With node v10+ it seems that npm install will fail because it tries to download a pre-built binary for [email protected] and fails to find one then it tries to build it and fails at that too (on osx and on circle-ci).

node-pre-gyp ERR! Tried to download(403): https://mapbox-node-binary.s3.amazonaws.com/sqlite3/v3.1.13/node-v64-darwin-x64.tar.gz 
node-pre-gyp ERR! Pre-built binaries not found for [email protected] and [email protected] (node-v64 ABI) (falling back to source compile with node-gyp) 

Currently, when I enable flattring for a domain, all pages on that domain are being flattred. I would like to suggest an option in the extension so that web pages are only flattred if they contain the meta tag.

Benefits:

1. Creators could fine-tune which content can be flattred by omitting the Flattr meta tag <meta name="flattr:id" content="foo"> on some pages. (For example on sign-in pages.)

2. For contributors this options would help remove the clutter on their dashboards since they only see pages where their flattr actually counts.

3. This would also add an extra layer of opt-in privacy because not all URLs are sent over to the server.

Environment

• Flattr version: 0.7.0.16
• Browser name and version: Cliqz 1.29.0 (fork of Firefox 69.0)
• OS name and version: OSX

Description

When visiting a private Github page enough times to generate a flattr, the URL is sent to the flattr backend. This could expose company secrets to the Flattr service, and may not align with users' privacy expectations. It also does not make much sense to Flattr private pages.

Steps to reproduce

1. Inspect network traffic from the extension about:debugging -> Network tab.
2. Visit a private Github repo and flattr it.

Observed behavior

A request is made to api.flattr.com/bulk containing the private Github URL.

Expected behavior

Private URLs should not be sent to the backend.

Synk is just an automated tool to check the dependencies that are used for vulnerabilities. So if someone makes a pull request for a npm package with a known vulnerability then we'll be alerted to that.

https://snyk.io/
https://github.com/marketplace/snyk
https://blog.travis-ci.com/2017-04-20-continuous-security-snyk-travis-ci/

A new version was supposedly released two months ago.
d94aef6

All my instances on Firefox and Chromium are still on 0.6.09. Is auto-update broken? wasn’t it ever released?

Environment

• Flattr version: Flattr (development) 0.2.311
• Browser name and version: Firefox 55
• OS name and version: Ubuntu 16.04

Steps to reproduce

1. Install extension
2. Connect to Flattr account
3. Go to about:preferences#privacy
4. Click on "clear your recent history"
5. Select time range "Everything"
6. Expand "Details" section and only select "Cookies"
7. Click on "Clear now"

Observed behavior
User is not logged in to Flattr account.

Expected behavior
User is still logged in to Flattr account.

Further information
Debugging the extension showed that chrome.storage.local is kept while localStorage is cleared after following these steps.

Background
There have been reports of users being logged out of their account and not noticing that no flattrs have been created and submitted to flattr.com. While we're still investigating the potential causes of such an issue (incl. access token got invalidated), we can at least make it more obvious to users that they are no longer authenticated.

What to change

• Use "error" state for icon whenever extension is inactive due to insufficient account data.
• Add information about account state changes to collected data.

Environment

• Flattr version: 0.6.0.9
• Browser name and version: Firefox 60
• OS name and version: macOS 10.13

Steps to reproduce

1. Open https://mobile.twitter.com/gamingonlinux/status/1001030089616904192
2. Click the Flattr button in the extension pop-out

Observed behavior

No flattrs.

Expected behavior

+1 flattr.

It'd be nice to add a circleci badge to the readme so that there is a easy to find link to circleci and so that the current status is clear on the landing page for this repo.

Please upload Flattr to Mozilla Add-Ons (AMO).
https://addons.mozilla.org/firefox/extensions/

Advantages:

• free promotion for Flattr to users who’re already familiar with and are actively looking for new extensions
• free promotion for Flattr inside Firefox to users of similar extensions to those who install Flattr (coming later this year)
• free promotion for Flattr on AMO next to related plugins (“people who install X also install Flattr”)
• synchronize installs with Firefox Sync/Account (FXA) so the extension is auto-reinstalled when people get a new computer
• you can still distribute the same version of the extension yourself plus on AMO (same signing process as today)
• synchronize opt-ins and settings with storage.sync (limited to 100 KB)

Disadvantages:

• None. 🎉

YouTube TV interface URLs aren’t recognized and don’t get attributed to the creator properly.

Here are some example URLs:

https://www.youtube.com/tv#/watch/video/control?v=YA-Enxfhl0E
https://www.youtube.com/tv#/watch/video/idle?v=YA-Enxfhl0E&resume
https://www.youtube.com/tv#/watch/video/seek?v=YA-Enxfhl0E&resume

I looked into why so few of my mobile pages appear on Flattr. Surprise, surprise; I use Google Search so everything I visit is loaded with AMP directly on Google.com. Of course these pages aren’t being Flattr’ed.

The following is URL mappings for the two largest AMP Viewers (the page that renders AMP documents when you click on a result on a search engine result page):

https://www.google.*/amp/s/example.com/document?example
=>                https:///example.com/document?example
https://www.google.*/amp/example.com/document?example
=>               http:///example.com/document
https://www.bing.com/amp/s/example.org/articles/text
=>                https:///example.org/articles/text
https://www.bing.com/amp/example.org/articles/text
=>               http:///example.org/articles/text

The above URL mappings lead to the AMP versions of the documents. Both Bing and Google AMP Viewer also provide link[rel~="canonical"] hints to the non-AMP variants of these pages.

Some challenges:

• Neither Bing or Google are enabled for Flattr’ing by default. People don’t want to Flattr these domains and AMP-Flattr’ing can’t be based on these domains.
• The extension popout should display the mapped URL so people know what they’re Flattring. Should also be possible to turn domains on and off as with regular websites.

(Yes, AMP URLs are controversial and they suck. But they’re here to stay for the foreseeable future.)

Adding a Dockerfile would allow us to easily run tests in a container instead of on our host computer (to protect against instances like this one with eslint), and also allows someone that might have a platform issue running the build and/or tests on their host computer then they will still easily be able to run our npm scripts with docker, also I think this will help us with testing by providing easy access to another platform for us to test on (for example we can pretty closely reproduce the results that CircleCI might have which we don't get on our dev computer).

At the moment we use a read+write db transaction to prevent us from trying to save/write more than one flattr at a time, the down side to this is that all queries to the flattr db made while a save is in progress are delayed while they wait for the transaction to complete.

It would be more efficient to replace the transaction with a redux-saga to simply buffer the save actions, this way if there is some other process that needs to write to this db in the future then we can control the access to the db with redux-saga.

Background
CircleCI requires all config files to use a different syntax for supporting CircleCI 2.0 as the current version has been deprecated. Therefore we need to adapt our config accordingly.

What to change
Follow steps outlined in migration guide at https://circleci.com/blog/sunsetting-1-0/

Background
We want to communicate changes that were made between releases in a more easily digestable way than git commit logs.

Looking through a couple popular projects on GitHub, there didn't appear to be any coherent theme in how changes should be communicated though so we got some options (see also http://keepachangelog.com/en/1.0.0/).

What to change
Create a CHANGES.md file:

• Use CHANGES.md as file name (alternative: CHANGELOG.md)
• Use YYYY-MM-DD as date format (alternative: MMM D, YYYY)
• Group changes under "Added", "Changed", "Fixed" and "Removed" according to keepachangelog.com (alternative: group by components)
• Use issue numbers and links to tag diffs to provide more context (alternative: use commit or PR numbers)

Environment

• Flattr version: 0.7.0.16
• Browser name and version: Chrome 68
• OS name and version: Ubuntu 16.04

Steps to reproduce

1. Go to https://storageapis.wordpress.com/
2. Interact with page
3. Open icon popup
4. Disable flattring and reenable it
5. Interact with page
6. Open icon popup

Observed behavior
Step 3: Attention bar is empty
Step 6: Attention bar is not empty

Expected behavior
Step 3: Attention bar is not empty
Step 6: Attention bar is not empty

See also #21

Background
We currently use the format A.B.C.Z (e.g. 1.2.3.456 and v1.2.3 for tags) for versioning the extension where A.B.C is manually defined by us and Z refers to the revision it's based on. That leads to the following issues though:

1. We cannot rebuild using our CI if the Firefox upload failed because we'll get a "signing failed" error from AMO
2. It's not obvious which git revision the build number refers to
3. We cannot differentiate between different builds based on their version (optional)

Unfortunately, Chrome enforces the following limitation on version numbers:

It must be between 1-4 dot-separated integers each between 0 and 65536.

What to change

Version

Chrome
Format: A.B.C.Y
Example: 0.4.0.123

Firefox
Format: A.B.C.Y.Z
Example: 0.4.0.123.1711141502

Y refers to the build number
Z refers to the date as YYMMDDhhmm

Version name (not yet supported by Firefox)
Format: A.B.C (Y; Z)
Example: 0.4.0 (release; d496d5b)

Y refers to the build identifier (i.e. release, staging or development)
Z refers to the git commit hash

In both formats, B and C could be automatically appended by the build system if we don't specify them manually.

Missing information
We need to verify the following assumptions first:

• Uploading the same build with the same version number again to CWS doesn't cause any issues
• Firefox accepts version strings with more than four numbers
• Firefox doesn't have / has loose-enough restrictions on how large integers in the version string can be

Alternatively, we could merge major and minor version numbers to free up one more integer in the version number string which would allow us to represent the UNIX timestamp as two integers (i.e. AB.C.Y.Z where Y = timestamp / 65536 and Z = timestamp % 65536).

Flattr 0.4.0.376, Firefox 58.0.2, Fedora 27

1. Open two windows
2. Open tab A with any Flattr’able page in window 2
3. Drag tab A from window 2 to window 1
4. Click the Flattr extension button in window 1
5. Reuse tab A (now in window 1) and go to any other Flattr’able page
6. Click the Flattr extension button in window 1 again

The tab is broken as far as the extension is concerned. Neither the page dragged over from window 2 (in step 4), nor any other page loaded in the tab (steps 5–6) will be Flattr’able.

Environment

• Flattr version: 0.5.0.3 (development)
• Browser name and version: Chrome 64
• OS name and version: Ubuntu 17.10

Steps to reproduce

1. Go to https://frankenslug.wordpress.com/
2. Interact with page
3. Open icon popup

Observed behavior
Attention bar is empty.

Expected behavior
Attention bar should have started to fill up.

Background
We are creating one JavaScript bundle for each page which means that we end up with quite a bit of duplication in the final build. Introducing an additional bundle for shared code can help us avoid this duplication and reduce the size of the bundle.

Initial experiments have shown that this method can also help us reduce the amount of code that's running on each page which is especially interesting for our content script.

What to change
Extend build logic to split off shared code into a separate bundle (see browserify partitioning).

Environment

• Flattr version: 0.6.0.9
• Browser name and version: Firefox 61.0
• OS name and version: Fedora 28

Description
The extension have complained a few times over the last few days that I don’t have an active subscription. I do have an active subscription, however.

Steps to reproduce

1. Open the extension pop-out.

Observed behavior
“No active subscription”. I’ve never seen this before a few days ago.

Expected behavior
No complaints as I do have an active subscription and the message goes away when I reopen the pop-out.

Background
We extended the capabilities of the domains whitelist to also match subdomains. This means that existing domains for which users have en-/disabled automatic flattring are likely not referring to the base domain which is why we need to adapt those accordingly.

Clearing that data should be sufficient since it only affects Closed Alpha users.

What to change
Clear data in "blocked" database

This URL will show an article in Instapaper when I’m logged in to the service. However, the same URL will redirect to the original source when anyone else (like Flattr) try to access it.
https://www.instapaper.com/read/1089200768

Flattr currently credit this URL to www.instpaper.com, but it should be credited to www.androidpolice.com (the original source).

Flattr should either follow all redirects when determine the proper URL to credit, OR maintain a list of services that redirect URLs (including URL shortener services).

Background
Some users don't like the idea of the extension being enabled by default on various sites and would, instead, like to manually enable the extension for any site they want to be flattred. Therefore we should allow users to change the extension's default behavior when determining whether automatic flattring should be enabled on a site.

We probably still want to consider blocked sites such as www.youtube.com/my_videos though to prevent the extension from flattring those.

What to change

• Add toggle to options page to switch between three states:
  • Enable flattring on all sites
    Treat any preset entries that have STATUS_DISABLED or STATUS_UNDEFINED as STATUS_ENABLED
  • Enable flattring on selected sites (default)
  • Disable flattring on all sites
    Treat any preset entries that have STATUS_ENABLED or STATUS_UNDEFINED as STATUS_DISABLED
• Keep treating preset entries that have STATUS_BLOCKED as such
• Explicitly mention value in data collection to avoid misinterpretation of status data

Original post
I feel frustrated that you don't offer a way to disable the whitelist you supply because it puts me in a position where I am using my monthly subscription to support websites I don't care about (whether because the sites I care about aren't active Flattr users or because I simply haven't flattered anything) instead of saving it to support websites I do care about.

There are several websites on that list that just seem seedy, for example let's say I want to support a fictional popular filesharing site The Pretty Boy. They are incredibly popular but they're not on the list. Several copycat domains are which may or may not be under the control of or offer the same content as the original. It might not even be safe to visit at all.

Then we have the hot websites all the kids love, such as 0430.com, a "web library" (remember those from the 90s?) that offers up original content and useful links to carefully curated websites. Maybe as one of the 8,725 individuals living in Murray county, Minnesota you'd like to visit murraycountynews.net to catch up on the latest happenings. I personally bookmarked tahiti-virus.org so that I can be the first to find out when their website is built!

Almost 900 thousand lines are in this file.

Background
Due to the upcoming changes with subscription handling, the Flattr API will no longer return the response code 402 which means that we'll no longer be able to detect subscription changes this way.

Instead, we now need to find this information in the response body. For example:

{"status":"success","subscription":{"active":false},"sandboxed":true}

What to change
When submitting flattrs, check the API response's body to determine whether the user has an active subscription and change the subscription state accordingly.

Environment

• Flattr version: 0.7.0alpha
• Browser name and version: Firefox 66
• OS name and version: Ubuntu 18.10

Steps to reproduce

1. Install extension.
2. Go to any site.
3. Click somewhere.

Observed behavior

• Warning messages are shown in JavaScript console.
• Attention bar in popup does not progress.

Expected behavior

• No warning messages shown in JavaScript console.
• Attention bar in popup progresses.

Warnings

Unhandled rejection: Transaction/<@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:3007:63
nativeAwaitCompatibleWrap/<@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:1532:23
callListener@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:1221:19
endMicroTickScope@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:1302:25
physicalTick@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:1277:30
index.js:1573:25
Unhandled rejection: addAttention/</</<@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:53674:28
callNext@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:4382:56
step/<@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:4385:24
nativeAwaitCompatibleWrap/<@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:1532:23
callListener@moz-extension://7183b64b-4658-4898-82ab-dd28c5f9bb75/lib/background/index.js:1215:19

Flattr should recognize translator services and be able to pull out the original URL and credit the original URL. About 4 % of traffic to my own humble English-language corner of the web come in through these translation proxy services.

Baidu:

• http://fanyi.baidu.com/transpage?query=https%3A%2F%2Fwww.example.com%2F&source=url&ie=utf8&from=it&to=zh&render=1

Bing Translator and Microsoft Translate:

• https://www.translatetheweb.com/?from=&to=en&a=https://www.example.com/
• https://www.microsofttranslator.com/bv.aspx?from=&to=en&a=https://www.example.com/

Google Translate:

• https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.example.com&edit-text=&act=url
• https://translate.googleusercontent.com/translate_c?act=url&depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=https://www.example.com/&xid={redacted}&usg={redacted}

Yanex Translate:

• https://translate.yandex.ru/translate?url=https%3A%2F%2Fwww.example.com%2F&lang=en-ru
• https://translate.yandex.com/translate?url=https%3A%2F%2Fwww.example.com%2F&lang=ru-en

Not sure if this should be performed in the extension or server-side, though.

Background
We were using localForage for storing collected data since the very beginning. Since then lots has changed and it turned out to be insufficient for further usage. For instance, we query the database for determining whether or not to trigger a notification.

What to change

• Add "events" database
• Update any code that interacts with the database
• Remove "stats" database
• (optional) Migrate events from "stats" database to "events" database

Environment

• Flattr version: 0.7.0.17
• Browser name and version: Firefox 66
• OS name and version: Ubuntu 18.10

Steps to reproduce
Install extension.

Observed behavior
JavaScript console shows error.

Expected behavior
No error is shown in JavaScript console.

Errors

Content Security Policy: The page’s settings blocked the loading of a resource at eval (“script-src”).

Further information
This issue can be traced back to Dexie's implementation of Promise which uses new Function("...").

Background
We want to allow people to use the extension even before they add a subscription to their Flattr account. Thereby they can discover what the extension does without any up-front investment.

What to change

• Stop considering whether account has active subscription when checking whether extension should be active
• Stop overriding icon state to indicate an error when there's no active subscription
• Move existing message which informs the user about the lack of a subscription to replace the "beta" box in the icon popup
• Replace the message's body text with "Keep in mind that without an active subscription, your favorite creators won't receive any money from you. Any flattrs made without an active subscription will not be converted into money."

Background
We're introducing the next update to the algorithm after which attention-based flattrs will be submitted immediately. That means that we will no longer distribute those flattrs once per day and therefore also don't need to remember when we last did that. Instead we will be processing history visits on a daily basis which allows us to move from localStorage to extension storage to avoid #3.

What to change

• Remove "last-distribution" localStorage item
• Add "history.lastProcessing" extension storage item

Background
For the sake of providing tailored flattring for video/music/podcasting sites we want to consider whether the tab is playing any sounds. This means that we need to know what state the tab is currently in and when its state changes.

Finally, we need to include that in the submitted data so that we can determine its effectiveness.

What to change

• Include tab's "audible" and "mutedInfo.muted" properties in "state" event
• Add new "audible" event to record any changes in the tab's "audible" property value
• Add new "muted" event to record any changes in the tab's "muted" property value

Background
We are using event listeners in our content script to collect certain user interactions with the website. Since we're listening in the bubbling phase the site may stop the event propagation or the event we're listening to might not bubble up (e.g. media events) in which case we won't get notified of the event occurring.

What to change
Set useCapture option to true for all event listeners in the content script which are used for the data collection.

Since we are using github we might as well create a CONTRIBUTING.md file to document how we should contribute.

https://github.com/blog/1184-contributing-guidelines

Currently we have an export function which exports the browsing events which are recorded, but there is some extension related data which should be easy to export, such as user settings.

Basically we should allow the user to export all of the extension's db data and settings data as json.

Background
Our current contribution process requires the contributor to fill out and submit to us our Contributor's License Agreement. While we can make this more apparent by introducing a CONTRIBUTING.md file (see #11), we should also make that process simpler and more convenient for contributors.

What to change
One way to tackle this would be a more seamless integration with GitHub (see #9 (comment)). Apart from that we could also look into alternatives to CLAs such as a Developer Certificate of Origin (see DCO).

(We’ve discussed this before over email, but I wanted to add a public issue for it as well.)

Differences between desktop and Android extension API. Specifically, the browser.history and browser.windows are unavailable on Firefox for Android. The Flattr extension uses these APIs without testing whether they’re available or not. (This will also cause issues for a Microsoft Edge port.)

Idea: when installed, the extension could display a message suggesting to uninstall the extension and enable Firefox Sync with History Sync on a desktop computer as well as on the mobile device. At least as a temporary work-around.

We want to be able to download updates of the domains list. At the moment all we can do is periodically check for an updated list, and download the list in full. In the future we could optimize to have diff updates.

Background
We want to introduce tailored flattring for video/music/podcasting sites and came up with an extension to the existing attention-based algorithm for that.

What to change

• Start 20s timeout and 15s interval when tab is audible and not muted
• Start attention gathering when tab becomes audible
• Stop attention gathering when tab becomes inaudible
• When timeout fires:
  • Set "audio" flag on URL
• When interval fires:
  • Add 15s of attention
• Use following thresholds instead of regular ones for attention that's added to a URL with "audio" flag
  • 140s, 400s, 880s, 1480s, 2460s, 3660s
• Clear timeout and interval when:
  • Tab stops being audible
  • Tab gets muted
  • Tab is removed
  • URL changes
  • Page is being refreshed
• Remove existing video thresholds (incl. "video" section in domains.json)

Many browsers have Reader/-ing Modes and they’re incredibly useful in fixing broken page designs and making texts readable. However, they also change the URL of the article to a point where the Flattr extension no longer recognizes them. Flattr should recognize and normalize reader mode URLs so that the original URL can be Flattr’ed.

Firefox (URLencoded property)

about:reader?url=http%3A%2F%2Fexample.com%2F

Chrome (URLencoded property; mobile only)

chrome-distiller://uuid/?url=http%3A%2F%2Fexample.com%2F

Microsoft Edge (extra protocol)

read:http://example.com/

Safari (replaces protocol)

safari-reader:example.com/

Background
Storing flattrs in a localForage database has proven to be insufficient since we need to query for that data in various places. The introduction of an MVP-ready version of the algorithm allows us to replace it with a more suitable database.

What to change
Replace "flattr" localForage database with "flattrs" Dexie database

Environment

• Flattr version: 0.6.0.9
• Browser name and version: Firefox 62
• OS name and version: macOS 10.14

Description

Can’t manually Flattr any subdomain on WordPress.com. No automatic Flattring happens.

Steps to reproduce

1. Visit https://storageapis.wordpress.com/ (*.wordpress.com)
2. Wave your mouse aimlessly for a minute
3. Open the pop-out and click Flattr

Observed behavior
No flattring.

Expected behavior
Flattring.

Errors
Nothing logged.