Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't ...
Updated answer for 2017: Yes.
The size column in the Network tab in Chrome Developer Tools has both the compressed and uncompressed size, for gzip, brotli and whatever comes in future. Eg:
Here the compressed size is 242 KB, the uncompressed size is 1.1 MB
To see both, ensure you have Devtools showing large request rows. You can find the checkbox by the ...
is there any other way to make my connection secured ?
Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...
When "Expires" and "Cache-Control" headers are not specified, but a "Last-Modified" header is specified, browsers have to guess at how long they should keep the document in cache. Some browsers do use algorithms that let the page remain in cache for a day or more.
Google caching best practices guide states:
Last-Modified is a "weak" caching header in ...
You can't prevent it, you can only stop people who don't understand coding.
If you are actually talking about hot linking (displaying images from your server on another site) that can be done via .htaccess.
Source Recently started to delete downloads claiming 'virus or spyware'.
"Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window."
Firefox uses data from Google's "Safe Browsing" project to assess the
reputation of websites and downloads. Every ...
Dec. 2018 edit
RawGit is now sunsetting due to malicious usage, so they recommend to use one of the following services instead:
Rawgithub.com allows users to take the "Raw" versions of a Git and turn it into a URL usable in <script> tags. It's quite easy to use, simply remove the first . from ...
By definition, if a visitor can view an image, it has already been downloaded. That's how a web page works. You can however use a variety of tactics to make it more difficult to do so.
I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.
The problem you have is out of your control since this is how the hosting is setup at Github on the path that you have mentioned, Extension type is not only the factor when it comes to executing files since the web hosting can over-rule how a browser renders a file.
You could have a .zip file rendering as a .html file if the host was setup to do so, you can ...
Because Microsoft Edge presents a User-Agent string that contains the word Chrome. And, for that matter, Safari.
Check out http://whatsmyuseragent.com/ and you'll see something like this:
This is deliberate on Microsoft's behalf to fool naïve user-agent checks into thinking that it's not Internet Explorer. Which it isn't.
I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress?
Basically, you need to force the download of the PDF file.
If you edit the .htaccess file and add this code, all PDF files should be downloaded instead of opened in your site.
Header set Content-Disposition attachment
If that's not an option, add a message ...
...compressed the app's EXE with UPX compressor...
~10 years ago, UPX was commonly used by viruses to make them more difficult to detect and reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue.
You really only have two options:
Use VirusTotal ...
Use CSS to position a transparent element over the image, so that right clicking it does not show the image-related options.
Or, for added confusion, overlay a transparent image on top, so that right clicking downloads the wrong image.
Do all subdomains need to use HTTPS?
Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, otherwise connecting will fail, so practically you will want all subdomains to use HTTPS.
Can I apply to the HSTS preload list with a subdomain, like sub.example.com?
It turns out I had a desktop version of the "Open Sans Light" font installed in my Windows machine.
After reading this thread: Issue 340: Open Sans 400 is showing as condensed light in Chrome
and uninstalling the font, the issue went away.
There's a proposal to add the .localhost domain as a new standard, which will make lives of developers way easier.
It would mean site.localhost and everything at *.localhost would automatically translate to 127.0.0.1, without /etc/hosts or dnsmasq workarounds.
Refer the RFC here.
Assuming that you have a search feature on your site then you can take advantage of the OpenSearch functionality in Chrome.
Taken from the Chromium documentation:
To enable this for all users (even those who haven't used your search form):
On your site's homepage provide a link to an OpenSearch description document. The link to the OSDD is placed in the ...
The file extension is irrelevant, it's the Content-Type header that matters, and that file is served with a text/plain content type (which is the purpose of Github's "raw" view).
You should really download a copy of the file locally to your site and include it from there. Even if it did work from Github, since you're not loading the JS file asynchronously, ...
Another way to accomplish this is with cURL:
curl -i -H "Accept-Encoding: gzip" http://someurl.com | wc -c
curl -i http://someurl.com | wc -c
The number shown after each command is the number of bytes that crossed the wire.
From the Wikipedia entry for .localhost (TLD):
As a top-level domain, the name has traditionally been defined statically in host DNS implementations with address records (A and AAAA) pointing to the same loopback addresses.
However, as you have found, it would appear that it's just Chrome and later versions of Opera (possibly the WebKit browsers, so ...
no-cache is not as strong as no-store. Chrome's documentation indicates that no-cache indicates a re-usable document, while no-store indicates that it should not be re-used.
Based on this information, your Cache-Control header should simply be:
The extra values in it may be letting Chrome pick and choose which it would like to ...
This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to adopt the use of SSL certificates.
According to Google's Developer Blog:
Eventually, Chrome will show a Not Secure warning for all pages served
"It feels like I have spyware on my computer."
Oh, it's much worse than that. There is spyware on everything but your computer, probably.
Grapeshot is an Oracle service. Here are a few quotes from the crawler explanation page:
Oracle Data Cloud assists advertisers placing contextual advertising
on web pages.
Pages are only visited on demand. If ...
Looking into Chrome source code, those numbers 6, 9 or similar are order numbers of enum. In case of 6, this is NETWORK_ERROR, in case of 9 it is SECURITY_ERROR.
Here is source showing that if given error is SERVER_ERROR it will put response code, but if it isn't SERVER_ERROR it will map its error to enum value, and this enum is defined here and the codes ...