4 ms·

uBlock Origin is completely free and open source. https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/ It's a very popular project on GitHub

uBlock Origin is completely free and open source. https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/ It's a very popular project on GitHub with many developers scrutinizing any changes to the codebase. Fears of uBlock Origin being a "security or privacy risk" based on code in the extension are unfounded.

Wowfunhappy 7y ago
It's not whether uBlock Origin is a security risk, it's whether the APIs it's using are a security risk, lest they fall into the hands of a less benign actor. (I also wish they'd kept the APIs open, just stating the other case.)
- PostOnce 7y ago
  You're complaining that a general purpose computer can be used for... general purposes. Computers should do what their users tell them to. I wouldn't appreciate a smartknife with a blade that only extended when something I was authorized to cut was in range. "Unrecognized cultivar". Tools do the work their possessors wish. Why would you let someone limit your tools? It's everywhere now. It's in the coffee pods. Why does everyone else know better than the user what the user should be doing?
  - lotsofpulp 7y ago
    >Why does everyone else know better than the user what the user should be doing? See windows and the malware infested ecosystem. People obviously don’t know what they’re doing, and/or don’t have the time vet every little action they do on their computer.
    - danShumway 7y ago
      But uBlock Origin keeps me safe online. I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change makes ordinary users safer, but makes power users less safe. I understand why Apple is doing it. But I'm still going to advise responsible owners to ditch Safari and pick a browser that will do a better job of blocking trackers.
      - acdha 7y ago
        > But uBlock Origin keeps me safe online. The problem is that all of the spyware says exactly the same thing. If the API exists, ordinary users are going to be asked to make huge security decisions with no effective way to tell whether the vendor (or the new owner who just bought it) is being honest.
        danShumway 7y ago
        Sure, but: > I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change still means that Firefox will have better adblocking and privacy tools than Safari. It's a tradeoff -- and if I'm a user that's already conservative about granting extensions permissions, I don't see how I get any benefits from this. I only get the downsides in the form of less effective blockers.
      - Wowfunhappy 7y ago
        > But I'm still going to advise responsible owners to ditch Safari and pick a browser that will do a better job of blocking trackers. Are the uBO alternatives like ka-block so bad?
        danShumway 7y ago
        They're not really comparable. Ka-Block actually advertises itself as being less effective than uBO. It's selling point is that it's a simpler extension that blocks fewer ads and trackers, under the assumption that this is good enough and on it'll on average be faster because of the reduced overhead. > Some ads will get through this filter, and that's ok. We already have extensions that block every ad that's ever appeared on the web with a completionist zeal that must be admired.[0] If you're blocking ads just to make pages load faster, Ka-Block is probably fine. If your primary goal is to protect your privacy, you shouldn't be using Ka-Block. [0]: https://github.com/dgraham/Ka-Block https://github.com/dgraham/Ka-Block
        Wowfunhappy 7y ago
  - Wowfunhappy 7y ago
    To be clear, I agree, I just didn't think GP was fairly stating the alternate case. As an aside, no one is stopping you from binary patching Safari on macOS, provided you don't mind turning off SIP. The nice API just isn't there anymore.
    - saagarjha 7y ago
      Injecting code into Safari is works just as well and is much less brittle. You'll have to disable Library Validation for the bundle, though.
      - Wowfunhappy 7y ago
        ...excuse me, that’s what I was actually thinking of. Actually patching the binary would be stupid, I meant to say code injection. Thank you.
  - wstuartcl 7y ago
    ... Your computer is a desk weight without the (or an) OS and software that runs on it. Each os/or software package down to libraries make trade offs that restrict their usage from general purpose to a specific set of functionality. It is impossible to write a line of functioning code without constraining the concept of "general purposes" as you have implied above -- each line of code does "something" not "Everything" by its very nature.
  - zeveb 7y ago
    I suspect that from Apple's (and Google's, and to some extent Mozilla's) point of view this is all about the computer doing what its user tells it to do — 'its user,' unfortunately, being Apple, Google or Mozilla. We the people using the computers aren't adults capable of making our own decisions and being responsible for the consequences, but rather livestock farmed either directly (Apple) or indirectly (Google & Mozilla( for money.
falcolas 7y ago
So long as it’s not sold. It’s happened before - a popular ad blocker is bought up for millions of dollars by an ad agency, and turned into an already installed vehicle for new ads. I see nothing about “free and open source” which prevents this.
- somebehemoth 7y ago
  It can be forked?
  - saagarjha 7y ago
    The last fork of uBlock Origin didn’t do so well: https://ublock.org/ https://ublock.org/
    - pwinnski 7y ago
      Didn't do so well how? It's very popular, used by many people who don't realize how terrible it is!
      - saagarjha 7y ago
        Ok, let's say it didn't do good :)
  - jtbayly 7y ago
    So what? How does that protect the end user?
- 0x0 7y ago
  In fact, isn't that why uBlock is not uBO?
wstuartcl 7y ago
... One malicious push/release effectively enables every user on browsers that have not transitioned to the passive list/filter model of blocking to be completely owned. It is not about intent, it is about the many many extensions out there that use this feature set for good intent, but inherently open the risk of a full on traffic funnel should they be exploited * the number of users for each of them.

Wowfunhappy 7y ago

It's not whether uBlock Origin is a security risk, it's whether the APIs it's using are a security risk, lest they fall into the hands of a less benign actor. (I also wish they'd kept the APIs open, just stating the other case.)

PostOnce 7y ago
You're complaining that a general purpose computer can be used for... general purposes. Computers should do what their users tell them to. I wouldn't appreciate a smartknife with a blade that only extended when something I was authorized to cut was in range. "Unrecognized cultivar". Tools do the work their possessors wish. Why would you let someone limit your tools? It's everywhere now. It's in the coffee pods. Why does everyone else know better than the user what the user should be doing?
- lotsofpulp 7y ago
  >Why does everyone else know better than the user what the user should be doing? See windows and the malware infested ecosystem. People obviously don’t know what they’re doing, and/or don’t have the time vet every little action they do on their computer.
  - danShumway 7y ago
    But uBlock Origin keeps me safe online. I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change makes ordinary users safer, but makes power users less safe. I understand why Apple is doing it. But I'm still going to advise responsible owners to ditch Safari and pick a browser that will do a better job of blocking trackers.
    - acdha 7y ago
      > But uBlock Origin keeps me safe online. The problem is that all of the spyware says exactly the same thing. If the API exists, ordinary users are going to be asked to make huge security decisions with no effective way to tell whether the vendor (or the new owner who just bought it) is being honest.
      - danShumway 7y ago
        Sure, but: > I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change still means that Firefox will have better adblocking and privacy tools than Safari. It's a tradeoff -- and if I'm a user that's already conservative about granting extensions permissions, I don't see how I get any benefits from this. I only get the downsides in the form of less effective blockers.
    - Wowfunhappy 7y ago
      > But I'm still going to advise responsible owners to ditch Safari and pick a browser that will do a better job of blocking trackers. Are the uBO alternatives like ka-block so bad?
      - danShumway 7y ago
        They're not really comparable. Ka-Block actually advertises itself as being less effective than uBO. It's selling point is that it's a simpler extension that blocks fewer ads and trackers, under the assumption that this is good enough and on it'll on average be faster because of the reduced overhead. > Some ads will get through this filter, and that's ok. We already have extensions that block every ad that's ever appeared on the web with a completionist zeal that must be admired.[0] If you're blocking ads just to make pages load faster, Ka-Block is probably fine. If your primary goal is to protect your privacy, you shouldn't be using Ka-Block. [0]: https://github.com/dgraham/Ka-Block https://github.com/dgraham/Ka-Block
        Wowfunhappy 7y ago
- Wowfunhappy 7y ago
  To be clear, I agree, I just didn't think GP was fairly stating the alternate case. As an aside, no one is stopping you from binary patching Safari on macOS, provided you don't mind turning off SIP. The nice API just isn't there anymore.
  - saagarjha 7y ago
    Injecting code into Safari is works just as well and is much less brittle. You'll have to disable Library Validation for the bundle, though.
    - Wowfunhappy 7y ago
      ...excuse me, that’s what I was actually thinking of. Actually patching the binary would be stupid, I meant to say code injection. Thank you.
- wstuartcl 7y ago
  ... Your computer is a desk weight without the (or an) OS and software that runs on it. Each os/or software package down to libraries make trade offs that restrict their usage from general purpose to a specific set of functionality. It is impossible to write a line of functioning code without constraining the concept of "general purposes" as you have implied above -- each line of code does "something" not "Everything" by its very nature.
- zeveb 7y ago
  I suspect that from Apple's (and Google's, and to some extent Mozilla's) point of view this is all about the computer doing what its user tells it to do — 'its user,' unfortunately, being Apple, Google or Mozilla. We the people using the computers aren't adults capable of making our own decisions and being responsible for the consequences, but rather livestock farmed either directly (Apple) or indirectly (Google & Mozilla( for money.

falcolas 7y ago

So long as it’s not sold. It’s happened before - a popular ad blocker is bought up for millions of dollars by an ad agency, and turned into an already installed vehicle for new ads. I see nothing about “free and open source” which prevents this.

somebehemoth 7y ago
It can be forked?
- saagarjha 7y ago
  The last fork of uBlock Origin didn’t do so well: https://ublock.org/ https://ublock.org/
  - pwinnski 7y ago
    Didn't do so well how? It's very popular, used by many people who don't realize how terrible it is!
    - saagarjha 7y ago
      Ok, let's say it didn't do good :)
- jtbayly 7y ago
  So what? How does that protect the end user?
0x0 7y ago
In fact, isn't that why uBlock is not uBO?

wstuartcl 7y ago

... One malicious push/release effectively enables every user on browsers that have not transitioned to the passive list/filter model of blocking to be completely owned. It is not about intent, it is about the many many extensions out there that use this feature set for good intent, but inherently open the risk of a full on traffic funnel should they be exploited * the number of users for each of them.