(Obsolete) Firefox build discussion thread about nanocore

[wazerstar]

I got latest version that was signed, grabbed it out from my cache. you can install it as drag and drop og locate file with firefox it will accept it.

v. 13.31
nano-defender.13.31-signed.zip from mozilla official store

File: nano-defender.13.31-signed.zip
CRC-32: a88c03ee
SHA-1: 82d5857a9bcdddd981b6a7e68265f31d42f98931
SHA-256: d159b3e953b165964d5ff3d09f488061304954ee36f72ff9332183e3793dc2cc
SHA-512: 70e8107283ec69c905ed45f8064c690d5f37ce429fa286dc604d29ed979b11b6c73cea8641feb917b6a0789f9e73423c608e7c5d74ec57b31e979b7d056b4f89

File: nano-defender-signed.xpi
CRC-32: dd2ed4f5
SHA-1: 045743f733e3ca89bce9778a871ad36271460674
SHA-256: 26fbc97e473883a2c0cc4d52eae93cc0508a16e8cc1b34dfccaa5578c7b755e3
SHA-512: 54a09ab2536a7a34baee067431d4e8e573c44830766c8758ba88495563491c2cb59ffd9e1e284087f55f05f14af9162228e1a6c9a836ac0e44d59826d0fa39f6

[Corruptinglyneedful]

Thanks guys, Firefox needs to piss off with preventing me from installing things I shouldn't. I can accept risk if something breaks. I don't need browsers to be my parent.

[jspenguin2017]

This is the email I got:

Hello,


Your add-on Nano Defender has been reviewed and one or more of of its versions have been disabled due to critical issues discovered.

Details:
This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion . Here are some examples that were discovered:
- content/1-content-domlib.js line 343
- content/1-content-domlib.js line 402
- content/1-content-domlib.js line 414
- content/1-content-domlib.js line 425
- content/1-content-domlib.js line 438
- content/3-content-rules-2-specific.js line 2588
- content/3-content-rules-2-specific.js line 2678
- content/3-content-rules-3-sticky.js line 24
- content/3-content-rules-4-proprietary.js line 33
- content/4-content-debug.js line 105
- content/4-content-debug.js line 132

A suggestion for the next version:
a) Please use node.textContent instead of innerHTML for assigning text information to a DOM node or if you need to create new DOM nodes use document.createElement() and NODE.appendChild() functions. Usually usage of innerHTML is not permitted in add-ons because innerHTML is a major security risk when used with data from external sources.
For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion
For inserting text, textContent (or JQuery text) or createTextNode() should be used instead of innerHTML.
For inserting HTML, the safer method is to use createElement(), textContent, appendChild() instead of innerHTML.
b) Please use an established library for sanitize when creating DOM elements using external data. You can use DOMPurify, see accepted versions here: https://github.com/mozilla/amo-validator/blob/master/validator/testcases/hashes-allowed.txt

1) We don't allow add-ons to use remote scripts because they can create serious security vulnerabilities. We also need to review all add-on code, and this makes it much more difficult. Please insert those scripts locally from your add-on code.
- content/3-content-rules-4-proprietary.js line 66

Version(s) affected and disabled:
13.11, 13.15, 13.16, 13.17, 13.20, 13.24, 13.27, 13.28, 13.29, 13.30, 13.31

Reviewer:
Bogdan Matei

You can resolve this by addressing the issues raised in the reviewer's notes and uploading a new version at https://addons.mozilla.org/en-US/developers/addon/real-nano-defender/versions

If you want to respond please reply to this email or visit https://addons.mozilla.org/en-US/developers/addon/real-nano-defender/versions .

You can also join us in #addon-reviewers on irc.mozilla.org.

To learn more about the review process, please visit https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Reviews
--
Mozilla Add-ons Team
https://addons.mozilla.org


===================================================================
You received this email because you're subscribed to:
   * email me when my add-on is reviewed by a reviewer


You can't unsubscribe from this type of email.

Manage email notifications: https://addons.mozilla.org/users/edit#acct-notify

First, all innerHTML assignments are either hard-coded or generated from trusted data. Make a POC to exploit it, I challenge you.

Second, the proprietary code loader only run if debug mode is on, where the flag is false for AMO version. I'll remove the loader though, but I need platform builder working first.

Also the link for responding doesn't work.

[jspenguin2017]

I'll pass the extension through platform builder after my exams. If Mozilla still doesn't like it then I'll go unlisted.

[jspenguin2017]

They have no remote script in production mode, not for Firefox at least. Script snippets are loaded remotely on Chrome (it's been like this for uBO for years).

They do have some remote scripts when loaded in debug mode, but that only works for Chrome. It is for the two websites where the webmaster just refuse to give up, so I set up some serious obfuscation and they gave up 😂

[Niftator]

The "get it for firefox" link at https://github.com/NanoAdblocker/NanoCore links here instead of, you know, anywhere useful, like an actual download link or anything.

[jspenguin2017]

Nano_Firefox_Defender.zip

I can't get a xpi file.

[krystian3w]

• ^{{6ea144f3-db99-47f4-9a1d-815e8b3944d1}} .xpi.txt - remove ".txt" ^{(recommend "save as..." option)}

• ^{{6ea144f3-db99-47f4-9a1d-815e8b3944d1}} .zip - change ".zip" to ".xpi" ^{(recommend "save as..." option)}

PS. Possible install with ".xpi.txt"/ ".zip" when drag & drop file to "about:addons" page.

[setosd000]

I have nano defender 13.31 xpi file from the directory of my firefox 58 32 bits Microsoft Windows.
nanodefender-13-31.zip Install it manually from file.

[dyn888]

That's great to hear! :)

Just for info, for new people who may wonder what to download. The following files are binary identical, that is, exactly the same file:
{6ea144f3-db99-47f4-9a1d-815e8b3944d1}.xpi (from nanodefender-13-31.zip, posted by setosd000)
nano-defender-signed.xpi (from nano-defender.13.31-signed.zip, posted by wazerstar)
6ea144f3-db99-47f4-9a1d-815e8b3944d1.zip (renamed xpi, posted by krystian3w)
6ea144f3-db99-47f4-9a1d-815e8b3944d1.xpi.txt (renamed xpi, posted by krystian3w)
SHA-1: 045743f733e3ca89bce9778a871ad36271460674
Thanks to all who uploaded! :)

The original filename from the Mozilla store was: nano_defender-13.31-an+fx.xpi

So, download any of these, they are all the same.

[krystian3w]

Extension_Signing#Unbranded_Builds / Iceweasel - test install older version #41 (comment)

No works in Unbranded (stable 58.0.2), Iceweasel and Nightly (60).
xpinstall.signatures.required - FALSE

Tested too method: "config.js + config-prefs.js / mozilla.cfg + autoconfig.js" - outdated

Always info: "addon may corrupt".

---

Possible another compile unsigned addon nano defender (I can install "uBlock0.webext.xpi" by grohill - unsigned in Unbranned / Nightly with change value xpinstall.signatures.required)?

[GrPK]

So what is the problem if I download the one from the add-ons page on the first post? Cause I dont get it why I should import the add-ons

[jspenguin2017]

It's about Nano Defender.

[Corruptinglyneedful]

OK, I seen that earlier but wasn't sure because it was just a random file link, could have been anything. However, I'll trust that you didn't just make up that MD5 check file and the fact you took time to post it, means you care about security.

I will give this a go, thank you.

[reunicorn]

@Niftator The extension is not yet available for download on Firefox. Right now it's only available for Chrome.

[jspenguin2017]

@Niftator I wrote "Work in progress", which means it's not done and ready yet.
This issue is for developers who wants to comment on it, like what needs to be changed to make it work on Firefox.

[jspenguin2017]

@Niftator It is up in the store now, I think I packaged the right files.
https://addons.mozilla.org/en-US/firefox/addon/real-nano-adblocker/

[nanisise]

Is it possible for supporting firefox 56?

[xlollomanx]

@nanisise I read somewhere jspenguin will not support ff56 because it need a different language to build extension and it's going to die.

[jspenguin2017]

For ND, no, because I absolutely need the new API in FF 57. And support for FF 57 may drop as soon as FF 58 is out because of browser bugs. Anti-adblock solutions are bleeding edge, you need to be on the latest technology to defeat sophisticated anti-adblock scripts.
Nano Adblocker supports back to FF 52 like uBO.

For legacy platforms, Nano Adblocker might support it if requested, but the support will drop as soon as it's dropped in uBO. However, chances are you'll be better to stay with uBO on legacy platforms as I have 0 experience coding legacy extensions.

[TonyTough]

Just a cosmetic issue:
If using Nano Defender with Ublock Origin in Firefox, the additional filter lists Nano Base, Nano Timer and Nano Whitelist are shown as URL under addtional filters in Ublock Origin
whereas Nano Defender Integration List is shown correctly as list name.

[jspenguin2017]

That feels like a bug in uBO where the title information isn't passed back. Nano has the problem as well, but in Nano's case, the title is hard coded into assets.json.

[jspenguin2017]

I can only debug one add-on at a time in Firefox?

[88b88power]

Are there any websites where we can test whether the Nano Defender is working?

[jspenguin2017]

@88b88power https://www.cloudflare.com/apps/noadblock/install

[Chrisnetika]

Hi guys, I'm a new user though before I have been using UBlock.I have a question, I want to mod the popup thingie idk what it's call where you can disable ad blocker and has buttons where you can zap element.What I want to do is add a button where I can enable/disable my filters on the fly.Reason why? Well I only have one custom filter and it's for https://*-edge-chat.facebook.com and what that does is hide last active on facebook as well semi disables fb chat.What I basically want to do is toggle that on the fly.I figure bit coding hack that toggles my filters setting fast.Is this possible? I understand every update will revert this and I would have to manually edit it back in every time.

[elypter]

why not create a userscript?

[jspenguin2017]

@Chrisnetika You would need to fork, Chrome will enforce code integrity of extensions and once signed, it won't load if changed.

[Chrisnetika]

Or I could repackage it while in developer mode, then whitelist the extension ID using group policy templates problem solved.I was looking around files and pinpointed the file I would probaly need to edit is js/popup.js.There already 4 buttons in tools at the bottom ie: toggle remote font,disable cosmetic filtering.. etc so i'm thinking can add one for my filters toggle.Only thing is... not sure what I need to add unless I spend hours looking through source and do trial and error lol. But yes I would need to fork ,do my edits and any updates I can just pull and preserve my edits, package the extension then add the extension i.d to whitelist via group policy (gets rid of annoying msgs in chrome)

[jspenguin2017]

@Chrisnetika You need to send a message to the background page, then:

• Remove / add your filter from / to nano.selectedFilterLists
• Call nano.loadFilterLists

You should check to make sure nano.selectedFilterListsLoaded is true and nano.loadingFilterLists is false to prevent savedata corruption.

I didn't test it, hopefully it works.

[Chrisnetika]

alright that a step in the right direction, thank you

[necros2k7]

Hi there. 1. Is it possible to use Nano defender with Umatrix, Ublock?
2. Can someone give cons & pros for using Nano blocker not other blockers?

[jspenguin2017]

1. Yes. See: https://jspenguin2017.github.io/uBlockProtector/ Although uAssets should be able to neutralize anti-adblock scripts of a good amount of websites.
2. uBO is more stable and can be slightly faster, Nano goes for bleeding edge and have more features, but in turn is less stable and slightly slower. The performance hit for loading Nano's resources into uBO is untested, Nano will for sure cache its extra resources efficiently. uBO is recommended if you want something that is "install and forget", Nano is recommended if you need Nano Defender or use dashboard (write custom filters, etc) a lot.

[KudoAmine]

Works great on Firefox Quantum! Thanks.

[bobsage123]

Apologies, not a developer but have a question. If we use this for firefox and ublock, should we totally get rid of AAK-Cont? Or can they work in conjunction?

[Atavic]

Nanodefender, an Anti-adblock defuser for Nano Adblocker previously called uBlock Protector, is the current addon that supersedes AAK-Cont script.

[jspenguin2017]

You don't need AAK-Cont in that case.

[DiaoulDu]

Not sure, but I guess that nano defender is involved within a loop process when using 1fichier.com.
Cheers.

[jspenguin2017]

@Francois-dag I can't reproduce. If you still have the problem, please open another issue with more details and I'll have a look.

[DiaoulDu]

https://1fichier.com/?2a5j7r9quz&af=127778

This one loops for me in the meantime :

• last firefox
• ghostery
• ublock-origin
• last nano defender

cheers.

[jspenguin2017]

Still can't reproduce.

[DiaoulDu]

problem is on my side then, many thanx !

[nymous]

Hi,

NanoDefender addon is not found at this link https://addons.mozilla.org/en-US/firefox/addon/real-nano-defender/ (or when searching the AMO).

[jspenguin2017]

OK, Mozilla doesn't like it, well, that's unfortunate.
The Chrome version is still up, you can use Chrome in the meantime. Or use Dev or Nightly to force install unsigned extension.

They say my content script libraries are over-optimized (no custom DOM library and no assigning to innerHTML without using a third party library, wtf?) I'll de-optimize them for Firefox, but I first need to get platform builder working first as I don't want Chrome to suffer the same performance hit.

[Atavic]

@jspenguin2017 https://add0n.com/

That's a good place.

[jspenguin2017]

Even if I make it unlisted, it still needs to be signed by Mozilla. You can't get around Big Browser's "security".

[TonyTough]

Bug 1436849
Nano Defender is no longer on Add-ons Mozilla
https://bugzilla.mozilla.org/show_bug.cgi?id=1436849

[jspenguin2017]

Well, I guess they don't want to talk, I don't see how opening an issue will help. They locked the feedback.

I'm still reviewing their questionable policy. If assigning to innerHTML counts as "Create or expose security vulnerabilities", well, I'm not spending time separating rules that use innerHTML and rules that do not.

That apply to unlisted extensions as well, so there is no point spending time making it unlisted.

The extension was on their extension store for 2 months, what a great screening system, so inconsistent.

[elypter]

this whole signing enforcement thing was just a powergrab and a move towards google. i wish waterfox had more developers.

[jspenguin2017]

The problem with Waterfox is they are trying to keep legacy extensions, which is probably not going to go very well.

[elypter]

every deviation from the original project is going to take some work. i still hope for mostly automatic merging tools. that would be a game changer for free software.

[dyn888]

Could you please upload 13.31 xpi somewhere? I have 'Nano Defender-13.30.xpi', installed it without any problem, but now i see 13.31 was released, so it would be nice to be able to upgrade it manually, until things are resolved.

[dyn888]

Thanks! I loaded it via extension debugging, albeit it can be a bit of a hassle to use it that way. Other that that, it works fine.

If anyone has original XPI (from Mozilla page), please upload. :)

[dyn888]

Just a quick question -- is the difference between 13.30 and 13.31 only in videolab.io being added?

BTW, Nano Defender (foxified) also works with FF 55.x, tested with a few sites on Waterfox 55.2.2 and Basilisk (Firefox/55.0 Basilisk/20180202), so maybe min version required could be lowered, albeit there may be some reason to keep it at 57, just saying.

nano_defender-13.30-foxified.zip

[jspenguin2017]

I bump the version for every change, so that's likely the case.

It doesn't always work on Firefox 55, I can add more compile flags when platform builder is working.

[MusicInMe]

Hi guys, sorry to bother yous, not familiar with coding. Can't install ver 13.31 on FF 56.0 (64 b) as it says, that the addon can not be installed because it "appears to be corrupt".

[dyn888]

Thank you very much, setosd000! :) I installed it on latest Firefox and it works 100%. For all interested, if you want to rename it, the original name from Mozilla site was: nano_defender-13.31-an+fx.xpi - according to Google Cache.

MusicInMe, technically it is not corrupt, it just needs newer Firefox. It won't get installed because the original 13.31 has "strict_min_version": "57.0" in it, while foxified editions are less strict and it is possible to install them on older browsers.

I am uploading foxified 13.31 for all those who want it. It was downloaded from Chrome store and converted to Firefox with 'Chrome Store Foxified' addon. First unpack the zip and then drag&drop it to your browser. Note: xpi addons have all original files signed to ensure integrity, so you can be sure it is safe to manually install it.

nano_defender-13.31-foxified.zip

[jspenguin2017]

That's not my Firefox build, someone used Foxified to sign the Chrome build. It should work 95% of the time, but the platform flag is missing and Firefox specific code won't run.

so you can be sure it is safe to manually install it

As Mozilla sign everything and review later, it hardly has any security, especially for unlisted Foxified extensions.

[jspenguin2017]

I have some code that uses Firefox 57's response body filtering but it's guarded by Firefox platform flag instead of feature detection, it's not a great design, I have plan in fixing it but it requires so much changes that I haven't get to it. The original extension was hard coded for Chrome and didn't have separable platform driver.

[dyn888]

So, original 13.30 also has strict_min_version. I edited my post. Yes, Mozilla does that, sign first and review later, still, it is a good way to ensure integrity of something, at least when it comes from official sources.

Hopefully issues described here will be resolved soon with Mozilla, and then people can install it normally again. Also, thanks for all the hard work so far!

[DarkWav]

You could make Nano Defender a script for tampermonkey or something like that. Then Mozilla cant pervent
you from distributing it for irrelevant reasons. Bu thats still your choice and i know you had your reasons to discontinue AAK-cont.

[TonyTough]

Yes, but would it be possible to just "encapsulate" the Add-on in a script for tampermonkey without further changes?

[jspenguin2017]

@DarkWav That's not possible. I need background page scripting. Going Userscript you have to live with rules of scripts hosts developers, which are way worse. Nano Defender needs to be a real extension.

@jspenguin2017 Lol, do they seriously say: (We dont allow add-ons to use remote scripts because they can create serious security vulnerabilities.)

So they say Nano Adblocker/Defender have Remote scripts? Lol Lol

[krystian3w]

Maybe Mozilla team do not have time follow changes in remote files 😰

[Corruptinglyneedful]

Firefox install missing for Nano Defender? Is this working yet? Using FF 56. Just ditched UBO because I heard this was better for blocking anti adblock which I'm steadily growing tired of.

[jspenguin2017]

Yea, I haven't get to it. Having technical difficulties with weird Mozilla policy.

[Corruptinglyneedful]

Can I force install it?

[HeXN0P]

Yep: download this file: https://www.sendspace.com/file/7lcysq
Drag and drop into your browser

[krystian3w]

@Tinyhaker - Old signed 13.31 or newest compile another method to works in:

• Firefox Unbranded
• Firefox Nightly (xpinstall.signatures.required - FALSE)
• Iceweasel

---

Ok this is signed 13.31

[Corruptinglyneedful]

@krystian3w does it work in Firefox 56 or could it be made to work?

[krystian3w]

Try install addon: https://addons.mozilla.org/pl/firefox/addon/checkcompatibility2/ and after install Nano Defender 13.31 from XPI file.

Im running Chrome version thanks to Chrome Store Foxified. Do you think I should downgrade instead to the proper Firefox version or is fine like this?

[jspenguin2017]

You can just change the manifest, there will be exceptions on the background page but shouldn't cause too much problems. The Chrome version should work most of the time, but not always.
I'm still fixing my tools... It can take a while combined with exams and other stuff...

[Corruptinglyneedful]

@jspenguin2017 I don't know what that means. I am a simple user who is tired of anti-adblocking ways and it does not seem to work for Firefox 56.

[jspenguin2017]

Yea, it doesn't yet. I'll add support for older Firefox later.

[Corruptinglyneedful]

Is there nothing I can do for anti-adblock then? I don't use Chrome and I don't use Firefox 57 yet.

[krystian3w]

If checkcompatibilty2 and/or Chrome Store Foxified doesn't help - yes.

[Corruptinglyneedful]

@krystian3w I have the addon installed but no xpi file to install and I can't seem to find one.

[HeXN0P]

@Corruptinglyneedful https://www.sendspace.com/file/7lcysq here you are the xpi file.
MD5 check CFE225F320AE7D411230FD84E87F0644.
SHA-1 045743F733E3CA89BCE9778A871AD36271460674
84.5 KB (86,529 bytes)
Version 13.31

[Corruptinglyneedful]

OK, this seems to have installed properly. Now is that all I need to do or is there some sort of other steps? Really liking this ad blocker as a fork of UBO. Got a bit tired of Gorhil's stuffy attitude and refusal to add features. This essentially does the same thing, with a dev that's much more helpful. I can support that.

[krystian3w]

http://onlinemd5.com

---

https://jspenguin2017.github.io/uBlockProtector/

quote from jspenguin2017.github.io/uBlockProtector

Step 1. Install Nano Defender.

That is it if you are using Nano Adblocker! If you are using uBlock Origin, then you have a few more steps to follow...

Step 2. Enable Adblock Warning Removal List.

Step 3. Install Nano Defender Integration filter list.

Step 4. Go to uBlock Origin dashboard, select "Settings" tab, check "I am an advanced user", click the gears that shows up, replace "unset" after "userResourcesLocation" by "https://jspenguin.com/NanoAdblocker/AssetsMirror/NanoResources.txt" (without quotes).

Note: If you have another User Resources in use, then you would need to either switch to Nano Adblocker or manually merge resources. It takes an eternity to get any resources into uAssets, I have tried.

Step 5. Install Nano filters.

Step 6. Install Nano filters - Whitelist.

Note: My filter lists are now hosted on my own server after criticism from Raymond Hill. Although the old links will still work if you prefer them.

Note: If you are using uBlock Origin, then you must have a functional Internet connection when you start your browser or touch anything in the dashboard.

[HeXN0P]

@Corruptinglyneedful i think you don't need to do anything more xD

[Corruptinglyneedful]

Oh, 1 more minor question. I tried to import my UBO settings to Nano and they don't seem to have worked, even after I commit the changes? I'm having to re-build my white list from scratch. Is this normal?

[HeXN0P]

@Corruptinglyneedful delete all white list in nano and import white list from UBO again :D

[Corruptinglyneedful]

I had done that originally, still didn't carry over the dynamic rules for some reason. /shrug

There are worse things.

[HeXN0P]

@Corruptinglyneedful doing the manual way =)) ctrl + a ; ctrl + c ; ctrl + v from UBO to Nano ..........

[Corruptinglyneedful]

Lol that would be painful slow to do 1 line at a time, yes that would be worse.

Another question has cropped up. The worst offender of anti-adblock and the whole reason for looking into it; Wikia.com is detecting I"m using an adblocker, even with Nano Defender on. It's only when I unblock this domain does it piss off. xpanama.net What is this domain? Also can we just talk about how disgusting wikia is for a minute. There's over 25 domains on this page, over half are ad servers or tracking companies...

[Corruptinglyneedful]

I hate to be a bother with this but I made a screen recording to show what I mean, images weren't cutting it.

It should help clear up the confusion.

You can view that here: https://gfycat.com/SoftKeyBigmouthbass

[HeXN0P]

@Corruptinglyneedful https://postimg.org/image/pxu2h0paj/ Mine don't have that url .....

[Corruptinglyneedful]

You need to allow wikia services, I believe. That's probably why.

[Corruptinglyneedful]

I edited my post.

[HeXN0P]

I enable the wikia services nothing happen ctrl + f5 the page

[Corruptinglyneedful]

That's really strange. Try setting it up like I have mine in the video. All those domains should be loading unless maybe only one shows up when you block one of the others.

Edit: You're right, blocking wikia-services yield no change. What does that even do? Yet Xpanama.net is still present and when I block it, it breaks the page.

Oh btw, I'm using default install filters and settings for Nano with the exception that I block all 3rd party scripts and frames.

[HeXN0P]

https://youtu.be/_0f83GCBSsA try like this hmmmh

[Corruptinglyneedful]

I notice that I am blocking and allowing way more domains than you. That could be it. Try to set it like how I had mine in the gfycat. I'm pretty sure it's adblock detector script hosted on a 3rd party domain. I google the domain and I can't find much about it.

How do you get yours to show all the sub domains?

[HeXN0P]

you click on the +all

[Corruptinglyneedful]

Thanks man, that helps with future blocking mwhahaha.

Oh, well look at this. adserver.xpanama.net and as soon as I block it, it breaks the page and throws that warning even if I whitelist the initial domain.

It has to be an anti-adblocker script. There's no ads on the page.

[HeXN0P]

if i click the blue turn off button reload the page i see the panama domain turn back on no way to see it

[Corruptinglyneedful]

That's pretty strange, yah? Are you on Firefox or Chrome? I'm on Firefox 56. Might make the difference.

I think I stumbled on their adblocking script somehow.