2024 Community Collab - we're pleased to announce yet another iteration of our annual collaborative mega-picture! Click here to check it out!

Userscripts / Customization

Sollace

I am the night!

StSyaN
It looks like I misremembered.

Security concerns for Stylish are well known, and documented

I’ve always known the firefox version of Tampermonkey to be untrustworthy, even back when I started. It ships with google analytics and I’m not even sure if it’s developed by the same people, so I avoid it to be safe.

Edit: And I don’t know about the state of Greasemonkey. iirc it stopped working for a bit and I switched away from it. Heard it got sold or something, which is exactly what caused the downfall of Stylish.

@Mildgyth
Chrome/Webkit versions should be fine. It’s really only the firefox addon you have to avoid.

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Sollace

I am the night!

Lé done. I have updated the install instructions for my userscript. I’ll repost them here as well so other people can see it.

Installation Instructions:

Before anything make sure you have installed Violentmonkey* for Firefox or Tampermonkey for Chrome, Opera, Safari or Edge

Additional Note:
Because derpibooru has a draconian CSP headers, firefox users are also going to need Laboratory by Mozilla

Install the addon and set it to use the following custom CSP for derpibooru:

screenshot

default-src ‘self’ https://derpicdn.net; font-src ‘self’ https://derpicdn.net; img-src ‘self’ data: https://camo.derpicdn.net https://derpicdn.net; script-src ‘self’ ‘unsafe-inline’ https://derpicdn.net; style-src ‘self’ ‘unsafe-inline’ self https://derpicdn.net

One final reminder:

Once configured, firefox users can remove the addon buttons from their toolbars and proceed to ignore its existance

After that simply click the download link to be prompted to install the script.

*Important Note: Do NOT use Greasemonkey. It’s dead, and the script may not work with it.

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Background Pony #D9B6

@byte[]
It is a pipe dream (unless you serve whole site as pre-rendered PNG or something). And this is a good thing, for variety of reasons, starting from simple personalization and ending with accessibility (I’m still surprised by amount of mobile sites that use user-scalable=no in <meta>. They’re shooting themselves in the foot).

StSyaN
THANK YOU! This is a godsend. None of my public scripts use <style> tag, only inline ones (Once I needed non-inline styles, but I distributed them as optional userstyle instead). So this is a good news to me.

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Ecstatis

StSyaN
I’m glad this issue has actually been addressed, but I’m having trouble getting the CSP to work, I’m still getting the same error printed to the console (inline (“default-src”)) whenever I add my own <style> tag. I noticed that the CSP in the screenshot is different from the one you posted, are you sure none of them might be wrong?

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Marker

Misanthrope

@Ecstatis
If you’re using Chrome, the original extension linked is a bit buggy, stopped working for everyone after a while. Try using this one instead, which disables CSP altogether so no configuration needed.

Posted 4 years ago Report

Link Quote Reply

stsyn

Moderator

@Ecstatis
Also if you are using Tampermonkey, you may use GM_addStyle, which bypasses CSP.

Posted 4 years ago Report

Link Quote Reply

Ecstatis

Oh sorry, I forgot to mention that I use both Firefox (Portable, up to date) and Violentmonkey though. I noticed that hovering over the CSP field shows a tiptool still saying “default-src ‘none’” for me - is that usual?

Should have tagged @Sollace instead

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Sollace

I am the night!

@Ecstatis
You have to enable the custom CSP and replace the content of the textbox with what I provided in the insturctions.

Sorry if It wasn’t entirely clear. (I did include a screenshot)

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Ecstatis

@Sollace
Thanks, it was clear enough for me. The problem is that it doesn’t work for me nontheless, though…

full

full

Any ideas?

Posted 4 years ago Report

Link Quote Reply

Marker

Misanthrope

@Ecstatis
I figured out what the problem was. The goddamn single quotes ’ got automatically replaced by smart quotes ’.
Just one of the reasons I hate them.

@Sollace
Try wrapping the custom CSP in “[== ]” like this
[bq][default-src ‘self’ https://derpicdn.net; font-src https://derpicdn.net; img-src data: https://camo.derpicdn.net https://derpicdn.net; script-src ‘unsafe-inline’ https://derpicdn.net; style-src ‘unsafe-inline’ https://derpicdn.net==][/bq]

Posted 4 years ago Report
Edited 4 years ago

Link Quote Reply

Marker

Misanthrope

There, just updated all my scripts so that Chrome users won’t need to install the Disable Content-Security-Policy extension. ~~Firefox users still need Laboratory by Mozilla though, unfortunately.~~ Not anymore.

Posted 4 years ago Report
Edited 4 years ago because: Add link

Link Quote Reply

Sollace

I am the night!

@Marker
Wrapped it. I don’t see any real difference. I assume the smart quotes is what caused it not to work?

Posted 4 years ago Report

Link Quote Reply

Sollace

I am the night!

@Marker
In my investigation of the issues with Violentmonkey is that they have an option to change how the script is applied to the page that gets around the csp restrictions.

If you’re not using css at all, you can try that to get your scripts working without the need for Laboratory.

Posted 4 years ago Report

Link Quote Reply

Marker

Misanthrope

@Sollace
Thanks, I’m aware of that, all of my scripts needs custom styling in one way or another. GM_addStyle is also required for the dumpster fire I use for saving user settings to work.

Posted 4 years ago Report

Link Quote Reply

Mildgyth

Senior Moderator

Humata, Hukhta, Hvarshta

@Sollace

How exactly?

Posted 4 years ago Report

Link Quote Reply

Sollace

I am the night!

@Mildgyth
In ViolentMonkey’s settings page, go to the settings tab and change “Default injection mode”. Also click Learn more about injection modes. to find out how script authors can define a mode from their scripts directly.

Posted 4 years ago Report

Link Quote Reply

Marker

Misanthrope

I somehow got my scripts to work on Firefox now. Adding @inject-into content seems to do the trick, which is weird because I wasn’t able to get them to run consistently with it before.

Posted 4 years ago Report

Link Quote Reply

Ecstatis

@Marker
That fixed it, thanks a lot!

@Sollace
I replaced Greasemonkey with Violentmonkey after seeing your post, and I’ve been liking it so far until I ran into problems with CSP restrictions and some page scripts seemingly breaking (on E621 e.g., I wasn’t able to open posts by clicking on them directly anymore - I had to do right-click and open in a new tab instead). Changing the injection mode fixed that for me as well though. Nice to see you can choose the injection mode for your scripts individually, that gives me some more possibilities as a web coder :)

Posted 4 years ago Report

Link Quote Reply

Sollace

I am the night!

Updated my post. If anyone’s having problems with spoiler images not loading, please try switching to the new CSP values in my post.

Posted 4 years ago Report

Link Quote Reply

Jarkes

GOKAAAAI... SILVER!

I recently switched back to Firefox and I’ve discovered that my old method of hiding certain links (mostly the threads dedicated to controversial subjects) is no long working in Stylish, and I can’t figure out how to fix it again.

Posted 4 years ago Report

Link Quote Reply

Jarkes

GOKAAAAI... SILVER!

Also, a proper “Glimmerbooru” that’s actually based off of her coat and mane would be nice.

Posted 4 years ago Report

Link Quote Reply

The Equestrian Zodiac

Witch Dagger!

So it seems that the script to display an image’s rating in prior to clicking on it is no longer working, which is kind of a shame, since it was a pretty nice script.

Posted 4 years ago Report

Link Quote Reply

Marker

Misanthrope

@Jarkes
Sounds to me like it may have been caused by the CSP.
I don’t use Stylish anymore after they came under fire for harvesting sensitive user data a while ago. And I’ve since switched to Stylus and can confirm the extension works with the site on Firefox.

@The Equestrian Zodiac
Do you have a link to the script?

Posted 4 years ago Report

Link Quote Reply

Jarkes

GOKAAAAI... SILVER!

@Marker

That worked, thanks!

Still wish I could make a Glimmerbooru based off of her color scheme, but I don’t actually know which color codes would match hers.

Posted 4 years ago Report

Link Quote Reply

Marker

Misanthrope

@Jarkes
Well… You could try just taking a color picker to a screenshot Starlight.

Posted 4 years ago Report

Link Quote Reply

Interested in advertising on Derpibooru? Click here for information!

Sky Railroad Merch Shop!

Help fund the $15 daily operational cost of Derpibooru - support us financially!