search

FreeTubeApp / FreeTube

An Open Source YouTube app for privacy
https://freetubeapp.io/
GNU Affero General Public License v3.0
13.37k stars 825 forks source link

No TLS encryption for search requests? #1100

Closed V3YNjKbFGLSQ0FzpOu1s closed 3 years ago

V3YNjKbFGLSQ0FzpOu1s commented 3 years ago

2021-03-10_00-21 The above picture is from my Wireshark log. 172.217.169.206 is Google. So I suppose my search requests are also visibe to the 3rd parties. Did I forget to set up something? This was actually going to be a feature request but I decided to ask it as a question to see if there's anything I can do, or if I misunderstood something as I'm not a pro on these matters. Thanks.

Editing to give more info: Freetube version is 0.12.0 Beta, installed via https://aur.archlinux.org/packages/freetube-bin I'm on Arch Linux with 5.11.4-arch1-1 kernel Electron version is 11.3.0, installed via https://archlinux.org/packages/community/x86_64/electron/

GilgusMaximus commented 3 years ago

Hi, you probably did not forget to setup something. Search requests are handled by a module we use. It could be that something does not work as expected in combination with electron, as their base url uses https (see here).

We'll likely have to take a look into that a bit closer

Svallinn commented 3 years ago

This is not related to node-ytsr, it's the yt-suggest package that is to blame.

I've opened a PR for the change to HTTPS, but if it takes too long, we can probably implement the logic directly in the project and cut out the dependency (although their package is browser ready, which would be beneficial for the project in the long run).

GilgusMaximus commented 3 years ago

Ah okay, that makes it much clearer. I personally haven't interacted with that module yet, so I first assumed it was the other. If the PR will not be included in a reasonable time, we can talk about either forking the project or implementing it ourselves. Our preference is always to stick to the modules we use, because they keep our code base smaller and easier to maintain.

And because the maintainer seems to be frequently active on Github, I am confident this will be merged. Although your PR seems to have not passed all linter tests. So you might want to check that out. But nonetheless thanks for contributing to the modules we use, so FreeTube can be improved as well !

Best Regards, Gilgus

Svallinn commented 3 years ago

The PR linter fail has to do with the lack of write permissions of my fork, since the action used (goto-bus-stop/standard-action@v1) makes a call to the Checks API Basically GHActions-related gimmicks and such.