Jump to content

My Browser Builds (Part 2)


Recommended Posts


3 hours ago, Mathwiz said:

The latest Flash (32.0.0.293) doesn't work with the latest Serpent 55 (2019.10.22).
(snipped)
I tried a clean profile; same result.

Cannot reproduce here:

ZUQpukd.jpg

TKnw041.jpg

9hgFqa1.jpg

New clean profile of latest St55 (32-bit) on Vista SP2 x86 - NPAPI Adobe Flash properly installed systemwide:

Y7lgs6L.jpg

Link to comment
Share on other sites

Very strange. The new version of Flash does appear to be correctly installed, and shows up on about:addons and about:plugins as installed and set to "Always Activate." Everything looks the same as the screen shots you posted above, except the "Check Adobe Flash Version" page, which shows blanks where the two Flash controls should be. Like you, I have Flash "protected mode" enabled.

Closing the latest Serpent 55 build and launching the previous build allowed the "Check Adobe Flash Version" page to run normally. The Flash animation and the version detection both worked as expected.

For the clean profile test, I was careful to make my clean profile the default and restart the browser. In the past I've noticed that the "Launch Profile in New Browser" button doesn't always do the job. Unfortunately, results were the same.

I also tried the same tests on Windows 7 and got the same results. Maybe it only works under Vista? (jk)

However, I am now home and about to try again. Be back soon....

Edit: I'm back. This is all on 64-bit Windows 7, BTW.

  • 2019.08.18 32-bit: works.
  • 2019.08.18 64-bit: works.
  • 2019.10.22 32-bit: doesn't work (same as on my work machine and on the XP VM). But it works on @VistaLover's PC.
  • 2019.10.25 64-bit: works!

I haven't tried a clean profile on this machine yet; BRB....

Edited by Mathwiz
Link to comment
Share on other sites

20 hours ago, Mathwiz said:

2019.10.22 32-bit: doesn't work (same as on my work machine and on the XP VM).

Does the previous version of NPAPI Flash (32.0.0.270) work there? :dubbio:Of course, just a sample of two people (works for one, doesn't for the other) has no statistical value... :no:

Edited by VistaLover
Link to comment
Share on other sites

Well, a clean profile didn't work on this machine either. But, perhaps a clue....

The first time I accessed the "Check Adobe Flash Version" page after switching to a clean profile, I got a pop-up saying something about "Tracking Protection Enabled." Remember, this was a clean profile - no add-ons! So it appears the latest Serpent build has some kind of "built-in" tracking protection, which, I suspect, is "protecting" me from Flash (a notorious privacy leak).

I also noticed the 64-bit version was built (rebuilt?) three days later than the 32-bit one. I need to go back and take a look at what @roytam1 added.

Edit: I may have figured it out! I just remembered that a "clean profile" isn't necessarily the same thing as "factory default" settings! You can change preferences outside the profile too, by, for example, installing the UOC Patch - and the only browser with the UOC Patch installed is the one that Flash doesn't work on!

Of course, now I have to figure out which line of the UOC Patch is interfering with Flash....

Edit 2: This is turning out to be more complicated than I imagined, but I found part of the problem. The UOC Patch sets privacy.resistFingerprinting to true, which inexplicably interferes with the Flash animation. Removing that line from the UOC Patch lets the Flash animation play normally.

 

Despite being one of the board's resident paranoids, I don't use privacy.resistFingerprinting canvas.poisondata, which works by randomizing the canvas fingerprint each time it's read, so it can't be used as data to help uniquely identify the browser. privacy.resistFingerprinting implicitly sets canvas.poisondata (and a whole bunch of other stuff).

The problem with that approach is that it puts the browser into the rather small subset of paranoids and privacy fanatics like me, meaning it only takes a few more bits of info to uniquely identify the browser anyway! So it's sort of self-defeating. (Of course, if the UOC Patch becomes truly popular, use of that preference would spread to a much larger number of browsers, making it more effective.)

Instead, I use an add-on that randomizes the canvas fingerprint weekly. This allows short-term tracking (a test site will show that canvas fingerprints are being leaked), but forces tracking sites to start over every week. That way I can be paranoid without standing out as one of the paranoid ones!

But, that's just a personal preference, and I wouldn't expect the UOC Patch to be changed based on my personal preferences.

The fact that privacy.resistFingerprinting interferes with the proper operation of Flash is a more serious issue, however.

Unfortunately, there's another preference somewhere that interferes with the Flash version box. I haven't found that culprit yet.

Edited by Mathwiz
Link to comment
Share on other sites

On 11/9/2019 at 8:03 AM, roytam1 said:

There are changes in upstream now, but unless his uxp branch goes into main branch(or unless I cherry-pick his branch's changes into my tree), I will do cherry-picks of his repo only.

Notice: And I have no time(~5 hours more time on transportation) on porting mailnews' upstream's changes to local tree, so some components in mailnews will not be same status as upstream.

Link to comment
Share on other sites

12 hours ago, Mathwiz said:

The latest Flash (32.00.293) doesn't work with the latest Serpent 55 (2019.10.22).

How to serpent 55 2019.10.22?

Current version serpent 55 2019.10.25 - basilisk55-win64-git http://prnt.sc/pxbmr0

The latest flash OK and swf displays well.

The problem is in Adobe online installers. You need to download uninstall adobe flash player.
I provide a direct link to the offline installer that works correctly. Adobe Flash Player 32.0.0.293 Stable

https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player.exe

 

 

Edited by kitaro1
Link to comment
Share on other sites

On 11/15/2019 at 6:59 AM, Sampei.Nihira said:

@Mathwiz

Hi:hello:

Can you specify the name of the add-on?

TH.

Sure; it's "Canvas Defender," v1.1.0.

 

On 11/15/2019 at 7:52 AM, kitaro1 said:

How to serpent 55 2019.10.22?

Current version serpent 55 2019.10.25 - basilisk55-win64-git http://prnt.sc/pxbmr0

The latest flash OK and swf displays well.

The problem is in Adobe online installers. You need to download uninstall adobe flash player.
I provide a direct link to the offline installer that works correctly. Adobe Flash Player 32.0.0.293 Stable

https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player.exe

The 32-bit version is dated 2019.10.22. The 64-bit version is dated 2019.10.25. @roytam1 must have had to fix something in the 64-bit version; hence the later date.

You won't have any trouble with Flash unless you've installed @looking4awayout's UOC Patch for FF 52-based browsers. A couple of the preferences he sets interfere with Flash. I've identified one as privacy.resistFingerprinting; if you remove that line from UOC_Patch_52.js, Flash partially works.

Edit: The other problematic preference is dom.ipc.plugins.asyncdrawing.enabled. Flash doesn't seem to work correctly on Windows 7 with that preference set to true. The "Check Adobe Flash Version" Web page won't show the Flash version.

Edit 2: In my XP VM, it's a YMMV situation. Sometimes it works if I leave it set to true; sometimes it doesn't. Making things even more confusing, if the UOC Patch is not installed, the default is true in Serpent 52 and false in Serpent 55.

For consistency, I customized my copy of the UOC Patch by removing the privacy.resistFingerprinting pref and by setting dom.ipc.plugins.asyncdrawing.enabled to false. With those changes, Flash always works when the UOC Patch is installed.

Link to comment
Share on other sites

19 minutes ago, Mathwiz said:

@roytam1 must have had to fix something in the 64-bit version; hence the later date.

nope, just because x64 version of .mozconfig was being touched unexpectedly causing a full rebuilt.

Edited by roytam1
Link to comment
Share on other sites

1 hour ago, Mathwiz said:

Sure; it's "Canvas Defender," v1.1.0.

With NM28 I use canvas.poisondata set to true.

When I need to obfuscate the "ClientRects Fingerprint" *** I use the add-on:

 

https://addons.palemoon.org/addon/canvasblocker-legacy/

 

*** Test:

https://browserleaks.com/rects

Edited by Sampei.Nihira
Link to comment
Share on other sites

Wow - it turns out that privacy.resistFingerprinting does a lot more besides what canvas.poisondata does! The full list of what it's supposed to do is in the spoiler. Most of this was not implemented in Serpent 55, and I'm unsure which of these functions interferes with Flash, but something does:

 
  • Complicated (see below)
    • Canvas image extraction is blocked
    • Absolute Screen Coordinates are obscured
    • Window Dimensions are rounded to a multiple of 200x100, and a warning is shown when maximizing
    • We only allow specific system fonts to be used, and we ship them to the user using kinto
  • Non-Trivial (see below)
    • The performance API is mostly disabled
    • Time Precision is reduced to 100ms, with up to 100ms of jitter
    • mozAddonManager may be blocked bug 1384330
    • Media Devices are spoofed bug 1372073
    • WebGL is limited bug 1217290
    • The Keyboard Layout is spoofed
    • The Locale is spoofed to en-US
    • The Date Input Field and Date Picker Panel are spoofed to en-US bug 1492587
    • If you customize the preferred language list (Accept-Language), you will be warned bug 1039069
    • System Media Queries will never match bug 1479240
    • The Pointer Event is spoofed bug 1363508 and also pointerEvent.pointerid bug 1492766
  • Trivial
    • The browser version is reported to be the most recent ESR version (but the OS is not spoofed)
    • Timezone is spoofed to 'UTC'
    • The gamepad API is disabled
    • All device sensors are disabled
    • The WebSpeech API is disabled
    • WEBGL_debug_renderer_info extension is disabled bug 1337157
    • navigator.hardwareConcurrency is spoofed to 2
    • Site-specific zoom is disabled bug 1369357
    • MediaError.message is restricted to a whitelist bug 1354633
    • The Network Information API reports an 'Unknown' connection type, and the ontypechange event is suppressed bug 1372072
    • The Media Statistics API will report calculated numbers not reflecting reality bug 1369309
    • Web Extensions are able to toggle privacy.resistFingerprinting
    • Geolocation is disabled bug 1372069 - but this will be reverted bug 1441295
    • screen.orientation.type is spoofed as 'landscape-primary' and screen.orientation.angle is spoofed to '0' bug 1281949 but also bug 1433815
    • navigator.plugins and navigator.mimeTypes are reported as empty bug 1281963 and bug 1324044
    • prefers-reduced-motion always returns false bug 1478158
    • AudioContext OutputLatency is spoofed bug 1564422
Edited by Mathwiz
Link to comment
Share on other sites

Did I not say

4 hours ago, Mathwiz said:

You won't have any trouble with Flash unless you've installed @looking4awayout's UOC Patch for FF 52-based browsers.

I've twice (Edit: now three times) posted that the UOC Patch is where the problem lies.

Edited by Mathwiz
Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...