Neopets Classic, Ruffle and forcing native Flash

[adoxa]

I have security.csp.enable set to true on basilisk with uBO and Greasemonkey installed, and the demo page still works.

Are you sure it's Flash and not Ruffle? I restored it to true on my main profile, blank page; back to false, "Activate Adobe Flash" (I set it to always ask).

[Mæstro]

Okay, created a new profile in Basilisk, installed uBO & Greasemonkey, added the userscript, went to the demo page, blank. Deleted everything in that profile, cloned my default, worked. Tracked it down to config security.csp.enable - set that to false and it works.

Yes, this is our biggest leap forwards!
Toggling that configuration setting and using the user script you gave, taken together, succeed in returning the genuine Flash, without the use of Modify HTTP. Even in Pale Moon, we enjoy partial success by following these same steps (with or without Modify HTTP; it makes no difference), in that, although we get a white blank, that white blank is a Flash asset, as proven by right-clicking, which yields Film nicht geladen (film not loaded). Curiously, the Neopets userscript you created appears with orange warning stripes behind it in my Greasemonkey user script menu. Might this have to do with it? Disparities between Pale Moon and Basilisk’s behaviour are always interesting…

[adoxa]

Even in Pale Moon, we enjoy partial success [...]

I tested in PM before posting and it worked fine for me (the demo at least; I'm afraid I'm not going to sign up to test anything else).

Curiously, the Neopets userscript you created appears with orange warning stripes behind it in my Greasemonkey user script menu.

That is (I believe) due to having no update URL.

[Mæstro]

I tested in PM before posting and it worked fine for me (the demo at least; I'm afraid I'm not going to sign up to test anything else).

My accepting this answer was a misclick, but perhaps might not be that far off. In a fresh Pale Moon profile, I get the behaviour I described with the userscript and configuration setting toggled for the demo: the white blank with film not loaded. Are you also using Linux? I do not know how, in fresh profiles, we could get different results.

[adoxa]

After creating yet another new profile, "Activate Adobe Flash" works, but clicking it goes blank (the swf is forbidden). Turns out it worked before because I had it in cache (same with Basilisk). After experimenting with cURL it looks like it needs the header Sec-Fetch-Dest: empty (instead of embed). Looks like you'll also need a header modifier (I used Proxydomo, but that's just for Windows). There's a few on CAA, has anyone any recommendations?

[Mæstro]

Looks like you'll also need a header modifier (I used Proxydomo, but that's just for Windows). There's a few on CAA, has anyone any recommendations?

Forgive me for the naïve question, but would this not be Modify HTTP Header’s job? I do not know how or where one would insert this header, but perhaps my ignorance there illustrates the confusion.

[frostknight]

Forgive me for the naïve question, but would this not be Modify HTTP Header’s job? I do not know how or where one would insert this header, but perhaps my ignorance there illustrates the confusion.

Think thats what he meant.

[adoxa]

Forgive me for the naïve question, but would this not be Modify HTTP Header’s job?

It would be, but I cannot find an extension called "Modify HTTP Header", so I can't comment on it (are you confusing it with "Modify HTTP Response"?). If you do indeed have such an extension, you need to set request (outgoing) header "Sec-Dest-Fetch" to value "empty".

[Mæstro]

are you confusing it with "Modify HTTP Response"?

Yes, I garbled the name, and should ask the names of those actual header-modifiers of which you know. Pale Moon-native ones would probably be best, if any exist.

[adoxa]

Only what's on CAA, hence why I was asking. Cloudflare's blocked me, so I won't be able to test anything, anyway.