[freenet-dev] History cloaking sucks

2009-01-19 Thread Zero3
Matthew Toseland skrev: >> - not fixing the real problem ( there are other ways to know if you >> are running freenet. >> for example, just include a http://127.0.0.1:"; >> onLoad="freenetLoaded();" /> >> > > IMHO this qualifies as a cross-site scripting attack. Don't browsers have to

[freenet-dev] History cloaking sucks

2009-01-19 Thread Thomas Sachau
Matthew Toseland schrieb: > On Saturday 17 January 2009 23:50, svenerichoffmann at gmx.de wrote: >> I think the only "real" solution to guarantee safety >> is a dedicated freenet browser. > > Isn't that what I just said? >> Trying to control the behaviour and safety of standard browsers >> is ser

[freenet-dev] History cloaking sucks

2009-01-19 Thread Matthew Toseland
On Sunday 18 January 2009 10:30, Daniel Cheng wrote: > On Sun, Jan 18, 2009 at 6:13 PM, Florent Daigni?re > wrote: > > * svenerichoffmann at gmx.de [2009-01-18 > > 00:50:17]: > > > >> I think the only "real" solution to guarantee safety > >> is a dedicated freenet browser. > >> > >> Trying to co

[freenet-dev] History cloaking sucks

2009-01-19 Thread Matthew Toseland
On Sunday 18 January 2009 17:54, Zero3 wrote: > Daniel Cheng skrev: > > Maybe we should try the another way round: detect if the user use the > > same browser > > for other web sites and issue a big fat warning for this. > > > > Oh, the sweet irony in us using the same exploit to test if user h

[freenet-dev] History cloaking sucks

2009-01-19 Thread Matthew Toseland
On Saturday 17 January 2009 23:50, svenerichoffmann at gmx.de wrote: > I think the only "real" solution to guarantee safety > is a dedicated freenet browser. Isn't that what I just said? > > Trying to control the behaviour and safety of standard browsers > is serious problematic. As Webmaster i

[freenet-dev] History cloaking sucks

2009-01-19 Thread Volodya
> There are some user still using frost (it is getting less spam when i > last checked). > People copy and parse freenet uri from frost to browser. This hurt > people copying > link from IM (skype/icq/msn/jabber) to browser too. But at least on Frost people have the added protection of not being a

Re: [freenet-dev] History cloaking sucks

2009-01-19 Thread Zero3
Matthew Toseland skrev: >> - not fixing the real problem ( there are other ways to know if you >> are running freenet. >> for example, just include a http://127.0.0.1:"; >> onLoad="freenetLoaded();" /> >> > > IMHO this qualifies as a cross-site scripting attack. Don't browsers have to

Re: [freenet-dev] History cloaking sucks

2009-01-19 Thread Thomas Sachau
Matthew Toseland schrieb: > On Saturday 17 January 2009 23:50, svenerichoffm...@gmx.de wrote: >> I think the only "real" solution to guarantee safety >> is a dedicated freenet browser. > > Isn't that what I just said? >> Trying to control the behaviour and safety of standard browsers >> is seriou

Re: [freenet-dev] History cloaking sucks

2009-01-19 Thread Matthew Toseland
On Sunday 18 January 2009 10:30, Daniel Cheng wrote: > On Sun, Jan 18, 2009 at 6:13 PM, Florent Daignière > wrote: > > * svenerichoffm...@gmx.de [2009-01-18 00:50:17]: > > > >> I think the only "real" solution to guarantee safety > >> is a dedicated freenet browser. > >> > >> Trying to control th

Re: [freenet-dev] History cloaking sucks

2009-01-19 Thread Matthew Toseland
On Sunday 18 January 2009 17:54, Zero3 wrote: > Daniel Cheng skrev: > > Maybe we should try the another way round: detect if the user use the > > same browser > > for other web sites and issue a big fat warning for this. > > > > Oh, the sweet irony in us using the same exploit to test if user h

Re: [freenet-dev] History cloaking sucks

2009-01-19 Thread Matthew Toseland
On Saturday 17 January 2009 23:50, svenerichoffm...@gmx.de wrote: > I think the only "real" solution to guarantee safety > is a dedicated freenet browser. Isn't that what I just said? > > Trying to control the behaviour and safety of standard browsers > is serious problematic. As Webmaster i kno

Re: [freenet-dev] History cloaking sucks

2009-01-19 Thread Volodya
> There are some user still using frost (it is getting less spam when i > last checked). > People copy and parse freenet uri from frost to browser. This hurt > people copying > link from IM (skype/icq/msn/jabber) to browser too. But at least on Frost people have the added protection of not being a

[freenet-dev] History cloaking sucks

2009-01-18 Thread Zero3
Daniel Cheng skrev: > Maybe we should try the another way round: detect if the user use the > same browser > for other web sites and issue a big fat warning for this. > Oh, the sweet irony in us using the same exploit to test if user has visited http://www.google.com/, http://www.ebay.com/, h

[freenet-dev] History cloaking sucks

2009-01-18 Thread Daniel Cheng
>> to start the "freenet" browser would be fine and convinient thing. >> >> - Original Message - >> From: "Matthew Toseland" >> To: >> Sent: Sunday, January 18, 2009 12:34 AM >> Subject: [freenet-dev] History cloaking sucks >&g

[freenet-dev] History cloaking sucks

2009-01-18 Thread Daniel Cheng
On Sun, Jan 18, 2009 at 7:34 AM, Matthew Toseland wrote: > We decided to get rid of the firefox profile, because it was becoming the > default profile on a few users' systems, causing severe problems as the user > didn't know what a browser profile is let alone how to switch back to the > default

[freenet-dev] History cloaking sucks

2009-01-18 Thread Florent Daignière
ient thing. > > - Original Message - > From: "Matthew Toseland" > To: > Sent: Sunday, January 18, 2009 12:34 AM > Subject: [freenet-dev] History cloaking sucks > > > > ___ > > Devl mailing list > >

Re: [freenet-dev] History cloaking sucks

2009-01-18 Thread Zero3
Daniel Cheng skrev: > Maybe we should try the another way round: detect if the user use the > same browser > for other web sites and issue a big fat warning for this. > Oh, the sweet irony in us using the same exploit to test if user has visited http://www.google.com/, http://www.ebay.com/, h

Re: [freenet-dev] History cloaking sucks

2009-01-18 Thread Daniel Cheng
to start the "freenet" browser would be fine and convinient thing. >> >> - Original Message - >> From: "Matthew Toseland" >> To: >> Sent: Sunday, January 18, 2009 12:34 AM >> Subject: [freenet-dev] History cloaking sucks >> >&

Re: [freenet-dev] History cloaking sucks

2009-01-18 Thread Florent Daignière
g. > > - Original Message - > From: "Matthew Toseland" > To: > Sent: Sunday, January 18, 2009 12:34 AM > Subject: [freenet-dev] History cloaking sucks > > > > ___ > > Devl mailing list > > Dev

Re: [freenet-dev] History cloaking sucks

2009-01-18 Thread Daniel Cheng
On Sun, Jan 18, 2009 at 7:34 AM, Matthew Toseland wrote: > We decided to get rid of the firefox profile, because it was becoming the > default profile on a few users' systems, causing severe problems as the user > didn't know what a browser profile is let alone how to switch back to the > default

[freenet-dev] History cloaking sucks

2009-01-18 Thread svenerichoffm...@gmx.de
--- Original Message - From: "Matthew Toseland" To: Sent: Sunday, January 18, 2009 12:34 AM Subject: [freenet-dev] History cloaking sucks > ___ > Devl mailing list > Devl at freenetproject.org > http://emu.freenetproject.

[freenet-dev] History cloaking sucks

2009-01-17 Thread Matthew Toseland
We decided to get rid of the firefox profile, because it was becoming the default profile on a few users' systems, causing severe problems as the user didn't know what a browser profile is let alone how to switch back to the default one. This meant freenet would typically be browsed by the user

Re: [freenet-dev] History cloaking sucks

2009-01-17 Thread svenerichoffmann
--- Original Message - From: "Matthew Toseland" To: Sent: Sunday, January 18, 2009 12:34 AM Subject: [freenet-dev] History cloaking sucks > ___ > Devl mailing list > Devl@freenetproject.org > http://emu.freenetproject.org/cgi-b

[freenet-dev] History cloaking sucks

2009-01-17 Thread Matthew Toseland
We decided to get rid of the firefox profile, because it was becoming the default profile on a few users' systems, causing severe problems as the user didn't know what a browser profile is let alone how to switch back to the default one. This meant freenet would typically be browsed by the user