4 ms·
What it does, under the covers: (function() { var a = document.createElement("script"); a.type = "text/javascript"; a.innerText = 'window["
by tyingq 5y ago
What it does, under the covers:
(function() {
var a = document.createElement("script");
a.type = "text/javascript";
a.innerText = 'window["_gaUserPrefs"] = { ioo : function() { return true; } }';
document.documentElement.insertBefore(a,
document.documentElement.firstChild);
})()
And it injects that into every site you visit:
"matches": [
"http://*/*",
"https://*/*"
],
They should probably replace it with their declarative blocking functionality.
- darknavi 5y ago> They should probably replace it with their declarative blocking functionality. I see what you did there. Won't this break with ManifestV3?
- greyface- 5y agoNo. ManifestV3 removes the webRequest API, which is used to modify/block in-flight requests. Injecting a script into every page, as this does, is still possible. https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#network-request-modification https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...
- GioM 5y agoIt’s a bit of a shame, the inability to modify requests for CORS will break a lot of frontend developer workflows. It’s going to force the adoption of cors-proxy type solutions instead of a relatively simpler extension.
- najqh 5y agoIt would be much simpler to block all requests to download the analytics javascript/web bug URL. Makes me think they want to keep collecting user data even if you install this.
- kevincox 5y agoBut the analytics script provides an API that some websites rely on so it would end up breaking some sites. This necessitates the approach of disarming the script rather than just blocking it.
- mlindner 5y agoI just don't use websites that break because of that.
- tedivm 5y agoI use ublock, which does block the script, and run into issues occasionally because of this. It seems to be mostly an issue with shopping carts.
- smitop 5y agouBlock Origin includes a dummy script that emulates the real Google Analytics script: https://github.com/gorhill/uBlock/blob/master/src/web_accessible_resources/google-analytics_analytics.js https://github.com/gorhill/uBlock/blob/master/src/web_access...
- neltnerb 5y agoHmm, I don't think I've ever encountered a website that was broken without enabling javascript that was obviously analytics (I use umatrix pretty aggressively). The one that usually breaks checkout flow for me is that the credit card processors all want to use an iframe and often recaptcha and usually it takes 3-4 reloads before it actually even tries to load it all.
- IYasha 5y agoI've seen a few sites that actually communicate with scripted-in ad providers to verify you have downloaded and watched their ads, visited partner pages. For "free" downloads, for example.
- btdmaster 5y ago
- neilparikh 5y agoDoesn't adding this to every site help fingerprint you? Hopefully most sites won't use this to track you, but a malicious site could definitely use this as an additional bit of information (and a fairly useful one, given that most people probably don't have this extension installed).
- judge2020 5y agoPerhaps, but there are much easier ways to fingerprint browsers who would have this installed and not a real ad-blocker.
- Sephr 5y agoLooks like this extension doesn't work for XHTML documents as well. Extensions that want to inject elements should use document.createElementNS with an explicit namespace.
- jchw 5y agoWow, thanks. Back when XHTML 1.0 was gaining traction and you had to serve a different content type to IE vs other browsers, I was trying to adopt it early, and yet I never realized that it had this impact on the DOM that entire time.