deCDN

[RealityRipple]

I've taken on this project under the name deCDN. The extension is written from scratch, but it imports the LocalCDN resources list through its Codeberg repository, so it's something of a "hybrid" between a new extension and a fork. I'm still checking for bugs and issues on specific websites, but it's at least mostly functional.

There are a few caveats:

• The LocalCDN archive is about 20 MB, but there's no interface to track the download or any warnings about it failing; for users on slower or unreliable connections, this can definitely be an issue. I'm still deciding how to approach this problem. This will probably be addressed in a future version, not the initial release.
• I had to make a cached interception of resources for the Developer Tools, because it loads resources oddly. If the data doesn't match exactly, the whole browser will lock up or crash. It is also possible that requests will leak out and then be aborted in the Developer Tools because of the way it works, meaning some request data may be sent to a CDN.
• I had to intercept and modify "content-security-policy" headers to include "data:" and remove "require-sri-for" on relevant pages. This can result in potential security issues.
• I had to force-disable Internet Download Manager through the Windows Registry during the repository ZIP file download because IDM's extension intercepts EVERY request instead of just content-originating requests, completely ignoring red flags such as "mozBackgroundRequest" or "nsIRequest.LOAD_BACKGROUND".
• If you find a site is not working as expected with this extension, it's important to check how LocalCDN on Firefox behaves on the same site - if LocalCDN doesn't work, deCDN's obviously not going to either, since it's using the exact same resources.
• Ad blockers and script stoppers like nMatrix can still block the resources deCDN provides, because the URLs are unchanged (except for files [such as fonts] referenced in CSS, which are replaced with data: URIs). LocalCDN provides a "whitelist" you can import into such blockers to allow them through, but that seems counterproductive to me - if you don't want a script to run, where it came from is irrelevant.

With any luck, there won't be any major issues, and a true "release" will be uploaded by the end of next week.

[ron_1]

I've taken on this project under the name deCDN.

Thanks for taking this project on. I for one appreciate it. One question, will the LocalCDN test page (link below) give accurate results on your fork?

https://www.localcdn.org/test/

[RealityRipple]

I've taken on this project under the name deCDN.

Thanks for taking this project on. I for one appreciate it. One question, will the LocalCDN test page (link below) give accurate results on your fork?

https://www.localcdn.org/test/

Had a discussion with the OP of this topic about that; it will work if you use Firefox compatibility mode for your user agent.
Font-Awesome, Material Icons, and Worst Case all have a check on the website that reads:

Code: Select all

if (navigator.userAgent.indexOf("Firefox") == -1 [...])

which skips the test entirely without even trying.
Additionally, LocalCDN's TinyMCE code points any v6 requests to a version that isn't included (7.0.1, iirc), which means their own example fails on LocalCDN, so of course deCDN's not gonna work there.

[back2themoon]

Many thanks for this, RealityRipple.

By the way, there's some activity in the Pale Moon branch of the original Decentraleyes. Can't say if a new version is imminent. The author recently reacted to a 4-year old issue.

https://git.synz.io/Synzvato/decentrale ... /pale-moon

[andyprough]

I've taken on this project under the name deCDN. The extension is written from scratch, but it imports the LocalCDN resources list through its Codeberg repository, so it's something of a "hybrid" between a new extension and a fork. I'm still checking for bugs and issues on specific websites, but it's at least mostly functional.

Seems to work without breaking anything for me so far. This is fantastic, thanks for putting the effort into this @RealityRipple!

[Michaell]

I've taken on this project

Thanks.

• The LocalCDN archive is about 20 MB, but there's no interface to track the download or any warnings about it failing; for users on slower or unreliable connections, this can definitely be an issue. I'm still deciding how to approach this problem. This will probably be addressed in a future version, not the initial release.

Seems like an incomplete download would be a big problem for those like me who choose to block requests for missing resources (that's the only way I will use these CDN extensions).

... the whole browser will lock up or crash. It is also possible ... some request data may be sent to a CDN.

Not good. I haven't noticed any of that with either LocalCDN or Decentraleyes.

I had to force-disable Internet Download Manager through the Windows Registry

I don't know what IDM is. If it is part of Windows, I am not sure I'd want a PM extension intefering with it - I do occasionally use other applications that access the internet. I use PM portable and tinkering with the registry is not desirable.

If you find a site is not working as expected with this extension, it's important to check how LocalCDN on Firefox behaves on the same site - if LocalCDN doesn't work, deCDN's obviously not going to either, since it's using the exact same resources.

How will we know this extension is the cause? Compare profiles with and without it? Would there be something in particular to look for in Error Console, or maybe the extension's own log?

Ad blockers and script stoppers like nMatrix can still block the resources deCDN provides, because the URLs are unchanged (except for files [such as fonts] referenced in CSS, which are replaced with data: URIs). LocalCDN provides a "whitelist" you can import into such blockers to allow them through, but that seems counterproductive to me - if you don't want a script to run, where it came from is irrelevant.

I rely on both uBlock Origin and ηMatrix (and an old customized extension) and block all 3rd party connections until I authorize them. I was reluctant to add the exceptions that DeCentralEyes recommends and only did it with the assurance that "block missing resources" would catch the requests not included. That behavior is critical for me to use this type extension. If I can use yours without including those exceptions that would be good. But letting the requests go through would be a no go for me.

[moonbat]

I was reluctant to add the exceptions that DeCentralEyes recommends and only did it with the assurance that "block missing resources" would catch the requests not included.

I have LocalCDN on Floorp, and it does have an option to block missing resources.

[andyprough]

I have LocalCDN on Floorp, and it does have an option to block missing resources.

This deCDN extension for Pale Moon does have the block missing resources option in settings.

[sinfulosd]

I'd like to thank RealityRipple for fulfilling my request and developed an extension for me and for all the 2000+ viewers of this thread. He spent over 2 weeks of intensive research and made a HUGE amount of effort in developing the extension. Granted that I gave some feedback and I was helping him in some testing, but I'd say he has done atleast 95% of the work. I guess it's only a matter of time for us to retire Decentraleyes add-on and replace it with a much superior one that relies on a more updated list of CDNs and frameworks.

Edit: I corrected the quotations. I'm still a bit confused on how to properly post on this forum.

I don't know what IDM is. If it is part of Windows, I am not sure I'd want a PM extension intefering with it...

It's a download manager that can be used to download files over the internet, but this one is a bit more sophisticated, since it uses a lot of advanced coding to download files. RealityRipple had a very difficult time dealing with it, that he decided to just tweak it in windows registry to disable it, download the list, and then re-enables it instead (If the download manager is installed on your windows PC)

Many thanks for this, RealityRipple.

By the way, there's some activity in the Pale Moon branch of the original Decentraleyes. Can't say if a new version is imminent. The author recently reacted to a 4-year old issue.

https://git.synz.io/Synzvato/decentrale ... /pale-moon

I emailed the guy, since July 19th and he didn't even respond to me. I absolutely gave up on him. Even his extensions on Chrome and Firefox rely on 6+ year-old resources. LocalCDN is simply superior.

[Michaell]

It's a download manager

You need to be more careful in using quotes - misquoting has created issues on this forum in the past.

I think Reality Ripple should start a topic specifically for deCDN. But since I don't want to do that myself, I'll post here again.

1. I assume "Ignore Hosts" is for sites one wants to not use the extension's copy for. Is it just for getting the absolute latest copy or is there some other reason? I've never quite understood what bypasses the CDN extensions or how it knows what is a CDN request and what isn't. I know Decentraleyes at least in the beginning only handled javascript js files, and I configured my blocking exceptions around that.
2. Is the list on "Block CDNs" tab useful if "Block missing resources" is enabled? If it is for blocking code from certain sites, what would be the advantage to blocking that way versus just blocking (no exception) in ηMatrix?
3. The Repo doesn't load. So I am unsure if the extension functions currently. It could be because of my blocking configuration but I can't tell what.
4. The "Details" link by "Preload page content" gives a site error about missing file(s). (I saved an image if you need it but I assume you're likely aware of it.)
5. For testing, is the Developer Tools Network Console a better place to look than the ηMatrix Logger? I assume that if I add an exception to ηMatrix that allows deCDN to access it that deCDN then is intercepting it after ηMatrix and therefore it's Logger may not show that access.
6. With "Allow downgrading" enabled, and "Block missing resources" enabled, is there any situation where the extension allows connections to the CDN servers?

I disabled Decentraleyes to test this but I'll go back to it until some of these things are addressed and/or I understand things better.

[RealityRipple]

I think Reality Ripple should start a topic specifically for deCDN. But since I don't want to do that myself, I'll post here again.

1. I assume "Ignore Hosts" is for sites one wants to not use the extension's copy for. Is it just for getting the absolute latest copy or is there some other reason? I've never quite understood what bypasses the CDN extensions or how it knows what is a CDN request and what isn't. I know Decentraleyes at least in the beginning only handled javascript js files, and I configured my blocking exceptions around that.
2. Is the list on "Block CDNs" tab useful if "Block missing resources" is enabled? If it is for blocking code from certain sites, what would be the advantage to blocking that way versus just blocking (no exception) in ηMatrix?
3. The Repo doesn't load. So I am unsure if the extension functions currently. It could be because of my blocking configuration but I can't tell what.
4. The "Details" link by "Preload page content" gives a site error about missing file(s). (I saved an image if you need it but I assume you're likely aware of it.)
5. For testing, is the Developer Tools Network Console a better place to look than the ηMatrix Logger? I assume that if I add an exception to ηMatrix that allows deCDN to access it that deCDN then is intercepting it after ηMatrix and therefore it's Logger may not show that access.
6. With "Allow downgrading" enabled, and "Block missing resources" enabled, is there any situation where the extension allows connections to the CDN servers?

I disabled Decentraleyes to test this but I'll go back to it until some of these things are addressed and/or I understand things better.

I don't make topics about my extensions here. That's what the comments section on my website is for.


"Ignore Hosts" is for sites that do not function correctly, where the need to use the website is greater than the need to disable CDN connections.


"Block Missing" is on a site-by-site basis, "Block CDNs" is global. Blocking or allowing for a website OVERRIDES any global CDN setting. The point is to be able to "fix" one website without letting other websites access CDNs. This two-list system gives you the greatest control.
The "Advanced" checkbox to block all missing resources is what controls visibility of the "Block CDNs" tab. When you check the "advanced" checkbox, it checks all the items in the list - those items are the actual settings, the "advanced" checkbox only exists to show+auto-select-all/hide the advanced options. It's not its own unique setting.


When you refer to "the repo" - which one are you talking about? I haven't uploaded the source code to deCDN to either GitHub or GitLab because it's still in initial development. However, the extension loads its data from LocalCDN's repo, not deCDNs.


The "Preload" link points directly to the UXP issue about preloading: https://repo.palemoon.org/MoonchildProductions/UXP/issues/2158. If you're getting an error, that's on your end.


The only truly reliable tester is an external packet sniffer application like Wireshark. But yes, your understanding of the order of blocking is correct.


"Allow downgrading" is irrelevant in this context - If all the CDNs are blocked on the third (advanced) tab, if downgrading is on, it'll serve the older one, if downgrading is off, it'll block it. The one difference would be if you chose "allow missing" for a specific website.

[ron_1]

Had a discussion with the OP of this topic about that; it will work if you use Firefox compatibility mode for your user agent.

So the test page won't work if on Gecko compatibility mode? Also, and I hope this isn't a dumb question, but does this mean the add-on doesn't work at all on a setting other than Firefox compatibility mode?

[RealityRipple]

Had a discussion with the OP of this topic about that; it will work if you use Firefox compatibility mode for your user agent.

So the test page won't work if on Gecko compatibility mode? Also, and I hope this isn't a dumb question, but does this mean the add-on doesn't work at all on a setting other than Firefox compatibility mode?

Correct on the first count, but no on the second - it's only a line in the LocalCDN test javascript page. My suggestion is to test Font-Awesome and Google Material Icons on w3schools instead:
https://www.w3schools.com/icons/tryit.asp?filename=tryicons_awesome_intro_basic
https://www.w3schools.com/icons/tryit.asp?filename=tryicons_google-intro_basic

[Michaell]

I don't make topics about my extensions here. That's what the comments section on my website is for.

That's fine - I have used that for other extensions.

"Block Missing" is on a site-by-site basis, "Block CDNs" is global.

OK, I would not have guessed that. (Block missing resources is global in Decentraleyes.) I'll have to study deCDN more to see how that works but site-by-site is good if there is an easy way to add them.

When you refer to "the repo" - which one are you talking about?

In the middle of the preferences window, Repo Branch: "Loading". Reload button to the right has no effect. Could be similar to the Preload error, due to my default blocking; will require more testing.

The "Preload" link .... If you're getting an error, that's on your end.

It was due to not allowing javascript by default. That is not an error, it's a rule I live by. The error message was from the site not my 'puter.

The only truly reliable tester is an external packet sniffer

I'm not that gung-ho. I'll stick to what I can see in the browser. Is there, or could there be, a log generated by deCDN?

[RealityRipple]

In the middle of the preferences window, Repo Branch: "Loading". Reload button to the right has no effect. Could be similar to the Preload error, due to my default blocking; will require more testing.

Using blockers that apply to chome and not exclusively content... That's just asking for things to break.
The file it needs to access is https://codeberg.org/api/v1/repos/nobod ... N/branches. If something's blocking JSON, your blockers might be a little too heavy. JSON is just data, not executable code.


Edit: Just tried accessing the issue page with JS completely disabled. There's a tiny "this website requires javascript" bar across the top, but other than that, nothing is amiss or different. I think your problem lies elsewhere.

[RealityRipple]

Oh, one more caveat: intercepting and removing crossorigin and integrity headers means i have to intercept all html (and technically xml/xhtml) files, wait for them to download entirely, do the replacements, and then pass the download along to the browser. This means that speedtests like testmy.net WILL NOT WORK CORRECTLY, since it buffers everything in the extension first, then spits it all out instantly.

I'd love to only sniff in the <head> block and then pass things along normally, but as we all know, there are plenty of sites that don't work like that, and include script and css resources wherever the hell they want. I will try to improve the parsing process in the future, so I can pass along chunks that don't contain partial script tag attributes like normal, but for now, if you notice any kind of "nothing then all-at-once" behavior, that's what's going on.

[Moonchild]

I think this is a necessary trade-off for deep-replacing script resources. I think if you let the browser start to parse/interpret chunks before it's all sanitised, you'll potentially run into (serious) problems.

[andyprough]

if you notice any kind of "nothing then all-at-once" behavior, that's what's going on

Seems to work without any hiccups after two days of having it installed. Any other kind of unusual behavior we should be watching out for as we use this development version?

[suzyne]

I have been reading this thread with interest, and now understand the privacy benefits of deCDN.

But I am wondering does the local storing of libraries and files have the potential to speed up Pale Moon? Or is the browser already keeping a local copy of these sorts of files after a first visit, so the difference would be minimal?

[Moonchild]

But I am wondering does the local storing of libraries and files have the potential to speed up Pale Moon?

Not really. These libraries will be cached as cached web content and they usually have a long expiration time; once downloaded they will remain in the cache (subject to various expiration/purge events, of course). So it may increase performance on first visit by avoiding the download, true, but I doubt that's a significant impact.