7 ms·
Uninstall Nano Defender
- Aaronstotle 6y agoI have never heard of nano defender, but I wonder why anyone ventures away from uBlock origin
- cblconfederate 6y agodoes it exist on android? i have adguard
- ceejayoz 6y agoI mean, I agree, but it's not like this couldn't happen there, too.
- heinrich5991 6y agoUnlikely, given the history of uBlock (Origin).
- wongarsu 6y agoIt could, but after what happened to the original uBlock it's unlikely that uBlock Origin would be sold to unnamed developers.
- ceejayoz 6y agoVirtually everyone has their price. It might be short-lived, but the damage you could do with that install base and auto-updating extensions...
- jchw 6y agoGiven that Raymond Hill is one of the persons helping to expose this mess, at least we can get a good idea of the motivations behind the uBlock Origin maintainers. Granted, it isn’t drama free. But frankly, these people have one of the best longest running track records of trust in all of browser extensions. It is going to be an immensely sad day when things go sour.
- ceejayoz 6y agoI use uBlock Origin, and I share your feelings about the team. That said, https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen was trusted too, and deliberately selling out isn't the only attack model. The extension ecosystem kinda terrifies me.
- dclusin 6y agoI've encountered it before. I believe its made it to HN front page a few times.
- MattGaiser 6y ago> I wonder why anyone ventures away from uBlock origin Tangential, but that attitude prevents a lot of competition in the tech space. A lot of the reason tech companies can grow so large with so little competition is the problem of trust.
- wongarsu 6y agoAnd the trust really comes down to observability. If I buy a vacuum cleaner it's easy to tell if it sucks and if I should recommend it to my friends. With software I might be able to judge functionality, but privacy and security usually come down to having a good track record. That said, it's by far not the only reason leading to tech monopolies. Network effects (paired with a lack of interoperability) brings users to Instagram and MS Office alike.
- hyperdimension 6y ago> If I buy a vacuum cleaner it's easy to tell if it sucks I clearly knew what you meant, but it definitely reminds me of the decade(s)-old adage: "The day Microsoft makes something that doesn't suck is the day they make a vacuum cleaner." I'd argue it's even vaguely on-topic, c.f. Windows 10 updates...
- rglullis 6y agoYeah, trust is earned slowly and lost quickly. Doesn't matter the industry. But it's hard to ignore the Lindy Effect: if a system is serving me for so long and so well, why do I need to worry about lack of competition? Before ublock, I had AdBlock and afterwards ABP on my machines. I started looking for alternatives when they introduced that "acceptable ads" crap.
- fireattack 6y agoNano defender is an anti-anti-adblocker. It works along with uBO ("defend" it if you like), or author's fork of uBO (Nano ADBlocker). uBo is getting good doing this job itself now, but there are still some gaps for Nano Defender to be useful.
- mkskm 6y agouBlock Origin has an unbreak filter list to address this now. Coupled with EasyList, it's been sufficient to remove anti-adblock warnings for me.
- wnevets 6y ago> Raymond inspected the modifications added by the new developers (which was not published to GitHub), revealing their dubious intentions. and chrome will auto-update the extension for you transparently so you don't miss out on these new amazing features!
- rightbyte 6y agoAuto-update is such a antifeuture. There is like no circumstances where it is beneficial since you can mever trust it wont break your stuff or add malicoius code. Since it is pushed instantly there is no chance anyone had the time to review it. Eg. Steam ask if it should update a game. Windows just does it and adds Candy Crush and spyware. Two different takes on the same thing.
- wongarsu 6y agoWindows tried manual updates for years, and even after switching to automated updates still received lots of bad press for security holes that were fixed years earlier. Home Edition taking away the ability not to update is the logical conclusion. Also Microsoft controls the code they push on your computer, they paid the people who wrote it and they take liability for it. Browsers are automatically pushing other people's code to your computer
- ziml77 6y agoI don't care much about the bad press for holes that were patched years back, but I do care about those unupdated machines becoming zombies in a botnet. Those things are so disruptive and the mitigations only work so well.
- russh 6y ago"Also Microsoft controls the code they push on your computer, they paid the people who wrote it and they take liability for it. Browsers are automatically pushing other people's code to your computer" No, Microsoft does not take liability, they expressly disclaim any and all liability in the users agreement.
- sippingjippers 6y agoNoticed this a few times, where race is associated with some bad behaviour as if it made matters any worse. What does it matter if the developers were Turkish? edit: are the downvotes because you believe race matters in this case, or some other problem with the comment?
- netule 6y agoThe author probably quoted it like that because it was the literal wording of the original, unedited, GitHub issue[1]: > But there is good news. A team of Turkish developers is in the process of acquiring Nano Adblocker and Nano Defender [...] [1]: https://github.com/NanoAdblocker/NanoCore/issues/362 https://github.com/NanoAdblocker/NanoCore/issues/362
- fwn 6y ago...and I'm relatively certain they wanted to communicate that the new owners are based in Turkey, not that their developer team is strictly of Turkish ethnicity. They probably didn't check whether there might be Kurds or Circassians on the team.
- coolspot 6y agoI didn’t downvote you, but “Team of Turkish developers” is just how original author of the extension refers to the new owner in his original announcement. https://github.com/NanoAdblocker/NanoCore/issues/362 https://github.com/NanoAdblocker/NanoCore/issues/362
- rubinlinux 6y agoMy impression was that Turkish referred to nationality, not race in this case. The impression is that electronic law and order in Turkey are different than in California.
- codnee 6y agoWhat does California have to do with all this?
- bluu00 6y ago> Remember to audit your extensions frequently, and remove any unused extensions. > In the case of Nano Defender, users were not notified before control of the extension was transferred to a third-party. That's not the right way to handle this. The whole browser extension ecosystem seems to be purposefully bloated with such loopholes allowing such backdoors. I remember seeing a clg presentation, "a browser is a literal nuke you carry on yourself, whatever be the ... or claims as of sandboxing, you're already dead" - loosely quoted.
- kmeisthax 6y agoQuite honestly I'm of the opinion that Google should strictly audit all transfers of ownership of popular extensions. The options for monetizing extensions are so limited that the only thing that can motivate someone to buy an extension is nefarious purposes.
- saxonww 6y agoI immediately wondered if the controversial Manifest V3 changes would render this a non-issue. https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://developer.chrome.com/extensions/migrating_to_manifest_v3 https://developer.chrome.com/extensions/migrating_to_manifes...
- ziml77 6y agoI was thinking the same thing. The reason that plugins like this, uBlock, and Stylish are so valuable is that they have access to everything on every site by nature. On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues.
- yjftsjthsd-h 6y ago> On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues. Except that it doesn't actually protect against security issues, because v3 manifests don't break the ability to read data, only modify requests. Also, since ads are a vector for malware[0], having an adblocker is a security benefit, not a loss. [0] ex. https://www.extremetech.com/internet/220696-forbes-forces-readers-to-turn-off-ad-blockers-promptly-serves-malware https://www.extremetech.com/internet/220696-forbes-forces-re...
- resynth1943 6y agoThanks for the clarification ;-)
- 6y ago
- vffhfhf 6y agoNano blocker was awesome. Now I have to delete stuff. At this point, I no longer trust non-open source application and even open source stuff with low followers.
- deleted 6y ago[deleted]
- wongarsu 6y agoNano Defender was open source prior to the sale, with 150 stars on github https://github.com/NanoAdblocker https://github.com/NanoAdblocker
- ziml77 6y agoEven larger open-source projects aren't immune. FileZilla has had an issue of adware a few times. I don't think there's any way to ensure that an application of any sort will remain trustworthy.
- draebek 6y agoAs it happens, earlier this year I came to the conclusion that browser extensions are too high-risk, and I disabled everything I could possibly do without. Now I'm limiting myself to just Firefox "recommended" extensions, under the hope that Mozilla is doing something to make sure they stay aboveboard, and a few non-recommended ones that I just can't live without, like Vimium. I lost some functionality due to disabling extensions, but so be it. The browser is far too important these days. For my remaining non-recommended extensions, all of which are open source I think, I am considering some workflow where I just clone their repos and install the extensions locally, updating occasionally when I can review the resulting changes myself. (It happens that I had disabled Nano Blocker in my purge months back. FWIW it never seemed to work for me. For those uninstalling, don't forget to uninstall the extension, the block lists, and the uBlock advanced "user resources" file.) EDIT: Just realized I can turn off automatic updates for just some Firefox add-ons, so I did that for a bunch of add-ons. I'll update them when something breaks and I have time to review what's changing.
- blibble 6y agobest reason to use firefox is the ability to disable updates for extensions I've got them all off except ubo
- resynth1943 6y agoThat could introduce security issues, though. I guess auto-update is a two-sided coin?
- toxicFork 6y agoThank you for mentioning, I went to my addon options to disable auto updates.
- jeffbee 6y agoThe only way anyone would have installed this trash in the first place is if their infosec threat model is complete nonsense. You're so worried about ad companies stealing your soul that you turn over full browser control to a bunch of randos? It does not and has not ever made sense.
- laurent92 6y agoOr if they are employees. I’m at my 4th employee, and there are 2 things I’m downright intolerant with: - People mixing their work cookies with their facebook cookies. There is a specific step in the onboarding where they have to create a chrome profile for their personal stuff, or it becomes waterboarding. - A dozen browser extensions. But some extensions are normally necessary (pretty-print the json for example) - I wonder what would be the right process.
- resynth1943 6y agoI use AdGuard DNS. Not perfect (they can still log your DNS history), but it definitely prevents any interception or malicious code stealing passwords. DNS is a lot simpler than blocking extensions. That being said, I do like Firefox's built-in tracker protection. I'd like to see more efforts like Firefox's canvas permission in the future, it definitely helps fight fingerprinting. I guess Epiphany's lack of extension support works to my advantage in some areas.
- aw1621107 6y agoAnyone know what the uninstall steps should be for those of us who used Nano Defender with uBlock Origin [0]? I've disabled Nano Defender and removed NanoResources.txt [1] from my UBO advanced settings, but I'm not sure if there is anything else I should be worried about. I also disabled the Nano Defender Integration and Nano filters lists, but I don't know whether those are safe to use. [0]: https://jspenguin2017.github.io/uBlockProtector/#extra-installation-steps-for-ublock-origin https://jspenguin2017.github.io/uBlockProtector/#extra-insta... [1]: https://gitcdn.xyz/repo/NanoAdblocker/NanoFilters/master/NanoFilters/NanoResources.txt https://gitcdn.xyz/repo/NanoAdblocker/NanoFilters/master/Nan...
- Cide 6y agoI removed Nano Defender and then reset uBO to default settings which should do it.
- nenaan 6y agoI suppose if there was ill intent, they would have silenced the seller with a NDA. It would be silly to let the seller sink your nefarious plan by letting the world know that ownership has transferred.
- uponcoffee 6y agoThere's plenty of people that simply won't know ownership has changed because they just consume the published extension. They're clearly maintaining two sets of code, one for github and one for publishing extensions; nefarious is a strong word, it is at least suspect. As far as an NDA goes, that's signaling to the current open-source maintainer that something nefarious is afoot. How would an NDA work? The maintainer hands other their GH account for the new party to commit under? The extension suddenly goes closed source? The maintainer doesn't acknowledge the community at all and rubber stamps anything the new party wants to commit the repository? It'd be far easier to publicly take over maintaince, do good for a month or so, then silently publish the malware. That was probably the best route here; the maintainer was going to donate most of the monry they received back to the Turkish developers if they did a good job) and they'd have passed the transitory wave of scrutiny from seasoned devs like gorhill.
- danbmil99 6y agoWhew, for a minute there I thought this was about Unix text editor "nano"
- resynth1943 6y agoHaha, well I doubt that's turning into malware anytime soon ;-)
- meroes 6y agoUnfortunately it blocks Twitch ads while others don't. Did the Firefox version suffer the same fate? Since a Twitch update ~1 month ago uMatrix did not have a working solution except for the first few days, but maybe things have changed.
- ebilgenius 6y agoThe Dev version of uBlock Origin has been updated recently to fix that
- meroes 6y agoOk ty for the info!
- bilegeek 6y agoThankfully - article update - since the Firefox version is maintained separately by LiCybora, that maintainer has split off[1]. What confuses me is that the original author, jspenguin2017, has showed up, and is helping a bit with the backend. Since he's already sold the Chrome extension to some shady developers, why is he somehow also nice enough to help out? Gorhill did something similar with the original uBlock, but at least they weren't shady right from the start. What in the world is going on here? Why didn't jspenguin2017 just abandon the project? [1]https://github.com/LiCybora/NanoDefenderFirefox/issues/187 https://github.com/LiCybora/NanoDefenderFirefox/issues/187
- deleted 6y ago[deleted]
- dastx 6y agoI'm not a nano defender user, never have been. I've come across it several times but never ended up trying it. This however makes me sad. We've got a champion who is maintaining a piece of software that's quite frankly pretty core to privacy and security in today's heavily tracked world. Obviously it's not just gorhill either. It includes the many people who have raised PRs, lowered the ticket burden of uBO, but also the many people who maintain some amazing lists. For that, all of these people have my gratitude. The reason this makes me sad is because this is the second time things like this happen. The second time gorhill's efforts are being shat on by some random person. This was completely reckless action by jspenguin2017. It's one thing to want to make money for your efforts, it's another to want to make money from the man hours spent by the uBO and list's maintainers. If jspenguin2017 truly means what he says in his posts and regrets his action, I hope he considers donating all of the money to gorhill & co.
- ayush--s 6y agoThe only adblocker I trust is uBlock from gorhill. I used Adblock way back in 2013-14 and jumped ship when they started allwoing some ads.
- ameyv 6y agoOther than removing extension and changing password? What else should one do? Is it possible to download malware to PC with extension and run it (Like keylogger)? Is it possible that my outlook account could have been hacked through cookie hijacking?
- antihero 6y agoIn another fun note, I've actually been rate-limited by Instagram for how many unlikes I've been doing to try and get rid of all the trash likes they've done using my cookie. Absolute garbage fire. And who knows what other stuff they've done with basically being able to be logged into any site you are?