Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-07 Thread Mateusz Konieczny via talk 



6 paź 2023, 13:57 od tr...@gmx.de:

> On 23-10-06 13:41, Tom Hughes wrote:
>
>> On 06/10/2023 12:12, Martin Trautmann wrote:
>>
>>> On 23-10-06 12:55, Tom Hughes via talk wrote:
>>>
 No it was released in June 2020. October 2021 was the last
 security patches.

 To answer the original question there have been any deliberate
 changes that I know but given the error it's entirely possible
 that FF has fixed something in what CSP rules it checks for what
 requests.

>>>
>>> I doubt that since FF did not see any changes here for some time,
>>> unfortunately. So it appears to be from an OSM editor's change.
>>>
>>
>> I think you misunderstood what I was saying.
>>
>> My hypothesis is that something in iD has started using a data URL
>> where it didn't before and that is triggering a latent bug in your
>> version of firefox (in that it is checking that URL against the
>> media-src rule in our security policy) while newer versions of
>> firefox are checking it against some other rule.
>>
>
> Thanks - that does clarify the issue. But as you say, "something in iD
> has started" - so it's a change within OSM's editor, which does break
> old systems.
>
> Maybe it's a reasonable and necessary change for ID - but maybe it isn't!
>
>
>> Without knowing more about which load is being blocked it's not
>> really possible to say more and I might be totally wrong as I'm
>> just guessing from the limited information available.
>>
>
>
> I agree - but I don't know where else to report this malfunction. It's
> obvious that one part of this bug is an outdated FF version. But that
> does not mean that those have to be excluded.
>
>
If you track down which exact change 
changed things then maybe it would make sense to report it
(You can try older iD versions and revisions)

In general I would strongly recommend
not using such ancient and insecure browser.

You can setup dual booting, get new see
computer, move that setup to VM, replace that software...___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-07 Thread Mateusz Konieczny via talk 



6 paź 2023, 15:42 od talk@openstreetmap.org:

> On 06/10/2023 14:23, Martin Trautmann wrote:
>
>> On 23-10-06 14:24, Tom Hughes wrote:
>>
>>>
>>>
>>> Maybe it would be easy to avoid and maybe it wouldn't but until
>>> we know what the actual problem is we can't tell and none of the
>>> developers are likely to have such an old browser to reproduce
>>> it even if they wanted to so unless you can provide more details
>>> somehow it's not clear what can be done.
>>>
>>
>>
>> Apart from the info given before I do see an
>>
>> Uncaught SyntaxError: expected expression, got '='
>>
>> https://www.openstreetmap.org/assets/id-859874f88bc2e65931793d0d2edfb626917168cd008d86196e5b6fe2c88b39d5.js
>>
>> :29:19029 
>> 
>>
>
> That's far more likely to be the main problem but you'd need to
> ask the iD developers if they have any clue what it might be.
>
I really would not bother asking people
about bugs present only in ancient, EOL
browsers (unless some project promises to
support browser not supported by even
maker of this browser)___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Tom Hughes via talk 

On 06/10/2023 14:23, Martin Trautmann wrote:

On 23-10-06 14:24, Tom Hughes wrote:



Maybe it would be easy to avoid and maybe it wouldn't but until
we know what the actual problem is we can't tell and none of the
developers are likely to have such an old browser to reproduce
it even if they wanted to so unless you can provide more details
somehow it's not clear what can be done.



Apart from the info given before I do see an

Uncaught SyntaxError: expected expression, got '='

https://www.openstreetmap.org/assets/id-859874f88bc2e65931793d0d2edfb626917168cd008d86196e5b6fe2c88b39d5.js

:29:19029 



That's far more likely to be the main problem but you'd need to
ask the iD developers if they have any clue what it might be.

Tom

--
Tom Hughes (t...@compton.nu)
http://compton.nu/


___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Martin Trautmann 

On 23-10-06 14:24, Tom Hughes wrote:



Maybe it would be easy to avoid and maybe it wouldn't but until
we know what the actual problem is we can't tell and none of the
developers are likely to have such an old browser to reproduce
it even if they wanted to so unless you can provide more details
somehow it's not clear what can be done.



Apart from the info given before I do see an

Uncaught SyntaxError: expected expression, got '='

https://www.openstreetmap.org/assets/id-859874f88bc2e65931793d0d2edfb626917168cd008d86196e5b6fe2c88b39d5.js

:29:19029 




I've NoScript installed, but everything on OSM is trusted. Adblockers 
are disabled.


inspect info:

https://i.ibb.co/bzk1hTz/Screen-Shot-2023-10-06-at-15-17-58.png

Please let me know if there's any other info I can provide - and how.



___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Tom Hughes via talk 

On 06/10/2023 12:53, Martin Trautmann wrote:

On 23-10-06 13:41, Tom Hughes wrote:

On 06/10/2023 12:12, Martin Trautmann wrote:

On 23-10-06 12:55, Tom Hughes via talk wrote:

No it was released in June 2020. October 2021 was the last
security patches.

To answer the original question there have been any deliberate
changes that I know but given the error it's entirely possible
that FF has fixed something in what CSP rules it checks for what
requests.


I doubt that since FF did not see any changes here for some time,
unfortunately. So it appears to be from an OSM editor's change.


I think you misunderstood what I was saying.

My hypothesis is that something in iD has started using a data URL
where it didn't before and that is triggering a latent bug in your
version of firefox (in that it is checking that URL against the
media-src rule in our security policy) while newer versions of
firefox are checking it against some other rule.


Thanks - that does clarify the issue. But as you say, "something in iD
has started" - so it's a change within OSM's editor, which does break
old systems.

Maybe it's a reasonable and necessary change for ID - but maybe it isn't!



Without knowing more about which load is being blocked it's not
really possible to say more and I might be totally wrong as I'm
just guessing from the limited information available.



I agree - but I don't know where else to report this malfunction. It's
obvious that one part of this bug is an outdated FF version. But that
does not mean that those have to be excluded.


Nobody is deliberately excluding you but equally nobody is going
to spend hours trying to make it work either.

Maybe it would be easy to avoid and maybe it wouldn't but until
we know what the actual problem is we can't tell and none of the
developers are likely to have such an old browser to reproduce
it even if they wanted to so unless you can provide more details
somehow it's not clear what can be done.

We don't even know the CSP error in the console is the root
cause of your main problems - it might be incidental as a media
load failing doesn't normally cause total page failure.

Tom

--
Tom Hughes (t...@compton.nu)
http://compton.nu/


___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Martin Trautmann 

On 23-10-06 13:41, Tom Hughes wrote:

On 06/10/2023 12:12, Martin Trautmann wrote:

On 23-10-06 12:55, Tom Hughes via talk wrote:

No it was released in June 2020. October 2021 was the last
security patches.

To answer the original question there have been any deliberate
changes that I know but given the error it's entirely possible
that FF has fixed something in what CSP rules it checks for what
requests.


I doubt that since FF did not see any changes here for some time,
unfortunately. So it appears to be from an OSM editor's change.


I think you misunderstood what I was saying.

My hypothesis is that something in iD has started using a data URL
where it didn't before and that is triggering a latent bug in your
version of firefox (in that it is checking that URL against the
media-src rule in our security policy) while newer versions of
firefox are checking it against some other rule.


Thanks - that does clarify the issue. But as you say, "something in iD
has started" - so it's a change within OSM's editor, which does break
old systems.

Maybe it's a reasonable and necessary change for ID - but maybe it isn't!



Without knowing more about which load is being blocked it's not
really possible to say more and I might be totally wrong as I'm
just guessing from the limited information available.



I agree - but I don't know where else to report this malfunction. It's
obvious that one part of this bug is an outdated FF version. But that
does not mean that those have to be excluded.


___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Tom Hughes via talk 

On 06/10/2023 12:12, Martin Trautmann wrote:

On 23-10-06 12:55, Tom Hughes via talk wrote:

No it was released in June 2020. October 2021 was the last
security patches.

To answer the original question there have been any deliberate
changes that I know but given the error it's entirely possible
that FF has fixed something in what CSP rules it checks for what
requests.


I doubt that since FF did not see any changes here for some time,
unfortunately. So it appears to be from an OSM editor's change.


I think you misunderstood what I was saying.

My hypothesis is that something in iD has started using a data URL
where it didn't before and that is triggering a latent bug in your
version of firefox (in that it is checking that URL against the
media-src rule in our security policy) while newer versions of
firefox are checking it against some other rule.

Without knowing more about which load is being blocked it's not
really possible to say more and I might be totally wrong as I'm
just guessing from the limited information available.

Tom

--
Tom Hughes (t...@compton.nu)
http://compton.nu/


___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Brian M. Sperlongano 
This is not OSM's problem to solve.

Ancient web browser slowly becomes unusable = expected behavior.

On Fri, Oct 6, 2023, 7:26 AM Martin Trautmann  wrote:

> On 23-10-06 12:55, Tom Hughes via talk wrote:
> > No it was released in June 2020. October 2021 was the last
> > security patches.
> >
> > To answer the original question there have been any deliberate
> > changes that I know but given the error it's entirely possible
> > that FF has fixed something in what CSP rules it checks for what
> > requests.
>
>
> I doubt that since FF did not see any changes here for some time,
> unfortunately. So it appears to be from an OSM editor's change.
>
>
>
> ___
> talk mailing list
> talk@openstreetmap.org
> https://lists.openstreetmap.org/listinfo/talk
>
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Martin Trautmann 

On 23-10-06 12:55, Tom Hughes via talk wrote:

No it was released in June 2020. October 2021 was the last
security patches.

To answer the original question there have been any deliberate
changes that I know but given the error it's entirely possible
that FF has fixed something in what CSP rules it checks for what
requests.



I doubt that since FF did not see any changes here for some time,
unfortunately. So it appears to be from an OSM editor's change.



___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Martin Trautmann 

On 23-10-06 12:34, Mateusz Konieczny via talk wrote:

Firefox 78 EST has reached end of life over year ago, see
https://endoflife.date/firefox 

It was released in October 2021.

I would strongly encourage to update it for security reasons.



I know - but there is certain software on this computer which does
prevent an update of the operating system, which is required for newer
FF versions.


And would not be surprised if random things are breaking.



They do - but maybe they do because of any need. Up to a short while ago
FF could handle the editor very well.


___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Tom Hughes via talk 

No it was released in June 2020. October 2021 was the last
security patches.

To answer the original question there have been any deliberate
changes that I know but given the error it's entirely possible
that FF has fixed something in what CSP rules it checks for what
requests.

I don't see that error, and as far as I can see our policy only
allows data URLs for images and not for other media which suggests
no data URLs are being validated against media-src for me.

Tom

On 06/10/2023 11:34, Mateusz Konieczny via talk wrote:
Firefox 78 EST has reached end of life over year ago, see 
https://endoflife.date/firefox 


It was released in October 2021.

I would strongly encourage to update it for security reasons.
And would not be surprised if random things are breaking.

Oct 6, 2023, 11:54 by tr...@gmx.de:

Have there been any changes for a minimum software version to use
the openstreetmap editor?

I can still browse with my old firefox version 78.15.0esr, but when
I try to edit anything, the editor's area remains empty.

Inspecting the pages names "The page’s settings blocked the loading
of a resource at data: (“media-src”)."

id-container does not load any more, I suppose.

Anything from

https://www.openstreetmap.org/assets/id-859874f88bc2e65931793d0d2edfb626917168cd008d86196e5b6fe2c88b39d5.js
 causes an error here.



___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk



___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk


--
Tom Hughes (t...@compton.nu)
http://compton.nu/


___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] software requirements for OSM Editor: Firefox

2023-10-06 Thread Mateusz Konieczny via talk 
Firefox 78 EST has reached end of life over year ago, see 
https://endoflife.date/firefox

It was released in October 2021.

I would strongly encourage to update it for security reasons.
And would not be surprised if random things are breaking.

Oct 6, 2023, 11:54 by tr...@gmx.de:

> Have there been any changes for a minimum software version to use the 
> openstreetmap editor?
>
> I can still browse with my old firefox version 78.15.0esr, but when I try to 
> edit anything, the editor's area remains empty.
>
> Inspecting the pages names "The page’s settings blocked the loading of a 
> resource at data: (“media-src”)."
>
> id-container does not load any more, I suppose.
>
> Anything from 
> https://www.openstreetmap.org/assets/id-859874f88bc2e65931793d0d2edfb626917168cd008d86196e5b6fe2c88b39d5.js
>  causes an error here.
>
>
>
> ___
> talk mailing list
> talk@openstreetmap.org
> https://lists.openstreetmap.org/listinfo/talk
>

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk