- Dillo-dev - lists.mailman3.com

how about if we make a 3.0.5

by eocene＠gmx.com

I wrote: > noname wrote: > > SSL3 and compression are not the main issue. > > HTTPS in dillo is completely broken because it does not check for domain > > name in the certificate. > > hg tip has checking code copied from wget and current dillo release has > > no code for it at all. It means that Dillo accepts any valid certificate > > as a certificate for, let's say, gmail. You can get one from StartSSL > > for free and test, it works. > > Right, I hadn't wanted to do any real New Work for 3.0.5 that would require > a somewhat higher level of scrutiny and testing, but all right, I'll take > a look at gluing that stuff into the https dpi. Adapted the name checking to fit into the dpi, plus server name indication while I was at it. Looks like it may be working. I'll push the code to the server later if you can promise to help give it heavy testing in coming days. When you're browsing, if you just change http to https, so many sites that don't expect TLS connections will offer up certificates that are broken in some way. And then try the various cancel/continue combinations...

June 12, 2015

how about if we make a 3.0.5

by eocene＠gmx.com

noname wrote: > SSL3 and compression are not the main issue. > HTTPS in dillo is completely broken because it does not check for domain > name in the certificate. > hg tip has checking code copied from wget and current dillo release has > no code for it at all. It means that Dillo accepts any valid certificate > as a certificate for, let's say, gmail. You can get one from StartSSL > for free and test, it works. Right, I hadn't wanted to do any real New Work for 3.0.5 that would require a somewhat higher level of scrutiny and testing, but all right, I'll take a look at gluing that stuff into the https dpi.

June 12, 2015

how about if we make a 3.0.5

by noname＠inventati.org

On Tue, Jun 09, 2015 at 02:50:30PM +0000, eocene wrote: > > It would be nice to put out some new stuff. > > Primary motivations: > > 1. placeholder attributes for textarea/input are everywhere, and often > they have no other explanation of their purpose. Having to guess > "this is probably for search, this is probably for username, this > is probably for password" is no fun. > 2. I know there are users just trusting dillo's https, so at the > least it would be good for their https dpis to have a better > cipher list and to disable SSL3 and compression. SSL3 and compression are not the main issue. HTTPS in dillo is completely broken because it does not check for domain name in the certificate. hg tip has checking code copied from wget and current dillo release has no code for it at all. It means that Dillo accepts any valid certificate as a certificate for, let's say, gmail. You can get one from StartSSL for free and test, it works.

June 12, 2015

[jcid@dillo.org: Re: how about if we make a 3.0.5]

by eocene＠gmx.com

Jorge wrote: > Good! This list looks quite safe to me. > > Feel free to ask if you find more patches thay may be included. Just now I was adding in: 1. Image buffer/cache improvements. 2. that which I found myself missing during use yesterday: a. Better notification when user's domainrc settings block page redirection. b. a bunch of assorted BUG_MSG/MSG changes made over the course of the past year. Looking at page bugs now for pages, I find myself sort of wanting my character reference changes, but...I have to draw the line somewhere. Although we have been running on it for a year... I don't know. Thoughts: - I guess it's a good sign that we're making some sort of progress if I miss having various changes. - My perception while using this prospective 3.0.5 yesterday was that it feels good, it feels speedy. Oh, one more thing: Does "Add break option after <img>" have something to do with floats, or can/should it go in as well?

June 12, 2015

[jcid@dillo.org: Re: how about if we make a 3.0.5]

by jcid＠dillo.org

On Thu, Jun 11, 2015 at 10:02:37PM +0000, eocene wrote: > Jorge wrote: > > On Thu, Jun 11, 2015 at 03:46:57PM +0000, eocene wrote: > > > I wrote: > > > > > > > > It would be nice to put out some new stuff. > > > > > > [snip] > > > > > > Been experimenting with a 3.0.5 branch (hg graft). > > > > > > Jorge: Do you think it would be a good idea to pull in your image changes > > > as well? We've been running on them for a long time and I imagine they > > > wouldn't be entangled to any great degree with anything else. > > > > Certainly. > > > > FWIW, I'm not comfortable with pushing a release yet because lots of sites > > render "better" (more readable) with the old version (be it because of float > > positioning or CSS colors). > > > > It's also true that a lot of time has passed since our last release, so > > if you can get some win-win features of the new branch and merge them into > > a better-than-the-former release, that we can confidently handle to our > > users, it may be worth the effort. > > Yeah, I'm staying away from float, grows, http, and tls for this. > I started with the last changeset in the 3.0.4.1 branch and added the > following: > > user: corvid > date: Thu Jun 11 15:20:02 2015 +0000 > summary: now give it a version number > > user: Sebastian Geerken > date: Sat Jul 12 15:27:37 2014 +0200 > summary: Tests are now linked to libX11 when needed. > > user: corvid > date: Wed Jul 23 19:02:56 2014 +0000 > summary: clarify situation with MENU element > > user: corvid > date: Wed Oct 08 15:27:10 2014 +0000 > summary: more compact MSG > > user: corvid > date: Wed Oct 22 01:29:46 2014 +0000 > summary: trim the publicsuffix TLDs yet again > > user: corvid > date: Fri Jul 18 19:34:35 2014 +0000 > summary: TODO > > user: corvid > date: Thu Jun 11 02:20:55 2015 +0000 > summary: 3.0.5 splash > > user: corvid > date: Wed Jun 10 22:22:11 2015 +0000 > summary: ChangeLog > > user: corvid > date: Wed Jun 10 22:08:12 2015 +0000 > summary: https rm RC4 from cipher list > > user: corvid > date: Sun May 31 02:17:35 2015 +0000 > summary: rm MSG > > user: corvid > date: Thu May 28 21:15:21 2015 +0000 > summary: libpng 1.6 series works for me > > user: Jorge Arellano Cid > date: Wed May 27 11:07:04 2015 -0300 > summary: Made view-source dpi use CSS formatting (it's shorter and cleaner) > > user: Jorge Arellano Cid > date: Tue May 26 11:29:21 2015 -0300 > summary: Fix view-source dpi to handle null characters correctly > > user: corvid > date: Sat May 16 17:28:24 2015 +0000 > summary: dillorc: search urls duckduckgo and startpage always redirect to https, so just specify https > > user: corvid > date: Sat May 09 15:24:53 2015 +0000 > summary: splash: urge users to read help. mention domainrc. > > user: corvid > date: Sat May 09 07:10:21 2015 +0000 > summary: keys: add Menu key > > user: corvid > date: Sat May 09 02:54:15 2015 +0000 > summary: fix font-size:(larger|smaller) > > user: corvid > date: Sun Apr 12 17:35:43 2015 +0000 > summary: more html5 doctype strings > > user: corvid > date: Fri Apr 03 19:24:10 2015 +0000 > summary: html5 (and css3) permit gr[ae]y in color names > > user: Johannes Hofmann > date: Sun Mar 08 20:05:21 2015 +0100 > summary: fix leak introduced in bbd25bf5 > > user: Johannes Hofmann > date: Fri Jul 25 22:48:32 2014 +0200 > summary: avoid requesting background images if an ancestor has display:none > > user: Johannes Hofmann > date: Tue Jan 06 21:29:27 2015 +0100 > summary: disable drag and drop > > user: Johannes Hofmann > date: Sun Feb 15 19:27:04 2015 +0100 > summary: use new count field to override default search url > > user: Johannes Hofmann > date: Sun Feb 15 19:20:21 2015 +0100 > summary: add count field in PrefsParser SymNode_t > > user: Johannes Hofmann > date: Sun Feb 15 19:17:51 2015 +0100 > summary: use single symbols table in PrefsParser::parse() > > user: corvid > date: Tue Feb 03 01:06:26 2015 +0000 > summary: for input placeholder, set position to beginning in case it's too long to show all at once > > user: corvid > date: Mon Feb 02 22:23:45 2015 +0000 > summary: TEXTAREA placeholder attribute > > user: corvid > date: Sat Jan 24 00:21:18 2015 +0000 > summary: input init usual_color > > user: Jorge Arellano Cid > date: Thu Jan 22 12:59:41 2015 -0300 > summary: Fix for segfault when there's no dpid and view source is requested. > > user: corvid > date: Thu Jan 22 08:51:02 2015 +0000 > summary: INPUT placeholder attribute > > user: corvid > date: Fri Jan 16 02:59:01 2015 +0000 > summary: don't inheritBackgroundColor for html5 sectioning stuff > > user: corvid > date: Fri Oct 17 01:36:00 2014 +0000 > summary: everyone's finally disabling SSL3; let's do so too > > user: corvid > date: Wed Sep 24 23:11:07 2014 +0000 > summary: handle irix's version of vsnprintf() > > user: corvid > date: Tue Sep 16 00:21:49 2014 +0000 > summary: url positioning in location bar > > user: corvid > date: Wed Sep 03 22:17:07 2014 +0000 > summary: a couple of quick https improvements > > user: Johannes Hofmann > date: Thu Aug 14 19:45:53 2014 +0200 > summary: improve lang and xml:lang attribute parsing > > user: corvid > date: Tue Aug 05 20:50:31 2014 +0000 > summary: html5 doctype, whitespace permitted between "html" and '>' > > user: corvid > date: Sat Aug 02 05:14:24 2014 +0000 > summary: fix the icon name fix > > user: corvid > date: Tue Jul 29 21:54:09 2014 +0000 > summary: fix icon name > > user: corvid > date: Fri Jul 18 18:53:28 2014 +0000 > summary: dillorc consistency > > user: corvid > date: Sun Jul 13 15:54:20 2014 +0000 > summary: let's not mention ipaq anymore > > user: Johannes Hofmann > date: Tue Jun 03 21:15:10 2014 +0200 > summary: change fltk-config test to be more crosscompile/buildroot friendly > > user: corvid > date: Tue Apr 15 21:49:30 2014 +0000 > summary: startpage in search urls > > parent: 3997:04d67ca748ba > user: corvid > date: Thu Apr 10 00:23:00 2014 +0000 > summary: user_help fix character reference Good! This list looks quite safe to me. Feel free to ask if you find more patches thay may be included. -- Cheers Jorge.-

June 12, 2015

[jcid@dillo.org: Re: how about if we make a 3.0.5]

by eocene＠gmx.com

Jorge wrote: > On Thu, Jun 11, 2015 at 03:46:57PM +0000, eocene wrote: > > I wrote: > > > > > > It would be nice to put out some new stuff. > > > > [snip] > > > > Been experimenting with a 3.0.5 branch (hg graft). > > > > Jorge: Do you think it would be a good idea to pull in your image changes > > as well? We've been running on them for a long time and I imagine they > > wouldn't be entangled to any great degree with anything else. > > Certainly. > > FWIW, I'm not comfortable with pushing a release yet because lots of sites > render "better" (more readable) with the old version (be it because of float > positioning or CSS colors). > > It's also true that a lot of time has passed since our last release, so > if you can get some win-win features of the new branch and merge them into > a better-than-the-former release, that we can confidently handle to our > users, it may be worth the effort. Yeah, I'm staying away from float, grows, http, and tls for this. I started with the last changeset in the 3.0.4.1 branch and added the following: user: corvid date: Thu Jun 11 15:20:02 2015 +0000 summary: now give it a version number user: Sebastian Geerken date: Sat Jul 12 15:27:37 2014 +0200 summary: Tests are now linked to libX11 when needed. user: corvid date: Wed Jul 23 19:02:56 2014 +0000 summary: clarify situation with MENU element user: corvid date: Wed Oct 08 15:27:10 2014 +0000 summary: more compact MSG user: corvid date: Wed Oct 22 01:29:46 2014 +0000 summary: trim the publicsuffix TLDs yet again user: corvid date: Fri Jul 18 19:34:35 2014 +0000 summary: TODO user: corvid date: Thu Jun 11 02:20:55 2015 +0000 summary: 3.0.5 splash user: corvid date: Wed Jun 10 22:22:11 2015 +0000 summary: ChangeLog user: corvid date: Wed Jun 10 22:08:12 2015 +0000 summary: https rm RC4 from cipher list user: corvid date: Sun May 31 02:17:35 2015 +0000 summary: rm MSG user: corvid date: Thu May 28 21:15:21 2015 +0000 summary: libpng 1.6 series works for me user: Jorge Arellano Cid date: Wed May 27 11:07:04 2015 -0300 summary: Made view-source dpi use CSS formatting (it's shorter and cleaner) user: Jorge Arellano Cid date: Tue May 26 11:29:21 2015 -0300 summary: Fix view-source dpi to handle null characters correctly user: corvid date: Sat May 16 17:28:24 2015 +0000 summary: dillorc: search urls duckduckgo and startpage always redirect to https, so just specify https user: corvid date: Sat May 09 15:24:53 2015 +0000 summary: splash: urge users to read help. mention domainrc. user: corvid date: Sat May 09 07:10:21 2015 +0000 summary: keys: add Menu key user: corvid date: Sat May 09 02:54:15 2015 +0000 summary: fix font-size:(larger|smaller) user: corvid date: Sun Apr 12 17:35:43 2015 +0000 summary: more html5 doctype strings user: corvid date: Fri Apr 03 19:24:10 2015 +0000 summary: html5 (and css3) permit gr[ae]y in color names user: Johannes Hofmann date: Sun Mar 08 20:05:21 2015 +0100 summary: fix leak introduced in bbd25bf5 user: Johannes Hofmann date: Fri Jul 25 22:48:32 2014 +0200 summary: avoid requesting background images if an ancestor has display:none user: Johannes Hofmann date: Tue Jan 06 21:29:27 2015 +0100 summary: disable drag and drop user: Johannes Hofmann date: Sun Feb 15 19:27:04 2015 +0100 summary: use new count field to override default search url user: Johannes Hofmann date: Sun Feb 15 19:20:21 2015 +0100 summary: add count field in PrefsParser SymNode_t user: Johannes Hofmann date: Sun Feb 15 19:17:51 2015 +0100 summary: use single symbols table in PrefsParser::parse() user: corvid date: Tue Feb 03 01:06:26 2015 +0000 summary: for input placeholder, set position to beginning in case it's too long to show all at once user: corvid date: Mon Feb 02 22:23:45 2015 +0000 summary: TEXTAREA placeholder attribute user: corvid date: Sat Jan 24 00:21:18 2015 +0000 summary: input init usual_color user: Jorge Arellano Cid date: Thu Jan 22 12:59:41 2015 -0300 summary: Fix for segfault when there's no dpid and view source is requested. user: corvid date: Thu Jan 22 08:51:02 2015 +0000 summary: INPUT placeholder attribute user: corvid date: Fri Jan 16 02:59:01 2015 +0000 summary: don't inheritBackgroundColor for html5 sectioning stuff user: corvid date: Fri Oct 17 01:36:00 2014 +0000 summary: everyone's finally disabling SSL3; let's do so too user: corvid date: Wed Sep 24 23:11:07 2014 +0000 summary: handle irix's version of vsnprintf() user: corvid date: Tue Sep 16 00:21:49 2014 +0000 summary: url positioning in location bar user: corvid date: Wed Sep 03 22:17:07 2014 +0000 summary: a couple of quick https improvements user: Johannes Hofmann date: Thu Aug 14 19:45:53 2014 +0200 summary: improve lang and xml:lang attribute parsing user: corvid date: Tue Aug 05 20:50:31 2014 +0000 summary: html5 doctype, whitespace permitted between "html" and '>' user: corvid date: Sat Aug 02 05:14:24 2014 +0000 summary: fix the icon name fix user: corvid date: Tue Jul 29 21:54:09 2014 +0000 summary: fix icon name user: corvid date: Fri Jul 18 18:53:28 2014 +0000 summary: dillorc consistency user: corvid date: Sun Jul 13 15:54:20 2014 +0000 summary: let's not mention ipaq anymore user: Johannes Hofmann date: Tue Jun 03 21:15:10 2014 +0200 summary: change fltk-config test to be more crosscompile/buildroot friendly user: corvid date: Tue Apr 15 21:49:30 2014 +0000 summary: startpage in search urls parent: 3997:04d67ca748ba user: corvid date: Thu Apr 10 00:23:00 2014 +0000 summary: user_help fix character reference

June 11, 2015

[jcid@dillo.org: Re: how about if we make a 3.0.5]

by jcid＠dillo.org

Ooops, I mistakenly replied private... Here's the FWD. -- Cheers Jorge.-

June 11, 2015

how about if we make a 3.0.5

by eocene＠gmx.com

I wrote: > > It would be nice to put out some new stuff. [snip] Been experimenting with a 3.0.5 branch (hg graft). Jorge: Do you think it would be a good idea to pull in your image changes as well? We've been running on them for a long time and I imagine they wouldn't be entangled to any great degree with anything else.

June 11, 2015

how about if we make a 3.0.5

by eocene＠gmx.com

It would be nice to put out some new stuff. Primary motivations: 1. placeholder attributes for textarea/input are everywhere, and often they have no other explanation of their purpose. Having to guess "this is probably for search, this is probably for username, this is probably for password" is no fun. 2. I know there are users just trusting dillo's https, so at the least it would be good for their https dpis to have a better cipher list and to disable SSL3 and compression. And then pick out some small, safe fixes. Just to look at ChangeLog, some candidates might be: - Fix crash that's possible searching for text while page still being built. - Fix for segfault when there's no dpid and view source is requested. - Fix view-source dpi to handle null characters correctly. - Made view-source dpi use CSS formatting (it's shorter and cleaner). - Crosscompile/buildroot-friendly fltk-config test. - Fix X11 icon name. - In location bar, tend toward showing beginning of URL instead of end. - Handle irix's version of vsnprintf(). - Fix bug with font_factor preference and CSS font-size:(larger|smaller). - Recognize Menu key in keysrc. - Avoid requesting background images if an ancestor has display:none. - Ignore built-in search url if any are specified in dillorc.

June 9, 2015

Google broke recently with 3.0.4 causing repush loop

by james.from.wellington＠gmail.com

Some pages which show lots of 'redirected 0 times', show less when I block *.gravatar.com in domainrc. On 09/05/2015, James C <james.from.wellington at gmail.com> wrote: > All of this is with the cookiesrc below, which lets google have > cookies on two domains. > > If I: > - log out of google > -- it stalls on a meta refresh tag > - select home, which for me is https://mail.google.com/?ui=html > - provide a username and password > -- I am eventually shown my email messages > then the code below redirects: > - once during the logout > - twice before asking for a password > - eight (8) times before showing me my mail > > Adding back the hack to share cookies probably makes no difference to > these figures, but I'm not sure, because I think that I remember > inconsistently getting seven and nine redirects, so I think that > google is A/B testing me. > > This code cannot be put into production, because it produces messages > about redirecting 0 times reasonably often, for reasons that I haven't > tracked down yet. > > -------------------------------- > #host action > DEFAULT DENY > .google.com ACCEPT_SESSION > .google.co.nz ACCEPT_SESSION > -------------------------------- > > render/dillo-jfw01$ hg diff > diff -r 07c0c28f8960 src/cache.c > --- a/src/cache.c Fri Mar 06 13:12:11 2015 +1300 > +++ b/src/cache.c Sat May 09 22:03:31 2015 +1200 > @@ -1007,11 +1007,24 @@ > return 0; > } > > - /* if there's a redirect loop, stop now */ > - if (bw->redirect_level >= 5) > - entry->Flags |= CA_RedirectLoop; > +// if (0 == bw->redirect_level % 5) { > + if (0 == bw->redirect_level % 1) { > + char *redirMessage; > + int choice; > + > + asprintf(&redirMessage, "Dillo: redirected %d times", > bw->redirect_level); > + > + choice = a_Dialog_choice(redirMessage, URL_STR(entry->Url), > + "Stop", "Continue", NULL); > + > + if (1 == choice) > + entry->Flags |= CA_RedirectLoop; > + > + free(redirMessage); > + } > > if (entry->Flags & CA_RedirectLoop) { > + MSG("Redirect loop for: %s\n", URL_STR_(entry->Url)); > a_UIcmd_set_msg(bw, "ERROR: redirect loop for: %s", > URL_STR_(entry->Url)); > bw->redirect_level = 0; > return 0; > diff -r 07c0c28f8960 src/cookies.c > --- a/src/cookies.c Fri Mar 06 13:12:11 2015 +1300 > +++ b/src/cookies.c Sat May 09 22:03:31 2015 +1200 > @@ -196,6 +196,15 @@ > > if (requester == NULL) { > /* request made by user */ > +#if 0 > + } else if (!strcmp("accounts.google.co.nz", URL_HOST(requester)) && > + !strcmp("mail.google.com", URL_HOST(query_url))) { > + MSG("Cookies: sent for google NZ special case 1.\n"); > + } else if (!strcmp("accounts.google.com", URL_HOST(requester)) && > + !strcmp("accounts.google.co.nz", URL_HOST(query_url))) { > + MSG("Cookies: sent for google NZ special case 2.\n"); > + > +#endif > } else if (!a_Url_same_organization(query_url, requester)) { > MSG("Cookies: not sent for request by '%s' for '%s'\n", > URL_HOST(requester), URL_HOST(query_url)); > > > On 09/05/2015, eocene <eocene at gmx.com> wrote: >> James wrote: >>> Here's a guess without justification: it's trying to get confirmation >>> that you accepted a cookie, and failing. >> >> I did make a quick attempt with accept_session in cookiesrc, and it >> didn't appear to make a difference... >> >>> The basis for my guess is that login to gmail is possible, but >>> requires more than five redirects, so I run a hacked up dillo 3.1, >>> with a dialog about whether to keep redirecting. >> >> How many redirects does it need? The only site that I tend to run into >> redirect problems with is nytimes.com (Not logging into any account; >> just looking at articles that people post links to...), and the last >> time I checked it was something like 12 redirects before it will give >> up and provide the page. And I wonder whether raising the redirect >> limit might be good, overall. >> >> Does gmail still need all of those redirects if you let it have a >> cookie? >> >> _______________________________________________ >> Dillo-dev mailing list >> Dillo-dev at dillo.org >> http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev >> >

June 6, 2015