evilpie

6 ms·

1.
by evilpie 5mo ago
The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by default. https://developer.mozilla.org/en-US&
2.
by evilpie 5mo ago
> The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with. > - We are not, and have no plans to abandon MV2
3.
by evilpie 7mo ago
Yes. It's in about:keyboard.
4.
by evilpie 7mo ago
You aren't reading it right. new Sanitizer({}) This Sanitizer will allow everything by default, but setHTML will still block elements/attributes that can lead to XSS. You might want something like: new Sanitizer({ repla
5.
by evilpie 7mo ago
Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.
6.
by evilpie 7mo ago
We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)
7.
by evilpie 11mo ago
If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.
8.
by evilpie 11mo ago
We enabled this by default in Firefox Nightly (only) this week.
9.
Firefox Security and Privacy newsletter 2025 Q2(attackanddefense.dev)
3 points by evilpie 1y ago|0 comments
10.
by evilpie 1y ago
Make sure you have Firefox 138! From the release notes: > You can also now reposition a tab group on the tab bar by dragging it.
11.
by evilpie 1y ago
Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy. https://extensionworkshop.com/documentation/publish/add-on-p...
12.
by evilpie 1y ago
While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security. For example I helped uBlock Origin out in 2022 when they ran into this: https://git
13.
Hardening the Firefox Front End with Content Security Policies(attackanddefense.dev)
185 points by evilpie 1y ago|68 comments
14.
by evilpie 2y ago
If it's disabled (greyed-out), then you already have telemetry disabled.
15.
by evilpie 2y ago
Firefox also has the about:config preference permissions.default.image: 2, which will block most images.
16.
by evilpie 3y ago
The profile actually shows the freeze is not caused by normal JS garbage collection, but by cycle collection. So probably something related to DOM nodes.
17.
by evilpie 3y ago
See also https://ooooooooo.ooo/ . "9o3o is an official (but experimental) online version of the Flashpoint Archive."
18.
by evilpie 3y ago
https://www.pcgameshardware.de/Internet-Thema-34041/News/AVM... Also one of the headings was mistranslated horribly. In linked the article: "AVM threatens to ban the sale of Fritzbox routers". The origin
19.
by evilpie 3y ago
See also Dario Casali's Half Life 25yr anniversary playthrough: https://www.youtube.com/playlist?list=PLk5gaNp4x_AVIJviyHueH...
20.
by evilpie 3y ago
Igalia is regularly contracted to work on new Firefox features, so this is already happening.
21.
by evilpie 3y ago
[deleted because I don't to be accused for ragebaiting]
22.
by evilpie 3y ago
As far as I can tell from my own recommended extensions is that every update needs to be approved/reviewed before it's made generally available.
23.
by evilpie 4y ago
> And it doesn't even tell you that it doesn't accept unsigned extensions, they claim that the extension is "broken". It's likely you forgot to include the browser_specific_settings with a some arbitrary id in th
24.
by evilpie 4y ago
This doesn't really affect blocking requests in any way, actually it's the opposite: This change doesn't allow extensions to bypass builtin security features. Firefox is going to continue to have more powerful blocking feat
25.
by evilpie 4y ago
Did you ever get around to communicating your use-case to the developers?
26.
by evilpie 4y ago
> Type starting with x- are non-standard. x-moz- means it’s a mozilla-defined one. There seems to be no standard mime type for a URL The standard web MIME for url(s) is text/uri-list: https://www.rfc-editor.org/rfc&#
27.
by evilpie 4y ago
Firefox will also rewrite YouTube embeds: https://searchfox.org/mozilla-central/rev/c6d17806faef8708b6... . Firefox also ships a "system" add-on ( https://github.com/mozilla-extensions&#x2F
28.
by evilpie 4y ago
Seems like they don't mention that fact anywhere in the readme or homepage.
29.
by evilpie 5y ago
The actual bug was in the C++ code handling the Content-Length header ( https://hg.mozilla.org/integration/autoland/rev/48c0e854be62... ) and the Rust code just happened to be first to trigger it.
30.
by evilpie 5y ago
I was wondering if the recent falling out with France had something to do with it. Maybe this is a cheap way to earn some points with Macron after NSO was caught potentially? spying on him/his government.

More ›