- Dillo-dev - lists.mailman3.com

table/cell width problem

by corvid＠lavabit.com

Also, I finally got around to looking into why the columns are strange on http://hg.dillo.org/dillo when I have remote style sheets enabled. Each row is a separate table, and the date and submitter fields have fixed widths specified in ems. That seems to work in general, but the problem is that the tables have width specified as 100%, which seems to make the table code forget about the column widths.

Dec. 27, 2009

are cookies supposed to be working nowadays?

by corvid＠lavabit.com

Tried enabling some cookies to test something, and I'm getting a lot of this sort of thing: [cookies dpi]: Enabling cookies as from cookiesrc... [cookies dpi]: (v.1) accepting connections... [cookies dpi]: Old netscape-style cookie... [cookies dpi]: Expires in 2000223 seconds, at Tue Jan 19 08:35:26 2010 ** ERROR **: [a_Dpi_send_blocking_cmd] Can't read message. It's a shiny new copy of the cookies dpi, and I haven't been seeing any problems with other dpis...

Dec. 27, 2009

[un]highlighting and drawing lines

by corvid＠lavabit.com

Yesterday, I noticed that simply clicking on a random spot on a page caused a bunch of drawLine()s. This turned out to be an unnecessary unhighlight. The attached code is what I got from playing around to see how much highlighting and unhighlighting is unnecessary. (Highlighting part of a single word was still relatively inefficient, but there was a variable named brute_highllighting controlling it, so I figured it was for a good reason.) However, if I move the mouse around more rapidly, I get a lot fewer mouse motion notifications, which means to some degree that we're doing redraws when the motion is slow enough that we can more likely afford it. It might be different over a network; I don't know. Any opinions?

Dec. 26, 2009

[oph-villedieu@orange.fr: dillo_2.1.1]

by corvid＠lavabit.com

Johannes wrote: > On Sun, Dec 20, 2009 at 07:08:42PM +0000, corvid wrote: > > The vertical-align code I have around doesn't do anything for table cells. > > > > Can you share what you have so far? The latest for non-table-cell was http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-December/007099.html (which points to a patch) and the latest for table-cell was http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-December/007105.html

Dec. 26, 2009

web bug save?

by jcid＠dillo.org

On Fri, Dec 25, 2009 at 05:46:22PM +0000, corvid wrote: > bb wrote: > > *On http://www.dillo.org/ I found the item News and a remark: > > > > 03-Jul-2009 Dillo-2.1.1 has been released to provide a security fix for > > malicious images. I am not shure what is meant with **malicious images? > > Are this so called Web bugs? If yes - how is the blocking done? > > Here's the advisory about the image size problem: > http://www.ocert.org/advisories/ocert-2009-008.html > > > I think there are some strategies possible to prevent a browser from a > > Web Bug attack: > > > > 1. Dont allow to load gifs or pngs from another URL as the actual page > > comes from. (I think to remember that firefox **originally **had such an > > option - not available in the actual version.) > > Here's the beginning of a thread and a patch experimenting with this: > http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-September/006844.ht… > (the "same host" option was found to be useless, but I'm still interested in > "same domain") > > > 2. I think one might prepare HTML/CSS not to load such gifs or pngs > > smaller than say about 5x5. Do you think such a measure is feasible in > > Dillo and could that really stop Web Bugs? But I think that there should > > not be a problem to make Web Bugs larger than 1x1pixel as long as they > > are transparent - may be I am wrong, I am just a simple minded user, not > > a web professional. So such a limit might be useless? AFAIS your analysis is correct. There's no problem in increasing the web bug image size, specially on these broadband days... Personally I have hopes on restricting resource loading from other sites, but as corvid cites, it's non trivial and requires careful thought. As a highly interested user, you may gather some information on web bugs, techniques to avoid them etc. and post a summary of your findings here. That would help a lot. We have the knowledge on how to code dillo and restricted time to work on it. If you can help us everybody gains. > Here's a post and patch experimenting with rejecting images with a dimension > of 0: > http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-December/007101.html > > > Are there other ideas? I am highly interested in that Web Bug problem. > > I'm glad to hear this, since user interest may encourage things to happen... I'm very interested in this topic, although haven't found free time these days... -- Cheers Jorge.-

Dec. 26, 2009

web bug save?

by Johannes.Hofmann＠gmx.de

On Fri, Dec 25, 2009 at 05:46:22PM +0000, corvid wrote: > bb wrote: > > *On http://www.dillo.org/ I found the item News and a remark: > > > > 03-Jul-2009 Dillo-2.1.1 has been released to provide a security fix for > > malicious images. I am not shure what is meant with **malicious images? > > Are this so called Web bugs? If yes - how is the blocking done? > > Here's the advisory about the image size problem: > http://www.ocert.org/advisories/ocert-2009-008.html > > > I think there are some strategies possible to prevent a browser from a > > Web Bug attack: > > > > 1. Dont allow to load gifs or pngs from another URL as the actual page > > comes from. (I think to remember that firefox **originally **had such an > > option - not available in the actual version.) > > Here's the beginning of a thread and a patch experimenting with this: > http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-September/006844.ht… > (the "same host" option was found to be useless, but I'm still interested in > "same domain") > > > 2. I think one might prepare HTML/CSS not to load such gifs or pngs > > smaller than say about 5x5. Do you think such a measure is feasible in > > Dillo and could that really stop Web Bugs? But I think that there should > > not be a problem to make Web Bugs larger than 1x1pixel as long as they > > are transparent - may be I am wrong, I am just a simple minded user, not > > a web professional. So such a limit might be useless? > > Here's a post and patch experimenting with rejecting images with a dimension > of 0: > http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-December/007101.html > > > Are there other ideas? I am highly interested in that Web Bug problem. > > I'm glad to hear this, since user interest may encourage things to happen... > Absolutely. We really need to address this. Maybe we can do some more research again about what other browsers or plugins do about this. Cheers, Johannes

Dec. 26, 2009

[oph-villedieu@orange.fr: dillo_2.1.1]

by Johannes.Hofmann＠gmx.de

On Sun, Dec 20, 2009 at 07:08:42PM +0000, corvid wrote: > Johannes wrote: > > On Sun, Dec 20, 2009 at 11:28:15AM -0300, Jorge Arellano Cid wrote: > > > Hi, > > > > > > I just received this email. The attached example shows the bug. > > > Does anybody remember what we did with valign? ;) > > > > > > > > I'm afraid I found a bug in this release (?) : > > > > it does not understand the html tag <td valign="bottom"> > > > > it reads instead <td valign="top"> > > > I think we never supported valign=top | middle | bottom > > in dillo-fltk. > > We probabely need to implement it in Textblock::sizeAllocateImpl(). > > The vertical-align code I have around doesn't do anything for table cells. > Can you share what you have so far? Cheers, Johannes

Dec. 26, 2009

web bug save?

by corvid＠lavabit.com

bb wrote: > *On http://www.dillo.org/ I found the item News and a remark: > > 03-Jul-2009 Dillo-2.1.1 has been released to provide a security fix for > malicious images. I am not shure what is meant with **malicious images? > Are this so called Web bugs? If yes - how is the blocking done? Here's the advisory about the image size problem: http://www.ocert.org/advisories/ocert-2009-008.html > I think there are some strategies possible to prevent a browser from a > Web Bug attack: > > 1. Dont allow to load gifs or pngs from another URL as the actual page > comes from. (I think to remember that firefox **originally **had such an > option - not available in the actual version.) Here's the beginning of a thread and a patch experimenting with this: http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-September/006844.ht… (the "same host" option was found to be useless, but I'm still interested in "same domain") > 2. I think one might prepare HTML/CSS not to load such gifs or pngs > smaller than say about 5x5. Do you think such a measure is feasible in > Dillo and could that really stop Web Bugs? But I think that there should > not be a problem to make Web Bugs larger than 1x1pixel as long as they > are transparent - may be I am wrong, I am just a simple minded user, not > a web professional. So such a limit might be useless? Here's a post and patch experimenting with rejecting images with a dimension of 0: http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-December/007101.html > Are there other ideas? I am highly interested in that Web Bug problem. I'm glad to hear this, since user interest may encourage things to happen...

Dec. 25, 2009

web bug save?

by bblochl＠arcor.de

*On http://www.dillo.org/ I found the item News and a remark: 03-Jul-2009 Dillo-2.1.1 has been released to provide a security fix for malicious images. I am not shure what is meant with **malicious images? Are this so called Web bugs? If yes - how is the blocking done? I think there are some strategies possible to prevent a browser from a Web Bug attack: 1. Dont allow to load gifs or pngs from another URL as the actual page comes from. (I think to remember that firefox **originally **had such an option - not available in the actual version.) 2. I think one might prepare HTML/CSS not to load such gifs or pngs smaller than say about 5x5. Do you think such a measure is feasible in Dillo and could that really stop Web Bugs? But I think that there should not be a problem to make Web Bugs larger than 1x1pixel as long as they are transparent - may be I am wrong, I am just a simple minded user, not a web professional. So such a limit might be useless? Are there other ideas? I am highly interested in that Web Bug problem. Seasons greetings bblochl ** *

Dec. 25, 2009

[oph-villedieu@orange.fr: dillo_2.1.1]

by corvid＠lavabit.com

Johannes wrote: > I think we never supported valign=top | middle | bottom > in dillo-fltk. > We probabely need to implement it in Textblock::sizeAllocateImpl(). I realized that my current solution, already known to be awfully inefficient, wouldn't let me implement baseline alignment. So, back to Table::sizeAllocateImpl(). When I had tried modifying y and descent here the other day, it put things in roughly the right place, but my problem was that the box drawn around the cell wouldn't reach to the top anymore. I imagine modifying the top padding value might help. Would that be an improper way to go about it?

Dec. 24, 2009