The Imgur website and Firefox

[John Corliss]

In the past few months, I've had the Imgur.com website host a few images
(uploaded from my hard drive) for me so that I could put links to them
in some messages I posted to usenet.

Please note two things:

1. I've never had the Imgur Uploader extension
(https://addons.mozilla.org/en-US/firefox/addon/imgur-uploader/)
installed, ever.
2. I always clean out my cookies whenever I shut down Firefox.

This morning, while looking around in about:config, I noticed the
following two prefs:

devtools.gcli.imgurUploadURL (set to https://api.imgur.com/3/image)
devtools.gcli.imgurClientID (set to a unique identifier which I won't
post here)

WHAT. THE. HELL?

I shut down Firefox, waited a while and then opened the prefs.js from my
profile folder up in a text editor. I then manually removed the two
settings from that file and saved it.

When I started Firefox back up and checked though, the two settings were
right back where they'd been in about:config!! I even went so far as to
try this twice, with the same result both times.

So next, with Firefox running, I deleted the values from those two prefs
in about:config, then shut down and restarted Firefox.

The values remained deleted. However, I will be watching to make sure
they don't return.

Does anybody know how did those two prefs get put into my prefs.js file
in the first place and how they keep coming back?

Does Mozilla have some kind of arrangement with that website or am I
infected by some kind of malware I picked up at the Imgur website?

If it's possible for a website to edit my prefs.js file and store
information there, then cookies are the least of my concerns!

--
John Corliss

[John Corliss]

I forgot to mention that when I delete the prefs' values and then
restart Firefox, going into about:config and right clicking on the prefs
to "Reset" them only restores the values, doesn't remove the prefs.


--
John Corliss

[VanguardLH]

https://wiki.mozilla.org/DevTools/Features/GCLI
(no updates in over 3 years)

https://developer.mozilla.org/en-US/docs/Tools/GCLI

It's still in there. Hit Shift+F2 to see the GCLI input bar at the
bottom. I have NEVER used it. Goes by the name Developer Toolbar.
Click on the hamburger menu button, select Developer, and you'll see it
in the list of hack tools included in Firefox.

[PietB]

John Corliss wrote:
> In the past few months, I've had the Imgur.com website host a few images
> (uploaded from my hard drive) for me so that I could put links to them
> in some messages I posted to usenet.
>
> Please note two things:
>
> 1. I've never had the Imgur Uploader extension
> (https://addons.mozilla.org/en-US/firefox/addon/imgur-uploader/)
> installed, ever.
> 2. I always clean out my cookies whenever I shut down Firefox.
>
> This morning, while looking around in about:config, I noticed the
> following two prefs:
>
> devtools.gcli.imgurUploadURL (set to https://api.imgur.com/3/image)
> devtools.gcli.imgurClientID (set to a unique identifier which I won't
> post here)
>
> WHAT. THE. HELL?

Interesting. I've never ever used imgur, but in my:
- Firefox only .imgurUploadURL is present;
- SeaMonkey both .imgurUploadURL and .imgurClientID are present;
- PaleMoon none of them is present.

-p

[John Corliss]

Thanks for pointing that out, but I'm already aware of the Developer
tools. So what is it you're saying I should use the GCLI input bar for?
Or are you saying that somehow the Imgur.com website was able to hack
into those tools to create and set those prefs?

Sorry, I'm kinda confused here.

--
John Corliss

[John Corliss]

Thanks for that info!

While Googling around to find info on the prefs, I found this page:

http://www.haganfox.net/Main/FirefoxSetup

About 2/3 of the way down, Hagan mentions those two prefs and recommends
removing their values the way I did. His mentioning them sort of
indicates (but in no way proves) that the two prefs come already
included in prefs.js if you do a fresh install of Firefox. I find this
difficult to believe though.

Googling for:

firefox imgur prefs -imgur.com

produces nothing of any help, but that doesn't surprise me given the
quality of the Google search engine these days.

--
John Corliss

[WaltS48]

From the GCLI Help menu when entering help screenshot; "[--imgur]
(boolean, required)
Use if you want to upload to imgur.com instead of saving to disk"


--
Linux Mint 17.2 "Rafaela" | KDE 4.14.2 | Thunderbird 45.0a1 (Daily)
You don't need zero-days when machines wherever are packed with old-days.
Go Bucs! (next season) Go Pens! Go Sabres! Go Pitt!
[Visit Pittsburgh]<http://www.visitpittsburgh.com/>
[Coexist · Understanding Across Divides]<https://www.coexist.org/>

[»Q«]

In
<news:mailman.8355.144949053...@lists.mozilla.org>,

John Corliss <jcor...@fake.invalid> wrote:

> This morning, while looking around in about:config, I noticed the
> following two prefs:
>
> devtools.gcli.imgurUploadURL (set to https://api.imgur.com/3/image)
> devtools.gcli.imgurClientID (set to a unique identifier which I won't

> post here) ^^^^^^^^^^^^^^^^^^^

Just to be clear, it's unique to Firefox, not unique to John
Corliss.

> WHAT. THE. HELL?

0df414e888d7240

> I shut down Firefox, waited a while and then opened the prefs.js from
> my profile folder up in a text editor. I then manually removed the two
> settings from that file and saved it.
>
> When I started Firefox back up and checked though, the two settings
> were right back where they'd been in about:config!! I even went so
> far as to try this twice, with the same result both times.
>
> So next, with Firefox running, I deleted the values from those two
> prefs in about:config, then shut down and restarted Firefox.
>
> The values remained deleted. However, I will be watching to make sure
> they don't return.

Generally, deleting lines from prefs.js has the effect of setting the
prefs to their defaults, which is what you seem to be reporting.
Setting them to something else (in this case, empty strings) via
about:config or user.js should work.

[EE]

But SeaMonkey does not even have devtools. Must be a holdover from the
Firefox core.
I set the imgurClientID to a blank and copied the setting into a user.js
file. I then exited SeaMonkey, then started it up again. That ID is
still blank, so you can use user.js to keep it blank.

[WaltS48]

On 12/07/2015 01:59 PM, EE wrote:
> PietB wrote:
>> John Corliss wrote:
>>> In the past few months, I've had the Imgur.com website host a few images
>>> (uploaded from my hard drive) for me so that I could put links to them
>>> in some messages I posted to usenet.
>>>
>>> Please note two things:
>>>
>>> 1. I've never had the Imgur Uploader extension
>>> (https://addons.mozilla.org/en-US/firefox/addon/imgur-uploader/)
>>> installed, ever.
>>> 2. I always clean out my cookies whenever I shut down Firefox.
>>>
>>> This morning, while looking around in about:config, I noticed the
>>> following two prefs:
>>>
>>> devtools.gcli.imgurUploadURL (set to https://api.imgur.com/3/image)
>>> devtools.gcli.imgurClientID (set to a unique identifier which I won't
>>> post here)
>>>
>>> WHAT. THE. HELL?
>>
>> Interesting. I've never ever used imgur, but in my:
>> - Firefox only .imgurUploadURL is present;
>> - SeaMonkey both .imgurUploadURL and .imgurClientID are present;
>> - PaleMoon none of them is present.
>>
>> -p
>>
> But SeaMonkey does not even have devtools.

Not yet. 1223341 – Add the Firefox Devtools to the SeaMonkey UI

[Ed Mullen]

It's a normal part of FF's built-in Web Developer utilities. It's also
in SeaMonkey.


--
Ed Mullen
http://edmullen.net/
Assphasia- a condition where your face looks so much like your butt your
bowels don't know which way to move.

[John Corliss]

»Q« wrote:

> John Corliss wrote:
>>
>> This morning, while looking around in about:config, I noticed the
>> following two prefs:
>>
>> devtools.gcli.imgurUploadURL (set to https://api.imgur.com/3/image)
>> devtools.gcli.imgurClientID (set to a unique identifier which I won't
>> post here) ^^^^^^^^^^^^^^^^^^^
>
> Just to be clear, it's unique to Firefox, not unique to John
> Corliss.
>
>> WHAT. THE. HELL?
>
> 0df414e888d7240

Why, so it is. Thanks for pointing that out. However, after reading this
bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=992386

I'm still not clear about why the developers thought that Firefox needed
those prefs. There's nothing special about Imgur that I can see.

>> I shut down Firefox, waited a while and then opened the prefs.js from
>> my profile folder up in a text editor. I then manually removed the two
>> settings from that file and saved it.
>>
>> When I started Firefox back up and checked though, the two settings
>> were right back where they'd been in about:config!! I even went so
>> far as to try this twice, with the same result both times.
>>
>> So next, with Firefox running, I deleted the values from those two
>> prefs in about:config, then shut down and restarted Firefox.
>>
>> The values remained deleted. However, I will be watching to make sure
>> they don't return.
>
> Generally, deleting lines from prefs.js has the effect of setting the
> prefs to their defaults, which is what you seem to be reporting.
> Setting them to something else (in this case, empty strings) via
> about:config or user.js should work.

Yes, I read this morning somewhere that if a setting keeps getting
changed back to something that copying that setting into a user.js file
will make sure that the resetting doesn't occur.

AdBlock Plus resets the following pref:

extensions.adblockplus.notificationurl

to https://notification.adblockplus.org/notification.json whenever that
extension is updated. I keep having to delete it to stop calling out to
that IP whenever Firefox is started. Maybe it's time for a user.js file
as you say.

--
John Corliss

[»Q«]

In
<news:mailman.8390.144952126...@lists.mozilla.org>,

John Corliss <jcor...@fake.invalid> wrote:

> I'm still not clear about why the developers thought that Firefox
> needed those prefs. There's nothing special about Imgur that I can
> see.

AFAICT, it's just that Imgur offer an API, <https://api.imgur.com/>,
which makes it relatively easy to include the feature in Firefox. I
don't know enough about image-sharing sites to know whether there are
others which offer such a thing.

[John Corliss]

»Q« wrote:

> John Corliss wrote:
>>
>> I'm still not clear about why the developers thought that Firefox
>> needed those prefs. There's nothing special about Imgur that I can
>> see.
>
> AFAICT, it's just that Imgur offer an API, <https://api.imgur.com/>,
> which makes it relatively easy to include the feature in Firefox. I
> don't know enough about image-sharing sites to know whether there are
> others which offer such a thing.

About the closest thing I've seen was the virus checking sites like
Virustotal and Jotti's, where you can also upload a file from your hard
drive to.

--
John Corliss

[John Corliss]

Never mind, I got it now. Also, I found this:

https://bugzilla.mozilla.org/show_bug.cgi?id=992386

--
John Corliss

[John Corliss]

John Corliss wrote:
> In the past few months, I've had the Imgur.com website host a few images
> (uploaded from my hard drive) for me so that I could put links to them
> in some messages I posted to usenet.
>
> Please note two things:
>
> 1. I've never had the Imgur Uploader extension
> (https://addons.mozilla.org/en-US/firefox/addon/imgur-uploader/)
> installed, ever.
> 2. I always clean out my cookies whenever I shut down Firefox.
>
> This morning, while looking around in about:config, I noticed the
> following two prefs:
>
> devtools.gcli.imgurUploadURL (set to https://api.imgur.com/3/image)
> devtools.gcli.imgurClientID (set to a unique identifier which I won't
> post here)

> (clipped)

>
> Does Mozilla have some kind of arrangement with that website or am I
> infected by some kind of malware I picked up at the Imgur website?

After reading this bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=992386

I found this:

https://groups.google.com/forum/?fromgroups#!topic/imgur/AJcTXtiOMPk

In the second link, Christian Heilmann described how the prefs are used
in the devtools:
_______________________________________________________________________
The story is this: Firefox Developer tools have a great feature that
when you press shift-F2 you get a command line to do all kind of things
with the browser. One of them is "screenshot" which takes a screenshot
of the page. "screenshot --fullpage" scrolls the whole page for you and
takes a picture of it. I was now proposing to offer an --imgur flag to
automatically upload the screenshot to imgur using the API but with 400m
users we will hit the limits pretty soon.
_______________________________________________________________________

So if you have a page that needs to be scrolled to view it all, you can
use this tool to make and image of it all without having to take
screenshots of portions and then photomerge them all together. Then a
developer can store the image on Imgur and have a link to the image to
show other developers.

Now I understand what's going on and I think I'll just leave the prefs
alone. OTOH, since I'm not a developer, deleting their values would have
no effect on anything.

Please consider this topic resolved.

--
John Corliss