8 ms·

The switch from full acces to white-listing for full blocking is just awesome imo. You can just decide for each case the tradeoff between advanced blocking and

The switch from full acces to white-listing for full blocking is just awesome imo. You can just decide for each case the tradeoff between advanced blocking and security.

e2le 3y ago
I'm unsure of how it exactly differs and whether there are features missing. I will admit that if I were to install uBOL today, I would be worried that it would be less capable and my browsing experience less-safe.
- eipi10_hn 3y ago
  There are many features missing, more prone to anti-adblock/ads-reinsertion (problems with `redirect-rule` and unable to fast updates) and ads/trackers/popups can slip through if cannot be caught by regex filters.
- odo1242 3y ago
  also: - one thing that is much less powerful is cosmetic filters, which means ads may be replaced with gray squares if uBOL can't remove them entirely - less filters overall, because the limits on how many filters are possible are pretty strict - extension updates will be both larger and much more frequent because filter lists can no longer be updated separately from the extension
  - flangola7 3y ago
    Why is there a filter limit at all? Why did Firefox add that? Can config change it?
    - postalrat 3y ago
      Filters aren't free
      - wtallis 3y ago
        They are quite often better than free, blocking unwanted content that would consume more memory and CPU time than the filter itself.
      - JacobSeated 3y ago
        Filters take a minuscule amount of resources. E.g. Even if you had to loop over a list with thousands of entries this would be unlikely to matter, and can in fact even be optimized quite significantly with various algorithms. However, because a database is most likely used, this is not even an issue, and the resource use will in fact be truly minimal. I can not give you an exact number, but it is massively bigger than the number of trackers / elements that any usable web page can realistically implement. Probably you can do several thousands database calls in less than a second due to indexing; and that can be further optimized by doing it in batches, bringing it up to tens of thousands, if not in the hundreds on modern PCs. It is literally not an issue.
        postalrat 3y ago
        Is the limit still around 30,000 or is it higher? That could be 600,000 filter checks on a page load with 20 requests. I'm sure it's fast but if people want unlimited number of rules that number could start exploding.
    - bornfreddy 3y ago
      > Why did Firefox add that? They didn't, Google did. It is part of MV3 specs, afaik.
      - _aizw 3y ago
        But Firefox still didn't have to implement the limit.
        _v7gu 3y ago
        Then don't use the downgraded version of the ad blocker? What is the point of having two versions of MV3 when you can use a superior adblocker on Firefox anyway?
      - flangola7 3y ago
        Google doesn't make Firefox. I flatly don't understand why Mozilla has that limit.
- winter_blue 3y ago
  Hmm, it looks like the uBO "Enter element picker mode" feature is not available. I've found that pretty useful occasionally in the past on websites where uBO doesn't catch an ad.
  - deleted 3y ago
    [deleted]
yellowapple 3y ago
That tradeoff is already possible with the normal uBlock Origin; it just has a different (preferable IMO) default. The only apparent upside to this version is if you don't trust Raymond Hill to refrain from spying on your browsing sessions via his add-on. By every other metric this seems like a downgrade.
- akyuu 3y ago
  If you use a non-declarative adblocker, you're not just trusting the developer, but also all the third-party filter lists you've subscribed to. These filters have powerful capabilities and can even exfiltrate website data [1], and they are updated in real time, so if a bad actor pushed a malicious update (e.g. by gaining access to any EasyList contributor account), you would most likely be affected. However, it's true some websites (like YouTube) are especially problematic and a declarative adblocker is not enough. What you can do is combine both approaches: use a declarative adblocker (uBlock Origin Lite) as a baseline, and selectively enable non-declarative adblockers (uBlock Origin) for specific websites (see [2] for a detailed overview). I like this layered approach because it gets you the best of both worlds: the security and performance of a declarative adblocker, and the functionality of a non-declarative adblocker when you need it, without compromising your entire browsing session. [1] https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css https://portswigger.net/research/ublock-i-exfiltrate-exploit... [2] https://seirdy.one/posts/2022/06/04/layered-content-blocking/ https://seirdy.one/posts/2022/06/04/layered-content-blocking...
nottorp 3y ago
Why do you think so? Say I open HN on my morning coffee and open 5 links in new tabs. They don't have to be to sites I've opened before. I will be tracked until i go to each tab and add it to uBlock Origin. How is that an improvement?
- mattstir 3y ago
  It truly does seem like a misinformed take on security, believing that being actively tracked is better than the possibility of being tracked if uBlock Origin were ever to be compromised.
  - nottorp 3y ago
    Those evil hackers always compromise open source code first, never the ads that no one is reviewing!

The switch from full acces to white-listing for full blocking is just awesome imo. You can just decide for each case the tradeoff between advanced blocking and security.

e2le 3y ago

I'm unsure of how it exactly differs and whether there are features missing. I will admit that if I were to install uBOL today, I would be worried that it would be less capable and my browsing experience less-safe.

eipi10_hn 3y ago
There are many features missing, more prone to anti-adblock/ads-reinsertion (problems with `redirect-rule` and unable to fast updates) and ads/trackers/popups can slip through if cannot be caught by regex filters.
odo1242 3y ago
also: - one thing that is much less powerful is cosmetic filters, which means ads may be replaced with gray squares if uBOL can't remove them entirely - less filters overall, because the limits on how many filters are possible are pretty strict - extension updates will be both larger and much more frequent because filter lists can no longer be updated separately from the extension
- flangola7 3y ago
  Why is there a filter limit at all? Why did Firefox add that? Can config change it?
  - postalrat 3y ago
    Filters aren't free
    - wtallis 3y ago
      They are quite often better than free, blocking unwanted content that would consume more memory and CPU time than the filter itself.
    - JacobSeated 3y ago
      Filters take a minuscule amount of resources. E.g. Even if you had to loop over a list with thousands of entries this would be unlikely to matter, and can in fact even be optimized quite significantly with various algorithms. However, because a database is most likely used, this is not even an issue, and the resource use will in fact be truly minimal. I can not give you an exact number, but it is massively bigger than the number of trackers / elements that any usable web page can realistically implement. Probably you can do several thousands database calls in less than a second due to indexing; and that can be further optimized by doing it in batches, bringing it up to tens of thousands, if not in the hundreds on modern PCs. It is literally not an issue.
      - postalrat 3y ago
        Is the limit still around 30,000 or is it higher? That could be 600,000 filter checks on a page load with 20 requests. I'm sure it's fast but if people want unlimited number of rules that number could start exploding.
  - bornfreddy 3y ago
    > Why did Firefox add that? They didn't, Google did. It is part of MV3 specs, afaik.
    - _aizw 3y ago
      But Firefox still didn't have to implement the limit.
      - _v7gu 3y ago
        Then don't use the downgraded version of the ad blocker? What is the point of having two versions of MV3 when you can use a superior adblocker on Firefox anyway?
    - flangola7 3y ago
      Google doesn't make Firefox. I flatly don't understand why Mozilla has that limit.
winter_blue 3y ago
Hmm, it looks like the uBO "Enter element picker mode" feature is not available. I've found that pretty useful occasionally in the past on websites where uBO doesn't catch an ad.
- deleted 3y ago
  [deleted]

yellowapple 3y ago

That tradeoff is already possible with the normal uBlock Origin; it just has a different (preferable IMO) default. The only apparent upside to this version is if you don't trust Raymond Hill to refrain from spying on your browsing sessions via his add-on. By every other metric this seems like a downgrade.

akyuu 3y ago
If you use a non-declarative adblocker, you're not just trusting the developer, but also all the third-party filter lists you've subscribed to. These filters have powerful capabilities and can even exfiltrate website data [1], and they are updated in real time, so if a bad actor pushed a malicious update (e.g. by gaining access to any EasyList contributor account), you would most likely be affected. However, it's true some websites (like YouTube) are especially problematic and a declarative adblocker is not enough. What you can do is combine both approaches: use a declarative adblocker (uBlock Origin Lite) as a baseline, and selectively enable non-declarative adblockers (uBlock Origin) for specific websites (see [2] for a detailed overview). I like this layered approach because it gets you the best of both worlds: the security and performance of a declarative adblocker, and the functionality of a non-declarative adblocker when you need it, without compromising your entire browsing session. [1] https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css https://portswigger.net/research/ublock-i-exfiltrate-exploit... [2] https://seirdy.one/posts/2022/06/04/layered-content-blocking/ https://seirdy.one/posts/2022/06/04/layered-content-blocking...

nottorp 3y ago

Why do you think so? Say I open HN on my morning coffee and open 5 links in new tabs. They don't have to be to sites I've opened before. I will be tracked until i go to each tab and add it to uBlock Origin. How is that an improvement?

mattstir 3y ago
It truly does seem like a misinformed take on security, believing that being actively tracked is better than the possibility of being tracked if uBlock Origin were ever to be compromised.
- nottorp 3y ago
  Those evil hackers always compromise open source code first, never the ads that no one is reviewing!