- Dillo-dev - lists.mailman3.com

valgrind
by onepoint＠starurchin.org May 23, 2015

May 23, 2015

eocene wrote: > I note the logs still say > > date: Tue Apr 28 21:42:28 2015 +0000 > summary: BUG_MSG > > Are the https changes not playing well with your setup? Something has broken my hg access. I just noticed that my hg update job has been failing for a while, but I haven't made any changes to it ages. $ hg incoming abort: error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581) Can anyone help? Jeremy

2 2

not following 301 Moved Permanently
by dennisn＠dennisn.mooo.com May 20, 2015

May 20, 2015

When accessing some sites, say for example http://thepiratebay.org , wget seems to successfully follow the "301 Moved Permanently" redirects a few times, but Dillo only seems to do one redirect and then stops. The last output is: HTTP warning: Message with a body lacked Content-Type header.

1 0

No edit/delete/report Buttons in Some phpBB Forums
by miro.rovis＠croatiafidelis.hr May 14, 2015

May 14, 2015

I've been using dillo for my regular browsing for a few weeks longer than from when I started the thread: Secure: yes, Though Features Missing; and Bugs http://lists.dillo.org/pipermail/dillo-dev/2015-April/010495.html on dillo mailing list, and I'd like to help at least occasionally with the sole kind of contribution that I can offer: reporting like those in that link, as I'm not a developer, and can program very little only. I have a new one report. on issue that I only mentioned (and wouldn't know how to solve back then) over at: Grsecurity/Pax installation on Debian GNU/Linux http://forums.debian.net/viewtopic.php?f=16&t=108616&start=60#p577608 But I can try and tell more about it as I saw the same missing edit and delete buttons in: https://forum.sleuthkit.org/ where, to verify it, one would need to register, I believe. And while that registering on a specialized tool forum can take a few hours or more time to get the maintainer's approval, true, I believe it is the same kind of missing functionality and in the Debian Forums, so I guess one can verify this behavior by, if they are not, registering into Debian Forums. I have noticed the same edit and delete buttons missing in Debian Forums too, and I choose the Sleuthkit Forum, because I'm currently posting on it, and can accomplish this report with much more ease then on Debian where I am done with my posts for some time. I have a slow and lengthy (and tiring: too advanced for me) topic on Sleuthkit Forum: An Avi Video Recovery with SleuthKit http://forum.sleuthkit.org/viewtopic.php?f=6&t=2441 ) and I have actually managed to edit my posts, and I managed to delete one (only the post not replied to can be deleted on Sleutkit Forum). But not by clicking on the respective icons, as they don't show in dillo. But by issuing Ctrl-U to open the source of the page while logged in and having my topic opened in my dillo browser and searching for the right (relative) link under the icon 'edit-icon' or 'delete-icon' and reconstructing the right page, because that was the only way to do it. I did search thoroughly, and no link, even on empty surfaces, did I manage to detect under the mouse (as I didn't in Debian Forums either). This is how I found it, after saving the source for the page, which is still opened for me since I posted on it, and where I deleted the last misposted post: The page was (and will not remain available under that exact address): Re: An Avi Video Recovery with SleuthKit https://forum.sleuthkit.org/viewtopic.php?f=6&t=2441&p=2630&sid=4e30a8bd740… (which is Page 2 of 2 of the topic; for those who will try elsewhere, or who just want to get the jist reading this without trying, this is the topic page 2: https://forum.sleuthkit.org/viewtopic.php?f=6&t=2441&p=2630#p2630 but that one has, surely no edit or delete -icon(s)) I saved it as: SK_150514-10_pg2_src.php ('10' because it's post 10 of the topic, 150514 is for 2015-05-14) and, for deleting, which is quicker to show, since it can be only one instance found, only the last post: cat /Cmn/dLo/SK_150514-10_pg2_src.php | grep delete-icon | \ sed 's/\&amp;/\&/g' and that gives, in this case (surely anyone would need their own current address given by the forum phpBB, but this is the principle, and even I as the same miroRR user will still get a different one variant of the string 'sid=...' for the same page the next time), [and that gives, in this case:] </pre><tr><td bgcolor='#DD7F32'>238<td><pre> <li class="edit-icon"><a href="./posting.php?mode=edit&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Edit post">Edit post</a></li><li class="delete-icon"><a href="./posting.php?mode=delete&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Delete post">Delete post</a></li><li class="report-icon"><a href="./report.php?f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Report this post">Report this post</a></li><li class="quote-icon"><a href="./posting.php?mode=quote&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Reply with quote">Reply with quote</a></li> (When grep'ing 'edit-icon', 'report-icon' or 'quote-icon' there would be two founds for each, as there are two posts.) in one line, however, but surely I prefer my Vim setting it to the usual 79 colums width, so readers in the mailing list would not have trouble viewing it as one line (I have mercy on my poor brothers in *nix ;-) ). Surely, if I will have to post this text on Gentoo Forums [*] and [**] and [***], case shown to be that this e-mail just does not send by the absolute joyous great provider of mine, urgh!, I will rather set it to around 110-120 colums width... But from that HTML code, I figured out from this segment: href="./posting.php?mode=delete&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" that if I wanted to delete that post, I would change the address from what it looked like into: https://forum.sleuthkit.org/posting.php?mode=delete&f=6&p=2634&sid=4e30a8bd… And indeed, after hitting Enter on that address I was asked for confirmation and was able to delete the post. There are also strings to use for changing the same address into the one that would accomplish editing that post: href="./posting.php?mode=edit&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" reporting that post: href="./report.php?f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" and quoting that post: href="./posting.php?mode=quote&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" None of those icons, however, show in dillo for me. This is about the whole report, as I can't even dedicate time to follow the suggestion be kind unixer eocene: Secure: yes, Though Features Missing; and Bugs http://lists.dillo.org/pipermail/dillo-dev/2015-April/010500.html and get my fonts sorted in dillo... since even the regular maintainance of my system during a data recovery work is already schedule completely exhausted, let alone DIY compilations. [*] I'll post this, in case it is not sent to dillo ML by my provider, on Gentoo Forums where I have anyway been planning for some time the idea to open a topic on browsers and really recommend dillo, as the its being so sea-calm secure when compared with the big surveillor browsers outweighs the missing features such as the lack of javascript and poor support for CSS, so this would fit on Gentoo Forums. [**] And I'll open a special section for suspected censored e-mails of mine, at http://www.CroatiaFidelis.hr/foss/cenz/ . However, uncenzorizing is a lot of work, it's in the order of a tenfold work than non-censored free e-mail correspondence, so I'll do it, I hope, some time in the future. [***] START Speaking of big surveillor browsers, I usually have issues with dillo right after I use one of those: the SchmoogleMoz Fox (but freely replace it with any of the other big ones and the potential for harm like below is there!). --- I had to use it, because the freaking Croatian corporate robber Zagreba?ka banka at www.zaba.hr require the use of javascript for internet banking... --- And that certainly is an issue, the requirement of javascript and privacy/intrusion/surveillance issues, which requirement and these issues is what I want to open the topic on Gentoo on for, and which would be great that dillo managed, with some also, hopefully, speaking as an incompetent but wishful observer --incompetent because not really a programmer-- with some also new honest young hackers/developers' blood to join in among the current herd of dillo developers [[ the work needed is huuuge ]] -- I'm dreaming, brothers, dreaming of a free unsurveilled surfing available for many; dillo looks really really closest to that accomplishment in the field of today's computing which is the sole island in all of computing with potential to be unsurveilled and free users of it therefore not controlled, and which [the sole island] is the FOSS *nix, from BSD variants to Linux variants... --- And so I had to use the SchmoogleFox, and lo and behold, certain stuff in dillo would not work after the bout of only some ten (10) minutes of the Schfox use. Such as I wasn't able to accomplish anything with either Ctrl-U nor right mouse click > View page source. Dillo would crash immediately. Updated my Gentoo from my local mirror (it's kernel 4 now in Gentoo ;-) !!) ( see my topic: Air-Gapped Gentoo Install, Tentative https://forums.gentoo.org/viewtopic-t-987268.html and links therefrom, such as to cloning system, a part-topic in: Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion https://forums.gentoo.org/viewtopic-t-999436.html for how to always be able to get renewable clean system even after intrusions ) and all now works. END [***] --- All links in this message checked and all I have found to be live before sending. -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

1 0

SSL in the browser
by eocene＠gmx.com May 9, 2015

May 9, 2015

James wrote: > Every certificate that doesn't have something at the root of its chain, as it should. I'm on osx and there is no /etc/ssl/certs, so I had no roots until I started loading them. Where does OSX keep them? I'd looked on the web a bit in the past in case there was any simple consensus out there on the matter of where to check, but didn't find anything. I'll see where curl checks. Whatever they do is probably a good idea.

2 4

font size / dpi
by eocene＠gmx.com May 9, 2015

May 9, 2015

On a 125 dpi display, web pages tend to be tiny. For font_factor, dillorc claims "All font sizes are scaled by this value", but that's only true for html sizes and the css sizes like 'small' 'x-large' etc. [hmm...speaking of which, I see there's a bug in there for 'larger' and 'smaller' where we apply font_factor erroneously.] We should either change the claim or make it true. Also, I was refreshing my memory on the resolution-independent px discussion from January. Mostly it was about concern for the cost of scaling images, and I realize that we kind of have to deal with images or else everything doesn't fit together, but...it would be nice in some ways if we could at least scale font sizes by dpi (the css px ones and the assorted 14's that we have around in src/ ).

1 0

Crash with ascii text scribbled across a data structure.
by james.from.wellington＠gmail.com April 22, 2015

April 22, 2015

>From time to time, I get a most peculiar SEGV. Here's an example on fairly clean source up to c761c66 on a mac: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: 13 at address: 0x0000000000000000 0x00000001000064b7 in Fl_Widget::position (this=0x118148910, X=2003792928, Y=1869881479) at Fl_Widget.H:321 321 void position(int X,int Y) {resize(X,Y,w_,h_);} (gdb) bt #0 0x00000001000064b7 in Fl_Widget::position (this=0x118148910, X=2003792928, Y=1869881479) at Fl_Widget.H:321 #1 0x000000010008521a in dw::fltk::FltkViewport::updateCanvasWidgets (this=0x101208a10, dx=0, dy=-25) at fltkviewport.cc:502 #2 0x0000000100086492 in dw::fltk::FltkViewport::scrollTo (this=0x101208a10, x=0, y=347) at fltkviewport.cc:398 #3 0x0000000100084c10 in dw::fltk::FltkViewport::scroll (this=0x101208a10, dx=0, dy=-25) at fltkviewport.cc:413 #4 0x0000000100084c4a in dw::fltk::FltkViewport::vscrollbarChanged (this=0x101208a10) at fltkviewport.cc:156 #5 0x0000000100084c65 in dw::fltk::FltkViewport::vscrollbarCallback (vscrollbar=0x101208c90, viewportPtr=0x101208a10) at fltkviewport.cc:161 #6 0x0000000100100b13 in Fl_Widget::do_callback (this=0x101208c90, o=0x101208c90, arg=0x101208a10) at Fl_Widget.cxx:328 #7 0x000000010001a8ef in Fl_Widget::do_callback (this=0x101208c90) at Fl_Widget.H:840 #8 0x00000001001005c1 in Fl_Valuator::handle_drag (this=0x101208c90, v=347) at Fl_Valuator.cxx:95 #9 0x00000001000ec3bc in Fl_Scrollbar::handle (this=0x101208c90, event=19) at Fl_Scrollbar.cxx:142 #10 0x00000001000857d7 in dw::fltk::FltkViewport::handle (this=0x101208a10, event=19) at fltkviewport.cc:304 #11 0x00000001000ceb39 in send (o=0x101208a18, event=19) at Fl_Group.cxx:98 #12 0x00000001000cf338 in Fl_Group::handle (this=0x10053d760, event=19) at Fl_Group.cxx:254 #13 0x0000000100007aa2 in UI::handle (this=0x10053d760, event=19) at ui.cc:788 #14 0x00000001000ceb39 in send (o=0x10053d760, event=19) at Fl_Group.cxx:98 #15 0x00000001000cf338 in Fl_Group::handle (this=0x10053d6b0, event=19) at Fl_Group.cxx:254 #16 0x00000001000ceb39 in send (o=0x10053d6b0, event=19) at Fl_Group.cxx:98 #17 0x00000001000cf338 in Fl_Group::handle (this=0x10053cf60, event=19) at Fl_Group.cxx:254 #18 0x00000001000b7b94 in Fl_Window::handle (this=0x10053cf60, ev=19) at Fl.cxx:1643 #19 0x00000001000b67e0 in send (event=19, to=0x10053cf60, window=0x10053cf60) at Fl.cxx:1136 #20 0x00000001000b8ad1 in Fl::handle_ (e=19, window=0x10053cf60) at Fl.cxx:1444 #21 0x00000001000b8b7a in Fl::handle (e=19, window=0x10053cf60) at Fl.cxx:1216 #22 0x00000001000ab1b3 in cocoaMouseWheelHandler (theEvent=0x1181582b0) at Fl_cocoa.mm:943 #23 0x00000001000ab1e8 in -[FLView scrollWheel:] (self=0x101505a50, _cmd=0x7fff8965ff98, theEvent=0x1181582b0) at Fl_cocoa.mm:2250 #24 0x00007fff890580c7 in -[NSWindow sendEvent:] () #25 0x00007fff88f8cafa in -[NSApplication sendEvent:] () #26 0x00000001000aed74 in +[FLApplication sendEvent:] (self=0x1001b36d0, _cmd=0x7fff896552c0, theEvent=0x1181582b0) at Fl_cocoa.mm:1609 #27 0x00000001000ae989 in do_queued_events (time=1e+20) at Fl_cocoa.mm:749 #28 0x00000001000ae9bf in fl_wait (time=1e+20) at Fl_cocoa.mm:773 #29 0x00000001000aea86 in fl_mac_flush_and_wait (time_to_wait=1e+20) at Fl_cocoa.mm:792 #30 0x00000001000b9081 in Fl::wait (time_to_wait=1e+20) at Fl.cxx:528 #31 0x00000001000b910b in Fl::run () at Fl.cxx:589 #32 0x00000001000052a7 in main (argc=1, argv=0x7fff5fbff280) at dillo.cc:589 (gdb) print (char *)this $6 = 0x118148910 "lore ipsum the text out of the editor window in the email.\n\nMore lorem ibsum.\n\nRegards,\nJames." 0x118148910 is correctly allocated to dw::flak::ui::FltkLabelButtonResource, according to Apple's debugging malloc. I can't find, in the debugging malloc, the allocation for storing the text in the text-box. The worst cases are that someone is scribbling malloc control structures, or someone is scribbling addresses in a dillo data structure. I've seen something essentially the same where the scribble contained a URL. I'm contemplating relinking with electric fence. Regards, James.

1 0

Secure: yes, Though Features Missing; and Bugs
by miroslav.rovis1＠zg.ht.hr April 12, 2015

April 12, 2015

( I already wrote this entire message, and only then noticed eocene didn't send this to dillo-dev but only to me. But I now have to, All written. Can't correct that now. ) On Fri, Apr 03, 2015 at 08:14:36PM +0000, eocene wrote: > miroslav.rovis1 wrote: > > ukrainian at uabox ~ $ Domain: Default accept. > > By the way, if you're interested in making your browsing more secure, > you could modify your domainrc file not to have 'accept' as its default > rule. Let me first reply to this message. I really wish to start viewing dillo more comfortably first, so this will wait. But, since I started about it here, let me explain. Look here, how my dillo brings pages to me currently: https://forums.gentoo.org/viewtopic-t-1004014.html#7724054 and currently, download and open the mkv files... (So people reading later, open the, hopefully, webm files. That's how it was, talking to you in the future.) Those mkv files will, hopefully, soon be replaced with the HTML5 compliant webm files. So if opened those, that's how it shows currently. I was only able to use dillo after reverting my 1024x768 capable old monitor, to 800x600, in another display in X (:1.0 in, say, ffmpeg command line), else, I would have gone blind from effort to read. And I still have difficulty reading some of the pages. ##################################################################### The Homepage is particularly too hard to read for, I guess at least a non-insignificant though small percentage (no, not less than a small percentage number, it's not insignificant!) of visitors. The background must be very light. As soon as it is too dark, the font is not easily readable. ##################################################################### I'm not at poor-accessibility eyesight yet, I don't have problems with most of pages. I really don't. Pls. take notice of this claim of mine and value the outlined paragraph with respect to that claim! I hope this will help dillo homepage become more readable. So, first I really need the fonts, and will follow your kind advice, eocene, on the fonts, as soon as I find more free time. domainrc is great thing to try to sort too, but the other issue is urgent. Pls allow more time for me to reply to your other mail (I got two mails of kind advice from eocene. Can't go online (the SourceForge archive) to see if my bad provider and bad regime filtered some emails out from dillo-dev. Busy elsewhere. -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

2 4

Documentation fixes: autolinking
by onepoint＠starurchin.org April 4, 2015

April 4, 2015

Three small patches that fix autolinking errors in the documentation. The first two escape the autolinking syntax in a few places where it was not intended to be a link. The third fixes a few places where a link was intended but the autolink syntax was not quite right. http://starurchin.org/dillo/patch/doxygen-escape-hash-characters.html http://starurchin.org/dillo/patch/doxygen-escape-double-colons.html http://starurchin.org/dillo/patch/doxygen-fix-simple-name-refs.html Comments are welcome. If these are OK I can push them myself as I have write permission. (It's actually easier for me to do it myself because Mercurial Queues does not notice when the remote repository has a patch that is identical to a patch in its queue and generates spurious errors.) Regards, Jeremy Henty

3 5

patch: provide a redirection-blocked page
by eocene＠gmx.com April 4, 2015

April 4, 2015

I was in the mood to make the use of domainrc more pleasant. Having to check the terminal for redirection-denied MSGs is no fun, and sometimes I imagine that I'm the only person who uses it due to its...limited friendliness. Patch attached.

1 0

Secure: yes, Though Features Missing; and Bugs
by miroslav.rovis1＠zg.ht.hr April 3, 2015

April 3, 2015

Hi! To me it is most important to avail myself of the security that dillo pretty much provides to me. What I can say, and recommend to anybody who has problems with `bulk collection' that they see in typical kind of actions deployed inside or on the way to, or on the way from, their machines... Sadly with `bulk collection' (previously known as `mass surveillance'; it comprises data harvesting and more) often go even worse kind of actions in privacy-repressive regimes: intrusions, even attacks... What I can say, is: I have so much fewer cases of the aforementioned issues when browsing with dillo, then I do when I have to, due to Javascript haven't yet been implemented in dillo, [than when I have to] use SchmoogleFox. So much fewer of those kind of problems! And yes, the Google, the Octopus of the Internet and the Surveillance Engine of the World, yes the Schmoog is sitting in the Firefox, in most of the regular users' machines who little depart from default configuration, and I don't think Mozilla harvesting itself can be easily disabled (you may remove direct Google harvesting/spying/other, but the Mozilla cloud is there, rest assured, for Google to use, fully!), and you can not, not that I know of an easy way --disprove me somebody!-- easily disable harvesting in Firefox... The security of dillo is generally such that I can usually rest calmly when I browse with dillo. And so I can recommend dillo to anybody who has problems with censorship, and when censorship of an oppressive regime is revealed, usually some kind of intrusion attempts, and/or attacks, are made against the one who managed to reveal it. To see more in depth about this claim of mine, read about dillo in the topics where I mention it on Gentoo Forums (just search for `dillo'): Updating and keeping your Gentoo non-poetterized https://forums.gentoo.org/viewtopic-t-1012022-start-0.html (currently three pages, dillo mentioned in 1st and 2nd. Before I close this first message, I'd like to show you this page where I demonstrated not just how the first Firefox harvest looks like on a Chinese style censorship deployed on dissenters in Croatia (that part is already posted: Google - can not open any link - malware ?? https://forums.gentoo.org/viewtopic-t-912056-start-25.html#7715646 but that topic I plan to improve adn add more content to yet) You can see that while I'm not really a programmer, I dabble with some ideas. This is my proposal for a program: https://github.com/miroR/uncenz I've been having censorship and related issues for really quite a number of years, By this current stage in my necessity-imposed research about it, I'm just about always traffic capturing when online, and you can find real and undeniable clickjacking and other intrusions (and learn about the Chinese style censorship and more; but, WARNING, the presentation is not so well made, and is unfinished) at: Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion https://forums.gentoo.org/viewtopic-t-999436.html I believe that an objective reader, with a little time to read from my research there, can see that my praising of dillo is based on my sufficient understanding and experience. I really wish that you dillo developers may gather enough developer power to make dillo happen in the sooner rather than later future, much more capable than it already is. I can imagine what tremendous work creating and developing of a browser is! With that aim and wish in mind, I'd like to write and send another message about another buggish behavior in dillo. But in this message I can explain more about what I wrote on page 2nd of the topic already mentioned: Updating and keeping your Gentoo non-poetterized: https://forums.gentoo.org/viewtopic-t-1012022-start-25.html#7713858 > Other then one thing. dillo, which I used, has a little problem with > cache, that can be easily circumvented, but the user needs to remember > to refresh the page, and I inadvertently lost a little text... The above behavior occurs sometimes on my system, it occurs rather erratically, but rather often, when posting on Gentoo Forums. Not when posting a completely new post, but after editing an already existing post. It is easy to circumvent it, by simply, after having posted the previously edited post in question, refreshing the page which the post appears in. You can often see text literally changing upon refreshing it. The bug often occurs `in reverse', concerning posting. What I mean, is if you open a post for at least the third time --yes it must be a problem related to dillo caching; I understand so much even though I'm not a programmer, but just an advanced user-- so [if you open a post for the third time for editing], unless you refresh the editing texarea, in the same fashion: by clicking on the "Reload" button, you miight find yourself inadvertently to be editing the text that you posted the time before last, and not the immediately previous edit to this third edit of that text (even though the last text, the immediately previous, has, obviously, also been already committed, and should have been shown to you). The other bug, or is it my misconfiguration, or is it something else, I will try and write about in my next post. I sure will try and prepare the next message sson, and send it in a matter of hours or maximally a day or two. But if it does not arrive, the likelihood is that it is waiting for spies at my providers' to read it, and decide whether to send it on, or filter it out and not send it to dillo mailing list at all. Should the latter happen, pls. find that message at not much later time than maximally a day or two from now, in the topic Google - can not open any link - malware ?? https://forums.gentoo.org/viewtopic-t-912056-start-25.html surely, as a new post (which will, in that case, be yet to be written and posted there), and share the link with others on this list, please). (This note NOT related to dillo: Censorship is really a hard issue to overcome. Have a look at: Recover partly overwritten luks volume? https://forums.gentoo.org/viewtopic-t-1004014.html#7724054 --even though I praised dillo in that topic too-- nobody helped me there!) -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

3 4