v0.8.0

Prerelease

HTTPS-only mode

HTTPS-only mode is on by default, for the whole browser. It sends every top-level http: navigation as https:, whoever wrote the address. It leaves Local-development sites alone, and subresources stay with the engine's mixed-content policy.

Omaweb shows its own page when the upgraded load fails or the site sends it back to plain HTTP. A form that would go to a plain address gets the same page. From there you go back, load the plain address once, or use plain HTTP for that site in the Space for good. A Private window never remembers that choice. Site information says when a page arrived through an upgrade. Turn the mode off in the privacy section of Settings.

Secure DNS and certificates

  • Secure DNS looks up every name over DNS-over-HTTPS. Turn it on in the privacy section of Settings, and pick Quad9, Cloudflare, Mullvad, or type an https: address. It is off by default, and the choice applies at once to the whole browser.
  • With Secure DNS on, a resolver that cannot be reached fails the lookup. The name never goes to the system's resolver in the clear. When a page's name is not found, Site information names the resolver that failed.
  • Site information offers View certificate on a page reached over TLS. It shows the chain to the trust anchor, one entry per certificate. Each entry lists subject, issuer, validity period, SHA-256 fingerprint and subject alternative names.
  • Copy a certificate field with its button, or with Return. The left and right arrows move along the chain, and up and down move through the fields.
  • The certificate interstitial offers the same view for the certificate it refused. You can check a Local-development site's self-signed certificate before you let it through.
  • Showing a verified page's certificate needs a patch in Omaweb's own engine. On a stock QtWebEngine, Site information says it cannot show it.

Content blocking

  • CNAME uncloaking checks a request the filter lists let through again, under each name in its host's CNAME chain. A tracker served from a site's own subdomain is refused as the tracker it is.
  • A canonical name on the request's own site is not checked. Site information lists each uncloaked refusal, with the canonical name it matched on a line of its own.
  • CNAME uncloaking needs Omaweb's own engine. On another engine, Settings names the engine it needs. With Secure DNS on, uncloaking sees each host's whole CNAME chain.
  • On CI's runner with omaweb-qtwebengine 6.11.2-3, Content blocking added 18.2 ms to a page of 40 images from 40 new hosts. On Arch's engine, without uncloaking, it added 6.1 ms. A page from 4 known hosts went from 2.6 ms to 4.0 ms.
  • Content blocking applies the procedural cosmetic rules in your filter lists. They hide elements, restyle them with :style(), or remove elements, attributes and classes.
  • Procedural rules run again as the page changes, at most every 100 ms. A rule change or a site switched off undoes them in place, except what :remove() took out. On CI's runner, Content blocking added 2.0 ms to a test page that carries procedural rules.
  • Settings names Ladybird as lacking procedural cosmetic filtering.

Screenshots

  • Screenshot page saves the page area as a PNG in your downloads location. It is at the display's pixel density, without Omaweb's chrome. The file is named for the page's title and the moment, and it is listed as a finished download.
  • Copy screenshot puts the same image on the clipboard. Run either from the Omnibar, or bind it to a key. In a split they capture the active tab.
  • Screenshot full page and Copy full-page screenshot take the whole document, a screenful at a time. What the page fixes to the viewport appears once, and the scroll position is put back afterwards.
  • Omaweb refuses a page taller than 32,767 device pixels before anything moves, and names the limit.

Fixes

  • Pages were black on a machine without Arch's qt6-webengine. The shell looked for the engine's QML module only in Qt's own directory. It now loads the module from Omaweb's engine.
  • Content blocking dropped a rule change, or a site switched off, made while a page was still loading. The page now takes the change when its load ends.
  • A reload after a rule change reused subresources from the earlier load, so the new rule refused nothing. The first reload after a rule change now bypasses the cache.
  • Filter rules with $elemhide or $specifichide work. adblock-rust 0.12.5 rejected both as invalid, so neither took a site's cosmetic rules away.
  • Site information and Settings said "1 requests blocked on this page". They use the singular now.
  • While Site information was open, the pointer stayed an arrow over the page's links and inputs. The page's own cursor shows through now.
  • The first click on a page that had just replaced the Start page landed on the Start page as it closed. The click reaches the page now.
  • A Private window's permission prompt said the answer was "remembered for this Space only". It now says "kept until this Private window closes". The question about downloading files automatically has the same fix.

Full changelog: https://github.com/villekivela/omaweb/compare/v0.7.3...v0.8.0

This release on GitHub