6 ms·

They all suck. Period. Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc

They all suck. Period. Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls. Ad parties don't sit still, they don't keep their ads on the same url when they found out they are blocked or maybe already preventive rotate through new urls etc. In the end you'll end up with some bizar long list which has to be checked for every url you visit etc etc. This will be a performance hog, and if you cant imagine that, then your list isn't long enough yet. Use proper egress filtering, allow what you know, and don't allow what you don't know, not just what some 3rd party put on a list. My advice for you in 2018. For ""Block by default" is a usability nightmare." yes it is for a week or 2, but I prefer usability nightmare then a safety nightmare.

joaodlf 9y ago
Way too negative. I have been using uBlock Origin for years and it's one of those things that just works. Turning it off in those rare moments it needs to be off is a bleak reminder of the state of the internet. Why would I want to go through the hassle of managing all of this work by myself? A massive THANK YOU to the individuals behind uBlock - You literally make the internet tolerable for me.
- mobilemidget 9y ago
  I don't know why you call it negative, I call it realistic. It's like putting all _caught_ pedofiles in a jail, and then saying children can roam the streets free and in safety...
  - otp124 9y ago
    It might be realistic to whitelist egress on a production server, but certainly not at my mother’s house.
    - thinkMOAR 9y ago
      The safety of your mothers' e.g. online banking, privacy, computer data(pictures, home videos etc) is less important then the company you work for (and probably has insurance)? update: Apparently for many here, protecting your family is less important. Sort of happy you are not my son or daughter giving me computer advice.
      - QasimK 9y ago
        The point is that if you do what you suggest, either maintaining your mothers’ devices becomes practically a full-time job where you are on call at all times (and you end up fully monitoring what she is doing even if you don’t want to know), or, from her perspective, the internet is “broken”. Probably both.
        thinkMOAR 9y ago
        The point is, that you make assumptions how much work it actually is and i am not, as i do this with almost everybody that asks me for such 'help' (after fixing, cleaning etc their machines). Stating it will be a full time job is such an overstatement, i'd almost call it a blatant lie. Your mom is on FB, YT, and maybe a handful of other sites daily (so no popups for those or decisions to take there). You could also monitor and log and then apply block/allow rules later for when you visit for coffee or dinner. (if you want to reply something here about unprotected in that period, think about all the new bad urls not on such url lists yet for apps like uBlock) And i only get positive feedback how well it works and how much they learned about websites and other internet services, the information leaked to 3rd parties, cooperation between companies. Even scared some contacts i have from social media like FB, Instagram and alike. Makes them a lot more aware of what is going on instead of giving them a list of known crap urls, again, maintained by some samaritan in an attic. Nice effort, i just think its fair from sufficient nowadays on the internet. In the time it takes these people to update the list, 1000 new crap urls have been registered. And doesn't take that much time, sure you have to put in some more time then, simply telling people to install uBlock (or similar) and tell them that they are safe and secure with this application. I prefer to educate properly instead of just throwing some half *ed solution their way and having them figure out it fails in the end anyway. Another note, the internet is broken, broken in many ways. And _you_ know this else you would not suggest any protection, apps like uBlock.
  - yjftsjthsd-h 9y ago
    > I don't know why you call it negative, I call it realistic. Negativity usually bills itself as realism, but that doesn't make it so.
  - elorant 9y ago
    It might be realistic for you, or me or anyone in here, but it definitely isn't realistic for the average user. And it's them we try to protect by blocking ads. Technical savvy people have an armada of options at their disposal, for example we could just block JavaScript. But the average Joe relies heavily on ad blockers for a smoother and safer experience browsing the web. You can't expect non technical users to do any of the things you propose.
  - ggg9990 9y ago
    You're arguing against yourself. They do put all caught pedophiles in jail, and it's extremely safe for children to roam the streets from a pedophile point of view (but very risky from a car accident point of view).
    - deleted 9y ago
      [deleted]
eps 9y ago
"Block by default" is a usability nightmare.
ascorbic 9y ago
> Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls. Right, and how is that supposed to happen in practice? Manually inspect every CDN domain loaded on every page that you visit? Or just live without scripts, images, fonts, video?
- klibertp 9y ago
  > Manually inspect every CDN domain loaded on every page that you visit? Basically, yes, see uMatrix. It's not for non-web-devs, I feel, but if you can easily recognize unnecessary connections it works pretty well.
  - _0ffh 9y ago
    > It's not for non-web-devs, I feel I don't know. I'm not a web dev (x), and I went from "dafuq?" to "I get it, this is so cool" in two minutes flat. Let's just say it sure helps if you're a technical person, not j. random user. (x) but engineer/CS, tbh edit: remove accidental markup
    - TheSpiceIsLife 9y ago
      I'm a trade qualified welder and metal fabricator and even I understand uMatrix. It's not rocket surgery.
      - klibertp 9y ago
        > It's not rocket surgery. Certainly, it just can take more time to sift through the list of tens of domains and deciding to allow or ban each connection if you don't already know which connections tend to be needed and which are not. Still, it's perfectly doable for anyone if you experiment a little, and it's done once per site, so the time needed for this shouldn't be an issue. It's just that people working with this stuff will have an easier time using uMatrix - which is what I really meant in my comment above :)
    - 9y ago
thinkMOAR 9y ago
Little snitch! (OSX) https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html no i don't work for or get paid in anyway by little snitch, i just love the product.
- kstrauser 9y ago
  You beat me to it, but I was going to mention LS too. Imaging you start off with Safari being unable to connect to anything. Little Snitch is running in Alert Mode and it asks you to decide on every outbound network connection. You visit Facebook. LS asks if Safari can talk to facebook.com on port 443. You say "yes, always". What about "server893.ads.facebook.com:443"? You say "make that .ads.facebook.com and block it forever". Do this through the few dozen prompts you'll get on this first visit when you visit a resource-heavy domain. Now hit reload and pick up a few more (like maybe this time you'll get a connection to a video CDN that you didn't see last time). Repeat until the requests taper off to nothing. Now put Little Snitch into "Silent Deny" mode and enjoy your Safari that can only view ad-free Facebook. Note: I don't really recommend doing this because I'd rather be doing almost literally anything else, but if I had to set up a social media kiosk for a relative, that's how I'd go about it. I do highly enjoy telling Little Snitch to deny connections to all the non-port-80/443 ad trackers. I can't imagine a single legitimate reason why I'd want Safari to connect to moatads.com:843.
gorhill 9y ago
> They all suck. Period. Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls. uBlock Origin allows you to block yourself any outgoing connection to servers you do not trust, including working in default-deny mode if you want[1]. In any case, those filter lists are maintained by dedicated volunteers[2], their work is way under-appreciated, because contrary to what you state, these volunteers spend a whole lot of time ensuring everything work as expected so that in the end all non-technical users who wouldn't be able to deal with default-deny mode can also be protected. * * * [1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... [2] https://github.com/easylist/easylist/commits/master https://github.com/easylist/easylist/commits/master https://github.com/uBlockOrigin/uAssets/commits/master https://github.com/uBlockOrigin/uAssets/commits/master
supergreg 9y ago
I'll trust the block lists from my internet neighbors. Thank you for your concern but the people who build those lists take sufficient care and most use a transparent process to add rules to them, like GitHub pull requests, and if there's ever a rule that wrongly blocks a site I can whitelist it myself with ease. They might burn some CPU cycles but surely the ads themselves burn much more.

joaodlf 9y ago

Way too negative. I have been using uBlock Origin for years and it's one of those things that just works. Turning it off in those rare moments it needs to be off is a bleak reminder of the state of the internet. Why would I want to go through the hassle of managing all of this work by myself? A massive THANK YOU to the individuals behind uBlock - You literally make the internet tolerable for me.

mobilemidget 9y ago
I don't know why you call it negative, I call it realistic. It's like putting all _caught_ pedofiles in a jail, and then saying children can roam the streets free and in safety...
- otp124 9y ago
  It might be realistic to whitelist egress on a production server, but certainly not at my mother’s house.
  - thinkMOAR 9y ago
    The safety of your mothers' e.g. online banking, privacy, computer data(pictures, home videos etc) is less important then the company you work for (and probably has insurance)? update: Apparently for many here, protecting your family is less important. Sort of happy you are not my son or daughter giving me computer advice.
    - QasimK 9y ago
      The point is that if you do what you suggest, either maintaining your mothers’ devices becomes practically a full-time job where you are on call at all times (and you end up fully monitoring what she is doing even if you don’t want to know), or, from her perspective, the internet is “broken”. Probably both.
      - thinkMOAR 9y ago
        The point is, that you make assumptions how much work it actually is and i am not, as i do this with almost everybody that asks me for such 'help' (after fixing, cleaning etc their machines). Stating it will be a full time job is such an overstatement, i'd almost call it a blatant lie. Your mom is on FB, YT, and maybe a handful of other sites daily (so no popups for those or decisions to take there). You could also monitor and log and then apply block/allow rules later for when you visit for coffee or dinner. (if you want to reply something here about unprotected in that period, think about all the new bad urls not on such url lists yet for apps like uBlock) And i only get positive feedback how well it works and how much they learned about websites and other internet services, the information leaked to 3rd parties, cooperation between companies. Even scared some contacts i have from social media like FB, Instagram and alike. Makes them a lot more aware of what is going on instead of giving them a list of known crap urls, again, maintained by some samaritan in an attic. Nice effort, i just think its fair from sufficient nowadays on the internet. In the time it takes these people to update the list, 1000 new crap urls have been registered. And doesn't take that much time, sure you have to put in some more time then, simply telling people to install uBlock (or similar) and tell them that they are safe and secure with this application. I prefer to educate properly instead of just throwing some half *ed solution their way and having them figure out it fails in the end anyway. Another note, the internet is broken, broken in many ways. And _you_ know this else you would not suggest any protection, apps like uBlock.
- yjftsjthsd-h 9y ago
  > I don't know why you call it negative, I call it realistic. Negativity usually bills itself as realism, but that doesn't make it so.
- elorant 9y ago
  It might be realistic for you, or me or anyone in here, but it definitely isn't realistic for the average user. And it's them we try to protect by blocking ads. Technical savvy people have an armada of options at their disposal, for example we could just block JavaScript. But the average Joe relies heavily on ad blockers for a smoother and safer experience browsing the web. You can't expect non technical users to do any of the things you propose.
- ggg9990 9y ago
  You're arguing against yourself. They do put all caught pedophiles in jail, and it's extremely safe for children to roam the streets from a pedophile point of view (but very risky from a car accident point of view).
  - deleted 9y ago
    [deleted]

eps 9y ago

"Block by default" is a usability nightmare.

ascorbic 9y ago

> Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls. Right, and how is that supposed to happen in practice? Manually inspect every CDN domain loaded on every page that you visit? Or just live without scripts, images, fonts, video?

klibertp 9y ago
> Manually inspect every CDN domain loaded on every page that you visit? Basically, yes, see uMatrix. It's not for non-web-devs, I feel, but if you can easily recognize unnecessary connections it works pretty well.
- _0ffh 9y ago
  > It's not for non-web-devs, I feel I don't know. I'm not a web dev (x), and I went from "dafuq?" to "I get it, this is so cool" in two minutes flat. Let's just say it sure helps if you're a technical person, not j. random user. (x) but engineer/CS, tbh edit: remove accidental markup
  - TheSpiceIsLife 9y ago
    I'm a trade qualified welder and metal fabricator and even I understand uMatrix. It's not rocket surgery.
    - klibertp 9y ago
      > It's not rocket surgery. Certainly, it just can take more time to sift through the list of tens of domains and deciding to allow or ban each connection if you don't already know which connections tend to be needed and which are not. Still, it's perfectly doable for anyone if you experiment a little, and it's done once per site, so the time needed for this shouldn't be an issue. It's just that people working with this stuff will have an easier time using uMatrix - which is what I really meant in my comment above :)
  - 9y ago

thinkMOAR 9y ago

Little snitch! (OSX) https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html no i don't work for or get paid in anyway by little snitch, i just love the product.

kstrauser 9y ago
You beat me to it, but I was going to mention LS too. Imaging you start off with Safari being unable to connect to anything. Little Snitch is running in Alert Mode and it asks you to decide on every outbound network connection. You visit Facebook. LS asks if Safari can talk to facebook.com on port 443. You say "yes, always". What about "server893.ads.facebook.com:443"? You say "make that .ads.facebook.com and block it forever". Do this through the few dozen prompts you'll get on this first visit when you visit a resource-heavy domain. Now hit reload and pick up a few more (like maybe this time you'll get a connection to a video CDN that you didn't see last time). Repeat until the requests taper off to nothing. Now put Little Snitch into "Silent Deny" mode and enjoy your Safari that can only view ad-free Facebook. Note: I don't really recommend doing this because I'd rather be doing almost literally anything else, but if I had to set up a social media kiosk for a relative, that's how I'd go about it. I do highly enjoy telling Little Snitch to deny connections to all the non-port-80/443 ad trackers. I can't imagine a single legitimate reason why I'd want Safari to connect to moatads.com:843.

gorhill 9y ago

> They all suck. Period. Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls. uBlock Origin allows you to block yourself any outgoing connection to servers you do not trust, including working in default-deny mode if you want[1]. In any case, those filter lists are maintained by dedicated volunteers[2], their work is way under-appreciated, because contrary to what you state, these volunteers spend a whole lot of time ensuring everything work as expected so that in the end all non-technical users who wouldn't be able to deal with default-deny mode can also be protected. * * * [1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... [2] https://github.com/easylist/easylist/commits/master https://github.com/easylist/easylist/commits/master https://github.com/uBlockOrigin/uAssets/commits/master https://github.com/uBlockOrigin/uAssets/commits/master

supergreg 9y ago

I'll trust the block lists from my internet neighbors. Thank you for your concern but the people who build those lists take sufficient care and most use a transparent process to add rules to them, like GitHub pull requests, and if there's ever a rule that wrongly blocks a site I can whitelist it myself with ease. They might burn some CPU cycles but surely the ads themselves burn much more.