Opera automatically fetches a page when it starts

masaoliu

masaoliu @BestCodes

Having failed to figure out where this "app" is and how to uninstall it, I sent just now an email to Hearty Journal asking for support on how to get rid of this "app".

This issue sticks only to Opera, not to Firefox-esr or Brave.

This makes me think the cause doesn't lie in system-wide configuration.

This issue remains even with this directory ~/.config/opera/ removed.

This makes me think client-side storage irrelevant and I can't fix this issue simply by manually removing persistent data that might be stored by Opera.

In Debian Linux, all software are supposed to be installed using apt install. I don't remember I ever installed this suspicious package which is now nonexistent in Debian packages repository.
I begin to suspect Opera was hard coded to periodically fetch pages from hearty.me. The following screenshot is the output of command opera >/tmp/opera.log 2>&1 &

chennien

chennien

Hi! This is Nien, the founder of Hearty Journal. I received your email. I apologize for any inconvenience caused. We reviewed the code image you posted earlier, and it appears to be the challenge page on our website hosted by Cloudflare, implemented to prevent automated bot access.

In fact, Hearty Journal neither offer any Opera extension nor alter your homepage. The issue may be related to a misconfiguration in the startup page URL. To resolve this, kindly check your browser settings or attempt to reset your browser.

For further assistance, please contact us: https://hearty.me/help . Thank you for your patience.

burnout426

burnout426 Volunteer @masaoliu

@masaoliu Goto the URL opera://rich-wallpaper/main.js, hit ctrl + f and search for hearty to see if anything comes up. It's not mentioned anywhere in my opera://rich-wallpaper/main.js on Windows at the moment.

"Hearty" probably won't be found for you there either unless something modified the file. But, something seems to be calling that JS to set a start page background/wallpaper or something, but it's failing and causing errors and such.

Assuming that, maybe that will help you pin down the cause.

I would also try searching the content of all files on your system for the the string hearty. Something like:

shopt -s dotglob
grep -rio "hearty" / > ~/Desktop/output.txt

in a Bash terminal might do it. Can't test for sure though. May take a long time for the search to complete, but that might find the source. You can change / to the path of a certain directory if you want to limit the search.

BestCodes

BestCodes

It may be that Opera is Chrome based…
Have you tried Google Chrome to see if it does the same thing?

Hi, I'm Best_codes! I'm a full-stack web dev who moderates on the makeblock forum. I have a website, https://bestcodes.dev. I love Opera, so I'm on here occasionally to report bugs and answer some questions.

leocg

leocg Moderator Volunteer @BestCodes

@bestcodes Opera is Chromium based, just liker Chrome, Vivaldi and other browsers.

BestCodes

BestCodes @leocg

@leocg Yes, I know, I was wondering if the same thing is occurring in other chromium based browsers or if it is specific to Opera.

Hi, I'm Best_codes! I'm a full-stack web dev who moderates on the makeblock forum. I have a website, https://bestcodes.dev. I love Opera, so I'm on here occasionally to report bugs and answer some questions.

burnout426

burnout426 Volunteer @chennien

@chennien said in Opera automatically fetches a page when it starts:

The issue may be related to a misconfiguration in the startup page URL. To resolve this, kindly check your browser settings or attempt to reset your browser.

In the pic from the OP's comment above, it shows that Opera's startup option at the URL opera://settings/onStartup is set to "Begin with fresh start page". It's not set to "open specific set of pages".

Also, user tried with a whole new Opera profile (which defaults to "retain tabs from previous" session and not "open specific set of pages".

User also tried loading Opera directly in a terminal to skip Opera's shortcut just in case it was messed up.

masaoliu

masaoliu @BestCodes

@bestcodes Brave browser is said to be Chrome based.
It runs quite quietly.

masaoliu

masaoliu @burnout426

@burnout426 hearty doesn't appear in opera://rich-wallpaper/main.js in my box, either.

The command *grep" I sent as a non-root user has been running for more than 2 hours. Here is part of the redacted output:

/home/john/.config/chromium/ZxcvbnData/1/us_tv_and_film.txt:hearty
/home/john/.config/BraveSoftware/Brave-Browser/iodkpdagapdfkphljnddpjlldadblomo/1.0.2440/list.txt:hearty
/home/john/.config/BraveSoftware/Brave-Browser/iodkpdagapdfkphljnddpjlldadblomo/1.0.2440/list.txt:hearty
/home/john/.config/opera/Default/Preferences:hearty
/home/john/.config/opera/Default/Preferences.backup:hearty
/home/john/.config/opera/Default/Network Persistent State:hearty
/home/john/.config/opera/Default/Network Persistent State:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.aG4N4S:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.aG4N4S:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.emoGnG:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.jY4Dfu:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.TdbbHV:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.TdbbHV:hearty
/home/john/.config/opera/Default/Network Persistent State.backup:hearty
/home/john/.config/opera/Default/Network Persistent State.backup:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.Fekgka:hearty
/home/john/.config/opera/Default/.org.chromium.Chromium.Fekgka:hearty
/home/john/.config/opera/Network Persistent State.backup:hearty
/home/john/.config/opera/Network Persistent State.backup:hearty
/home/john/.config/opera/adblocker_rules.json:hearty
/home/john/.config/opera/adblocker_rules.json:hearty
/home/john/.config/opera/.org.chromium.Chromium.FKPIk4:hearty
/home/john/.config/opera/.org.chromium.Chromium.FKPIk4:hearty
/home/john/.config/opera/.org.chromium.Chromium.p9ZvDT:hearty
/home/john/.mozilla/firefox/m7zvypbi.default/SiteSecurityServiceState.txt:hearty
/home/john/.mozilla/firefox/m7zvypbi.default/SiteSecurityServiceState.txt:hearty
/home/john/Desktop/Old Iceweasel Data/8moyusmh.default-1396798610782/extensions/en-US@dictionaries.addons.mozilla.org/dictionaries/en-US.dic:hearty
/home/john/.xsession-errors:hearty
/home/john/.xsession-errors:hearty
/home/john/.xsession-errors:hearty
/home/john/.xsession-errors:Hearty

burnout426

burnout426 Volunteer

A lot of those just look like "hearty" is in some adblocker lists for various browsers. Those look legit and not harmful.

However, I don't know what the .org.chromium.Chromium.XXXXXX folders are in Opera's user data folder. Those seem suspicious and seem like some kind of Chromium policy type definition for an extension or something. Not sure though. Check in those folders to see what's in them.

masaoliu

masaoliu @burnout426

@burnout426 Here are all the files with prefix .org.chromium.Chromium. under ~/.config/opera/

They were created on Nov. 16 and today is Nov. 26.

.org.chromium.Chromium.1RO1LL
.org.chromium.Chromium.aG4N4S
.org.chromium.Chromium.emoGnG
.org.chromium.Chromium.Fekgka
.org.chromium.Chromium.jY4Dfu
.org.chromium.Chromium.L3S6HU
.org.chromium.Chromium.NnVb2d
.org.chromium.Chromium.NswJjv
.org.chromium.Chromium.oB1yys
.org.chromium.Chromium.SPY8w9
.org.chromium.Chromium.TdbbHV
.org.chromium.Chromium.w9S8cd
.org.chromium.Chromium.wztya0

Excerpt of .org.chromium.Chromium.1RO1LL, which is JSON I believe, follows:

{"SDCH":{"dictionaries":{},"version":2},"net":{"http_server_properties":{"broken_alternative_services":[{"anonymization":[],"broken_count":1,"host":"facebook.com","port":443,"protocol_str":"quic"},{"anonymization":[],"broken_count":19,"host":"www.leecheen.com","port":443,"protocol_str":"quic"},{"anonymization":[],"broken_count":12,"host":"pic.pimg.tw","port":443,"protocol_str":"quic"},{"anonymization":[],"broken_count":6,"host":"www.startpage.com","port":443,"protocol_str":"quic"},{"anonymization":[],"broken_count":7,"host":"news.ourhappybirthday.com","port":443,"protocol_str":"quic"},{"anonymization":[],"broken_count":38,"host":"www.bigfang.tw","port":443,"protocol_str":"quic"},{"anonymization":["HAAAABUAAABodHRwczovL2NhbWJyaWRnZS5vcmcAAAA=",true],"broken_count":1,"host":"u.ipw.metadsp.co.uk","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABEAAABodHRwczovL2hpbmV0Lm5ldAAAAA==",true],"broken_count":13,"host":"www.bigfang.tw","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABEAAABodHRwczovL2hpbmV0Lm5ldAAAAA==",true],"broken_count":1,"host":"tags.creativecdn.com","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABEAAABodHRwczovL2hpbmV0Lm5ldAAAAA==",true],"broken_count":6,"host":"statics.creativecdn.com","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABEAAABodHRwczovL3lhaG9vLmNvbQAAAA==",true],"broken_count":1,"host":"a.sportradarserving.com","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABEAAABodHRwczovL3lhaG9vLmNvbQAAAA==",true],"broken_count":2,"host":"trace.popin.cc","port":443,"protocol_str":"quic"},{"anonymization":["HAAAABUAAABodHRwczovL3N0YXJ0cGFnZS5jb20AAAA=",false],"broken_count":61,"host":"www.startpage.com","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABQAAABodHRwczovL2ZhY2Vib29rLmNvbQ==",false],"broken_count":1,"host":"scontent.ftpe7-4.fna.fbcdn.net","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABQAAABodHRwczovL2xpbmtlZGluLmNvbQ==",true],"broken_count":1,"host":"radar.cedexis.com","port":443,"protocol_str":"quic"}],"servers":[{"anonymization":["GAAAABEAAABodHRwczovL2hpbmV0Lm5ldAAAAA==",false],"server":"https://info.cloudflare.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13346939393370659","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABEAAABodHRwczovL2hpbmV0Lm5ldAAAAA==",true],"server":"https://dc2694e3dcaab805a098c611d07b5ffe.safeframe.googlesyndication.com"}

...

,"server":"https://www.googleapis.com","supports_spdy":true},{"anonymization":["OAAAADMAAABjaHJvbWUtZXh0ZW5zaW9uOi8vb2JoYWlncG5oY2lvYW5uaWlhZXBjZ2tkaWxvcGZsYmIA",false],"server":"https://go.hearty.me","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13347193163761059","port":443,"protocol_str":"quic"}],"anonymization":["OAAAADMAAABjaHJvbWUtZXh0ZW5zaW9uOi8vb2JoYWlncG5oY2lvYW5uaWlhZXBjZ2tkaWxvcGZsYmIA",false],"network_stats":{"srtt":17211},"server":"https://a.nel.cloudflare.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13344687563384956","port":443,"protocol_str":"quic"}],"anonymization":["OAAAADMAAABjaHJvbWUtZXh0ZW5zaW9uOi8vb2JoYWlncG5oY2lvYW5uaWlhZXBjZ2tkaWxvcGZsYmIA",false],"network_stats":{"srtt":156443},"server":"https://hearty.me","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13347193816639865","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL2NhbWJyaWRnZS5vcmcAAAA=",false],"network_stats":{"srtt":25122},"server":"https://analytics.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13347193816762868","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL2NhbWJyaWRnZS5vcmcAAAA=",false],"network_stats":{"srtt":22274},"server":"https://stats.g.doubleclick.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13347193816769886","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL2NhbWJyaWRnZS5vcmcAAAA=",false],"network_stats":{"srtt":16692},"server":"https://www.google.com.tw","supports_spdy":true}],"supports_quic":{"address":"2001:b011:2003:349b:7285:c2ff:fe45:3eb0","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

burnout426

burnout426 Volunteer @masaoliu

@masaoliu Those look like SDCH settings for various sites. I don't think they're the cause.

BestCodes

BestCodes @masaoliu

@masaoliu Check out this Opera page and see if hearty diary is in the running internals anywhere:

opera://serviceworker-internals/

Hi, I'm Best_codes! I'm a full-stack web dev who moderates on the makeblock forum. I have a website, https://bestcodes.dev. I love Opera, so I'm on here occasionally to report bugs and answer some questions.

chennien

chennien

As mentioned earlier, the fetched page wasn't the typical Hearty
Journal page but rather the Cloudflare challenge page, implemented to
deter automated bot access. Typically, users encounter these pages in
unusual situations, such as error 403, 404, 500 and 503. If possible,
could you provide the exact URL that Opera fetched?

If you continue to face difficulties resolving the misconfiguration,
please consider resetting or reinstalling the browser. Once again, I
apologize for any inconvenience caused. Thank you for your
consideration.

masaoliu

masaoliu @BestCodes

@bestcodes said in Opera automatically fetches a page when it starts:

opera://serviceworker-internals/

These are all the displayed entries:

Registrations in: /home/john/.config/opera/Default (6)

Scope: https://community.cloudflare.com/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 3
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Fetch handler type: NOT_SKIPPABLE
Script: https://community.cloudflare.com/service-worker.js
Version ID: 4
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2

Scope: https://forums.opera.com/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 5
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Fetch handler type: NOT_SKIPPABLE
Script: https://forums.opera.com/service-worker.js
Version ID: 13
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2
Client:
ID: 168569c4-b57d-4e1b-850c-cbdf71edd3a6
URL: https://forums.opera.com/topic/67900/opera-automatically-fetches-a-page-when-it-starts/28

Scope: https://mail.google.com/mail/u/0/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 2
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Fetch handler type: NOT_SKIPPABLE
Script: https://mail.google.com/mail/u/0/sw.js?offline_allowed=1
Version ID: 12
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2

Scope: https://twitter.com/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 1
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Fetch handler type: NOT_SKIPPABLE
Script: https://twitter.com/sw.js
Version ID: 15
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2

Scope: https://www.reddit.com/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 0
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Fetch handler type: EMPTY_FETCH_HANDLER
Script: https://www.reddit.com/sw.1ab8087c79dd3679b0bd38e1c9ebc5de.js
Version ID: 0
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2

Scope: https://www.youtube.com/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 4
Navigation preload enabled: true
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: EXISTS
Fetch handler type: NOT_SKIPPABLE
Script: https://www.youtube.com/sw.js
Version ID: 16
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2

masaoliu

masaoliu @chennien

@chennien Thank you for the help.

I can't get the URL because the message that shows up doesn't give me any clue about the URL Opera follows.

All I do to get this message is typing opera & in Linux command prompt.

Somehow, Opera used to repeatedly fetch this content.
This time it seems to have fetched the content only once, immediatly after Opera is launched from command line.

If Opera doesn't repeatedly fetch this big content, I consider to leave it as it is.

masaoliu

masaoliu @masaoliu

@masaoliu
Ah! Opera, and only Opera, repeatedly and automatically fetches this content, when only one this web page and Opera tab is opened.

chennien

chennien

Hi @masaoliu,

In the last line of the image you posted: "source: chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/background_worker.html (0) ", the code doesn't belong to any of our pages. It seemed to be appended by the browser. Could you please check the info of the extension?

masaoliu

masaoliu @chennien

@chennien I have only two extensions, both are disabled.

I will be removing all of them after I have made this comment. I will come back to comment if the auto fetches completely stops.

==Edit==
I can't find a way to remove these extensions. They seem to be mandatory.

BestCodes

BestCodes

@masaoliu I visited hearty.me and the issue began on my device. To resolve it, I went to
opera://serviceworker-internals/ opera://serviceworker-internals/. Then, I pressed CTRL + F and searched for “hearty” and related terms (“.me”, etc.). I found this:

Scope: https://hearty.me/
Storage key:
Ancestor chain bit: SameSite
Registration ID: 93
Navigation preload enabled: false
Navigation preload header length: 4
Active worker:
Installation Status: ACTIVATED
Running Status: STOPPED
Fetch handler existence: DOES_NOT_EXIST
Fetch handler type: NO_HANDLER
Script: https://hearty.me/sw.js
Version ID: 108
Renderer process ID: 0
Renderer thread ID: -1
DevTools agent route ID: -2
Log:

So I unregistered the process, restarted Opera, and the issue was gone.

Let me know if that works for you. It did for me. Best of luck!

Hi, I'm Best_codes! I'm a full-stack web dev who moderates on the makeblock forum. I have a website, https://bestcodes.dev. I love Opera, so I'm on here occasionally to report bugs and answer some questions.