privacybadger icon indicating copy to clipboard operation
privacybadger copied to clipboard

Use "<all_urls>" permission to catch WebSockets

Open ghostwords opened this issue 6 years ago • 5 comments

Fixes #1010.

ghostwords avatar Jul 09 '19 19:07 ghostwords

How many of our Firefox users are on Firefox 66 and above?

Looking at Firefox usage stats on AMO, I estimate ~8% of our users on Firefox will run into the permissions dialog, and about a third of them will remain stuck on the previous version of Privacy Badger. We should expect to get a number of emails/GitHub issues and bad reviews if we roll out this change to all users.

Here is my quick-and-dirty AMO totals scraper. To use, open the developer console in the above link, inspect a row for the date that you want to evaluate, select the <tr> of that row in the Elements tab (to properly populate the $0), and copy and paste the below script.

(function () { let total = 0, good = 0; $0.querySelectorAll('td').forEach((el,idx)=> { let br = el.parentNode.parentNode.parentNode.querySelectorAll('th')[idx+1].innerText; let amt = +el.innerText.replace(/,/g, ""); total += amt; let version = parseFloat(br.replace("Firefox ", "").replace("Android ", ""), 10); if (version >= 66) { good += amt; } }); console.log("66+: %s (%s%%)\nTotal: %i", good, (good*100/total).toFixed(2), total); }());

ghostwords avatar Jul 09 '19 21:07 ghostwords

About 3% of that 8% comes from Firefox ESR version 60. Most (?) ESR 60 users will migrate to Firefox 68 at the end of October, if I understand https://wiki.mozilla.org/Release_Management/Calendar correctly.

ghostwords avatar Jul 09 '19 21:07 ghostwords

Updating onBeforeRequest() to listen to all URLs (instead of just http/https URLs) breaks not recording tab data for extension pages (#2451).

Should be fixed by 516820704daecd51ee3bf9091a7a2741032ae58f

Edit: Hmm, doesn't this short circuit for WebSocket requests?

ghostwords avatar Nov 04 '19 15:11 ghostwords

While we fixed tests with 8dbf62513049e49bf84862743ab21e1cba98c11f, the better fix might be to avoid running listeners on extension pages.

ghostwords avatar May 07 '20 20:05 ghostwords

Should also review whether we should in fact use <all_urls>, or whether adding all permutations of wss is better. (Review pertinent emails from cs.kuleuven.be.)

ghostwords avatar May 07 '20 21:05 ghostwords