LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-07-2018, 11:32 AM   #1
GTrax
Member
 
Registered: Oct 2005
Location: UK
Distribution: Mint
Posts: 258

Rep: Reputation: 37
Mathjax on GNU IceCat - and cloudfront.net and cloudflare.com


When using GNU IceCat browser to look at a technical forum, seeing text like "## N^2 ##", it is clearly a Latex-like expression that is supposed to render into a nice n_squared expression.
This is something done by Mathjax, a Javascript library which displays mathematical notation in most web browsers using MathML, Latex, and ASCIIMathML markup languages.
Mathjax installs from the Debian or Ubuntu repositories (and likely others) as libjs-mathjax.

OK - I did that, but I am unclear as to how to make the browser aware it is there, and to use it.
.. which brings us to cloudfront.net, and cloudfront.com

Enabling the script from "[I]cloudflare.com" makes it all work, even without a local mathjax. We get our n_squared notation.

To provide some of the functionality on this very LinuxQuestions.org site requires javascript from cloudflare.com

Not to be confused with "cloudfront.net"
This one is apparently capable of inserting or embedding javascript code into webpages creating links to ads and more when displaying the page. The source itself is not changed but modifed during the display.
Very clever - using Javascript to invoke external loaders. I guess I don't know very much about how safe/trustworthy this is.

My question is, do we really need external content providers to get a browser to use Mathjax?
Even more, what if the Javascript is not enabled, but Mathjax is already installed from the repository? Can it still work?
Finally, should a Linux user be wary of, and maybe block cloudfront.net?

Last edited by GTrax; 08-07-2018 at 11:35 AM.
 
Old 08-08-2018, 07:02 AM   #2
ntubski
Senior Member
 
Registered: Nov 2005
Distribution: Debian, Arch
Posts: 3,780

Rep: Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081
Quote:
Originally Posted by GTrax View Post
Mathjax installs from the Debian or Ubuntu repositories (and likely others) as libjs-mathjax.

OK - I did that, but I am unclear as to how to make the browser aware it is there, and to use it.
It doesn't work that way, quoting from the Debian package description:

Quote:
Simply include MathJax and some mathematics in a web page, and MathJax will do the rest.
Which is to say, it has to be included by the web page source, having it installed locally is of no use.

Maybe you could write a browser extension which injects it? There are some suggestions about GreaseMonkey scripts doing that on this page: https://mathoverflow.net/questions/2...e-and-in-email


Quote:
.. which brings us to cloudfront.net, and cloudfront.com

Enabling the script from "[I]cloudflare.com" makes it all work, even without a local mathjax. We get our n_squared notation.
Presumably that web page is using a copy of mathjax via cloudflare.com.

Quote:
Finally, should a Linux user be wary of, and maybe block cloudfront.net?
I don't think there is a particular reason to be wary of cloudfront in particular, it's just serving copies of things chosen by the website operator. Although you may decide that you don't trust Amazon generally (all big corporations are evil, right? ).

https://en.wikipedia.org/wiki/Amazon_CloudFront
https://en.wikipedia.org/wiki/Cloudflare
 
1 members found this post helpful.
Old 08-09-2018, 04:22 AM   #3
GTrax
Member
 
Registered: Oct 2005
Location: UK
Distribution: Mint
Posts: 258

Original Poster
Rep: Reputation: 37
Quote:
Originally Posted by ntubski View Post
.. having it installed locally is of no use.

I don't think there is a particular reason to be wary of cloudfront in particular, it's just serving copies of things chosen by the website operator. Although you may decide that you don't trust Amazon generally (all big corporations are evil, right? ).

https://en.wikipedia.org/wiki/Amazon_CloudFront
https://en.wikipedia.org/wiki/Cloudflare
My thanks ntubski
OK - I get it. Mathjax is then a tool for use at the page creation end, put in a script, so that a browser with the markup language smarts will render it nicely. I guess I have always had that little dilemma when encountering any Tex or Latex content. One always needed some extra rendering viewer or WSIWYG tool to get to see it like the printer would deliver it.

As for cloudfront.net and the like.
It is not that I am super-paranoid suspicious. I just use a Firefox-type browser with the NoScript add-on, and I am happy to enable the reasonable scripts to allow the main site to work. If it then requires 10, or 20, or 40 further scripts, I have to think "why"? !! In that case, it breaks my trust. If the site still works, I press on. If getting it to work is conditional on all the peeper sites getting information, then the site is toast!

Being less profiled lets me see search results less filtered to what some robot algorithm decides I should see.
e.g. Setting cookies to be deleted on closing the browser makes for a much better experience when it is then used on something like (say) YouTube. I like to see the bigger range of eclectic choices, rather than have the choices "refined for a better browsing experience". I like to be the one to choose what is "better" for me.

LQ uses netdna-ssl.com, and I trust LQ, so I am sure it is OK.
I do know that finding out what exactly netdna-ssl really does is not so easy!
 
Old 08-11-2018, 03:58 AM   #4
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 19,872
Blog Entries: 12

Rep: Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053
Quote:
Originally Posted by GTrax View Post
Mathjax installs from the Debian or Ubuntu repositories (and likely others) as libjs-mathjax.

OK - I did that, but I am unclear as to how to make the browser aware it is there, and to use it.
.. which brings us to cloudfront.net, and cloudfront.com

Enabling the script from "[I]cloudflare.com" makes it all work, even without a local mathjax. We get our n_squared notation.
sadly, most browsers aren't able to use programs installed locally.
yes, the site uses some mathjax javascript hosted on cloudflare.
fwiw, there's an addon that attempts to replace commonly used remote scripts with local versions (but still not the one you installed via apt): https://addons.mozilla.org/en-US/fir...decentraleyes/
maybe it includes mathjax...
(btw if you decide to try that i think you'd still have to allow access to cloudfront, and trust that the addon then replaces the request with a localised one)
 
1 members found this post helpful.
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
slackbuilds libreoffice 4.3.2 connects to cloudfront.net number22 Slackware 2 10-13-2014 07:00 PM
LXer: GNU IceCat 9.0.1 released LXer Syndicated Linux News 0 12-30-2011 03:50 AM
LXer: GNU IceCat 9.0.1 released LXer Syndicated Linux News 0 12-29-2011 06:31 PM
LXer: GNU IceCat 9.0.1 released LXer Syndicated Linux News 0 12-28-2011 11:30 PM
[SOLVED] No audio in GNU IceCat (Firefox equivalent) Geraldsmod Linux - Software 1 10-01-2009 07:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:07 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration