News for hackers. Stuff that matters.
Re:Adblock Plus filter lists may execute arbitrary code in w... by magduf on Monday April 15, 2019 @12:12PM (#19666397)
There have been many good reasons to switch to uBlock Origin long before today's issue: speed, memory footprint, no "acceptable ads", etc. I don't know why anyone still uses ABP.
Re:Adblock Plus filter lists may execute arbitrary code in w... by angott on Monday April 15, 2019 @12:21PM (#19666488)
It's mostly a marketing issue in my opinion. ABP was the first ad-blocker to enter the mainstream market back during the Firefox days, and they had virtually no competition for half a decade, before the entire Acceptable Ads controversy. I think unfortunately there is still a significant number of users who just associate "AdBlock == AdBlock Plus".
Re:Adblock Plus filter lists may execute arbitrary code in w... by gorhill on Monday April 15, 2019 @12:43PM (#19666674)
> a significant number of users who just associate "AdBlock == AdBlock Plus"

AdBlock uses Adblock Plus filtering engine internally and also supports and enables "Acceptable Ads" by default:

> AdBlock is a popular ad blocking extension for Chrome, Opera and Safari, now based on the Adblock Plus code.[1]

* * *

[1] https://github.com/betafish-inc/adblock-releases

Re:Adblock Plus filter lists may execute arbitrary code in w... by angott on Monday April 15, 2019 @02:51PM (#19667807)
Oh, sorry, I was not referring to specifically that AdBlock extension. I wanted to say that users just associate "adblocking extension = AdBlock Plus".
Re:Adblock Plus filter lists may execute arbitrary code in w... by gorhill on Monday April 15, 2019 @03:21PM (#19668074)
Ah I see, never mind then; and in that case I do agree with your comment.
Re:Adblock Plus filter lists may execute arbitrary code in w... by shpx on Monday April 15, 2019 @09:17PM (#19670315)
Any chance you're going to get the uBlock name back? Explaining the story every time I tell someone to switch to uBlock Origin is annoying.
Re:Adblock Plus filter lists may execute arbitrary code in w... by brian_herman__ on Monday April 15, 2019 @03:39PM (#19668216)
Love ur work with origin
Re:Adblock Plus filter lists may execute arbitrary code in w... by ryanchoi on Monday April 15, 2019 @08:46PM (#19670153)
Agreed, in the same way all touchscreen smartphones were/are(?) called iPhones, or people calling all tissues Kleenexes in the US, I think for a huge fraction of laypersons, ABP has an understandably strong grasp on the product category.
Re:Adblock Plus filter lists may execute arbitrary code in w... by smacktoward on Monday April 15, 2019 @12:19PM (#19666468)
There were a lot of people telling others to use AdBlock Plus for a long time, and once a bit of advice like that gets lodged in the public consciousness, it's next to impossible to extract it. I still run into Windows users who still think they need to install WinZip to open ZIP files, for instance, even though Windows has come with ZIP handling built in to its file explorer ever since Windows XP.

This is why brands have immense value.

Re:Adblock Plus filter lists may execute arbitrary code in w... by behringer on Monday April 15, 2019 @01:19PM (#19666957)
Also antivirus is the same way. Windows AV is perfectly acceptable for many normal use cases, but people still think they need free AV alternatives like AVG.
Re:Adblock Plus filter lists may execute arbitrary code in w... by wingworks on Monday April 15, 2019 @09:28PM (#19670373)
Or horrible (in my opinion) paid solutions like McAfee...
Re:Adblock Plus filter lists may execute arbitrary code in w... by magduf on Tuesday April 16, 2019 @10:54AM (#19674142)
>Or horrible (in my opinion) paid solutions like McAfee...

It's not just your opinion. Mr. John McAfee himself, the guy who started the company and whose name it still bears, has publicly stated that McAfee software is "the worst software on the planet"!

If that isn't enough for people to avoid a brand name, then I don't know what is. But apparently, countless businesses are so clueless they keep using McAfee software even though its own founder says it's trash.

Re:Adblock Plus filter lists may execute arbitrary code in w... by GrinningFool on Monday April 15, 2019 @01:44PM (#19667157)
> Windows has come with ZIP handling built in to its file explorer ever since Windows XP.

Although it's been molasses-slow in comparison to 3rd party tools since that time as well.

Re:Adblock Plus filter lists may execute arbitrary code in w... by smacktoward on Monday April 15, 2019 @02:03PM (#19667346)
True, but it's Good Enough for most people, who only deal with ZIP files infrequently and generally only ever encounter relatively small ones.

When I talk to these folks and probe why they think they need WinZip, they never say "oh, I was trying to uncompress a 7GB file the other day in Explorer and it took forever." They say "I'm on Windows, and this is a Zip, therefore I need WinZip." They're usually genuinely surprised to find out that this is something Windows can do all by itself.

Re:Adblock Plus filter lists may execute arbitrary code in w... by angott on Monday April 15, 2019 @02:52PM (#19667826)
Does anybody know why this happens? I don't think MSFT would really have issues finding some software engineers to fix this.
Re:Adblock Plus filter lists may execute arbitrary code in w... by jraph on Monday April 15, 2019 @02:59PM (#19667895)
I guess this is the reason: https://devblogs.microsoft.com/oldnewthing/20180515-00/?p=98...

> Since its release in Windows XP, Zip folders has not been actively developed. The reason is the usual: Because adding features requires engineering resources, and engineering resources are limited. Furthermore, since the compression and decompression code weren’t written by anybody from Microsoft, there is no expertise in the code base, which means that debugging and making changes is a very difficult undertaking.

Re:Adblock Plus filter lists may execute arbitrary code in w... by code_duck on Monday April 15, 2019 @07:58PM (#19669930)
“Because adding features requires engineering resources, and engineering resources are limited.“

seems to translate to ‘because we really don’t care’. It’s not as if Microsoft is strapped for cash.

Re:Adblock Plus filter lists may execute arbitrary code in w... by metildaa on Monday April 15, 2019 @11:11PM (#19670830)
At least they haven't purged it, if this were Google then there would be no ZIP support in newer OS versions.

They even killed ChromeOS ans Chorme updates for a bunch of 3 to 4 year old Chromebooks recently, despite the hardware being fine to run newer ChromeOS.

Re:Adblock Plus filter lists may execute arbitrary code in w... by magduf on Tuesday April 16, 2019 @10:58AM (#19674181)
Why should they? Are they going to make more money if they fix it? Of course not; people aren't basing their usage of Windows on the performance of the built-in unzipper. Advanced users just install a 3rd-party tool, the clueless masses just use the built-in thing and wait and think it's normal. Companies like Microsoft don't care about building the best product they can; they only care about maximizing profits, so the solution that's "good enough" is what they go with. What they have works, poorly, and costs them nothing to maintain, so that's what they stick with.
Re:Adblock Plus filter lists may execute arbitrary code in w... by ebg13 on Monday April 15, 2019 @12:20PM (#19666482)
uBlock Origin for Safari has been abandoned for about a year. :\
Re:Adblock Plus filter lists may execute arbitrary code in w... by hombre_fatal on Monday April 15, 2019 @12:59PM (#19666820)
Safari's (Webkit's) content blockers are even better imo. Declarative rules that get compiled. Can't intercept arbitrary requests with Javascript logic but I don't think that's necessary. Though it makes something like uMatrix harder to implement.
Re:Adblock Plus filter lists may execute arbitrary code in w... by kevin_thibedeau on Monday April 15, 2019 @01:25PM (#19667011)
There's still a need for something like the element zapper which can remove obstructing popups that aren't implemented in Javascript.
Re:Adblock Plus filter lists may execute arbitrary code in w... by hombre_fatal on Monday April 15, 2019 @01:42PM (#19667138)
Though you can implement this with the content blocker API. You add a rule to the rule list and recompile it, though it does come at the expense of UX and flexibility for sure.
Re:Adblock Plus filter lists may execute arbitrary code in w... by stephenr on Monday April 15, 2019 @01:48PM (#19667197)
Which has been a part of Content Blockers since day 1.
Re:Adblock Plus filter lists may execute arbitrary code in w... by fredsir on Monday April 15, 2019 @03:22PM (#19668083)
I wish there was something like uMatrix for Safari but using content blockers. Would really scratch an itch for me.
Re:Adblock Plus filter lists may execute arbitrary code in w... by bad_user on Tuesday April 16, 2019 @12:53AM (#19671224)
Safari’d content blockers are next to useless.

Safari is really easy to beat by anti-ad-blocking technology, the only reason for why more publishers won’t do it is because they don’t want to piss off people, but as the minority of people using ad-blockers grows, they’ll get over that fear.

Also FYI injecting scripts in webpages is the only way to prevent anti-ad-blocking from working.

Re:Adblock Plus filter lists may execute arbitrary code in w... by ameshkov on Monday April 15, 2019 @01:31PM (#19667061)
Safari content blocking API is abandoned since 2015 when it was introduced. It simply does not allow using advanced blocking techniques which were developed by Chrome/FF blockers during these years.

It might be enough to handle most of the ads at the moment, but it fails miserably when a website uses any adblock circumvention.

Re:Adblock Plus filter lists may execute arbitrary code in w... by stephenr on Monday April 15, 2019 @01:47PM (#19667189)
How is it abandoned? Because the API doesn't change more often than I change my underwear? It works well, is efficient and ensures user privacy and safety (from the sort of issues being described in the article) and it gained new capabilities (forcing a HTTPS url) after launch.

As for your specific claim, 1Blocker has an entire section of blocking rules to counter anti-adblock.

Sure, if some site want's to be completely hostile to users, it may still show up. The little cross icon on the tab solves that issue pretty quickly.

Re:Adblock Plus filter lists may execute arbitrary code in w... by ameshkov on Monday April 15, 2019 @01:59PM (#19667304)
So you are telling me that not changing the API in years despite numerous requests is a good thing? Well, I disagree.

Regarding https, this change was made in 2015.

Re:Adblock Plus filter lists may execute arbitrary code in w... by bobthepanda on Monday April 15, 2019 @02:51PM (#19667815)
There's a wide spectrum between "abandoned" and "totally up to date." Not everything is black and white.
Re:Adblock Plus filter lists may execute arbitrary code in w... by stephenr on Monday April 15, 2019 @02:54PM (#19667852)
Well it all depends what the requests are, doesn’t it.

I’m sure some have requested the ability to run javascript, that doesn’t mean it’s a good idea to add that to the api.

Re:Adblock Plus filter lists may execute arbitrary code in w... by ameshkov on Monday April 15, 2019 @03:22PM (#19668079)
> Well it all depends what the requests are, doesn’t it.

Oh, there are all sorts of them.

From simple feature requests (like being able to distinguish fetch/xmlhttprequest) and bug reports (like that it considers requests to subdomains third-party) to something more complicated.

The problem is that regardless of what's requested/reported, there is no reaction.

> I’m sure some have requested the ability to run javascript, that doesn’t mean it’s a good idea to add that to the api.

Desktop Safari allows extensions to run javascript, why would anyone want to make it a part of the content blocking API.

Re:Adblock Plus filter lists may execute arbitrary code in w... by Nadya on Monday April 15, 2019 @04:46PM (#19668752)
>like that it considers requests to subdomains third-party)

As it should. Sometimes subdomains are third party. If I whitelist example.org I do not want any subdomains to be whitelisted without be explicitely whitelisting *.example.org as a wildcard or any specific subdomains.

Proof of concept: I constantly host what I could consider 3rd party resources on subdomains for clients. eg: billing.example.com where billing. isn't owned or operated by example.com and could be running who knows what in terms of Javascript and Ads that I may or may not trust without whitelisting billing.example.com. The most common of these are specific marketing/tracking forms that they wish to run through some third party marketing agency and not our in-house tracking systems.

Re:Adblock Plus filter lists may execute arbitrary code in w... by stephenr on Tuesday April 16, 2019 @01:31AM (#19671350)
Neither xhr nor subdomains sound like valid features/bugs. Just because they don’t agree with changes you want doesn’t mean it’s “abandoned”.

As for why someone would request JS - you’re the one who suggested chrome/ff blockers are “more advanced”. And yet here we are on a thread about arbitrary code execution.

Re:Adblock Plus filter lists may execute arbitrary code in w... by ameshkov on Tuesday April 16, 2019 @04:26AM (#19672025)
I don't think our discussion can come to any compromise. You seem to believe that not doing anything is a good thing, and the API is already ideal. I have a different opinion. Well, it's okay to have different opinions.
Re:Adblock Plus filter lists may execute arbitrary code in w... by stephenr on Tuesday April 16, 2019 @05:06AM (#19672179)
> You seem to believe that not doing anything is a good thing, and the API is already ideal

Not really. I've submitted a request for an enhancement myself (ability to auto-redirect to the canonical URL - to avoid the bullshit of AMP pages) but what you've suggested just don't seem like worthwhile or positive changes IMO.

My argument wasn't "zero change is good" my argument is that it doesn't need much change and a stable API is hardly "abandonment".

Re:Adblock Plus filter lists may execute arbitrary code in w... by hombre_fatal on Monday April 15, 2019 @01:38PM (#19667109)
At the same time, I merely will not use a website that is so hostile nor do I regularly encounter websites like that. uBlock Origin breaks in this way as well, and the only website I can even recall with this behavior was a shady movie-streaming site I was linked to.

What do you mean by abandoned? I use it and it works for me daily.

Re:Adblock Plus filter lists may execute arbitrary code in w... by ameshkov on Monday April 15, 2019 @01:47PM (#19667186)
Adblock circumvention is a technique when a website reinjects and encrypts the ads when it detects that they were blocked. Kinda like what Facebook does.

Most of the changes and improvements to modern ad blockers are to deal with this kind of ads. Not in Safari, though. Webkit devs did nothing to improve or extend the content blocking API. Not to say that it still imposes the ridiculous rules limitation - you can't have more than 50k rules in a list (while Easylist alone has more than 80k).

Re:Adblock Plus filter lists may execute arbitrary code in w... by hombre_fatal on Monday April 15, 2019 @01:58PM (#19667295)
I'm not sure what misunderstanding you think I have with regard to adblock circumvention.

I can appreciate that uBlock Origin wants to be a universal condom that works on every website for everyone, but I also don't think it's so damning if the content blocker API is sufficient for that. Yet uBlock Origin and its rule lists still fail at this task as well.

A website can do any number of annoying things that uBlock Origin cannot block including things that aren't even related to ads. I simply refuse to use such websites. In fact, I want to know that a website does these things rather than remain in blissful ignorance. I don't want to support such a website even with my viewership.

I've built content blockers. The rule limit is circumvented by simply bundling multiple rule lists.

Also, 80% of Easylist is crap anyways. The problem with Easylist and things like it is that they become append-only lists because nobody wants to go back and verify that rules still apply. Not to mention all the site-specific rules for sites you'll never visit because it was someone's random hobby horse. But you can absolutely encode Easylist across two content blocker extensions bundled in one app. But in doing so, you'll also realize how easy it is to prune so that it fits in one rule list, there are so many rules for garbage sites.

Re:Adblock Plus filter lists may execute arbitrary code in w... by ameshkov on Monday April 15, 2019 @02:36PM (#19667668)
> I can appreciate that uBlock Origin wants to be a universal condom that works on every website for everyone, but I also don't think it's so damning if the content blocker API is sufficient for that. Yet uBlock Origin and its rule lists still fail at this task as well.

I'd say it is sufficient for 90% of the websites at the moment.

My point is that this is not a constant value. Advertisers adapt and evolve, and content blockers need to do the same.

> A website can do any number of annoying things that uBlock Origin cannot block including things that aren't even related to ads. I simply refuse to use such websites. In fact, I want to know that a website does these things rather than remain in blissful ignorance. I don't want to support such a website even with my viewership.

This is indeed the best way to let site owners know that this approach is unacceptable. I wish everyone were doing the same.

> The rule limit is circumvented by simply bundling multiple rule lists.

Sure, but this is a workaround, quite an ugly one in fact.

> Also, 80% of Easylist is crap anyways

It does contain a lot of redundant rules, maybe 30% of it, but not 80% that's for sure. And what if I want to use more filter lists? The only thing I can do is use the multiple lists workaround. It is simply weird that nothing was done about this limitation in more than 3 years.

Re:Adblock Plus filter lists may execute arbitrary code in w... by hombre_fatal on Tuesday April 16, 2019 @02:22PM (#19675999)
I think the limitation is just the simplest trade-off.

For example, an unbounded rule list has unbounded serial compilation time.

A 50k rule list recompiles in a couple seconds on my laptop and quite some time on my iPhone, but multiple rule lists can be compiled in parallel.

I suppose your response to this would be that content blocker recompilation could be made parallel over a single list or made to support incremental recompilation.

And you're probably right. But note that even Chrome's proposed content blocker system has the same limitation. Perhaps it's not as straightforward as it seems and it's not just a result of neglect/abandonment.

I mainly responded because the language you used seemed more damning than necessary. But have you tried 1Blocker X[1] which is built on the content blocker API? It's hard to condemn the content blocking system too much when there's an app that utilizes it to such great effect.

You are right about Apple/Webkit moving slowly on community feedback and bug reports though. I suppose I'm used to the glacial pace of non-critical-path browser issues after my Firefox bug went three years without response until it was fixed after Quantum's release. You are probably more critical here than I am. At Amazon, anything sev3 to sev5 went into a heap so large it was a miracle if anyone opened it again.

[1]: https://itunes.apple.com/us/app/1blocker-x-adblock/id1365531...

Re:Adblock Plus filter lists may execute arbitrary code in w... by scarface74 on Monday April 15, 2019 @01:55PM (#19667261)
That’s an easy one to get around. 1Blocker X has 10 sets of rules.
Re:Adblock Plus filter lists may execute arbitrary code in w... by lostmsu on Monday April 15, 2019 @12:30PM (#19666572)
It is open source. You can probably make it work with a single git merge (judging from experience with uMatrix for Edge).
Re:Adblock Plus filter lists may execute arbitrary code in w... by dorgo on Monday April 15, 2019 @04:40PM (#19668715)
I use ublock in advanced mode ( broken web by default + white lists ). I have no experience with the non-expert mode and for this reason tend to recommend / install ABP to friends / family.

Somehow, my intuition is that ublock is too advanced/complex for non-tech-affine users.

Re:Adblock Plus filter lists may execute arbitrary code in w... by woodrowbarlow on Monday April 15, 2019 @05:38PM (#19669160)
i use ublock origin with default settings and the end-user browsing experience the same as ABP. click install and never touch it again.