- Dillo-dev - lists.mailman3.com

Secure: yes, Though Features Missing; and Bugs

by miroslav.rovis1＠zg.ht.hr

( I really got this message from Dennis, not from dillo, aah, what can you when the provider is bad... ) On Thu, Apr 02, 2015 at 10:51:13AM -0400, Dennis New wrote: > On Wed, 1 Apr 2015 22:35:13 +0200, miroslav.rovis1 at zg.ht.hr wrote: > > [...] > > The security of dillo is generally such that I can usually rest calmly > > when I browse with dillo. > > > > And so I can recommend dillo to anybody who has problems with > > censorship, and when censorship of an oppressive regime is revealed, > > usually some kind of intrusion attempts, and/or attacks, are made > > against the one who managed to reveal it. > > Agreed! It is incredibly valuable in this regard. It's minimalist > nature makes it far far more likely to be secure -- it presents a far > smaller "attack surface". (I think the lack of JavaScript support is a > feature, not a bug.) Yeah, except you need it often... (not everybody is FOSS oriented)... > > > [...] > > I've been having censorship and related issues for really quite a > > number of years, By this current stage in my necessity-imposed > > research about it, I'm just about always traffic capturing when > > online, and you can find real and undeniable clickjacking and other > > intrusions (and learn about the Chinese style censorship and more; > > Of course, the centralized state-controlled nature of the "normal > mainstream" internet makes this kind of censorship and hijacking > inevitable. If we realistically expect free speech we should be > migrating to censorship-proof darknets (like Tor or Freenet or I2P et > cetera) and perhaps decentralized hardware infrastructure like meshnets. I wish I was there already! Late adopter. What I have achieved: only through terribly extensive effort and time. > > [...] > > > Other then one thing. dillo, which I used, has a little problem with > > > cache, that can be easily circumvented, but the user needs to > > > remember to refresh the page, and I inadvertently lost a little > > > text... > > Yea that's happened to me a few times. Annoying. The input form will > use the originally filled field data, rather than the newer data, > unless the page is refreshed. Perhaps this is related to another > annoyance where, for example, after filling a form but incorrectly > guessing a captcha, there is no way to recover my original typed text. > (I've gotten into the habit of typing my posts in a separate text > editor to avoid this.) > > > [...] > > Zagreb, Croatia > > Cool city :). I see on http://dennisn.mooo.com/wiki/ you like some of our music. "Hladno pivo" are capable musicians, but ideologically I feel differently... Can't delve on this though. And I promised the other bug or similar that it were, of dillo. Not immediately. I'm slow. Pls. allow time. Cheers dear people! -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

April 2, 2015

Secure: yes, Though Features Missing; and Bugs

by dennisn＠dennisn.mooo.com

On Wed, 1 Apr 2015 22:35:13 +0200, miroslav.rovis1 at zg.ht.hr wrote: > [...] > The security of dillo is generally such that I can usually rest calmly > when I browse with dillo. > > And so I can recommend dillo to anybody who has problems with > censorship, and when censorship of an oppressive regime is revealed, > usually some kind of intrusion attempts, and/or attacks, are made > against the one who managed to reveal it. Agreed! It is incredibly valuable in this regard. It's minimalist nature makes it far far more likely to be secure -- it presents a far smaller "attack surface". (I think the lack of JavaScript support is a feature, not a bug.) > [...] > I've been having censorship and related issues for really quite a > number of years, By this current stage in my necessity-imposed > research about it, I'm just about always traffic capturing when > online, and you can find real and undeniable clickjacking and other > intrusions (and learn about the Chinese style censorship and more; Of course, the centralized state-controlled nature of the "normal mainstream" internet makes this kind of censorship and hijacking inevitable. If we realistically expect free speech we should be migrating to censorship-proof darknets (like Tor or Freenet or I2P et cetera) and perhaps decentralized hardware infrastructure like meshnets. > [...] > > Other then one thing. dillo, which I used, has a little problem with > > cache, that can be easily circumvented, but the user needs to > > remember to refresh the page, and I inadvertently lost a little > > text... Yea that's happened to me a few times. Annoying. The input form will use the originally filled field data, rather than the newer data, unless the page is refreshed. Perhaps this is related to another annoyance where, for example, after filling a form but incorrectly guessing a captcha, there is no way to recover my original typed text. (I've gotten into the habit of typing my posts in a separate text editor to avoid this.) > [...] > Zagreb, Croatia Cool city :).

April 2, 2015

Secure: yes, Though Features Missing; and Bugs

by miroslav.rovis1＠zg.ht.hr

Hi! To me it is most important to avail myself of the security that dillo pretty much provides to me. What I can say, and recommend to anybody who has problems with `bulk collection' that they see in typical kind of actions deployed inside or on the way to, or on the way from, their machines... Sadly with `bulk collection' (previously known as `mass surveillance'; it comprises data harvesting and more) often go even worse kind of actions in privacy-repressive regimes: intrusions, even attacks... What I can say, is: I have so much fewer cases of the aforementioned issues when browsing with dillo, then I do when I have to, due to Javascript haven't yet been implemented in dillo, [than when I have to] use SchmoogleFox. So much fewer of those kind of problems! And yes, the Google, the Octopus of the Internet and the Surveillance Engine of the World, yes the Schmoog is sitting in the Firefox, in most of the regular users' machines who little depart from default configuration, and I don't think Mozilla harvesting itself can be easily disabled (you may remove direct Google harvesting/spying/other, but the Mozilla cloud is there, rest assured, for Google to use, fully!), and you can not, not that I know of an easy way --disprove me somebody!-- easily disable harvesting in Firefox... The security of dillo is generally such that I can usually rest calmly when I browse with dillo. And so I can recommend dillo to anybody who has problems with censorship, and when censorship of an oppressive regime is revealed, usually some kind of intrusion attempts, and/or attacks, are made against the one who managed to reveal it. To see more in depth about this claim of mine, read about dillo in the topics where I mention it on Gentoo Forums (just search for `dillo'): Updating and keeping your Gentoo non-poetterized https://forums.gentoo.org/viewtopic-t-1012022-start-0.html (currently three pages, dillo mentioned in 1st and 2nd. Before I close this first message, I'd like to show you this page where I demonstrated not just how the first Firefox harvest looks like on a Chinese style censorship deployed on dissenters in Croatia (that part is already posted: Google - can not open any link - malware ?? https://forums.gentoo.org/viewtopic-t-912056-start-25.html#7715646 but that topic I plan to improve adn add more content to yet) You can see that while I'm not really a programmer, I dabble with some ideas. This is my proposal for a program: https://github.com/miroR/uncenz I've been having censorship and related issues for really quite a number of years, By this current stage in my necessity-imposed research about it, I'm just about always traffic capturing when online, and you can find real and undeniable clickjacking and other intrusions (and learn about the Chinese style censorship and more; but, WARNING, the presentation is not so well made, and is unfinished) at: Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion https://forums.gentoo.org/viewtopic-t-999436.html I believe that an objective reader, with a little time to read from my research there, can see that my praising of dillo is based on my sufficient understanding and experience. I really wish that you dillo developers may gather enough developer power to make dillo happen in the sooner rather than later future, much more capable than it already is. I can imagine what tremendous work creating and developing of a browser is! With that aim and wish in mind, I'd like to write and send another message about another buggish behavior in dillo. But in this message I can explain more about what I wrote on page 2nd of the topic already mentioned: Updating and keeping your Gentoo non-poetterized: https://forums.gentoo.org/viewtopic-t-1012022-start-25.html#7713858 > Other then one thing. dillo, which I used, has a little problem with > cache, that can be easily circumvented, but the user needs to remember > to refresh the page, and I inadvertently lost a little text... The above behavior occurs sometimes on my system, it occurs rather erratically, but rather often, when posting on Gentoo Forums. Not when posting a completely new post, but after editing an already existing post. It is easy to circumvent it, by simply, after having posted the previously edited post in question, refreshing the page which the post appears in. You can often see text literally changing upon refreshing it. The bug often occurs `in reverse', concerning posting. What I mean, is if you open a post for at least the third time --yes it must be a problem related to dillo caching; I understand so much even though I'm not a programmer, but just an advanced user-- so [if you open a post for the third time for editing], unless you refresh the editing texarea, in the same fashion: by clicking on the "Reload" button, you miight find yourself inadvertently to be editing the text that you posted the time before last, and not the immediately previous edit to this third edit of that text (even though the last text, the immediately previous, has, obviously, also been already committed, and should have been shown to you). The other bug, or is it my misconfiguration, or is it something else, I will try and write about in my next post. I sure will try and prepare the next message sson, and send it in a matter of hours or maximally a day or two. But if it does not arrive, the likelihood is that it is waiting for spies at my providers' to read it, and decide whether to send it on, or filter it out and not send it to dillo mailing list at all. Should the latter happen, pls. find that message at not much later time than maximally a day or two from now, in the topic Google - can not open any link - malware ?? https://forums.gentoo.org/viewtopic-t-912056-start-25.html surely, as a new post (which will, in that case, be yet to be written and posted there), and share the link with others on this list, please). (This note NOT related to dillo: Censorship is really a hard issue to overcome. Have a look at: Recover partly overwritten luks volume? https://forums.gentoo.org/viewtopic-t-1004014.html#7724054 --even though I praised dillo in that topic too-- nobody helped me there!) -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

April 1, 2015

Documentation fixes: autolinking

by onepoint＠starurchin.org

Jorge Arellano Cid wrote: > On Mon, Mar 16, 2015 at 03:28:43PM +0000, Jeremy Henty wrote: > > > > Three small patches that fix autolinking errors in the documentation. > > The first two escape the autolinking syntax in a few places where it > > was not intended to be a link. The third fixes a few places where a > > link was intended but the autolink syntax was not quite right. > > > > http://starurchin.org/dillo/patch/doxygen-escape-hash-characters.html > > http://starurchin.org/dillo/patch/doxygen-escape-double-colons.html > > http://starurchin.org/dillo/patch/doxygen-fix-simple-name-refs.html > > > > Comments are welcome. > > > > If these are OK I can push them myself as I have write permission. > > (It's actually easier for me to do it myself because Mercurial Queues > > does not notice when the remote repository has a patch that is > > identical to a patch in its queue and generates spurious errors.) > > +1. > > Just not sure about the last one. I don't know whether it > changes the intended semantic for human readers. I think it actually corrects the semantics. An initial '::' means resolve the name in the top namespace, not the current one, but the class names used in the docs are relative to dw/lout. So I think the patch does the right thing. Regards, Jeremy Henty

March 21, 2015

Documentation fixes: autolinking

by jcid＠dillo.org

On Mon, Mar 16, 2015 at 03:28:43PM +0000, Jeremy Henty wrote: > > Three small patches that fix autolinking errors in the documentation. > The first two escape the autolinking syntax in a few places where it > was not intended to be a link. The third fixes a few places where a > link was intended but the autolink syntax was not quite right. > > http://starurchin.org/dillo/patch/doxygen-escape-hash-characters.html > http://starurchin.org/dillo/patch/doxygen-escape-double-colons.html > http://starurchin.org/dillo/patch/doxygen-fix-simple-name-refs.html > > Comments are welcome. > > If these are OK I can push them myself as I have write permission. > (It's actually easier for me to do it myself because Mercurial Queues > does not notice when the remote repository has a patch that is > identical to a patch in its queue and generates spurious errors.) +1. Just not sure about the last one. I don't know whether it changes the intended semantic for human readers. -- Cheers Jorge.-

March 16, 2015

Documentation fixes: autolinking

by onepoint＠starurchin.org

Three small patches that fix autolinking errors in the documentation. The first two escape the autolinking syntax in a few places where it was not intended to be a link. The third fixes a few places where a link was intended but the autolink syntax was not quite right. http://starurchin.org/dillo/patch/doxygen-escape-hash-characters.html http://starurchin.org/dillo/patch/doxygen-escape-double-colons.html http://starurchin.org/dillo/patch/doxygen-fix-simple-name-refs.html Comments are welcome. If these are OK I can push them myself as I have write permission. (It's actually easier for me to do it myself because Mercurial Queues does not notice when the remote repository has a patch that is identical to a patch in its queue and generates spurious errors.) Regards, Jeremy Henty

March 16, 2015

Documentation fixes

by jcid＠dillo.org

On Thu, Mar 12, 2015 at 09:44:53PM +0100, Sebastian Geerken wrote: > On Mi, M?r 11, 2015, Jorge Arellano Cid wrote: > > On Wed, Mar 11, 2015 at 03:50:42PM +0000, Jeremy Henty wrote: > > > I have four documentation patches ready for review that came from > > > looking at the doxygen error output. The first is the upgrade to > > > Doxyfile, the other three are small fixes to errors that doxygen > > > happened to notice. I hope the extended descriptions will make > > > everything clear. > > > > > > http://starurchin.org/dillo/patch/doxygen-upgrade-config.html > > > http://starurchin.org/dillo/patch/doxygen-remove-unmatched-close-div.html > > > http://starurchin.org/dillo/patch/doxygen-typo-nsbp-entity.html > > > http://starurchin.org/dillo/patch/doxygen-escape-button-tag-angle-brackets.… > > > > > > There is more to do but I'd like to clear these out of the way first. > > > > > > All comments are welcome. > > > > Thank you vey much Jeremy! > > > > +1 > > > > I'd apply them now but am unsure only about the first. > > Let's see what Sebastian thinks of this bunch. > > I've committed and pushed them all. > > As for the first patch, this is a simple update. I'm running version > 1.8.1.2, but Jeremy's update with version 1.8.9.1, which adds some > more options, does not cause problems for me. Thanks Sebastian. That was the point, exactly. -- Cheers Jorge.-

March 12, 2015

Documentation fixes

by sgeerken＠dillo.org

On Mi, M?r 11, 2015, Jorge Arellano Cid wrote: > On Wed, Mar 11, 2015 at 03:50:42PM +0000, Jeremy Henty wrote: > > I have four documentation patches ready for review that came from > > looking at the doxygen error output. The first is the upgrade to > > Doxyfile, the other three are small fixes to errors that doxygen > > happened to notice. I hope the extended descriptions will make > > everything clear. > > > > http://starurchin.org/dillo/patch/doxygen-upgrade-config.html > > http://starurchin.org/dillo/patch/doxygen-remove-unmatched-close-div.html > > http://starurchin.org/dillo/patch/doxygen-typo-nsbp-entity.html > > http://starurchin.org/dillo/patch/doxygen-escape-button-tag-angle-brackets.… > > > > There is more to do but I'd like to clear these out of the way first. > > > > All comments are welcome. > > Thank you vey much Jeremy! > > +1 > > I'd apply them now but am unsure only about the first. > Let's see what Sebastian thinks of this bunch. I've committed and pushed them all. As for the first patch, this is a simple update. I'm running version 1.8.1.2, but Jeremy's update with version 1.8.9.1, which adds some more options, does not cause problems for me. Sebastian

March 12, 2015

Documentation fixes

by jcid＠dillo.org

On Wed, Mar 11, 2015 at 03:50:42PM +0000, Jeremy Henty wrote: > > I have four documentation patches ready for review that came from > looking at the doxygen error output. The first is the upgrade to > Doxyfile, the other three are small fixes to errors that doxygen > happened to notice. I hope the extended descriptions will make > everything clear. > > http://starurchin.org/dillo/patch/doxygen-upgrade-config.html > http://starurchin.org/dillo/patch/doxygen-remove-unmatched-close-div.html > http://starurchin.org/dillo/patch/doxygen-typo-nsbp-entity.html > http://starurchin.org/dillo/patch/doxygen-escape-button-tag-angle-brackets.… > > There is more to do but I'd like to clear these out of the way first. > > All comments are welcome. Thank you vey much Jeremy! +1 I'd apply them now but am unsure only about the first. Let's see what Sebastian thinks of this bunch. -- Cheers Jorge.-

March 11, 2015

Documentation fixes

by onepoint＠starurchin.org

I have four documentation patches ready for review that came from looking at the doxygen error output. The first is the upgrade to Doxyfile, the other three are small fixes to errors that doxygen happened to notice. I hope the extended descriptions will make everything clear. http://starurchin.org/dillo/patch/doxygen-upgrade-config.html http://starurchin.org/dillo/patch/doxygen-remove-unmatched-close-div.html http://starurchin.org/dillo/patch/doxygen-typo-nsbp-entity.html http://starurchin.org/dillo/patch/doxygen-escape-button-tag-angle-brackets.… There is more to do but I'd like to clear these out of the way first. All comments are welcome. Regards, Jeremy Henty

March 11, 2015