Hacker News Reader

evilpieon The woes of sanitizing SVGs

The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by default.

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...

evilpieon Firefox Has Integrated Brave's Adblock Engine

> The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with.

> - We are not, and have no plans to abandon MV2 extensions. This will ensure certain types of add-ons, like ad-blockers, continue to work best in Firefox.

> - Firefox supports several ad-blockers as add-ons on Desktop and Android, including uBlock Origin.

> - We are not bundling Brave's ad-blocking system, we're testing one of their open source Rust components to improve how Firefox processes tracker lists.

https://www.reddit.com/r/firefox/comments/1sttf82/firefox_wi...

This is what the official Firefox account had to say when this came up on reddit.

evilpieon Making Firefox's right-click not suck with about:config

Yes. It's in about:keyboard.

evilpieon Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148

You aren't reading it right.

  new Sanitizer({})

This Sanitizer will allow everything by default, but setHTML will still block elements/attributes that can lead to XSS.

You might want something like:

  new Sanitizer({ replaceWithChildrenElements: ["h1"], elements: [], attributes: [] })

This will replace <h1> elements with their children (i.e. text in this case), but disallow all other elements and attributes.

evilpieon Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148

Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.

evilpieon Firefox 148 Launches with AI Kill Switch Feature and More Enhancements

We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)

evilpieon Element: setHTML() method

If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.

evilpieon Element: setHTML() method

We enabled this by default in Firefox Nightly (only) this week.

evilpieon Firefox tab groups are here

Make sure you have Firefox 138! From the release notes: > You can also now reposition a tab group on the tab bar by dragging it.

evilpieon Hardening the Firefox Front End with Content Security Policies

Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.

https://extensionworkshop.com/documentation/publish/add-on-p...

evilpieon Hardening the Firefox Front End with Content Security Policies

While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security.

For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...

evilpieon Firefox tracks you with “privacy preserving” feature

If it's disabled (greyed-out), then you already have telemetry disabled.

evilpieon Show HN: Tiny Chrome extension to disable images to reduce distractions

Firefox also has the about:config preference permissions.default.image: 2, which will block most images.

evilpieon Cross My Heart – A Frogger Demake in 256 Bytes of HTML/JS

The profile actually shows the freeze is not caused by normal JS garbage collection, but by cycle collection. So probably something related to DOM nodes.

evilpieon Flashpoint Archive

See also https://ooooooooo.ooo/. "9o3o is an official (but experimental) online version of the Flashpoint Archive."

evilpieon Fritzbox: AVM is threatened with a sales ban due to violations of Huawei patents

https://www.pcgameshardware.de/Internet-Thema-34041/News/AVM...

Also one of the headings was mistranslated horribly.

In linked the article: "AVM threatens to ban the sale of Fritzbox routers". The original in German: "AVM droht Verkaufsverbot für Fritzbox-Router". Right translation is roughly: "AVM is threatened with a ban on the sale of Fritzbox routers".

evilpieon Half-Life: 25th Anniversary Documentary [video]

See also Dario Casali's Half Life 25yr anniversary playthrough: https://www.youtube.com/playlist?list=PLk5gaNp4x_AVIJviyHueH...

evilpieon Firefox desktop extensions coming soon for the upcoming Android release

Igalia is regularly contracted to work on new Firefox features, so this is already happening.

evilpieon Firefox 115 Now Available with Intel GPU Video Decoding on Linux

[deleted because I don't to be accused for ragebaiting]

evilpieon More malicious extensions in Chrome Web Store

As far as I can tell from my own recommended extensions is that every update needs to be approved/reviewed before it's made generally available.

evilpieon TabFS – a browser extension that mounts the browser tabs as a filesystem

> And it doesn't even tell you that it doesn't accept unsigned extensions, they claim that the extension is "broken".

It's likely you forgot to include the browser_specific_settings with a some arbitrary id in the manifest.json.

Permanently installing unsigned extensions definitely works in the Developer Edition after setting the pref in about:config.

evilpieon What’s going on in the world of extensions

This doesn't really affect blocking requests in any way, actually it's the opposite: This change doesn't allow extensions to bypass builtin security features.

Firefox is going to continue to have more powerful blocking features compared to what a DNS based approach like pihole can provide.

evilpieon What’s going on in the world of extensions

Did you ever get around to communicating your use-case to the developers?

evilpieon How the clipboard works

> Type starting with x- are non-standard. x-moz- means it’s a mozilla-defined one. There seems to be no standard mime type for a URL

The standard web MIME for url(s) is text/uri-list: https://www.rfc-editor.org/rfc/rfc2483#section-5

evilpieon YouTubePluginReplacement.cpp: YouTube-specific code in WebKit

Firefox will also rewrite YouTube embeds: https://searchfox.org/mozilla-central/rev/c6d17806faef8708b6....

Firefox also ships a "system" add-on (https://github.com/mozilla-extensions/webcompat-addon) that has interventions and user-agent overrides for many websites. See for yourself in Firefox on about:compat.

evilpieon React PDF Viewer

Seems like they don't mention that fact anywhere in the readme or homepage.

evilpieon Retrospective and technical details on the recent Firefox outage

The actual bug was in the C++ code handling the Content-Length header (https://hg.mozilla.org/integration/autoland/rev/48c0e854be62...) and the Rust code just happened to be first to trigger it.

evilpieon US puts NSO Group on trade blacklist

I was wondering if the recent falling out with France had something to do with it. Maybe this is a cheap way to earn some points with Macron after NSO was caught potentially? spying on him/his government.

evilpieon Firefox 94

Congrats to the team on shipping site isolation. This required a lot of work on very fundamental parts like frame/page loading.

evilpieon Firefox 93

All the bugs you linked are marked as fixed, so unless you open a new bug with clear steps of reproducing your specific issue, it's probably never going to happen.