How to Configure WebPositive: Bookmarks, Privacy, and Downloads

WebPositive—often called Web+—is Haiku’s native browser built on the project’s WebKit port. Its current interface provides start/search/download behavior, fonts, proxy configuration, file-based bookmarks, a downloads window, history controls, and a cookie manager. It does not expose every privacy/security control familiar from larger browsers, so configuration must distinguish implemented features from wishful menu paths.

Record the browser and package baseline

Before changing settings, record Haiku revision, architecture, installed WebPositive/HaikuWebKit package versions, and whether the problem occurs in a stable release or nightly package state. Use package inventory rather than a website’s user-agent guess.

Update only through Haiku’s configured trusted repositories and keep the system/browser packages on a supported combination. A rendering-engine update can affect cookies, TLS, downloads, and site compatibility; preserve an earlier bootable package state and bookmarks before a major update.

WebPositive stores configuration, cookies, cache, and browsing history under:

~/config/settings/WebPositive/

Bookmarks live as individual files below its Bookmarks directory. Back up that directory while WebPositive is closed before a large reorganization or profile reset. Do not copy the whole live settings directory over a running browser and assume every database/message file is consistent.

Configure the settings WebPositive actually exposes

Open Window → Settings. The current official guide documents three areas: general settings, fonts, and proxy server. It does not document separate “Privacy,” “Downloads,” or “Advanced/User Agent” tabs from the old article.

In General, configure:

Start page file or URL.
Search page; a custom engine uses %s where the encoded search term belongs.
Download folder.
What a new window, new tab, and startup should load.
Tab-bar, full-screen-interface, pointer, and Home-button behavior.
Number of days retained in the History menu.

Use an HTTPS search endpoint with the correct query template. Test one term from the locator field; an invalid %s template can turn searches into malformed URLs or disclose terms to an unintended host.

Choose a dedicated download folder on a volume with sufficient space and a backup/cleanup policy. Do not use a package-managed system directory or a location automatically executed at startup.

Set fonts and proxy without hiding failures

The Fonts page selects standard, serif, sans-serif, and fixed-width faces and sizes. Test ordinary text, code, non-Latin characters, and zoom. A missing glyph is usually a font-coverage or page issue, not evidence that changing the browser’s encoding will fix it.

Proxy settings include address, port, and optional authentication in current source. Use only a trusted proxy whose certificate/TLS behavior and logging policy are understood. Verify both HTTP and HTTPS destinations and compare direct access when diagnosing.

Do not leave a sensitive proxy password in a shared Haiku profile. The settings source shows proxy credentials are configuration values; do not assume OS-backed encryption merely because the password field hides typing. Restrict filesystem/profile access and prefer short-lived, dedicated credentials where supported.

If a proxy makes one site fail, capture exact error and proxy logs rather than disabling certificate validation or installing an untrusted root blindly.

Organize bookmarks through Tracker

Bookmark the current page with Alt+B. Use Manage bookmarks… or Alt+M to open the bookmark directory in Tracker. Each bookmark is a file with attributes such as URL, name/title, and keywords; display those columns through Tracker’s Attributes menu and edit them like other attributes.

Create folders for a small stable taxonomy, but preserve the behavior described by the official guide: keeping master bookmarks in the root and copies in custom subfolders allows Tracker type-ahead filtering across the full collection while still producing submenu organization. Test whether copied entries remain intentional duplicates before bulk deletion.

The bookmark bar is toggled from View. You can drag the favicon/URL marker into the bar, Desktop, or a Tracker window. After reorganizing, click every high-value bookmark, confirm its URL/title, and reopen WebPositive to verify persistence.

Backups must preserve BFS attributes. A generic archive, cloud sync, or non-BFS target can keep empty/small bookmark files while discarding the URL metadata that makes them useful. Restore a sample and inspect its attributes before trusting the backup.

Manage history with correct scope

General settings controls how many days links remain in the History menu; current source constrains that setting rather than offering unlimited retention. The History menu also provides Clear history with confirmation.

Clearing history does not mean “clear all browsing data.” It does not delete downloaded files, bookmarks, every cookie, cache data, or persistent HTTP authentication credentials. Verify each data class separately instead of presenting one button as a privacy wipe.

Locator suggestions draw on previously visited sites, so clear history when that list itself is sensitive. Reopen the browser and confirm old history entries no longer appear. On a shared machine, remember Haiku’s normal desktop is not a mature isolated multi-user environment; browser-profile privacy cannot substitute for separate OS accounts.

Inspect and delete cookies deliberately

Open Window → Cookie manager. Current source and translated UI expose cookie domains and fields including name, path, expiration, value, and flags, with deletion support. Remove cookies for one site when troubleshooting authentication; removing all cookies signs out sites and discards preferences/session state.

Session cookies are expected to expire on browser exit. Persistent cookies carry expiration dates. If a site repeatedly logs out, capture the site, cookie domain/path/expiration, WebPositive/HaikuWebKit version, and exact navigation sequence before deleting evidence.

The current Settings window does not provide the old article’s advertised accept-all/block-third-party/block-all policy. Cookie deletion after receipt is not equivalent to preventing third-party cookies, tracking requests, scripts, fingerprinting, or storage in the first place. Do not market it as tracking protection.

For privacy-sensitive use requiring content blocking, site isolation, extension policies, or mature per-site permission controls, choose a browser/platform that demonstrably supplies those requirements. A native lightweight browser can be useful without being the right boundary for every high-risk workflow.

Treat remembered credentials separately

When a site uses HTTP authentication, WebPositive can offer to remember the username/password. Current source maintains session and persistent credential stores, but the documented Settings UI does not include the “Saved Passwords” manager claimed by the previous article.

For sensitive accounts, decline persistent storage and use a dedicated password manager workflow that does not depend on an undocumented browser store. Never assume a hidden password field means encrypted-at-rest storage.

If persistent HTTP credentials must be removed and the current build offers no UI, close WebPositive and consult the matching CredentialsStorage source/path before touching profile files. Back up bookmarks separately, quarantine only the credential store, relaunch, and verify all saved HTTP credentials were intentionally cleared. Do not hex-edit or partially rewrite the flattened settings data.

Website form passwords, HTTP-auth credentials, cookies, and proxy credentials are different stores. Clearing one is not proof the others are gone.

Manage downloads as files, not browser history

Open Window → Downloads or use Alt+D. The window shows progress, speed, size, estimated completion, and controls to cancel, restart, open, or remove list entries. “Remove finished” removes entries from the list; it does not necessarily delete the downloaded files. “Remove missing” cleans references whose files were moved/deleted.

Tracker can rename or move a download while WebPositive is tracking it, and the Downloads window follows those changes. Moving an active download to Trash stops it. After completion, verify file type, size, checksum/signature from an authoritative source, and actual content before opening.

Downloaded files can carry a META:url attribute recording origin, viewable with Haiku attribute tools or DiskProbe. Useful provenance is not authenticity: a hostile server can still deliver malicious or misleading content from the recorded URL.

Install software through HaikuDepot/trusted repositories when available. Do not execute a script or HPKG solely because the browser completed it successfully.

Avoid fake compatibility fixes

The old article recommended a Settings → Advanced user-agent override. Current WebPositive Settings source does not implement that panel. More importantly, claiming to be another browser does not add missing JavaScript APIs, codecs, DRM, WebAssembly behavior, security mitigations, or engine fixes.

If a site rejects WebPositive, capture console/network behavior, browser and WebKit versions, minimal URL, expected/actual result, and whether another Haiku browser works. Report a standards/compatibility bug rather than inventing a global identity string that can make server behavior harder to diagnose.

Likewise, there is no documented one-click “Clear Browsing Data” panel covering history and cache together. Use the real History and Cookie Manager controls. For cache corruption, close the browser, preserve the profile and exact reproduction, and follow a current issue-specific recovery procedure rather than recursively deleting the whole settings directory.

Verify the final configuration

Restart WebPositive and confirm start/search pages, new-tab policy, fonts, proxy, download folder, bookmark attributes, history retention, and intended cookies persist. Download a harmless test file, move it with Tracker, verify provenance, and remove both the list entry and file deliberately.

The privacy audit should list what remains stored: history, cookies, cache, bookmarks, downloads, HTTP credentials, proxy credentials, and any site data. Configuration is complete when each retained class is intentional and its removal path is known—not when a nonexistent privacy preset has been selected.

Related:

Sources: