News for hackers. Stuff that matters.
Re:Hundreds of web firms record 'every keystroke' by KozmoNau7 on Wednesday November 29, 2017 @08:08AM (#15806453)
This is why it is absolutely mandatory that any browser I use has Privacy Badger and uBlock Origin in dynamic mode with all 3rd party scripts and 3rd party frames blocked by default, in addition to the static block lists.

Dynamic mode is the somewhat hidden feature that makes uBlock Origin as powerful as NoScript, and more flexible when it comes to differentiating between whether to allow content from a domain globally, or only on specific sites.

https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...

Highly recommended.

Re:Hundreds of web firms record 'every keystroke' by tombrossman on Wednesday November 29, 2017 @08:30AM (#15806557)
Long time NoScript user here, and I had to remove it today as it is completely broken and unusable. I cannot even get the preferences to open so I can export my whitelisted domains to uMatrix, which I'm testing as a replacement.

I would like to combine uBlock and uMatrix, but I'm not sure I can replicate the functionality I want. Your mention of dynamic filtering is interesting and I wonder if others are using it and can make a recommendation?

I need all JavaScript off by default (including first-party) and the ability to block both ad-serving domains and filters such as /ads/ that work across all domains. Is this possible to do entirely within uBlock Origin?

Re:Hundreds of web firms record 'every keystroke' by dvddgld on Wednesday November 29, 2017 @10:28AM (#15807489)
I used to use NoScript and am now more than happy with uBlock Origin in medium mode. The developer of uBlock Origin and uMatrix actually recommends against using them together now (for most people).

See https://www.reddit.com/r/firefox/comments/706xrr/umatrix_vs_...

Re:Hundreds of web firms record 'every keystroke' by joveian on Wednesday November 29, 2017 @03:12PM (#15810401)
It depends on how much work you want to do... I change umatrix defaults to not allow any javascript, which breaks a lot of things (usually images :/). I also don't load anything from third party sites by default, which also breaks images and often css (many sites I usually just read the text with broken css). For this uMatrix is great and I wouldn't use uBlock Origin at all except that uMatrix has no option to not load fonts and I also have Firefox configured to just use DejaVu 16pt on all sites (which makes the web so much nicer, although also breaks a few things), but this doesn't prevent it from loading fonts for some reason (at least last I checked). I guess because some sites use icon fonts and maybe Firefox can't tell the difference until it gets the file.
Re:Hundreds of web firms record 'every keystroke' by dvddgld on Thursday November 30, 2017 @02:37AM (#15814060)
So which part of this isn't possibly with only uBlock Origin?
Re:Hundreds of web firms record 'every keystroke' by joveian on Thursday November 30, 2017 @01:45PM (#15818329)
Blocking font loading. I'm not sure where fonts show up in uMatrix and there is at least not a specific fonts category, which is what I want.
Re:Hundreds of web firms record 'every keystroke' by KozmoNau7 on Friday December 01, 2017 @03:10AM (#15822637)
I block all fonts by default ("no-remote-fonts: * true" in "My Rules"), and selectively re-enable them on sites that I trust to use fonts responsibly.

This will block all externally loaded fonts, only system fonts will be used.

Re:Hundreds of web firms record 'every keystroke' by joveian on Saturday December 02, 2017 @02:44PM (#15833620)
I looked an only saw references to that in uBlock Origin, then realized I read the question wrong :/. As far as I know it is possible to do everything I want in uBlock Origin (I do the same with fonts), however the interface is less convenient than uMatrix, even with the advanced extra panel. It would work if uMatrix ever goes away, but I'd rather use uMatrix while I can. I tend to leave changes as temporary only when I can unless I am visiting a site frequently, so I end up having to redo many permissions and even a small increase in convenience is nice.
Re:Hundreds of web firms record 'every keystroke' by dvddgld on Saturday December 02, 2017 @06:16PM (#15834836)
Gotcha, that's fair enough!
Re:Hundreds of web firms record 'every keystroke' by beckler on Wednesday November 29, 2017 @08:58AM (#15806766)
Looking at the uBlock dynamic filtering, it looks very similar to uMatrix. To block all scripts in uBlock, you'd probably want to block inline scripts, 1st party scripts, and 3rd party scripts with global rules which is possible with dynamic filtering.

However, if you're using chrome, you should have the ability to disable it from the browser altogether.

Re:Hundreds of web firms record 'every keystroke' by tombrossman on Wednesday November 29, 2017 @09:09AM (#15806862)
I'm using Firefox and I need an easy way to toggle JS on for specific domains, which NoScript used to allow and uMatrix does, but I think I'll have to do some further experimentation and get used to the new add-on.
Re:Hundreds of web firms record 'every keystroke' by beckler on Wednesday November 29, 2017 @11:44AM (#15808219)
You can set global rules and individual exceptions based on domain.

Read more about it here: https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...

Re:Hundreds of web firms record 'every keystroke' by thisacctforreal on Thursday November 30, 2017 @02:15AM (#15813997)
It's kind of hidden, but if you select the wildcard in the top-left domain list of uMatrix, you can disable classes of requests by default. eg Cookies, XHRs, iframes, then whitelist them per-site.
Re:Hundreds of web firms record 'every keystroke' by dhimes on Wednesday November 29, 2017 @10:19AM (#15807405)
Did you change browsers or something? Noscript seems to still work fine for me. Linux Firefox 56.0 (64-bit)
Re:Hundreds of web firms record 'every keystroke' by tombrossman on Wednesday November 29, 2017 @11:25AM (#15808009)
No, I'm using Firefox 57 (sure you are still on 56? 57 should be in the repos) and after a shaky start with NoScript 10, whatever the latest update did has badly broken the extension for many users. I am hopeful it will be as good as it used to be some day but today it really is badly broken and unusable. See the reviews from the last 24 hours, it's a mess: https://addons.mozilla.org/en-US/firefox/addon/noscript/revi...
Re:Hundreds of web firms record 'every keystroke' by dhimes on Wednesday November 29, 2017 @11:43AM (#15808214)
yeah- 56. double-checked. But linux mint- they try to not break things :)
Re:Hundreds of web firms record 'every keystroke' by arkh on Wednesday November 29, 2017 @10:29AM (#15807494)
There was a huge change with Firefox 57.

It is getting back to usable but it still lacks ABE and some other tools.

Re:Hundreds of web firms record 'every keystroke' by Daycrawler on Wednesday November 29, 2017 @10:28AM (#15807482)
Firefox 57 was release a couple weeks ago and breaks most extension by dropping the legacy add-on system.
Re:Hundreds of web firms record 'every keystroke' by tombrossman on Wednesday November 29, 2017 @11:29AM (#15808054)
For the avoidance of doubt, NoScript version 10 shipped a few days after FF57 was released, and it is an update to that combination which is not working for me. I uninstalled & reinstalled the extension, and clicking on the settings icon instantly crashes the browser. It is totally unusable for me.
Re:Hundreds of web firms record 'every keystroke' by dhimes on Wednesday November 29, 2017 @10:36AM (#15807558)
I was hoping that was not case. I was hoping something like Safari on a Mac Pro.
Re:Hundreds of web firms record 'every keystroke' by Zekio on Wednesday November 29, 2017 @08:58AM (#15806769)
uBlock and uMatrix are designed to work together :)

and yes you can disable ALL javascript with uBlock :)

Re:Hundreds of web firms record 'every keystroke' by casca on Wednesday November 29, 2017 @08:30AM (#15806560)
Also highly recommended for people who are willing to spend a little more time to control where their browser retrieves content is uMatrix[1]. Written and maintained by the most esteemed Raymond Hill who creates uBlock Origin.

If you're on Chrome, don't forget to also install uBO-Extra[2] along with uBlock Origin[2], otherwise you don't get WebSocket coverage.

[1] https://github.com/gorhill/uMatrix [2] https://github.com/gorhill/uBO-Extra

Re:Hundreds of web firms record 'every keystroke' by blockoperation on Wednesday November 29, 2017 @12:23PM (#15808716)
Actually, Chromium (and uBO) has supported blocking WebSockets via webRequest for a while now[1], despite the desperate protests of a MindGeek employee[2].

[1] https://chromium.googlesource.com/chromium/src/+/0f198df6bc8... [2] https://bugs.chromium.org/p/chromium/issues/detail?id=129353...

Re:Hundreds of web firms record 'every keystroke' by KozmoNau7 on Wednesday November 29, 2017 @12:56PM (#15809095)
Still, installing uBO-Extra is a damn good idea. If nothing else than to block insidious methods such as Instart Logic and WebRTC abuse: https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...
Re:Hundreds of web firms record 'every keystroke' by jasonkostempski on Wednesday November 29, 2017 @10:05AM (#15807282)
All this time I assumed 3rd-party frames were blocked by default in uBlock Origin. I never even noticed the line in the Dynamic mode UI :/