4 ms·

uMatrix has been unmaintained for 2 years and has known vulnerabilities[1]. Time to move to another extension. [1] https://www.ghacks.net/2021/07/15/umatrix-ha

by pavon 4y ago

uMatrix has been unmaintained for 2 years and has known vulnerabilities[1]. Time to move to another extension. [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...

ThunderSizzle 4y ago
I wish it would be fixed or forked if gorhill won't fix it. uMatrix's UI is easily the best I've used due to showing the white/black list as a matrix.
- pavon 4y ago
  I know, I love uMatrix, and was sad to leave it. I've migrated to uBlock Origin, but it isn't the same even with dynamic filtering window opened. With uMatrix I had been taking the approach of denying all third-party resources by default and selectively allowing just the ones I need, and after the move largely ended up abandoning this approach. The different UI of uBO was part of this decision, but not the biggest factor. Over time it had gotten less and less workable even with uMatrix's great UI. I could no longer configure a site once and then expect it to work for any amount of time, as the rate at which new mandatory third-party dependencies were added to sites kept increasing. And I was visiting more websites as part of avoiding big sites like Amazon. In addition, uBO's CNAME unmasking meant that many resources that were considered first party by uMatrix, are treated as third party by uBO. This added to the burden of whitelisting, but also got me thinking about how fuzzy the first party / third party distinction was and that it was increasingly a poor proxy variable for what I was really trying to block (trackers mostly, and also some annoyances). I also use the Temporary Container extension in Firefox. In the end I decided that the default block lists of uBO combined with the isolation and discarding of persistent data provided by Temporary Containers was good enough for most browsing. I still use a whitelisting approach for my handful of permanent containers, and uBO's dynamic mode UI is good enough for that.
fn-mote 4y ago
Easy to say "move to another", but what offers comparable functionality? The vulnerability does not seem that serious to me... isn't it going to be pretty obvious if it gets exploited with this description? > An attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. When the extension crashes, users are left without protection until it is reloaded. So I'm going to start seeing a bunch of ads as my clue, right? [Not a drive-by:] > It requires that users become active, e.g. by clicking on a link. The article you linked has plenty of information in the comments, it's actually a good resource.
kasabali 4y ago
Check your facts. This vulnerability has been fixed in uMatrix 1.4.2 [0], released few days after the linked news article. [0] https://github.com/gorhill/uMatrix/releases/tag/1.4.2 https://github.com/gorhill/uMatrix/releases/tag/1.4.2
- eek2121 4y ago
  Check your own. uBlock Origin functionality made this extension die on a hill.
  - pabs3 4y ago
    uBlock Origin definitely isn't a replacement for uMatrix. I've tried.
  - kasabali 4y ago
    This was addressed directly to this part: > and has known vulnerabilities which is demonstrably false. If you want to talk about other points move on to a related sibling sub-thread.

by pavon 4y ago

ThunderSizzle 4y ago

I wish it would be fixed or forked if gorhill won't fix it. uMatrix's UI is easily the best I've used due to showing the white/black list as a matrix.

pavon 4y ago
I know, I love uMatrix, and was sad to leave it. I've migrated to uBlock Origin, but it isn't the same even with dynamic filtering window opened. With uMatrix I had been taking the approach of denying all third-party resources by default and selectively allowing just the ones I need, and after the move largely ended up abandoning this approach. The different UI of uBO was part of this decision, but not the biggest factor. Over time it had gotten less and less workable even with uMatrix's great UI. I could no longer configure a site once and then expect it to work for any amount of time, as the rate at which new mandatory third-party dependencies were added to sites kept increasing. And I was visiting more websites as part of avoiding big sites like Amazon. In addition, uBO's CNAME unmasking meant that many resources that were considered first party by uMatrix, are treated as third party by uBO. This added to the burden of whitelisting, but also got me thinking about how fuzzy the first party / third party distinction was and that it was increasingly a poor proxy variable for what I was really trying to block (trackers mostly, and also some annoyances). I also use the Temporary Container extension in Firefox. In the end I decided that the default block lists of uBO combined with the isolation and discarding of persistent data provided by Temporary Containers was good enough for most browsing. I still use a whitelisting approach for my handful of permanent containers, and uBO's dynamic mode UI is good enough for that.

fn-mote 4y ago

Easy to say "move to another", but what offers comparable functionality? The vulnerability does not seem that serious to me... isn't it going to be pretty obvious if it gets exploited with this description? > An attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. When the extension crashes, users are left without protection until it is reloaded. So I'm going to start seeing a bunch of ads as my clue, right? [Not a drive-by:] > It requires that users become active, e.g. by clicking on a link. The article you linked has plenty of information in the comments, it's actually a good resource.

kasabali 4y ago

Check your facts. This vulnerability has been fixed in uMatrix 1.4.2 [0], released few days after the linked news article. [0] https://github.com/gorhill/uMatrix/releases/tag/1.4.2 https://github.com/gorhill/uMatrix/releases/tag/1.4.2

eek2121 4y ago
Check your own. uBlock Origin functionality made this extension die on a hill.
- pabs3 4y ago
  uBlock Origin definitely isn't a replacement for uMatrix. I've tried.
- kasabali 4y ago
  This was addressed directly to this part: > and has known vulnerabilities which is demonstrably false. If you want to talk about other points move on to a related sibling sub-thread.