build01491: 2021-05-02

Freenet 0.7.5 build 1491 is now available.

This build is a bugfix release.
It ships cleanup to the pitch black defense and to streaming video and audio in the browser.

For the pitch black defense, it disables defensive swapping
if swapping is disabled in general because the node uses opennet.
This should resolve problems to the network structure and data persistence
introduced during the pitch-black fix because
opennet nodes started swapping when they had network-issues (Sorry for that :-().
Also it delays the pitch black defense to 10 minutes after startup instead of 1 minute after startup
to further reduce the probability of stray swapping.
Mitigating the Pitch Black Attack is funded by NLnet through the NGIO PET fund with financial support from the European Commission's Next Generation Internet programme.

Sidenote: If you have a Freenet project, that might be a good match for the Assure grant or the Search and Discovery grant, have a look at their site! The two application periods are open until first of June and a good match for individuals who want to get funding for concrete improvements: https://nlnet.nl/themes/

For streaming, this release fixes operation over proxies that provide a http node via https,
and it adds m3u compability for mobile devices - thanks to DC*
(some mobile browsers answer the query "supports m3u" with "maybe" O_o).

Further improvments in this release:

• Improve OpenBSD support thanks to jv@D7b92AQB2664AkrR.
• Fix plugin compatibility problems from refactoring.
• More cleanup of old code thanks to Jan Gerritsen.
• Fix label for logged attribute RoutingDisabled - thanks to Jan Gerritsen

Thank you for using Freenet!

• Arne Babenhauserheide

Developer changelog:

2021-05-02

Changes in 1491:

• disable pitch black defense if swapping is disabled because the node uses opennet
  this should resolve problems to the network structure
  introduced during the pitch-black fix because
  opennet nodes started swapping when they had network-issues.
  Sorry for that :-(

• start pitch black defense 10 minutes after startup, not 1 minute after startup
  further reduce the probability of stray swapping

• fix streaming: deal with proxies providing a http node via https
  streaming should now work over proxies.

• m3u compability for mobile devices - thanks to DC*
  some mobile browsers answer the query "supports m3u" with "maybe" O_o

• add OpenBSD support thanks to jv@D7b92AQB2664AkrR

• Add compatibility method for plugins (SCGIPublisher needs it)

• recover constructor for compatibility with plugins

• Fixed several unused variables issues - thanks to Jan Gerritsen

• Fix label for logged attribute RoutingDisabled - thanks to Jan Gerritsen

• Arne Babenhauserheide

---

Arne Babenhauserheide (6):
start pitch black defense 10 minutes after startup, not 1 minute after startup
fix: deal with proxies providing a http node via https
disable pitch black defense if swapping is disabled
add OpenBSD support thanks to jv@D7b92AQB2664AkrR
Add compatibility method for plugins (SCGIPublisher needs it)
recover constructor for compatibility with plugins

Arne Babenhauserheide (freenet releases) (3):
Update default bookmark editions
Update default bookmark editions
Build 1491

DC* (1):
m3u compability for mobile devices

Jan Gerritsen (2):
Fixed several unused variables issues
Fix label for logged attribute RoutingDisabled

testing-build-1491-pre1

testing

build01491-pre1

Merge branch 'pitch-black-defense-after-10-minutes' into next

build01490: 2021-03-14

Freenet 0.7.5 build 1490 is now available.

This release provides three different changes:

• streaming in the browser,
• mitigating the pitch black attack, and
• providing the windows-installer from the node again.

For streaming, it builds on the m3u-filter to provide
direct in-browser streaming. Currently
it works with audio (mp3 and ogg vorbis)
and video (ogg theora) in sufficient quality for
music playlists and specially crafted video-streams.

With this change, adding a media-tag that references an m3u-list like

<audio src="stream.m3u" controls="controls">
not supported?
</audio>

or

<video src="stream.m3u" controls="controls">
<a href="stream.m3u">stream.m3u</a>, starting with <a href="sff-001.ogv">sff-001.ogv</a>.
    Putting the first video here causes freesitemgr to more likely
    put the first video into the container, giving faster initial startup.
</video>

In Sharesites you need to add at least one space before the tag.

There are three example sites:

• Audio-Playlist: USK@1wpsnrzb9fiFmmq6OozoZ0Mnk376AlizUKjKPh3TXwM,CwfRO8X0xaCUzH28eoHigxUV-5TkRV8hCoQdO2kmsQM,AQACAAE/streaming-over-fproxy/3/
• Streaming Video: USK@UGh1rxaHczJVr4k4LwxWrxFBc-Dt5P0F3IuPONpp8ZQ,klWF5g9B2PLst8tRO8c9tzk6XvisGynFVJRzM8-9718,AQACAAE/stream-36c3-sff/3/
• Radio Interview: USK@4DQ15JpGlVGDdyXvQE3Egz7SLK2TzMAUmp~aptnwyt4,ljFASreV8AHaQhscfrNLuVyl3qksltgP9sndtLuUHB8,AQACAAE/stream-radiocc-freenet/1/

This follows an old idea to enhance freesites with strictly checked interactivity,
similar to userscripts but without the security implications of adding a script
that might have a very different threat model than Freenet itself.

Also this release ships a mitigation for the pitch black attack.
For details see https://www.mail-archive.com/[email protected]/msg55182.html

Mitigating the pitch black attack is supported by NLnet
as part of the NGI0 PET Fund.
For details see https://nlnet.nl/project/Freenet-Routing/
Thank you!

There are still more tests needed to ensure that the change suffices
to resolve the main objection that existed among people well-versed
in the technical background of Freenet, GNUnet, and others
against using the friend-to-friend mode of Freenet since 2007.

It used to be far too easy to break a pure friend-to-friend net
Arne Babenhauserheide
(all nodes using high-security mode). This should be resolved now.

And finally the UOM transfer max sizes were tripled,
so the windows-installer provided by Freenet nodes gets updated again,
and the annoying warning about freenet-latest-installer-windows.exe
during install and update disappears.

Thank you for using Freenet!

Arne Babenhauserheide

Developer changelog:

2021-03-14

Changes in 1490:

• inject vanilla Javascript m3u-player into Freesites
  to get in-browser playlist streaming (with config to disable if needed).
  Thanks to nextgens and desyncr for the review!
• mitigate the pitch black attack following
  https://www.mail-archive.com/[email protected]/msg55182.html
  Thanks to nextgens and x for the review!
• triple the UOM transfer max sizes
  so the windows-installer provided by nodes gets updated again.
  Thanks to desyncr for the review!

---

  [m3u-player] inject vanilla Javascript m3u-player into Freesites
  [m3u-player] adjust ContentFilterTest: header with script-source
  experiments in location manager, do not compile
  start experimenting with highlevelsimpleclient
  Implement initial untested pitch-black defense
  [m3u-player] prefetch the next three tracks to smooth segment-sizes
  pitchBlack: add intra-day persistency and cleanup
  pitchBlack: fix: decode yesterdays file content as base64
  improve stats (missed commit)
  pitchBlack: also secure the CHK store
  Choose between SSK und Pubkey at random
  create a local variable to hold LocalDateTime.now() and queue next job at beginning to avoid try-block
  use secure random (CSPRNG) for the KSK filename
  cleanup leftover removal: if deletion failed, use deleteOnExit, and only listFiles once.
  replace base64 encoding of file contents by plain UTF-8 encoding.
  only interpret DNF as isRequestExceptionBecauseUriIsNotAvailable (= must swap)
  change prefix of status files
  fix imports
  skip UTF_8 and bufferedWriter: we’re dealing with raw bytes.
  fix imports
  add config option for the m3u-player embedding
  add l10n for config option for the m3u-player embedding
  triple max size for update file transfers to avoid errors due to the larger windows installer
  use constants for the max sizes over update
  Update default bookmark editions
  Update default bookmark editions
  Build 1490

testing-build-1490-pre1

• Add inline m3u-player for streaming over Freenet right from the browser
• Add fix for the pitch-black attack.

Install via new_installer_offline_1490-pre1.jar (on GNU/Linux) or FreenetInstaller-1490-pre1.exe (Windows).

You can also test it, by replacing freenet.jar and freenet.jar.new by the released freenet-testing-build-1490-pre1.jar in an existing Freenet install (stop the node first!).

build01489: 2020-12-15

Freenet 0.7.5 build 1489 is now available.

This release adds an m3u-filter that enables safe access to m3u-playlists.

Together with the existing support for media files
(Audio using mp3, Ogg Vorbis, or Flac, and video using Ogg Theora),
safe playlists make Freenet viable as streaming platform:
You can create an m3u-file and others can
play it right from their media-players (i.e. mpv or vlc).

On the network layer this release adopts
the one safe release from the let-it-burn patchset:
Maximum backoff-times are reduced from 3 hours to 8 minutes.
This might increase bandwidth available.

Also progresspage.js now has a declared license for Libre-JS
and the checkall script was rewritten.

We hope you enjoy using Freenet!

• Arne Babenhauserheide

Developer changelog:

2020-12-15

Changes in 1489:

• Add m3u support with mp3, ogg, oga, ogv, and flac. Thanks to Bombe for reviewing!

• Reduce max backoff times from 3 hours to 8 minutes;
  the one safe change from the let-it-burn patchset.
  This might increase bandwidth available. Thanks to TheSeeker.

• add explicit license for Libre-JS to progresspage.js

• rewrite checkall to match the class for all input elements,
  add explicit license for Libre-JS

• Arne Babenhauserheide

---

Arne Babenhauserheide (46):
prefix links in m3u-files with host+port of the node to allow for local playback with arbitrary keys.
rewrite checkall, match the class for all input elements, and add explicit license for Libre-JS
add explicit license for Libre-JS to progresspage.js
cleanup whitespace
use host and port from request, storing it in the fetch context
FIX: did not skip empty lines terminated with CRLF.
preserve final linebreak on Windows
actually fix merge errors
fix merge error
host→private hostAndPort, otherParams→otherMimeTypeParams, inline
Allow prefetching of inline mp3 and ogg
Remove unused constants
get scheme, host, and port for proxies.
Fix readability
adjust test to use scheme host and port
Fail m3u test on missing files
add spaces around +
remove unnecessary casts
remove single-use constructor again
remove outdated TODO
Use the right header and header-field for host
First split Forwarded header by , then parse only the first entry.
Remove non-existent parameter
fix comment for schemeHostAndPort
check headers against whitelist from fproxy.bindTo and proxy.port
move schemeHostAndPort prefix parsing to easily testable class
add tests and correctly treat default values
simplify: filename in exception
check against null
code-style: braces and spaces in FetchContext
license: GPLv3+ → GPLv2+ (what it should have been)
kill stray newlines
hostAndPort → schemeHostAndPort
ContentFilter: Initialize earlier to simplify code
kill unused variables and imports, outdated or misleading comments
parametrized tests to named test methods
Get Config settings as Options to benefit from the defaults
Do not break line unnecessarily
Move scheme host and port parsing to static parse method.
Fix tests: Still need port fallback.
simplify UriFilterProxyHeaderParser: simple static method
bubble exceptions to test failure
provide default implementation for the previous readFilter interface
deprecated compatibility interface and moved from HashMap to Map
also migrate JPEGFilter.readFilter from HashMap to Map
Add one more compatibility function and deprecate it.

Arne Babenhauserheide (freenet releases) (8):
Update default bookmark editions
update NEWS.md
style: space-comma to comma-space
limit travis checks to Java in debian stable, Java LTS and the most recent GA version.
Update default bookmark editions
Update default bookmark editions
Update default bookmark editions
Build 1489

DC* (1):
Add support for Android VM

TheSeeker (1):
Reduce max backoff times.

babenhauserheide (4):
Add failover for FetchContext reading of old saved requests
Remove parsing of Forwarded header again to reduce the scope
Fail test with exception on first missing file
Remove unused imports

testing-build-1489-pre1

1489 test release

build01488: 2020-11-08

Freenet 0.7.5 build 1488 is now available.

In this build we only updated translations to make Freenet more inviting:

• add Hungarian
• update French

A big thank you to our team at Transifex!

Thank you for using Freenet!

• Arne Babenhauserheide

Developer changelog:

2020-11-08

Changes in 1488:

In 1488 we only updated translations to make Freenet more inviting:

• add Hungarian
• update French

A big thank you to our team at Transifex!

• Arne Babenhauserheide

---

Arne Babenhauserheide (freenet releases) (5):
update french translations — thanks to our transifex team
add hungarian translation, thanks to the transifex team
update NEWS
Update default bookmark editions
Build 1488

build01487: 2020-09-30

Freenet 0.7.5 build 1487 is now available.

The focus of this build are plugin-updates:

• Add KeepAlive which allows keeping files alive in Freenet (ready as official plugin thanks to redwerk),
• plugin-FlogHelper adds audio- and video-tag and more translations,
• Sharesite provides better default CSS (more beautiful sites) and clearer wording,
• Freemail uses the newer WoT API,
• KeyUtils has a small fix to adjust for internal API change (was broken in 1486).
• Add UPnP2 plugin for testing.

Also this build accepts Android Java as not End of Life
to simplify the mobile-node maintenance
(see https://github.com/freenet-mobile/app).

The windows-installer and wintray are now being built by our
continuous integration system using a more secure code-signing setup.
This should reduce the scary warnings on install,
reduces our dependency on specific setup of the release manager,
and provides earlier checks whether something in fred broke the installer.

Thank you for using Freenet!

• Arne Babenhauserheide

Developer changelog:

2020-09-30

Changes in 1487:

• Plugin-updates:
  KeepAlive (redwerk fixes: now ready as official plugin),
  plugin-FlogHelper (audio- and video-tag and more translations),
  Sharesite (better default CSS, clearer wording),
  Freemail (use newer WoT API and cleanup),
  KeyUtils (adjust for internal API change).

• Add UPnP2 plugin for testing.

• Accept Android Java as not EOL to simplify the mobile-node maintenance
  (see https://github.com/freenet-mobile/app).

• Set context class loader when terminating plugin (by Bombe)

• Cleanups of some old deprecated code.

• The windows-installer and wintray are now being built
  by our continuous integration system using a more secure code-signing setup.
  This should reduce the scary warnings on install,
  reduces our dependency on specific setup of the release manager,
  and provides earlier checks whether something in fred broke the installer.

• Arne Babenhauserheide

---

Arne Babenhauserheide (15):
fix indent
replace local static isAndroid() method by static import
cleanup imports
fix indent
remove unused imports again (undo merge error)
Revert "Removed several usages of the deprecated Closer" — overlooked dangers in late-night review; will refile for review.
Increase max size for installers: wininstaller fetched again
Update FlogHelper to version 36
Update Sharesite to version 0.4.8
update Freemail to version 30
Update plugin KeyUtils
add plugin KeepAlive
add plugin UPnP2
Update plugin KeyUtils
add missing name and description for plugins UPnP2 and KeepAlive

Arne Babenhauserheide (freenet releases) (3):
update NEWS
Update default bookmark editions
Build 1487

Curious Ginie (1):
Added definition that source code is encoded in UTF-8 to gradl build definition

DC* (1):
Run sanity checks against given value

David ‘Bombe’ Roden (2):
Set context class loader when terminating plugin
Set context class loader when terminating plugin

Florent Daigniere (2):
fix reproducible builds
Changes to the datastore

Jan Gerritsen (3):
Removed unused imports
Removed several usages of the deprecated Closer
Replaces deprecated Constructors like Byte() or Integer() with Byte.valueOf() or autoboxing

babenhauserheide (2):
accept all Android Java versions as not EOL.
accept all Android Java versions as not EOL.

testing-build-1487-pre2

testing