76

Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't ...


47

You have Data Saver turned on in the settings of Google Chrome. It proxies all your HTTP (not HTTPS or incognito) traffic through an optimisation server at Google to make the pages smaller.


41

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...


33

When "Expires" and "Cache-Control" headers are not specified, but a "Last-Modified" header is specified, browsers have to guess at how long they should keep the document in cache. Some browsers do use algorithms that let the page remain in cache for a day or more. Google caching best practices guide states: Last-Modified is a "weak" caching header in ...


32

Source Recently started to delete downloads claiming 'virus or spyware'. "Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window." ... Firefox uses data from Google's "Safe Browsing" project to assess the reputation of websites and downloads. Every ...


31

Updated answer for 2017: Yes. The size column in the Network tab in Chrome Developer Tools has both the compressed and uncompressed size, for gzip, brotli and whatever comes in future. Eg: Here the compressed size is 242 KB, the uncompressed size is 1.1 MB To see both, ensure you have Devtools showing large request rows. It's the first icon in "View" ...


25

Dec. 2018 edit RawGit is now sunsetting due to malicious usage, so they recommend to use one of the following services instead: jsDelivr GitHub Pages CodeSandbox unpkg Original post Rawgithub.com allows users to take the "Raw" versions of a Git and turn it into a URL usable in <script> tags. It's quite easy to use, simply remove the first . from ...


19

I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.


16

The problem you have is out of your control since this is how the hosting is setup at Github on the path that you have mentioned, Extension type is not only the factor when it comes to executing files since the web hosting can over-rule how a browser renders a file. You could have a .zip file rendering as a .html file if the host was setup to do so, you can ...


14

Basically it started because some websites used to sniff the user-agent to tell what browser someone was using so they could block browsers that they thought wouldn't work with their websites. Specifically, websites were blocking Internet Explorer because it didn't offer as many features as Netscape Navigator. Instead of simply building a website that works ...


14

Because Microsoft Edge presents a User-Agent string that contains the word Chrome. And, for that matter, Safari. Check out http://whatsmyuseragent.com/ and you'll see something like this: (Emphasis mine) This is deliberate on Microsoft's behalf to fool naïve user-agent checks into thinking that it's not Internet Explorer. Which it isn't.


12

I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress? <script type='text/javascript' src='http://www.andreszsogon.com/wp-content/themes/contango/lib/js/superfish/superfish-combine.min.js?ver=1.5.9'></script&...


10

Ironically the answer is on this page and every other Stack Exchange site :) You have to define an OpenSearchDescription for your site. If you look at the source code of this page you will see in the header: <link rel="search" type="application/opensearchdescription+xml" title="Pro Webmasters - Stack Exchange" href="/opensearch.xml"> And if you ...


9

Update for 2017 When using large icons, the chrome dev tools show a before and after compression size in the network tabs. I confirmed by switching gzip off and on on my webserver.


9

Basically, you need to force the download of the PDF file. If you edit the .htaccess file and add this code, all PDF files should be downloaded instead of opened in your site. <FilesMatch "\.(?i:pdf)$"> ForceType application/octet-stream Header set Content-Disposition attachment </FilesMatch> If that's not an option, add a message ...


8

You must type (not copy-paste) the entire Javascript (including "javascript:") into the address bar to execute Javascript - Chrome will strip the "javascript:" protocol specification and treat your Javascript as a search if your last action in the address bar is copy-pasting. A more convenient way to execute arbitrary Javascript in Chrome would be to open ...


8

...compressed the app's EXE with UPX compressor... ~10 years ago, UPX was commonly used by viruses to make them more difficult to detect and reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue. You really only have two options: Use VirusTotal ...


7

It turns out I had a desktop version of the "Open Sans Light" font installed in my Windows machine. After reading this thread: Issue 340: Open Sans 400 is showing as condensed light in Chrome and uninstalling the font, the issue went away.


6

You are sending the Content-Type: application/octet-stream header, presumably hoping to trigger the browser to download the file instead of letting the user view it. This however is not really the best way. You are better of with sending the correct content type and add a content disposition header, like so: Content-Type: video/mp4 Content-Disposition: ...


6

The file extension is irrelevant, it's the Content-Type header that matters, and that file is served with a text/plain content type (which is the purpose of Github's "raw" view). You should really download a copy of the file locally to your site and include it from there. Even if it did work from Github, since you're not loading the JS file asynchronously, ...


6

no-cache is not as strong as no-store. Chrome's documentation indicates that no-cache indicates a re-usable document, while no-store indicates that it should not be re-used. Based on this information, your Cache-Control header should simply be: Cache-Control: no-store The extra values in it may be letting Chrome pick and choose which it would like to ...


6

This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to adopt the use of SSL certificates. According to Google's Developer Blog: Eventually, Chrome will show a Not Secure warning for all pages served over ...


5

From https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/ There's a proposal to add the .localhost domain as a new standard, which will make lives of developers way easier. It would mean site.localhost and everything at *.localhost would automatically translate to 127.0.0.1, without /etc/hosts or dnsmasq workarounds. Refer the RFC here.


5

Ah, found another way to get it working: Click the 3 dots to the top right, then More Tools, then select Animations


5

Assuming that you have a search feature on your site then you can take advantage of the OpenSearch functionality in Chrome. Taken from the Chromium documentation: To enable this for all users (even those who haven't used your search form): On your site's homepage provide a link to an OpenSearch description document. The link to the OSDD is placed in the ...


4

Another way to accomplish this is with cURL: curl -i -H "Accept-Encoding: gzip" http://someurl.com | wc -c versus curl -i http://someurl.com | wc -c The number shown after each command is the number of bytes that crossed the wire.


4

Looking into Chrome source code, those numbers 6, 9 or similar are order numbers of enum. In case of 6, this is NETWORK_ERROR, in case of 9 it is SECURITY_ERROR. Here is source showing that if given error is SERVER_ERROR it will put response code, but if it isn't SERVER_ERROR it will map its error to enum value, and this enum is defined here and the codes ...


4

Do all subdomains need to use HTTPS? Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, otherwise connecting will fail, so practically you will want all subdomains to use HTTPS. Can I apply to the HSTS preload list with a subdomain, like sub.example.com?...


4

I have an application that has started seeing this issue around noon on Nov 20, 2014 (Eastern), with near the exact same issues mentioned. I was able to connect with one of our users who indicated she was using the Hola.org plugin and I was then able to reproduce the error after installing it myself on Chrome. Funny thing is although my site was ...


Only top voted, non community-wiki answers of a minimum length are eligible