Unable to click links on news.sky.com

[llamatron]

https://news.sky.com/

Page appears to load... but unable to click any of the links. This was not an issue with the old version prior to updating.

I've also had some middle mouse click issues randomly - having to middle click twice as sometimes it opens the link in a new tab AND goes into scroll mode.

[vannilla]

I can click on various elements and navigate to a different page, however if I try to select one of the headlines nothing happens.
Hovering over them shows an animation in which all text and images disappears and clicking on them does nothing.
Is this what you are experiencing?

[llamatron]

Yep, that is exactly the issue.

[The Squash]

I'm using Pale Moon for Linux 28.8.4 32-bit.

I just went to news.sky.com and noticed that whenever I hover over a link, the entire link (and image associated with the link) turns white. Clicking on the link doesn't take me to the article in question.

I looked in the error console and saw four messages in a row which said:

Code: Select all

metrics.sky.com:443 uses an invalid security certificate.

The certificate is only valid for the following names:
 *.sc.omtrdc.net, sc.omtrdc.net

(Error code: SSL_ERROR_BAD_CERT_DOMAIN)

I did a Whois search on omtrdc.net and found that the domain name is owned by Com Laude, a British "corporate domain name management" firm, according to their home page at comlaude.com. I thus have reason to believe that this issue has something to do with the Cross-Origin Policy and a poor SSL certificate.

(As an aside, neither sc.omtrdc.net nor omtrdc.net have any running Web servers as far as I could tell; the connection timed out when I tried.)

For the record, the following two images are a randomly-picked headline from that page, and what the same headline looks like after I hover over it.

Of course, I might just be giving useless information, like usual, apparently.

[twigs]

This problem with Sky News started about 10 days ago. The Error Console is showing the following:

Timestamp: 16/06/2020 14:48:18
Error: ReferenceError: _satellite is not defined
Source File: https://news.sky.com/
Line: 2336

Timestamp: 16/06/2020 14:48:19
Warning: Use of attributes’ nodeValue attribute is deprecated. Use value instead.
Source File: https://news.sky.com/js/min/site-main-1 ... 473ac6c.js
Line: 1

Edit: I believe I noticed the problem a day or two before the new release came out

[Moonchild]

ReferenceError: _satellite is not defined

Well obviously you need to readjust your satellite dish!

[badnick]

Same behaviour on Pale Moon 28.10

[The Squash]

I'm using Pale Moon for Linux 28.8.4 32-bit.

Pfft.. Maybe next time you want attempt to help someone try not to use an old and insecure version of the application. Swear it is like the wonders never start with you.

Nobody said what version of Pale Moon they were using. I happened to be running Pale Moon 28.8.4. I checked it out and pitched my three cents. This is how problems get solved, not by people saying "me too".

Off-topic:
And if you're wondering why I'm using Pale Moon 28.8.4...
This is a live CD and it's hard to upgrade an application every month when you can't find a blank CD.
And a thumb drive is out of the question too -- have you ever heard of a Pentium III system that could boot from a thumb drive? C'mon. Give me a break. 28.8.4 isn't even that old, anyway.

But I'll try it again with 28.10.0, anyway, as much of a pain as it may be.

[adesh]

Same behaviour even on latest unstable, so version doesn't seem to matter in this case.

[The Squash]

I just tried the same experiment on Pale Moon 28.10.0. Everything that I said about Pale Moon 28.8.4 still holds true, from the rollover effect to the error console messages. I'd show you again but the image this time was of a toilet...

And don't think that it's got something to do with my profile: I just obliterated my old profile and made sure everything was set to defaults.

I just used wget (the GNU Internet file downloader) to pull down https://news.sky.com and it didn't say anything about an invalid security certificate. But when I tried to pull down https://metrics.sky.com using wget, it says (like it does when a site has got an invalid security certificate):

Code: Select all

--2020-06-16 16:16:50--  https://metrics.sky.com/
Resolving metrics.sky.com... 3.89.214.96, 3.213.30.101, 3.217.100.252, ...
Connecting to metrics.sky.com|3.89.214.96|:443... connected.
ERROR: no certificate subject alternative name matches
	requested host name 'metrics.sky.com'.
To connect to metrics.sky.com insecurely, use `--no-check-certificate'.

And if you go directly to metrics.sky.com in Pale Moon (28.10.0), you get a blank page and the Network monitoring tool shows that the connection was established correctly, without Pale Moon worrying about the invalid security certificate.

Allow me now to explain what I think the problem here (and a lot of other "mysterious problems" with Pale Moon) is / are. Let's roll back the clock to 2011.

In Firefox 4 and earlier definitely, if Firefox came across a Web site with an invalid security certificate, Firefox would fail to connect. It would show a big, scary screen about the Web site using an invalid security certificate.

Sometime between the release of Firefox 4 and Firefox 15 (that sounds broad, but Firefox was releasing at a phenomenal pace back then and today), the Firefox developers realized that this pedantic policy was locking out Firefox users from viewing a lot of Web sites, many of which were poorly designed and poorly secured. So they loosened the restriction a little: If you as the user entered a URL of a Web site which had an invalid security certificate into the URL bar, Firefox would load the site anyway. If the URL was of a site which you hadn't explicitly loaded but was only referenced by a Web site you loaded, the URL would not be loaded. This worked for a long while and I suspect this is what's in Pale Moon.

But of course stupidity never ends. So even that lax rule didn't work after awhile, because certain Web developers got lazy. (Let's just be frank here.)

Firefox and Chrome have a leg up here because AFAIK they both are completely lax with the rules now. Pale Moon users are stuck with a browser that doesn't work on a lot of Web sites.

In short: I think this should be an option to the user. If they want to be a stickler, they can enable the strictness option. If they just want to view a Web page and have done with it, then bam.

Now that's my 6 cents I've pitched in thus far.

[Moonchild]

I'm sorry but there really is no significant difference between how Pale Moon handles site security and how Firefox does it. We are using the same secure connection library too (NSS).
Also, what you say is bogus: enter a site in the address bar that has bad SSL/TLS or cert issues and the browser WILL NOT connect. Never has.

[New Tobin Paradigm]

Off-topic:
Can we squash this guy yet? He is really stupid.

[The Squash]

I'm sorry but there really is no significant difference between how Pale Moon handles site security and how Firefox does it. We are using the same secure connection library too (NSS).

That's what I'm saying. Pale Moon falls down, like at least old versions of Firefox, because we're so pedantic about the secure connections. I've seen this time and time again.

Also, what you say is bogus: enter a site in the address bar that has bad SSL/TLS or cert issues and the browser WILL NOT connect. Never has.

We were never at war with Eastasia.

Sure, truly bogus certificates like ones that have expired are kicked by Pale Moon. But just repeat the steps I already outlined: wget https://metrics.sky.com and then enter https://metrics.sky.com into the URL bar in Pale Moon. Just try it; you may have intended Pale Moon to not accept bogus certificates, but if so you've got a big bug on your hands.

Off-topic:
Can we squash this guy yet? He is really stupid.

Off-topic:
I'll private message you later about that.

[Moonchild]

Pale Moon falls down, like at least old versions of Firefox, because we're so pedantic about the secure connections. I've seen this time and time again.

Horseshit!


wget:

Code: Select all

$ wget https://metrics.sky.com
--2020-06-17 04:29:27--  https://metrics.sky.com/
Resolving metrics.sky.com (metrics.sky.com)... 15.188.154.177, 15.236.175.233, 15.236.9.100
Connecting to metrics.sky.com (metrics.sky.com)|15.188.154.177|:443... connected.
ERROR: cannot verify metrics.sky.com's certificate, issued by 'CN=DigiCert SHA2 High Assurance Serve
r CA,OU=www.digicert.com,O=DigiCert Inc,C=US':
  Self-signed certificate encountered.
ERROR: no certificate subject alternative name matches
        requested host name 'metrics.sky.com'.

In plain English: CA-issued certificate found, but doesn't match the requested hostname.

enter https://metrics.sky.com into the URL bar in Pale Moon.

I just did, and Pale Moon helpfully tells me:

metrics.sky.com uses an invalid security certificate.
The certificate is only valid for the following names: *.sc.omtrdc.net, sc.omtrdc.net
(Error code: SSL_ERROR_BAD_CERT_DOMAIN)

Which is exactly what should happen if the certificate is issued for a different domain than the URL.
And it's more to the point than wget

Qualys labs agrees:

FireShot Pro Screen Capture #227 - 'SSL Server Test_ metrics_sky_com (Powered by Qualys SSL Labs)' - www_ssllabs_com_ssltest_analyze_html_d=metrics_sky_com.jpg

So don't call Pale Moon "pedandic to the point of being unusable" because it's just plain wrong.

[New Tobin Paradigm]

Off-topic:

I'll private message you later about that.

No. No, you won't. A few days ago, I made the decision that I would no longer accept private messages from people on this forum. Largely because of the unsolicited ones from you but also others.

So yeah, I have no desire to speak to you behind closed doors. I been down that road too many times already. If you have something to say to me you can say it in public and on the record.

The bottom line here is that we will not be compromising user security and safety by connecting at all costs to a badly configured and operated supposed secure server and pretending everything is a-ok because you are too stupid to realize just how much of a bad idea that really is.

The Pale Moon and other UXP application users know or figure out quickly if there is one claim we make that isn't potentally just a subjective opinion it is that we take security absolutely and deadly seriously and will not put them at risk for any reason including the reason of the week bitched about by some random moron on the forum.

If you don't like it you are obviously free to walk out that door. In fact, for you specifically, I highly recommend it.

[Moonraker]

https://metrics.sky.com/
i clicked the link and get an untrusted connection warning,i use puppy linux.

What distro is squash using.?...maybe the openssl library needs updating or something...just a guess mind.

[New Tobin Paradigm]

UXP doesn't use openssl it uses nss.

[moonbat]

Got blocked from accessing it by nMatrix, then I recalled that I reflexively block any subdomain that has to do with metrics or analytics or whatever. Don't have to care about certificate authenticity from a server whose only job is tracking, and blocking which doesn't affect the main website in any way. It's amazing how many dozens of shitty analytics and tracking providers there are out there - just a trip to any site has me browsing the uBlock panel and global blacklisting everything other than well known CDNs or the site's own CDN. Very rarely had problems and it's easy enough to find out and grant access to whatever's breaking it.

[GREGBKK]

Having the exact same issue with latest PM on Linux 64 bit, Windows 7 64 bit and my work computer (Windows 7 , 32 bit)

[Moonchild]

Yes, back on-topic.
I've not been able to suss out what exactly causes this issue - they do explicitly set some z-ordering on some of the elements and take others out-of-flow, so possibly that's related. the "blocks" are a right layout mess, though. it only affects the stories that have the "fancy shine" animation applied to them; it was likely designed by their webmaster on chrome and therefore not very browser agnostic, using layout quirks of Blink.