when cookies are disabled
Whitelist a site with Cookie AutoDelete don't allow login when cookies are disabled :
network.cookie.cookieBehavior = 2
I have to set the value "1" to enable login on whitelisted sites.
I supposed this is due to webextension not able to override FF internal preferences / access about:config.
Thus, setting network.cookie.cookieBehavior = 2 allow only to use exceptions in FF cookies settings.
Tested on FF 54.0.1 and Nightly 56.0a1 (2017-07-15)
Do you confirm that, or is there a problem on my side ?

You can't login to any site without cookies. network.cookie.cookieBehavior = 1 is the right choice.

I'm yet to migrate to WE (eg uBo, uM, C-AD etc) and when I do, it will still keep my 56 for fallback/comparisons/testing. So I can't comment on C-AD.
@2glops - have you set a site exception - because FF should obey it's own site permission rules.

You can't login to any site without cookies. network.cookie.cookieBehavior = 1 is the right choice.

soz for the thumbs down (not really :P) .. when will people learn to use SITE EXCEPTIONS .. damnit (won't work if you clear site permissions on close or eg PB mode). Why allow any f**kin cookies by default.  Block em all, default deny-all. As Vizzini would say "INCONCEIVABLE" :)

@Thorin-Oakenpants - have you set a site exception - because FF should obey it's own site permission rules.
Yes,
FF deny all + CAD whitelist = no login allowed anywhere
FF deny all + FF site exceptions = logins OK for site exceptions (no CAD installed)
I'll probably stick with site exceptions and no cookie addon.
Whenever possible, I reduce the addons number.

^^ but if I'm reading this right, your matrix in incomplete: did you try: FF deny all + FF site exceptions + CAD

FF deny all + FF site exceptions + CAD (just installed, no whitelist) = login possible on FF site exceptions

^^ right. So there is your answer.

Block all cookies by default (esp 3rd party as this has other ramifications with access to indexedDB, cache etc).
Allow FF site exceptions for sites you wish to login into or keep settings (eg I keep an ArsTechnica one so I always have the dark theme, I do not login there, I have no account). I don't know about you, but all I have ever needed is about 10 permanent cookies, and 10 session only cookies ever at most - so it shouldn't be too much of a hassle to set them up. FF has two types - allow and allow for session (Cookie Controller has a third called allow first party only)
Fine-tune cleanup with CAD - eg auto-delete non-white/greylists after 1 minute or whatever and other bits and bobs

@Thorin-Oakenpants
Thanks.
Less then 10 site exceptions for me, not too much to settle !
I'll keep CAD to watch what occurs in cookie-land.

Thorin-Smokinpants wrote:

Block all cookies by default (esp 3rd party as this has other ramifications with access to indexedDB, cache etc).

I previously created an issue (https://github.com/ghacksuserjs/ghacks-user.js/issues/159) regarding the ramifications with indexedDB.  What are the cache ramifications?

FYI: CanvasBlocker can be detected by sites
https://github.com/kkapsner/CanvasBlocker/issues/114#issuecomment-295259795

FYI: CanvasBlocker can be detected by sites

@earthlng does your detection test concern only the CanvasBlocker add-on or does it detect the fact canvas is blocked, whatever the blocker? I am wondering if the other similar FF add-on, Canvas Defender would be detected by your test, and is it detected by other sites as CanvasBlocker is.

@zymase Canvas Defender is not detected.

OK, @Gitoffthelawn .
Just wondering : earthlng's detection test mentions, here with CanvasBlocker:
    function length: CB detected
    function name: CB not detected
    error provocation 1: CB not detected
    error provocation 2: CB not detected
    error provocation 3: CB not detected

I guess the result is all in function length?

Hmmm ... your test says I do not have canvas blocker, and yet .. I do

This sticky addon for SUGGESTIONS is going to become out of control. Take this to a new topic please

moved it to a new issue https://github.com/ghacksuserjs/ghacks-user.js/issues/174 and deleted the comments from this issue. sorry Pants for going offtopic ;)

^^ this is what i didn't want
x - Thorin-Oakenpants deleted a comment from Rubangol 3 hours ago
x - earthlng deleted a comment from zymase 2 hours ago
x - earthlng deleted a comment from Gitoffthelawn 2 hours ago
x - earthlng deleted a comment from zymase 2 hours ago
We'll end up with hundreds of these over time. These never used to appear, it started about 4 or 5 weeks and there is no setting it seems to turn it off. Now I have trouble keeping a couple of stickies clean after suggestions etc have been dealt with.
Note: If you delete your own message this transparency does not show. I'd rather edit the message and replace it completely with "please delete, item dealt with", and you can self clean. IDK. Stickies like this are not fit for purpose anymore

@Gitoffthelawn @earthlng @publicarray @Atavic @2glops can you please clean out your posts which have been dealt with - they are all marked as "delete me". @earthlng : could you combine your posts into the first one re your clone add-on. Dont forget the link to it on github. Thanks guys (and gals)

Web Extension : Smart HTTPS (revived)
https://addons.mozilla.org/en-US/firefox/addon/smart-https-revived/
Tested on Nightly, performs well.

The problem with Smart HTTPS (revived or plain) is that it won't handle cross-site calls performed from a non-secured site.
Consider, i.e, http://www.cartesfrance.fr/
The site is not secured and calls sites of which some available in https : SmartHTTPS calls those sites in http (doesn't interfere in fact, when the page coder chose http and not https to call those sites) ... but HTTPSEverywhere calls those sites in https because it has rules for those...

@zymase
Good point ! I missed that one.

note: added eCleaner (Forget Button) to wiki

No Resource URI Leak looks like on Firefox 55 does not fulfill its functions. For me it's a huge hole in privacy. What alternatives are there?

@rebrovov I don't think there are real alternatives.
The bug about Firefox 55 has been opened by someone 3 months ago but it seems he got no response.
https://notabug.org/desktopd/no-resource-uri-leak/issues/14
You have 2 points from what I understand.

You go with ESR and test if that still works.

You use NoScript and it should block the browser leaking info.

You could stay with FF54 but that would expose you to other problems.

@rebrovov @EchoDev
https://github.com/ghacksuserjs/ghacks-user.js/issues/7#issuecomment-319802762

@EchoDev Nope. NoScript not block browser leaking info. He just blocks JS which does not allow to read the information. You can not completely disable JS on all sites. Especially since I prefer uMatrix. If earthlng does not post the corrected version, I'll go to the ESR.

From wiki link, it seems some patches are on the way :
https://bugzilla.mozilla.org/show_bug.cgi?id=863246
But will certainly not be ready for FF55.


Handle tombstone in ledger updates

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

@howardjohn: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
8819e134fb5f1ab6e0072c30e4979e41fae20050
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@howardjohn: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
8819e134fb5f1ab6e0072c30e4979e41fae20050
link
/test lint_istio

gencheck_istio
8819e134fb5f1ab6e0072c30e4979e41fae20050
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.


Error when using xgb.plot.tree: Assertion failed

Hello,
I wanted to visualize my model trees with:
xgb.plot.tree(model = mod.y, feature_names = mod.y$feature_names)
and I got this error in the View pane of RStudio:
Assertion failed: font->name, at: textspan.c,206,textspan_size at Error
    at Ga (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:49:124)
    at Fa (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:49:22)
    at ___assert_fail (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1140:116)
    at $B (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1158:126815)
    at vz (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1160:88229)
    at mz (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1160:83388)
    at nz (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1160:84583)
    at EC (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1158:136028)
    at Ff (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1157:95783)
    at Lf (http://localhost:14267/session/viewhtml18fb3fdf9d10/lib/viz-0.3/viz.js:1157:100587)

Could you provide a reproducible script, also the used XGB version?

Stalled


UseRateLimit not applying to Endpoint for different types of messages.

Contact Details
No response
Version
8.x
On which operating system(s) are you experiencing the issue?
Windows
Using which broker(s) did you encounter the issue?
RabbitMQ, In-Memory
What are the steps required to reproduce the issue?
1. Send multiple different messages to a consumer

What is the expected behavior?

I'm applying the UseRateLimit configuration to the Endpoint so that my MessageConsumer will only process 1 message every 5 minutes. So when I send 3 messages to the consumer it should take 5 minutes to consume each message.

What actually happened?
When I send 2 MessageAlpha messages and 1 MessageBeta message, 1 MessageAlpha and 1 MessageBeta message get consumed immediately then it waits another 5 minutes to consume the 2nd MessageAlpha  message.
From my understanding then I'm applying the UseRateLimit to the endpointConfiguration instead of the consumerConfiguration it should restrict the consumer to 1 message / 5 minutes regardless of the message type.
Related log output, including any exceptions
No response
Link to repository that demonstrates/reproduces the issue
https://github.com/jgozner/MassTransit-Test

Rate Limit is an older filter, so if you're configuring on an endpoint, you'd need to add it prior to the message type split, similar to how it's shown below:
endpointConfigurator.AddPrePipeSpecification(new RateLimitPipeSpecification<ConsumeContext>(1, TimeSpan.FromSeconds(5)));

I see, I couldn't find this information in the MassTransit documentation. Can I create a PR to add this information for future people?

For the documentation? Sure.

@phatboyg I am using rate limit on my subscription endpoint using the method subscriptionEndpointConfigurator.UseRateLimit(). While it is applying the rate limit successfully, it gives message lock expired error for few messages when it cross the lock duration.
Does it mean that the rate limit applies after the message is locked by consumer ? Ideally I am expecting the message to be locked only after it is rate limited and picked by consumer.


Improve AWS VPC support.

If we are in a VPC there is a very good chance we will not have a public dns name. Now we can fall back to the private dns name if there is no public one.

Found in housekeeping pass and cloud provisioner is deprecated.


Avoid negative numbers on frontend and backend

Input takes number from 1. And also backend check request and return error message if number is not above 0.

@miso33 Thank you for contributing to the repo. I hope your first contribution experience was great 🎉.

This solves #1

BTW, if you are interested in similar project, checkout https://github.com/parthpandyappp/Classroom. We are trying to make open source alternative to google classroom using Django. If you are interested please find discord invite link in the README. Let me know if you are interested to work on this.


⚠ Bofrost.fr has degraded performance

In 0bd35b0, Bofrost.fr (https://www.bofrost.fr) experienced degraded performance:

HTTP code: 200
Response time: 1416 ms

Resolved: Bofrost.fr performance has improved in da7bdbf after 12 minutes.


Merge master-qa

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.2 out of 3 committers have signed the CLA.:white_check_mark: jerome-benoit:white_check_mark: LucasBrazi06:x: mariansalcedaYou have signed the CLA already but the status is still pending? Let us recheck it.


Add bazel BUILD file for nanopb.

Is it possible to have the BUILD file in a subdirectory, or would that cause problems?

It would be best to put it under the top directory. Is there any particular reason to put it in a subdirectory?

Mainly just that there are dozens of different build systems, so the top directory will easily be filled with files that are relevant to only a small number of people. But I guess that is not a big problem yet, I'll have to think about it later.


Sourcemap conflict with Susy

Check my example repo with the error case:
https://github.com/Tibicenas/gulp-susy_scss
RIght now the example in the repo crash,
events.js:85
      throw er; // Unhandled 'error' event
            ^
Error: "/bower_components/susy/sass/susy/output/support/_rem.scss" is not in the SourceMap.

but If i  comment in gulp file the three lines about source maps everything works and
on the other hand,  if i comment the susy import in /scss/layouts/grid.scss    everything works too
So, its some conflict between Susy and Sourcemaps.

+1

+1

+1

+1

+1

Conflict between Foundation 6 and Sourcemaps too !

+1

+1

+1

+1

Just came across this issue, if you replace sourcemaps.write with this in your gulp file it should ignore the @import. Changing sourceroot depending on your project.
.pipe(sourcemaps.write({includeContent: false, sourceRoot: '/app'}))
see 'write options' here for more details: https://github.com/floridoo/gulp-sourcemaps

@CalumBaines thanks, I'll give it a shot here in a few and let you know.

@CalumBaines this doesn't work, even though the error is no longer displayed, the sourcemap not showing correct stylesheets now.

This issue is old, but I did manage to get your repo working again with quite of few bugs in it . I targeted it against 1.9.1 and got.
╰─⠠⠵ gulp
[01:15:30] Using gulpfile ~/code/github/thirdparties/gulp-susy_scss/gulpfile.js
[01:15:30] Starting 'sass'...
[01:15:30] Starting 'watch'...
[01:15:30] Finished 'watch' after 36 ms

events.js:141
      throw er; // Unhandled 'error' event
      ^
Error: Unsupported source map encoding charset=utf8;base64
    at PreviousMap.decodeInline (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/previous-map.js:69:19)
    at PreviousMap.loadMap (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/previous-map.js:89:25)
    at new PreviousMap (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/previous-map.js:31:25)
    at new Input (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/input.js:39:19)
    at Object.parse [as default] (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/parse.js:17:17)
    at new LazyResult (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/lazy-result.js:54:42)
    at Processor.process (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/postcss/lib/processor.js:30:16)
    at DestroyableTransform._transform (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/gulp-autoprefixer/index.js:24:5)
    at DestroyableTransform.Transform._read (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/readable-stream/lib/_stream_transform.js:184:10)
    at DestroyableTransform.Transform._write (/Users/nem/code/github/thirdparties/gulp-susy_scss/node_modules/readable-stream/lib/_stream_transform.js:172:12)

Closing this because that project looks dead (last commit in Aug 2015)


No newlines when executing "gradle --version" (windows)

When I run gradle --version with a nightly version on windows the output is missing newlines.
If I explicitly set --console plain then the output is correct.
Expected Behavior
>gradle -version

------------------------------------------------------------
Gradle 3.6-20170309000026+0000
------------------------------------------------------------

Build time:   2017-03-09 00:00:26 UTC
Revision:     67719c34af2ccbff7add98fe659e26ada7ea2391

Groovy:       2.4.9
Ant:          Apache Ant(TM) version 1.9.6 compiled on June 29 2015
JVM:          1.8.0_112 (Oracle Corporation 25.112-b15)
OS:           Windows 10 10.0 amd64

Current Behavior
>gradle -version
 ------------------------------------------------------------
                                                             Gradle 3.6-20170309000026+0000
                                                                                ------------------------------------------------------------

 Build time:   2017-03-09 00:00:26 UTC
                                      Revision:     67719c34af2ccbff7add98fe659e26ada7ea2391

                                                                                Groovy:       2.4.9
                                                                                Ant:          Apache Ant(TM) version 1.9.6 compiled on June 29 2015
                            JVM:          1.8.0_112 (Oracle Corporation 25.112-b15)
                                                                                OS:           Windows 10 10.0 amd64

Your Environment
Nightly build (3.6-20170309000026+0000)
Windows Command Prompt

Thanks a lot @rbaradari for this issue. It is, in fact, a issue related to the new console. Fortunately, PR https://github.com/gradle/gradle/pull/1462 fixes this problem. We will see to merge the PR and fix your issue in the process.
Could you tell us which version of Windows are you using to get this behavior? This would help us ensure no additional issue is introduced.

This is now fixed in master and will be included in the next nightly. I will close the issue. If you see the problem again, reopen the issue so we can prioritize the work.


feat: start new design

https://www.figma.com/file/62ByqrNpfWiNRXeBJQbZmH/TJCSC?node-id=0%3A1
https://github.com/TJCSec/website/projects/1#card-51762432
https://github.com/TJCSec/website/projects/1#card-51758981

subtitle is a little large

Maybe slightly increase margin between items on the right side of the navbar

I think one final minor change is maybe decrease the padding on the mobile - text is dangerously close to overflowing on iPhone-6 sized device, and will probably overflow on an iPhone 5 or smaller (not that anyone uses em)

Otherwise, I think the homescreen follows the mockup nicely

I think there should be some additional content about the club as a whole (officers, what we do, etc), and CTA can just scroll down

Yeah we can have another section within the home route for club-info/QA/officers, I'll make sure to add it in the figma tomorrow

Seems all good to me


update description of directory structure

Seems the directory structure has changed and the description is out of date

This part of the readme went away with the latest website redo. Sorry for any confusion this called and thank you for the PR!