MX Linux Forum

Posted: **Thu Nov 09, 2017 1:45 pm**

We now have an update of the popular Pale Moon browser in the main repository. 27.6.0, a major development update, has a long list of changes, which can be viewed here: https://github.com/MoonchildProductions ... n/releases

Pale Moon offers you a browsing experience in a browser completely built from its own, independently developed source that has been forked off from Firefox/Mozilla code a number of years ago, with carefully selected features and optimizations to improve the browser's stability and user experience, while offering full customization and a growing collection of extensions and themes to make the browser truly your own

Posted: **Thu Nov 30, 2017 3:29 pm**

Minor security/bugfix update 27.6.2 is now in the main repository:

Changes/fixes:

Implemented the concept of so-called "cookie-averse document objects" which is a security&privacy measure that blocks certain web content from setting cookies. This mitigates cookie-injection, which might help against "hidden" cookie tracking.
Mitigated some domain name spoofing through IDN by using dotless-i and dotless-j with accents. (CVE-2017-7832)
Pale Moon will display these kinds of spoofed domains in punycode now in the actual address bar.
Please note that the identity panel will always be able to help you on secure sites when IDNs are in use to notice potential spoofing, as opposed to relying on detection algorithms in the URL itself. As such, some other issues like CVE-2017-7833 are already mitigated by us.
Fixed an issue with mixed-content blocking. (CVE-2017-7835)
Added an extra check for the correct signature data type on certificates.
Added missing sanitization in exporting bookmarks to HTML. (CVE-2017-7840)
Fixed several crashes and memory safety hazards.

Posted: **Wed Jan 17, 2018 2:47 pm**

Pale Moon 27.7.0 has landed in the main repository. The release notes for this update can be viewed here.

As a side note, I'm also looking for anyone with a 64-bit Ubuntu 17.10 system to test an experimental gcc-6 version, which is the first version I've been able to build for that release on the openSUSE Build Service. Currently it's sitting in the system, but not published, since Pale Moon developers are wary of any builds done on anything except gcc-4.9.

The zip of the Ubuntu deb is here: https://drive.google.com/open?id=1k0PhN ... Iw2Xw9sc5M

Posted: **Fri Jan 19, 2018 1:08 pm**

Pale Moon 27.7.1 has now landed in the main repository.

This is a minor emergency update to address website breakage and a theme issue (theme issue Windows only).

Changes/fixes:

Added support for Array.prototype[@@unscopables].
Unfortunately, the addition of Javascript's ES6 Unscopables in 27.7.0 was incomplete, which caused a number of websites (e.g. Chase on-line banking, some Russian government sites) to display blank or not complete loading after updating to that version of the browser. This update should fix the problem by adding the missing part of the feature.

Posted: **Fri Feb 02, 2018 1:41 pm**

Pale Moon 27.7.2 has landed in the main repository. Notably it further "fuzzes" the timer resolution to defeat any Spectre attacks.

- Changed the X-Content-Type-Options: nosniff behavior to only check
"success" class server responses, for web compatibility reasons.
- Changed the perfomance timer resolution once more to a granularity of
1 ms, after evaluating more potential ways of abusing Spectre. This
takes the most cautious approach possible lacking more information
(because apparently NDAs have been signed over this between mainstream
players), follows Safari's lead, and should make it not just infeasible
but downright impossible to use these timers for nefarious purposes in
this context.
- Improved the debug-only startup cache wrapper to prevent a rare crash.
- Fixed a crash in the XML parser.
- Added a check for integer overflow in AesTask::DoCrypto()
(CVE-2018-5122) DiD
- Fixed a potential race condition in the browser cache.
- Fixed a crash in HTML media elements (CVE-2018-5102)
- Fixed a crash in XHR using workers.
- Fixed a crash with some uncommon FTP operations.
- Fixed a potential race condition in the JAR library.

Posted: **Wed Feb 21, 2018 6:13 pm**

I've since found out that the builds on Ubuntu 17.10 and Debian testing against gcc-4.9 were failing because of a bug in libc6 2.26. I tried again today and was successful on Buster because of a fixed libc6 that has rolled into testing, but 17.10 is stuck with the bugged version. So I'm going to add Buster builds of palemoon and palemoon-nonsse2 to my main Pale Moon OBS repo, as well as offer the palemoon-repackbinaries version to all users, just in case they prefer that one.

Relevance: antiX that uses the Buster repos.

Posted: **Sat Feb 24, 2018 11:05 am**

@all:

One general question: Would you consider saving login passwords in Pale Moon to be "safe"?

Greetings, and thanks in advance for your answers, Joe

Posted: **Sat Feb 24, 2018 4:25 pm**

MX-16_fan wrote:@all:

One general question: Would you consider saving login passwords in Pale Moon to be "safe"?

Greetings, and thanks in advance for your answers, Joe

Not if someone gets access to your browser for a minute so they can look at them; that's the same as in Firefox. Using a "password safe" solution is going to be more secure.

Posted: **Sun Feb 25, 2018 6:00 am**

@Stevo:

Stevo wrote:
MX-16_fan wrote:@all:

One general question: Would you consider saving login passwords in Pale Moon to be "safe"?

Greetings, and thanks in advance for your answers, Joe
Not if someone gets access to your browser for a minute so they can look at them; that's the same as in Firefox. Using a "password safe" solution is going to be more secure.

What if nobody got access to the computer running, but to the HDD (e.g. by stealing the computer)?

Greetings, Joe

Posted: **Sun Feb 25, 2018 5:57 pm**

OK, I did a little research, and Pale Moon, like Firefox, has the option to add a Master password before anyone can access your stored password. So no passerby or thief can access them. They are encrypted either way in your profile, but the Master password keeps others out.

Posted: **Mon Feb 26, 2018 8:14 am**

@Stevo:

Stevo wrote:OK, I did a little research, and Pale Moon, like Firefox, has the option to add a Master password before anyone can access your stored password. So no passerby or thief can access them. They are encrypted either way in your profile, but the Master password keeps others out.

Thanks a lot!

So unless someone gets physical access to your running machine, Pale Moon saves your passwords in a "safe" fashion even if you don't use a Master password. Correct?

Greetings, and have a good week, Joe

Posted: **Mon Feb 26, 2018 2:00 pm**

So unless someone gets physical access to your running machine, Pale Moon saves your passwords in a "safe" fashion even if you don't use a Master password. Correct?

That's what I get from reading the FAQs. That only makes sense, and I would assume every browser that can save passwords does the same thing.

Posted: **Mon Feb 26, 2018 2:24 pm**

@Stevo:

Stevo wrote:
So unless someone gets physical access to your running machine, Pale Moon saves your passwords in a "safe" fashion even if you don't use a Master password. Correct?
That's what I get from reading the FAQs. That only makes sense, and I would assume every browser that can save passwords does the same thing.

Every good browser

. Thanks, and greetings, Joe

Posted: **Sun Mar 04, 2018 4:15 pm**

Pale Moon 27.8.0 is now in the main repository.

This is a development update with new and improved features and bugfixes.

Changes/fixes:

Added support for emojis on Windows systems that have relatively poor support for them with standard font sets by including our own font (EmojiOne based for now).
Added a setting in preferences to select the use of tab previews with Ctrl+Tab.
Added Eyedropper menu entry to the AppMenu.
Added a preference to control whether the text cursor (caret) should be thicker when dealing with CJK characters or not (default = yes).
Added URL fix-ups for schemes (mis-typed "ttp://" etc.).
Added support for ES6 "Symbol species".
Updated our TLS 1.3 support to the latest (probably final) draft.
Fixed gap inconsistency in the tabstrip.
Fixed a number of browser crashes.
Fixed a crash with the exponentiation operator "**"
Set the performance timer granularity to 1 ms.
Updated the kiss-fft library to our forked 1.4.0 version.
Disabled a potentially problematic optimization on Win 8+ with high contrast themes in use.
Removed the notification bar when in full screen to prevent unwanted visible screen elements.
Removed unmaintained and insecure WebRTC code - building with WebRTC enabled is no longer an option.
Removed redundant checks for "Vista or later" since that is all we support.
Added display of the http status to raw request displays.
Added a workaround for cloned videos not retaining their muted state.
Added a temporary workaround to avoid crashes on trackless media.
Removed some superfluous ellipses from menu labels.
Fixed undesired shrinking of line heights as a result of setting minimum font size in preferences.
Fixed some issues with setting the new tab preference (regression).

Posted: **Mon Mar 05, 2018 12:37 am**

Thanks Stevo. 27.8 Installed and no problems (yet) looks like many of the fixes were Win related. Certainly no issues with MX. Overall, am very happy to have abandoned Firefox, PM does all the browsing I need, and without any of the FF issues that forum members keep reporting.

Gordon.

Posted: **Mon Mar 19, 2018 10:10 pm**

@Stevo:

MX-16_fan wrote:@Stevo:

Stevo wrote:
So unless someone gets physical access to your running machine, Pale Moon saves your passwords in a "safe" fashion even if you don't use a Master password. Correct?
That's what I get from reading the FAQs. That only makes sense, and I would assume every browser that can save passwords does the same thing.
Every good browser . Thanks, and greetings, Joe

PS Just happened to find an old discussion here: https://forum.palemoon.org/viewtopic.php?p=14888#p14888, where the Pale Moon chief says: "Passwords in Pale Moon are secure, provided you are using a strong Master Password (that's not easy to guess)." Any idea what he could mean by that? Really the "thief" scenario only? Or does that relate to Pale Moon Sync also? Greetings, Joe

Posted: **Mon Mar 19, 2018 10:40 pm**

@all:

Just found a great workaround for the problem of missing search plugins for localized Wikipedia sites (i.e. other than EN).

I installed Malte Kraus' "Add to Search Bar" Add-on from http://addons.palemoon.org/addon/add-to-search-bar/ and followed the instructions given here: https://firefox.maltekraus.de/extension ... search-bar.

Now I can easily search whatever language's Wikipedia I like (and a gazillion of other sites).

I guess this might be helpful for some of you.

What a cool add-on!

Greetings, Joe

Posted: **Mon Mar 19, 2018 10:54 pm**

Any password should be resistant to brute force attacks, regardless whether a bad guy gets access to your hardware or not. What a strong password means is easily found via web searches.

Posted: **Tue Mar 20, 2018 9:09 am**

@Stevo:

Stevo wrote:Any password should be resistant to brute force attacks, regardless whether a bad guy gets access to your hardware or not. What a strong password means is easily found via web searches.

But not using a Master Password at all does not mean that

a) the Pale Moon Sync server gets your data in plain, nor that
b) Pale Moon locally saves your login data in plain.

Correct?

Greetings, Joe

Posted: **Tue Mar 20, 2018 10:43 am**

MX-16_fan -

>Master Password and passwords

I remember researching this several years ago. (I realize we are discussing Pale Moon ...) Back in the day, one needed a master password to encrypt the passwords. This is from 2009:

https://luxsci.com/blog/master-password ... rbird.html

Mozilla's page about the Master Password, updated in 2018:

http://kb.mozillazine.org/Master_password

Pale Moon forum entry by Moonchild (developer of Pale Moon), dated 2016:

https://forum.palemoon.org/viewtopic.ph ... ted#p81494

A very recent discussion about the Master Password on the Pale Moon forums (note Moonchild has included a link to a bug report and the bug report contains a link to Mozilla's bug report):

https://forum.palemoon.org/viewtopic.php?f=4&t=18643

Posted: **Tue Mar 20, 2018 11:54 am**

@vksan:

vksan wrote:MX-16_fan -

>Master Password and passwords

I remember researching this several years ago. (I realize we are discussing Pale Moon ...) Back in the day, one needed a master password to encrypt the passwords. This is from 2009:

https://luxsci.com/blog/master-password ... rbird.html

Mozilla's page about the Master Password, updated in 2018:

http://kb.mozillazine.org/Master_password

Pale Moon forum entry by Moonchild (developer of Pale Moon), dated 2016:

https://forum.palemoon.org/viewtopic.ph ... ted#p81494

A very recent discussion about the Master Password on the Pale Moon forums (note Moonchild has included a link to a bug report and the bug report contains a link to Mozilla's bug report):

https://forum.palemoon.org/viewtopic.php?f=4&t=18643

Thanks! What's the bottom line of all this? Greetings, Joe

Posted: **Fri Mar 23, 2018 2:18 pm**

Pale Moon has been updated to 27.8.2 in the main repository. This is a security update.

Changes/fixes:

Privacy fix: prevented update checks for the default theme.
Added a user-agent override for Dropbox to improve compatibility with their service.
Fixed an issue with mouseover handling related to (CVE-2018-5103). DiD
Disabled the Mac OSX Nano allocator. DiD
Fixed (CVE-2018-5129) OOB Write.
Updated the lz4 library to 1.8.0 to solve potential issues. DiD
Fixed (CVE-2018-5137) Path traversal on chrome:// URLs
Fixed several memory safety an synchronicity hazards.

DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Posted: **Tue Apr 17, 2018 9:36 pm**

The new 27.9.0 release has now landed in the main repository! Changes are:

* New release:
- Fixed a number of spec compliance issues in our media subsystem.
- Added a trailing slash to referrers when policy is set to fix some web
compatibility issues.
- Fixed the property order in Object.getOwnPropertyNames(string) and others
for web compatibility.
- Updated RegExp(RegExp object, flags) to the ES6 standard specification.
- Changed the embedded font from the no longer free EmojiOne to the
open-licensed Twemoji (with additional fixes). This also further extends
unicode support to Unicode 10 emoji(s). Please note that as a result, color
emoji(s) will look different than before.
- Adjusted some things in our memory allocator code to provide, among other
things, better allocation alignment on Windows.
- Made the attempt to migrate people from the old sync server domain name to
the current one more aggressive. We will be retiring the old
pmsync.palemoon.net Sync server address shortly to remove the need for us
to maintain a security certificate for it; this preference migration should
automatically put everyone on the correct server address when upgrading.
- Made reading of the sessionstore synchronous, to speed up startup and
prevent the homepage from being loaded when restoring a session.
- Added a fix to switch to the correct window/tab when a web notification
is clicked.
- Changed the placeholder text to not include "Search" when all search
functions from the address bar are disabled.
- Enabled the use of Skia for canvas on Linux and OSX.
- Worked around a potential cause for some non-standard bitmapped fonts
ending up with incorrect line heights (I'm looking at you, Noto fonts!).
- Added a workaround for incorrectly-encoded JPEG-XR images with planar
alpha. Ultimately, the jxrlib reference implementation should be fixed to
encode according to spec.
- Aligned XCTO:nosniff allowed script MIME types with the updated spec.
- Improved the logic for storing vector images in the surface cache.
- Fixed character set handling for XMLHttpRequests.

Posted: **Tue Apr 17, 2018 11:26 pm**

27.9 has not appeared yet on the UT repo. Not to worry, will try again tomorrow.

Edit: 'Tis now tomorrow and have got 27.9. Thanks.

Posted: **Tue May 08, 2018 6:57 pm**

Updated to 27.9.1 in the main repo.

* New upstream maintenance update:
- Removed the unused/incomplete places protocol handler.
- Worked around an issue with MSE media without a Track ID. This should help
with the playability of some live streams.
- Ported across jemalloc improvements from UXP.
- Ported across cairo mutex improvements from UXP.
- Added support for FFmpeg 4.0/libavcodec 58.
- Added a fix for Windows 10's "isAlpha()" not being what one would expect
in v1803.

Posted: **Wed May 09, 2018 8:18 pm**

Stevo wrote:Updated to 27.9.1 in the main repo.

On mx17.1 and antiX17.1 I do get for upgrade/install palemoon:i386

Code: Select all

The following packages have unmet dependencies:
 palemoon : Depends: libfontconfig1 (>= 2.12.6) but 2.11.0-6.7+b1 is to be installed

I did send another post probably within the wrong thread about this issues
here: viewtopic.php?f=57&t=39874&start=930#p446504

Posted: **Wed May 09, 2018 9:09 pm**

Am running 27.9.1 on 64 bit system with all dependencies met. Uses libfontconfig1 2.13.0.4-MX17+1

Posted: **Wed May 09, 2018 10:49 pm**

I just sent up the fixed MX 17 i386 version of PM, but you can get it early here: Edit, incorrect versioning...will get the correct version up in an hour or so.

Posted: **Thu May 10, 2018 7:10 am**

stevo - the new deb is labelled mx15.

Posted: **Thu May 10, 2018 8:17 am**

Hi guys, not a lot of time todyay, so just a quick note (yeah right, right?)

Remember that weird, possibly screensaver related issue I mentinoed awhile ago ... the one that triggers a funky looking desktop with a huge 150px+ border around everything and missing window decorations ... a problem which corrects itself inexplicably after a little while ... ???

PALEMOON is the culprit. If my system runs stable without any hitches for a few days, while using nothing but FF and keeping it open (minimized) on the screen, followed by then opening Palemoon .... bamm, that weird crash thingie whatever it is, occurs. I can duplicate it without a problem and there does appear an x-screensaver message of sorts with 2 errors on the screen. As stated, I can duplicate this and so far only palemoon has been able to cause this on my machine. I took photos of the screen, just don't have time to upload them today.

No, please don't advise not to use a screensaver. If any fix on MX requires the lack of using a screensaver ... then screensavers should be removed from MX. That would be the correct solution, instead of implying that something which is used by countless millions of people, should not be used anymore. I'll be back tomorrow to post those photos. Screenshots of the full problem are impossible because every time that the mouse is clicked or a keyboard key tapped, the screen changes again ... eventually returning to normal. Happy Fathersday for all of you Dads out there (in Germany) !!!

Posted: **Thu May 10, 2018 8:31 am**

If any fix on MX requires the lack of using a screensaver

Seems to me it is a fix required on Palemoon, not MX, since as you asserted it only occurs with Palemoon.

Posted: **Thu May 10, 2018 3:25 pm**

anticapitalista wrote:stevo - the new deb is labelled mx15.

Curses! Rebuilding now.

Posted: **Fri May 11, 2018 2:44 pm**

Stevo wrote:
anticapitalista wrote:stevo - the new deb is labelled mx15.
Curses! Rebuilding now.

Has the new deb been uploaded to the repo?

Posted: **Fri May 11, 2018 2:53 pm**

I don't see it there...maybe I will have to build a 64-bit version to match it. Let me check with Tim.

Posted: **Fri May 11, 2018 5:41 pm**

OK, just uploaded the rebuilt packages: https://drive.google.com/open?id=1yluAA ... sePi-ZrC11

Posted: **Fri May 11, 2018 6:21 pm**

Works great in MX/antiX 32/64! Thanks! ur

Posted: **Fri May 11, 2018 6:47 pm**

Have I missed something? Been using PaleMoon 27.9.1 for several days without any problems.

Posted: **Fri May 11, 2018 6:50 pm**

Gordon Cooper wrote:Have I missed something? Been using PaleMoon 27.9.1 for several days without any problems.

Yep, the 32bit version did had a unfortunate dependencies issue within the deb. Fixed now by Stevo!
And by this he had to rebuild the 64bit version also!

Posted: **Fri May 11, 2018 7:01 pm**

Thanks fehlix, am using the 64 bit and was wondering what might be wrong with it. Now I know.

Posted: **Sat May 12, 2018 7:13 am**

Hello,
FI: I have just tried palemoon 27.9.1 today, and I think that it will be my web browser by default ... I like it, small and efficient right now.

Posted: **Sat May 12, 2018 2:00 pm**

I did the same today, too, coming to the same conclusion, and I uninstalled Firefox. Palemoon seemed less resourceful (about 80-100mb less than Firefox) and slightly more responsive, while remaining sufficiently complete to cover all the needs of an average user. In addition it is frequently updated and, which does not hurt, even with a nice appearance.

Posted: **Sun May 13, 2018 4:08 am**

PaleMoon 27.9.1 (64) told me yesterday "NoScript is known to cause security or stability issues"
see http://blocklist.palemoon.org/info/?id=pm112

Severity level 1: You will be warned and recommended to disable this extension, but can continue to use it if you so wish after confirmation.

Using Palemoon since years, first time they told me to disable something, hmh ...

Posted: **Sun May 13, 2018 5:42 am**

Kulmbacher wrote: Sun May 13, 2018 4:08 am PaleMoon 27.9.1 (64) told me yesterday "NoScript is known to cause security or stability issues"

You can disable the extension blocklist in about:config.
However, be warned: At the Pale Moon forums the developer says that you absolutely shouldn't do that for security reasons.
I have done it because the warning kept popping up, and I don't want to go without NoScript.

Posted: **Sun May 13, 2018 5:46 am**

well :
https://sysdfree.wordpress.com/2018/05/11/169/ & https://sysdfree.wordpress.com/2018/05/12/214/

same for me, issue with noscript extension so I disabled > extensions.blocklist.enabled;false
(i know I know, but I'll take the risk)

Posted: **Sun May 13, 2018 8:48 am**

It appears rather a stability issue, than a security issue.
From palemoon web-site
http://blocklist.palemoon.org/info/?id=pm112

This is a Pale Moon specific blocklist entry.
Additional information:
NoScript is known to cause severe issues with a large (and growing) number of websites and stability issues in the browser itself, negatively influencing otherwise unrelated browser features.
It has known interop issues with Pale Moon and if you use this extension, it should be replaced with alternatives for a smooth and hassle-free browsing experience.

We cannot provide browser support as long as this extension is installed, due to the far-reaching issues in the browser. Use at your own peril.

Severity level 1: You will be warned and recommended to disable this extension, but can continue to use it if you so wish after confirmation.

Posted: **Sun May 13, 2018 9:15 am**

I have seen absolutely no severe issues using PM and NS for the year or so I've been using them.
NoScript will obviously "break" pages that use scripts, that's what it's meant to do.
I fully understand not wanting to constantly give support when people don't know how to use NS, but I don't get labeling it as a security and stability issue.
Am I missing something?

Posted: **Sun May 13, 2018 10:51 am**

Redacted wrote: Sun May 13, 2018 9:15 am ...Am I missing something?...

The palemoon guys are concerned about stability, that seems to be their man issue, IMHO.
I've long time ago switched from noscript to umatrix with palemoon (and all my other browsers I run),
which is still available for palemoon. I do feel it's superiour to noscript,
but you'll need first understand the concept of umatrix a bit as you can
fintune on resoucrece level of a web-site to build filter-rules, but YMMV.

Posted: **Sun May 13, 2018 12:16 pm**

fehlix wrote: Sun May 13, 2018 10:51 am I've long time ago switched from noscript to umatrix with palemoon (and all my other browsers I run),
which is still available for palemoon. I do feel it's superiour to noscript...

Thanks for the thoughts, fehlix. I know there's a steep learning curve, but I do need to look into it.

Posted: **Mon May 14, 2018 4:23 am**

linwinux wrote: Thu May 10, 2018 8:17 am Hi guys, not a lot of time todyay, so just a quick note (yeah right, right?)

PALEMOON is the culprit. If my system runs stable without any hitches for a few days, while using nothing but FF and keeping it open (minimized) on the screen, followed by then opening Palemoon .... bamm, that weird crash thingie whatever it is, occurs. I can duplicate it without a problem and there does appear an x-screensaver message of sorts with 2 errors on the screen. As stated, I can duplicate this and so far only palemoon has been able to cause this on my machine. I took photos of the screen, just don't have time to upload them today.

No, please don't advise not to use a screensaver. If any fix on MX requires the lack of using a screensaver ... then screensavers should be removed from MX. That would be the correct solution, instead of implying that something which is used by countless millions of people, should not be used anymore. I'll be back tomorrow to post those photos. Screenshots of the full problem are impossible because every time that the mouse is clicked or a keyboard key tapped, the screen changes again ... eventually returning to normal. Happy Fathersday for all of you Dads out there (in Germany) !!!

Alright, that's it, no more Palemoon for me. For the past 3 days I had my screensaver completely disabled, not even using a black screen ... just no screensaver at all ... rebooted the system too ... and since then I've had this weird screen problem occur twice on me in the past 3 days. There'S no doubt in my mind that there's something weird going on with Palemoon. I've had this happen on a fairly new 6 core AMD machine, and I've also had this happen on a 10 year old Acer dual-core laptop. The only thing that's triggered this weird screen issue, was clicking on the Palemoon symbol in order to use the Palemoon browser. On the Acer there was no other browser open at the same time, and on my newer 6 core AMD setup I had FF already open, but minimized. The only common denominator that I can find with this issue, is starting palemoon ...

.

screenrage04.jpg

screenrage03.jpg

screenrage02.jpg

screenrage01.jpg

Posted: **Mon May 14, 2018 4:28 am**

Hmm, something odd is going on with the forum attachments too. I tried attaching 4 images. The largest one was 209KB which by todays Gigabyte/Terabyte HDD standards is already itty bitty teeny tine. Two of the other images were below 200KB. After a couple of minutes, three of the images were repalced with ... no longer available ... messages. Larger images which show the entire problem on a screen are really difficult to save in lower size without losing quite a bit of image quality and many if not most people don't even know how to compress an image that small. 400KB would be really nice to have ... 10 images only being 4MB in size ...

.

Posted: **Mon May 14, 2018 4:30 am**

I cannot off the bat remember the forum limits but you can also try uploading them to an external host, that will likely sort this out for now.

Posted: **Mon May 14, 2018 4:44 am**

Ah.. went on a search and found this:

The maximum file size for attachments is 256K for both private and public posts.
The maximum number of attachments per post is 3 for public posts, and 1 for private posts.

Posted: **Mon May 14, 2018 4:48 am**

And to add a bit more. This is a world wide group. In some places the bandwidth is narrow, so the forum's rules on file file size and attachments are set to recognise this limitation.

Posted: **Mon May 14, 2018 5:51 am**

@linwinux, two questions:
Is you'r computer dual-boot'ng with Windows?
Have you set BIOS-time to local time?

Posted: **Mon May 14, 2018 6:29 am**

The 6 core AMD machine is a dual-boot setup with windows 7. But I haven't booted into Windows 7 for a month or even longer. Because of our VPN service I'm using the boot into systemd though, perhaps that makes a difference? My understanding is that Mint utilizes systemd as well and I've never had issues like this with Mint for around 3+ years. The other system, the dual-core Acer is strictly an MX system, nothing else on it.

Posted: **Mon May 14, 2018 7:41 am**

@linwinux: Will this strange behavior happens also without VPN? I.e. you could boot non-systemd without VPN and see how palemoon behaves and whether your screen-saver issue shows up again. Only an idea...

Posted: **Mon May 14, 2018 9:56 am**

The Acer system does not boot into systemd and there is no VPN either. My system boots into systemd, but this has happened with vpn disabled as well as enabled.

Posted: **Tue May 22, 2018 8:31 pm**

Pale Moon 27.9.2 is now in the main repo.

This is a security and stability update.

Changes/fixes:

We changed the language strings for softblocked items so people will cry less when we do our job.
(CVE-2018-5174) Prevent potential SmartScreen bypass on Windows 10.
(CVE-2018-5173) Fixed an issue in the Downloads panel improperly rendering some Unicode characters, allowing for the file name to be spoofed. This could be used to obscure the file extension of potentially executable files from user view in the panel.
(CVE-2018-5177) Fixed a vulnerability in the XSLT component leading to a buffer overflow and crash if it occurs.
(CVE-2018-5159) Fixed an integer overflow vulnerability in the Skia library resulting in possible out-of-bounds writes.
(CVE-2018-5154) Fixed a use-after-free vulnerability while enumerating attributes during SVG animations with clip paths.
(CVE-2018-5178) Fixed a buffer overflow during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable extension in order to occur.
Fixed several stability issues (crashes) and memory safety hazards.

Posted: **Wed Jun 13, 2018 5:42 pm**

Pale Moon has been updated to security release 27.9.3 in the main repo:

Changes/fixes:

(CVE-2017-0381) Ported a patch from libopus upstream. Note, contrary to that report, the libopus maintainers state they don't believe remote code execution was possible, so this was not a critical patch.
Fixed an issue with task counting in JS GC.
Fixed a use-after-free in DOMProxyHandler::EnsureExpandoObject (thanks to Berk Cem Göksel for reporting).

Posted: **Tue Jul 17, 2018 10:54 pm**

Now updated to 27.9.4 in the main repo:

- Updated the useragent for addons.mozilla.org to work around their "Only
with Firefox" discrimination preventing users from downloading themes, old
versions of extensions, and other files with Pale Moon.
- Restricted web access to the moz-icon:// scheme that could potentially be
abused to infringe the user's privacy.
- Prevented various location-based threats. DiD
- Fixed a potential vulnerability with plugins being redirected to different
origins (CVE-2018-12364).
- Improved the security check for launching executable files
(by association) on Windows from the browser. For users who have (most
likely accidentally) granted a system-wide waiver for opening these kinds
of files without being prompted, this permission has been reset.
- Fixed an issue with invalid qcms transforms (CVE-2018-12366).
- Fixed a buffer overflow using the computed size of canvas elements
(CVE-2018-12359).
- Fixed a use-after-free when using focus() (CVE-2018-12360).
- Added some sanity checks on nsMozIconURI. DiD
- Fixed an issue in the case the preferences file in the profile would not be
writable (e.g. temporary permission issues due to backup, virus scanning or
similar external processes).

Posted: **Thu Aug 16, 2018 1:18 pm**

The major milestone release of Pale Moon 28.0.0 is now in our main repository.

SpiderMonkey update: The JavaScript engine has received a major upgrade and now supports all landmark features from the ECMAScript standards as carried by mainstream browsers. This should put an end to the increasing JavaScript issues we've seen due to web frameworks not being browser-agnostic in that respect, or the browser not supporting what websites expect.

Goanna update: The layout and rendering engine (Goanna) has been updated to its 4th generation (version 4.*) which brings with it improved compatibility with "trendy" CSS styling techniques that build on a few very specific features (e.g. CSS Grid). Goanna continues to build on tried-and-tested software fallbacks in case hardware acceleration can't be used, and Linux remote desktop users can continue to leverage xrender for speedy remote screen updates in Pale Moon.

DOM enhancements: Enhancements in the Document Object Model provides websites with updated APIs to perform their tasks. (e.g. Fetch, WebAnimations, WebCrypto, HTML Input Element Extensions, etc.)

Media enhancements: Our media back-end update is, for all intents and purposes, complete. MSE media streaming (for MP4) should be compatible with all major players on the market now. MSE for WebM is still disabled by default due to some compatibility issues that need to be examined, but you may enable this in preferences to e.g. allow 4k video playback on some sites that only offer UHD in WebM format. We now also support playback of FLAC-encoded audio.

New: WebGL2 support! Pale Moon now supports the WebGL2 standard for enhanced graphical experiences in 2D and 3D.

Devtools have been given a refresh. Just in case you thought they weren't extensive enough yet, some new categories have been added to inspect and manipulate all aspects of web content.

Updates to the login manager: Login credentials can now be stored specifically with or without a user name, and selected individually. This is a behavior change from previous, and clicking a password field can now pop-up a selection list of user names for which passwords are stored (if multiple credentials are saved). Clicking the appropriate login name (or date-stamped version if no name is present) will fill in the accompanying password.

What might be more important for people worrying about upgrading to this milestone is what hasn't changed.

We continue to support NPAPI plugins.
We continue to support complete themes as well as lightweight themes.
We continue to offer a fully customizable interface like before. Australis (like seen in Basilisk) is not used.
We continue to support XUL overlay, bootstrapped and (deprecated) Jetpack extensions (collectively called "legacy extensions" by Mozilla).
We do not include any DRM in the browser (people needing this can use e.g. the Silverlight plugin to play protected content), even though the platform we build on supports it.

Posted: **Thu Aug 16, 2018 2:49 pm**

Thanks.

Posted: **Thu Aug 16, 2018 2:55 pm**

Do you have a nonsse2 version?

Posted: **Thu Aug 16, 2018 3:50 pm**

anticapitalista wrote: Thu Aug 16, 2018 2:55 pm Do you have a nonsse2 version?

They removed any support for non-sse2 builds.

Posted: **Thu Aug 16, 2018 3:56 pm**

Stevo wrote: Thu Aug 16, 2018 3:50 pm
anticapitalista wrote: Thu Aug 16, 2018 2:55 pm Do you have a nonsse2 version?
They removed any support for non-sse2 builds.

That is bad news. So latest nonsse2 is 27.9.4?

Posted: **Thu Aug 16, 2018 6:46 pm**

anticapitalista wrote: Thu Aug 16, 2018 3:56 pm
Stevo wrote: Thu Aug 16, 2018 3:50 pm
anticapitalista wrote: Thu Aug 16, 2018 2:55 pm Do you have a nonsse2 version?
They removed any support for non-sse2 builds.
That is bad news. So latest nonsse2 is 27.9.4?

Yup, that's the last one where the option to build without it is supported. The developer also asked me to take it off my OBS repo to avoid any confusion with the current release.

Posted: **Thu Aug 16, 2018 8:48 pm**

Thanks, Stevo,
Learning to like the PaleMoon browser.
Been using Firefox for the last few months; this seems like a much improved Firefox
Tried it a couple or three years ago but went back to something else.

Posted: **Thu Aug 16, 2018 9:24 pm**

Version 28 installed and behaving. This old desktop is about 10 years old, but apparently not old enough to have problems.

Posted: **Sun Aug 19, 2018 4:14 am**

https://www.antixforum.com/forums/topic ... post-11841

PM version 28 - 32bit system

I have the described behavior also
As AddOn are installed:
uBlock
DE language package
language switcher

The start with a new, virgin directory .moonchild productions leads to this result

2018-08-19-09-51-49_scrot.png

Posted: **Mon Aug 20, 2018 9:36 am**

Today the new PaleMoon update was launched that corrects several faults.
http://linux.palemoon.org

Posted: **Mon Aug 20, 2018 2:08 pm**

Gerson wrote: Mon Aug 20, 2018 9:36 am Today the new PaleMoon update was launched that corrects several faults.
http://linux.palemoon.org

I can't find release newer than 28.0.0 in their UXP github repo, and your link doesn't have any information about a newer release...

Posted: **Mon Aug 20, 2018 4:20 pm**

One antiX user, along with users from some other distros, reported not being able to select items in the Preferences. It seemed to be related to whatever gtk theme they were using, but the solution is to

Final solution! In about:config find browser.preferences.animateFadeIn, set as true. Problem solved!

Posted: **Mon Aug 20, 2018 4:44 pm**

Stevo wrote: Mon Aug 20, 2018 2:08 pm
Gerson wrote: Mon Aug 20, 2018 9:36 am Today the new PaleMoon update was launched that corrects several faults.
http://linux.palemoon.org
I can't find release newer than 28.0.0 in their UXP github repo, and your link doesn't have any information about a newer release...

If you go to the main page ( a link) from Gerson's link, there is a small note top right corner of the page saying 28.0.0 was released on 16 August.
I am using 28 right now and not sure when I installed it.

Posted: **Thu Aug 23, 2018 2:40 pm**

I meant newer than 28.0.0, which seems to be implied when he wrote "Today" on the 20th.

There is also a tip for those looking for better streaming video performance, as in higher resolutions playing smoothly, possibly only working for 32-bit:

In about:config, set media.ffvpx.enabled to false.

Posted: **Tue Aug 28, 2018 6:19 pm**

There was a 28.0.0.1 release today, but it only addresses Windows issues, so we don't need to update to that.

Posted: **Sat Sep 01, 2018 4:14 pm**

Pale Moon 28.0.1 in now in the main repository!

This is a bugfix point release to address serious performance bottlenecks and general run-time issues (UI slowness, crashes, hangs) with the browser. Once again this impacted 32-bit operating systems more severely than 64-bit ones due to its more limited address space that would get flooded with bogus data.

Changes/fixes:

Backed out a Mozilla upstream patch causing issues with IPC and texture allocation for the compositor.
Backed out a Mozilla upstream patch causing issues with Javascript memory buffer allocation.

Posted: **Fri Sep 21, 2018 2:12 pm**

We now have a major upgrade to Pale Moon 28.1.0 in the main repository. Changes include:

- Updated NSS to 3.38, removed TLS 1.3 draft version check since it's
considered final.
- Reinstated RC4 as an optional encryption cypher for non-standard
environments (e.g. old routing/peripheral networked hardware on LAN). RC4
and 3DES are marked weak and disabled, and will never be used in the first
handshake with a site, only as last-ditch fallback when specifically
enabled (meaning they won't show up on ssllabs' test, for example).
- Removed Telemetry accumulation calls, automatic timers and stopwatches.
This removes a very noticeable performance sink for all operations on all
platforms.
- Fixed many occurrences of discouraged types of memory access for primarily
GCC 8 compatibility. This improves overall code security as a
defense-in-depth measure.
- Re-implemented the pref-controlled custom background color for
standalone images.
- Updated session history handling for internal pages. about:logopage is no
longer stored in history, and you can choose to store the QuickDial page in
history by setting the pref browser.newtabpage.add_to_session_history to
true. This is disabled by default (meaning you can't use the "Back" button
to go back to the QuickDial page) as a defense-in-depth security measure.
- Added ui.menu.allow_content_scroll to control whether content can be
scrolled if a context menu is open.
- Fixed incorrect code removal in ipc.
- Removed support for TLS session caches in TLSServerSocket.
- Added support for local-ref as SVG xlink:href values.
- Changed the find bar to be a browser-global toolbar again (like in Pale
Moon 27) instead of per-tab. For people who prefer search terms to be
saved on a per-tab basis (like with the per-tab findbar previously), this
is possible by setting findbar.termPerTab to true. This resolves a number
of issues, including styling with lightweight themes not applying to the
find bar, and status pop-ups overlapping the find bar.
- Ported all relevant security fixes from Mozilla's Gecko/62 release,
including CVE-2018-12377 and CVE-2018-12379.
- Restored part of the searchplugin API that was removed by Mozilla, so
extensions can provide and save edits to installed search engines.
- Improved the speed of restoring browsing sessions upon startup.
- Fixed the "Restore previous session" button sometimes being missing from
about:home, while a restorable session would be present.
- Fixed tab previews in the Windows taskbar (if enabled).
- Fixed the setting of the new tab page being "My Home Page" so it'll pick up
subsequent changes to the home page URL automatically.
- Removed the Firefox Accounts migrator from Sync.
- Fixed an issue with the enabled state of number controls if appearances
changed.
- Stopped building ffvpx on 32-bit platforms (except Windows) to use the
(faster) system-installed lib instead.
- Re-added a horizontal scroll action option for mouse wheel. (regression)
- Fixed handling of content language if the locale is changed.
- Fixed document navigation with the F6 key.
- Fixed toolbar styling in toolkit themes.
- Fixed viewing the source of a selection.

Posted: **Fri Sep 21, 2018 2:19 pm**

Thank you Stevo to maintain this soft, I now really like PaleMoon (my favorite web browser).

Posted: **Fri Sep 21, 2018 6:27 pm**

Me too.
I keep a Firefox-ESR for banks,
and Palemoon is my daily ride.

Posted: **Fri Sep 21, 2018 6:52 pm**

And me. I have gone a step further and removed Firefox completely from my old desktop.

Posted: **Tue Nov 13, 2018 6:56 pm**

We now have 28.2.0 in the main repository. Enjoy!

v28.2.0 (2018-11-13)
This is a major development and bugfix release.

Changes/fixes:

Fixed a major performance issue with web workers.
Fixed a rare crash on local networks with HTTP basic auth and unsupported cipher suites.
Fixed a performance/timer issue when leaving the browser idle.
Fixed an issue causing an empty dialog when launching executable files from the browser.
Fixed an issue preventing making entries to disallow sites to store data for off-line use.
Removed code to prevent extensions with binary components.
Fixed an issue with common dialogs being sized incorrectly for their content.
Fixed an issue with event handling on the tab bar that would cause frustrating behavior when trying to open/close tabs in rapid succession.
Switched default behavior for scrolling when a context or pop-up menu is open to allow scrolling, like in v27. This also affects scrolling in very long menus, e.g. bookmarks.
Added experimental Asynchronous Panning and Zooming (APZ) for desktop use.
Re-enabled the use and parsing of ICC v4 color profiles.
Removed telemetry code from the caching subsystem.
Improved full-screen detection for suppressing status messages.
Made all arguments passed to Init*Event() optional except the first for parity with other browsers.
Cleaned up some internal installer code.
Fixed making caret width configurable when dealing with CJK characters (regression).
Fixed drawing of table borders consistently when zooming a page (regression).
Exposed the "Save download location per site" pref in about:config.
Improved media handling (ongoing).
Added experimental support for AV1 in WebM videos (disabled by default).
Note: this is for WebM only for now, so MP4 and MSE AV1 streams (e.g. YouTube) will not (yet) play.
Removed the (defunct and incomplete) in-browser translation code.
Fixed an issue with CSS Grid layouts unnecessarily shrinking element blocks.
Fixed notification settings menu entry (opes about:permissions with relevant data now).
Fixed the launching of an undesirable background content process for capturing page thumbnails.
Fixed a focus issue in the bookmark properties dialog.
Changed the setting for reporting CSS errors to the console to false by default, to prevent unnecessary performance loss for recording this data.
Added control mechanisms for Opportunistic Encryption (both for alternative services and upgrade-insecure-requests) in preferences, and disabled this by default due to potential security and privacy issues with this transitional technology.
Updated the default reported Firefox version in Firefox Compatibility Mode to prevent "too old Firefox" complaints on websites.
Updated libnestegg, ffvpx, reader view components and several other modules from upstream.
Implemented security fixes for CVE-2018-12381, CVE-2017-7797, a better fix for CVE-2018-12386 (DiD), CVE-2018-12401 (DiD), CVE-2018-12398, CVE-2018-12392, several Skia bugs, and several crashes and memory safety hazards that do not have a CVE number.

Posted: **Tue Nov 13, 2018 11:45 pm**

Thanks Steve. Update looks OK so far, I'll yell if any problems appear.

Posted: **Wed Nov 14, 2018 2:58 am**

Thanks.

Posted: **Sat Nov 17, 2018 12:35 am**

Pale Moon 28.2.1 for Linux has been released.
This release addresses a critical usability issue in the history and bookmarks window.

The release is just 12 hours old, but I want to leave a reminder to Stevo

Posted: **Sat Nov 17, 2018 2:08 am**

Don't think that 28.2.1 is a Linux release yet.

Posted: **Thu Dec 06, 2018 4:28 pm**

Pale Moon has been updated to 28.2.2 in the main repository, from 28.2.1 that I forgot to enter here.

28.2.2:

Changes/fixes:

Changed the about:feeds icon for external applications to a generic icon, since that kind of access to executables is no longer allowed for security reasons.
Fixed issues with copying/pasting bookmarks in the Library View.
Fixed a crash occurring when using HTTP pipelining over some (broken) proxies.
Fixed several issues with animated WebP display (animations stopping, corrupted frames on lossy images, etc.)
Fixed an issue with the display of truncated GIF images.
Fixed an issue with deleting recent history not working properly.
Fixed incorrect duplicate compatibility mode preferences in about:config.

28.2.1:

This is a bugfix release to address critical usability issues with the bookmarks/history window.

Posted: **Wed Jan 16, 2019 4:26 pm**

Pale Moon 28.3.0 is now in the main repository and should be propagating through the mirrors.

This is a major development and bugfix release. Packaging changes include shipping a much better copyright file and also shipping copies of the MPL 1.1 and MPL 2 licenses.

Changes/fixes:

Added AV1 support for MP4/MSE videos. Please note that this is a reference library implementation and the upstream decoding lib currently has poor performance for higher resolutions (720p+). This is disabled by default; use the about:config preference media.av1.enabled to enable this codec.
Changed the API used for video playback with FFmpeg 58+. This should solve performance issues with VPx.
Redesigned the main toolbar icons as SVG images to make them HiDPI compliant.
Fixed the sync notification (infobar) icon.
Fixed a potential cycle collector resource leak.
Added icons and controls to tabs to indicate if sound is playing the tab and if so, allowing the user to mute it with a click.
This is a native implementation of the API in use in Basilisk and performs the same function as the "expose noisy tabs" extension, although the extension may still be preferred by some for e.g. skinning capabilities. The feature may be disabled with browser.tabs.showAudioPlayingIcon.
Removed support for VR hardware.
Fixed out-of-bounds sizes for CSS calculation strings.
Removed the DirectShow component since it is no longer necessary.
Removed Firefox Accounts integration, phase 1:
Changed the Sync client to the one from Tycho.
Made Sync optional at build time.
Stopped trying to cater to addons.mozilla.org since they no longer offer anything useful to Pale Moon after the Great XUL Extension Purge™.
Added an option to process favicons for optimal sized display and removing animations. Enable this with browser.chrome.favicons.process
Fixed an incorrect preference reference in feed reader.
Fixed an issue with lazy frame construction on display:contents elements. This should solve e.g. the use of mathjax in comments on stackoverflow.
Media code improvements and cleanup (ongoing).
Updated the DropBox useragent override to solve login issues.
Fixed potential crashes due to shutdown observers in VTT and font lists. DiD
Enabled some mistakingly-disabled optimizations in the JS JIT compiler.
Fixed several potential crashes in JS. DiD
Fixed several potential crashes in WebCrypto. DiD
Fixed a potential crash in JS Range Analysis. DiD
Fixed a potential crash in the layout engine due to combo boxes. DiD
Fixed a potential shutdown crash in non-standard environments related to 2D Canvas. DiD
Fixed a potential overflow in the PNG writer. DiD
Fixed a potential double-free in the MAR signing utility. DiD
Fixed an issue where URLs could be extracted cross-origin (CVE-2018-18494).
Updated NSPR to v4.20.
Updated NSS to 3.41, providing (among other things) full compatibility with the final version of TLS 1.3 on websites.
Updated location.protocol to the latest spec.
Updated Intersection Observers to the latest spec and enabled them by default.
Updated the SQLite lib to 3.26.0.
Fixed errors about the login manager's recipeManager not being available (yet).
Switched status bar download arrow to SVG.
Fixed a crash in IntersectionObservers.
Fixed initialization of the Search service from browser code to avoid synchronous init.
Added logging of performance warnings to devtools consoles.
Fixed favicons in taskbar tab preview listings.
Blocked Comodo IS dll < version 6.3 to prevent startup crashes.
Fixed issues in the HTML form submit observer module.
Limited resolving depth of CSS variables to a sane maximum (fixes cras.sh issue).
Removed Mozilla's proprietary constructor on WebAudio's AudioContext, aligning it with the standard specification.
Exposed the previously hidden preference in about:config for page thumbnail generation (some people prefer this for local privacy).
Aligned Element.ScrollIntoView with the DOM specification. This improves, among other things, compatibility with the React framework.

DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Posted: **Sat Jan 26, 2019 1:34 pm**

Updated to 28.3.1 in main:

This is a minor bugfix and stability release.

If you are using a language pack, please make sure you have the matching version for this browser version installed. Some strings were added for Captive Portal detection (see below) and outdated language packs will cause blank preference pages.

Changes/fixes:

• Improved toolbar icon display for all DPIs on Windows.
• Disabled the IntersectionObserver API by default while we work on resolving crashes caused by it.
• Added isIntersecting to the IntersectionObserver API per specification.
• Added an option to the preferences window to enable Captive Portal detection (Advanced -> General). If your network connection regularly encounters Captive Portals (e.g. using a laptop on the road or other WiFi connections that require login or agreement to terms) then enabling this detection may make your use of such networks more convenient.
For those worried about privacy: the detection service makes use of our own infrastructure and does not contact third parties like Apple or Google.

Posted: **Tue Feb 19, 2019 11:17 pm**

Pale Moon 28.4.0 is now in the main repo and making its way through the mirrors. Changes include:

This is a major development, stability and security release.

Changes/fixes:

Removed more telemetry code from the platform.
Fixed implementation of the IntersectionObserver API to avoid crashes, and enabled it by default.
Switched to the new ffmpeg decode API to avoid dropping of frames.
Fixed a buffering issue in the WebP decoder that caused intermittent browser crashes.
Improved resource-efficiency for internal stopwatch timers.
Improved handling of incorrectly-encoded CTTS in media files, resolving some playback issues of videos.
Improved the Cycle Collector and Garbage Collector.
Improved fullscreen navigation bar handling in the situation it has focus when switching to full screen.
Aligned instanceof with the final ES6 spec.
Improved Windows DIB (bitmap) clipboard data handling.
Exposed TLS 1.3 cipher suite prefs in about:config in case people want to disable them individually.
Allowed empty string on the location.search setter to clear URL query parameters from JS.
Added a potential fix for external links not opening in the current window/tab (untested).
Enabled C++11 thread-safe statics in the entire application.
Updated several preferences for integration with the new add-ons site.

Security fixes:

Fixed a potential use-after-free in IndexedDB code. (DiD)
Improved proxy handling to avoid localhost getting proxied. (CVE-2018-18506)
Ported upstream Skia fixes. (CVE-2018-18356, CVE-2018-18335)
Fixed an additional Skia issue. (CVE-2019-5785)
Fixed several potentially-exploitable memory safety hazards and crashes. (DiD)
Fixed a possible data race when performing compacting GC.

DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Posted: **Tue Mar 19, 2019 6:38 pm**

Unfortunately libfontconfig1 2.13 is missing in antiX 17 and palemoon can't be installed.

Posted: **Tue Mar 19, 2019 6:57 pm**

yes -libfontconfig1 in debian/stretch is libfontconfig1 (2.11.0-6.7 and others) so the palemoon build is faulty for standard debian/stretch.

Posted: **Tue Mar 19, 2019 7:46 pm**

Oops, I must have had the MX repo added to sbuild for that particular build. But it's fine with MX!

However, antiX users can always use the Jessie/Stretch/Buster versions from my OBS repo--add the repo and its key to get automatic updates, or just download and install the single deb package. See the "download packages" on this page:

https://build.opensuse.org/package/show ... r/palemoon

The repo also has the latest firejail and firetools if you want to use those with PM.

Posted: **Thu Mar 28, 2019 1:44 pm**

Pale Moon 28.4.1 is now available in the main repository.

This is a security and bugfix update.

Fixed hover state arrows on some controls.
Fixed potential denial-of-service issues involving FTP (loading of subresources and spamming errors).
Disabled Microsoft Family Safety (Win 8.1) by default. This prevents security issues as a result of a local MitM setup.
Added several site-specific overrides (Firefox Send and polyfill.io) to work around website UA-sniffing isues.
Implemented the origin-clean algorithm for controlling access to image resources.
Cleaned up the helper application service code.
Ported applicable security fixes from Mozilla (CVE-2019-9791, CVE-2019-9792, CVE-2019-9796, CVE-2019-9801, CVE-2019-9793, CVE-2019-9794, CVE-2019-9808 and ZDI-CAN-8368).
Implemented several defense-in-depth measures (for CVE-2019-9790, CVE-2019-9797, CVE-2019-9804, and a JavaScript issue).
Fixed several memory safety hazards and crashes.
Binaries are now code-signed again (including the setup program for the installer).

The Pale Moon package now also provides www-browser and gnome-www-browser for any desktop metapackages that require one of those virtual browser packages.

Unlike the last 28.4.0 packages, these are also fully compatible with vanilla Stretch and antiX 17.X.

Posted: **Sat Mar 30, 2019 8:45 am**

Stevo wrote: Thu Mar 28, 2019 1:44 pm Pale Moon 28.4.1 is now available in the main repository.

This is a security and bugfix update.
...

I like Palemoon, my default web-Browser now (thanks Stevo, I discovered it by you), I also have an Android version (but unfortunately not the latest, an old V 25.9.6)

Posted: **Wed May 01, 2019 3:13 pm**

Updated to 28.5.0 in the main repo:

* New upstream major development and bugfix release:
- Redesigned the about box.
- Added "Check for updates" menu entries to the AppMenu and classic menu
(since the About box redesign no longer has application update in it).
- Restored the app.update.url.override pref for AUS testing/override.
- Added "Loop" control to html5 video.
- Fixed a crash with frames (e.g. when using Tile Tabs).
- Fixed an issue with textarea placeholders (spec compliance).
- Removed the Windows Maintenance Service one last time.
- Improved http basic auth DoS heuristics.
- Fixed an issue on big-endian machines (e.g. PPC64/linux).
- Removed e10s code from widgets.
- Preffed the various http "Accept" headers and aligned with the Fetch spec
(except for image requests).
- Aligned URLSearchParams with the spec.
- Updated several site-specific UA overrides.
- Fixed "Yet Another special case of a flex frame being the absolute
containing block"™
- Fixed border drawing when the tab bar is hidden.
- Pref-controlled and disabled the use of unboxed plain objects in
JavaScript's JIT compiler.
- Improved handling of interrupted connections through proxies and
pseudo-VPN extensions.
- Removed contextual identity.
- Updated the 7zip installer stub to a much more recent code version.
- Fixed an issue with applying percentages to 0 in layout sizes.
- Fixed an issue with calculating linear sums in JS JITed code.
- Added default value feature to get*Pref() preference functions.
- Fixed an issue that would occasionally overwrite the new tab custom URL.
- Updated the SQLite library to 3.27.2
- Killed the crashreporter toolkit files and exception handler hooks.
- Fixed an issue with a missing border on the tab bar when on the bottom.
- Fixed a crash with badly-formatted SVG files.
- Showed the robots to the exit after squatting in the browser for decades.
- JavaScript: Implemented TC39 toString() revision proposal.
- Rearchitectured the JavaScript front-end parser to provide better and more
logical parsing of JS code.
- Removed support code and leftovers for unsupported SunOS, AIX, BEOS, HPUX
and OS/2 operating systems.
- Fixed a scrollbar arrow issue on OS X.
- Removed all Firefox Accounts code.
- Made the CSS parser more robust and aligned url() behavior with the CSS3
spec in case of bad input.
- Fixed an issue with blocklist updates not actually dynamically applying
due to a wrong URL.
- Updated the embedded emoji font to the TweMoji v11.4.0 equivalent.
- Fixed an issue with async/deferred scripts preventing page loads from
completing.

Posted: **Thu May 02, 2019 1:59 am**

I have updated to 28.5.0 in MX and in Mint 19.1 Cinnamon.
The new "Check for Updates" entry in the 'Help' dropdown menu is missing in the MX build.
I haven't seen any other way to do an update check.
It does work properly in the other build.

I've attached a screenshot that lists my installed extensions.
Currently using the new default theme.

System: Host: mx1 Kernel: 4.19.0-1-amd64 x86_64 bits: 64 Desktop: Xfce 4.12.3
Distro: MX-18.2_x64 Continuum Apr 7 2019
Machine: Type: Desktop Mobo: ASRock model: H370M Pro4 serial: <root required>
UEFI: American Megatrends v: P3.40 date: 10/25/2018
CPU: Topology: 6-Core model: Intel Core i5-8600K bits: 64 type: MCP L2 cache: 9216 KiB
Speed: 800 MHz min/max: 800/4300 MHz Core speeds (MHz): 1: 800 2: 800 3: 800 4: 800 5: 800
6: 800
Graphics: Device-1: Intel driver: i915 v: kernel
Display: x11 server: X.Org 1.19.2 driver: intel resolution: 1920x1200~60Hz
OpenGL: renderer: Mesa DRI Intel UHD Graphics 630 (Coffeelake 3x8 GT2) v: 4.5 Mesa 18.2.6
Audio: Device-1: Intel driver: snd_hda_intel
Sound Server: ALSA v: k4.19.0-1-amd64
Network: Device-1: Intel driver: e1000e
IF: eth0 state: up speed: 1000 Mbps duplex: full mac: 70:85:c2:a7:d7:b8
Drives: Local Storage: total: 1.25 TiB used: 3.52 GiB (0.3%)
ID-1: /dev/nvme0n1 vendor: A-Data model: SX8200NP size: 223.57 GiB
ID-2: /dev/sda vendor: Samsung model: SSD 840 EVO 120GB size: 111.79 GiB
ID-3: /dev/sdb vendor: Western Digital model: WD1003FZEX-00K3CA0 size: 931.51 GiB
ID-4: /dev/sdc type: USB vendor: Transcend model: JetFlash Transcend 16GB size: 14.60 GiB
Partition: ID-1: / size: 5.91 GiB used: 333.6 MiB (5.5%) fs: overlay source: ERR-102
ID-2: swap-1 size: 2.00 GiB used: 0 KiB (0.0%) fs: swap dev: /dev/nvme0n1p3
ID-3: swap-2 size: 4.00 GiB used: 0 KiB (0.0%) fs: swap dev: /dev/sda3
Sensors: System Temperatures: cpu: 33.0 C mobo: N/A
Fan Speeds (RPM): N/A
Info: Processes: 201 Uptime: 13m Memory: 7.46 GiB used: 1.03 GiB (13.8%) Shell: bash
inxi: 3.0.33

Posted: **Thu May 02, 2019 6:58 am**

... Updated to 28.5.0 in the main repo: ...

... Strange, Ctrl + Left mouse clic does not work "to open as new tab" into this Palemoon version here, a bug?

Posted: **Thu May 02, 2019 7:04 am**

It works here.

Posted: **Thu May 02, 2019 7:09 am**

JayM wrote: Thu May 02, 2019 7:04 amIt works here.

Ah ... thank you for the info. JayM ... then I have to investigate ... (work into Chromium, Firefox, but not Palemoon 28.5.0 here, worked with the previous version)

EDIT: OK, FI it was a plugin, the new version of "Tab Mix Plus" solved this issue.
new one: Tab Mix Plus - Version 0.5.7.0 Installed

Posted: **Thu May 02, 2019 10:00 am**

mjtux wrote: Thu May 02, 2019 1:59 am I have updated to 28.5.0 in MX and in Mint 19.1 Cinnamon.
The new "Check for Updates" entry in the 'Help' dropdown menu is missing in the MX build.
I haven't seen any other way to do an update check.
It does work properly in the other build.

You might want to read the Release notes.
http://www.palemoon.org/releasenotes.shtml

v28.5.0 (2019-04-30)
This is a major development and bugfix update.

Changes/fixes:

Redesigned the about box.
Added "Check for updates" menu entries to the AppMenu and classic menu (since the About box redesign no longer has application update in it).

If it is still in another build else where then they modified their build to include it.

Posted: **Thu May 02, 2019 5:01 pm**

mjtux wrote: Thu May 02, 2019 1:59 am I have updated to 28.5.0 in MX and in Mint 19.1 Cinnamon.
The new "Check for Updates" entry in the 'Help' dropdown menu is missing in the MX build.
I haven't seen any other way to do an update check.
It does work properly in the other build.
...

Well, since Mint doesn't have PM in its repo, that begs the question as to how you installed it. If you used my repo on the OBS, the sources are exactly the same for MX and the OBS versions--I just change the top line in the changelog for the different versions. I just tested the OBS Stretch package and don't see the updater there, either.

Actually, not having an update checker is how Debian prefers its packages, but usually there's a patch or config file involved to disable it. I think we did that for our Firefox packages fairly recently, too.

Posted: **Fri May 03, 2019 1:55 am**

towwire wrote: Thu May 02, 2019 10:00 am
You might want to read the Release notes.
http://www.palemoon.org/releasenotes.shtml

v28.5.0 (2019-04-30)
This is a major development and bugfix update.

Changes/fixes:

Redesigned the about box.
Added "Check for updates" menu entries to the AppMenu and classic menu (since the About box redesign no longer has application update in it).
If it is still in another build else where then they modified their build to include it.

I did look at the release notes, as that page is opened in the browser immediately after the update is installed and the browser is restarted.
So, I'm confused about what the AppMenu and classic menu are. I thought that referred to the Help menu, which is where the new "Check" is.

It used to be in the "About" popup window.
The build I have was downloaded from the Pale Moon website.
Once installed, the updates are automatic.

Stevo wrote: Thu May 02, 2019 5:01 pm
Well, since Mint doesn't have PM in its repo, that begs the question as to how you installed it.

Actually, not having an update checker is how Debian prefers its packages, but usually there's a patch or config file involved to disable it. I think we did that for our Firefox packages fairly recently, too.

I used the manual install method:
https://linux.palemoon.org/help/installation/

I'm fairly new to Linux, so there are still many concepts and procedures that I don't know.
Would the manual install work with MX, or is it best to get PM only through the repository?

Thanks for the replies.

Posted: **Fri May 03, 2019 4:20 am**

At 08.20 UTC, the distribution of 28.5 seems to be incomplete. Not seen yet here downunder, so I looked at the Utah repo, not there either.
Will try again tomorrow.

Posted: **Fri May 03, 2019 1:35 pm**

Gordon Cooper wrote: Fri May 03, 2019 4:20 am At 08.20 UTC, the distribution of 28.5 seems to be incomplete. Not seen yet here downunder, so I looked at the Utah repo, not there either.
Will try again tomorrow.

Here is my history.

2019-05-01 08:09:33 upgrade palemoon amd64 28.4.1+repack-1 28.5.0+repack-1mx17+1

As you can see, it came thru on May first and I'm in Washington State.

Posted: **Fri May 03, 2019 4:43 pm**

mjtux wrote: Fri May 03, 2019 1:55 am ...

I'm fairly new to Linux, so there are still many concepts and procedures that I don't know.
Would the manual install work with MX, or is it best to get PM only through the repository?

Thanks for the replies.

I try to get the new version of PM in the repos on the day it's released, but it does take a couple hours to build the packages, test, and upload them. I actually had a test build done a few days earlier, since the release appeared on Github on Saturday, but I'm not supposed to jump the gun. So if users get it from our Package Installer, it'll come from the repo and updates will be done like all the other updates.

If you want, you can still use the packages directly from Pale Moon--nothing prevents that choice, either.

Posted: **Fri May 03, 2019 4:53 pm**

I installed from mx-repo (mirror here in DE) about 1-2 hours before the announcment from Stevo was made here in in the forum, so I guess the actual mirror synced fairly fast.

Posted: **Fri May 03, 2019 5:52 pm**

towwire wrote: Fri May 03, 2019 1:35 pm
Gordon Cooper wrote: Fri May 03, 2019 4:20 am At 08.20 UTC, the distribution of 28.5 seems to be incomplete. Not seen yet here downunder, so I looked at the Utah repo, not there either.
Will try again tomorrow.
Here is my history.
2019-05-01 08:09:33 upgrade palemoon amd64 28.4.1+repack-1 28.5.0+repack-1mx17+1
As you can see, it came thru on May first and I'm in Washington State.

@ towwire. It was here in the repo this morning - 4th May local - around midday on the 3rd for you. Not unusual for upgrades to be delayed here in NZ, the time zone change means that we sometimes miss the update sync.
BTW had a great vacation in WA. Up in the NE forest area where the stateline with Idaho goes through the
town of Newport and taxes seem to vary depending upon which side of street you are shopping.

PM 28.5 installed OK and no problems as yet.

Posted: **Tue May 07, 2019 5:31 pm**

28.5.0 is the first Pale Moon update that hasn't come normally through MX Updater. Stuck on 28.4.1 (working beautifully). Running MX 16.1 32-bit PAE in the US, fully updated and with all recommended repository changes, I think. Other packages still updating normally without errors. Next step?

Posted: **Tue May 07, 2019 6:56 pm**

BillZM wrote: Tue May 07, 2019 5:31 pm 28.5.0 is the first Pale Moon update that hasn't come normally through MX Updater. Stuck on 28.4.1 (working beautifully). Running MX 16.1 32-bit PAE in the US, fully updated and with all recommended repository changes, I think. Other packages still updating normally without errors. Next step?

What does

Code: Select all

sudo apt-cache policy palemoon

show?

You can always manually grab and install the latest Jessie deb from my OBS repo, too: https://software.opensuse.org//download ... e=palemoon

Posted: **Tue May 07, 2019 7:03 pm**

sudo apt_cache policy palemoon

Installed: 28.4.1+repack-1
Candidate: 28.5.0+repack-1mx15+1
Version table:
28.5.0+repack-1mx15+1 0
500 http://mxrepo.com/mx/repo/ mx15/main i386 Packages
*** 28.4.1+repack-1 0
500 http://la.mxrepo.com/antix/jessie/ jessie/main i386 Packages
100 /var/lib/dpkg/status

Posted: **Tue May 07, 2019 7:16 pm**

Darn, I have to build that version in a Virtual Box VM, so I hope it didn't accidentally pick up a dependency. Let me check....

Depends:

Code: Select all

libasound2 (>= 1.0.16), libatk1.0-0 (>= 1.12.4), libc6 (>= 2.17), libcairo2 (>= 1.2.4), libdbus-1-3 (>= 1.9.14), libdbus-glib-1-2 (>= 0.78), libfontconfig1 (>= 2.12.6), libfreetype6 (>= 2.2.1), libgcc1 (>= 1:4.2), libgdk-pixbuf2.0-0 (>= 2.22.0), libglib2.0-0 (>= 2.30.0), libgtk2.0-0 (>= 2.24.0), libpango-1.0-0 (>= 1.14.0), libpangocairo-1.0-0 (>= 1.14.0), libpangoft2-1.0-0 (>= 1.14.0), libstdc++6 (>= 5.2), libx11-6, libx11-xcb1, libxcb-shm0, libxcb1, libxext6, libxrender1, libxt6, libavcodec54 | libavcodec-extra54 | libavcodec55 | libavcodec-extra55 | libavcodec56 | libavcodec-extra56 | libavcodec57 | libavcodec-extra57 | libavcodec58 | libavcodec-extra58 | libavcodec-ffmpeg56 | libavcodec-ffmpeg-extra56

No, it looks OK.

What happens if you try

Code: Select all

sudo apt-get install palemoon=28.5.0+repack-1mx15+1

Posted: **Tue May 07, 2019 8:49 pm**

Stevo wrote: Tue May 07, 2019 7:16 pm
What happens if you try
Code: Select all
sudo apt-get install palemoon=28.5.0+repack-1mx15+1

Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
palemoon : Depends: libdbus-1-3 (>= 1.9.14) but 1.8.22-0+deb8u1 is to be installed
Depends: libfontconfig1 (>= 2.12.6) but 2.12.1-0.1mx150+1 is to be installed
Depends: libstdc++6 (>= 5.2) but 4.9.2-10+deb8u2 is to be installed
E: Unable to correct problems, you have held broken packages.

Posted: **Tue May 07, 2019 9:51 pm**

Pale Moon 28.5 installed here from Utah mirror and running without problems. It was installed as an update to PM 28.4.
Are you installing 28.5 as a new complete program. Any dependencies missing perhaps in that package only and were present
in 28.4 or previous packages ?

Posted: **Tue May 07, 2019 10:02 pm**

Gordon Cooper wrote: Tue May 07, 2019 9:51 pm Pale Moon 28.5 installed here from Utah mirror and running without problems. It was installed as an update to PM 28.4.
Are you installing 28.5 as a new complete program. Any dependencies missing perhaps in that package only and were present
in 28.4 or previous packages ?

As mentioned, I'm running MX16.1 32-bit which has had some repository changes in recent months; I think I'm all caught up with those and the distro is updating nicely.

If I remember correctly, I installed Pale Moon first via Synaptic, I think as 27.9.4, and it has updated with no hiccups ever since (up through 28.4.1). I have reinstalled once or twice using snapshots I had saved. Again, Pale Moon has run and updated flawlessly until 28.5.0

Posted: **Tue May 07, 2019 10:20 pm**

Stevo/Gordon,

When I look at Pale Moon properties in Synaptic, it shows
Available Versions:
28.5.0+repack-1mx15+1 (mx)
28.4.1+repack-1 (jessie)

I wondered if "jessie" vs "mx" was a clue. Sorry for my complete lack of knowledge here! I appreciate your help!

Posted: **Tue May 07, 2019 10:29 pm**

As you were running 28.4 previously, that nearly disposes of my thoughts about a new installation. I have been running Pale Moon
ever since it became available, my early version installations were from Synaptic but 28.5 and the 27.* versions were definitely from
the MX repositories. Thinking..........

Posted: **Tue May 07, 2019 10:46 pm**

I could try to upgrade with Synaptic (which might resolve issues), but holding off for now in case Stevo wants me to try something else.
Not many still running MX16? I'm reluctant to upgrade as the 3.16 kernel just flies on these old laptops.

Posted: **Tue May 07, 2019 11:13 pm**

This desktop is not exactly new, I have replaced the power pack and installed an SSD as sda, but the operating system is dated
October 2009. No issues at all with all versions of MX since the beginning. Currently MX 18.2

Posted: **Wed May 08, 2019 4:31 pm**

I installed Steve's generic 28.5.0 Debian build (palemoon_28.5.0+repack-1_i386.deb grabbed directly) and it did install without flagging any dependencies. It runs but seems sluggish loading tabs relative to the MX build of 28.4.1 I was just running.

Posted: **Wed May 08, 2019 8:46 pm**

I think I accidentally built the i386 MX 15 version on a MX 17/18 virtual machine.

I'll do a rebuild.

Update: fixed MX 15 packages are on the way to the repo.

Posted: **Thu May 09, 2019 4:05 am**

Stevo wrote: Wed May 08, 2019 8:46 pm Update: fixed MX 15 packages are on the way to the repo.

That's it! Updated and ran perfectly. Thanks!

Posted: **Sat May 11, 2019 10:08 am**

Palemoon is my primary browser and I love it. However I see that the latest update has done something to break compatibility with my Nextcloud installation (particularly the TASK app). Everything else in Palemoon and Nextcloud work fine for me in Palemoon, but for some reason after the update the Task app now gives me a totally blank white screen in the browser. I have no clue what the problem is as I am not getting any kind of error message. The same task app works fine in every other browser, but on every one of my Palemoon updated installs i am getting the same white screen ( Nextcloud blue bar at top of screen looks fine, but nothing but white beneath it).

Is there a place where I can download the prior deb package (28.4.1, if I am correct) and use that for the time being until perhaps new updates of Palemoon fix my problem?

Thanks very much.

Edit: FWIW -- the Nextcloud task app developer responded: https://github.com/nextcloud/tasks/issu ... -491523216

@nathan2423 I had a look now and downloaded Pale Moon Portable for Windows. With https://github.com/nextcloud/tasks/tree/compatibility the app seems to work normally on the first sight. But basically none of the click actions (like starring or completing a task etc.) works. This seems to be because the event bubbling of Pale Moon is really weird. It basically does not bubble upwards, so the click handlers are never called.

I guess it would be possible to fix this by moving the click handlers to the innermost element, but this would be quite some effort.

However, we can merge https://github.com/nextcloud/tasks/tree/compatibility anyway, because it does not change the behaviour for other browsers and bundle size stays the same.

Edit2: From NC Tasks developer: Well without the change in #401 I also only get a white screen with Pale Moon on windows.

—

Posted: **Thu Jun 06, 2019 7:35 pm**

Version 28.5.2 has been released by Pale Moon team.

Posted: **Fri Jun 07, 2019 12:32 am**

Thanks, grabbing the source now.

Posted: **Fri Jun 07, 2019 2:57 pm**

Uploaded for the main repo, but can be downloaded early here for MX 15 through 18: https://drive.google.com/open?id=1JfRQH ... RRuS27O2gi

Posted: **Fri Jun 07, 2019 4:45 pm**

Stevo wrote: Fri Jun 07, 2019 2:57 pm Uploaded for the main repo, but can be downloaded early here for MX 15 through 18: https://drive.google.com/open?id=1JfRQH ... RRuS27O2gi

Thanks Stevo.

Posted: **Fri Jun 07, 2019 7:57 pm**

Pale Moon 2.5.2 is now in the main MX 17 repo. It's a security and bugfix update.

Posted: **Fri Jun 07, 2019 9:37 pm**

2,5,2 installed and working, no problems. Thanks Stevo.

Posted: **Sat Jun 08, 2019 2:13 pm**

I've found out that the 32-bit version requires the MX versions of fonconfig and libglib2.0-0, which is fine for MX users, but not so good for antiX and vanilla Stretch users that hooked onto our repo, so I deleted and regenerated the 32-bit sbuild environment that was to blame--I think it got the MX 17 versions "stuck" in it when I had to shut it down with MX 17 attached to it. It takes just a couple minutes to delete and create a fresh new stretch-i386 environment, so I didn't bother logging into the schroot and cleaning it out manually.

There will be a mx17+2 build shortly for 32-bit.

Posted: **Fri Jul 05, 2019 12:13 pm**

Shortly after 28.6 there is now a new release...

v28.6.0.1 (2019-07-04)
This is an out-of-band update to fix some pressing issues with the latest release.

Changes/fixes:

Updated the application icon to provide better visuals on Windows classic and other grey backgrounds.
Reduced the Master Password hashing rounds to prevent issues with stored password retrieval while still sufficiently strengthening the encryption.
If you have previously re-keyed the database after the update to 28.6.0, you should do so again by going through the change master password process to reduce access times.
Updated the WhatsApp Web site-specific user-agent override to respond to Google refusing access based on the old string.
Updated the branding for the portable launcher.

Not sure if the Pale Moon devs still deserve the support from other people building and distributing their browser. I keep using Pale Moon because I think it's the best browser and probably one of the cleanest browsers in terms of telemetry/spyware. I could use Trava90's build, but I got used to getting it from here.

Posted: **Fri Jul 05, 2019 7:27 pm**

I'll get to it. There's also my repo on the OBS that you could install from--it usually finishes all the Ubuntu and Debian packages in 30-60 minutes.

Posted: **Fri Jul 05, 2019 9:47 pm**

Stevo wrote: Fri Jul 05, 2019 7:27 pm I'll get to it. There's also my repo on the OBS that you could install from--it usually finishes all the Ubuntu and Debian packages in 30-60 minutes.

Thanks, I installed it (Debian 9 x64 version) through gdebi. Is this the same build that will show up in the MX repo?

Posted: **Fri Jul 12, 2019 6:01 am**

Data breach post-mortem
...
A malicious party gained access to the at the time Windows-based archive server)(archive.palemoon.org) which we've been renting from Frantech/BuyVM, and ran a script to selectively infect all archived Pale Moon .exe files stored on it (installers and portable self-extracting archives) with a variant of Win32/ClipBanker.DY (ESET designation). Running these infected executables will drop a trojan/backdoor on your system that would potentially allow further compromise to it.

The moment this was reported to me on A malicious party gained access to the at the time Windows-based archive server (archive.palemoon.org) which we've been renting from Frantech/BuyVM, and ran a script to selectively infect all archived Pale Moon .exe files stored on it (installers and portable self-extracting archives) with a variant of Win32/ClipBanker.DY (ESET designation). Running these infected executables will drop a trojan/backdoor on your system that would potentially allow further compromise to it.

The moment this was reported to me on 2019-07-09,

https://forum.palemoon.org/viewtopic.php?f=17&t=22526

just windows, but symptom for security of palemoon servers?

Posted: **Fri Jul 12, 2019 6:33 pm**

We're OK, because we get and build the source from Github, so avoid any contact with their servers altogether. The OBS builds also never had any contact with their server.

Posted: **Fri Jul 12, 2019 6:36 pm**

dreamer wrote: Fri Jul 05, 2019 9:47 pm
Stevo wrote: Fri Jul 05, 2019 7:27 pm I'll get to it. There's also my repo on the OBS that you could install from--it usually finishes all the Ubuntu and Debian packages in 30-60 minutes.
Thanks, I installed it (Debian 9 x64 version) through gdebi. Is this the same build that will show up in the MX repo?

It's pretty much the same exact program, though the OBS version is seen as a higher version because of the way they are named.

Posted: **Thu Jul 25, 2019 9:29 pm**

Pale Moon 28.6.1 is now in the main repo. All users should update.

Posted: **Fri Jul 26, 2019 8:12 pm**

Thanks!

Posted: **Fri Jul 26, 2019 9:04 pm**

Have updated to 28.6.1 and it works fine. Thanks.

Posted: **Fri Sep 13, 2019 1:51 pm**

We now have updated to 28.7.1 in the main repository. All users are urged to update.

Fixed an issue where saving a webpage to disk would sometimes drop tags from the document.
Fixed an issue with click-to-play plugin content throwing up a blank notification.
Fixed an issue in the renderer where region intersections would sometimes return the wrong result.
This fixes a regression caused by the fix for CVE-2016-5252.
Fixed security issues: CVE-2019-11744, CVE-2019-11752, CVE-2019-11737, CVE-2019-11746, CVE-2019-11750, CVE-2019-11747 and CVE-2019-11738.
Unified XUL Platform Mozilla Security Patch Summary: 7 fixed, 1 DiD, 1 already covered, 22 not applicable.

Posted: **Sat Sep 21, 2019 5:26 am**

Beginning with version 28.6.0, Pale Moon browser began crashing frequently on MX.
The browser would crash and immediately the desktop also. It went all the way down to the login screen.
I had not seen any posts about Pale Moon crashes following the updates.
All of the PM updates remained fine with Mint 19.2 Cinnamon - never crashed.
I thought it might be a problem with that build, but the crashes continued after the next updates, including v28.7.1.

The crashes seemed to happen during page navigation, so I thought it might be the mouse going bad.
The same thing happened with keyboard only use.

I tried Safe Mode - no luck.
I tried a reinstall - no luck.
I tried remove and reinstall - no luck.
I tried complete removal with Synaptic and fresh install - no luck; even with no add-ons installed.

Finaly, I thought it might be the optional setting in MX Tweak -> Config Options that I had turned ON to remedy screen tearing.
Use Intel driver instaed of default "modsetting" driver

I deactivated that setting, did a restart and then a fresh install.
Then, no more crashes

, but the screen tearing was back.
I reactivated the Intel option and did another restart.
Still no more crashes.

During the interim, I installed Waterfox and got it configured the way I like and there were no crashes.
So now I'm happy with Waterfox.

Since this turned out to be a hardware/driver compatibility issue with Pale Moon on MX 18.3, I think it's best to post an alert.
This could have other consequences.

Posted: **Sat Sep 21, 2019 3:29 pm**

Thanks for the report! Though you seem to have somehow made the crashing stop, even after switching back to the intel driver, I wonder if an even newer kernel or Mesa might also fix the problem, since 8th-gen Intel hardware support is still being improved. We have both in the test repos.

Posted: **Thu Dec 12, 2019 4:49 pm**

Now updated to Pale Moon 28.8.0 in the main repository! It's a major new release.

If anyone has an ARM-based device, such as Raspian running on a Pi, I also have experimental builds on the OBS for the distros it supports: https://build.opensuse.org/package/show ... r/palemoon

and the Pale Moon devs and I would appreciate any reports about it running on those devices. Thanks!

Posted: **Fri Dec 13, 2019 4:49 am**

... Cool ... Palemoon is an efficient & light web browser, it is my favorite now (with some plugins).

Posted: **Mon Jan 13, 2020 5:42 pm**

Now updated to 28.8.1 in the main repository--all users should update!

Fixed a sampling issue in libsoundtouch (DiD)

Fixed an issue with a new upcoming Windows 10 feature not honoring Private Browsing mode by default (DiD)

Fixed several stability and memory safety hazards. (DiD)

Fixed an issue where files could inadvertently be executed with the designated file type handler instead of opened. (CVE-2019-17019)

Fixed an issue with the JavaScript JIT compiler that could lead to exploitable crashes. (CVE-2019-17026) actively exploited

Posted: **Wed Jan 29, 2020 6:58 pm**

We've pushed the new 28.8.2 release into our main repository!

* New small bugfix and compatibility update:
- Reverted the addition of JavaScript regular expression lookarounds since
the implementation caused crashes. We'll have to revisit this later.
- Fixed an issue where FTP servers would hang the browser if they were not
sending answers according to the protocol specification.
- Added a workaround for GitHub trying to enforce more Google-isms (which we
don't support at this time) to browsers that identify as "Firefox-alike".

Posted: **Wed Feb 05, 2020 4:35 pm**

The new 28.8.2.1 release should be hitting the main repos.

This is a minor release in response to YouTube deprecating their old web UI. This change will enable the new YouTube UI by default.

Posted: **Wed Feb 19, 2020 2:38 pm**

We have updated Pale Moon to 28.8.3.

This is a regular maintenance bugfix and security release.

Changes/fixes:

Fixed an issue in CSP blocking requests without a port for custom schemes.
Fixed a potentially hazardous crash in layers.
Fixed random crashes on some sites using IndexedDB.
Changed the way the application can be invoked from the command-line to prevent a whole class of potential exploits involving modified omnijars.
If your special-needs environment requires that you launch the browser with custom browser/gre omnijars from the command-line, you must set the UXP_CUSTOM_OMNI environment variable before launch from this point forward.
Fixed an issue in the html parser after using HTML5 template tags, allowing JavaScript parsing and execution when it should not be allowed, risking XSS vulnerabilities on sites relying on correct operation of the browser. (CVE-2020-6798)

Posted: **Wed Feb 19, 2020 4:04 pm**

Thank You!

Posted: **Sun Apr 12, 2020 9:40 pm**

Updating to 28.9.1 in the main repo:

This is a minor security and bugfix release.

Re-imported the ExtensionStorage js module for use by browser extensions.

Fixed an issue with the WebRequest module having erroneously un-processed build directives in it. This might have caused some subtle breakage.

Removed the use of high-resolution Windows system timers from the layout refresh driver; this should help with some performance and battery life issues.

Fixed an issue where various parts of hardware acceleration weren't properly linked when changing the option from preferences.

If you have changed the preferences option to "use hardware acceleration when available" between 28.9.0 and this release, it is recommended that you go into preferences and toggle the option off/on to the preferred setting to correct any discrepancies.

Fixed an issue with building the user-agent string using the build date as ID.

Fixed an issue with the release of document content viewers (CVE-2020-6819). DiD

Fixed an issue with handling functions with rest parameters. DiD

Unified XUL Platform Mozilla Security Patch Summary: 2 Defense-in-depth, 14 not applicable

Posted: **Sun May 03, 2020 1:30 am**

Updated to 28.9.2 in the main repo.

* Minor update for stability and compatibility:
- Re-based the 28.9 version of browsers on a separate development branch
that excludes the extensive work being done for Google WebComponents, to
avoid potential performance and stability issues caused by as-of-yet
incomplete and in-progress code for the new milestone.
- Enabled DOM High Resolution timestamps for compatibility with websites
that strictly rely on them for operation.
- Added a preference to allow copying the unescaped URL from the address bar
(especially useful for internationalized domain names and paths). To
enable this, set browser.urlbar.decodeURLsOnCopy to true in about:config
- Fixed several application crashes (thanks, Fysac!)

Posted: **Mon Jun 08, 2020 12:00 am**

Updated to 28.10.0 in the main repo!

This is a development, bugfix and security update.

Changes/fixes:

Implemented URLSearchParams' sort() function
Implemented ES2020 globalThis for web compatibility
Improved our WebM media parser to be more tolerant to different encoding styles.
Improved our MP3 media parser to be more tolerant to different encoding styles and particularly tiny files/stream chunks.
Improved performance of table drawing for more corner cases
Changed the way images without a src are handled in page layouts to align with the Chrome-pushed spec.
Added modern MIPS support
Split out the ICU data file from xul.dll on Windows
Fixed a regression in WebAudio channel handling due to a landed security fix.
Fixed a regression preventing scripting from properly disabling input controls
Fixed an issue with border radius sometimes not being honored in tables
Fixed some build issues in non-standard configurations.
Removed more telemetry code
Removed the in-browser speech recognition engine and API
Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
Changed handling of braille blanks in the ui (CVE-2020-12409) DiD
Mitigated a potential timing attack against DSA keys in NSS (CVE-2020-12399)

Posted: **Mon Jun 08, 2020 10:22 am**

Thank you! Sometimes I have to use Firefox or Chrome, but I hope Pale Moon can stay relevant on a chromified Web.

Posted: **Wed Jul 15, 2020 4:47 pm**

Stevo wrote: Mon Jun 08, 2020 12:00 am Updated to 28.10.0 in the main repo!

Pale Moon 28.11.0 released yesterday:

This is a development, bugfix and security update.

Changes/fixes:

Changed storage format for certificates and passwords to SQLite.
Added a preference (browser.tabs.insertAllAfterCurrent) to enable always adding new tabs after the current tab, whether related or not.
Changed the way Firefox extensions are displayed in the add-on manager (provide a clear warning).
Denied other types of add-ons that aren't explicitly targeting Pale Moon's ID.
Improved the browser's DPI-awareness to be per-monitor instead of system-wide, on supported Windows operating systems.
Updated bookmark backups code with the other half of what should have been done way back when, so they work fully as-intended.
Added a preference (browser.bookmarks.editDialog.showForNewBookmarks) to enable immediately showing the edit dialog for new bookmarks.
If set to true, clicking the star in the address bar will pop open the edit dialog immediately for changing details/sorting.
Fixed the useragent string in native mode, and updated UA code to properly respond to live changes to some preferences.
Tidied up front-end browser JavaScript.
Changed the way sources are compiled (on-going de-unification).
Improved compatibility with gcc v10
Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
Fixed some build issues in non-standard configurations.
Fixed wrong positions when calculating the position for position:absolute child inside a table.
Aligned file name extension of saved url files with other applications (lower case)
Fixed building with --disable-webspeech (to disable speech synthesis)
Added global menubar support for GTK.
Implemented node.getRootNode
Implemented AbortController (Abort API)
Improved the uninstaller to use elevation when prudent and actually remove program files.
Fixed a rare issue with editable page content.
Fixed a crash related to ES module scripts.
Aligned ES module scripting better with the current spec and removed eager instantiation.
Fixed a potential issue with the JPEG encoder. (CVE-2020-12422) DiD
Fixed a potential issue with AppCache manifests. DiD
Fixed a potential crash in JavaScript date parsing.
Fixed a problem with RSA key generation that would make it potentially vulnerable to side-channel attacks. (CVE-2020-12402)
Fixed a potential crash due to multithread race condition. DiD
Fixed a correctness issue in URL handling. (CVE-2020-12418) DiD

Posted: **Sat Jul 18, 2020 3:11 pm**

Updated to 28.11.0 in the main repo:

Changed storage format for certificates and passwords to SQLite.
Added a preference (browser.tabs.insertAllAfterCurrent) to enable always adding new tabs after the current tab, whether related or not.
Changed the way Firefox extensions are displayed in the add-on manager (provide a clear warning).
Denied other types of add-ons that aren't explicitly targeting Pale Moon's ID.
Improved the browser's DPI-awareness to be per-monitor instead of system-wide, on supported Windows operating systems.
Updated bookmark backups code with the other half of what should have been done way back when, so they work fully as-intended.
Added a preference (browser.bookmarks.editDialog.showForNewBookmarks) to enable immediately showing the edit dialog for new bookmarks.
If set to true, clicking the star in the address bar will pop open the edit dialog immediately for changing details/sorting.
Fixed the useragent string in native mode, and updated UA code to properly respond to live changes to some preferences.
Tidied up front-end browser JavaScript.
Changed the way sources are compiled (on-going de-unification).
Improved compatibility with gcc v10
Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
Fixed some build issues in non-standard configurations.
Fixed wrong positions when calculating the position for position:absolute child inside a table.
Aligned file name extension of saved url files with other applications (lower case)
Fixed building with --disable-webspeech (to disable speech synthesis)
Added global menubar support for GTK.
Implemented node.getRootNode
Implemented AbortController (Abort API)
Improved the uninstaller to use elevation when prudent and actually remove program files.
Fixed a rare issue with editable page content.
Fixed a crash related to ES module scripts.
Aligned ES module scripting better with the current spec and removed eager instantiation.
Fixed a potential issue with the JPEG encoder. (CVE-2020-12422) DiD
Fixed a potential issue with AppCache manifests. DiD
Fixed a potential crash in JavaScript date parsing.
Fixed a problem with RSA key generation that would make it potentially vulnerable to side-channel attacks. (CVE-2020-12402)
Fixed a potential crash due to multithread race condition. DiD
Fixed a correctness issue in URL handling. (CVE-2020-12418) DiD
Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 4 defense-in-depth, 10 not applicable.

Posted: **Sat Aug 08, 2020 1:52 am**

Updated to 28.12.0 in the main repo!

v28.12.0 (2020-08-04)
This is a development, bugfix and security update.

Changes/fixes:

Added controls for WASM to the browser's preferences, and enabled by default.
Enabled various arbitrarily-disabled CSS functions.
Added the use of basic path descriptors (i.e. polygon) to css clip paths.
Implemented multithreaded request signal handling for the Abort API. Please see implementation notes below.
Updated the included US-English dictionary, adding approximately 2500 additional words.
Removed the DOM battery API. This was already disabled for privacy reasons for a long while.
Fixed an erroneous warning displayed on toolkit-only add-ons like supplied dictionaries.
Fixed an issue with the sessionstore tab load preference.
Improved the generation of the names of downloaded files to prevent confusion. (CVE-2020-15658)
Fixed a code issue with base64 encoding of data.
Fixed 2 safety hazards in JavaScript. (One being CVE-2020-15656) DiD
Fixed a spec compliance issue with regards to the cross-origin loading of scripts. (CVE-2020-15652)
Improved the loading of a system DLL on Windows, preventing low-risk hijacking potential. (CVE-2020-15657) See implementation notes.
Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 defense-in-depth, 15 not applicable.

Posted: **Wed Aug 12, 2020 11:14 am**

Thanks. WASM is now enabled by default so photopea.com works out of the box.

Posted: **Mon Sep 07, 2020 11:05 pm**

We now have 28.13.0 in the main repo!

Release notes are here.

This release also will appear in XFCE's preferred browser settings, thanks to work by our fehlix.

Posted: **Tue Sep 29, 2020 6:48 pm**

Just finished building and sending 28.14.0 to the main repos. It may take a day or so to appear there, but you can download my upload (378 M) and manually install the debs in it early, too: https://drive.google.com/file/d/1RipEOa ... sp=sharing

Never mind--just got this PM forum message:

You will want to halt your builds and stand by for a point release to fix a crash introduced in the new ResizeObserver.

Posted: **Wed Sep 30, 2020 2:19 pm**

28.14.1 now on the way to main repo to fix crashiness introduced with new feature in 2.14.0.

Early birds can download and install the deb from this 378 M zip: https://drive.google.com/file/d/1ugLH9K ... sp=sharing

Posted: **Tue Oct 06, 2020 6:21 pm**

Updated to 28.14.2 in the main repo to stop more crashes due to that same new feature.

Posted: **Thu Oct 29, 2020 8:20 am**

28.15.0 should appear in the main repo shortly.

* This is a standard development and bugfix release.
- Implemented support for CSS caret-color.
- Implemented support for un-prefixed ::selection CSS pseudo-element styling.
- Fixed another potential crashing scenario in ResizeObservers.
- Fixed several crashes in the DOM Fetch API.
- Fixed a crash in table pagination.
- Security issues fixed: CVE-2020-15680 (VG-VD-20-115) and several memory safety hazards.
- Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 defense-in-depth, 12 not applicable.

Posted: **Wed Feb 03, 2021 6:15 pm**

29.0.0 should be in the main repo soon. This is a milestone update,and it still a gtk+2 version.

Posted: **Wed Feb 03, 2021 6:30 pm**

Anxious to give it a spin, thanks.

Posted: **Sat Feb 13, 2021 1:57 pm**

Thanks, it works well. (v29.0.1)

Posted: **Wed Mar 31, 2021 9:01 pm**

For x86 users, we have 29.1.1 GTK2 now in the main repo and GTK 3 in test.

Posted: **Fri Apr 02, 2021 4:00 pm**

Stevo wrote: Wed Mar 31, 2021 9:01 pm For x86 users, we have 29.1.1 GTK2 now in the main repo and GTK 3 in test.

Any idea when this will reach the repo?
There are 29.1.1 packages for MX 19 and MX 21, but MX 17 is still at 29.1.0

Posted: **Fri Apr 02, 2021 5:06 pm**

My mistake, I haven't had time to build those four yet, and may not even tomorrow. You could get the single debs from the OBS repo for Stretch until they are, though:

https://build.opensuse.org/package/show ... r/palemoon
https://build.opensuse.org/project/show ... emoon-GTK3

Posted: **Fri Apr 02, 2021 5:47 pm**

The armhf version installers and runs without problem. Thanks.

Posted: **Fri Apr 02, 2021 9:37 pm**

Great to hear!

I remembered that since PM doesn't generate but one deb, it's not a pain to let the OBS build the packages for me and saves a lot of time, so I did that. You can get the debs here early: https://drive.google.com/file/d/1MD9Oot ... sp=sharing

Posted: **Wed Apr 28, 2021 5:24 pm**

Pale Moon 29.2.0 was released yesterday, and the i386 and amd64 builds for GTK 2 and GTK 3 have finished and are available in their respective main and test repos.

Posted: **Wed Nov 10, 2021 5:58 pm**

OK...all versions of 29.4.2, the new release, have built now, and we'll soon have the usual gtk2 version in main and the gtk3 version in the test repo for amd64 and i386 architectures.

Posted: **Fri Jan 21, 2022 3:52 pm**

29.4.4 GTK 2 packages are now in the main repository, with the GTK 3 versions in testing to allow the user to install either one.

* This is a security update:
- Improved application library loading security. DiD
- Fixed an issue in JavaScript serialization. DiD
- Fixed a potential out-of-bounds issue in IndexedDB. DiD
- Fixed a potential issue in widget data handling code. DiD
- Fixed potentially exploitable crashes in handling truncated/corrupt media
files or streams.
- Fixed an issue in the DOM FileReader code.
- Updated NSS to 3.52.3 to address a security issue.
- Fixed the following security issues: CVE-2022-22736, CVE-2022-22741,
CVE-2021-4140, CVE-2022-22746, CVE-2022-22744 and CVE-2022-22747.

Posted: **Tue Mar 29, 2022 2:25 pm**

Stevo wrote: Fri Jan 21, 2022 3:52 pm 29.4.4 GTK 2 packages are now in the main repository, with the GTK 3 versions in testing to allow the user to install either one.

Pale Moon 29.4.5.1 just released.

Please, Stevo, package it for MX-21 (GTK2/GTK3)

Release Notes: https://www.palemoon.org/releasenotes.shtml

Code: Select all

v29.4.5.1 (2022-03-29)
This is a bugfix update to address performance issues due to caching.

v29.4.5 (2022-03-23)
This is a security update.

Changes/fixes:

    Fixed several application crash scenarios. DiD
    Fixed a number of thread locking/mutex issues. DiD
    Fixed a leak of content types due to inconsistent error reporting. (CVE-2022-22760)
    Fixed an issue with iframe sandboxing not being properly applied. (CVE-2022-22759)
    Fixed a potential leak of bookmarks from the exported bookmarks file if it included a malicious bookmarklet.
    Fixed an issue with drag-and-drop. (CVE-2022-22756)
    Fixed a potential crash due to truncated WAV files.
    Fixed a memory safety issue with XSLT. (CVE-2022-26485)

Posted: **Tue Mar 29, 2022 6:55 pm**

Yeah, 29.4.5.1 x86 builds are uploaded for main--armhf packages take much longer to build.

I spent much time on the 29.4.5 packages only to have to pull them from the repo due to the bug.

MX Linux Forum

MX 17/18 Repository: The Pale Moon Browser Thread

MX 17/18 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread

Re: MX 17 Repository: The Pale Moon Browser Thread