4 ms·

Troy very publicly carrying water for Scott Helme/Report URI looks quite a bit different in hindsight, as the number of Report URI marketers doubles to 2. · ht

by j_s 9y ago

Troy very publicly carrying water for Scott Helme/Report URI looks quite a bit different in hindsight, as the number of Report URI marketers doubles to 2. · https://twitter.com/troyhunt/status/920590590223331329 https://twitter.com/troyhunt/status/920590590223331329 · https://twitter.com/troyhunt/status/920222303849390081 https://twitter.com/troyhunt/status/920222303849390081 · https://twitter.com/troyhunt/status/920173854835720193 https://twitter.com/troyhunt/status/920173854835720193 The uBlock Origin dev compromised with an opt-out for CSP reports, even though they can be used for things like IP address leaks to 3rd party servers (similar to the as-seen-in-court Tor-busting captcha mess). Personally I would prefer only same-origin reports. -- My biggest problem in all of this is that Scott was not careful to always document his not-quite-obvious conflict of interest, and even worse: Troy's association is only now being revealed weeks later. I do appreciate the work being done to improve the effectiveness of CSP reports in default configurations of open source tools, but can't help wondering about the motivation. Disclaimers go a long way toward keeping unsuspecting maintainers informed of both sides of an issue. · https://github.com/issues?utf8=%E2%9C%93&q=is%3Aissue+author%3Ascotthelme+CSP https://github.com/issues?utf8=%E2%9C%93&q=is%3Aissue+author... · https://twitter.com/Danbo/status/920325189954654208 https://twitter.com/Danbo/status/920325189954654208 Scott was also blamed here on HN last week for his part in promoting the death of HKHP (public key pinning) apparently due to ease of misconfiguration. · https://news.ycombinator.com/item?id=15573076 https://news.ycombinator.com/item?id=15573076 Looking back now I'm left wondering how HKHP affected Report URI and Scott's other project, Security Headers. I will disclose my bias as I watch highly effective marketing of convenience (top of HN!) triumph over my personal flavor of slightly paranoid privacy yet again.

pfg 9y ago
I don't understand the argument that it's bad because it leaks the IP address to a third party. So would embedding any other resource hosted on a different domain - from JavaScript CDNs to images. No one is suggesting these should be blocked, right? I have no problem with uBlock blocking requests to the CSP report-uri if the domain in question is on the user's filter list (I'd probably consider it a bug if it didn't do that), but that's not what is happening here (before this was fixed, that is). The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar.
- j_s 9y ago
  It is 100% clear to me that differences of opinion will result in drawing the line on an ad blocker's default configuration in different places. Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I personally was unaware [edit]this could happen to me in Chrome with uBlock Origin installed[/edit] until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true. > JavaScript CDNs to images. No one is suggesting these should be blocked, right? Many of these [edit](specifically: tracking pixels and just straight up ad images)[/edit] are blocked by ad blockers in the default configuration. > The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar. Thank you for the correction. I apparently imagined this referenced when partial VPN or Tor is insecurely used only to access specific domains, or DNS is not also routed through. [edit] updated with a bit more detail
  - pfg 9y ago
    > Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I'm not sure what you're asking - when did I become aware of this possibility? I guess when I learned about CSP? > I personally was unaware this was possible until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true. Adblockers block requests to things like Google Analytics by matching the domain (and other patterns). Why is this not an acceptable solution for CSP? If tracking tools start using CSP for this, they'll be added to the filter lists, just like any other tracking script. We're not asking uBlock to block all third-party requests on the off-chance it might be an ad or tracking service, so why would we do that for CSP? > Many of these are blocked by ad blockers in the default configuration. Do you have a source for this? This would break a large number of sites. uBlock seems to have an experimental feature that mirrors certain popular CDN URLs locally, but it doesn't seem to be enabled by default and the Wiki page hasn't been updated in over two years. AIUI, even with this feature enabled, requests to non-popular (non-local) assets would still go through.
    - 9y ago

by j_s 9y ago

pfg 9y ago

I don't understand the argument that it's bad because it leaks the IP address to a third party. So would embedding any other resource hosted on a different domain - from JavaScript CDNs to images. No one is suggesting these should be blocked, right? I have no problem with uBlock blocking requests to the CSP report-uri if the domain in question is on the user's filter list (I'd probably consider it a bug if it didn't do that), but that's not what is happening here (before this was fixed, that is). The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar.

j_s 9y ago
It is 100% clear to me that differences of opinion will result in drawing the line on an ad blocker's default configuration in different places. Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I personally was unaware [edit]this could happen to me in Chrome with uBlock Origin installed[/edit] until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true. > JavaScript CDNs to images. No one is suggesting these should be blocked, right? Many of these [edit](specifically: tracking pixels and just straight up ad images)[/edit] are blocked by ad blockers in the default configuration. > The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar. Thank you for the correction. I apparently imagined this referenced when partial VPN or Tor is insecurely used only to access specific domains, or DNS is not also routed through. [edit] updated with a bit more detail
- pfg 9y ago
  > Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I'm not sure what you're asking - when did I become aware of this possibility? I guess when I learned about CSP? > I personally was unaware this was possible until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true. Adblockers block requests to things like Google Analytics by matching the domain (and other patterns). Why is this not an acceptable solution for CSP? If tracking tools start using CSP for this, they'll be added to the filter lists, just like any other tracking script. We're not asking uBlock to block all third-party requests on the off-chance it might be an ad or tracking service, so why would we do that for CSP? > Many of these are blocked by ad blockers in the default configuration. Do you have a source for this? This would break a large number of sites. uBlock seems to have an experimental feature that mirrors certain popular CDN URLs locally, but it doesn't seem to be enabled by default and the Wiki page hasn't been updated in over two years. AIUI, even with this feature enabled, requests to non-popular (non-local) assets would still go through.
  - 9y ago