- Dillo-dev - lists.mailman3.com

URL field / Loading page images / Refreshing DNS cache: Correction
by jgaffney＠lawrenceville.org 08 Jul '16

08 Jul '16

[...] > In the current snapshot, the navigation bar has changed, and the URL > field does not seem to be taking into account font_factor -- with the > result that the window is smaller than the font height. You can test > this by setting, e.g., font_factor=2.0 in your dillorc (most > dramatically for a tiny panel with small icons). The issue seems to > be with this factor not being taken into account when bh and lh are > set in make_panel() in ui.cc. [...] I meant what is actually called the "location box," and on comparing the code for 3.0.5 to the snapshot of a few days ago, I see that there has been no change in the section of make_panel() in ui.cc that sets the values of bh, lh, etc. The change that has caused the problem is the addition of line 466 of ui.cc: i->textsize((int) rint(14.0 * prefs.font_factor)); But the height of the CustInput i is still set to lh, which does not take into account prefs.font_factor.

3 2

CSS parser bug
by sgeerken＠dillo.org 05 Jul '16

05 Jul '16

Hi! The CSS parser seems to have a bug handling shorthand properties. This example works well, both properties are handled correctly: <body style="background: url(http://www.gnu.org/graphics/heckert_gnu.small.png) repeat-y"> Adding "transparent" (for "background-color"), however, causes the other parts not to be parsed: <body style="background: transparent url(http://www.gnu.org/graphics/heckert_gnu.small.png) repeat-y"> Not a regression, dillo 3.0.5 shows the same behaviour. Sebastian

2 2

trustworthiness of dillo's TLS code at present
by eocene＠gmx.com 04 Jul '16

04 Jul '16

Currently I'd trust dillo for https about as much as I'd trust wget for https. (Not that I've really examined wget, but just as a sort of gauge here...) Back in the DPI days, dillo didn't check hostnames on certificates because that was an impossible nightmare with openssl unless you found the code somewhere to modify for your own project. [By the way, there was outrage a couple of years ago when people realized that lots and lots of tools out there, and tls libraries for popular languages, were using OpenSSL and not doing any hostname validation.] It was only with 3.0.5 that I had looked into TLS myself and learned enough about what's insecure at present to disable old ciphers, disable ssl3, disable tls compression. When TLS moved into the browser with the OpenSSL version, I integrated hostname checking code adapted from wget source. And now mbed TLS does the checking itself. At present, our weakness relative to something like chrome or firefox would be in the area of certificate revocation. Dillo has never had a way to know when a certificate has been revoked. For a while, there were certificate revocation lists (CRLs) that are generally published by the assorted certificate authorities, although sometimes you have to click on agreements to get them. The other problem is that those grow _huge_, and distributions don't generally have packages for them (unlike ca-certificates for root certificates). I wouldn't be surprised if the agreements bar distribution. And there was OCSP, which stands for.... Online Certificate Status Protocol. Every time you get a certificate, you query some server, often a third-party server, and ask it whether this certificate is still valid. But those OCSP servers were/are nowhere near reliable enough, and browsers couldn't very well fail everything when the OCSP servers were being flaky.. So OCSP stapling has been coming along, where the OCSP data comes from the original server along with the certificate. OpenSSL has had OCSP code for a little while, but it's very buggy and not documented, and maybe you could get it to work if your application is exceedingly similar to the sample client, but good luck. mbed TLS has OCSP on their roadmap, but it's not implemented yet. As for what the firefoxes and chromes of the world are up to, firefox ripped out their CRL code a while back and they have some other mechanism where certificate authorities notify them of revocations and they push it out. Because they're still big enough to get certificate authorities to do things for them. And they have 'public key pinning' where a server sends keys to certificates, and the client checks that, when certificates are presented in the future, they continue to use one or more of those keys. My understanding is that this is not at all widely used currently. Like if you go to google while claiming that you're chrome, maybe.

1 0

valgrind errors
by eocene＠gmx.com 26 Jun '16

26 Jun '16

Was just having a look at the valgrind errors, and I think the main one is in textblock.cc: int leftBorder = boxOffsetX () + leftInnerPadding + (lines->size () == 0 ? line1OffsetEff : 0); leftBorder being set to line1OffsetEff when line1OffsetEff has not been initialized.

2 4

Error message when starting 3.1-dev from xterm
by waltdnes＠waltdnes.org 26 Jun '16

26 Jun '16

Wnen starting up from an xterm, and then exiting, I get the following. ** ERROR **: prefsparser: Syntax error in dillorc: name="(null)" value="(null)" Domain: Default accept. dillo_dns_init: Here we go! (threaded) Disabling cookies. Dillo: normal exit! I moved my custom dillorc, and copied the generic one, i.e. /usr/local/dillo/etc/dillo/dillorc to check that it wasn't something I did. It still gets the same error. -- Walter Dnes <waltdnes at waltdnes.org>

3 4

Patch: Zero detected HTML errors
by nick＠linicks.net 25 Jun '16

25 Jun '16

Hi Devs, The sentence (Dillo message): Zero detected HTML errors! Is a bit contrived in English - this small patch (attached) changes it to more legal/legible English usage. Regards, Nick -- Gosh that takes me back... or is it forward? That's the trouble with time travel, you never can tell." -- Doctor Who "Androids of Tara"

2 6

New design of tag nesting cleanup within the parser.
by jcid＠dillo.org 24 Jun '16

24 Jun '16

Hi there, This is an important patchset that's just been committed. There're plenty of details in the hg comments (hg log -v). This are changes that affect the way dillo copes with Tag Soup (i.e. bad formed HTML). The idea is to create a valid doc tree before passing it to Dw for rendering, so yes, rendering may change. Please check the comments, then browse your regular sites and give it a test drive, then send some feedback. At least in my case there were nice surprises! -- Cheers Jorge.-

5 18

Strange performance behaviour related to <span>
by sgeerken＠dillo.org 20 Jun '16

20 Jun '16

Hi! I've stripped down one testcase to a sequence of simple HTML snippets. Try (for i in $(seq 1 20); do echo '<div style="float:left"><div></div><div style="display:table"><span></div></div>'; done) > tmp.html; dillo tmp.html and the development version of dillo hangs for a while. You may vary the number (second argument of seq). If you look at the file tmp.html, you'll notice that it is incorrect HTML. Interrestinly, leaving the <span> away still results in incorrect and deeply nested HTML, but dillo is much faster: (for i in $(seq 1 20); do echo '<div style="float:left"><div></div><div style="display:table"></div></div>'; done) > tmp.html; dillo tmp.html Dillo 3.0.5 is fast in both cases. Does anyone have an idea what effect the <span> has? I've already run gprof, but the result does not look very meaningful at a first glance. Sebastian

2 6

ComplexButtonResource initial size
by jcid＠dillo.org 18 Jun '16

18 Jun '16

Hi Sebastian, While testing the design corrections of the parser's nesting handling, I noticed ComplexButtonResource takes full width as initial size. e.g. A<button></button> I didn't find where to set its initial size. Would you mind giving it a look? -- Cheers Jorge.-

2 1

Bug report - enterpress_forces_submit; mouse cursor wonky
by nick＠linicks.net 08 Jun '16

08 Jun '16

Hi all, Hard one to explain. First some info; I am running: Slackware 14.1 Xfce4 4.10.0 Latest stable kernel 3.18.35 (updated today) Now, I have a word search/dictionary page with several fields, and for some reason Dillo needs to use the mouse to 'process' the submit form - I haven't investigated what can be wrong with my HTML to make Dillo just use 'enter' to 'submit' yet. I added dillorc option enterpress_forces_submit=YES and now the page 'submit' works with the enter key. But when doing so, sometimes the mouse cursor disappears altogether afterwards (but it is still there as in the WM toolbar it appears again) You can see the Dillo toolbar icons depress but no mouse. Sometimes the mouse cursor changes to a 'I' and stays like that (in Dillo). The behaviour is totally random. The page to test is here: https://linicks.net/AnAdIc/ Just use the first field to mess around in. Try 'dillo' first, then just add extra letters or other words to test (as Dillo saves the cache - we need to refresh it). Nick -- Gosh that takes me back... or is it forward? That's the trouble with time travel, you never can tell." -- Doctor Who "Androids of Tara"

1 0