They can choose not to provide the service unless you pay.

They can also choose not to provide the service to unregistered users and give out free daily watches as a part of their marketing campaign. Then you enter a simple contract by opening an account and agreeing to their terms.

Terms which can include data collection, but it has to be possible to opt-out from it without losing access to the service.

I'm not familiar with tbh because the idea of working on ad software and SEO seem like the most boring possibly ethically dubious jobs.

Ideally, yes.

Every time you see a popup to approve cookies, it is explicitly so a company can beg you to allow them to track you for free money.

I don't think umatrix is actively maintained any more

https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

...oh, I see, I have to first go into the settings to declare myself an able-minded human. That's quite the UX failure, hiding functionality behind an unrelated toggle at an entirely different place.

Having finally found the correct mystical incantation, I can answer your question. At first glance, that UI is incredibly confusing. Why are there two two columns to the right of every domain? What's the difference between making the left column red and the right grey, versus making the right column red and the left grey? What is the significance of the +'s and -'s in the various cells? That help page doesn't explain any of it.

What's really missing: uMatrix lets me see how many resources of what type were loaded from what domain. That's very helpful when finding out what needs to be unblocked: if a site doesn't work, I progessively whitelist third-party resources until basic functionality is restored. I then remove everything from the writelist that's unused. It doesn't seem like that information is available.

Also: with UBO it doesn't seem possible to enable javascript for just one third-party host, or enable everything except javascript? If I whitelist a host in the UI, it automatically enables static resources (img, css), dynamic resources (js), cross-site data (xhr) and frames. I'm not going to write manual rules every time I want to allow everything except javascript.

This is just from a cursory examination, so maybe the functionality is there, it's just unfamiliarity with the new interface. But from what I'm seeing, neither the UI itself nor the help page make a compelling reason to make the switch.

>uMatrix lets me see how many resources of what type were loaded from that domain.

uBlock Origin > Logger (its an icon)

> enable javascript for just one third-party host

Red button (with more enabled) disables a specific resource in a nested-list UI very similar to uMatrix AFAIR.

Red button (with more enabled) disables a specific resource

I don't see it. Red button disables a specific domain for as far as I can see. It doesn't disable just one type of resource from that domain.

in a nested-list UI very similar to uMatrix

It seems this is the problem: uMatrix is most emphatically not a nested-list UI: it is an authorization matrix UI. It seems that UBO does try to incorporate some of uMatrix' features back into it, but in the basis it's still a one-dimensional blocklist. That's just not good enough for how I browse the web in safety.

Why are there two two columns to the right of every domain?

The left column is for global rules (independent of the currently-visited domain), the right column is for rules specific to the currently-loaded domain. This is strictly inferior to uMatrix, which allows me to set rules for every part of the dns name (e.g. I can easilty switch between settings rules for news.ycombinator.com, ycombinator.com and even for all .com sites). So what's missing: source domain control over the rule I'm currently setting.

What's more, in uMatrix I could set a hard block on a toplevel domain (say, google.com) and then add a whitelist for a subdomain (say, mail.google.com) which would override the higher-level block. Since UBO only uses block (red)/ignore (grey), this kind of setup is not possible. So what's missing: an explicit allow/ignore/block toggle like in uMatrix.

What is the significance of the +'s and -'s in the various cells?

These are blocked and allowed resources, so there's some level of feedback there. But it seems that CSS resources are not included in those statistics at all, and images do cause a + to be displayed in the domain-specific row but not in the generic "images" row whereas third-party javascript gets a + in the domain-specific row and in the generic "3rd-party scripts row". So what's missing: I want resource type indicators rather than generic "+"

I'll repeat what I wrote as a response to the sibling comment because it seems to be a fundamental UI problem: the UI of UBO still seems geared towards a one-dimensional blocklist and is missing all the controls for two-dimensional control of [domains]x[resource types]. And after years of safely browsing the modern web with uMatrix, I can't imagine going without that control.

-----

Turns out that youtube also has:

1) the dominant browser;

2) the same interests as, multiple partnerships with, and very little actual competition with the company that runs the next biggest browser in a walled garden, and

3) been completely funding the development of the browser that continually press releases as if youtube's aims are pure evil and that they are the only opposition.

If a website doesn’t support your usecase, that’s on you, there is no ADA requirement for JS-free websites

Privacy shouldn't only be afforded to the more technical users.

Yes! I would have much preferred the EU to make PSAs explaining how to disable cookies in browsers rather than inflicting popups on billions of users.

Yes. If you create regulations with the assumption that they will be followed exactly how you want them to be rather than considering how entities who don't share your goals will react, you are doing a bad job.

The GDPR disallows tracking without consent, but more in the spirit of “don’t track” than “get consent”. It also specifies that conditions should be clear, and that not granting consent (or withdrawing it) should be as simple as granting it. It even specifies that sites that request private information from kids should be clearer, because they need to understand what they’re accepting even if their guardians will provide the consent.

They're an entirely rational and predictable reaction to it. If you're trying to regulate bad actors, it should be utterly unsurprising when they game the easily gameable rules.

The GDPR disallows tracking without consent, but more in the spirit of “don’t track” than “get consent”.

Then it should actually ban tracking, without the loophole of "you can track as long as you get the user to click a button, also you can't offer them anything in exchange for doing so". That's just asking for all the dark patterns we've gotten.

The problem isn't that. The problem is that people are being convinced that malicious compliance is somehow the EU's fault. This is clearly the bad actors being bad; the thing that's being gamed isn't GDPR, but publicity around it. As in, the EU should probably invest some money in naming and shaming actors complying in bad faith (if at all).

Today, we are supposed to ignore the removal of choice as relevant.

We are supposed to ignore the billions of dollars Google pays to be the default search engine, where it is well-known that users do not actively select it.

We are supposed to ignore what happened to Facebook when Apple gave iOS users the choice to "Limit Ad Tracking" where previously they were given no such choice.

https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv...

Giving users meaningful choice is a threat to the so-called "tech" company business model. Obviously those working for such companies will not like the idea of having to obtain consent to engage in surveillance and data collection. Much of that surveillance and collection is accomplished using Javascript.

1. The risks posed by those applets from the early web versus the risks posed by Javascript today may be different. However, the later is no less threatening. The world's web users have lost an incredible quantum of privacy thanks to the "run all Javascript by default" feature of web browsers distributed by so-called "tech" companies. The surveillance potential enabled by running arbitrary Javascript from the web is enormous. The company that produces the browser and the JS engine is in fact an advertising company engaged in surveillance advertising services on a massive scale.

For example, I did not consent to this y18.svg file that this website has served to me. This is a non-consensual violation of my computational autonomy. Just to put a logo up? Horrific.

Wouldn't that depend on when YouTube starts the "three video" counter? A blanket ban on ad blockers may not violate the law, but their implementation may.

If the page need to load some SPA app, draw the canvas (accessing GPU), or WebUSB, etc, then ask for permission would be a good idea. Just like how accessing ones' camera and mic requires permission. It will force web developers to do less stuff in JS for just display. And if an app type of application is needed, then ask for permission.