19 ms·

For anyone who uses uBlock Origin (and if you don't, I highly recommend it), there is a companion plugin for WebSockets that I recently stumbled upon and am enj

For anyone who uses uBlock Origin (and if you don't, I highly recommend it), there is a companion plugin for WebSockets that I recently stumbled upon and am enjoying https://github.com/gorhill/uBO-WebSocket https://github.com/gorhill/uBO-WebSocket The article also notes that uBlock and ABP have both shipped "workarounds", in the typical cat and mouse fashion

ryuuchin 10y ago
The workarounds are reliant on filter lists to remain up to date. You can also just block websocket completely by adding the following to your filters (provided you're not using websockets for anything else): ||*$websocket,important You could actually use this method to create a whitelist by removing the "important" argument then creating a whitelist using the correct syntax.
- noir_lord 10y ago
  Yep an "Off by default: This site is requesting to use WebSockets" approach would be the best solution.
  - chipperyman573 10y ago
    The problem is that non-techie users have started to use adblock (even my grandma had adblock on her laptop). Obviously HN users would be able to look at a page, think "Oh, a websocket could be used to provide real-time updates on vote counts" (for example), and allow it. But a regular user would see a scary warning and just close out of it.
Klathmon 10y ago
Maybe try paying for the content through their plan that allows you to pay without seeing any ads? I get that this is a porn site we are talking about here, but why is "just pay for it" never discussed in these kinds of submissions? Why is it always "how do we keep getting all this content for free without paying" and not "why can't they make it easier to pay" or "how else can I pay for this without losing security or anonymity"?
- sdoering 10y ago
  The problem isn't (at least with me) not that I have a problem with paying for content, but with opening and attack vector that isn't even controlled by the primarily visited outlet (be it porn or journalism). It wouldn't (at least in my case) be a problem with advertisement per se. Adservers with additional adservers behind them (and cascading further down) where only one would have to be compromised to infect my machine is what makes me use hard rules not to let (unknown) third party requests on any page pass. I try to minimize my flank surface in regards to such online attack possibilities. In my case it is with adblocking, a curated and regularly updated host file, 3rd party request blockage and so on... OK, the net is mostly unusable and painful nowadays, but that is the price to pay.
- tokenizerrr 10y ago
  Because I really enjoy not getting malware installed on my computer. As long as ads are one of the major vectors for malware installations, and ad networks barely vet the ads they publish, I will be doing everything I can do to block them.
  - Klathmon 10y ago
    If that were really the case, wouldn't paying the price for their premium package that has a 0% chance of having advertisements be better than using an adblocker which clearly has a greater than 0% chance at seeing ads?
    - bahjoite 10y ago
      Of course not. Using an ad blocker means that ads are blocked at all sites. Paying for content at one site clearly doesn't affect the ads delivered by other sites.
      - Klathmon 10y ago
        the 2 aren't mutually exclusive. You can have an adblocker, and still pay for content...
cm3 10y ago
Is it correct that the Firefox uBlock Origin doesn't need the companion as it already supports WebSockets filtering?
- broguinn 10y ago
  I would really like to know the answer to this question.
- mcescalante 10y ago
  Yes, this appears to be correct - the Firefox API supports filtering out of the box. If you check the readme on the WebSocket companion, it specifically mentions Chromium based browsers, assumedly indicating it's intended for them. There is also a note on the normal uBlock repo that says that Firefox has an extra feature with a link to inline script tag filtering, which says it does not work on Chromium based brownsers: https://github.com/gorhill/uBlock/wiki/Inline-script-tag-filtering https://github.com/gorhill/uBlock/wiki/Inline-script-tag-fil...
  - cm3 10y ago
    Thanks for the confirmation. I expect new engines like Servo to support content and request filtering at a lower layer for efficiency reasons, while of course still exposing it to JavaScript as needed. Opera already does this out of the box, though I don't know the internals and it's not as full featured as uBlock Origin. Without uBlock Origin and uMatrix, the web would be unusable from a UX perspective. thanks gorhill and friends!
  - gorhill 10y ago
    To be sure there is no confusion, it's possible to block inline scripts with Chromium, but not on a per-inline script tag basis. Per-inline script tag filtering is possible for Firefox, but the feature relies on "beforescriptexecute", which is planned to be deprecated in Firefox as well[1]. As a result I have ceased to create "script:contains" filters and favor filter solutions which work on all browsers. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1286822 https://bugzilla.mozilla.org/show_bug.cgi?id=1286822
the8472 10y ago
Note that this this only intercepts websocket requests in the DOM window context. It could be potentially be bypassed by using workers which have access to websocket APIs. The real solution is for chrome to add support to their request filtering.
- gorhill 10y ago
  Filters such as `*$websocket`[1] should also work in workers as well, since such filter syntax causes a CSP directive to forbid websocket connections to be injected into a page. [1] Used for Pornhub and many others.
takeda 10y ago
Was wondering why it's only available for Chrome; after researching this more, it looks like Firefox version of uBlock Origin shouldn't need any extra addons to block websockets.
necessity 10y ago
Or just disable WebSockets on about:config, which should be done anyway.
miles 10y ago
On the Chrome Web Store page for that extension[1], it mentions: "UPDATE: since this companion extension was published, uBlock Origin has itself gained the ability to blanket-block all websocket connection attempts for specific sites using a new filter syntax." [1] https://chrome.google.com/webstore/detail/ublock-origin-websocket/pgdnlhfefecpicbbihgmbmffkjpaplco https://chrome.google.com/webstore/detail/ublock-origin-webs...

ryuuchin 10y ago

The workarounds are reliant on filter lists to remain up to date. You can also just block websocket completely by adding the following to your filters (provided you're not using websockets for anything else): ||*$websocket,important You could actually use this method to create a whitelist by removing the "important" argument then creating a whitelist using the correct syntax.

noir_lord 10y ago
Yep an "Off by default: This site is requesting to use WebSockets" approach would be the best solution.
- chipperyman573 10y ago
  The problem is that non-techie users have started to use adblock (even my grandma had adblock on her laptop). Obviously HN users would be able to look at a page, think "Oh, a websocket could be used to provide real-time updates on vote counts" (for example), and allow it. But a regular user would see a scary warning and just close out of it.

Klathmon 10y ago

Maybe try paying for the content through their plan that allows you to pay without seeing any ads? I get that this is a porn site we are talking about here, but why is "just pay for it" never discussed in these kinds of submissions? Why is it always "how do we keep getting all this content for free without paying" and not "why can't they make it easier to pay" or "how else can I pay for this without losing security or anonymity"?

sdoering 10y ago
The problem isn't (at least with me) not that I have a problem with paying for content, but with opening and attack vector that isn't even controlled by the primarily visited outlet (be it porn or journalism). It wouldn't (at least in my case) be a problem with advertisement per se. Adservers with additional adservers behind them (and cascading further down) where only one would have to be compromised to infect my machine is what makes me use hard rules not to let (unknown) third party requests on any page pass. I try to minimize my flank surface in regards to such online attack possibilities. In my case it is with adblocking, a curated and regularly updated host file, 3rd party request blockage and so on... OK, the net is mostly unusable and painful nowadays, but that is the price to pay.
tokenizerrr 10y ago
Because I really enjoy not getting malware installed on my computer. As long as ads are one of the major vectors for malware installations, and ad networks barely vet the ads they publish, I will be doing everything I can do to block them.
- Klathmon 10y ago
  If that were really the case, wouldn't paying the price for their premium package that has a 0% chance of having advertisements be better than using an adblocker which clearly has a greater than 0% chance at seeing ads?
  - bahjoite 10y ago
    Of course not. Using an ad blocker means that ads are blocked at all sites. Paying for content at one site clearly doesn't affect the ads delivered by other sites.
    - Klathmon 10y ago
      the 2 aren't mutually exclusive. You can have an adblocker, and still pay for content...

cm3 10y ago

Is it correct that the Firefox uBlock Origin doesn't need the companion as it already supports WebSockets filtering?

broguinn 10y ago
I would really like to know the answer to this question.
mcescalante 10y ago
Yes, this appears to be correct - the Firefox API supports filtering out of the box. If you check the readme on the WebSocket companion, it specifically mentions Chromium based browsers, assumedly indicating it's intended for them. There is also a note on the normal uBlock repo that says that Firefox has an extra feature with a link to inline script tag filtering, which says it does not work on Chromium based brownsers: https://github.com/gorhill/uBlock/wiki/Inline-script-tag-filtering https://github.com/gorhill/uBlock/wiki/Inline-script-tag-fil...
- cm3 10y ago
  Thanks for the confirmation. I expect new engines like Servo to support content and request filtering at a lower layer for efficiency reasons, while of course still exposing it to JavaScript as needed. Opera already does this out of the box, though I don't know the internals and it's not as full featured as uBlock Origin. Without uBlock Origin and uMatrix, the web would be unusable from a UX perspective. thanks gorhill and friends!
- gorhill 10y ago
  To be sure there is no confusion, it's possible to block inline scripts with Chromium, but not on a per-inline script tag basis. Per-inline script tag filtering is possible for Firefox, but the feature relies on "beforescriptexecute", which is planned to be deprecated in Firefox as well[1]. As a result I have ceased to create "script:contains" filters and favor filter solutions which work on all browsers. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1286822 https://bugzilla.mozilla.org/show_bug.cgi?id=1286822

the8472 10y ago

Note that this this only intercepts websocket requests in the DOM window context. It could be potentially be bypassed by using workers which have access to websocket APIs. The real solution is for chrome to add support to their request filtering.

gorhill 10y ago
Filters such as `*$websocket`[1] should also work in workers as well, since such filter syntax causes a CSP directive to forbid websocket connections to be injected into a page. [1] Used for Pornhub and many others.

takeda 10y ago

Was wondering why it's only available for Chrome; after researching this more, it looks like Firefox version of uBlock Origin shouldn't need any extra addons to block websockets.

necessity 10y ago

Or just disable WebSockets on about:config, which should be done anyway.

miles 10y ago

On the Chrome Web Store page for that extension[1], it mentions: "UPDATE: since this companion extension was published, uBlock Origin has itself gained the ability to blanket-block all websocket connection attempts for specific sites using a new filter syntax." [1] https://chrome.google.com/webstore/detail/ublock-origin-websocket/pgdnlhfefecpicbbihgmbmffkjpaplco https://chrome.google.com/webstore/detail/ublock-origin-webs...