12 ms·
Firefox 87 introduces SmartBlock for Private Browsing
- CA0DA 6y ago"a number of common scripts" - I wish they would have linked to where to find the technical details of which scripts they are emulating. Anyone know where this can be found?
- 29083011397778 6y agoIsn't it in the rest of the sentence you didn't quote? > In Firefox 87, SmartBlock will silently stand in for a number of common scripts classified as trackers on the Disconnect Tracking Protection List. Which, I assume, would be pulled from here [0] [0] https://disconnect.me/trackerprotection https://disconnect.me/trackerprotection
- oktoberpaard 6y agoI think the question was which of those trackers have a stand-in script (could be a subset of all blocked trackers) and what the stand-in script looks like.
- arthuredelstein 6y agoThe main "engine" is here: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/lib/shims.js https://searchfox.org/mozilla-central/source/browser/extensi... The shims are here: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/shims/ https://searchfox.org/mozilla-central/source/browser/extensi... And the config file for how they are used is here: https://searchfox.org/mozilla-central/source/browser/extensions/webcompat/data/shims.js https://searchfox.org/mozilla-central/source/browser/extensi...
- deleted 6y ago[deleted]
- 29083011397778 6y agoBased on the comparison shown between using the third party scripts with tracking, and using the smart block stand-in, I wonder if this could be an edge against Chrome? While the Google team can push the envelope, pay for whatever is necessary, and add their own standards (such as AMP, though that may be going away IIRC), they're likely stuck waiting on trackers just like Firefox was (on non-AMP pages).
- oktoberpaard 6y agoI believe that the comparison was between blocking the tracking script with and without a stand-in.
- jefftk 6y agoYes: "Previously (left), the website tiny.cloud had poor loading performance in Private Browsing windows in Firefox because of an incompatibility with strong Tracking Protection. With SmartBlock (right), the website loads properly again, while you are still fully protected from trackers found on the page."
- whalesalad 6y agoThis is a great solution to a problem that seems to becoming more prevalent. Reminder to devs that bolted on third party scripts should not be in the critical path. Meaning, if you are doing something like capturing a click event in a Google analytics handler and blocking the redirect until you’ve tracked the click - you’re going to have a bad time. Many tracking scripts are designed for this and will gracefully/silently fail via something like an array push mechanism but I’ve encountered the opposite as well. Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects - but it’s also helped me build more resilient applications that work just as well for people who don’t have trackers enabled.
- ethagnawl 6y ago> Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects I have a family member who works in marketing and am regularly asked to either turn off the pihole or add a new URL to the ignored list for exactly this reason.
- McDyver 6y agoYou can create groups in pihole and select which devices can bypass it. I'm not sure if you can assign specific lists per group, though
- llarsson 6y agoI believe you can! https://docs.pi-hole.net/database/gravity/groups/ https://docs.pi-hole.net/database/gravity/groups/
- mosselman 6y agoThe easiest way around this is to install a secondary browser (or use a profile in firefox, but that is cumbersome) for work. They could use a different DNS provider in that browser. I use Brave for this and Firefox for my private stuff. Or they could ask their employer to pay for a VPN services that comes with DNS. Your family member will then have an easy to understand and easy to spot (VPN is ON) way to 'go into work mode' and out of it for private.
- disposekinetics 6y agoIs this Firefox adopting LocalCDN/Decentraleyes, or am I totally misunderstanding what's going on.
- oktoberpaard 6y agoIt’s different, as Decentraleyes hosts a local copy of libraries like jQuery, while the new Firefox feature is about emulating tracking scripts with a minimal set of features to trick the site into thinking it is present.
- disposekinetics 6y agoThat's a great idea. Thank you for clarifying.
- Silhouette 6y agoIf this works, it will be a very welcome development. Firefox is still my preferred primary browser given who the competition is, but the number of normal, everyday sites I visit that don't work properly in Firefox has become irritating. It appears that quite a few of those problems are caused by the security/privacy blocking rather than a lack of other functionality in Firefox, and it's usually the blocking by Firefox itself rather than any relevant add-ons because disabling the latter doesn't solve the problem.
- prower 6y agoCould you provide examples? For the few cases i've encountered, disabling Ublock Origins (before blacklisting the website forever) solves the problem.
- Silhouette 6y agoSorry, I haven't thought to bookmark any of them. I'm just talking about sites I'd come across while browsing, perhaps following some interesting links from sites like HN. But on a noticeable number of occasions now, dev tools confirm there are script errors that seem to come from identifiers being undefined and the like, and if I literally disable every add-on I'm using, they are still undefined (but only in Firefox, not other browsers). The changes to promote privacy in recent versions of Firefox seem like the most likely explanation at that point, though to be fair I have no hard evidence of that either.
- emayljames 6y agoI have encountered a few issues with uBlock and annoyances filter breaking the chocolatey website (portable software provider) where it leaves the site with an overlay. I've seen this in a few other places too.
- GoblinSlayer 6y agoI opened the chocolatey website with outright disabled scripts and it works ok. Markup is not very bad, search even works and they have noscript autohiding spinners (didn't know such a thing can exist at all), I suppose it was designed with noscript compatibility in mind.
- UI_at_80x24 6y agoNext step (please): block all 1x1 sized images. The transparent pixel tracking trick is common enough now that it should be blocked by default in all 'Private' modes.
- metalliqaz 6y ago... and tracking pixels would become 1x2, meanwhile actual 1x1 images used for formatting would stop working
- falcolas 6y ago> 1x1 images for formatting Huh? People still do this? Designers, I swear.
- FalconSensei 6y ago> actual 1x1 images used for formatting would stop working I see that as a feature
- asicsp 6y ago
- newscracker 6y ago> The SmartBlock stand-ins are bundled with Firefox: no actual third-party content from the trackers are loaded at all, so there is no chance for them to track you this way. Those third party scripts may not be able to track, but I wonder if the act of loading the stand-in scripts quickly (?) from within Firefox would lead to other issues. > We also want to acknowledge the NoScript and uBlock Origin teams for helping to pioneer this approach. Not to belittle the effort by others and other projects, but these two extensions, along with some others (like Privacy Badger), have helped users immensely in protecting themselves.
- irae 6y ago> I wonder if the act of loading the stand-in scripts quickly (?) from within Firefox would lead to other issues. Mozilla does everything in the open, if you care to look at their bugtracker you will probably find all the conversation there, pros and cons, etc.
- jefftk 6y ago> I wonder if the act of loading the stand-in scripts quickly (?) from within Firefox would lead to other issues. That's essentially the same as if they are loaded from the browser cache. What sort of issues are you concerned about?
- wisniewskit 6y agoHi, lead SmartBlock dev here. My regular job at Mozilla involves diagnosing web sites for web compatibility issues, so I definitely share your concerns -- I routinely see sites relying on scripts loading in a specific order, but not coding themselves in a way that ensures that they actually do. I haven't received any reports so far during the six-month-or-so nightly cycle where SmartBlock was only on nightly builds, so I'm optimistic. In the worst case we might be able to just add in an artificial delay to fix that, but of course I'd rather waste user's time like that unless that's 100% necessary. And ultimately, problems are at least as likely (in my experience) to manifest with scripts loading too slowly, or not loading at all due to random networking hiccups.. many sites just aren't very tolerant at all of script loading failures.
- deleted 6y ago[deleted]
- EVa5I7bHFq9mnYK 6y agoAnything "smart" and "intelligent" is by now firmly associated with "we are watching you" in my brain. Maybe not the case here ... let's hope.
- kaba0 6y agoHow about reading what it is?
- EVa5I7bHFq9mnYK 6y agoThat's too much work. Is it good? I'll take your word for it.
- kaba0 6y agoProbably not worth reading, but then at least look at the comments that describe what it does. Basically, it is a dummy implementation of often used tracking libs, so that if a website wants to use one, firefox will instead call their own instead. Making websites both faster and more privacy-friendly.
- prower 6y agoWouldn't it be better to have it also when browsing non-privately?
- go561192 6y agoThe new 'trim referrer by default' in Firefox 87 [1] was already enabled in private mode only, some months/weeks ago. So maybe they will make it default everywhere after some weeks? Maybe after working out any kinks? [1] https://news.ycombinator.com/item?id=26539673 https://news.ycombinator.com/item?id=26539673
- wisniewskit 6y agoSmartBlock can only kick in when tracking content is actively being blocked by tracking protection. If you'd like that to be on all the time, you can turn strict (or custom) tracking protection on in all windows, but of course the trade off is that you'll likely experience more site breakage, like you might in private browsing windows.
- musicale 6y agoTracking vs. privacy is an arms race and the current endgame looks like server-side tracking vs. VPNs/virtual clients. I wonder what Mozilla's plan is for blocking/mitigating server-side tracking?
- kostko 6y agoWhy not add something to protect the web security? XSS protection ? CSRF protection? We could do those things in the browser and not in every website in existance…
- Boltgolt 6y agoOne word: Compatibility. There are already protections against XSS and CSRF build in, and adding stricter rules would cause sites to break. Do you want to maintain a list of all sites that need cross origin GET requests to function?
- ybbond 6y agoThe one major improvement of 87 for me is the "Highlight All" for search also display location in the scroll bar.