fix(bearblocker): stage lists from settings/filter-lists — #105 pointed at the wrong dir - #131
Merged
Merged
Conversation
Michael: 'zero trust dude we don't trust mozilla, we review the upstream and
harden where possible too.' He is right and my earlier framing was still too
trusting: a valid signature proves only that MOZILLA SIGNED IT, not that the
content is benign. A compelled or compromised upstream ships signed records.
review.mjs reads what we are about to serve and FAILS CLOSED on: a collection
with no signature, a URL in signed content the collection has no business
carrying, active-content markers (javascript:/<script/eval(), a new or vanished
collection, or a >25% swing in record count — the shape a poisoned security list
would take. A SHA256 baseline makes silent drift in already-vouched-for data
visible on the next run.
Made it collection-aware after the first pass produced noise — blunt rules get
ignored, which is worse than no rule. ct-logs IS a list of log endpoints,
intermediates embeds CPS URIs in certificate data, plugins/addons rows carry a
user-facing 'why was this blocked' link. Those are inventoried; everywhere else a
URL is a finding. (Same false-positive trap as calling plugins=5 a leak earlier —
verify what upstream legitimately contains before alarming.)
REAL findings from the first review of Mozilla PROD data:
- Mozilla ships PLACEHOLDER urls in production CT data:
https://ct.example.com/bogus/ and .../bogus/ipng/
- plugin-blocklist rows carry CLEARTEXT http:// advisory links (oracle,
adobe, microsoft, divx, mozilla blog)
Neither is fetched in normal operation, but we now SEE them instead of assuming,
and the baseline diff surfaces the next change automatically.
…ed at the wrong dir The package gate earned itself on its first real run. It failed the ubuntu nightly with: 🔴 bearblocker-ads.txt MISSING — the ad/tracker blocker will load NOTHING PACKAGE VERIFICATION FAILED — do not ship this build. My #105 'fix' for the dead ad-blocker DID NOT WORK. I pointed stage-bearnet.sh at settings/bearblocker/, which holds only the actor .mjs files. The filter lists live in settings/filter-lists/ — which patches.py has always known (_lists_src = Path('../settings/filter-lists')). I misread a two-command AGENTS.md BRANCH_TRIAGE.tsv Brewfile LICENSE README.md SECURITY.md TRUST_SURFACE.yaml agent-sidecar agentplane automation branding build capture-sidecar ci credential-broker deploy docs examples flake.nix gecko-patches install.sh iot-sidecar lib manifests mounts mozconfig native node_modules package-lock.json package.json packaging patches policy profiles prophet-workspace runtime schemas scripts settings when writing #105 and never verified the staging actually produced files. So the browser would have shipped its headline ad/tracker blocker with ZERO rules for a SECOND time, and the only reason it didn't is the gate. Fixed and TESTED this time, not assumed: stage-bearnet: bearblocker lists → (2 files) bearblocker-ads.txt: 229 rules bearblocker-privacy.txt: 254 rules gate: 🔴 MISSING -> ✅ staged (229 rules) / ✅ staged (254 rules) Fourth time today that executing instead of parse-checking found the real defect. That is the lesson of this session, and this commit is the proof it was worth building the gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gate earned itself on its first real run. It failed the ubuntu nightly with:
My #105 "fix" did not work
I pointed
stage-bearnet.shatsettings/bearblocker/— which holds only the actor.mjsfiles. The filter lists live insettings/filter-lists/, whichpatches.pyhas always known (_lists_src = Path('../settings/filter-lists')). I misread a two-commandlswhen writing #105 and never verified the staging produced any files.The browser would have shipped its headline ad/tracker blocker with zero rules for a second time. The only thing that stopped it was the gate.
Fixed and tested — not assumed
Fourth time today that executing instead of parse-checking found the real defect. This commit is the proof the gate was worth building.