Userscripts / Customization

StSyaN
It looks like I misremembered.

Security concerns for Stylish are well known, and documented


I've always known the firefox version of Tampermonkey to be untrustworthy, even back when I started. It ships with google analytics and I'm not even sure if it's developed by the same people, so I avoid it to be safe.

Edit: And I don't know about the state of Greasemonkey. iirc it stopped working for a bit and I switched away from it. Heard it got sold or something, which is exactly what caused the downfall of Stylish.

@Mildgyth
Chrome/Webkit versions should be fine. It's really only the firefox addon you have to avoid.

Lé done. I have updated the install instructions for my userscript. I'll repost them here as well so other people can see it.

Installation Instructions:

Before anything make sure you have installed Violentmonkey* for Firefox or Tampermonkey for Chrome, Opera, Safari or Edge

Additional Note:
Because derpibooru has a draconian CSP headers, firefox users are also going to need Laboratory by Mozilla

Install the addon and set it to use the following custom CSP for derpibooru:

screenshot

default-src 'self' https://derpicdn.net; font-src 'self' https://derpicdn.net; img-src 'self' data: https://camo.derpicdn.net https://derpicdn.net; script-src 'self' 'unsafe-inline' https://derpicdn.net; style-src 'self' 'unsafe-inline' self https://derpicdn.net

One final reminder:
* Once configured, firefox users can remove the addon buttons from their toolbars and proceed to ignore its existance

After that simply click the download link to be prompted to install the script.

*Important Note: Do NOT use Greasemonkey. It's dead, and the script may not work with it.

@byte[]
It is a pipe dream (unless you serve whole site as pre-rendered PNG or something). And this is a good thing, for variety of reasons, starting from simple personalization and ending with accessibility (I'm still surprised by amount of mobile sites that use user-scalable=no in <meta>. They're shooting themselves in the foot).

StSyaN
THANK YOU! This is a godsend. None of my public scripts use <style> tag, only inline ones (Once I needed non-inline styles, but I distributed them as optional userstyle instead). So this is a good news to me.

StSyaN
I'm glad this issue has actually been addressed, but I'm having trouble getting the CSP to work, I'm still getting the same error printed to the console (inline (“default-src”)) whenever I add my own <style> tag. I noticed that the CSP in the screenshot is different from the one you posted, are you sure none of them might be wrong?

@Ecstatis
If you're using Chrome, the original extension linked is a bit buggy, stopped working for everyone after a while. Try using this one instead, which disables CSP altogether so no configuration needed.

@Ecstatis
Also if you are using Tampermonkey, you may use GM_addStyle, which bypasses CSP.

Oh sorry, I forgot to mention that I use both Firefox (Portable, up to date) and Violentmonkey though. I noticed that hovering over the CSP field shows a tiptool still saying "default-src 'none'" for me — is that usual?

Should have tagged @Sollace instead

@Ecstatis
You have to enable the custom CSP and replace the content of the textbox with what I provided in the insturctions.

Sorry if It wasn't entirely clear. (I did include a screenshot)

@Sollace
Thanks, it was clear enough for me. The problem is that it doesn't work for me nontheless, though…



Any ideas?

@Ecstatis
I figured out what the problem was. The goddamn single quotes ' got automatically replaced by smart quotes ’.
Just one of the reasons I hate them.


@Sollace
Try wrapping the custom CSP in "[== ]" like this [bq][default-src 'self' https://derpicdn.net; font-src https://derpicdn.net; img-src data: https://camo.derpicdn.net https://derpicdn.net; script-src 'unsafe-inline' https://derpicdn.net; style-src 'unsafe-inline' https://derpicdn.net==][/bq]

There, just updated all my scripts so that Chrome users won't need to install the Disable Content-Security-Policy extension. Firefox users still need Laboratory by Mozilla though, unfortunately. Not anymore.

@Marker
Wrapped it. I don't see any real difference. I assume the smart quotes is what caused it not to work?

@Marker
In my investigation of the issues with Violentmonkey is that they have an option to change how the script is applied to the page that gets around the csp restrictions.

If you're not using css at all, you can try that to get your scripts working without the need for Laboratory.

@Sollace
Thanks, I'm aware of that, all of my scripts needs custom styling in one way or another. GM_addStyle is also required for the dumpster fire I use for saving user settings to work.

@Sollace

How exactly?

@Mildgyth
In ViolentMonkey's settings page, go to the settings tab and change "Default injection mode". Also click Learn more about injection modes. to find out how script authors can define a mode from their scripts directly.

I somehow got my scripts to work on Firefox now. Adding @inject-into content seems to do the trick, which is weird because I wasn't able to get them to run consistently with it before.

@Marker
That fixed it, thanks a lot!

@Sollace
I replaced Greasemonkey with Violentmonkey after seeing your post, and I've been liking it so far until I ran into problems with CSP restrictions and some page scripts seemingly breaking (on E621 e.g., I wasn't able to open posts by clicking on them directly anymore — I had to do right-click and open in a new tab instead). Changing the injection mode fixed that for me as well though. Nice to see you can choose the injection mode for your scripts individually, that gives me some more possibilities as a web coder :)

Updated my post. If anyone's having problems with spoiler images not loading, please try switching to the new CSP values in my post.

I recently switched back to Firefox and I've discovered that my old method of hiding certain links (mostly the threads dedicated to controversial subjects) is no long working in Stylish, and I can't figure out how to fix it again.

Also, a proper "Glimmerbooru" that's actually based off of her coat and mane would be nice.

So it seems that the script to display an image's rating in prior to clicking on it is no longer working, which is kind of a shame, since it was a pretty nice script.

@Jarkes
Sounds to me like it may have been caused by the CSP.
I don't use Stylish anymore after they came under fire for harvesting sensitive user data a while ago. And I've since switched to Stylus and can confirm the extension works with the site on Firefox.

@The Equestrian Zodiac
Do you have a link to the script?

@Marker

That worked, thanks!

Still wish I could make a Glimmerbooru based off of her color scheme, but I don't actually know which color codes would match hers.

@Jarkes
Well… You could try just taking a color picker to a screenshot Starlight.