Skip to content

chore(desktop): stop bundling uBlock Origin — MarkSyncr blocks now - #78

Merged
ralyodio merged 1 commit into
mainfrom
chore/drop-ublock
Aug 4, 2026
Merged

chore(desktop): stop bundling uBlock Origin — MarkSyncr blocks now#78
ralyodio merged 1 commit into
mainfrom
chore/drop-ublock

Conversation

@ralyodio

@ralyodio ralyodio commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Why

MarkSyncr is already in the bundle for bookmark sync, and it now ships declarativeNetRequest blocking. Verified against the CRX the build actually fetches (v0.8.37):

permissions:            [... declarativeNetRequest ...]
declarative_net_request:
  rules/ads.json        enabled   15,000 rules
  rules/privacy.json    enabled   15,000 rules

Sample rules: ||pagead2.googlesyndication.com^ → block, ||googleadservices.com^ → block, ||stats.g.doubleclick.net^ → block.

Shipping uBlock Origin alongside it means two blockers filtering the same requests, and uBlock was the last reason the default install carried an MV2 extension.

Changed

  • build-release.sh — dropped fetch_ublock(), UBO_SRC, the staging step and the call
  • eslint.config.js, .gitignore — entries that existed only for the fetched tree
  • Comments in the launcher, tronbrowser.cmd, launcher.test.ts

Manifest V2 support stays

It was commented as being for uBlock, but that was never the whole truth. Recent Chromium disables MV2 by default, and letting that kill switch back on would silently break any MV2 extension a user installed themselves. Not bundling one is our call; theirs isn't. Comments reworded to say that accurately.

Verified

Built the linux archive from this branch:

tronbrowser/extensions/ai-sidebar
tronbrowser/extensions/marksyncr
$ tar -tzf ... | grep -i ublock   → none

Lint clean, 169 tests pass.

One thing to be aware of

15,000 + 15,000 = exactly 30,000 static rules, which is Chrome's guaranteed static-rule ceiling across enabled rulesets. It fits, but with no headroom — adding a third ruleset or growing either file would start silently dropping rules. Worth knowing on the MarkSyncr side; not a blocker here.

🤖 Generated with Claude Code

MarkSyncr is already in the bundle for bookmark sync, and it now ships
declarativeNetRequest blocking: two enabled static rulesets, rules/ads.json and
rules/privacy.json, 15,000 rules each. Shipping uBlock Origin alongside it means
two blockers filtering the same requests, and it was the last reason we carried
an MV2 extension in the default install.

Removed the build-time fetch and the staging step, plus the tooling entries that
existed only for it — the eslint ignore and the .gitignore path for a tree we no
longer download.

Manifest V2 support stays. It was commented as being for uBlock, but that was
never the whole truth: recent Chromium disables MV2 by default, and flipping
that kill switch back on would silently break any MV2 extension a user installed
themselves. Not bundling one is our decision to make; theirs isn't.

Verified by building the linux archive: extensions/ are ai-sidebar and marksyncr,
nothing matches ublock, and the staged MarkSyncr manifest carries both rulesets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

93 finding(s)

HIGH/CRITICAL: 6 | MEDIUM: 87

Severity Rule Location
HIGH js-unescaped-html-sink apps/extensions/public/store.js:545
HIGH manifest-typosquat apps/mobile/package.json:35
HIGH js-unescaped-html-sink apps/web/public/dns.js:101
HIGH secret-generic-api-key packages/storage/src/config.ts:51
HIGH secret-generic-credential packages/storage/src/config.ts:51
HIGH secret-generic-credential services/api/src/store/payments.test.ts:11
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:96
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:29
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/settings-sections.js:24
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:77
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:165
MEDIUM insecure-temp-file apps/desktop/src/launcher.test.ts:21
MEDIUM insecure-temp-file apps/desktop/src/tor.test.ts:40
MEDIUM insecure-temp-file apps/desktop/src/tor.test.ts:44
MEDIUM insecure-temp-file apps/desktop/test/launcher.test.ts:92
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:92
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:93
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:104
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:107
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:110
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:155
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:163
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:175
MEDIUM sql-template-interpolation apps/extensions/public/store.js:176
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:222
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:225
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:230
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:282
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:289
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:292
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:302
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:307
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:319
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:419
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:425
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:429
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:449
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:468
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:477
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:481
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:497
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:506

…and 43 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit bfe9cb2 into main Aug 4, 2026
6 checks passed
@ralyodio
ralyodio deleted the chore/drop-ublock branch August 4, 2026 10:27
ralyodio added a commit that referenced this pull request Aug 4, 2026
main moved twice underneath this branch: #77 rewrote the profile-state blocks
and #78 reworded the Manifest V2 comment after uBlock stopped being bundled.
The conflict was that comment — this branch still carried the old wording, with
the GPU block inserted above it. Kept main's wording and the GPU block, ordered
so the block runs before MV2_KEEP is used.

The branch was parked as WIP with no tests, and launcher flag handling is
exactly what this suite covers, so it should not merge without them. Six cases:
each mode's effect on the command line, that `safe` appends Vulkan to the
disable-features list without displacing the MV2 kill switch it shares that
list with, that an unknown mode falls back to `on` and says so, and that
TRONBROWSER_GPU overrides the stored mode. Verified 5 of the 6 fail against
main's launcher; the sixth asserts the default, which holds either way.

Still worth saying plainly: this is an escape hatch, not a diagnosis. Launching
with --disable-gpu did NOT fix the freeze it was written for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant