Localization NS 10

[Giorgio Maone]

"Decisions" are not displayed anywhere and ALL are reset if you click "Forget decisions"?

Yes. This will likely change in the future (going more in the XSS exceptions way), but I had to cut some UX corners to rush out a prototype because the attack will be publicized at the Usenix conference which starts today.

Maybe name the button "Forget decisions (anonymously/normally)"?
It seems to me that now the expected action is to switch to "Enabled in Private Browsing only" if something else was selected.

Let's keep it this way for now, as I said the UI is likely to change for the better soon.
Thanks!

[fatboy]

Windows 7, Fx 1026.0ESR, new profile, NS 11.4.16rc1 only
Traditional question: where can I see "Toggle restrictions enforcement for current tab" and "Configure current page's permissions"?
Alt+Shift+Space opens a menu like this − http://ipic.su/img/img7/fs/AltShiftSp.1675592625.png
In the additional window (Alt+Shift+N) the same.

[Giorgio Maone]

From about:add-ons, settings buttons "Manage extension's shortcut".

[fatboy]

Thanks!

[fatboy]

Code: Select all

  "cap_x-load": {
    "message": "x-load",
    "description": "Capability for file:// documents to load subresources from a different and non descendant directory."
  },

looked at https://gitlab.torproject.org/tpo/appli ... sues/43635 , but I don't understand.

This can be seen in tor 13.5 (or only in 14), r3dfox 128, Fx 115?

[Giorgio Maone]

Code: Select all

  "cap_x-load": {
    "message": "x-load",
    "description": "Capability for file:// documents to load subresources from a different and non descendant directory."
  },

looked at https://gitlab.torproject.org/tpo/appli ... sues/43635 , but I don't understand.

This can be seen in tor 13.5 (or only in 14), r3dfox 128, Fx 115?

The problem with this capability (and the reason why I added the description, which is not there for any other string so far), is that it's related to a new mitigation for a specific non-disclosed yet fingerprinting issue, and it's the first (and hopefully last) of a new kind of "floating" capabilities, which are displayed only for specific origins (in this case only for file:/// URLs) and circumstances (in this case when a subresource load from a path which is not the same of the hosting document is attempted).

However I've added the string just to avoid the console noise, since for now it can be left untranslated, as I can't think of any self-explanatory label short enough not to clutter the entire custom permissions editing space.

A reminder that a more descriptive localized title (to be displayed on hover and on tap) for each capability would be a nice future enhancement.

[fatboy]

So, if file:/// saved from example.com. is open
and it wants to load active content from notexample.com,
then the "x-load" checkbox should appear in file: -> CUSTOM with the tooltip:
"Capability for ‹…› directory."

[Giorgio Maone]

So, if file:/// saved from example.com. is open
and it wants to load active content from notexample.com,
then the "x-load" checkbox should appear in file: -> CUSTOM with the tooltip:
"Capability for ‹…› directory."

More like if you open "file:///home/fatboy/Downloads/somepage.html" and it tries to load anything, even an image, from an unrelated directory (e.g. "file:///home/fatboy/.config/chromium/Avatars/avatar_generic.png"), then a "x-load" placeholder is shown, and also in the permissions popup you get a CUSTOM line for file:///home/fatboy/.config/chromium/Avatars/ entry with the "x-load" checkbox first in the customization interface. No tooltip yet, though; "description" in messages.json files are just meant as an explainer for translator, AFAIK. I will need to add extra "cap_xxx_tooltip" entries (or something like that) with messages like "If granted, this capability allows files in this directory to be loaded by any other file:/// document".

[fatboy]

Thank you.

[barbaz]

So, if file:/// saved from example.com. is open
and it wants to load active content from notexample.com,
then the "x-load" checkbox should appear in file: -> CUSTOM with the tooltip:
"Capability for ‹…› directory."

More like if you open "file:///home/fatboy/Downloads/somepage.html" and it tries to load anything, even an image, from an unrelated directory (e.g. "file:///home/fatboy/.config/chromium/Avatars/avatar_generic.png"), then a "x-load" placeholder is shown, and also in the permissions popup you get a CUSTOM line for file:///home/fatboy/.config/chromium/Avatars/ entry with the "x-load" checkbox first in the customization interface. No tooltip yet, though; "description" in messages.json files are just meant as an explainer for translator, AFAIK. I will need to add extra "cap_xxx_tooltip" entries (or something like that) with messages like "If granted, this capability allows files in this directory to be loaded by any other file:/// document".

Tried to update the sticky with this information, is it correct?
Does x-load have any effect on pages that are not file: URLs?