12 ms·

Adblock Plus filter lists may execute arbitrary code in web pages

245 points by dessant 8y ago

k1m 8y ago
Good advice: "Users may also switch to uBlock Origin.[1] It does not support the $rewrite filter option and it is not vulnerable to the described attack." [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
- blibble 8y ago
  ublock origin is also not owned by a company that takes money from advertisers to be reviewed for the "acceptable ads" list
- fock 8y ago
  how the hell did the uBlock brand get sold do ABP anyways? (probably the wrong place to ask such things on HN)
  - enriquto 8y ago
    well they probably paid enough money to the people who sold it. If you were owner of that name, how much would you sell it for?
  - nes350 8y ago
    This has been previously discussed on HN: https://news.ycombinator.com/item?id=9718625 https://news.ycombinator.com/item?id=9718625
  - k__ 8y ago
    It seems like uBlock was forked. The people who forked tried to make some money off the name by asking people for donations. They seemingly failed after the uBlock creator called them out and renamed his work to "uBlock Origin". So the people who forked sold what they got to ABP and called it a day.
  - gorhill 8y ago
    I wrote my own thoughts on this on Reddit recently[1], excerpt: > BetaFish Inc, owner of AdBlock, paid to acquire control of the GitHub repository and control of the ublock.org site last year. The apparent goal was to keep the deception ongoing, and further increase it, as clearly the site is trying to game search engines so to rank ublock.org high in results. They also registered the trademark "uBlock" in Germany, and have been pulling code from "uBlock Origin" repo. > Nothing that they are doing is user friendly, it's to deceive people who are looking to install "uBlock Origin" into installing "uBlock" instead. * * * [1] https://www.reddit.com/r/uBlockOrigin/comments/b8vr9j/got_fooled_into_installing_ublockorg_chrome/ek0yaao/ https://www.reddit.com/r/uBlockOrigin/comments/b8vr9j/got_fo...
    - wnevets 8y ago
      >paid to acquire control of the GitHub repository Paid who?
      - ihuman 8y ago
        I think Chris Aljoudi > https://en.wikipedia.org/wiki/UBlock_Origin https://en.wikipedia.org/wiki/UBlock_Origin > Through April and May 2015, the uBlock project was forked by Chris Aljoudi, while uBlock Origin reflected the continuing effort by the original developer Raymond Hill. Since April 2015, uBlock Origin has been completely unrelated to the web site ublock.org. > Shortly after the project division [between uBlock and uBlock Origin], Chris Aljoudi created ublock.org to host uBlock, promote the extension and request donations... In July 2018, uBlock was acquired by AdBlock.
        fireattack 8y ago
        The wording on Wikipedia doesn't seem to match what actually happened. IIRC, Raymond Hill, the original author of uBlock and current maintainer of uBlock Origin, voluntarily gave the control of uBlock project to Chris Aljoudi because he was tired of dealing with all the bug reports/issues (and Aljoudi offered to take it over, I think). But due to various reasons, shortly (very shortly, maybe even no gap in between) after, he self-forked uBlock [1] to make uBlock Origin and started to work on it again. So technically uBlock Origin is the fork, and more importantly, Chris Aljoudi didn't really "fork uBlock", he inherited the main repo. Note: I'm by no means to defend Aljoudi's practice on uBlock and I'm pretty sure Hill regretted his decision of handing it over. But let's avoid historical revisionism. [1]: https://web.archive.org/web/20150427225211/https://github.com/gorhill/uBlock/ https://web.archive.org/web/20150427225211/https://github.co... (See the "forked from chrisaljoudi/uBlock" text and readme.MD below) --- Edit: [2] Hill's own words about this matter on Apr 11, 2015: https://github.com/gorhill/uBlock/issues/38#issuecomment-91871802 https://github.com/gorhill/uBlock/issues/38#issuecomment-918...
- magduf 8y ago
  There have been many good reasons to switch to uBlock Origin long before today's issue: speed, memory footprint, no "acceptable ads", etc. I don't know why anyone still uses ABP.
  - ebg13 8y ago
    uBlock Origin for Safari has been abandoned for about a year. :\
    - lostmsu 8y ago
      It is open source. You can probably make it work with a single git merge (judging from experience with uMatrix for Edge).
    - hombre_fatal 8y ago
      Safari's (Webkit's) content blockers are even better imo. Declarative rules that get compiled. Can't intercept arbitrary requests with Javascript logic but I don't think that's necessary. Though it makes something like uMatrix harder to implement.
      - kevin_thibedeau 8y ago
        There's still a need for something like the element zapper which can remove obstructing popups that aren't implemented in Javascript.
        hombre_fatal 8y ago
        Though you can implement this with the content blocker API. You add a rule to the rule list and recompile it, though it does come at the expense of UX and flexibility for sure.
        stephenr 8y ago
        Which has been a part of Content Blockers since day 1.
      - 8y ago
- neilv 8y ago
  uBlock Origin is the one to use for the last few years. (I've worked on filter lists since the Junkbuster and then Privoxy days, through Adblock Plus. Then Adblock Plus suddenly seemed like a bad place to be, and uBlock was similarly questionable, so I moved to uBlock Origin, even though adding new rules there was more work than in ABP. I've been very happy with uBlock Origin, and with its lead developer's apparent benevolent intentions.)
- nydel 8y ago
  i'm wondering whether adnauseum is safe from this, or rather if it's possibly not safe e.g. with certain lists enabled...
- spookyuser 8y ago
  Kind of funny, I just noticed uBlock Origin blocks requests to uBlock.org under "Badware risks" maybe they should add adblock plus to that list now.
- deleted 8y ago
  [deleted]
Y_Y 8y ago
Well the solution is easy: we just see which of the filterlist publishers are trustworthy and which aren't, and have the extension automatically download this listlist and apply it to its list of filterlists. Of course you need to be sure that the listlist is of trustworthy origin, but you can just check if the supplier of the listlist is itself on the listlist.
OrgNet 8y ago
one more reason not to use it... too bad the people using it won't ever read that (they should have switched years ago, so we know they don't read this kind of news)
SquareWheel 8y ago
It's a bit disingenuous to refer to this as an "exploit" all throughout the article. It's a feature, and an intended one at that. It's offering whitelist maintainers more power over their filters. You can disagree with its inclusion in the spec (as I do), but you should make an argument on that premise instead. Calling it an exploit is no different than claiming .exe files are exploits because they allow arbitrary code to run. Or that browser extensions are exploits because they too can manipulate the page.
- nneonneo 8y ago
  It’s rightly referred to as a vulnerability; the term exploit is used to describe a realistic scenario that is enabled by the vulnerable code. The problem is that you can’t necessarily trust filter maintainers to be completely honest. Users don’t regularly audit the thousands of rules in their filter lists, so a bad or compromised filter could easily introduce a malicious filter in an update. The $rewrite rule lets a filter change what code is being loaded by a webpage (under certain fairly realistic situations).
  - SquareWheel 8y ago
    >The problem is that you can’t necessarily trust filter maintainers to be completely honest. I agree with that, and it's not a strong security model. But my original point is that the author is using a bad faith argument by describing a feature they dislike as an exploit. It's in spec for what the original authors intended. Just like running an executable program is potentially risky, but a design of the system.
    - csours 8y ago
      User expectation is important. You don't generally have to put warnings on knives that they may cut you, but if you made a coffee mug that sliced peoples lips up you would get in trouble. As a developer, I expect that browser plugins can execute code in some context (though I think general users may not even expect that); but I don't generally expect that plugins will execute code from some arbitrary 3rd party source.
ycombonator 8y ago
More reasons to run Pihole, the setup just took 20 mins including installing Rasbian. Anyone know how to mimic ublock origins filter list in Pihole ?
- millzlane 8y ago
  https://firebog.net/ https://firebog.net/
- steve19 8y ago
  Unlock can block page elements while pi hole can only block dns. So if the ad is served from the same domain as the site you are visiting, pi hole cannot do anything about it, but ublock can.
- Ayesh 8y ago
  > Anyone know how to mimic ublock origins filter list in Pihole ? You cannot. Pihole may be. Abetter solution for network-wode ad blocking, but some ads (such as push notification spam) use the same domain name as the original site, so pihole can't block them, being just a DNS blacklist.
- shawnz 8y ago
  Adblock/uBlock are much more powerful than PiHole, which can only block DNS requests. Thus you wouldn't be able to use the majority of the filters.
- sneak 8y ago
  https://github.com/pi-hole/pi-hole/pull/2706 https://github.com/pi-hole/pi-hole/pull/2706
- dastx 8y ago
  Perhaps there's some proxy out there that would do it. The closest you'll come to it at the moment is either privoxy (proxy with it's own rules) or alternatively, AdGuard Home, which is like pi-hole, but it also understands AdBlock Filters (though to be clear, it still only does host blocking).
Animats 8y ago
Making ad block filter lists Turing-complete: really bad idea.
gorhill 8y ago
> Users may also switch to uBlock Origin. It does not support the $rewrite filter option Support for this filter option was discussed (and declined) in uBlock Origin's issue tracker: https://github.com/uBlockOrigin/uBlock-issues/issues/46 https://github.com/uBlockOrigin/uBlock-issues/issues/46
- joncrane 8y ago
  Damn, the developer of uBlock Origin recognized the problem with it immediately, explained it, and shut it down.
  - shawnz 8y ago
    He is also the person who posted the parent comment :)
    - deleted 8y ago
      [deleted]
- degenerate 8y ago
  We love you gorhill. Here's a permalink to your explanation in that thread: https://github.com/uBlockOrigin/uBlock-issues/issues/46#issuecomment-391303700 https://github.com/uBlockOrigin/uBlock-issues/issues/46#issu...
- d0bby 8y ago
  > My hunch tells me this is not good. After some clicking I found this: https://github.com/uBlockOrigin/uAssets/issues/4080#issuecomment-436759360 https://github.com/uBlockOrigin/uAssets/issues/4080#issuecom... , might be interesting
- 21717117 8y ago
  This is the kind of thing that really cements my love for this tool. Gorhill is the hero we don't deserve.
nitrohorse 8y ago
Some discussion by gorhill 11 months ago about this: https://github.com/uBlockOrigin/uBlock-issues/issues/46#issuecomment-391303700 https://github.com/uBlockOrigin/uBlock-issues/issues/46#issu...
d0bby 8y ago
People are talking about uBlock Origin... I really like it, no doubts it's good and everyone should consider using it. BUT, since we are talking about uBlock Origin, I'd like to mention another awesome extention Raymond Hill made. uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix) uMatrix alone is very powerful, and will prevent most ads. Yes you as a user need to do the work, but the result is better. If you like the idea of uMatrix, you may also look at NoScript! Actually, I live almost ad free using NoScript + uBlock Origin for at least 2 yrs. $rewrite... what a dumb feature btw!
- darkpuma 8y ago
  I find uMatrix+uBO (with uMatrix set to block everything by default and uBlock Origin set to it's default easy mode) to be best setup. Ads virtually never get through, and most websites don't need javascript at all to read the articles so my uMatrix whitelist is actually surprisingly small.
burtonator 8y ago
I wonder if we need a non-turning complete library for chrome extensions like we have for some packet filtering libraries and bitcoin script. No regex. No loops. Constrained list of functions. This could go a long way towards opening up the web to more extensions but also keeping it more secure. I recently did a rev to the Polar chrome extension: https://chrome.google.com/webstore/detail/polar-pdf-web-and-documen/jkfdkjomocoaljglgddnmhcbolldcafd?hl=en https://chrome.google.com/webstore/detail/polar-pdf-web-and-... and I had to request a new permission for filtering and they're now taking a WEEK to approve my any updates due to code review. I really only need to evaluate a URL and add headers. This doesn't need to be turing complete. I basically just need to take a HTTP response and headers if they're missing when a specific origin is set.
- tekstar 8y ago
  This is where Safari content blocking extensions are now. The extensions register a list of URLs with Safari with instructions to block.
  - deleted 8y ago
    [deleted]
- AnaniasAnanas 8y ago
  Why no regex and (bounded) loops? You don't need turing completeness for either of these. And what does Turing completeness has to do with security anyway?
- kccqzy 8y ago
  The relevant API is there in Chrome though currently in beta only; see https://developers.chrome.com/extensions/declarativeNetRequest https://developers.chrome.com/extensions/declarativeNetReque...
deevolution 8y ago
Switch to brave!
userbinator 8y ago
I feel like this is another instance of "useful feature gets removed because of security vulturism[1]" --- something which has been happening for a while, but has gotten infuriatingly frequent lately. In this case, the mere fact that you're using a third-party list already suggests trust of the author, or at least an implicit acknowledgement that your ideas of what should be filtered agree. Ad blocking extensions should consider dropping support for the $rewrite filter option. It’s always possible to abuse the feature to some degree, even if only images or style sheets are allowed to be redirected. The classic "ban it because it can be abused" mindset. Let's ban the use of computers too, certainly that would be more secure! Google has been notified about the exploit, but the report was closed as “Intended Behavior”, since they consider the potential security issue to be present solely in the mentioned browser extensions. As they should, because what user-agents are doing have nothing whatsoever to do with their site. (Disclaimer: I don't use ABP nor uBlock nor any in-browser blocking extensions, so I have no conflicts of interest here. I use a full MITM proxy which is far more powerful than anything you can do with a browser extension. I wonder what he'll think about that...) [1] https://news.ycombinator.com/item?id=19660677 https://news.ycombinator.com/item?id=19660677
- deleted 8y ago
  [deleted]
- Forge36 8y ago
  It could have been implemented in a more restrictive way to prevent this issue and allow more targeted behaviors, instead it allows third party lists (which already require a users trust) to run code. Previously this wasn't the case. Can your MITM proxy modify HTTPS traffic? If so, how did you configure your machines to trust the cert you're using?
  - userbinator 8y ago
    Can your MITM proxy modify HTTPS traffic? If so, how did you configure your machines to trust the cert you're using? Yes, of course. It wouldn't be very useful otherwise. The proxy has its own CA, and I install the cert into the trusted roots of all the machines I use.

245 points by dessant 8y ago

k1m 8y ago

Good advice: "Users may also switch to uBlock Origin.[1] It does not support the $rewrite filter option and it is not vulnerable to the described attack." [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock

blibble 8y ago
ublock origin is also not owned by a company that takes money from advertisers to be reviewed for the "acceptable ads" list
fock 8y ago
how the hell did the uBlock brand get sold do ABP anyways? (probably the wrong place to ask such things on HN)
- enriquto 8y ago
  well they probably paid enough money to the people who sold it. If you were owner of that name, how much would you sell it for?
- nes350 8y ago
  This has been previously discussed on HN: https://news.ycombinator.com/item?id=9718625 https://news.ycombinator.com/item?id=9718625
- k__ 8y ago
  It seems like uBlock was forked. The people who forked tried to make some money off the name by asking people for donations. They seemingly failed after the uBlock creator called them out and renamed his work to "uBlock Origin". So the people who forked sold what they got to ABP and called it a day.
- gorhill 8y ago
  I wrote my own thoughts on this on Reddit recently[1], excerpt: > BetaFish Inc, owner of AdBlock, paid to acquire control of the GitHub repository and control of the ublock.org site last year. The apparent goal was to keep the deception ongoing, and further increase it, as clearly the site is trying to game search engines so to rank ublock.org high in results. They also registered the trademark "uBlock" in Germany, and have been pulling code from "uBlock Origin" repo. > Nothing that they are doing is user friendly, it's to deceive people who are looking to install "uBlock Origin" into installing "uBlock" instead. * * * [1] https://www.reddit.com/r/uBlockOrigin/comments/b8vr9j/got_fooled_into_installing_ublockorg_chrome/ek0yaao/ https://www.reddit.com/r/uBlockOrigin/comments/b8vr9j/got_fo...
  - wnevets 8y ago
    >paid to acquire control of the GitHub repository Paid who?
    - ihuman 8y ago
      I think Chris Aljoudi > https://en.wikipedia.org/wiki/UBlock_Origin https://en.wikipedia.org/wiki/UBlock_Origin > Through April and May 2015, the uBlock project was forked by Chris Aljoudi, while uBlock Origin reflected the continuing effort by the original developer Raymond Hill. Since April 2015, uBlock Origin has been completely unrelated to the web site ublock.org. > Shortly after the project division [between uBlock and uBlock Origin], Chris Aljoudi created ublock.org to host uBlock, promote the extension and request donations... In July 2018, uBlock was acquired by AdBlock.
      - fireattack 8y ago
        The wording on Wikipedia doesn't seem to match what actually happened. IIRC, Raymond Hill, the original author of uBlock and current maintainer of uBlock Origin, voluntarily gave the control of uBlock project to Chris Aljoudi because he was tired of dealing with all the bug reports/issues (and Aljoudi offered to take it over, I think). But due to various reasons, shortly (very shortly, maybe even no gap in between) after, he self-forked uBlock [1] to make uBlock Origin and started to work on it again. So technically uBlock Origin is the fork, and more importantly, Chris Aljoudi didn't really "fork uBlock", he inherited the main repo. Note: I'm by no means to defend Aljoudi's practice on uBlock and I'm pretty sure Hill regretted his decision of handing it over. But let's avoid historical revisionism. [1]: https://web.archive.org/web/20150427225211/https://github.com/gorhill/uBlock/ https://web.archive.org/web/20150427225211/https://github.co... (See the "forked from chrisaljoudi/uBlock" text and readme.MD below) --- Edit: [2] Hill's own words about this matter on Apr 11, 2015: https://github.com/gorhill/uBlock/issues/38#issuecomment-91871802 https://github.com/gorhill/uBlock/issues/38#issuecomment-918...
magduf 8y ago
There have been many good reasons to switch to uBlock Origin long before today's issue: speed, memory footprint, no "acceptable ads", etc. I don't know why anyone still uses ABP.
- ebg13 8y ago
  uBlock Origin for Safari has been abandoned for about a year. :\
  - lostmsu 8y ago
    It is open source. You can probably make it work with a single git merge (judging from experience with uMatrix for Edge).
  - hombre_fatal 8y ago
    Safari's (Webkit's) content blockers are even better imo. Declarative rules that get compiled. Can't intercept arbitrary requests with Javascript logic but I don't think that's necessary. Though it makes something like uMatrix harder to implement.
    - kevin_thibedeau 8y ago
      There's still a need for something like the element zapper which can remove obstructing popups that aren't implemented in Javascript.
      - hombre_fatal 8y ago
        Though you can implement this with the content blocker API. You add a rule to the rule list and recompile it, though it does come at the expense of UX and flexibility for sure.
      - stephenr 8y ago
        Which has been a part of Content Blockers since day 1.
    - 8y ago
neilv 8y ago
uBlock Origin is the one to use for the last few years. (I've worked on filter lists since the Junkbuster and then Privoxy days, through Adblock Plus. Then Adblock Plus suddenly seemed like a bad place to be, and uBlock was similarly questionable, so I moved to uBlock Origin, even though adding new rules there was more work than in ABP. I've been very happy with uBlock Origin, and with its lead developer's apparent benevolent intentions.)
nydel 8y ago
i'm wondering whether adnauseum is safe from this, or rather if it's possibly not safe e.g. with certain lists enabled...
spookyuser 8y ago
Kind of funny, I just noticed uBlock Origin blocks requests to uBlock.org under "Badware risks" maybe they should add adblock plus to that list now.
deleted 8y ago
[deleted]

Y_Y 8y ago

Well the solution is easy: we just see which of the filterlist publishers are trustworthy and which aren't, and have the extension automatically download this listlist and apply it to its list of filterlists. Of course you need to be sure that the listlist is of trustworthy origin, but you can just check if the supplier of the listlist is itself on the listlist.

OrgNet 8y ago

one more reason not to use it... too bad the people using it won't ever read that (they should have switched years ago, so we know they don't read this kind of news)

SquareWheel 8y ago

It's a bit disingenuous to refer to this as an "exploit" all throughout the article. It's a feature, and an intended one at that. It's offering whitelist maintainers more power over their filters. You can disagree with its inclusion in the spec (as I do), but you should make an argument on that premise instead. Calling it an exploit is no different than claiming .exe files are exploits because they allow arbitrary code to run. Or that browser extensions are exploits because they too can manipulate the page.

nneonneo 8y ago
It’s rightly referred to as a vulnerability; the term exploit is used to describe a realistic scenario that is enabled by the vulnerable code. The problem is that you can’t necessarily trust filter maintainers to be completely honest. Users don’t regularly audit the thousands of rules in their filter lists, so a bad or compromised filter could easily introduce a malicious filter in an update. The $rewrite rule lets a filter change what code is being loaded by a webpage (under certain fairly realistic situations).
- SquareWheel 8y ago
  >The problem is that you can’t necessarily trust filter maintainers to be completely honest. I agree with that, and it's not a strong security model. But my original point is that the author is using a bad faith argument by describing a feature they dislike as an exploit. It's in spec for what the original authors intended. Just like running an executable program is potentially risky, but a design of the system.
  - csours 8y ago
    User expectation is important. You don't generally have to put warnings on knives that they may cut you, but if you made a coffee mug that sliced peoples lips up you would get in trouble. As a developer, I expect that browser plugins can execute code in some context (though I think general users may not even expect that); but I don't generally expect that plugins will execute code from some arbitrary 3rd party source.

ycombonator 8y ago

More reasons to run Pihole, the setup just took 20 mins including installing Rasbian. Anyone know how to mimic ublock origins filter list in Pihole ?

millzlane 8y ago
https://firebog.net/ https://firebog.net/
steve19 8y ago
Unlock can block page elements while pi hole can only block dns. So if the ad is served from the same domain as the site you are visiting, pi hole cannot do anything about it, but ublock can.
Ayesh 8y ago
> Anyone know how to mimic ublock origins filter list in Pihole ? You cannot. Pihole may be. Abetter solution for network-wode ad blocking, but some ads (such as push notification spam) use the same domain name as the original site, so pihole can't block them, being just a DNS blacklist.
shawnz 8y ago
Adblock/uBlock are much more powerful than PiHole, which can only block DNS requests. Thus you wouldn't be able to use the majority of the filters.
sneak 8y ago
https://github.com/pi-hole/pi-hole/pull/2706 https://github.com/pi-hole/pi-hole/pull/2706
dastx 8y ago
Perhaps there's some proxy out there that would do it. The closest you'll come to it at the moment is either privoxy (proxy with it's own rules) or alternatively, AdGuard Home, which is like pi-hole, but it also understands AdBlock Filters (though to be clear, it still only does host blocking).

Animats 8y ago

Making ad block filter lists Turing-complete: really bad idea.

gorhill 8y ago

> Users may also switch to uBlock Origin. It does not support the $rewrite filter option Support for this filter option was discussed (and declined) in uBlock Origin's issue tracker: https://github.com/uBlockOrigin/uBlock-issues/issues/46 https://github.com/uBlockOrigin/uBlock-issues/issues/46

joncrane 8y ago
Damn, the developer of uBlock Origin recognized the problem with it immediately, explained it, and shut it down.
- shawnz 8y ago
  He is also the person who posted the parent comment :)
  - deleted 8y ago
    [deleted]
degenerate 8y ago
We love you gorhill. Here's a permalink to your explanation in that thread: https://github.com/uBlockOrigin/uBlock-issues/issues/46#issuecomment-391303700 https://github.com/uBlockOrigin/uBlock-issues/issues/46#issu...
d0bby 8y ago
> My hunch tells me this is not good. After some clicking I found this: https://github.com/uBlockOrigin/uAssets/issues/4080#issuecomment-436759360 https://github.com/uBlockOrigin/uAssets/issues/4080#issuecom... , might be interesting
21717117 8y ago
This is the kind of thing that really cements my love for this tool. Gorhill is the hero we don't deserve.

nitrohorse 8y ago

Some discussion by gorhill 11 months ago about this: https://github.com/uBlockOrigin/uBlock-issues/issues/46#issuecomment-391303700 https://github.com/uBlockOrigin/uBlock-issues/issues/46#issu...

d0bby 8y ago

People are talking about uBlock Origin... I really like it, no doubts it's good and everyone should consider using it. BUT, since we are talking about uBlock Origin, I'd like to mention another awesome extention Raymond Hill made. uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix) uMatrix alone is very powerful, and will prevent most ads. Yes you as a user need to do the work, but the result is better. If you like the idea of uMatrix, you may also look at NoScript! Actually, I live almost ad free using NoScript + uBlock Origin for at least 2 yrs. $rewrite... what a dumb feature btw!

darkpuma 8y ago
I find uMatrix+uBO (with uMatrix set to block everything by default and uBlock Origin set to it's default easy mode) to be best setup. Ads virtually never get through, and most websites don't need javascript at all to read the articles so my uMatrix whitelist is actually surprisingly small.

burtonator 8y ago

I wonder if we need a non-turning complete library for chrome extensions like we have for some packet filtering libraries and bitcoin script. No regex. No loops. Constrained list of functions. This could go a long way towards opening up the web to more extensions but also keeping it more secure. I recently did a rev to the Polar chrome extension: https://chrome.google.com/webstore/detail/polar-pdf-web-and-documen/jkfdkjomocoaljglgddnmhcbolldcafd?hl=en https://chrome.google.com/webstore/detail/polar-pdf-web-and-... and I had to request a new permission for filtering and they're now taking a WEEK to approve my any updates due to code review. I really only need to evaluate a URL and add headers. This doesn't need to be turing complete. I basically just need to take a HTTP response and headers if they're missing when a specific origin is set.

tekstar 8y ago
This is where Safari content blocking extensions are now. The extensions register a list of URLs with Safari with instructions to block.
- deleted 8y ago
  [deleted]
AnaniasAnanas 8y ago
Why no regex and (bounded) loops? You don't need turing completeness for either of these. And what does Turing completeness has to do with security anyway?
kccqzy 8y ago
The relevant API is there in Chrome though currently in beta only; see https://developers.chrome.com/extensions/declarativeNetRequest https://developers.chrome.com/extensions/declarativeNetReque...

deevolution 8y ago

Switch to brave!

userbinator 8y ago

I feel like this is another instance of "useful feature gets removed because of security vulturism[1]" --- something which has been happening for a while, but has gotten infuriatingly frequent lately. In this case, the mere fact that you're using a third-party list already suggests trust of the author, or at least an implicit acknowledgement that your ideas of what should be filtered agree. Ad blocking extensions should consider dropping support for the $rewrite filter option. It’s always possible to abuse the feature to some degree, even if only images or style sheets are allowed to be redirected. The classic "ban it because it can be abused" mindset. Let's ban the use of computers too, certainly that would be more secure! Google has been notified about the exploit, but the report was closed as “Intended Behavior”, since they consider the potential security issue to be present solely in the mentioned browser extensions. As they should, because what user-agents are doing have nothing whatsoever to do with their site. (Disclaimer: I don't use ABP nor uBlock nor any in-browser blocking extensions, so I have no conflicts of interest here. I use a full MITM proxy which is far more powerful than anything you can do with a browser extension. I wonder what he'll think about that...) [1] https://news.ycombinator.com/item?id=19660677 https://news.ycombinator.com/item?id=19660677

deleted 8y ago
[deleted]
Forge36 8y ago
It could have been implemented in a more restrictive way to prevent this issue and allow more targeted behaviors, instead it allows third party lists (which already require a users trust) to run code. Previously this wasn't the case. Can your MITM proxy modify HTTPS traffic? If so, how did you configure your machines to trust the cert you're using?
- userbinator 8y ago
  Can your MITM proxy modify HTTPS traffic? If so, how did you configure your machines to trust the cert you're using? Yes, of course. It wouldn't be very useful otherwise. The proxy has its own CA, and I install the cert into the trusted roots of all the machines I use.