search

arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
10.03k stars 515 forks source link

Embed videos will not load and play within Canvas LMS: [A: it was uBO] #1808

Closed GlitteringReturn closed 7 months ago

GlitteringReturn commented 7 months ago

🟥 https://github.com/arkenfox/user.js/wiki/5.2-Troubleshooting

I ran a sandbox on Windows 11, installed Firefox and confirmed the same embed videos do load on default Firefox. Also, confirmed it doesn't have anything to do with auto-play or popups.

🟪 REQUIRED INFO

OMG I found the issue, it was uBO, after refreshing firefox to reset everything except for my bookmarks, and redownloading and importing my settings into uBO i nearly had a stroke as I realised the issue occured again, then i uninstalled uBO simply turning it off, for the website was not enough no idea why

Thorin-Oakenpants commented 7 months ago

since you mention canvas then add a canvas exception - see https://github.com/arkenfox/user.js/wiki/3.3-Overrides-[To-RFP-or-Not]#-rfp

c3d1c06c-bf26-477e-b0eb-c50ef4477ba6 commented 7 months ago

@Thorin-Oakenpants I think Canvas LMS is just the name of the software.

@GlitteringReturn Is a login required to access such a link? Otherwise please give a usable example one so we can test.

Thorin-Oakenpants commented 7 months ago

https://www.instructure.com/higher-education/products/canvas/canvas-lms

https://community.canvaslms.com/t5/Canvas-Basics-Guide/What-are-the-browser-and-computer-requirements-for-Instructure/ta-p/66

Thorin-Oakenpants commented 7 months ago

@GlitteringReturn try turning off ETP strict - click the blue shield on the left hand side of the url

GlitteringReturn commented 7 months ago

@Thorin-Oakenpants I think Canvas LMS is just the name of the software.

@GlitteringReturn Is a login required to access such a link? Otherwise please give a usable example one so we can test.

Login is required unfortunately

GlitteringReturn commented 7 months ago

@GlitteringReturn try turning off ETP strict - click the blue shield on the left hand side of the url

Completed, however, it didn't work, if you need me to provide more info or do anything, just notify me here.

GlitteringReturn commented 7 months ago

Definitely a strange issues (esp. for me who knows nothing about computers), I presume this issue is applicable to all websites with embed videos that have the same "architecture" as canvas

Thorin-Oakenpants commented 7 months ago

I'm just going to guess that this something RFP related and in a few more months I am going to switch off RFP by default - see #1804

So what I suggest you do is in your overrides, add the following

/* turn off RFP related items until arkenfox catches up */
user_pref("privacy.resistFingerprinting", false);
user_pref("privacy.resistFingerprinting.letterboxing", false);
user_pref("webgl.disabled", false);

/* parrot check */
user_pref("_user.js.parrot", "overrides: success");

then restart, open about:config and type in parrot and make sure it says overrides: success

and now test the problem is fixed

GlitteringReturn commented 7 months ago

I'm just going to guess that this something RFP related and in a few more months I am going to switch off RFP by default - see #1804

So what I suggest you do is in your overrides, add the following

/* turn off RFP related items until arkenfox catches up */
user_pref("privacy.resistFingerprinting", false);
user_pref("privacy.resistFingerprinting.letterboxing", false);
user_pref("webgl.disabled", false);

/* parrot check */
user_pref("_user.js.parrot", "overrides: success");

then restart, open about:config and type in parrot and make sure it says overrides: success

and now test the problem is fixed

Thanks a lot @Thorin-Oakenpants , however, this did not solve the error unfortunately. Dang it. In general, it seems that I haven't really had errors due to 'RFP' tbh. Very enigmatic error is seems. Could be an error on my part due to the way my computer is configured (I doubt it though)

Thorin-Oakenpants commented 7 months ago

Worth a shot :) and at least we know its not webgl either. And we know it's not ETP. I'd really like to know what is it too.

We're either going to just keep suggesting prefs (most you can you flip in abut:config before you load any of the website in tabs), but to be honest, I would just keep adding them to the overrides and restart FF (you never know if some of them require a restart, plus the overrides list will give you a record of what are trying .. just keep adding items to it, one by one, re-testing ... until it works)

some possible items

try these first: one by one: I'll list them here with the values you want in your overrides

user_pref("security.ssl.require_safe_negotiation", false); // 1201
user_pref("security.tls.enable_0rtt_data", true); // 1202
user_pref("security.OCSP.require", false); // 1212
user_pref("security.cert_pinning.enforcement_level", 1); // 1223
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", false); // 1270
user_pref("network.http.referer.XOriginTrimmingPolicy", 0); // 1602

I've started with networking ones because there are no console errors and nothing happens, but to be honest, nothing else sticks out

or you could do a binary/bisection as per the wiki - that is in a new profile add half the user.js and test, etc. This can very quickly narrow down where the pref is

GlitteringReturn commented 7 months ago

disable uBO for the site(s) if you're using uBO

Yeah I made sure to do that, luckily before doing my troubleshoots. I got you, I will report back soon. I copied the code into my overrides file, didn't work, this one is a tough cookie, especially since I dunno how to probe computer related errors.

I'll head into about:config and will filter by modified and try turning some things on and off.

Edit: I figured out the above is a bad idea quickly, since I accidentally deleted a couple of preferences, luckily i was able to find them and their default values from my backup and add them to the overrides.

So far no luck, hoping to find a solution before the dreaded bisection and manual tediousness

GlitteringReturn commented 7 months ago

@Thorin-Oakenpants, update: this is not an issue with Arkenfox, for some reason when I made a new profile and applied my user.js file from my old Firefox profile, the videos started playing fine. I happened to do this by chance, after I completely failed at getting the "binary thingo" to work.

However, I did find a difference between the profiles, their prefs.js files differed from one another (maybe this is an issue with Arkenfox, assuming the prefs.js files are causing this issue). See this link for the differences, from a random service I found, that will expire in 1 month.

The weird takeaways from this are that fresh Arkenfox profiles can be different from one another for some reason, and simply installing a new Firefox is not enough to prove it is Arkenfox's fault.

Can anyone with more expertise than me answer whether or not this could be the cause? I tried turning off uBO by clicking the power button off for the site, maybe I need to uninstall it.

Unrelated question, but is using Google on Arkenfox okay due Arkenfox's "defenses", or should I use DuckDuckGo regardless?

Thorin-Oakenpants commented 7 months ago

Good to know you got it sorted. I have to admit, I am still using the same profile since I set up a new one (I use portables) back just before XUL was dropped, so around about FF56/57? Never had any issues. IDK if your profile was "corrupt" so to speak. IDK how old it is/was? There's a lot of settings in about:config under the hood, and a fair few files for state (cookies etc, hsts, etc etc). One reason we suggest running prefsCleaner and also the cleanup script .. for existing profiles.

Hope the transition was easy: e.g. adding extensions and their settings back in, importing your bookmarks ... adding site exceptions e.g. cookies + site data :)

truck on 🚚

Thorin-Oakenpants commented 7 months ago

hah, you edited your post, so I almost never saw all the extra stuff after binary thingo

diffs

The diffs between your new and old prefs.js are basically all runtime (like migration prefs as your update FF over the years, or update timestamps for various things, or info on remote services info, or first profile start ids, or session start ids such as push) or user changes (e.g. modify widths/toggles in consoles, or adjust sidebar widths, or move things on the toolbars/tabstrip, and extensions stuff ) - I don't see anything in there that would cause a problem

nothing to worry about. If AF is at fault, then you test that by only using AF on a new profile

Unrelated question, but is using Google on Arkenfox okay due Arkenfox's "defenses", or should I use DuckDuckGo regardless

up to you - do you trust (or care about) google? I use google (on nightly) because I basically only ever do very specific (tech) searches and only google is good enough to find my shit. Otherwise (both my main AF and nightly) non tech searches I use wikipedia or an IMDB search engine I added back in 1929, and I have DDG there as well. That pretty much covers it

but I also never need to sign in anywhere with google, and I block a fair bit of google related domains on all scopes via uBO, and I never use youtube, or gmail, or google docs ... etc. And I sanitize on close (all site data). So pretty much as far as I'm concerned, google doesn't track me - they only monetize my searches - which is just going to be boring tech shit. And each session, it's just another new shadow profile - except of course they will leverage my IP and maybe some FPing. I honestly don't know what they do for tracking in this regard (FPing).

but if you log in with google somewhere, this will open up your traffic to them as well since it allows the 3rd party to act as first party. And then there is the site exception for keeping some cookies + site data, that also disables partitioning for those domains see #1448

So you do you :) You want the web to be usable, and no doubt you want searches to be useful. DDG is certainly more private and doesn't shadow profile you or try to track you across the internet. So maybe use DDG as a default, but leave google as an option. And/or add extra search engines - e.g. I'm always looking shit up on wikipedia and imdb - this means bypassing all search engines and directly talking to the 1st party site I wanted in the first place

GlitteringReturn commented 7 months ago

I have to admit, I am still using the same profile since I set up a new one (I use portables) back just before XUL was dropped, so around about FF56/57? Never had any issues. IDK if your profile was "corrupt" so to speak. IDK how old it is/was? There's a lot of settings in about:config under the hood, and a fair few files for state (cookies etc, hsts, etc etc). One reason we suggest running prefsCleaner and also the cleanup script .. for existing profiles.

Hope the transition was easy: e.g. adding extensions and their settings back in, importing your bookmarks ... adding site exceptions e.g. cookies + site data :)

truck on 🚚

Thanks mate, keep trucking.

My profile is pretty new, but i still run the updater and pref cleaner a lot.

GlitteringReturn commented 7 months ago

@Thorin-Oakenpants, just a few last questions, have you considered opening a discussions page, for non-issue related general questions, whether they be about Firefox, security, privacy and computer science in general?

Also, is the goal of Arkenfox to emulate Mullvad and Tor, but allow more convenience with the overrides.js file? If so, I noticed Mullvad and Tor have some appearance differences, specifically with the location of their letterboxes and the compactness of their navigation bars and tabs. Could we implement some of these features, as well as other security and privacy features? Easier said then done I know

righto im done

GlitteringReturn commented 7 months ago

OMG I found the issue, it was uBO, after refreshing firefox to reset everything except for my bookmarks, and redownloading and importing my settings into uBO i nearly had a stroke as I realised the issue occured again, then i uninstalled uBO simply turning it off, for the website was not enough no idea why

Thorin-Oakenpants commented 7 months ago

I do not want discussions - it just creates noise - rejected it before, been asked a few times. I just want to focus on actual issues.

Thorin-Oakenpants commented 7 months ago

First step of troubleshooting as per the wiki - test FF with a new profile and no changes to ensure it actually works. Step 2, add only AF user.js (and maybe your overrides) to see if it is an AF pref - i.e no extensions.

sigh

GlitteringReturn commented 7 months ago

First step of troubleshooting as per the wiki - test FF with a new profile and no changes to ensure it actually works. Step 2, add only AF user.js (and maybe your overrides) to see if it is an AF pref - i.e no extensions.

sigh

Yeah I already did that, a while ago in this thread, but i should have done it prior to making the thread, couldn't be bothered to read the troubleshooting section tbh, not cause it's bad, just because the wiki is already A LOT for someone who isn't technically literate i.e., a layperson1.

Oddly reinstalling uBO fixed the issue, lmao. I tried to turn off uBO one of the first things I did, but didn't try uninstalling it, as i used it on a fresh profile and it was working. My custom configuration screwed something up even when reinstalling ublock, but then EVEN MORE ODDLY i reinstalled uBO AGAIN and then it started working with my custom configuration, honestly i dont know what the heck is going on

1As for the discussions thing, fair enough, although sometimes things aren't up to you and me, maybe the people can use it and for those who wanna ignore it they can? Hint hint: maybe feedback could be a MAJOR use case of the discussions section

I'm just happy to keep on trucking now.

Another thing I noticed is that the arkenfox letterboxing margins change depending on my windows scale size, this doesn't happen for mullvad or tor, also, it changes depending on whether i am in fullscreen or not