search

Frewacom / pywalfox

Dynamic theming of Firefox (and Thunderbird) using your Pywal colors
https://addons.mozilla.org/en-US/firefox/addon/pywalfox/
Mozilla Public License 2.0
583 stars 12 forks source link

I'm seeing outbound connections to a Cloudflare address. Why? #70

Closed anthonyg-1 closed 2 years ago

anthonyg-1 commented 2 years ago

I saw some odd outbound connections via netstat and with lsof I saw that your plugin was making connections to the following IP: 104.16.248.249

Reference: https://www.abuseipdb.com/check/104.16.248.249

Why?

anthonyg-1 commented 2 years ago

Actually this may be the result of the "HTTPS Everywhere" Firefox plugin but lsof is showing a python process that's calling out to that address. When I disable your plugin, it stops. Is your plugin employing any telemetry? If not then you can close this issue and apologies for the confusion.

Frewacom commented 2 years ago

There is no telemetry in pywalfox, not in the addon, nor the native host. I am not making any external requests what-so-ever.

It is really strange you are seeing these types of connections. I will have a look at my machine to see if I have the same traffic.

Frewacom commented 2 years ago

Actually this may be the result of the "HTTPS Everywhere" Firefox plugin but lsof is showing a python process that's calling out to that address. When I disable your plugin, it stops. Is your plugin employing any telemetry? If not then you can close this issue and apologies for the confusion.

The IP address is to Mozilla's DNS-over-HTTPS server, which is probably why it happens when you have the "HTTPS Everywhere" plugin enabled.

There is no telemetry in pywalfox, not in the addon, nor the native host. I am not making any external requests what-so-ever.

On second thought, there is actually telemetry, but it is done entirely by Firefox, not pywalfox (with no option to disable as far as I am aware). It collects downloads, daily users, etc. If I were to guess, I would say that the traffic is related to this. Either way, it is not something I can control, but rather something that needs to be disabled locally for each user.

As far as I can tell, the outbound traffic you are seeing is not related to pywalfox and should be completely harmless 🐼