Hacker News: evilpie

New comment by evilpie in "Firefox Has Integrated Brave's Adblock Engine"

evilpie — Sat, 25 Apr 2026 07:28:18 +0000

> The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with.

> - We are not, and have no plans to abandon MV2 extensions. This will ensure certain types of add-ons, like ad-blockers, continue to work best in Firefox.

> - Firefox supports several ad-blockers as add-ons on Desktop and Android, including uBlock Origin.

> - We are not bundling Brave's ad-blocking system, we're testing one of their open source Rust components to improve how Firefox processes tracker lists.

https://www.reddit.com/r/firefox/comments/1sttf82/firefox_wi...

This is what the official Firefox account had to say when this came up on reddit.

New comment by evilpie in "Making Firefox's right-click not suck with about:config"

evilpie — Thu, 05 Mar 2026 11:43:20 +0000

Yes. It's in about:keyboard.

New comment by evilpie in "Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148"

evilpie — Tue, 24 Feb 2026 17:25:58 +0000

You aren't reading it right.

  new Sanitizer({})

This Sanitizer will allow everything by default, but setHTML will still block elements/attributes that can lead to XSS.

You might want something like:

  new Sanitizer({ replaceWithChildrenElements: ["h1"], elements: [], attributes: [] })

This will replace

elements with their children (i.e. text in this case), but disallow all other elements and attributes.

New comment by evilpie in "Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148"

evilpie — Tue, 24 Feb 2026 14:47:48 +0000

Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.

New comment by evilpie in "Firefox 148 Launches with AI Kill Switch Feature and More Enhancements"

evilpie — Tue, 24 Feb 2026 08:54:14 +0000

We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)

New comment by evilpie in "Element: setHTML() method"

evilpie — Wed, 22 Oct 2025 21:23:18 +0000

If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.

New comment by evilpie in "Element: setHTML() method"

evilpie — Wed, 22 Oct 2025 20:51:27 +0000

We enabled this by default in Firefox Nightly (only) this week.

Firefox Security and Privacy newsletter 2025 Q2

evilpie — Thu, 17 Jul 2025 12:00:07 +0000

Article URL: https://attackanddefense.dev/2025/07/17/firefox-security-privacy-newsletter-2025-q2.html

Comments URL: https://news.ycombinator.com/item?id=44592338

Points: 3

# Comments: 0

New comment by evilpie in "Firefox tab groups are here"

evilpie — Wed, 30 Apr 2025 07:41:27 +0000

Make sure you have Firefox 138! From the release notes: > You can also now reposition a tab group on the tab bar by dragging it.

New comment by evilpie in "Hardening the Firefox Front End with Content Security Policies"

evilpie — Wed, 09 Apr 2025 11:31:58 +0000

Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.

https://extensionworkshop.com/documentation/publish/add-on-p...

New comment by evilpie in "Hardening the Firefox Front End with Content Security Policies"

evilpie — Wed, 09 Apr 2025 11:30:37 +0000

While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security.

For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...

Hardening the Firefox Front End with Content Security Policies

evilpie — Wed, 09 Apr 2025 09:34:16 +0000

Article URL: https://attackanddefense.dev/2025/04/09/hardening-the-firefox-frontend-with-content-security-policies.html

Comments URL: https://news.ycombinator.com/item?id=43630388

Points: 185

# Comments: 68

New comment by evilpie in "Firefox tracks you with “privacy preserving” feature"

evilpie — Wed, 25 Sep 2024 07:46:45 +0000

If it's disabled (greyed-out), then you already have telemetry disabled.

New comment by evilpie in "Show HN: Tiny Chrome extension to disable images to reduce distractions"

evilpie — Sat, 01 Jun 2024 22:24:42 +0000

Firefox also has the about:config preference permissions.default.image: 2, which will block most images.

New comment by evilpie in "Cross My Heart – A Frogger Demake in 256 Bytes of HTML/JS"

evilpie — Sun, 11 Feb 2024 21:26:03 +0000

The profile actually shows the freeze is not caused by normal JS garbage collection, but by cycle collection. So probably something related to DOM nodes.

New comment by evilpie in "Flashpoint Archive"

evilpie — Thu, 04 Jan 2024 12:03:01 +0000

See also https://ooooooooo.ooo/. "9o3o is an official (but experimental) online version of the Flashpoint Archive."

New comment by evilpie in "Fritzbox: AVM is threatened with a sales ban due to violations of Huawei patents"

evilpie — Mon, 18 Dec 2023 12:44:00 +0000

https://www.pcgameshardware.de/Internet-Thema-34041/News/AVM...

Also one of the headings was mistranslated horribly.

In linked the article: "AVM threatens to ban the sale of Fritzbox routers". The original in German: "AVM droht Verkaufsverbot für Fritzbox-Router". Right translation is roughly: "AVM is threatened with a ban on the sale of Fritzbox routers".

New comment by evilpie in "Half-Life: 25th Anniversary Documentary [video]"

evilpie — Tue, 28 Nov 2023 13:21:01 +0000

See also Dario Casali's Half Life 25yr anniversary playthrough: https://www.youtube.com/playlist?list=PLk5gaNp4x_AVIJviyHueH...

New comment by evilpie in "Firefox desktop extensions coming soon for the upcoming Android release"

evilpie — Fri, 11 Aug 2023 09:36:19 +0000

Igalia is regularly contracted to work on new Firefox features, so this is already happening.

New comment by evilpie in "Firefox 115 Now Available with Intel GPU Video Decoding on Linux"

evilpie — Tue, 04 Jul 2023 15:01:22 +0000

[deleted because I don't to be accused for ragebaiting]