Hacker News Reader

Comment by gorhill | Hacker News Reader

In the paper, this excerpt:

> We choose Adblock as it is one of the most popular. It is also possible to use Adblock Plus or uBlock, as the way they operate is exactly the same — HTTP filters and HTML element hiding.

AdBlock in the Chrome store uses Adblock Plus filtering engine[1], so to say the way these two "operate is exactly the same" makes sense.

However uBlock Origin uses its own code base, and is far better equipped than AdBlock/Adblock Plus to deal with anti-blockers, so to say that the way uBO operates is "exactly the same" is a stretch.

* * *

[1] Since version 3.0: https://help.getadblock.com/support/discussions/topics/60000... -- it's not explicitly stated in the announcement but this code repo mirror shows it: https://github.com/kzar/watchadblock/blob/c5f5b7f535182d6774...

View on HN

TIL that the author of uBlock Origin reads HN.

Cool!

And thank you for your service to the Internet!

They all suck. Period.

Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls.

Ad parties don't sit still, they don't keep their ads on the same url when they found out they are blocked or maybe already preventive rotate through new urls etc.

In the end you'll end up with some bizar long list which has to be checked for every url you visit etc etc. This will be a performance hog, and if you cant imagine that, then your list isn't long enough yet.

Use proper egress filtering, allow what you know, and don't allow what you don't know, not just what some 3rd party put on a list.

My advice for you in 2018.

For ""Block by default" is a usability nightmare."

yes it is for a week or 2, but I prefer usability nightmare then a safety nightmare.

> They all suck. Period. Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls.

uBlock Origin allows you to block yourself any outgoing connection to servers you do not trust, including working in default-deny mode if you want[1].

In any case, those filter lists are maintained by dedicated volunteers[2], their work is way under-appreciated, because contrary to what you state, these volunteers spend a whole lot of time ensuring everything work as expected so that in the end all non-technical users who wouldn't be able to deal with default-deny mode can also be protected.

* * *

[1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

[2] https://github.com/easylist/easylist/commits/master https://github.com/uBlockOrigin/uAssets/commits/master

Way too negative.

I have been using uBlock Origin for years and it's one of those things that just works. Turning it off in those rare moments it needs to be off is a bleak reminder of the state of the internet. Why would I want to go through the hassle of managing all of this work by myself?

A massive THANK YOU to the individuals behind uBlock - You literally make the internet tolerable for me.

I don't know why you call it negative, I call it realistic.

It's like putting all _caught_ pedofiles in a jail, and then saying children can roam the streets free and in safety...

> I don't know why you call it negative, I call it realistic.

Negativity usually bills itself as realism, but that doesn't make it so.

It might be realistic to whitelist egress on a production server, but certainly not at my mother’s house.

It might be realistic for you, or me or anyone in here, but it definitely isn't realistic for the average user. And it's them we try to protect by blocking ads. Technical savvy people have an armada of options at their disposal, for example we could just block JavaScript. But the average Joe relies heavily on ad blockers for a smoother and safer experience browsing the web. You can't expect non technical users to do any of the things you propose.

You're arguing against yourself. They do put all caught pedophiles in jail, and it's extremely safe for children to roam the streets from a pedophile point of view (but very risky from a car accident point of view).

> Block any outgoing connection you don't trust instead of simply taking some 3rd party list with URLs, unverified, no quality control etc, and only blacklist these KNOWN bad urls.

Right, and how is that supposed to happen in practice? Manually inspect every CDN domain loaded on every page that you visit? Or just live without scripts, images, fonts, video?

> Manually inspect every CDN domain loaded on every page that you visit?

Basically, yes, see uMatrix. It's not for non-web-devs, I feel, but if you can easily recognize unnecessary connections it works pretty well.

> It's not for non-web-devs, I feel

I don't know. I'm not a web dev (x), and I went from "dafuq?" to "I get it, this is so cool" in two minutes flat. Let's just say it sure helps if you're a technical person, not j. random user.

(x) but engineer/CS, tbh

edit: remove accidental markup

I'm a trade qualified welder and metal fabricator and even I understand uMatrix. It's not rocket surgery.

> It's not rocket surgery.

Certainly, it just can take more time to sift through the list of tens of domains and deciding to allow or ban each connection if you don't already know which connections tend to be needed and which are not.

Still, it's perfectly doable for anyone if you experiment a little, and it's done once per site, so the time needed for this shouldn't be an issue. It's just that people working with this stuff will have an easier time using uMatrix - which is what I really meant in my comment above :)

Same here, and I’m not an engineer or CS. uMatrix is IMO something a bright child could work out through trial and error.

Am bright child, can confirm.

(Just kidding, I'm actually a foolish middle-aged man. But I'm talking about my inner bright child.)

if you can easily recognize unnecessary connections it works pretty well

I find recognizing unnecessary connections to be the painful part.

I'll trust the block lists from my internet neighbors. Thank you for your concern but the people who build those lists take sufficient care and most use a transparent process to add rules to them, like GitHub pull requests, and if there's ever a rule that wrongly blocks a site I can whitelist it myself with ease.

They might burn some CPU cycles but surely the ads themselves burn much more.

"Block by default" is a usability nightmare.

Little snitch! (OSX) https://www.obdev.at/products/littlesnitch/index.html

no i don't work for or get paid in anyway by little snitch, i just love the product.

You beat me to it, but I was going to mention LS too.

Imaging you start off with Safari being unable to connect to anything. Little Snitch is running in Alert Mode and it asks you to decide on every outbound network connection. You visit Facebook. LS asks if Safari can talk to facebook.com on port 443. You say "yes, always". What about "server893.ads.facebook.com:443"? You say "make that .ads.facebook.com and block it forever". Do this through the few dozen prompts you'll get on this first visit when you visit a resource-heavy domain. Now hit reload and pick up a few more (like maybe this time you'll get a connection to a video CDN that you didn't see last time). Repeat until the requests taper off to nothing.

Now put Little Snitch into "Silent Deny" mode and enjoy your Safari that can only view ad-free Facebook.

Note: I don't really recommend doing this because I'd rather be doing almost literally anything else, but if I had to set up a social media kiosk for a relative, that's how I'd go about it.

I do highly enjoy telling Little Snitch to deny connections to all the non-port-80/443 ad trackers. I can't imagine a single legitimate reason why I'd want Safari to connect to moatads.com:843.

What would you recommend for mobile? Browsing on Android with Chrome is a nightmare, and the last time I tried FF it was a bit sluggish (although it did allowed me to install extensions!)

Firefox for Android is wonderful after Quantum. uBlock Origin works fine with it, and you can even use the custom filters to purge the scourge of the so called "dickbars" from your browsing experience. It's not as streamlined to use as with a mouse, but never having to see those Medium banners again makes my Internet life so much better.

"dickbars:"

https://twitter.com/gruber/status/874304779622785024

Though Firefox on Android has improved a lot with the recent quantum update, you can still feel it's a little laggy as compared to Chrome.

Specifically, scrolling on Firefox feels very laggy. Also, Firefox doesn't play videos on same tab. That becomes very frustrating.

Are you sure you're using Quantum? Quantum isn't in Firefox 57 for mobile, you need the beta 58 for Quantum.

Huh, I didn't know this. I felt Firefox 56 -> 57 was a major improvement in Android too, and was sure this was due to Quantum. I wonder now if that was just placebo.

It wasn't just placebo, some parts of Quantum made it in to 57 mobile, just not everything.

On mobile Android I mainly use Firefox equipped with ublock origin in order to save battery, bandwidth and boost performance.

- This helps with all types of ads for many news and reading,

- the big benefit is: opening all youtube videos on Firefox with ublock origin in order to get rid of youtube ads -

Have you tried Firefox focus[0]. I use it on a daily basis and I am quite happy with it.

[0]https://www.mozilla.org/en-US/firefox/mobile/

Firefox is a LOT better since the Quantum update. Like, actually usable compared to Chrome.

A lot of websites will still look weird but still a million times better when you don't have popup windows poking your eye, also reading mode is a god send.

Brave! Chrome engine, built in Adblock, some interesting ideas about paying content creators

I've tried countless browsers on Android, as well as various adblocking plugins and services. I always found myself going back to Chrome because it just worked.

I started using Brave about a year ago and I love it. The only thing I'm missing is syncing my bookmarks between Brave on my phone and Chrome on my computer, but a year later and it hasn't bothered me enough to find a fix.

Why not try Brave for desktop? Note: I am not a Brave user, genuinely curious about your experience!

I tried Brave on desktop but UI is a bit rough for me and lacking configurability. But it does improve every time I check

Take a look at Blockada.

https://github.com/blokadaorg/blokada

Firefox for Android has built-in tracking protection, which also boosts performance. You can enable it in the privacy preferences.

Firefox of course! I've been using it since the day it came out on Android. It means less phoning home to Google, and you can install Privacy Badger. Works for me like on the desktop.

Not exactly an adblocker, but on your local network you could use pi-hole.

I've been running a pi-hole vm for a very long time now. It's awesome not having a ton of ads on mobile devices.

Lightning with blocked 3rd party cookies and no Javascript. Wonderfully fast.

Brave browser. I switched from Firefox a few months ago and I love it.

Reply on news.ycombinator.com