Viewing profile — evilpie

The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by defaul…

> The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with. …

Yes. It's in about:keyboard.

You aren't reading it right. new Sanitizer({}) This Sanitizer will allow everything by default, but setHTML will still block elements/attributes that can lead to XSS. You might wan…

Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.

We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)

If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.

We enabled this by default in Firefox Nightly (only) this week.

Make sure you have Firefox 138! From the release notes: > You can also now reposition a tab group on the tab bar by dragging it.

Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy. https://extensionworkshop.com/documentation/publish/add-on-p...

While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security. For example I helped uBlock Origin…

If it's disabled (greyed-out), then you already have telemetry disabled.

Firefox also has the about:config preference permissions.default.image: 2, which will block most images.

The profile actually shows the freeze is not caused by normal JS garbage collection, but by cycle collection. So probably something related to DOM nodes.

See also https://ooooooooo.ooo/ . "9o3o is an official (but experimental) online version of the Flashpoint Archive."

https://www.pcgameshardware.de/Internet-Thema-34041/News/AVM... Also one of the headings was mistranslated horribly. In linked the article: "AVM threatens to ban the sale of Fritzb…

See also Dario Casali's Half Life 25yr anniversary playthrough: https://www.youtube.com/playlist?list=PLk5gaNp4x_AVIJviyHueH...

Igalia is regularly contracted to work on new Firefox features, so this is already happening.

[deleted because I don't to be accused for ragebaiting]

As far as I can tell from my own recommended extensions is that every update needs to be approved/reviewed before it's made generally available.