#156 Consider changing Worker protection from Remove to Strict
Opened by polcak. Modified

Summary

The default JShelter JSS level used to include Strict protection. However, due to pages like https://www.mkdocs.org/ (https://pagure.io/JShelter/webextension/issue/80#comment-832837, https://pagure.io/JShelter/webextension/issue/80#comment-852202), we decided to switch to remove workers by default.

Later several pages appeared to break when Worker is not present and we decided to modify JShelter settings on these pages https://pagure.io/JShelter/webextension/blob/main/f/common/settings_tweaks.js#_23. Recently, #155 appeared and it looks like Anubis is deployed on many FLOSS projects and breaks with JShelter. But Chromium-based browsers do not break with Strict. I think that it will not be possible to maintain a list of domain running Anubis while Remove helps only to https://www.mkdocs.org/ and https://wiki.orc.gmu.edu/mkdocs/ that we know of.

Firefox-based browsers might get working with Anubis once we resolve #43 and #80.

I am wandering if it is time to change Worker setting to Strict by default and add exceptions to mkdocs.org/ and wiki.orc.gmu.edu. However, there might be a lot of pages like these as well.

Setup

Is there a way how to make more informed decision?


Metadata Update from @polcak:
- Issue tagged with: design decision, project policy

See https://pagure.io/JShelter/webextension/issue/148#comment-971371, JShelter in Firefox interacting with pages hosted by Cloudflare is another reason to switch Worker from Remove to Strict.

Metadata