Unable to access hanime.tv [solved: wasm]

[ghost]

Firefox 81.0.4
Using latest user.js with recomended setup.

Accessing the degenerate site hanime.tv results in "Your browser is too old", which is odd. Using safe-mode without extensions results in the same issue. Using 2nd clean profile with no extension and no custom user.js works just fine.

I tried going through most obvious prefs in user.js disabling them one-by-one but after 20/30 or so I gave up, there were no results and testing all 100+ is just an absolute chore.

if anyone has any suggestions that'd be appreciated

[PhotonNite]

It is caused by javascript.options.wasm being disabled

[ghost]

It is caused by javascript.options.wasm being disabled

How did you figure it out? What the methodology used (besides the one suggested by Thorin-Oakenpants)? I had 0 errors in console. How can I go about figuring out such issues in future? Any tips?

[PhotonNite]

How did you figure it out?

I just guessed based on the previous issues I had with other sites but normally I use the same method Thorin-Oakenpants suggested when the site breaks

[ghost]

Hmm, is there any way to use user.js per container? Using custom profile for a new tab is a bit too heavy, but if there was a way to use custom containerso you can have specific perfs disabled for specific site you gonna open in that workspace - that'd be hella nice, so I can keep wasm disabled in general for the common mode/container.

[rusty-snake]

Hmm, is there any way to use user.js per container?

No.

[earthlng]

How can I go about figuring out such issues in future? Any tips?

use our troubleshooter script

[Ilomantis]

Slightly OT but is disabling WebAssembly even necessary? I looked at an old issue (#244) from 2017 and as far as I could tell there are no FP implications. The fact that a relatively popular (heh) website is now broken because of it makes me wonder.

[Thorin-Oakenpants]

It's more to do with the fact that it increases the attack surface and is a security risk. It's also not widely used. A quick search reveals

• Jan 2020: ZDNet: Half of the websites using WebAssembly use it for malicious purposes

  • WebAssembly not that popular: Only 1,639 sites of the Top 1 Million use WebAssembly.

• Jul 2020: IEEE.org: More Worries over the Security of Web Assembly

  • A 2019 study conducted by researchers at the Technical University of Braunschweig in Germany investigated the top 1 million websites and found Web Assembly to be used in about 1,600 of them. More than half of those instances were for mining crytocurrency

  • ... security researchers have increasingly been finding vulnerabilities in Web Assembly, some that had been known and rectified for native programs years ago.

• Apr 2020: Medium: WebAssembly Is the End of the Internet As We Know It

  • Lastly, there are security issues. With this much power and low-level access, certain attacks (brute-force) and vulnerabilities are becoming possible

[Thorin-Oakenpants]

OK, I'll rephrase that .. @earthlng Should we add a reason to 2422 as to why we disable it: e.g

/* 2422: disable WebAssembly [FF52+] [SETUP-PERF]
 * WASM blah blah, see [2]
 * [STATS] WASM is rare: approx 0.2% of websites, and half of those for are for crytopmining, see [3]
 * [NOTE] In FF71+ this no longer affects extensions (1576254)
 * [1] https://developer.mozilla.org/docs/WebAssembly ***/
user_pref("javascript.options.wasm", false);

We could also probably drop the FF71 note now ESR is 78, maybe add a setup-web tag, except we already have a setup-perf on it. I think a setup-web fits better

[earthlng]

^^ yeah, sounds good to me, you found some good and interesting links there.

[ghost]

Hmm, is there any way to use user.js per container?

No.

That's unfortunate. So custom profiles is the only way?
Hmm, is there any way to access advanced preferences in about:config via extensions API?

[Thorin-Oakenpants]

is there any way to access advanced preferences in about:config via extensions API?

Web Ext allows access to a very few privacy related settings - that's it. Certainly not flipping wasm.

So custom profiles is the only way

Or a secondary browser: e.g. install Beta or Nightly for one offs: tweak it al little: e.g add uBlock Origin, run thru the options UI etc: sanitize everything on close

Edit: The reason I say that is because they both allow me to open them even when I have my main FF open (without resorting to adding flags to shortcuts etc)

[ghost]

Web Ext allows access to a very few privacy related settings - that's it. Certainly not flipping wasm.

I guess this kind of makes sense, seeing how some of them require restart so a tab wont do. I will stick for custom profiles, thanks!