expose existing browser commands through the configurable keyboard
shortcuts page without assigning new default accelerators:
- Duplicate tab
- Exit
- Move active tab to new window
- Open new tab to the right
- Close tabs to the right
- Close other tabs
- Pin or unpin active tab
- Show as tab
- Open active tab in its PWA window
- Open web app settings
- Show web app information
- Create application shortcut
- Install PWA
- Route media
- Mute or unmute current site
- Create QR code
- Take screenshot
- Show full URLs
- Empty cache and hard reload
- Import settings
- Manage extensions
- Inspect devices
- Open browser management page
- Open performance settings
- Switch to Classic layout
- Switch to Compact layout
- Switch to Vertical layout
- Open Settings
Fixes#335Fixes#1467Fixes#1527Fixes#1528Fixes#1837Fixes#1975Fixes#2246Fixesimputnet/helium-windows#329
Related: #1711
- define the transport-neutral read interface used to retrieve objects
from providers
- implement the browser side of the protocol
- fetch state chunks only after accepting the head, enforce limits, then
decrypt and assemble the sync state
- provide lightweight setup verification and revision-based refreshes
- drop ungoogled's doh-changes patch
- add google DNS to list of options
- add 1.1.1.2 and 1.1.1.3 to list of options
- add nextdns to global list of options
- remove cleanbrowsing from options
- remove a weird EU dns provider from options in EU
- remove opendns from options
- removes option shuffling for sake of grouped ordering (there are 3
cloudflare options)
this feature splits outgoing TLS ClientHello messages across TLS records
at a randomized boundary. it targets the visible server name, or the
encrypted_client_hello extension when ECH is used.
this can help bypass domain-based DPI filtering that expects these
fields in a single TLS record. it does not hide DNS queries or
destination IP addresses, and produces unusual, recognizable TLS
traffic.
some middleboxes and TLS endpoints mishandle ClientHello messages
fragmented across records, even though the TLS spec explicitly permits
this. this is known to affect vercel-hosted sites, which may be
unavailable while this feature is enabled.
derive a vault-specific 256bit object key from the vault key and UUID
using HKDF-SHA256. encrypt with AES-256-GCM-SIV, authenticate the vault
UUID and object role as associated data.
enforce the role-specific plaintext limits defined by the vault format
before encryption and decryption. reject invalid or oversized objects
related: #90
helium/core/sync/vault: define the private vault format
sync state is represented as encrypted objects in some general object
store.
remote: descriptor
head -> latest journal record -> state chunks
|
v
parent journal record -> state chunks
|
v
...
local: checkpoint -> last accepted generation + journal record
- vault: one sync dataset + UUID + encryption key
browsers that select the same vault synchronize with eachother
the object store sees only the vault's encrypted objects
- descriptor: immutable identity record containing the vault UUID and
creation time
- head: small mutable record pointing to vault's latest complete state
- generation: monotonically increasing commit number, establishes
ordering. 0 = empty vault with no records, each published
state increments the generation by one
- journal: vault's (linked) ordered history of committed browser states
- journal record: some state snapshot for some generation, naming its
encrypted chunks needed to reconstruct that
generation's complete state, and its parent to link
its history
- state chunk: immutable encrypted object containing part of a
generation's serialized sync state
- checkpoint: locally protected identity of the last accepted head:
vault UUID + generation + journal record ID + epoch
- epoch: bounded section of journal history used to allow compaction of
history and collection of old immutable objects
writers upload state chunks and journal records and first, then
atomically replace the head to publish the completed generation, so
readers discover the latest state without observing a partially
uploaded generation.
related: #90
may be useful for bypassing some network restrictions
`Alt-Svc: h3` is not upgraded to QUIC v2 when v2 is forced due to a bug
in chromium which needs to be handled in a separate patch and PR
- allow the sync engine to use a custom backend instead of the
google/gaia backed one, disable google backend
- support account-independent backend selection
- limit custom backend types to known-supported data types and filter
user preferences accordingly
related: #90
- rename the "Security" page to "Network and security" and reorganize it
into "Network", "Privacy signals", and "Security" sections
- improve HTTPS-only mode option labels
- move the DNT toggle from third-party cookie settings into "Privacy
signals" and clarify its description
- add a GPC toggle to "Privacy signals"
- remove the DNT confirmation dialog and add explanatory text to the
"Privacy signals" section header
- move "Network" and security above "Site settings"
we don't care about google ai mode for which the webui omnibox was made.
no clue why it's even in chromium instead of chrome, along with tons of
other trash.
it was enabled in latest patch via https://crrev.com/c/8176782
chromium's clipping bounds assumed vertical tabs were always on the
left, causing side panel contents to be clipped when tabs were
right-aligned.
fixes#2247
wukko