5 ms·

I think only one approach works these days: Consider the whole web hostile. Browse with uBlock Origin and JS off. Enable JS for trusted domains only. Give up,

I think only one approach works these days: Consider the whole web hostile. Browse with uBlock Origin and JS off. Enable JS for trusted domains only. Give up, blacklist, and go elsewhere if whack-a-mole enabling needs too many unknown random domains enabled just to read that article.

PuffinBlue 9y ago
What tool do you use to manage switching JavaScript on and off on a per site basis? I too want to default off and whitelist but I'm not sure the best way to do it as the browser addons I have found make it easy to turn JS off, but they default to on and don't have a default off capability.
- dmm 9y ago
  NoScript is what I've always used. It defaults all javascript to be off and you can enable it permanently or temporarily per domain.
- oldcynic 9y ago
  NoScript on Firefox and Scriptsafe[0] on Chrome. [0] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...
  - PuffinBlue 9y ago
    Thanks, I'll take a look.
- aiCeivi9 9y ago
  uMatrix
- zentiggr 9y ago
  uMatrix is great for blacklisting by default and only enabling as needed for website core operations. Also has a "don't filter on this domain" switch for things like bank sites and other fragile ops.
  - Momquist 9y ago
    uMatrix is definitely great for this. I consider it a request firewall at browser level. And it works very well at blocking everything (JS, CSS, image, any type of request really) by default, should you wish to do so. It also allows blocking webworkers which mining sites tend to rely on.
    - PuffinBlue 9y ago
      Thanks, I'll take a look.
- ballenf 9y ago
  Safari on Mac makes it pretty easy. Also the built-in reading mode means 95% of sites that block content with an overlay are bypassed with one click.
EvanAnderson 9y ago
I simply can't imagine how one can use the web today w/o this strategy. Frustratingly, I also can't figure out how to instruct my non-technical family and friends on doing this themselves.
- bunderbunder 9y ago
  I'm frustrated here, too. It's not that nobody's interested - people I know are interested in finding out how my browser is able to display pages so much faster than theirs, and how my computer remains responsive even when I have a bazillion tabs open. But effectively using NoScript inevitably requires having at least enough technical knowledge to understand how JavaScript works and predict which blocked components are causing the bit of the page that you actually want to fail to load. It's almost like there needs to be a NoScript-like plugin that crowdsources a whitelist of domains (or, maybe better yet, specific scripts) so that non-technical users can have access to the knowledge of people who have the ability to figure this mess out. But, of course, you'd need to figure out a crowdsourcing method that's resistant to attack, because the ad networks and other malicious players would immediately be paying the click farmers to vote their scripts into the whitelist.
  - 341c8ec7 9y ago
    The best solution I have found for my friends and family is the Brave Browser on the desktop, and Firefox Focus on mobile. Neither are perfect, you do have to give up some granular control, but I feel they might be the best solutions for the layman at this time. I've also heard that DuckDuckGo recently made a simplified uBlock time add-on. Haven't had a chance to play with that much however, maybe someone can chime in.
- oldcynic 9y ago
  rPi and pi-hole is probably the best option here these days. Friends often ask how their phone is so much nicer when they visit than at home. :D I've converted a couple. I don't think trying to convey what ad or script blocking choices they should be making really works with non-tech folks any more. To be fair it was always a bit of a stretch...
wang_li 9y ago
> Consider the whole web hostile. That has been the model since the beginning. The problem is that web developers and browser developers have a greater interest in doing their thing than in protecting end users. Thus the introduction of cookies, javascript, iframes, etc. It's been a continuous curve of increased scope inside tbe browser. Now we have web assembly, workers, websockets, local storage, etc. and no good way for the end user to actually observe any of this shit. Browser developers are reinventing the operating system, but poorly.
- guelo 9y ago
  You make me think of the travesty of web video. Flash video worked fine, and Flash blockers worked well and gave users the control of when to play video. Flash blockers were some of the most popular plugins. Then, for reasons that users didn't care about, the web was "improved" to build video into JavaScript APIs. But somehow they failed to add user's top requested video feature: autoplay control. Now we're stuck with publishers using increasingly user-hostile autoplay video with no user control.
  - Santosh83 9y ago
    Yes. Flash was made click to play by default and all seemed to be fine, then we got HTML5 video. I still can't manage to block some videos on popular news sites from autoplaying each time I visit an article page. Even with media.autoplay.enabled set to FALSE in Firefox's configuration.
  - zAy0LfpBZLC8mAC 9y ago
    I very much cared about proprietary software with loads of vulnerabilities hoggin the CPU being replaced by something more sensible. That browsers don't implement any effective autoplay control still is idiotic (but then, the solution is simple: deactivate all codecs, and use youtube-dl for a better and ad-free user experience anyway).

PuffinBlue 9y ago

What tool do you use to manage switching JavaScript on and off on a per site basis? I too want to default off and whitelist but I'm not sure the best way to do it as the browser addons I have found make it easy to turn JS off, but they default to on and don't have a default off capability.

dmm 9y ago
NoScript is what I've always used. It defaults all javascript to be off and you can enable it permanently or temporarily per domain.
oldcynic 9y ago
NoScript on Firefox and Scriptsafe[0] on Chrome. [0] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...
- PuffinBlue 9y ago
  Thanks, I'll take a look.
aiCeivi9 9y ago
uMatrix
zentiggr 9y ago
uMatrix is great for blacklisting by default and only enabling as needed for website core operations. Also has a "don't filter on this domain" switch for things like bank sites and other fragile ops.
- Momquist 9y ago
  uMatrix is definitely great for this. I consider it a request firewall at browser level. And it works very well at blocking everything (JS, CSS, image, any type of request really) by default, should you wish to do so. It also allows blocking webworkers which mining sites tend to rely on.
  - PuffinBlue 9y ago
    Thanks, I'll take a look.
ballenf 9y ago
Safari on Mac makes it pretty easy. Also the built-in reading mode means 95% of sites that block content with an overlay are bypassed with one click.

EvanAnderson 9y ago

I simply can't imagine how one can use the web today w/o this strategy. Frustratingly, I also can't figure out how to instruct my non-technical family and friends on doing this themselves.

bunderbunder 9y ago
I'm frustrated here, too. It's not that nobody's interested - people I know are interested in finding out how my browser is able to display pages so much faster than theirs, and how my computer remains responsive even when I have a bazillion tabs open. But effectively using NoScript inevitably requires having at least enough technical knowledge to understand how JavaScript works and predict which blocked components are causing the bit of the page that you actually want to fail to load. It's almost like there needs to be a NoScript-like plugin that crowdsources a whitelist of domains (or, maybe better yet, specific scripts) so that non-technical users can have access to the knowledge of people who have the ability to figure this mess out. But, of course, you'd need to figure out a crowdsourcing method that's resistant to attack, because the ad networks and other malicious players would immediately be paying the click farmers to vote their scripts into the whitelist.
- 341c8ec7 9y ago
  The best solution I have found for my friends and family is the Brave Browser on the desktop, and Firefox Focus on mobile. Neither are perfect, you do have to give up some granular control, but I feel they might be the best solutions for the layman at this time. I've also heard that DuckDuckGo recently made a simplified uBlock time add-on. Haven't had a chance to play with that much however, maybe someone can chime in.
oldcynic 9y ago
rPi and pi-hole is probably the best option here these days. Friends often ask how their phone is so much nicer when they visit than at home. :D I've converted a couple. I don't think trying to convey what ad or script blocking choices they should be making really works with non-tech folks any more. To be fair it was always a bit of a stretch...

wang_li 9y ago

> Consider the whole web hostile. That has been the model since the beginning. The problem is that web developers and browser developers have a greater interest in doing their thing than in protecting end users. Thus the introduction of cookies, javascript, iframes, etc. It's been a continuous curve of increased scope inside tbe browser. Now we have web assembly, workers, websockets, local storage, etc. and no good way for the end user to actually observe any of this shit. Browser developers are reinventing the operating system, but poorly.

guelo 9y ago
You make me think of the travesty of web video. Flash video worked fine, and Flash blockers worked well and gave users the control of when to play video. Flash blockers were some of the most popular plugins. Then, for reasons that users didn't care about, the web was "improved" to build video into JavaScript APIs. But somehow they failed to add user's top requested video feature: autoplay control. Now we're stuck with publishers using increasingly user-hostile autoplay video with no user control.
- Santosh83 9y ago
  Yes. Flash was made click to play by default and all seemed to be fine, then we got HTML5 video. I still can't manage to block some videos on popular news sites from autoplaying each time I visit an article page. Even with media.autoplay.enabled set to FALSE in Firefox's configuration.
- zAy0LfpBZLC8mAC 9y ago
  I very much cared about proprietary software with loads of vulnerabilities hoggin the CPU being replaced by something more sensible. That browsers don't implement any effective autoplay control still is idiotic (but then, the solution is simple: deactivate all codecs, and use youtube-dl for a better and ad-free user experience anyway).