Hacker News Reader

Comment by TekMol | Hacker News Reader

This seems to be a blacklisting solution. Some third party code gets filtered.

I prefer a whitelisting solution. umatrix is a very elegant tool for this. You can say

    On domain thisandthat.com allow scripts from domain
    soandso.com'

   On domain funkycars.com allow images from
   domain carimageserver.com

That is exactly the level of whitelisting that feels logical to me.

https://addons.mozilla.org/en-US/firefox/addon/umatrix/

I wonder how closely Mozilla analyzes the addons they offer for download? Are they as trustworthy as Firefox itself?

View on HN

Whitelisting while keeping every website moderately functional seems impractical for the Mozilla team, which means the burden of choosing what to allow falls on the end user.

While that's a great approach for privacy, the usability loss would probably drive the average person away from Firefox. I think the listed approach is likely best for the average user, but I think it would be nice to have an option for a power user to turn on a whitelist-only mode. (One could argue that "install an extension" is an appropriate "option" for the power user, but as you mention, it's nicer to not need to rely on third party extensions)

> Whitelisting while keeping every website moderately functional seems impractical for the Mozilla team, which means the burden of choosing what to allow falls on the end user.

I've used NoScript for a long time, and the hardest thing is knowing what the domain is doing so I can decide what to allow. It's hard to tell the difference between opaquely named ad-networks and opaquely named media player providers.

It would be nice if someone could start compiling a database that

1. groups together the domains used by different sites and services (e.g. website.com and website-images.com) and

2. includes a brief description of their purpose or business.

So, doubleclick.com and doubleclick.net could be grouped and easily identified as an ad network, google tag manager is a tracker, etc.

I doubt such a list would take any more effort to maintain than the current ad-blocker lists.

Yeah, but for non-techies? As a fellow uMatrix user I love it, but normal people don't want to set up a whitelist for every site they visit and get broken websites without.

edit: Removed some nonsense I wrote in a hurry. Sorry.

Try some empathy

Well, ok. My comment was crap. Removed it.

I don't know or care what the comment said, but self-awareness/self-criticism like this is one of the main reasons I like reading HN. Thank you!

> I wonder how closely Mozilla analyzes the addons they offer for download? Are they as trustworthy as Firefox itself?

This has been a contentious discussion of late. Mozilla does manual (human) code review add-ons after they're submitted to AMO and made available for install, but they don't tell you which add-ons have been reviewed by a person and which haven't. It's apparently too costly and slow a process to review every submission, so much of this is automated, for better or worse.

Sophisticated users can download them and look at the code, as .xpi files are really just zip archives, but everyone else is on their own.

umatrix is a landmine of broken checkout and payment navigations for inexpert users.

And relatively expert users too. I adore uMatrix but sometimes open a specific browser just to make a purchase, then wipe all trace of it.

Reply on news.ycombinator.com