Main » Discussion » Mozilla, *sigh* » New reply
    New reply
    Post help

    Presentation

    [b]…[/b] — bold type
    [i]…[/i] — italic
    [u]…[/u] — underlined
    [s]…[/s] — strikethrough
    [code]…[/code] — code block
    [spoiler]…[/spoiler] — spoiler block
    [spoiler=…]…[/spoiler]
    [source]…[/source] — colorcoded block, assuming C#
    [source=…]…[/source] — colorcoded block, specific language[which?]
    [abbr=…]…[/abbr] — abbreviation

    [franpared] [franpaorange] [franpayellow] [franpablue] [franpagreen] - you know what these are.
    [color=…]…[/color] — set text color
    [jest]…[/jest] — you're kidding
    [sarcasm]…[/sarcasm] — you're not kidding

    Links

    [img]http://…[/img] — insert image
    [url]http://…[/url]
    [url=http://…]…[/url]
    >>… — link to post by ID
    [user=##] — link to user's profile by ID

    Quotations

    [quote]…[/quote] — untitled quote
    [quote=…]…[/quote] — "Posted by …"
    [quote="…" id="…"]…[/quote] — ""Post by …" with link by post ID

    Embeds

    [youtube]…[/youtube] — video ID only please
    Thread review
    tomman Day 13 of the Clownflare Siege...

    The conflict has escalated. Big Time.

    Not only Clownflare continues refusing to give an answer publicly, they have tightened their browser blocklist:

    - SeaMonkey is now outright blocked with a "Your browser is out of date!" hard error.
    - There are reports that Opera (for those that don't remember, it's now a Chrome reskin) is now getting blocked too.
    - Poor Pale Moon / UXP users instead are being deliberately driven to madness, as Clownflare has decided to crash their browsers, first via a bug on their BigInt implementation, then now forcing the browser to crash after running out of memory. Death sentence, as decreed by the Clownflare Browser Junta.

    If this is not a deliberate criminal act, I don't know how to call it. Sadly, given the current status of the USAian administration of doom, I don't see any likely legal challenge to Clownflare's de facto control over the web browser market. Too bad DDoSing the Internet's largest anti-DDoS provider is not feasible, because they deserve a fate MUCH worse than that...

    If you use Clownflare services: STOP. Crippling the open Internet is not a worthy price to pay in exchange for some protection from the mafia.
    If you work for Clownflare: I know you have no morals anyway as a fellow Silly Con Valley employee, but the world would appreciate a lot if you reconsidered your ethics and quit. No stock options is worth killing the open Internet, sorry.
    If you work for the USDOJ: My condolencies :/
    Kawaoneechan
    Posted by tomman
    We really need the Franpa Alerts™ back...







    Aren't you glad I still have a full copy of the old boards (even if not public-facing by request) to dig these up from?

    * Kawa considers locally hosting the images and/or adding alert buttons to the post toolbar

    Edit: added [franpaX] bbcodes, where X is red orange yellow blue or green. Locally hosted. Go nuts.
    tomman We really need the Franpa Alerts™ back...

    Read my post and the linked articles again: my problem is not getting the captchas over and over, but the captchas themselves REFUSING TO EVEN LOAD because Clownflare is employing browser fingerprinting tactics designed to break on anything that isn't Chrome, a Chrome clone, "latest Firefox", or Safari. THIS IS BY DESIGN, because Clownflare now feels that owns half of the Internet, and they dislike browser diversity, just like MS in the IE/NS era.

    You cannot work around this with addons - it's effectively a hard block, a punishment tactic for not using an Approved Browser by the Clownflare Junta. No, I refuse to do that, might as well wipe Linux, reinstall Windows, make a Facetwittok account, and enjoy being part of the brainwashed masses.
    Nicholas Steel Have you tried the Silk - Privacy Pass Client extension for Fireox to minimize the need to fill in Cloudflare Captchers?
    tomman Well, Clownflare's war against diversity in web browsers promptly escalated up: it's that time of the year when not only SeaMonkey but also Pale Moon and nearly every other non-mainstrean browser gets cockblocked. HARD. Now I no longer get any checkbox I can tick to tell them that indeed I'm still made of bones and flesh. Worse: many places of the Internet now consider my complaints about CF war on users "noise, annoying compliants, a YOU problem, WORKS FOR ME".

    It has become so strongly irritating that a Pale Moon regular decided to invoke Silly Con Valley's customer service hotline: a Hackernews post: https://news.ycombinator.com/item?id=42953508
    ~200 comments so far (mostly noise praising Clownflare's services, people on Firefox/Chromium/Linux claiming endless page loops, a idiot spreading ye good ole "Pale Moon is an ancient unsafe Firefox fork" FUD, and another user saying that if you want to make a new web browser, it absolutely has to be a Chrome skin), but as of the time of this post, nobody from Clownflare is willing to take responsibility on this.

    In the meanwhile, I'm effectively BANNED from half of the Internet, especially from those websites which have set CF to "I'm under attack" level. Congats Clownflare, you managed to do what not even the actual communist thug that leads my country have managed to do so far!

    UPDATE: over 1000 votes, ~420 comments... and ZERO CF staff response. But on a thread from the same date (today) related to some Clownflare service down, the very first post is from CF's Clown Executive Officer telling their paid users that everything was peachy again, excusing himself for the downtime. Of course we Turnstile victims are not paid users (or even CF customers in first place!), so we don't deserve respect just because our web browser is not mainstream Chrome under Windows.

    Browsers cockblocked so far:
    - SeaMonkey
    - Pale Moon (it even triggered a crash related with its WIP BigInt support, which got promptly fixed!)
    - Qutebrowser
    - Arc (never heard of this one, but apparently it has more users than SeaMonkey)

    Users with addons, that self-build mainstream browsers, Chromium users, Linux users, those on some VPNs (including Apple's iCloud Relay), and even Firefox 115 ESR (STILL supported by Mozilla!) also have claimed increased harassment from Turnstile, including the endless loop issue, or failures after ticking that checkbox. Complaint threads at CF forums (powered by Dischorse Dicksores Discourse) also get promptly locked by paid CF shills. And of course the feedback form on Turnstile is wired to /dev/null.

    This. Is. WAR.
    Clownflare and their supporting users: TO HELL WITH YOU!
    tomman Clownflare, PLEASE DIE IN A SEA OF FIRE. Choke on a dick, step on a Lego, etc.

    Today Clownflare's browser integrity / captchas hit my balls a record number of times:

    - Wine's AppDB switched to "paranoia" mode after some silly idiots attacking a mostly dead site. I had to try THIRTY TIMES until the goddamned Turnsickle™ let me pass, because obviously I am one of those enemies, amirite?

    - Of course the stupid Turnsick™ will re-challenge you at unexpected times because your crime is using a Non Approved Web Browser by the Silly Con Valley Junta (official CF policy: if you're not using Chrome, Chredge, or maybe latest Firefux, you're persona non grata and subject to be embargoed from the Internet)

    - For some reason, many shady websites (including piracy/porn outlets) are relying on Clownflare, because if there is something better than blocking innocent users whose only crime was Thinking Different™, is protecting obviously illegal activity (unless you're protecting bullies/murderers, and only if there is a strong enough social media shitstorm)

    - Even if the site doesn't opt in to the Browser Integrity crapola, Turnstupid™ can be used as a ordinary captcha. This bite me BADLY today in a case involving Steam's arbitrary content policies, SJWs, Visa/MasterCard monopolies on payment cards, and... catgirls. Suffice to say, went to buy a DLC at Denpasoft, and Clownflare's half-working Turnshitte™ BLOCKED ME OUT FROM PAYING FOR STUFF!

    - Clownflare Turnstile™ is known to exploit Chrome-specific behavior that it's designed to break on any web browser they don't like. But unfortunately other websites are starting to copycat Clownflare too: another example I met today is DDoS-Guard, with a similar (and even more broken) Browser Integrity dogshit. Oh, end users are not supposed to file complaints at CF's support channels because technically we're not their customers, just criminal scum instead having to complain at whatever website deployed them (where the answer will always be "use Chrome")

    - To put the cherry at this shit icecream, Google started punishing me with hot Recaptcha hell today, maybe because they hate SeaMonkey, my CGNAT'd ISP, me, or all three.


    Rememnber: it's now considered A CRIME to use the Internet without a Clownflare-approved web browser. IT'S FOR YOUR SAFETY, CITIZEN.
    Can't wait until those twats go under, but given the current state of affairs at 'merica, I guess the abuse will only get worse from now on. And if you're a site operator using Clownflare services, FUCK YOU! Stop empowering the Internet's single biggest man-in-the-middle, with a power that the cadres at the CCP can only drool in their dreams about having it.
    tomman Terrible news from the SeaMonkey crew, as they just lost one of their few valuable longstanding contributors: WG9s passed away almost a week ago.

    He provided the infra for hosting prerelease builds, so if you were using the alphas or betas, chances were it was his builds which were rock solid (to the point of being THE defacto official prereleases recommended for testing purposes by the team), so his loss leaves a big void in an already stretched-to-the-limit project :/ Now it's the time to contribute to SeaMonkey, more than ever, especially if you value a free web and a sane browser UI!

    Rest in peace, Bill!
    Nicholas Steel
    Posted by tomman
    In other stupid news, the latest one to break their website in our Not Chromey browsers is Memeur Imgur: sometimes your uploaded images page 404s, forcing a logout and a logon to fix that, except that the fine memengineers at this house of clowns made a stupid change that broke the logon form: they named a field on the form (actually a BUTTON) "submit", which apparently is enough to override the default form.submit JS method on browsers becsause of... weird HTML form shit, leading to a "form.submit is not a method" error if a script tries to submit the form (which is what the fake submit button on Imgur's login button does).

    Dunno how they got this obviously broken junk working on Thy Holy Chrome™, but this renders users like me unable to login directly into Imgur. The workaround, based on that blogpost I found involves running these Javascript lines in your browser console:
    var f = document.forms["signin-form"];
    HTMLFormElement.prototype.submit.call(f);

    The second line will trigger the actual real form.submit method, letting me login... for now.

    Remember me to never send my CV to houses run by clowns, thanks.


    My issue with Imgur in Firefox is it'll intermittently show a error page when trying to view my images. Never figured out why this is, usually if I leave it for a while it'll start working and load my images.
    tomman
    Posted by creaothceann
    I just googled "imgur login" and https://imgur.com/signin was the first result. It worked from there.

    "Login", "signin", same meaning. Yes, that's the page that now breaks on SeaMonkey due to JS abuse and a ordinary button literally named "submit".

    The fact this works on Chrome and its clones means that they decided to do the right thing (for once!) and assume that a button named "submit" is NOT a override for form.submit(), and that older web browsers (including Mozilla/Gecko) has always been doing weird shit there (maybe that weird shit dates all the way back to Netscape, who knows?). But then the web itself is built over foundations made of weird shit, so... Nonetheless, naming ANY element inside a form "submit" is an extremely dumb idea for other reasons.
    creaothceann I just googled "imgur login" and https://imgur.com/signin was the first result. It worked from there.
    tomman Mozilla rebrands. AGAIN.
    https://blog.mozilla.org/en/mozilla/mozilla-brand-next-era-of-tech/

    The new logo is even more stupid than the Moz://a era one. But hey, they hired a Very Expensive advertising agency to come up with this abomination, and look how nice it looks at the badges they use at the San Francisco HQ! In the meanwhile, Mozilla keeps losing more and more relevance, and the only thing that can save us from a grim Chromey future is... the US Deparment of Justice.

    "Next era of tech", AKA "doomed". Stop donating to Mozilla and send your money to other projects that actually need and deserve it: Waterfox, SeaMonkey, Ladybird, and yes, even Pale Moon.

    --

    In other stupid news, the latest one to break their website in our Not Chromey browsers is Memeur Imgur: sometimes your uploaded images page 404s, forcing a logout and a logon to fix that, except that the fine memengineers at this house of clowns made a stupid change that broke the logon form: they named a field on the form (actually a BUTTON) "submit", which apparently is enough to override the default form.submit JS method on browsers becsause of... weird HTML form shit, leading to a "form.submit is not a method" error if a script tries to submit the form (which is what the fake submit button on Imgur's login button does).

    Dunno how they got this obviously broken junk working on Thy Holy Chrome™, but this renders users like me unable to login directly into Imgur. The workaround, based on that blogpost I found involves running these Javascript lines in your browser console:
    var f = document.forms["signin-form"];
    HTMLFormElement.prototype.submit.call(f);

    The second line will trigger the actual real form.submit method, letting me login... for now.

    Remember me to never send my CV to houses run by clowns, thanks.
    tomman In this episode of Brand Necrophilia: America On-Line revived Netscape Browser... as a Chrome clone:

    https://wetdry.world/@ipg/113491635810847495
    https://xcancel.com/TRX7800X/status/1857791517110530222

    I wish I were making up this crap, but no, it's real - apparently the Netscape brand has survived for the last decade as a small ISP, part of the AOL empire (because apparently AOL still has subscribers in USA, mostly elderly people that hasn't realized dialup is beyond useless in 2024), and now AOL hired some advertising "security" firm (SentryBay) to rebadge yet another Chrome build as "Netscape", conveniently hidden at the footer of the Netscape (the ISP) homepage.

    Of course, the Father of Mozilla / Emeritus Asshole JWZ has already disowned this abortion of nature. All this dogvomit comes in the middle of the DoJ push to get Google to divest Chrome, something that sadly is not likely to happen after next January in the light of recent political events :/
    tomman After almost 2 decades of serving me well, I finally retired my trusty nx9010 from active duty, and that includes email.

    Time to move almost 2 decades of mailboxes that began life many moons ago under some flavor of Outlook Express, then Outlook, then Mozilla Suite, then Thunderbird, and eventually Suite again SeaMonkey. Now that I need the space for a new machine, it means it's time to do what I've been neglecting to do for years: move my email once again. To be fair, this move was long due, since the nx9010 was confined to run SM 2.49.5 because that was the final version that supported XP. Here is a basic outline on what I did to achieve that last move:

    - Download your email as usual on the old system, for one last time.

    - Backup your email folders (usually at $PROFILE/Mail/) and make a backup of that backup, just in case.

    - On the new setup/profile, recreate your accounts using the exact same info (login, etc). Setup them as you had them in your old profile (identities, aliases, server settings, etc.)

    - Close SeaMonkey, go to $PROFILE/Mail/ on the new profile, and for each account you need to restore, enter on its respective mail server dir, delete all the files already there, and copy the set from the same server from your backup in its place. Don't get tempted to do this BEFORE creating the account, as SM will find that the directory exists, and create your account into a new directory as a precaution!

    - Run SeaMonkey again - your mail should be exactly as you left it last time before the switch. Yay~!

    Also, good timing because MICROS~1 started threatening me with a good time: starting next September, you need to switch to Modern™ authentication methods to keep your ability to send and receive email from your Hotmale lookOut account. In other words: MS wants you to upgrade to Windows 11 and install their awesome Outlook app switch to OAuth2... or rather, its slightly wicked implementation of it, because after reading the story of OAuth, it turned out to be a shitty enterprisey standard so bad its original author ragequitted HSRD after seeing what they did with his creation. Anyway, OAuth2 is not supported on 2.49.5, but it's perfectly supported on the 2.53 branch, albeit with some caveats:

    - 2.53.18.x should work for MS, but better use the nightlies (or at least, the recently shipped 2.53.19 beta 1!)

    - You need to fix a couple prefs: open about:prefs, and search for "scope". You will find at least two prefs per each OAuth2-capable account:
    mail.server.server$NUMBER.oauth2.scope
    mail.smtpserver.smtp$NUMBER.oauth2.scope

    For your Outlook accounts, you will notice the value contains a bunch of URLs that begin with https://outlook.office365.com/ - those will NOT work! Edit them and remove all instances of "365" from the URLs (do NOT modify anything else!!!)
    The pref should look like this now:
    https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access


    - Microsoft will identify SeaMonkey as "Mozilla Thunderbird", since they're piggybacking over TB's app ID - getting one issued by MS is already a kafakesque nightmare.

    Technically, MS also offers app passwords (just like Google), if you have enabled 2FA on your account. But they do not advertise that, they certainly didn't mentioned them on their announcements, and I'm not going to waste a single extra braincell on more security theater. For now. Oh, and MICROS~1 is deprecating the fallback XP-era Outlook web UI that we get on SeaMonkey and other non-Chrome browsers too. You know, the one that actually sips bandwidth and it's SANE (albeit with a very dated style). Fun.
    tomman I never bothered using release versions of SeaMonkey on my daily driver anymore - the nightlies are Good Enough™ for daily usage given the slow pace of changes. You may want to ask frg and folks on IRC for any late-minute breaking changes (and watch out with your addons!), but these days I just upgrade to the latest nightly once or twice a month.

    From the Chromeisms front, the latest serial offender is Clownflare, as usual - they now have a tradition of breaking any non-Chrome'd browser YEARLY without explanation:
    https://news.ycombinator.com/item?id=31317886
    https://community.cloudflare.com/t/browser-integrity-check-broken/381029
    https://community.cloudflare.com/t/broken-in-the-latest-pale-moon-what-does-cloudflare-require-to-work/518036

    Two weeks ago, I fell victim to this, and at very sensitive place: one of my banks (to name and shame: a hipster-ish bank that goes under the stupid name of Bancamiga - literally means "FriendlyBank" in English!) decided that it was an AWESOME idea to deploy ClownFart's Browser Integrity Check (which is the most likely reason to get served CF captchas these days if you get caught using a web browser not approved by the Internet Party), and combined with a late minute update by Clownflare, I got effectively locked out from logging in into my bank (where I have, among other things, part of my savings, my one good credit card, and even a international debit card from the very few authorized to be issued in this country, so just closing this account and switching banks would hurt me BADLY). Called the bank, told them that ClownFart got in the middle, got told to pound sand and "upgrade my web browser, clear the cache and cookies, and try again or use a cellphone".

    Even called Venezuela's banking regulator (got the chance to don my Loyal Party Member™ cosplay), telling them that Clownflare not only was getting in the middle, but also the bank got unresponsive AND CF being a California corporation means that this bank is one Executive Order away from breaking the laws (effectively turning this into a potential national security threat, yay~!). They tried initially to dismiss me with the same pathetic excuses as used by the bank ("y u no cellphone?"), but eventually they told me to file a formal complaint letter to the bank, OVER EMAIL, then wait 20 days... and if the bank doesn't favorably reply, I should call again to escalate the complaint (I'm still in the process of gathering enough legal and historical background to write said letter). After some online research, turns out that I wasn't alone - Pale Moon users were being subject to the same ABUSE by Clownflare's latest deployment of Chromeisms... and even worse, they were dismissing Moonchild's formal support ticket (he is a paid CF customer) under bogus arguments. Users complaining at CF's forum (which uses the abomination known as Discourse, so a double whammy for us not using a Jeff Approved™ browser) were also being shooed away, to file useless claims with site operators for a problem caused by CF.

    Incredibly, before we were forced to escalate the complaint to Silly Con Valley's complaint department (aka Hackernews), someone at Clownflare realized the fuckup, and 4 days later I was able to logon into my bank again... and to the other half of the Internet relying on Browser Integrity Check, but only after enduring "you are a human, right?" checks on SeaMonkey because I'm a threat to CF's bottom line, it seems.

    If you work at ClownFart: FUCK YOU. Hope our paths never cross in this life or things will end [censored]. You're a enemy to the Internet and to freedom. Hope you guys get hacked to shreds by [insert your favorite villain here] - mightier evil actors have fallen, and CF won't be the exception!
    Site operators: STOP USING CLOWNFLARE SERVICES FFS! CF doesn't care about security, they care about being in control of everything - they have the MITM power that many governments around the world drool with...
    As for Bancamiga... I was happy with the services of this bank, but not anymore - trust takes forever to build, and seconds to destroy. This case is NOT closed yet, I shall get that formal complaint letter filled promptly, to serve as a warning for the rest of the banking system in Venezuela. (I sincerely hope that if The Angry Cheeto wins again, he bars Clownflare from selling services to my country)
    tomman 2.53.17 is now on beta... but I'm gonna skip that release.

    Why? Because I've switched (for now) to the nightly builds, and those are already at 2.53.18, which now implements pretty serviceable support for some annoying Chromeisms, including the latest regex vomit (backported from Waterfox) and Google WebComponents® now being enabled by default (but not Shadow DOM yet!) - those two are MANDATORY for most of the modern web since it relies on hipster JS framenotworks.

    Seriously, it's that good. Backup your profiles, and monitor #seamonkey for possible breaking changes and pleas for testing the nightlies and betas - we really need that!


    ---

    The latest Chromeism of the week is a particularly NASTY one: Web Environment Integrity:
    https://github.com/RupertBenWiser/Web-Environment-Integrity
    https://www.theregister.com/2023/07/25/google_web_environment_integrity/

    Banks, Hollywood, and other Big Corps are gonna love this shit, straight out of the deeply locked jails of cellphones! If you hated your bank because their mobile crapp wouldn't run on your rooted/custom ROM flashed cellphone, they will also now be able to refuse access to their web portals too unless you're using a Legit™ browser/OS combo! This not only hurts alternate/non-Chrome browsers even harder, it even bars Chrome forks or even local builds of Chromium! Welcome to 1984, this is the future we wanted.... NOT!

    If you work for Google and don't QUIT NOW, you deserve all the insults you're getting online for horrible moves like this. No 6-figure salary and stock options are worth killing whatever is left from the freedoms of Internet and computing - might as well switch to making murder machines for the military!
    Kawaoneechan
    Posted by tomman
    (link expires in one week - please rehost!)
    https://helmet.kafuka.org/flashblock_fixed.xpi
    tomman 2.53.15 broke good ol' Flashblock.

    Yes, Flash is dead. But Flashblock can also block HTML5 video, which is highly needed nowadays in the era of poor bandwidth and metered fake 4G cellphone networks. Adblockers can achieve the same, but I don't need full-fat uBlock as my current adblocking solution is perfect for my needs.

    Turns out Flashblock was using some long, LONG deprecated Mozilla-proprietary JS feature: getPreventDefault(): https://bugzilla.mozilla.org/show_bug.cgi?id=691151
    But then, Flashblock has been dead for pretty much almost the same time, so noone bothered checking... until today!

    Simple fix: replace all instances of getPreventDefault() with the standards-compliant defaultPrevented on flashblock.xml/videoblock.xml (inside $ADDON_ROOT/chrome/flashblock.jar!/content/flashblock/). Repack, reinstall, done.

    Or just use my fixed XPI: https://we.tl/t-uNjyaVA2l9
    (link expires in one week - please rehost!)
    CaptainJistuce
    Posted by tomman
    https://www.seamonkey-project.org/releases/seamonkey2.53.15/

    GO!
    YEEEEEEEEEEEEEEAH!!!!
    tomman https://www.seamonkey-project.org/releases/seamonkey2.53.15/

    GO!
    tomman Apparently enough stuff has been backported to make Giggityhub more-or-less "work" by just enabling dom.webcomponents.enabled on the latest betas, according to frg.

    I guess it's time to backup my profile and hop again onto the beta train, but at this stage I wish that a deadly pandemic just wipe webshits from the entire planet so the web standards can go back to being STANDARDS, and not a eternal moving target. Alas, that's not happening :/

    If you work with/for the Google Chrome team: DIE.
      Main » Discussion » Mozilla, *sigh* » New reply
      Kawa's Github