gorhill

42 ms·

361.
by gorhill 11y ago
> I'm not sure where I said anything like that Here (my emphasis): > Adblock Edge was discontinued a little while back [...] uBlock Origin is apparently now the blessed alternative [...] but I immediately found a few potential
362.
by gorhill 11y ago
> I couldn't immediately see any of the other suggested lists Fanboy's Anti-ThirdpartySocial is right there in the list of lists, under the Social header. > In contrast, with a couple of fire-and-forget plug-ins I've be
363.
by gorhill 11y ago
Video footage of that code executing: https://www.youtube.com/watch?v=3_VDM8nC9sM
364.
by gorhill 11y ago
> I immediately found a few potential tracking issues with its default lists I am curious: what are these "few potential tracking issues" specifically ? Whatever default lists uBO is using, unlike with ABE (which is essentiall
365.
by gorhill 11y ago
When I try the proofs of concept in Firefox 41, I see all font requests being done at once at page load time, regardless of whether the font resource is used or not. This actually foils the exploit. I suppose this is the way to mitigate the
366.
by gorhill 11y ago
> I'm pretty sure the requests still go to the attacker You are right, they do, it's just that the returned data is not allowed to be seen/used by the page -- the "l0.cm" server still got the information.
367.
by gorhill 11y ago
> The attackers then immediately performed a password reset to hijack PageFair’s account on a Content Distribution Network (CDN) service that we use to serve our analytics javascript tag. They modified the CDN settings so that instead of
368.
by gorhill 11y ago
I can't make this work on my side, both Chromium and Firefox block the requests for the font resources from l0.cm (because CORS policy): Font from origin 'http://l0.cm' has been blocked from loading by Cross-O
369.
by gorhill 11y ago
The filter lists which are selected by default are part of the package. An updated versions of these lists is progressively downloaded a few minutes after first install. But this has been like this since forever now, this is not new. This d
370.
by gorhill 11y ago
Yes, it still is in the store as of now. However the email I received is titled "Chrome Web Store: Removal notification for uBlock Origin". In any case, it's just impossible for me to figure what is the issue. I could spend a
371.
by gorhill 11y ago
A "Privacy & Security" category for extensions in the Chrome store would be an interesting first move.
372.
by gorhill 11y ago
The Firefox version of uBlock Origin supports inline script tag filtering, which allows to work around Bild's block (and other such attempts).[1] Chromium-based browser do not support inline script tag filtering, but you can still bloc
373.
by gorhill 11y ago
> uBlock (Origin) super quick AdBlock fork uBlock Origin was written from scratch, it's not a fork of AdBlock. > with terrible interface I disagree. Out of the box, the UI is mostly a big button to toggle it on/off on a per-
374.
by gorhill 11y ago
I run benchmark regularly concerning privacy exposure, and I ran one this summer to find out all 3rd parties for a sample of high traffic web sites. I collected and sorted the results by [3rd party, 1st party] pairs: this allows to see at a
375.
by gorhill 11y ago
Just checked and it works fine using default settings. If you added more filter lists, the issue is likely caused by one of them.
376.
by gorhill 11y ago
This is not mentioned in the article, so just to be more specific, the override of `XMLHttpRequest.open()` applies only for the Safari-specific code of the extension.[1] [1] See https://github.com/chrisaljoudi/uBlock&#x
377.
by gorhill 11y ago
Using this means `ampproject.org` will be able to build a profile of your browsing history to any of the AMP partners' web sites. I suppose referrer spoofing could help mitigate this, but then I suppose other browser fingerprinting tec
378.
by gorhill 11y ago
> You suggest elsewhere there is revenue sharing involved, but that is not true. It's the data sharing which is worrying. Exactly which entities have access to what data gathered by `ampproject.org`?
379.
by gorhill 11y ago
This is what I get if I block `ampproject.org` (which -- given its purpose -- is meant to become ubiquitous): A blank page.[1] In reality, the speed gain (which is the advertised benefit of AMP) is just a matter of avoiding to pull all the
380.
by gorhill 11y ago
I personally choose to block ubiquitous 3rd parties by default[1], to fight both bloat AND privacy exposure. This AMP project reduces the bloat but at the cost of increased privacy exposure. If I globally block `ampproject.org` when visitin
381.
by gorhill 11y ago
Possibly because in reality the resources consumed while at rest (disk storage) are magnitude less important than the resources consumed while running (memory/CPU cycles).
382.
by gorhill 11y ago
> Ads help fund free services and content on the web. "free" is incorrect, "obfuscated costs to the users" is more accurate.
383.
by gorhill 11y ago
I could not find any entry in the FAQ about how this new way of delivering web pages will negatively affect users who have made the conscious choice to reduce their privacy exposure through the express blocking of undesirable 3rd parties. F
384.
by gorhill 11y ago
I also reported this on September 21st, after someone alerted me to this on Twitter.[1] To think that uBlock Origin itself was suspended from the store back in April because its icon resembled too much that of the other uBlock.[2] [1] htt
385.
by gorhill 11y ago
> I have set up this unofficial one that tracks the changes between each zip published on their releases page Nice, this makes it much easier to track changes. For those interested, here is a URL which can be used as a template to diff a
386.
by gorhill 11y ago
> I was under the impression that the local IP leak was an unintended side-effect of webRTC, not a 'required component' Same here. My understanding is that the breakage of Hangout is unintended, as the original Chromium issue f
387.
by gorhill 11y ago
> I wish they made that clear I agree, I opened an issue to address this: https://github.com/gorhill/uBlock/issues/773
388.
by gorhill 11y ago
Did you click the setting "Prevent WebRTC from leaking local IP addresses"? If so, this will prevent Hangout from working. Reference issue: https://github.com/gorhill/uBlock/issues/757
389.
by gorhill 11y ago
Whitelisting a site is just a matter of pressing the big blue button: it works on a per-site basis.
390.
by gorhill 11y ago
Because uBlock Origin ships with the default filter lists, so that it can work immediately out of the box without having to remotely fetch these filter lists at launch time (updated versions of these lists will be automatically fetched some

More ›