search

altcha-org / altcha

GDPR compliant, self-hosted CAPTCHA alternative with PoW mechanism and advanced anti-spam filter.
https://altcha.org
MIT License
493 stars 16 forks source link

Firefox: Gah. Your tab just crashed. #28

Closed franzos closed 5 months ago

franzos commented 6 months ago

Proof of work - Cool idea! I thought I try the captcha at https://altcha.org/ but unfortunately the tab crashes shortly after I click it; There's no network requests, or any other useful logs; This is all I got:

Navigated to about:blank
Navigated to https://altcha.org/
[CanvasBlocker] invalid content script order: require not defined at https://altcha.org/

I did disable the CanvasBlocker extension on 2nd try but it still crashes.

I'm on Firefox 115.9.1esr (64-bit). If there's anything else I can provide, tell me how :)

Cheers

ovx commented 6 months ago

Hi, thanks for reporting. This doesn't seem like an issue related to ALTCHA or the website directly, it seems to be caused by some of the extensions or Firefox itself. The ALTCHA widget has been tested in Firefox, it works without issues on desktop and mobile and nobody else reported any crashes.

I would try:

franzos commented 6 months ago

update to latest Firefox

Updated to the latest release 115.10; Still crashes.

disable all extensions

I tried incognito, then without extension; Still crashes.

I got it to spit out more logs; Nothing relevant though:

ALTCHA mounted 0.3.1 altcha.Dy5Jciyu.js:2:8710
ALTCHA workers 8 altcha.Dy5Jciyu.js:2:8710
ALTCHA using test mode altcha.Dy5Jciyu.js:2:8710
ALTCHA mounted 0.3.1 altcha.Dy5Jciyu.js:2:8710
ALTCHA workers 8 altcha.Dy5Jciyu.js:2:8710
ALTCHA using test mode altcha.Dy5Jciyu.js:2:8710
ALTCHA generating test challenge 
Object { test: 10000 }
altcha.Dy5Jciyu.js:2:8710
ALTCHA challenge 
Object { algorithm: "SHA-256", challenge: "aa3aca4e378c9669324d5eab9d30e8b98f661007a0762e29dcc31ea90259e6d6", salt: "18f24db2d7e", signature: "" }

At this point it crashes.

If the problem is "Firefox itself", I'd be curious what you'd think causes the crash, at this point? I haven't seen a crash like this in years, so presumably you're doing something, the thousands of sites I visit (or work on) don't.

ovx commented 6 months ago

Thanks for the input, it would be good to get to the bottom of this. The widget is just spawning several WebWorkers and computing SHA hashes. It's all plain JavaScript, zero dependencies, so it's very unexpected to see it crash. The memory requirements are minimal, it's designed to be only CPU-heavy.

You can try the complexity tester: https://altcha.org/docs/complexity/ to see if it also crashes - it's a different but similar implementation. I suspect, that it might be related to WebWorkers, so maybe try to use low number of workers in the tester, disable them by unchecking "Use Web Worker".

Some more questions:

franzos commented 6 months ago

You can try the complexity tester: https://altcha.org/docs/complexity/ to see if it also crashes

I tried 50,000, 100,000 and 500,000. No problem. Also tried with (8x), and without web-worker. No issue.

What is the value of navigator.hardwareConcurrency?

navigator.hardwareConcurrency
8

Are you using a custom built Firefox or an officially distributed package?

I'm running Firefox on guix; The package is here: https://github.com/nonguix/nonguix/blob/master/nongnu/packages/mozilla.scm#L102 - it's fairly popular, and has been around for a couple of years - and since you're saying "zero dependencies", I doubt that any (missing) plugins cause an issue.

Maybe you have some "experimental" flags configured (from about:config)?

I only modified MOZ_ENABLE_WAYLAND set to true.

I did observe something rather funny; I've been able to get the captcha to work occasionally, if I run Firefox performance profiler in parallel; Something like:

  1. Start profiling (Performance -> Start recording)
  2. Click Captcha -> Succeeds
  3. Stop profiling
  4. Reload the page
  5. Click Captcha -> Succeeds
  6. Reload the page
  7. Click Captcha -> Succeeds
  8. Close the tab; Open a new tab and go to https://altcha.org/
  9. Click Captcha -> Crash

I've done this cycle 2x times now; I don't close Firefox, only the Tab (8).

ovx commented 6 months ago

Hi, thanks for the information. I tried to install Firefox from guix, unfortunately it fails with a vague error on one of the decencies and I gave up on it. Nevertheless it works just fine with official builds on Linux and everywhere else, so this problem is most definitely caused by one of the build flags used in guix. If it seems to work when profiling, it suggests, this is a feature which detects "stuck javascript" such as infinite loops and terminates the tab. Somehow the guix build has this feature configured too strict.

As of now, this issue is marked as "cannot fix" due to lack of reproducible environment and the fact is effects only the guix build of Firefox.

You can try to investigate yourself, I suspect its the recursive calling of the next function here: https://github.com/altcha-org/altcha/blob/main/src/helpers.ts#L52. It is implemented this way (instead of a for-loop, which seems to work in the complexity tester without issues) to give the event loop a chance to receive the abort event during computation.

266-750Balloons commented 6 months ago

I am also experiencing the issue on Firefox ESR 115.10.0, but on Debian Trixie (Testing) with the Debian version of the package. I experience the same behavior as @franzos, with the complexity test working. I'll see if I can do more to get more information on this (testing different Firefox builds on my distro and the like), but at the moment, I am incredible busy.

ovx commented 6 months ago

I'm running Debian 12, with FF 115.10.0esr and works just fine. But it's a VM on Mac OS, so I'm thinking this might be somehow platform specific.

I did a small rewrite of the function to use for-loop. If you could please test this version here: https://altcha.org/docs/altcha-test/ and tell me if it still crashes. @franzos @266-750Balloons thanks a lot!

franzos commented 6 months ago

If you could please test this version here: https://altcha.org/docs/altcha-test/ and tell me if it still crashes.

Firefox ESR 115.10.0

  1. Initial load, try, check passed real quick (> 1s) -> Success
  2. Reload tab, try again -> crash tab
  3. Reload tab, try again -> crash tab
  4. Reload tab, try again -> my whole desktop session crashed (wlgreet, sway)

Firefox Nightly 125.0.3

  1. Initial load, try -> whole browser crashed
  2. Restart browser, try again -> whole browser crashed

I should note, that 4, 5 and 6 took especially long. I can probably count till 6, before the crash happens.

I am also experiencing the issue on Firefox ESR 115.10.0, but on Debian Trixie

@266-750Balloons is this a wayland session by any chance?

I'm running Debian 12, with FF 115.10.0esr and works just fine.

What desktop environment did you try this on?

ovx commented 6 months ago

@franzos Are you able to get some crash report from Firefox?

The test page uses randomly generated number, but the demo on the index page is set to 10k, so this is why it takes different times in different runs.

I'm also running wayland with gnome. Also tried to install extensions (adblockers, canvasblocker) and run multiple tabs, play youtube in the background, works just fine for me.

franzos commented 5 months ago

@ovx Found some time to look into this today, but cannot replicate this anymore, on Firefox Nightly 126.0. I have all my usual extensions enabled, and I doubt they played a role, as I tested both with and without extensions.

Looking at the release notes from 125.0.3 to 126.0 I can't make out anything that would make a difference, but then again, what do I know. If I have time over the weekend, I'll try the ESR release again. Now I'm especially curious what caused the issue :smile:

ovx commented 5 months ago

Closing this issues. Seems to work fine now, if anybody has similar problems, open a new issue.