197845 2019-05-13 11:03:48 -0700 [WPE][GTK] Enable hyperlink auditing 2019-06-12 07:50:23 -0700 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build PC Linux RESOLVED FIXED P2 Normal --- 1 mcatanzaro mcatanzaro berto bugs-noreply cgarcia commit-queue enometh ews-watchlist gustavo mcatanzaro oldest_to_newest 1535675 0 mcatanzaro 2019-05-13 11:03:48 -0700 WebKitSettings::enable-hyperlink-auditing is enabled by default in WebPreferences.yaml but disabled by default in WebKitSettings.cpp. We should probably turn it on. See https://webkit.org/blog/8821/link-click-analytics-and-privacy/ for why having this off probably slows down web content, and why this is not a privacy risk. 1535679 1 369748 mcatanzaro 2019-05-13 11:07:14 -0700 Created attachment 369748 Patch 1535680 2 ews-watchlist 2019-05-13 11:09:58 -0700 Thanks for the patch. If this patch contains new public API please make sure it follows the guidelines for new WebKit2 GTK+ API. See http://trac.webkit.org/wiki/WebKitGTK/AddingNewWebKit2API 1535681 3 ews-watchlist 2019-05-13 11:10:09 -0700 Attachment 369748 did not pass style-queue: ERROR: Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp:782: Weird number of spaces at line-start. Are you using a 4-space indent? [whitespace/indent] [3] Total errors found: 1 in 4 files If any of these errors are false positives, please file a bug against check-webkit-style. 1535910 4 enometh 2019-05-13 18:47:29 -0700 There is a problem with the apple position in the "link-click-analytics-and-privacy" page - the claims are patently false. The page is apologetics from apple for removing the ability to block pings from safari - as they have apparently removed this switch there. The goal is tomake all ping requests and violations reporting non-optional, thereby removing the mechanism from the browser user to "do anything about it to protect himself" Any communication from the browser to a server that cannot be controlled by the user of the browser is a privacy risk. This should be self-evident. It is this basic truth that is under attack on that page. The argument for XHR sync and user-experience to motivate this policy change is bogus for the simple reason that they can be blocked. XHRs can be blocked by the user because they go through documented mechanisms which are exposed to the user via the webprocess. If there is no XHR being sent there is no loss of "user experience" as no tracking is sent from the user at all - and there is no loss of either privacy or user experience. Pings and beacons and reporting technology that address "user experience" are only addressing the issue of how to send tracking and privacy-leaking information from the user without the user ever knowing it and without the user being able to do anything about it. The only way to disable tracking and protect privacy is to expose the user to a mechanism. This particular technology is significant because all the browser manufacturers are acting in concert to remove the mechanisms from the user to protect himself. It is a shame that all opensource browser development has been dishonestly subverted to remove functionality and control from the user all the while under a false narrative. (For example epiphany is advertised as an independent browser focussing on privacy and security. But everytime unsuspecting user uses epiphany it tries to fingerprint the user with his ip on firefox and google servers) 1536009 5 mcatanzaro 2019-05-14 05:29:10 -0700 Browsers can't block XHR without breaking the web; there's just no way. Your argument doesn't make any sense. 1542376 6 mcatanzaro 2019-06-06 06:27:14 -0700 Ping reviewers. 1544085 7 369748 commit-queue 2019-06-12 07:50:22 -0700 Comment on attachment 369748 Patch Clearing flags on attachment: 369748 Committed r246352: <https://trac.webkit.org/changeset/246352> 1544086 8 commit-queue 2019-06-12 07:50:23 -0700 All reviewed patches have been landed. Closing bug. 369748 2019-05-13 11:07:14 -0700 2019-06-12 07:50:22 -0700 Patch bug-197845-20190513130713.patch text/plain 3485 mcatanzaro U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ1MjM0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGMyOTEzYWViYjJiOTY3N2Mx M2Q1ZTllYTZmY2Y2YWY1ZTVlZDhhZTkuLmMwYThkYzczYWU3NDFiY2QyMDcyODZkZmE0ZGMyNDM0 NTE0MjQyNmQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTktMDUtMTMgIE1pY2hhZWwg Q2F0YW56YXJvICA8bWNhdGFuemFyb0BpZ2FsaWEuY29tPgorCisgICAgICAgIFtXUEVdW0dUS10g RW5hYmxlIGh5cGVybGluayBhdWRpdGluZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTk3ODQ1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgKiBVSVByb2Nlc3MvQVBJL2dsaWIvV2ViS2l0U2V0dGluZ3MuY3Bw OgorICAgICAgICAod2Via2l0X3NldHRpbmdzX2NsYXNzX2luaXQpOgorCiAyMDE5LTA1LTEzICBN aWNoYWVsIENhdGFuemFybyAgPG1jYXRhbnphcm9AaWdhbGlhLmNvbT4KIAogICAgICAgICBVbnJl dmlld2VkLCBmaXggdW51c2VkIHZhcmlhYmxlIHdhcm5pbmdzIGluIHJlbGVhc2UgYnVpbGRzCmRp ZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9BUEkvZ2xpYi9XZWJLaXRTZXR0aW5n cy5jcHAgYi9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9BUEkvZ2xpYi9XZWJLaXRTZXR0aW5ncy5j cHAKaW5kZXggNjU3YjFmZWJmNWQxZWUzMjYxMjY3MDRjYzIxZGE5NWU2NDM3ZjhjOC4uYzJlZDY4 MzFkYTU5YTRjYmJhMWYzYTNkNTkzMmQxNzg4YjRkN2I4MyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YktpdC9VSVByb2Nlc3MvQVBJL2dsaWIvV2ViS2l0U2V0dGluZ3MuY3BwCisrKyBiL1NvdXJjZS9X ZWJLaXQvVUlQcm9jZXNzL0FQSS9nbGliL1dlYktpdFNldHRpbmdzLmNwcApAQCAtNzc5LDcgKzc3 OSw3IEBAIHN0YXRpYyB2b2lkIHdlYmtpdF9zZXR0aW5nc19jbGFzc19pbml0KFdlYktpdFNldHRp bmdzQ2xhc3MqIGtsYXNzKQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ19w YXJhbV9zcGVjX2Jvb2xlYW4oImVuYWJsZS1oeXBlcmxpbmstYXVkaXRpbmciLAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXygiRW5hYmxl IGh5cGVybGluayBhdWRpdGluZyIpLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgXygiV2hldGhlciA8YSBwaW5nPiBzaG91bGQgYmUgYWJs ZSB0byBzZW5kIHBpbmdzLiIpLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgRkFMU0UsCisgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUUlVFLAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVhZFdyaXRlQ29uc3RydWN0UGFy YW1GbGFncykpOwogCiAgICAgLyoqCmRpZmYgLS1naXQgYS9Ub29scy9DaGFuZ2VMb2cgYi9Ub29s cy9DaGFuZ2VMb2cKaW5kZXggMTdkNmNhMDIzZTIzYWI2MGY4NWI2ZDBiNTRiMTBiOGMyMTcxNjMx MS4uYzM5ZTk2YWY0MGRjMDgyYjJjNTI3MzQ5Yjc0MTAwNzVmMjE4MjEwNCAxMDA2NDQKLS0tIGEv VG9vbHMvQ2hhbmdlTG9nCisrKyBiL1Rvb2xzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisy MDE5LTA1LTEzICBNaWNoYWVsIENhdGFuemFybyAgPG1jYXRhbnphcm9AaWdhbGlhLmNvbT4KKwor ICAgICAgICBbV1BFXVtHVEtdIEVuYWJsZSBoeXBlcmxpbmsgYXVkaXRpbmcKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5Nzg0NQorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogVGVzdFdlYktpdEFQSS9UZXN0 cy9XZWJLaXRHTGliL1Rlc3RXZWJLaXRTZXR0aW5ncy5jcHA6CisgICAgICAgICh0ZXN0V2ViS2l0 U2V0dGluZ3MpOgorCiAyMDE5LTA1LTEyICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBsZS5j b20+CiAKICAgICAgICAgW0pTQ10gQ29tcHJlc3MgV2F0Y2hwb2ludCBzaXplIGJ5IHVzaW5nIGVu dW0gdHlwZSBhbmQgUGFja2VkPD4gZGF0YSBzdHJ1Y3R1cmUKZGlmZiAtLWdpdCBhL1Rvb2xzL1Rl c3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0R0xpYi9UZXN0V2ViS2l0U2V0dGluZ3MuY3BwIGIvVG9v bHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRHTGliL1Rlc3RXZWJLaXRTZXR0aW5ncy5jcHAK aW5kZXggZDExNTZmMzg0Njc4ZmVlZDI2NDJmNGE5NzY5ZGU5NTFjZjViOTBhYy4uNWE0YTdlNGE0 MjRlNDhiYjY1YWM4Y2JiMDliNjhhMTc0NDdiMTI0MiAxMDA2NDQKLS0tIGEvVG9vbHMvVGVzdFdl YktpdEFQSS9UZXN0cy9XZWJLaXRHTGliL1Rlc3RXZWJLaXRTZXR0aW5ncy5jcHAKKysrIGIvVG9v bHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRHTGliL1Rlc3RXZWJLaXRTZXR0aW5ncy5jcHAK QEAgLTk2LDEwICs5NiwxMCBAQCBzdGF0aWMgdm9pZCB0ZXN0V2ViS2l0U2V0dGluZ3MoVGVzdCos IGdjb25zdHBvaW50ZXIpCiAgICAgd2Via2l0X3NldHRpbmdzX3NldF9qYXZhc2NyaXB0X2Nhbl9v cGVuX3dpbmRvd3NfYXV0b21hdGljYWxseShzZXR0aW5ncywgVFJVRSk7CiAgICAgZ19hc3NlcnRf dHJ1ZSh3ZWJraXRfc2V0dGluZ3NfZ2V0X2phdmFzY3JpcHRfY2FuX29wZW5fd2luZG93c19hdXRv bWF0aWNhbGx5KHNldHRpbmdzKSk7CiAKLSAgICAvLyBCeSBkZWZhdWx0IGh5cGVyIGxpbmsgYXVk aXRpbmcgaXMgZGlzYWJsZWQuCi0gICAgZ19hc3NlcnRfZmFsc2Uod2Via2l0X3NldHRpbmdzX2dl dF9lbmFibGVfaHlwZXJsaW5rX2F1ZGl0aW5nKHNldHRpbmdzKSk7Ci0gICAgd2Via2l0X3NldHRp bmdzX3NldF9lbmFibGVfaHlwZXJsaW5rX2F1ZGl0aW5nKHNldHRpbmdzLCBUUlVFKTsKKyAgICAv LyBCeSBkZWZhdWx0IGh5cGVyIGxpbmsgYXVkaXRpbmcgaXMgZW5hYmxlZC4KICAgICBnX2Fzc2Vy dF90cnVlKHdlYmtpdF9zZXR0aW5nc19nZXRfZW5hYmxlX2h5cGVybGlua19hdWRpdGluZyhzZXR0 aW5ncykpOworICAgIHdlYmtpdF9zZXR0aW5nc19zZXRfZW5hYmxlX2h5cGVybGlua19hdWRpdGlu ZyhzZXR0aW5ncywgRkFMU0UpOworICAgIGdfYXNzZXJ0X2ZhbHNlKHdlYmtpdF9zZXR0aW5nc19n ZXRfZW5hYmxlX2h5cGVybGlua19hdWRpdGluZyhzZXR0aW5ncykpOwogCiAgICAgLy8gRGVmYXVs dCBmb250IGZhbWlseSBpcyAic2Fucy1zZXJpZiIuCiAgICAgZ19hc3NlcnRfY21wc3RyKHdlYmtp dF9zZXR0aW5nc19nZXRfZGVmYXVsdF9mb250X2ZhbWlseShzZXR0aW5ncyksID09LCAic2Fucy1z ZXJpZiIpOwo=