- Dillo-dev - lists.mailman3.com

patch: .domain cookies from/to domain

by corvid＠lavabit.com

I realized that there's an asymmetry in the dillo code with it accepting but not sending .example.com for a host example.com, when this asymmetry is not in the spec, AFAICT. Cookies are to be rejected if the "value for the request-host does not domain-match the Domain attribute", and "Host A's name domain-matches host B's if * both host names are IP addresses and their host name strings match exactly; or * both host names are FQDN strings and their host name strings match exactly; or * A is a FQDN string and has the form NB, where N is a non-empty name string, B has the form .B', and B' is a FQDN string. (So, x.y.com domain-matches .y.com but not y.com.)" So it seems that we "shouldn't" accept them in the first place.

Dec. 29, 2009

table/cell width problem

by Johannes.Hofmann＠gmx.de

-------- Original-Nachricht -------- > Datum: Tue, 29 Dec 2009 13:54:45 +0000 > Von: "corvid" <corvid(a)lavabit.com> > An: dillo-dev(a)dillo.org > Betreff: Re: [Dillo-dev] table/cell width problem > Jorge wrote: > > On Sun, Dec 27, 2009 at 05:27:08AM +0000, corvid wrote: > > > Also, I finally got around to looking into why the columns are strange > > > on http://hg.dillo.org/dillo when I have remote style sheets enabled. > > > > > > Each row is a separate table, and the date and submitter fields have > > > fixed widths specified in ems. That seems to work in general, but the > > > problem is that the tables have width specified as 100%, which seems > > > to make the table code forget about the column widths. > > > > IIRC a CSS-aware user agent can act as if old HTML presentation > > directives weren't there. Which could apply here. > > > > OTOH I don't know whether this would cause more harm. > > Let's suppose that it had been specified as <table style="width:100%">, > then. Enabling the code in dw/table.cc around line 697 seems to change this behaviour. Not sure if it already fixes it though. Cheers, Johannes -- Preisknaller: GMX DSL Flatrate f?r nur 16,99 Euro/mtl.! http://portal.gmx.net/de/go/dsl02

Dec. 29, 2009

table/cell width problem

by corvid＠lavabit.com

Jorge wrote: > On Sun, Dec 27, 2009 at 05:27:08AM +0000, corvid wrote: > > Also, I finally got around to looking into why the columns are strange > > on http://hg.dillo.org/dillo when I have remote style sheets enabled. > > > > Each row is a separate table, and the date and submitter fields have > > fixed widths specified in ems. That seems to work in general, but the > > problem is that the tables have width specified as 100%, which seems > > to make the table code forget about the column widths. > > IIRC a CSS-aware user agent can act as if old HTML presentation > directives weren't there. Which could apply here. > > OTOH I don't know whether this would cause more harm. Let's suppose that it had been specified as <table style="width:100%">, then.

Dec. 29, 2009

patch: .domain cookies from/to domain

by corvid＠lavabit.com

Jorge wrote: > On Mon, Dec 28, 2009 at 01:21:41AM +0000, corvid wrote: > > Like the patch says, > > /* > > * Technically, cookies set with a domain of .example.com cannot be sent > > * back to the host example.com, even if example.com set them in the first > > * place. Do most user agents allow it? Yes. Does a large percentage of the > > * web require it in order to work at all? Yes. > > */ > > > > The downside might be the scenario of sub.example.com setting a cookie > > that example.com didn't expect to receive, but if everyone else does it... > > AFAIS it would provide a very good way for tracking what pages > a user is reading to big hosting sites. e.g. blogspot.com I believe in that case, subdomains of blogspot.com would already be able to read/write a .blogspot.com cookie. > If you're using a unique IP, it may not add much, but if you're > behind a NAT or proxy or similar, this cookie singles out you. > > Considering most browsers allow these cookies, chances of > finding tracking code using this technique increases! Probably > only opaqued by the much bigger privacy hole javascript provides. > > :) > > > Unless someone tells me not to within the next few days, I'll commit > > something along the lines of this patch. > > I'd use a cookiesrc option set to NO by default instead of the > #define. > > Maybe allowing to set it by site (as the rest of cookiesrc) is > not a bad idea too. After all, people would enable it when they > need a specific site to work. Setting it by site sounds like a good idea.

Dec. 29, 2009

table/cell width problem

by jcid＠dillo.org

On Sun, Dec 27, 2009 at 05:27:08AM +0000, corvid wrote: > Also, I finally got around to looking into why the columns are strange > on http://hg.dillo.org/dillo when I have remote style sheets enabled. > > Each row is a separate table, and the date and submitter fields have > fixed widths specified in ems. That seems to work in general, but the > problem is that the tables have width specified as 100%, which seems > to make the table code forget about the column widths. IIRC a CSS-aware user agent can act as if old HTML presentation directives weren't there. Which could apply here. OTOH I don't know whether this would cause more harm. -- Cheers Jorge.-

Dec. 29, 2009

patch: .domain cookies from/to domain

by jcid＠dillo.org

On Mon, Dec 28, 2009 at 01:21:41AM +0000, corvid wrote: > Like the patch says, > /* > * Technically, cookies set with a domain of .example.com cannot be sent > * back to the host example.com, even if example.com set them in the first > * place. Do most user agents allow it? Yes. Does a large percentage of the > * web require it in order to work at all? Yes. > */ > > The downside might be the scenario of sub.example.com setting a cookie > that example.com didn't expect to receive, but if everyone else does it... AFAIS it would provide a very good way for tracking what pages a user is reading to big hosting sites. e.g. blogspot.com If you're using a unique IP, it may not add much, but if you're behind a NAT or proxy or similar, this cookie singles out you. Considering most browsers allow these cookies, chances of finding tracking code using this technique increases! Probably only opaqued by the much bigger privacy hole javascript provides. :) > Unless someone tells me not to within the next few days, I'll commit > something along the lines of this patch. I'd use a cookiesrc option set to NO by default instead of the #define. Maybe allowing to set it by site (as the rest of cookiesrc) is not a bad idea too. After all, people would enable it when they need a specific site to work. -- Cheers Jorge.-

Dec. 29, 2009

Problem while running Dillo2 browser on latest CVS LTIB code + IMX27 ADS

by jcid＠dillo.org

On Mon, Dec 28, 2009 at 04:49:42PM +0530, Rajesh Marathe wrote: > Hi, > > We are working on IMX27 ADS board and have taken latest CVS based LTIB > code. I have included 'Dillo2' and 'fltk' packages as my objective would > be to run the browser dillo on the imx27 system. > > After the Linux boots up, I go to the console and try to run the > browser. But, I get the following error: > > ---------------------------------------------------------------------- > mx27# > mx27# > mx27# ./dillo > paths: Cannot open file > '//.dillo/dillorc' > paths: > Using /usr/etc/dillo/dillorc > paths: Cannot open file > '//.dillo/keysrc' > paths: > Using /usr/etc/dillo/keysrc > dillo_dns_init: Here we go! > (threaded) > Disabling > cookies. > Can't open display > ":0.0" > mx27# > ---------------------------------------------------------------------- > > I did try to debug and found out that the function fltk::open_display > returns the above display error. > > How do I set the display correctly so that the browser's opening page > gets displayed on the LCD panel connected to IMX27 board ? Assuming you have the X server already running, run dillo as the same user that has the X server running (not root). Dillo needs the X server (or kdrive) to run. If you can run the fltk demo, dillo should run too. -- Cheers Jorge.-

Dec. 28, 2009

Problem while running Dillo2 browser on latest CVS LTIB code + IMX27 ADS

by rmarathe＠i-rode.com

Hi, We are working on IMX27 ADS board and have taken latest CVS based LTIB code. I have included 'Dillo2' and 'fltk' packages as my objective would be to run the browser dillo on the imx27 system. After the Linux boots up, I go to the console and try to run the browser. But, I get the following error: ---------------------------------------------------------------------- mx27# mx27# mx27# ./dillo paths: Cannot open file '//.dillo/dillorc' paths: Using /usr/etc/dillo/dillorc paths: Cannot open file '//.dillo/keysrc' paths: Using /usr/etc/dillo/keysrc dillo_dns_init: Here we go! (threaded) Disabling cookies. Can't open display ":0.0" mx27# ---------------------------------------------------------------------- I did try to debug and found out that the function fltk::open_display returns the above display error. How do I set the display correctly so that the browser's opening page gets displayed on the LCD panel connected to IMX27 board ? regards, Rajesh Marathe.

Dec. 28, 2009

web bug save?

by corvid＠lavabit.com

bb wrote: > You sent me an option switch to forbid dillo to request another domain > as that of the actually used page: > http://lists.auriga.wearlab.de/pipermail/dillo-dev/2009-September/006844.ht… > > How can I patch Dillo in this way? > It might be useful to have that as an option in Dillo, I am shure not > every user is comfortable with that restriction. I just remembered that I had another version later in the thread, and I just took a couple of minutes to get the patch to apply cleanly again. http://www.dillo.org/test/filtering.2.patch from the main directory of the dillo source, "patch -p1 < filtering.2.patch" and then put filter_auto_requests=same_domain in ~/.dillorc

Dec. 28, 2009

patch: .domain cookies from/to domain

by corvid＠lavabit.com

Like the patch says, /* * Technically, cookies set with a domain of .example.com cannot be sent * back to the host example.com, even if example.com set them in the first * place. Do most user agents allow it? Yes. Does a large percentage of the * web require it in order to work at all? Yes. */ The downside might be the scenario of sub.example.com setting a cookie that example.com didn't expect to receive, but if everyone else does it... Unless someone tells me not to within the next few days, I'll commit something along the lines of this patch. PS I just committed a change today to fix up expiration/replacement of cookies, which was somewhat broken in general, and especially broken with respect to session cookies, so if anyone out there uses cookies much, please test!

Dec. 28, 2009