YASWT.

guigirl

Yet Another Service Worker Thread

For years one of my custom WPs has been vivaldi://serviceworker-internals, via which i routinely keep an eye on the breeding of these damn invasive pests. One of the most virulent purveyors of these things is our beloved forum, albeit from time to time i find other sites have also set up base-camp there too.

I regularly Stop and Unregister these things [which is a very chromium game of Whack-A-Mole if ever there was one]. Now, i instead wonder if using the option --disable-shared-workers in my custom command launcher might be better? Once i've posted this i shall test it out, but i did want to ask this first... what downsides should or might i expect from this idea? Eg, will it curdle my cat, or bamboozle my budgie?

I searched the forum first for "ServiceWorker"...

...from which, i saw numerous trusted & worthy Olde Thyme forummers advising peeps who asked about SW issues, to which the universal recommendation always boiled down to, essentially...

Try going to vivaldi://serviceworker-internals and clicking Unregister

...though i did especially enjoy this very Ducky one...

Personal note: Notifications and Service Workers need to die slowly in a fire

So that's why i thought, if historically the forum advice has always been [paraphrasing] "nuke the buggers", then why not stop them globally, permanently, instead of individually [assuming i have interpreted the intent of that option correctly]?

guigirl

@guigirl Well ffs, that option seems useless...

ServiceWorker

Open DevTools window and pause JavaScript execution on Service Worker startup for debugging.
Registrations in: /home/guigirl/.config/vivaldi-snapshot/Default (1)
Scope: https://forum.vivaldi.net/
Registration ID: 442
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Script: https://forum.vivaldi.net/service-worker.js
Version ID: 449
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2
Client:
ID: c6971a61-8587-4608-a71c-d8178ff807e1
URL: https://forum.vivaldi.net/topic/74530/yaswt

I expected my WP to show... nada.
Grumble...

Pathduck

@guigirl Well, I still have the following rules in uBlock:

! Service Worker A**holes
||cnet.com/service-worker.js
||twitter.com/sw.js
||finn.no/sw.js
||youtube.com/sw.js
||quora.com/sw.js
||google.com/maps/preview/sw
||google.com/mail/u/0/sw.js
||yahoo.com/service-worker.js

However, since "Cookie Autodelete" added support for removing SWs I just use:

It seems to work fine, but I know you've struggled with getting it to work?

ALSO - I've just noticed this one:

Registrations in: D:\bin\Vivaldi-stable\User Data\Default\Storage\ext\mpognobbkildjkofajifpdfhcoklimli\def (1)
Scope: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/
Registration ID: 0
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: RUNNING
Fetch handler existence: DOES_NOT_EXIST
Script: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/background-service-worker-873d52e877593885bced8686dea6aecb.js
Version ID: 5
Renderer process ID: 11732
Renderer thread ID: 1
DevTools agent route ID: 7
Client:
ID: 55fd32d0-ca1f-46c6-b073-109212c80fbd
URL: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/main.html
Client:
ID: b884646a-d692-4166-989b-5fdd59de7e3a
URL: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html
Client:
ID: efb7929e-6ba2-44f0-a7b7-3eb6a0915cc4
URL: undefined

A quick look at the SW code suggests it's related to the mail/RSS client (that I don't use..)

Why...

guigirl

I had briefly thought it was working, judging by the plethora of SW ERROR messages in the terminal...

guigirl@archlinuxTower[~] 00:44:02 Wed Apr 20 $> firejail --blacklist=/Seagate -- /opt/vivaldi-snapshot/vivaldi-snapshot --disk-cache-dir=/tmp/vivaldi-snapshot-cache --force-device-scale-factor=1 --debug-packed-apps --disable-features=UserAgentClientHint --disable-shared-workers
Reading profile /etc/firejail/vivaldi-snapshot.profile
Reading profile /home/guigirl/.config/firejail/vivaldi-snapshot.local
Reading profile /etc/firejail/vivaldi.profile
Reading profile /home/guigirl/.config/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 31799, child pid 31818
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Warning: logind not detected, nogroups command ignored
Warning: cleaning all supplementary groups
Child process initialized in 136.84 ms
[6:6:0420/004416.329315:ERROR:image_generic.cc(76)] Unable to decode PNG for 1.
libva error: /usr/lib/dri/iHD_drv_video.so init failed
[42:42:0420/004416.336585:ERROR:sandbox_linux.cc(377)] InitializeSandbox() called with multiple threads in process gpu-process.
[6:6:0420/004416.476516:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004417.508952:ERROR:CONSOLE(727)] "Uncaught TypeError: Cannot read properties of undefined (reading 'push')", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/jdhooks.js (727)
[6:6:0420/004417.839362:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
Fontconfig error: Cannot load default config file: No such file: (null)
[6:6:0420/004419.614175:ERROR:CONSOLE(1)] "Uncaught (in promise) ReferenceError: SharedWorker is not defined", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/bundle.js (1)
[6:6:0420/004419.662936:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004421.063218:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004421.085299:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004421.183732:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004421.427660:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004421.649935:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004422.249963:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004424.597086:ERROR:CONSOLE(0)] "Uncaught (in promise) Error: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004426.945763:ERROR:CONSOLE(0)] "Unchecked runtime.lastError: Cannot access contents of url "chrome://serviceworker-internals/". Extension manifest must request permission to access this host.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004426.946237:ERROR:CONSOLE(0)] "Unchecked runtime.lastError: Cannot access contents of url "chrome://serviceworker-internals/". Extension manifest must request permission to access this host.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004427.733024:ERROR:CONSOLE(0)] "Uncaught (in promise) Error: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004427.733135:ERROR:CONSOLE(0)] "Uncaught (in promise) Error: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004446.135241:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004446.162783:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004446.214907:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004446.701011:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004446.942032:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004452.534961:ERROR:CONSOLE(0)] "Uncaught (in promise) Error: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004452.535101:ERROR:CONSOLE(0)] "Uncaught (in promise) Error: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)
[6:6:0420/004505.872740:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004505.894384:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004505.930292:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004505.996655:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004507.253641:ERROR:service_worker_task_queue.cc(213)] DidStartWorkerFail mpognobbkildjkofajifpdfhcoklimli: 5
[6:6:0420/004507.318876:ERROR:CONSOLE(0)] "Uncaught (in promise) Error: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)

...but per my preceding post, the WP shows SW still happen, damnit.

@pathduck said in YASWT.:

It seems to work fine, but I know you've struggled with getting it to work?

Ta for your info, but yes, your memory is good [the farce is strong with this one] -- i had a real love-hate relationship for years with CAD. Many months ago i disabled it & now simply block all cookies in chromium settings [with a manual Allowed list]. For the record, when i was still using CAD, i had indeed found its SW option, but that also never worked reliably for me.

Gotta say, being repetitive, i really am peeved that chromium command is not working -- it got my hopes up for nothing.

guigirl

Yabber dabber dooo --- solved it!

https://www.amritabithi.com/permanently-disable-all-service-workers-for-brave-browser/

PoC:

Pathduck

@guigirl Ooh that's clever making it read only

A bit too hard-core for me, it could potentially lead to crashes but time will tell

sudo chmod 500 Service\ Worker/;

Hmm, why the sudo, assuming this is in ~ ?

I also did a search, and while earlier this had just turned up the usual advice (unregister etc), I now found this golden nugget for uBlock:
https://bonina.eu/web/disable-service-workers-chromium-browsers/

||$csp=worker-src 'none'

"The thought of some website installing a Service Worker(SW) upon visit, without explicit user acceptance or acknowledgement, makes little sense. [...] This liberal approach poses risks such as opening a new channel of entry for future exploits while contributing to the overall unnecessary arbitrary resource consumption. Disabling them altogether is a sensible approach to undo this."

So true

Note that outright blocking SWs might lead to some issues, like with this forum and its SW - potentially stopping notifications from working (?) But I think that the SW is only used for showing native notifications when the site is closed, and I don't need that crap anyway...

guigirl

@pathduck said in YASWT.:

why the sudo, assuming this is in ~ ?

Agree with you. I only followed the spirit of that method, not the letter [ie, in KDE changing Permissions, Ownership etc is a piece of cake just with the fabulous Dolphin GUI file manager], but it didn't ask me for authority when i did it, thus proving your point [which i knew to be valid even had i not used Dolphin]. Who knows?

@pathduck said in YASWT.:

found this golden nugget for uBlock

Yes, my searX last night also found that, & i was going to try it [& post here about it] but i found that other one which appealed to me even more. However, now, i think i might also deploy this uBO one too, coz, to my confusion & massive displeasure, despite last night's apparent victory, today i am faced with this shock:

ServiceWorker

Open DevTools window and pause JavaScript execution on Service Worker startup for debugging.
Registrations in: /home/guigirl/.config/vivaldi-snapshot/Default/Storage/ext/mpognobbkildjkofajifpdfhcoklimli/def (1)
Scope: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/
Registration ID: 2
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: RUNNING
Fetch handler existence: DOES_NOT_EXIST
Script: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/background-service-worker-c8f843bd2fcad012a7d3564ea6959d67.js
Version ID: 8
Renderer process ID: 3009
Renderer thread ID: 1
DevTools agent route ID: 7
Log:

I've noted yours & @hlehyaric 's reservations about now blocking all SWs in the current Snappie thread, but fwiw, so far anyway, no ill-effects [CRASH!!!] have befallen anything here [BOOM!!!] afaict [KAPOW!!!].

Later... after also deploying that uBO method...

Hmmm, ok yeah, now i can reproduce those ill-effects you both mentioned [the unwanted on-page Translate button, & the permanent status bar message Mail client starting...]. Those ill-effects coincide reproducibly when my WP for SW remains empty [care of my two blocking deployments]. As i mentioned in the Snappie thread...

I had that too, last night, after doing the SW stuff i posted about in t'other thread, However, i easily fixed it via that magic trick i discovered & posted about some weeks ago:

...however my subsequent tests repeatedly show that the penalty paid for executing said magic trick is that the bloody V SW once again occurs in the SW WP [notwithstanding the ongoing deployment of my two aforementioned alleged SW blocks, damnit].

On balance, i've decided to fly half of a white flag of surrender:

retained the SW directory Read-Only trick, to hopefully stop all non-V SWs in their evil nasty filthy little tracks.
disabled the very short-lived uBO method, coz it interferes with those important native V functions you two already mentioned, necessitating wielding that magic wand, which becomes self-defeating.

Dagnabbit. Still, ~~two outta three~~ one outta two ain't bad...

Pathduck

@guigirl said in YASWT.:

I had that too, last night, after doing the SW stuff i posted about in t'other thread, However, i easily fixed it via that magic trick i discovered & posted about some weeks ago:

Interesting idea, especially if it makes the SW magically register itself again. Are you always loading Vivaldi with the --debug-packed-apps flags?

I admit I mostly stopped doing that when it became much easier to just open devtools from an open Settings tab. I only need it for the right-click inspect option for some of the more pesky UI elements.

Trying it here it just crashes the browser... But it does bring back the SW registration. So - must be a way to trigger "Reload app" without having first to load with the flag arguments...

Later... after also deploying that uBO method...

Nope, pretty sure it's not related to the uBO rule. It was one of my theories too, but I excluded that after testing with disabling extensions etc. I'm running with that rule now and no SW registered except the Vivaldi internal one and things seem to be working again.

In theory your setting r/o to the Service Workers dir could cause something like this, but apparently this little bugger does not live there, it exists in
Storage/ext/mpognobbkildjkofajifpdfhcoklimli/def
for some reason (as can be seen in its registration path).

guigirl

@pathduck said in YASWT.:

Are you always loading Vivaldi with the --debug-packed-apps flags?

Yep. Several weeks ago, maybe even a few months now, i re-evaluated if i still "need" it, & "want" it. Whilst i was aware that we now have alternative accessibility to the Dev Inspector UI, being a simpleton with a goldfish memory means the big advantage of my command launcher way is that it's set & forget [i excel at the latter part]. Then, much more recently when i twigged to the fact this option also gives me those additional context menu options [but only in some parts of the V UI], i decided definitely to leave well enough alone.

@pathduck said in YASWT.:

Trying it here it just crashes the browser

Most of the time i've used it, V appears to crash, but then almost immediately relaunches [with as i now recognise, that specific V SW once again alive]. This [my] morn though when i did all that testing, the final time i used it it really did simply crash V. After i verified no processes were running, i had to manually relaunch it from my custom panel icon again... thereafter it remains behaving fine. Historically i recall also some other crashes from it, but a majority of my time with it, the crash--autorecovery occurred.

@pathduck said in YASWT.:

Nope, pretty sure it's not related to the uBO rule

I agree with you. The way i wrote it, above, is inaccurate, coz i confused myself trying to recollect the exact sequences of what i did & what happened, after the event. Hours after my last edit, i came to feel quite dissatisfied with the accuracy of some of my recollection, specifically the part you've [IMO] correctly pinpointed now. Ta.

@pathduck said in YASWT.:

this little bugger does not live there, it exists in
Storage/ext/mpognobbkildjkofajifpdfhcoklimli/def

Yes, i had gleaned that important [albeit weirdarse!] info from your post in the Snappie thread, which is why i now feel reasonably comfy my RO directory "trick" ["mine" only via deployment, not wrt intellectual property, i hasten to acknowledge] should be "safe" from clobbering basic V operation... maybe?

hlehyaric

@guigirl Tbh, I didn't think to use Reload App (thought I have debug packed apps enabled), instead I restarted V to no avail.

I have some reservations wrt SW to say the least, but I don't find many of them .

guigirl

@hlehyaric said in YASWT.:

have debug packed apps enabled), instead I restarted V to no avail

Yeah, i found this an interesting / unexpected point... how on earth can fully closing/launching V fail to fix it, whereas this mysterious hidden Reload App thingie magically does fix it. I mean, huh?

Pathduck

@guigirl @hlehyaric

I've also found that calling chrome.runtime.reload(); in the UI-inspect devtools will (most of the time) trigger a reload of the browser and reregistration of the worker. And a lot of the time it will crash, depending... but the worker will usually be back.

I suspect calling that method is the same as triggering a "Reload App" or at least similar. It's brute force, and probably likely to fsck things up at some point so best avoided

guigirl

@pathduck said in YASWT.:

likely to fsck things up

Yes, did someone just call me?

guigirl

My eye was drawn to this by my usual infatuation with hhgttg coincidences:

& then once there, i read the last dozen or so posts. OMZ, it seems that the topic of SW is positively erupting all over the place atm!

hlehyaric

@guigirl There needed to be a new hot topic, we could not keep on with these crash cases for weeks…

Catweazle

I never need to unregister the serviceworkers. Since I use the marvelous Site Bleacher extension, I have only the serviceworkers (and other datas) active from the sites which I have whitelisted.

Pathduck

@guigirl said in YASWT.:

OMZ, it seems that the topic of SW is positively erupting all over the place atm!

I know, we need to get attention to this horrible plague!

Now, one might say that obsessing over SWs running is pointless, as individually they take little resources and are in some cases useful - some people actually like getting notifications when a site is closed (for some weird reason).

But when every bloody web developer thinks "hey using a SW would be great!" suddenly the browser is plagued with dozens of the things for no good reason. Each maybe running a small slice of CPU time, but these things accumulate.

Thing is, they are:

Rude - installing themselves without any way for the user to give consent - I mean, people talk about cookies and the GDPR, what about SWs and giving informed consent?
Abused by shady sites to serve malicious notifications looking like they come from the browser, leading users to malware/phishing sites.
Abused by web developers in general when there's no need for them.
Able to make websocket connections to the sender sites, telling it "here I am, I want notifications!"
Most likely a future vector for vulnerabilities.

Some docs to end this rant while I'm still able:

"Workers (as these background scripts are called herein) are relatively heavy-weight, and are not intended to be used in large numbers."
"Generally, workers are expected to be long-lived, have a high start-up performance cost, and a high per-instance memory cost."
https://html.spec.whatwg.org/multipage/workers.html#scope-2

"They are intended, among other things, to enable the creation of effective offline experiences, intercept network requests and take appropriate action based on whether the network is available, and update assets residing on the server. They will also allow access to push notifications and background sync APIs."
https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API

"During our research, we have found several ways attackers can leverage this API to enhance their low-to-medium risk findings into a powerful and meaningful attack. By abusing this API, an attacker can also leave his footprint in the victim's browser and potentially leak sensitive information."
https://www.akamai.com/blog/security/abusing-the-service-workers-api

https://arxiv.org/pdf/1810.00464.pdf

Gods, I hate the modern web, JS API hell, less and less control over the web experience for the user.

Google et al: "Web sites are apps, the browser is an OS"

hlehyaric

@pathduck said in YASWT.:

are in some cases usefuf

As we have just learned to our cost…

guigirl

Ya know, i truly am glad for this recent bout of SW discussion, coz it's illuminated something to me that until now i was misunderstanding. That is... i hate & deplore SWs, & was horrified at their very concept when i first learned of them X years back. However the part i've only now in this past 36 hours come to realise, is that i now know i'm not alone! For whatever reason i had this feeling that most peeps, & "the world" generally, thought that SW were a tremendous idea.... making me feel like i was some kind of loony for feeling the opposite.

In FF i love the fact i can completely disable them [done in my user.js], & afaict i have not lost out on any desirable website facilities because of that. Yet, by contrast, in V i've just been fuming for years that i was apparently powerless to stop them... & mystified that i might have been the only one who even felt that way.

Now however, following that eye-opening search i did on the forum, i discovered my silliness in having not realised many others also feel this way. Phew!

A Former User

@guigirl many thanks for sharing the info about FF's SW that I never dreamt I would find in V forum.

Anyways, kindly share how can I disable SW in firefox by user.js.