Issues in `vivaldi://serviceworker-internals`?

DavidON

In browsing through the entries in the latest Vivaldi Forums Digest, I came across the following sentence...

@Pathduck said in Vivaldi getting slower:
.

Look at vivaldi://serviceworker-internals and delete any you don't recognize.
.

"serviceworker-internals" was a new Vivaldi URL to me, so of course I had to check it out. Indeed there were a number of entries (please see attached) that I didn't recognise. I drilled in to them and learned exactly nothing (save that one of the .json's is an eye-popping 17mb).

I then unregistered the first two (no option available for the third).

Can anyone tell me...

Are they malicious?
What do they do? (Fingers crossed on the "DOES_NOT_EXIST" - but the scripts certainly do.)
what did I do that would have resuted in these being installed (right word?)?
Should I remove the last one? If so, how?

I'm running 2.7.1628.30 on Windows 8.1.

Many thanks,
David.

Pathduck

@DavidON To learn about Service Workers, have a look here:
https://en.wikipedia.org/wiki/Progressive_web_applications#Service_workers
https://developers.google.com/web/fundamentals/primers/service-workers (mostly for developers)

Quote:
"A service worker is a script that your browser runs in the background, separate from a web page, opening the door to features that don't need a web page or user interaction. Today, they already include features like push notifications and background sync. In the future, service workers might support other things like periodic sync or geofencing."

I don't like them, and feel I have no use for them, since I turn off notifications anyway. I don't need to get a pop-up telling me my Gmail account has a new email - or a site notifying me of a sale, even with the site closed...

As to your questions:

Are they malicious? I'm sure a lot of clever and security-minded people have worked on the service-workers spec, and generally I don't think users need to worry. But knowing also web developers tend to prefer new and shiny rather than proven safe I'm still sceptical. My main reason for disliking them is that they are unnecessary cruft I don't need.
https://chromium.googlesource.com/chromium/src/+/master/docs/security/service-worker-security-faq.md
What do they do? Hopefully this was answered in the first links.
what did I do that would have resulted in these being installed? It's enough to visit a site. You don't necessarily get a notification that a site wants to install them, which is also one of my major gripes with them.
Should I remove the last one? If so, how? You can just click Unregister to remove it, but it will probably return if you visit the site again. If you trust the site, and visit it often, it's probably not such a big deal.

To remove them you can either:

Delete Browser Data from the Vivaldi options, make sure Storage is chosen for purge.
Click Unregister from the serviceworker-internals page on each one.
Delete the content of the Service Worker directory of the Vivaldi profile while the browser is closed. (%LOCALAPPDATA%\Vivaldi\User Data\Default\Service Worker)

For example, I have now one from the tabloid Metro UK, which I visited once today to read about the Brexit debacle. This is the kind of stuff that pisses me off about them.

I really hope in the future there will be a way to either block them completely, or to white-list a set of domains where I would accept service-workers. There are extension which also allow you to either block them or clean them, but I don't know how well they work. You can also use the uMatrix extension to block them per-domain, but I find the extension too complex and overkill for my daily use. I use the Cookie Autodelete extension but it doesn't support clearing service-workers per domain (yet...)

DavidON

Great, answer, thanks, Pathduck!

As it happens, for privacy reasons, I delete most Browsing Data umpteen times a day, so I now see that they're all gone. (BTW, I didn't make it clear, but I only unregistered two of the three because the last one remaining had no Unregister option.)

Pretty horrifying that this is happening with minimal visibility. Previously, I was blacklisting sites on which I didn't want to run Javascript - I'm now trying whitelisting!

I see that Chrome has a setting to block these. Hopefully, it's high up on Vivaldi's to-do list.

Update: OK, blocking JavaScript and whitelisting sites was wildly optimistic - just too many sites need it!

Many thanks,
David.

Pathduck

@DavidON Yes, in the Brave New World of Web 2.0 trying to block JavaScript will be an exercise in frustration, too much stuff will simply break. The same with cookies really, too many sites will simply refuse to let you use it, or even read articles, without accepting cookies first. So instead I find it easier to use the extension to delete them after tab close, and basically the same goal is achieved.

If you clear browser data several times a day, you needn't worry about service-workers I think.

Also, where is the setting in Chrome that allows to block service-workers? Does it work per-domain or do you disable them globally? Vivaldi has most of the same options as Chrome, but I've tried to search all the Chrome settings pages but didn't find any.

maxoku

@DavidON @Pathduck Maybe there is an add-on that automatically removes not whitelisted service-workers? Like cookie auto-delete that removes them after closing tab with them. Thanks to that pages still work when visited, but nothing is stored and hopefully working in the background. Unfortunately Cookie Auto-delete add-on deletes all of them even if sites are whitelisted.

Pathduck

@maxoku Cookie Autodelete definitely works with whitelisting SWs per site. This forum has one and if I set it to keep SW it will stay

maxoku

@pathduck I don't know, I use it and it allowed few not whitelisted domains. There is an option to clear service workers, but it clears also whitelisted. So I don't know.

Pathduck

@maxoku The whitelist open is "Keep Service Workers"

In my case I want to clear all SWs so default option is unchecked.

maxoku

@pathduck I meant this in the settings, not whitelist:

If you want to clear all SW then use it, it bypass the setting to keep them in whitelist.

As it generally works, it still allowed some not whitelisted service workers to be around, so it's not 100% bulletproof I think.

Pathduck

@maxoku

If you want to clear all SW then use it, it bypass the setting to keep them in whitelist.

No - that option just enables the cleaning of Service Workers. If unchecked, SW cleanup will not function at all.

As it generally works, it still allowed some not whitelisted service workers to be around, so it's not 100% bulletproof I think.

If there are issues with some service workers not being cleaned you should report it to the developer:
https://github.com/Cookie-AutoDelete/Cookie-AutoDelete/issues

maxoku

@pathduck No, when I enabled this option all my working services were cleared regardless of the whitelist.

Edit: Well, I've checked it again and seems that you're right. All settings should be checked if wants them to be auto-deleted. It just clears all the data once when being enabled.