October 2011 - Dillo-dev - lists.mailman3.com

Digest authentication

by corvid＠lavabit.com

furaisanjin wrote: > The problems of my DVD recorder are > 1 it doesn't allow extra space characters between '='. My impression has been that rfc 2617, following rfc 2616's rules, permits implied linear whitespace in such places. But we can take the spaces out. > 2 uri needs to have quote I was sure this was wrong. And it turns out that this is in the errata (http://www.rfc-editor.org/errata_search.php?rfc=2617) 'Errata ID: 2600 Status: Verified Type: Technical Reported By: Victor S. Osipov Date Reported: 2010-11-02 Verifier Name: Peter Saint-Andre Date Verified: 2011-07-14 Section 3.2.2 says: digest-uri = "uri" "=" digest-uri-value digest-uri-value = request-uri ; As specified by HTTP/1.1 It should say: digest-uri = "uri" "=" <"> digest-uri-value <"> digest-uri-value = request-uri ; As specified by HTTP/1.1 Notes: This is an error here that the digest-uri-value is not enclosed in quotation marks' > 3 the order of parameter seems to have strict rule (username, realm, > nonce, uri, cnonce, nc, algorithm, response, qop) > > Both IE and firefox follow 1 and 2 but only IE follows 3. We could try it and see whether all of the stupid software (or at least most of the stupid software) likes that order.

Oct. 11, 2011

Digest authentication

by furaisanjin＠gmail.com

Sorry about confusion. 2011/10/11 corvid <corvid at lavabit.com>: > furaisanjin wrote: >> 2011/10/11 corvid <corvid at lavabit.com>: >> > Is there a site that isn't working? >> >> http://x68000.q-e-d.net/~68user/net/sample/http-auth-digest/secret.html >> >> This is just a test page and user name is hoge and password is fuga. > > It seems to work for me. I give user and pass, and then it shows me > a page with "Digest" and some Japanese text that I don't know how > to read. Originally I detected digest authentication problem with my DVD recorder. I put some debug code to see the behavior but I put extra quote like algorithm="MD5". This caused the problem to access the page mentioned above. >> > a_Digest_compute_digest() calculates A1 for MD5 and MD5-sess, >> > but I disabled digest auth for MD5-sess in >> > Auth_parse_digest_challenge_cb() because >> > http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#authdigestalgorit… >> > said "MD5-sess is not correctly implemented yet", which prevented >> > me from giving it much testing. >> >> RFC 2617 (http://www.faqs.org/rfcs/rfc2617.html) mentions how A1 is >> calculated in 3.2.2.2 and MD5-sess >> requires more parameters and A1 is calculated only once but A1 is also >> calculated for MD5 and none >> specified algorithm. > > This is what a_Digest_compute_digest() does. Yes, I was looking at wrong place. The problems of my DVD recorder are 1 it doesn't allow extra space characters between '='. 2 uri needs to have quote 3 the order of parameter seems to have strict rule (username, realm, nonce, uri, cnonce, nc, algorithm, response, qop) Both IE and firefox follow 1 and 2 but only IE follows 3. Regards, furaisanjin

Oct. 11, 2011

Digest authentication

by corvid＠lavabit.com

furaisanjin wrote: > 2011/10/11 corvid <corvid at lavabit.com>: > > Is there a site that isn't working? > > http://x68000.q-e-d.net/~68user/net/sample/http-auth-digest/secret.html > > This is just a test page and user name is hoge and password is fuga. It seems to work for me. I give user and pass, and then it shows me a page with "Digest" and some Japanese text that I don't know how to read. > > a_Digest_compute_digest() calculates A1 for MD5 and MD5-sess, > > but I disabled digest auth for MD5-sess in > > Auth_parse_digest_challenge_cb() because > > http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#authdigestalgorit… > > said "MD5-sess is not correctly implemented yet", which prevented > > me from giving it much testing. > > RFC 2617 (http://www.faqs.org/rfcs/rfc2617.html) mentions how A1 is > calculated in 3.2.2.2 and MD5-sess > requires more parameters and A1 is calculated only once but A1 is also > calculated for MD5 and none > specified algorithm. This is what a_Digest_compute_digest() does.

Oct. 10, 2011

Digest authentication

by furaisanjin＠gmail.com

2011/10/11 corvid <corvid at lavabit.com>: > Is there a site that isn't working? http://x68000.q-e-d.net/~68user/net/sample/http-auth-digest/secret.html This is just a test page and user name is hoge and password is fuga. > a_Digest_compute_digest() calculates A1 for MD5 and MD5-sess, > but I disabled digest auth for MD5-sess in > Auth_parse_digest_challenge_cb() because > http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#authdigestalgorit… > said "MD5-sess is not correctly implemented yet", which prevented > me from giving it much testing. RFC 2617 (http://www.faqs.org/rfcs/rfc2617.html) mentions how A1 is calculated in 3.2.2.2 and MD5-sess requires more parameters and A1 is calculated only once but A1 is also calculated for MD5 and none specified algorithm. Regards, furaisanjin

Oct. 10, 2011

Digest authentication

by corvid＠lavabit.com

furaisanjin wrote: > It seems that current digest authentication doesn't supportsA1 > calculation. Is there any plan when this is implemented? Is there a site that isn't working? a_Digest_compute_digest() calculates A1 for MD5 and MD5-sess, but I disabled digest auth for MD5-sess in Auth_parse_digest_challenge_cb() because http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#authdigestalgorit… said "MD5-sess is not correctly implemented yet", which prevented me from giving it much testing.

Oct. 10, 2011

Digest authentication

by furaisanjin＠gmail.com

Hi all. It seems that current digest authentication doesn't supportsA1 calculation. Is there any plan when this is implemented? Regards, furaisanjin

Oct. 10, 2011

Dillo review article

by rogerx.oss＠gmail.com

> If the tools menu holds a "My CSS" menu entry, holding a list >of custom style sheets (.css files in ~/.dillo/), and allowing to >apply it on-the-fly (similar to "Panel Size"), it would be quite >handy. The only real use I see with different styles are those whom work at night, or are just light sensitive (AKA old age) like me. (Aside from those that want pretty colors.) > We may include some pre-made ones, as the dark background Rogut >suggested (readability), larger font, etc. <shrugs> I'm still using the suggested dark style css posted to this thread. Haven't had any issues with it yet, else I would have switched back to default. One issue I recall now, there is a flash of total white background on page reload. If any page flashing, should use the default background color within the style css settings. >> [...] >> When browsing at night, I sometimes use the following snippet with >> Firefox. Works with dillo too. Colors could use some tweaking. >> >> * { >> font-family: 'M+ 1p' !important; >> background:#1E2426 !important; >> color:#C7C7C7 !important; >> border-color:#6B8299 !important; >> border-width:0.1em !important; >> } >> a { color:#C17B6C !important; } >> hr, h1, h2, h3, h4 { margin-bottom:0.2em !important; } >> th, td { padding:0.1em !important; } >> a { text-decoration:underline !important; border:none !important; } >> a:hover { text-decoration:none !important; } >> input, select, button, textarea { color:#548A1E !important; } > > Just appended this line: > > :visited {color: #008080 !important} > > to it. Yea, the links can be tricky when changing colors. -- Roger http://rogerx.freeshell.org/

Oct. 10, 2011

Dillo review article

by jcid＠dillo.org

On Fri, Oct 07, 2011 at 11:05:03AM +0300, Rogut??s Sparnuotos wrote: > Roger (2011-10-06 19:59): > > > On Thu, Oct 06, 2011 at 08:24:18PM +0000, corvid wrote: > > >Roger wrote: > > >> 2) Should there be at least a style.css template file within the tarball doc > > >> folder for users to play with? This is an interesting idea... Funny how the article was able to make us (in dillo-dev) put some atention in style.css again. I just discovered that the file is re-read each time. There's no need to load another dillo to test changes to it. Just reload the page you're viewing. If the tools menu holds a "My CSS" menu entry, holding a list of custom style sheets (.css files in ~/.dillo/), and allowing to apply it on-the-fly (similar to "Panel Size"), it would be quite handy. We may include some pre-made ones, as the dark background Rogut suggested (readability), larger font, etc. > [...] > When browsing at night, I sometimes use the following snippet with > Firefox. Works with dillo too. Colors could use some tweaking. > > * { > font-family: 'M+ 1p' !important; > background:#1E2426 !important; > color:#C7C7C7 !important; > border-color:#6B8299 !important; > border-width:0.1em !important; > } > a { color:#C17B6C !important; } > hr, h1, h2, h3, h4 { margin-bottom:0.2em !important; } > th, td { padding:0.1em !important; } > a { text-decoration:underline !important; border:none !important; } > a:hover { text-decoration:none !important; } > input, select, button, textarea { color:#548A1E !important; } Just appended this line: :visited {color: #008080 !important} to it. -- Cheers Jorge.-

Oct. 9, 2011

Dillo review article

by rogerx.oss＠gmail.com

> On Fri, Oct 07, 2011 at 11:05:03AM +0300, Rogut?s Sparnuotos wrote: >Roger (2011-10-06 19:59): >> > On Thu, Oct 06, 2011 at 08:24:18PM +0000, corvid wrote: >> >Roger wrote: >> >> 2) Should there be at least a style.css template file within the tarball doc >> >> folder for users to play with? >> > >> >What would be interesting to have in a sample style.css? >> >All I have in mine is...let's see... >> >":link, :visited {text-decoration: underline !important}" >> > >> >Colors, maybe... >> >> Just my thoughts on this, I don't customize the layouts much from the >> default as page formating gets screwed-up when viewing heavily formated >> websites. ie. CNN, FoxNews, ... >> >> In the past, I tried formating pages to use light fonts on a dark >> background, but as stated above, I would always encounter problems with >> other websites page colors. Since trying this 5+ years ago, just gave >> up and decided viewing the page as it was intended. Also conflicts if >> the user tries to print the page too. >> >> As such, we can see why styles.css obviously doesn't get much attention >> due to the above issues. And for resolving screen brightness when I >> have a headache, I just use a CLI browser called ELinks. > >When browsing at night, I sometimes use the following snippet with >Firefox. Works with dillo too. Colors could use some tweaking. > >* { > font-family: 'M+ 1p' !important; > background:#1E2426 !important; > color:#C7C7C7 !important; > border-color:#6B8299 !important; > border-width:0.1em !important; >} >a { color:#C17B6C !important; } >hr, h1, h2, h3, h4 { margin-bottom:0.2em !important; } >th, td { padding:0.1em !important; } >a { text-decoration:underline !important; border:none !important; } >a:hover { text-decoration:none !important; } >input, select, button, textarea { color:#548A1E !important; } > >-- >-- Rogut?s Sparnuotos Tested here and it looks pretty good to put a commented section like this within the style.css file. The snippet above could use some comments within each statement though, so a user can modify the background and font colors at first glance here though. (In other words, I've seen some really nice commented xml/css stylesheets from News sites which I could easily read. ;-) -- Roger http://rogerx.freeshell.org/

Oct. 7, 2011

Dillo review article

by rogutes＠googlemail.com

Roger (2011-10-06 19:59): > > On Thu, Oct 06, 2011 at 08:24:18PM +0000, corvid wrote: > >Roger wrote: > >> 2) Should there be at least a style.css template file within the tarball doc > >> folder for users to play with? > > > >What would be interesting to have in a sample style.css? > >All I have in mine is...let's see... > >":link, :visited {text-decoration: underline !important}" > > > >Colors, maybe... > > Just my thoughts on this, I don't customize the layouts much from the > default as page formating gets screwed-up when viewing heavily formated > websites. ie. CNN, FoxNews, ... > > In the past, I tried formating pages to use light fonts on a dark > background, but as stated above, I would always encounter problems with > other websites page colors. Since trying this 5+ years ago, just gave > up and decided viewing the page as it was intended. Also conflicts if > the user tries to print the page too. > > As such, we can see why styles.css obviously doesn't get much attention > due to the above issues. And for resolving screen brightness when I > have a headache, I just use a CLI browser called ELinks. When browsing at night, I sometimes use the following snippet with Firefox. Works with dillo too. Colors could use some tweaking. * { font-family: 'M+ 1p' !important; background:#1E2426 !important; color:#C7C7C7 !important; border-color:#6B8299 !important; border-width:0.1em !important; } a { color:#C17B6C !important; } hr, h1, h2, h3, h4 { margin-bottom:0.2em !important; } th, td { padding:0.1em !important; } a { text-decoration:underline !important; border:none !important; } a:hover { text-decoration:none !important; } input, select, button, textarea { color:#548A1E !important; } -- -- Rogut?s Sparnuotos

Oct. 7, 2011