8 ms·

"Since looking into it, I noticed that uBlock Origin already has the default list "Block Outsider Intrusion into LAN" but it wasn't enabled." Never knew that t

"Since looking into it, I noticed that uBlock Origin already has the default list "Block Outsider Intrusion into LAN" but it wasn't enabled." Never knew that this existed. Thank you!

dd_xplore 1y ago
Is that available in lite version too? Now that the origin js being phased out
- nicce 1y ago
  You can't change browser? Or is there something bigger happening?
  - surajrmal 1y ago
    Not everyone wants to change browsers.
    - LarMachinarum 1y ago
      then again, if the makers of one big browser (and via there also the derived browsers) start force-shoving spyware upon you (by restricting blockers), it comes down to a decision of how you set your priorities. Personally, It's a clear cut red line, but you do you.
- daveidol 1y ago
  It’s only being phased out on Chrome, by Google.
  - ddlsmurf 1y ago
    Yes, to make us safer, now you enable developer mode and disable signature checking to install it locally, thanks Google
    - maleldil 1y ago
      Soon, you won't be able to install it locally because the API it relies on will no longer be available. Use Firefox.
      - Bnjoroge 1y ago
        Or Microsoft Edge
        Ntrails 1y ago
        I thought Edge also did not support true ad blocking?
        maleldil 1y ago
        Microsoft will eventually (TBD) remove Manifest v2 support from Edge, too[1]. > Manifest V2 extensions will no longer function in Microsoft Edge, even with the use of enterprise policies. [1] https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/manifest-v3 https://learn.microsoft.com/en-us/microsoft-edge/extensions/...
        fc417fc802 1y ago
        Isn't that because Edge has been a wrapper around Chromium for a while now? Presumably support will follow upstream.
- bilalq 1y ago
  Just checked, and it seems like it is. Not enabled by default for some reason.
- LarMachinarum 1y ago
  … or you can instead phase out those browsers who try to force blocker restrictions i.e. spyware on you (e.g. chrome and such), and use one of the browsers where you can use the full-featured (not "lite") uBlock Origin instead, e.g. Firefox.
  - Filligree 1y ago
    Firefox might be an okay browser, but that would imply supporting Mozilla. I've been meaning to switch to Vivaldi. Just as soon as the onboarding dialog stops crashing.
    - Rastonbury 1y ago
      I wonder how bad does Mozilla have to be that you have to continue using Chrome without ublock?
      - Filligree 1y ago
        Worse than it is now, I suppose.
    - tos1 1y ago
      I'm curious: What's your reasons for not wanting to support Mozilla?
      - Filligree 1y ago
        I disagree with their politics, I'm concerned by the multiple privacy incidents, and I generally refuse to support them until they refocus on Firefox instead of all the other stuff they're doing. If they worked only on Firefox, I'd have nothing against them. As it stands, I can't even donate to Firefox if I want to.
- buyucu 1y ago
  It is not being phased out for Firefox.
nerflad 1y ago
Checking out the initial request on github for this feature I wonder why is this necessary? What access to the local network does the browser provide, or need to provide, and why isn't this something developers are more concerned about? I had a feeling this was possible as I see lots of mdns requests when I connect to certain things running sockets. https://github.com/uBlockOrigin/uAssets/issues/4318 https://github.com/uBlockOrigin/uAssets/issues/4318
- lol768 1y ago
  It's being looked at. https://bugzilla.mozilla.org/show_bug.cgi?id=1481298 https://bugzilla.mozilla.org/show_bug.cgi?id=1481298
  - theyinwhy 1y ago
    7 year old ticket updated and prioritized because of https://localmess.github.io/ https://localmess.github.io/
    - sitkack 1y ago
      This is how it always is with Firefox, you hit some bug and then find that it was entered YEARS ago, while they burn focus on things like Pocket.
- dannyw 1y ago
  There are certainly use cases, but whether they’re warranted is a good question. One popular router maker offers a ‘magic URL’ (domain name) that scans your network for the gateway management page, and redirects. It’s not necessary, but it certainly helps novice users. Having worked in IT support, I’ve also purchased hardware devices that have a web management UI; which connects directly instead of proxying through a cloud. Ultimately this is probably one thing that should be behind a permission request (like webcam access), but it’s not a feature without value.
balamatom 1y ago
Massively improved my security posture with this. Thanks all!
buyucu 1y ago
Likewise I didn't know it existed, but it was enabled on my laptop and mobile browsers.
adastra22 1y ago
I’m flabbergasted that this is even allowed. Who thought it was a good idea to allow any web page you visit to access your local network?
- johncolanduoni 1y ago
  Internal apps on non-private IP addresses occasionally use this. There is a standard called Private Network Access[1] that requires these requests to have preflights like CORS requests. Only Chrome has implemented it so far. [1]: https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/
  - adastra22 1y ago
    Why though? What is the use case that demands this? It'd better be a real pressing need because the security risks are immense and obvious. This is a backdoor to every network firewall.
    - psd1 1y ago
      I'm hazy on the details, but: Home Assistant has a well-known public name that opens your local instance. On first access, you need to give it the name or ip of your instance, which is saved in browser storage. This supports deep links into your config from forum posts. My mum also had a shitty D-Link wifi mesh device, which was packaged as an appliance. I cannot speak lowly enough about that garbage device, but then, I am not really the target market. iirc it had something similar; a public dns name for local appliance mgmt.
      - adastra22 1y ago
        How is that the same thing? That is a DNS entry that resolves to an internal IP. That lets a user explicitly type a domain and get something internal. That wouldn’t allow cnn.com to ports scan my fridge.
        1y ago

"Since looking into it, I noticed that uBlock Origin already has the default list "Block Outsider Intrusion into LAN" but it wasn't enabled." Never knew that this existed. Thank you!

dd_xplore 1y ago

Is that available in lite version too? Now that the origin js being phased out

nicce 1y ago
You can't change browser? Or is there something bigger happening?
- surajrmal 1y ago
  Not everyone wants to change browsers.
  - LarMachinarum 1y ago
    then again, if the makers of one big browser (and via there also the derived browsers) start force-shoving spyware upon you (by restricting blockers), it comes down to a decision of how you set your priorities. Personally, It's a clear cut red line, but you do you.
daveidol 1y ago
It’s only being phased out on Chrome, by Google.
- ddlsmurf 1y ago
  Yes, to make us safer, now you enable developer mode and disable signature checking to install it locally, thanks Google
  - maleldil 1y ago
    Soon, you won't be able to install it locally because the API it relies on will no longer be available. Use Firefox.
    - Bnjoroge 1y ago
      Or Microsoft Edge
      - Ntrails 1y ago
        I thought Edge also did not support true ad blocking?
      - maleldil 1y ago
        Microsoft will eventually (TBD) remove Manifest v2 support from Edge, too[1]. > Manifest V2 extensions will no longer function in Microsoft Edge, even with the use of enterprise policies. [1] https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/manifest-v3 https://learn.microsoft.com/en-us/microsoft-edge/extensions/...
        fc417fc802 1y ago
        Isn't that because Edge has been a wrapper around Chromium for a while now? Presumably support will follow upstream.
bilalq 1y ago
Just checked, and it seems like it is. Not enabled by default for some reason.
LarMachinarum 1y ago
… or you can instead phase out those browsers who try to force blocker restrictions i.e. spyware on you (e.g. chrome and such), and use one of the browsers where you can use the full-featured (not "lite") uBlock Origin instead, e.g. Firefox.
- Filligree 1y ago
  Firefox might be an okay browser, but that would imply supporting Mozilla. I've been meaning to switch to Vivaldi. Just as soon as the onboarding dialog stops crashing.
  - Rastonbury 1y ago
    I wonder how bad does Mozilla have to be that you have to continue using Chrome without ublock?
    - Filligree 1y ago
      Worse than it is now, I suppose.
  - tos1 1y ago
    I'm curious: What's your reasons for not wanting to support Mozilla?
    - Filligree 1y ago
      I disagree with their politics, I'm concerned by the multiple privacy incidents, and I generally refuse to support them until they refocus on Firefox instead of all the other stuff they're doing. If they worked only on Firefox, I'd have nothing against them. As it stands, I can't even donate to Firefox if I want to.
buyucu 1y ago
It is not being phased out for Firefox.

nerflad 1y ago

Checking out the initial request on github for this feature I wonder why is this necessary? What access to the local network does the browser provide, or need to provide, and why isn't this something developers are more concerned about? I had a feeling this was possible as I see lots of mdns requests when I connect to certain things running sockets. https://github.com/uBlockOrigin/uAssets/issues/4318 https://github.com/uBlockOrigin/uAssets/issues/4318

lol768 1y ago
It's being looked at. https://bugzilla.mozilla.org/show_bug.cgi?id=1481298 https://bugzilla.mozilla.org/show_bug.cgi?id=1481298
- theyinwhy 1y ago
  7 year old ticket updated and prioritized because of https://localmess.github.io/ https://localmess.github.io/
  - sitkack 1y ago
    This is how it always is with Firefox, you hit some bug and then find that it was entered YEARS ago, while they burn focus on things like Pocket.
dannyw 1y ago
There are certainly use cases, but whether they’re warranted is a good question. One popular router maker offers a ‘magic URL’ (domain name) that scans your network for the gateway management page, and redirects. It’s not necessary, but it certainly helps novice users. Having worked in IT support, I’ve also purchased hardware devices that have a web management UI; which connects directly instead of proxying through a cloud. Ultimately this is probably one thing that should be behind a permission request (like webcam access), but it’s not a feature without value.

balamatom 1y ago

Massively improved my security posture with this. Thanks all!

buyucu 1y ago

Likewise I didn't know it existed, but it was enabled on my laptop and mobile browsers.

adastra22 1y ago

I’m flabbergasted that this is even allowed. Who thought it was a good idea to allow any web page you visit to access your local network?

johncolanduoni 1y ago
Internal apps on non-private IP addresses occasionally use this. There is a standard called Private Network Access[1] that requires these requests to have preflights like CORS requests. Only Chrome has implemented it so far. [1]: https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/
- adastra22 1y ago
  Why though? What is the use case that demands this? It'd better be a real pressing need because the security risks are immense and obvious. This is a backdoor to every network firewall.
  - psd1 1y ago
    I'm hazy on the details, but: Home Assistant has a well-known public name that opens your local instance. On first access, you need to give it the name or ip of your instance, which is saved in browser storage. This supports deep links into your config from forum posts. My mum also had a shitty D-Link wifi mesh device, which was packaged as an appliance. I cannot speak lowly enough about that garbage device, but then, I am not really the target market. iirc it had something similar; a public dns name for local appliance mgmt.
    - adastra22 1y ago
      How is that the same thing? That is a DNS entry that resolves to an internal IP. That lets a user explicitly type a domain and get something internal. That wouldn’t allow cnn.com to ports scan my fridge.
      - 1y ago