forum.palemoon.org/viewtopic.php?t=32127#p260948 Clownflare siege, day 50: Pale Moon got whitelisted

it still blocks SeaMonkey, and any attempt to get the invisible Turnstile to render will hang the browser :/

(and even the Pale Moon whitelist remains fragile)

So... nothing has really changed, and I really wish I had a debug symbols build here to check why in the hell SM is hanging if I dare using Inspector to point at the invisible Turnstile box

it's a instafreeze now, and doesn't seem to be script related in principle (as no script timeout window ever comes), but I have no clue there

...wait

....it eventually unhung itself!?

.....after almost 5 minutes

OK, let me wait 5 more minutes then...

2 minutes, still hung at 100% single core

...3 minutes, still burning coal

and exactly 4 minutes later, it hung

so... 240 seconds

---it unhung

then the page reloads, still with a blank Turnstile

looking at about:config for prefs named "timeout" yields nothing if looking for 240 seconds

but there are a couple dom.min_timeout_value prefs set to 4 (that one and dom.min_tracking_timeout_value)

maybe 4 for "minutes"¡

?

...no, those are miliseconds

irrelevant then

after a couple more runs on my Ryzen laptop, I can indeed narrow down the hang time to ~270 seconds, or 4m30s

that's a... very weird timeout

so let's recap: go to a Clownflared site, get the invisible challenge, try to inspect it (this caused it to render in older versions), then your browser will hang for 270 seconds pegging a single core 100%

it WILL unhang itself after that, then the challenge obviously has failed and expired, so it reloads.

yep, 270 seconds.

now let's confirm if this is profile dependent or not

forum.palemoon.org/viewtopic.php?f=65&t=32190&start=20#p260857 yep, the whitelist is _only_ for Pale Moon, contingent on them actually implementing a bunch of CSP junk as Chrome does among other things, and they will revoke it if they feel so

> Going to launch our browser developer program hopefully before end of month. This community will be invited to join along with others we are in contact with. The aim will be to share our requirements and have a better two way communication in place. Of course this is always going to be an ongoing balance between reducing unwanted bot traffic to a minimum VS keeping the false positive rate...

...as low as possible

FWIW the hang IS reproducible on 1) clean profile, and 2) usual work profile booted in safe mode

the 270 seconds timeout is extremely weird - the time IS always constant, always reproducible, and there is no specific pref or anything browser-side

but if it is a script that takes all that time, why the script timeout warning doesn't kick in?

now let's check if it is hardware dependant

fired up my trusty Core 2 Duo laptop

this one is running the release 2.53.20 official binaries, and the hang indeed is reproducible

now let's see how long it takes to unblock

...far more than 5 minutes, it seems :/

the poor ol' Core has been hung for the last 10 minutes :O

...finally it unhung itself after TWENTY MINUTES

Core 2 Duo T7200: > 20 minutes. Ryzen 7 5700U: 270 seconds