My Browser Builds (Part 4)

[mina7601]

6 hours ago, NotHereToPlayGames said:

A reminder-link for those that may be interested  --  https://msfn.org/board/topic/183484-polyfill-whats-all-this-then/?do=findComment&comment=1216125

Thanks for the flashback.

Just kidding, but thanks for the link to that topic again. it was a great topic.

Edited March 18, 2023 by mina7601

[UCyborg]

2 hours ago, NotHereToPlayGames said:

And shouldn't we then call this a "Mozillaism" since everything else is always called a "Googleism"?  

Yes, I though I'd be refreshing to read about some "Mozillaisms" here since it's always about "Googleisms".

And what do we call JPEG XL support in Pale Moon / Basilisk? AFAIK, they're the only web browsers in which support exists on the current stable release, Firefox has it only in nightly builds behind about:config setting and Chromium removed support a while ago. "Moonchildism"? "Moonchild Productionsism"? And has once widely supported NPAPI become "Moonchildism" in the end?

[OutlawHusbando]

Google tapped out because they want to protect their IPs, which are WEBP and AVIF, can't let their childs die for JPEG-XL (better at everything especially quality with a bit higher file size)

 

With MV3 all adblockers will become half-a**, and vulnerable to anti-adblock scripts because they can't use a lot of advanced blocking features like noop, scriptlets and limited amount of rule.

Edited March 18, 2023 by OutlawHusbando

[msfntor]

CSP TEST - Content Security Policy Browser Test: https://content-security-policy.com/browser-test/

It seems to me that no browser based on Firefox passes this JavaScript Unsafe Hashes Test CSP Level 3 - the result is in red: "CSP Level 3 Inline Hash Not Supported".
All our browsers built on Chrome pass this test...

[VistaLover]

On 3/17/2023 at 11:20 AM, RamonUn said:

Some things on GH still need extra polyfilling to work properly for example if you have no palefill you won't get the PerformanceObserver and thus no auto completion after typing # or @.

You can always go to about:config and toggle "dom.enable_performance_observer" to "true"; the reason it's not true by default/already is Moonchild's objection to it ...

EDIT: My post is probably redundant now , because of this ; but I hadn't got to it by the time I hit the "Submit" button  (always lessons to be learnt) ... 

Edited March 18, 2023 by VistaLover

[VistaLover]

On 3/17/2023 at 9:12 PM, UCyborg said:

On 3/15/2023 at 6:01 PM, VistaLover said:

Can someone with access to "upstream" (e.g. @UCyborg ) relay this bug to them, so, perhaps, it could be investigated and, hopefully, remedied?

They fixed it in their code tree before you posted about it here.

... For those members that have not been following this, the reference made is to the "GitHub-vanishing-timestamps-bug" I first reported here, with further instances of it reported here and here ...

Affected Serpent 52 versions in my case were 32-bit builds with BuildID=20230302072906 and BuildID=20230310123711; the second one was less tested, because of it being crash-prone ... The bug manifested itself when (martok's) palefill extension was disabled and native WC+SR support left at its default "enabled" state; throwing palefill into the mix resulted in adverse effects , sadly, as far as that bug was concerned...

I could easily and reliably reproduce the bug, both in "dirty" and "fresh" St52/NM28 profiles; rather unfortunately, others here could not (not their fault, obviously ), so I got the sense my bug report was being doubted/disputed ...

Many thanks @UCyborg for posting about it in the official Pale Moon forums; in your screengrab:

one can witness the bug present in latest PM 32.1.0b3 (64-bit) ...

For "closure", the bug was fixed (many thanks conveyed to the upstream dev, @FranklinDM) via merging PR #2152 in MoonchildProductions/UXP/commit/4c4bc3c, which landed in "our" tree as roytam1/UXP/commit/18e6934 ...

I have been running the latest St52 (32-bit) build (ID=20230315155040) for close to 7hr and can verify that (annoying) bug as fixed !

Additional thanks for your words of wisdom below, on why running official (martok's) palefill (enabled) alongside the native WC implementation should not be encouraged:

On 3/17/2023 at 9:12 PM, UCyborg said:

Palefill as provided on martok's GitHub page will indeed still impact GitHub in a significant way even when Web Components are provided by the browser because some checks aren't there so some stuff still gets injected unconditionally, but even when certain injected code has checks to not do anything if not necessary, I suppose its code must still be parsed by the browser.

Edited March 20, 2023 by VistaLover

[VistaLover]

... Just thought it prudent to post about it here, too (originally found in the official MCP forums):

https://addons.palemoon.org/addon/wctoggle/

This XUL extension is compatible with St52 (haven't tested it on St55/NM28, but should be) and contains a button that can be put onto the toolbar (/elsewhere in the visible GUI) that, when clicked, can toggle the native WebComponents+ShadowRoot support OFF/ON; the focused/selected browser tab is being reloaded when that button is clicked (so, don't click it while typing something on-line inside that tab ), to have that tab render without/with WCs... 

I found the extension useful in a niche use case of mine, more about that in a future post ...

[VistaLover]

4 hours ago, msfntor said:

It seems to me that no browser based on Firefox passes this JavaScript Unsafe Hashes Test CSP Level 3 - the result is in red: "CSP Level 3 Inline Hash Not Supported".

After reading the documentation,

https://content-security-policy.com/unsafe-hashes/

me thinks we're blessed that "our" UXP-based browsers fail that test:

Quote

This will allow the javascript

doSomething();

to run in our button, but it could also run in an element injected by an attacker.

What should you use instead of unsafe-hashes?

As we mentioned, the unsafe-hashes source list may be considered unsafe, so a better approach is to move the event handler logic into a JavaScript file.

 

4 hours ago, msfntor said:

All our browsers built on Chrome pass this test

... Consistent with the documentation:

Quote

The unsafe-hashes directive was added to CSP Level 3. It is currently supported in Chrome 69+

[VistaLover]

On 3/17/2023 at 9:12 PM, UCyborg said:

I use modified version that more thoroughly checks browser features and prevents processing rules that polyfill functions that already exist in the browser.

... Why not document those modifications in your GitHub palefill fork ?

[Mathwiz]

On 3/15/2023 at 7:18 PM, AstroSkipper said:

In this profile, setting both dom.webcomponents.enabled and dom.getRootNode.enabled to the value true with Palefill 1.26 enabled works on your testing repo, i.e., GH timestamps are shown each time.

But I bet performance suffers, negating the purpose of native Web components (dom.webcomponents.enabled=true) in the first place. So yes, you can use them together, but you patient Frisians are best advised to wait a few more weeks, until Palefill and native Web components reach some sort of truce.

In the meantime, impatient Americans, Greeks, et al. will have to choose between slow performance (Palefill) and fast but incomplete support (native Web components).

On 3/17/2023 at 3:43 AM, luweitest said:

Edge browser download page:

https://www.microsoft.com/en-us/edge/download?form=MA13FJ

do not work in Serpent 52

What @VistaLover said. Doesn't even work if you spoof Win 7 or greater in your user agent.

You've got to appreciate the irony! M$ doesn't let you download a modern browser (Edge) unless you already have one, in which case, why would you want Edge?

On 1/16/2023 at 4:27 PM, UCyborg said:

I delete VC runtime DLLs from application folder, so all api*.dll, msvcp140.dll, ucrtbase.dll, vcomp140.dll and vcruntime140.dll, also both D3DCompiler_*.dll since I have all of those in system System32/SysWOW64 folders. Then dependentlibs.list file must be modified to not list any of those

Here's a short windows .bat/.cmd file to automate that process. Set winsys=System32 unless you have a 64-bit system and you've downloaded a 32-bit browser; in that case set winsys=SysWOW64.

copy dependentlibs.list new.list
for %%f in (api*.dll msvcp140.dll ucrtbase.dll vcomp140.dll vcruntime140.dll D3DCompiler_*.dll) do if exist %windir%\%winsys%\%%f (del %%f && ren new.list b4.list && findstr /ilv "%%f" b4.list >new.list && del b4.list)

if exist new.list (
  ren dependentlibs.list dependentlibs.bak
  ren new.list dependentlibs.list
)

16 hours ago, UCyborg said:

PerformanceObserver is implemented in UXP, but MCP thinks it's evil so it's disabled by default

I don't think it's so much a matter of good v. evil as that the UXP implementation breaks Web pages such as Google Translate, that are probably used more often

16 hours ago, UCyborg said:

Firefox got structuredClone before Chromium did.

So structuredClone is probably not a Googlism? (Perhaps a Mozilla-ism?) Wonder who thought that one up, and why?

11 hours ago, UCyborg said:

And what do we call JPEG XL support in Pale Moon / Basilisk? AFAIK, they're the only web browsers in which support exists on the current stable release, Firefox has it only in nightly builds behind about:config setting and Chromium removed support a while ago.

No, it's not a "Moonchildism;" that would only apply if Moonchild added support that no other browser had. The answer is right there in your question: Google had it in Chromium, then removed it because "Google likes a rival format it helped develop, AVIF." Can't have any open alternatives to the Goog, can we?

5 hours ago, msfntor said:

It seems to me that no browser based on Firefox passes this JavaScript Unsafe Hashes Test CSP Level 3 - the result is in red: "CSP Level 3 Inline Hash Not Supported".
All our browsers built on Chrome pass this test.

Well, of course not, because "CSP Level 3 Inline Hash" is a Googlism!

[luweitest]

21 minutes ago, Mathwiz said:

On 3/17/2023 at 4:43 PM, luweitest said:

Edge browser download page:

https://www.microsoft.com/en-us/edge/download?form=MA13FJ

do not work in Serpent 52

What @VistaLover said. Doesn't even work if you spoof Win 7 or greater in your user agent.

You've got to appreciate the irony! M$ doesn't let you download a modern browser (Edge) unless you already have one, in which case, why would you want Edge?

To try GPT-4 chatbot; The new Bing needs Edge brower to work.

[VistaLover]

On 3/17/2023 at 5:41 PM, VistaLover said:

What's worse, I couldn't get a download to happen with any of 360EEv12/13/13.5 and KafanMiniBrowser, so I'm not able to fetch the Edge files under this Vista SP2 x86 laptop;

... So it's this mighty villain :

https://developer.mozilla.org/en-US/docs/Web/API/structuredClone

Unless I'm mistaken, this takes its place in history as the first JS "shiny" to not only be a UXP-killer, but a Windows XP/Vista killer at the same time : No browser able to currently launch under these OSes (Vista's Extended Kernel not taken into account here ) supports this natively ; and, to rephrase what's been posted above by Mathwiz, MS, in their infinite idiocy , used this piece of code to establish access to "their" downloads ; whatever happened to good ol' clickable links?

[luweitest]

Is there any add-on that could do HTTP everywhere? Sometimes only http version works for some site. I set a bookmarklet:

javascript:(function(){location.href=location.href.replace(/^https\:/,"http:");})()

But it only modifies current failed URL, not the ones I want to click, not even the redirections happened when I submit a form.

[VistaLover]

30 minutes ago, Mathwiz said:

I don't think it's so much a matter of good v. evil as that the UXP implementation breaks Web pages such as Google Translate, that are probably used more often

... How so? I have, since long ago, performanceObserver enabled and here (yesterday's St52 32-bit) GT works as expected:

[Mathwiz]

On 3/17/2023 at 9:12 PM, UCyborg said:

Seems a rather simple polyfill gets this one going:

https://www.gloomycorner.com/javascript-troubleshooting-structuredclone-is-not-defined/

It's been added to my palefill-1.25.4.xpi (it's newer than martok's...also gets Facebook's messenger to load again with another fix...until it breaks sometime in the future).

The polyfills like above also work when installed in the form of user script, just need the metadata, template is suggested by your favorite user script manager, just tell it to run on the problematic site and it should probably run at document-start.

Thanks, but now I have a new problem! After installing palefill-1.25.4 in St 52, the Edge download page goes totally blank immediately after downloading!

It has to be a profile issue. I installed palefill-1.25.4 in an otherwise-clean profile and it worked. Someone told me to try that first

But now I have to figure out what I could've done in St 52 that I haven't done in St 55 that blocks the Edge page from loading in the former....