Hacker News new | ask | show | jobs
by simoncion 21 days ago
The only thing that I don't do in Firefox's "Private Browsing" mode is play a handful of stupid little in-browser games that save progress in a cookie or whatever. I even have Firefox set up to open in "Private Browsing" by default. Here's what I did just now:

1) Quit Firefox

2) Opened Firefox

3) Visited 'about:config'

4) Set 'javascript.enabled' to 'false'

5) Quit Firefox

6) Opened Firefox

7) Re-visited 'about:config' and verified that 'javascript.enabled' is still set to 'false'

8) Visited <https://datatracker.ietf.org/doc/rfc5737/>

It's still exactly like I reported it was. The "Manage browsing data" thing accessed through Firefox's regular settings dialog doesn't indicate that there is any data saved by any ietf.org subdomain, and when I watch the Network pane, a ctrl+shift+f5 reload of the RFC5737 page indicates that the page loads everything from an ietf.org subdomain... so the saved resources from one of the like eight domains in that list aren't relevant.
1 comments
Insimwytim 20 days ago
Fascinating.

I use NoScript, not 'javascript.enabled' setting.

I checked more closely and here is what appears to be missing:

  Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://static.ietf.org/dt/12.65.2/ietf/bootstrap-icons.5b9cac4e.woff. (Reason: CORS request did not succeed). Status code: (null).
Bootstrap icons.

  Block javascript - icons won't load.
  Allow javascript - icons load.
  Block javascript again - icons load, unless tab is closed and then opened again.
This behavior has been observed previously.

I tried to selectively block css to see how it's tied to javascript.

  Block javascript, block css from static.ietf.org - icons won't load, page layout is broken.
  Allow javascript, block css from static.ietf.org - the icons won't load, layout is fine.
Evidently, with javascript blocked, layout css loads fine, but bootstrap icons only able to load when javascript is not blocked.

'javascript.enabled' setting seem to has no effect on icons. However, unlike NoScript, it does not provide any domain separation/granularity.

link