Quote
Mala Okeh
Hi everybody, esp. Dorian,

can someone tell me if a final version of K-Meleon 76 is planned, and if so when?

Thx in advance,

Mala

sorry Mala. nothing so far from Dorian or any of the KM developers on finalizing KM 76. nothing but silence so you must wait until perhaps sometime in 2017.

I believe Dorian is preparing some sort of Christmas gift for us ;-)

Quote
rodocop
I believe Dorian is preparing some sort of Christmas gift for us ;-)

No, i think Dorian has been captured by some hot girl.
All hope is this lady let him to relieve from love prison.

Quote
rodocop
I believe Dorian is preparing sNo. Browome sort of Christmas gift for us ;-)

No. This browser is dead...

Hello there,

I'm not completely dead yet, I had another SSD crash and Windows decided to format my backup... I though I had another backup except it was *only* 8 months old. I already didn't like much windows before that but now I wish I could really avoid using it.

So, I've gathered what I have to make what could be a RC2. But I'm afraid this could not be complete and could have more problem than the RC. I don't have a changelog except for the code history (with crappy comment sorry)

Anyways, I wishes you happy holidays :p

I wish You joyeux Noël & frohe Weihnacht too. And thank You.

Sorry for Your frustration.

Merry XMS to all.

p.s. That Timo is probably from Sverdlovsk region and IMHO wanted to tease our comrade rodocop. с Рождеством to these two in Russia.

While win 3.1, WfW, 98se, Win2000, XP and even 7 are good systems this trying to be smarter than even experienced users and NSA spying are bad habits.

Windows too often does unwanted rollbax and recovers ... US West Coast idioty.

Maybe it is time and we should ask our friend Alain for a k-m linux distro with wine to run our good old browser and other windows programs we know and like.



Edited 2 time(s). Last edit at 12/20/2016 07:58PM by guenter.

Quote
guenter
...XP and even 7 are good systems this trying to be smarter than even experienced users and NSA spying are bad habits.

Let me reword that: ...are a crime and desaster. :cool:

Glad you're back Dorian! (Frankly, had already given up hope too ;-)
But shocked to hear everything is lost - again

Those SSDs seem to be highly dangerous for data, incredible. And there I used to believe that all those modern windows systems must be rock stable with all that restore point stuff and automatics and what not. But of course, if the complete disk goes down the tubes - oh no. And the backup gets eaten!? What does that mean now? All the source code lost since March, nothing in some sort of repository uploaded? Only the binary of RC1 still there? And that can't be reverse-engineered or whatever? Have no clue sorry.

PS: Please include the old, fully working USERAGENT macro again! Seems like lately people get more and more "old browser" warnings even with KM75.1. Most have no clue this could be fixed easily in most cases, and instead think this browser were hopelessly outdated and dead. Tsss. I know Mozillas old pref has been dropped long since but keep reading that it still works when added manually again. Anyone could do a little check for KM76...?

And the print preview seems completely impossible...

And the RSS button does nothing at all...

And perhaps the red-green "check.png" for the privbar could get another icon for "no 3rd party" settings too? Either yellow or half-red-green? People who never toggled anything keep thinking "cookies are allowed, so can't be the reason why function X doesn't work". Am using a half-red-green icon in the triple-toggle macro "priv3buttons", looks fine IMO. Even if the native macros keep toggling 2x only, perhaps they could still show the mixed icon if the setting is "no 3rd party".

Just daydreaming a bit

Quote
Dorian
Anyways, I wishes you happy holidays :p

This tool may help you a little.
SSD-Z
http://aezay.dk/aezay/ssdz/

We're not those editor push you hard to finish manuscript during holiday.
Take you time and enjoy!

Quote
Dorian
I've gathered what I have to make what could be a RC2. But I'm afraid this could not be complete and could have more problem than the RC.

@Dorian
Glad to see you again, and thanks for the update. Now KM76 can open the pages properly of pan.baidu.com. But two bugs to report:
1. Seems couldn't clear caches by the tool menu options, anynoe confirm?
2. Can't add and save user-defined gestures actions, please check this.

@siria
I use the old useragent macro in all KM74, KM75 and KM76 versions, it works very good!

Best wishes for all the KM friends.

________________________________________
K-Meleon zh-CN: http://pan.baidu.com/s/1o6NoHfG

Dorian

Very happy to hear from you. Too bad about the SSD problem. I hope 2017 is very much better for you.

@Dorian

Nice to see you.
To you and all K-Meleoneros: Season's greetings and best wishes for the New Year!

Sorry for the annoyance.
Wouldn't an external HD come handy? They are quite cheap nowadays.
Even though I never experienced data loss I have all valuable data stored on an external HD.
Call me paranoid but some of the data is stored additionally on a second external HD.

@Guenter

Quote

Windows too often does unwanted rollbax and recovers.

Except you disable that feature. I did so to spare my HD.

@Siria

Quote

Let me reword that: ...are a crime and desaster.

It's a matter of individual experience.
For me W2k was a huge improvement over Win98. Win7 is an improvement over W2k. However my Windows-story ends here because since Win8 Microsoft became a dead chapter for me.

I have started getting messages that I cannot use some sites in HTTPS mode because the security is not good enough. What is the highest level KM can handle? Are there any options a user can do to increase the security?

I have tried in 75.1, 76RC and 76RC2.

I don't think this user agent related. One site mentioned TLS, but I don't remember the specific message.

@James
Perhaps check your allowed TLS levels or SSL in about:config
There are even pref sheets for this, in old KM
F2>Privacy..>Encryption>Encrypted Transmission
In newer KMs probably additional stuff, not sure where exactly, perhaps start on "about:about" ?

siria


From: https://www.howsmyssl.com/
I am supplying TLS 1.2 and the following cyphers:

The cipher suites your client said it supports, in the order it sent them, are:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

I think that I wrote the pref sheet item as MgrTransCrypt.kmm in September of 2011.

what are the sites affected, James?

And can't it be the Win 10 issue?

rodocop

The site was https://www.myhealth.va.gov/

I think that they were having some server/code problem. I just now got that site to load in another tab. Right now, I am using the 76RC version of the browser.

For two days that site would not load in 75.1, 76RC, or 76RC2. It did load in MS Edge yesterday.

I wish that I could remember what site returned a message about TLS.

Loads in 75.1 for me

Quote
JamesD
I have started getting messages that I cannot use some sites in HTTPS mode because the security is not good enough. What is the highest level KM can handle? Are there any options a user can do to increase the security?

I have tried in 75.1, 76RC and 76RC2.

I don't think this user agent related. One site mentioned TLS, but I don't remember the specific message.

Hi JamesD - The highest level encryption (https) for KM76RC is TLS 1.2. TLS 1.3 has not been activated yet AFAIK. And yes, you're quite correct it is not UA-related.

Now I have to ask, because too many people can't quite see the difference, do you understand what TLS and SSL are? Importantly, are you aware that SSL is fatally broken and has been for as much as 10 years?

Transport Layer Security replaces Secure Sockets Layer, and SSL must be disabled.

To make your KM secure, do these:

* security.ssl.enable_false_start;false
* security.ssl.require_safe_negotiation;true
* security.ssl.treat_unsafe_negotiation_as_broken;true

* security.tls.unrestricted_rc4_fallback;false
* security.tls.version.fallback-limit;1
* security.xpconnect.plugin.unrestricted;false

network.disable.ipc.security;false
security.cert_pinning.process_headers_from_non_builtin_roots;false
security.ssl.errorReporting.enabled;true

security.tls.version.max;3 /this makes KM ready for TLS 1.3 when that is activated
security.tls.version.min;1

* security.ssl3.ecdhe_ecdsa_rc4_128_sha;false
* security.ssl3.ecdhe_rsa_rc4_128_sha;false
* security.ssl3.rsa_des_ede3_sha;false
* security.ssl3.rsa_rc4_128_md5;false
* security.ssl3.rsa_rc4_128_sha;false

Anything with an asterix is a UserSet, no asterisk means default setting.

Removing the 5 ciphers will force KM to look higher on the shelves, and will prevent insecure sites from loading. Thes ciphers are all broken: you may as well use plain-text

Doing this will get get some sites unloadable, sadly. It was heart-breaking to see so many Microsoft technical sites refused by KM. But eventually M$ grew a brain.

Alas, many Apple support sites are still using broken old (non)security...

There is no point encouraging sloppy server management, so you'll need to grit your teeth, and fire off an emnail to their site management if you have a pressing need to access those pages... They probably won't care

IMHO, KM should be shipped with these settings pre-installed.

____________________
Understanding the scope of the problem is the first step on the path to true panic. [Florence Ambrose, "Freefall" 01372 January 22, 2007 http://freefall.purrsia.com/ff1400/fv01372.htm]



Edited 2 time(s). Last edit at 12/23/2016 02:38PM by gordon451.

Uh, you kidding??? :O KM shall be unusable out-of-box on tons of important sites, with the purpose to educate the site authors, but in reality the only victims are us users??? Sorry, no way.
The userbase of KM would instantly drop to near zero!

And in my trusty old KM1.6 am mightly glad that there even are some sites out there still serving to SSL3/TLS1 too, otherwise half the web wouldn't even be readable anymore. Considering most of those site use https only for whatever fancy reason but not for privacy, being all public anyway.

The very few sites that REALLY must be secure, like for banking etc., can still enforce a higher encryption level, but that's a whole different story.

Quote
siria
Uh, you kidding??? :O KM shall be unusable out-of-box on tons of important sites, with the purpose to educate the site authors, but in reality the only victims are us users??? Sorry, no way.
The userbase of KM would instantly drop to near zero!

Hi Siria - I deleted SSL two years ago, and had trouble with only 5 or 6 sites, 3 in MicrosoftLand and two Western Australian State Government sites. And PayPal, go figure.

Microsoft did eventually grow a brain--this year!, all other sites now at least have TLS capabilities and I don't care if they still service SSL requests.

However, if you need to talk to Apple support sites, yes you could have a problem, because they appear to not have TLS, OR they may not have upgraded their cipher suites. I discovered this when my employer gave us iPads for our client interface, and I suddenly had to learn a very strange eco-system.

But breaking tons of important sites? Not my experience at all, and I would have thought that Europe would be a bit smarter than us Down Under so slightly more advanced in security terms.

KM1.6... I'm not sure it knows what TLS is, so at some stage you may not be able to visit tons of important sites anyway. OTOH, you could add settings to config, and cipher suites are usually under-the-hood anyway so all may still be well.

____________________
Understanding the scope of the problem is the first step on the path to true panic. [Florence Ambrose, "Freefall" 01372 January 22, 2007 http://freefall.purrsia.com/ff1400/fv01372.htm]

With all due respect, i think you guys talk something meaningless.

All open source web browser is easy to under attack somehow, So IE, Safari maybe the better option to use for web merchandise.

@ gordon451 if done like You suggest people will not assume it is a site fault but the small minority browser's fault.

AFAIR it has been discussed before.

set security.tls.version.max

and security.tls.version.min

to Your likings.

p.s. jasonliul K-Meleon uses the same GRE as Firefox which is one of the commercial browser - even though they may see it differently. And I do not consider more IE save for things. There can be an extra security if a browser is not so mainstream.



Edited 1 time(s). Last edit at 12/24/2016 11:08AM by guenter.

Possible regression?

In a post that I made today in the Off Topic section there seems to be a difference in the appearance of the forum. See the pictures below. I do have js enabled both places.

Is there another item that I should check?

Press F9 to toggle images?



Edited 1 time(s). Last edit at 12/25/2016 05:26PM by guenter.

Ha - got it! I think...
At least in KM1.6, here it's caused by that infamous JS image switch again:
F2 > Page Display > Images > Disallow scripts... (ROLLOVER)

Unless of course there may now be additional probs in 76?

guenter & siria

Disallow rollover images was the problem. I guess that I just got carried away clicking on items when I set up the RC2.

Thanks

The item in preferences - GUI appearence - general - Hide K-Meleon app title bar for KM76RC2 does not reflect the state of the title bar. I found this when I looked for solutions for this item: http://kmeleonbrowser.org/forum/read.php?1,140560

In my prefs panel the block was un-checked so I checked it and did a restart. I came up in KM without the title bar as expected. However when I went to restore the title bar the block was un-checked. Not being sure of another method to get the title bar back, I checked the block again and restarted. The title bar is back.

This is the case of not only this pref - I found some new prefboxes added to KMprefs in 75-75.1 not synced with the prefs themselves.
And it was already reported several times...



Edited 1 time(s). Last edit at 12/29/2016 07:13PM by rodocop.

Yeah, to get the simplest fixes into the official version is always much harder as 100x more complicated bugs :cool: I do understand it's more boring, but still...

Here's another 'simple' fix wish:

@Dorian
At the end of toolbars.cfg is a bit HowTo text, but it's partly contradictory, at least confusing. That's a real pity, because those extremely free customizations are one of the greatest features of KM!

Prob also, it's been too long I tried the new 7X buttons myself (1-2 years?) and meanwhile have the syntax details forgotten again too, making it very difficult to support new users even in the forum here

currently:
# NO TOOL BAR IMAGES = TEXT BASED TOOL BAR WITH BUTTON NAMES FOR IMAGES
# Button name starts with ! sign = Text based toolbar. If images are defined, the buttons show Image+Name

Seems like old and new version are mixed up here, 2 different methods supposedly creating a TEXT toolbar?
But IIRC (??) the new skin versions (=this file) ONLY recognize a "!" for a text toolbar?
Also most buttons contain no images anyway HERE, yet still do show them.
Not sure how to improve this, perhaps something like that??

# NO TOOL BAR IMAGES = TEXT BASED TOOLBAR WITH BUTTON NAMES FOR IMAGES
# Button name starts with ! sign = TEXT BASED TOOL BAR, showing this NAME.
# If images are defined for its COMMAND, either here below the tooltip line (??) or globally
# in skins.cfg (or in a macro??), text buttons will show IMAGE+NAME (example Privacy Bar)

# The button NAMES here are free text and have nothing to do with its function. Change as you like.
# This is especially important for the button WIDTH of TEXT toolbars, where the longest visible
# button defines the width for ALL other buttons inside the same toolbar too (e.g. Privacy bar)

current with additions:
# Print{ = NAME OF BUTTON (free text, no function)
# filePrint|Print = ID COMMAND, PLUGIN COMMAND, OR MACRO | MENU NAME (as defined in menus.cfg, macros or plugins)

=====

Yet another wish:

Add also a prepared user skin folder, named e.g. "myskin1", which contains just a copy of the default toolbars.cfg, and perhaps skin.cfg too
2 intentions: clueless users have at least a chance to realize skins are customizable, and to realize that images in the default folder work in all other skins too. And also less risk they accidentally overwrite and MESS the default toolbars.cfg, the one and only...