@jnaskali

Re:

I think userscripts have a @run-at default of document-end, so wrapping it in a ready function doesn't seem necessary

GM's @run-at currently states:

The default if no value is provided. The script will run after the main page is loaded, but before other resources (images, style sheets, etc.) have loaded.

jQuery's $(document).ready currently states:

Code included inside $( document ).ready() will only run once the page Document Object Model (DOM) is ready for JavaScript code to execute.

... and also states ...

Code included inside $( window ).on( "load", function() { ... }) will run once the entire page (images or iframes), not just the DOM, is ready.

So if you need complete page load the latter jQuery reference is what to use... otherwise the former and/or GM's @run-at should be okay if the DOM is all you are looking for.

But... Note some types of CSS can add content on the fly with a style sheet. I don't see you using a MutationObserver so it's probably okay for now.

May want to have the noConflict option put in mentioned here for .user.js engines that may need that.

... it seems Greasemonkey needs to be told explicitly to use unsafeWindow's jQuery.

1. Depends on the GM version and Firefox version. Sandboxing comes and goes (both are facing long term growing pains from Moz and changes) which is why one should always use an IIFE for best practices on ones code.

2. Sites Cross Origin policy could have changed too, along with Firefox version, to prevent certain things from being shared/utilized.

Re: @julzyw:

I would suggest that you be very careful about replies that vaguely fit into the topic... especially here.

OUJS Admin

See this point in your current code.

If you want to display a portion of it use // for @description instead. Also probably won't show up in any .user.js engine script list with the description if available.

OUJS Admin

Re: This line

The NASA license is a U.S.A Governmental license. If you aren't a government agency it can be a felony to impersonate one. There are also international laws that prevent impersonation. i.e. extradition treaties and possible existing sanctions.

Refs:

• U.S.C with https://www.law.cornell.edu/uscode/text/18/912

It's left in here in case we get some more government staff in here... so pick carefully and you would be required to fill out what agency, etc., exactly for this FOSS license inside of your script. See SPDX example at NASA.

Thanks,
OUJS Admin

Talk about a dated issue. ;) The SPDX codes changed a while ago. So GPL-3.0-or-later is the current norm. If you go into "Edit Script" they are all listed.

OUJS Admin

Re: @Mottie:

Thanks for the report. Good guess on the dependency... that's not what I thought when I looked at this yesterday but it seems to be accurate.

Follow:

• markedjs/marked#1745

atob for those being picky too... inverse function. If you need specific implementations usually it's best to have a library from a common, well known, source.

OUJS Admin

Re: @Lera_Rosalene:

Obfuscation is, in part, when you can't immediately read it with the existing tools on the site (Beautify for example). From what I've examined on your script you are mangling (shortening to be specific) your identifiers (variables) to one letter identifiers and LF/CR equivalents (minification). This in my book is okay atm however if you start substituting with hex identifiers or making the strings unreadable on what you are doing (base64 for example) then any user may be eligible for immediate, unnotified, removal. localStorage for example on your script, if you were to obfuscate built in identifiers that would be a TOS ding. Usually more critical are external urls, cookies, QSP, port to port, and ajax (xhr) requests. If they become obfuscated then the axe will fall.

What should I do to help people confirm that my code is not malicious?

A SCM (like GitHub, GitLab, etc.) that has the pure raw, readable, code is always a plus for evaluation of the readability. Usually it's best to include a framework stub with the script encapsulated in an IIFE (for your scripts safety) that does it on the fly. For example btoa is a common method in all browsers, in the DOM, to base64 a string on the fly.

Obfuscation can also include if you don't explain what the script is doing. i.e. throwing ads on unsuspecting users. Tell everyone on your script description here on OUJS or you can get the axe as well. Not everyone knows every aspect of JavaScript so it's best to put a clear description both in the script and its relevant "Script Info".

Use your best judgement. As it stands now with 0.1.5+ba9dba3 of your script I don't see any immediate issue flags at this time.

OUJS Admin

Please fix this as soon as possible. Libraries are reusable pieces of code used in a primary .user.js. See https://openuserjs.org/about/Userscript-Beginners-HOWTO#what-is-a-library-script- if you have further queries.

OUJS Admin

No problem. Welcome.

Try using https://gist.githubusercontent.com/cmsax/2942af63fbb1e664120af617683483f5/raw/youtube-search-filter.js for the latest gist instead of fixing it on an old static hash found in 0.1.0+be178af.

:)

Still have the issue with https://gist.githubusercontent.com/cmsax/2942af63fbb1e664120af617683483f5/raw/18955d0e0a00e347451754bbf097ff2ada786ae5/youtube-search-filter.js .

Now it look likes you've pushed the overwriting of the script to the 2nd update instead of the first.

With your code at version 0.1.0+f41d13f

// @downloadURL  https://gist.github.com/raw/2942af63fbb1e664120af617683483f5

which currently contains:

{
    "ytd-search-block-list": [
        "stone记",
        "rfi",
        "bbc news中文",
        "熱點互動",
        "热点互动",
        "美国之音",
        "老外看中国",
        "唐浩",
        "江峰",
        "李蘭斯",
        "leonard",
        "自由亚洲",
        "孙文",
        "看中国",
        "石涛",
        "冷眼看世界",
        "ntdtv",
        "新聞第一現場",
        "視角",
        "新聞:綜合頻道",
        "memehongkong",
        "中國時局",
        "睿眼看世界",
        "天亮時分",
        "陳破空",
        "大纪元",
        "大紀元",
        "新聞拍案驚奇",
        "新唐人",
        "公子沈",
        "wen zhao",
        "财经冷眼"
    ]
}

When your user script engine updates the script, the script source will be obliterated/overwritten and you'll be trying to inject an object of data instead of the script published here which will usually cause an error in the console.

Is this what you really want to do?

Ref:

• @downloadURL

Re: @joeytwiddle:

Sorry for the slow reply, I was making a cup of tea.

ROFL! :)

Followup: The All category is still not quite what it means... "All" would be all of their feeds which is how it used to be. However it has been posting a few articles.

On other news related to the sites core and this topic, if not read yet:

• https://blog.npmjs.org/post/612764866888007680/next-phase-montage
• https://github.blog/2020-03-16-npm-is-joining-github/

Re: @mattjgalloway:

thinking that was the right thing to do - apologies I didn’t know about the forking on here

Re:

"OpenUserJs.org allows all published works on OpenUserJS.org to be forked via OpenUserJS.org forking capabilities." from the current TOS

Any ideas what’s up here and how I can get this forked properly?

Fork it on OUJS first... that builds the linkage... since you clearly didn't read but acknowledged that you did the script under it's current name is forever removed on your account. You may change the @name and try again. Normally this wouldn't be required but you did violate the TOS.

Again if it happens again, from anyone, my patience is at minimum for this since it's quite clear not to do improper forking. Technically you stole the script by not forking it properly... that alone is reason for account removal... but luckily the minuscule patience left afforded you some leeway (which isn't required).

OUJS Admin.

Improper forking means a TOS violation. Reread it again. Any further violations may end up being account removal.

OUJS Admin

Re: @magnushakansson:

https://openuserjs.org/install/magnushakansson/JenkinsPipelineSteps.user.js#bypass=true

Whenever you see #bypass=true that usually means you don't have Tampermonkey (TM) installed/enabled/working (or Violentmonkey (VM)) in Chromium based browsers such as Chrome.

Please check your browser to make sure a .user.js engine is installed, enabled, etc. If it still doesn't work try another clean profile with a new installation of your preferred .user.js engine manager.

Currently installs for me.

Thanks,
OUJS Admin

Re: @freeos:

Taking the less subtle approach, unlike jscher2000's gently mentioned open advice, to prevent blatant misinformation:

GM_config lacks the following features, a regular user might want:

• Ability to open and change the options without reloading the page.

This is absolutely incorrect. You have clearly ignored bothering to check out how to use GM_config with the .open command.

GM_config lacks the following features, a regular user might want:
...

• Do not show the options every time when the page is loaded (refreshed), only when the user explicitly decides to.

Again incomplete research on your part with poor assumptions on the GM_config Unit Test.

The wiki is referenced on the library homepage and should have been your first visit before assuming incorrectly.

Please try, try again.

Re: @freeos:

... add options ...

Take a gander at https://openuserjs.org/garage/Making_a_blocklist_user-friendly

Seems to be working well for me and this isn't even a clean profile. Tried that?

OUJS Admin

Re: @meister90:

The automatic profileInstaFollow is not divulged on the main script page so that definitely merits removal of the Script.

@manuelc

If I get another report and don't see you divulging what your future scripts do, in detail human-readable terms, your account will have the default TOS applied.

OUJS Admin

Re: @Clemente3905:

This public report is a little vague. The .user.js itself is currently benign at 2.2+88f06e5 with the exception of sending a post request to https://www.easy-youtube-mp3.com/. Are you sure whatever your software is reporting this isn't just a possibly unwanted program (PUP)?

As with any "online transcoders" one should always be aware of what is being done on those external sites... so if it's somehow injecting a script on their end into the context of youtube.com then I'd give the ISP that hosts that PHP script a notification instead. Have more than what you posted here otherwise they will dismiss it especially since you shouted it with all caps which isn't a wise thing to do.

OUJS Admin.

Try again... this is your only warning that should not have to be given.

OUJS Admin

http://www.webautofill.com/scripts/ssmms.otp.auto.grease.min.js?V0.2 is obfuscated. You have until later today to fix this otherwise we'll take the default TOS action.

Thank you for your attention on this matter,
OUJS Admin