76

Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't ...


49

Updated answer for 2017: Yes. The size column in the Network tab in Chrome Developer Tools has both the compressed and uncompressed size, for gzip, brotli and whatever comes in future. Eg: Here the compressed size is 242 KB, the uncompressed size is 1.1 MB To see both, ensure you have Devtools showing large request rows. You can find the checkbox by the ...


47

You have Data Saver turned on in the settings of Google Chrome. It proxies all your HTTP (not HTTPS or incognito) traffic through an optimisation server at Google to make the pages smaller.


41

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...


36

When "Expires" and "Cache-Control" headers are not specified, but a "Last-Modified" header is specified, browsers have to guess at how long they should keep the document in cache. Some browsers do use algorithms that let the page remain in cache for a day or more. Google caching best practices guide states: Last-Modified is a "weak" caching header in ...


33

You can't prevent it, you can only stop people who don't understand coding. Generally it is done with Javascript which is easy to disable. Further, it is a trivial matter to take a screenshot of an image. If you are actually talking about hot linking (displaying images from your server on another site) that can be done via .htaccess.


32

Source Recently started to delete downloads claiming 'virus or spyware'. "Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window." ... Firefox uses data from Google's "Safe Browsing" project to assess the reputation of websites and downloads. Every ...


26

Dec. 2018 edit RawGit is now sunsetting due to malicious usage, so they recommend to use one of the following services instead: jsDelivr GitHub Pages CodeSandbox unpkg Original post Rawgithub.com allows users to take the "Raw" versions of a Git and turn it into a URL usable in <script> tags. It's quite easy to use, simply remove the first . from ...


24

By definition, if a visitor can view an image, it has already been downloaded. That's how a web page works. You can however use a variety of tactics to make it more difficult to do so. As you've mentioned, using JavaScript to interfere with the normal contextual menu is an option. However, that won't work if the user has disabled JavaScript on their browser. ...


19

I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.


16

The problem you have is out of your control since this is how the hosting is setup at Github on the path that you have mentioned, Extension type is not only the factor when it comes to executing files since the web hosting can over-rule how a browser renders a file. You could have a .zip file rendering as a .html file if the host was setup to do so, you can ...


14

Because Microsoft Edge presents a User-Agent string that contains the word Chrome. And, for that matter, Safari. Check out http://whatsmyuseragent.com/ and you'll see something like this: (Emphasis mine) This is deliberate on Microsoft's behalf to fool naïve user-agent checks into thinking that it's not Internet Explorer. Which it isn't.


12

I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress? <script type='text/javascript' src='http://www.andreszsogon.com/wp-content/themes/contango/lib/js/superfish/superfish-combine.min.js?ver=1.5.9'></script&...


11

Update for 2017 When using large icons, the chrome dev tools show a before and after compression size in the network tabs. I confirmed by switching gzip off and on on my webserver.


10

Basically, you need to force the download of the PDF file. If you edit the .htaccess file and add this code, all PDF files should be downloaded instead of opened in your site. <FilesMatch "\.(?i:pdf)$"> ForceType application/octet-stream Header set Content-Disposition attachment </FilesMatch> If that's not an option, add a message ...


9

...compressed the app's EXE with UPX compressor... ~10 years ago, UPX was commonly used by viruses to make them more difficult to detect and reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue. You really only have two options: Use VirusTotal ...


9

One more trick to make it a little harder, which also works with Javascript disabled. Use CSS to position a transparent element over the image, so that right clicking it does not show the image-related options. Or, for added confusion, overlay a transparent image on top, so that right clicking downloads the wrong image. Example: https://www.w3schools.com/...


7

Do all subdomains need to use HTTPS? Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, otherwise connecting will fail, so practically you will want all subdomains to use HTTPS. Can I apply to the HSTS preload list with a subdomain, like sub.example.com? ...


7

It turns out I had a desktop version of the "Open Sans Light" font installed in my Windows machine. After reading this thread: Issue 340: Open Sans 400 is showing as condensed light in Chrome and uninstalling the font, the issue went away.


7

From https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/ There's a proposal to add the .localhost domain as a new standard, which will make lives of developers way easier. It would mean site.localhost and everything at *.localhost would automatically translate to 127.0.0.1, without /etc/hosts or dnsmasq workarounds. Refer the RFC here.


7

Assuming that you have a search feature on your site then you can take advantage of the OpenSearch functionality in Chrome. Taken from the Chromium documentation: To enable this for all users (even those who haven't used your search form): On your site's homepage provide a link to an OpenSearch description document. The link to the OSDD is placed in the ...


6

The file extension is irrelevant, it's the Content-Type header that matters, and that file is served with a text/plain content type (which is the purpose of Github's "raw" view). You should really download a copy of the file locally to your site and include it from there. Even if it did work from Github, since you're not loading the JS file asynchronously, ...


6

Another way to accomplish this is with cURL: curl -i -H "Accept-Encoding: gzip" http://someurl.com | wc -c versus curl -i http://someurl.com | wc -c The number shown after each command is the number of bytes that crossed the wire.


6

From the Wikipedia entry for .localhost (TLD): As a top-level domain, the name has traditionally been defined statically in host DNS implementations with address records (A and AAAA) pointing to the same loopback addresses. However, as you have found, it would appear that it's just Chrome and later versions of Opera (possibly the WebKit browsers, so ...


6

no-cache is not as strong as no-store. Chrome's documentation indicates that no-cache indicates a re-usable document, while no-store indicates that it should not be re-used. Based on this information, your Cache-Control header should simply be: Cache-Control: no-store The extra values in it may be letting Chrome pick and choose which it would like to ...


6

This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to adopt the use of SSL certificates. According to Google's Developer Blog: Eventually, Chrome will show a Not Secure warning for all pages served over ...


5

Ah, found another way to get it working: Click the 3 dots to the top right, then More Tools, then select Animations


5

"It feels like I have spyware on my computer." Oh, it's much worse than that. There is spyware on everything but your computer, probably. Grapeshot is an Oracle service. Here are a few quotes from the crawler explanation page: Oracle Data Cloud assists advertisers placing contextual advertising on web pages. Pages are only visited on demand. If ...


4

Looking into Chrome source code, those numbers 6, 9 or similar are order numbers of enum. In case of 6, this is NETWORK_ERROR, in case of 9 it is SECURITY_ERROR. Here is source showing that if given error is SERVER_ERROR it will put response code, but if it isn't SERVER_ERROR it will map its error to enum value, and this enum is defined here and the codes ...


Only top voted, non community-wiki answers of a minimum length are eligible