Hacker News Reader

Comment by TekMol | Hacker News Reader

I found that for me a whitelist makes more sense then a blacklist.

I use umatrix with these two default rules:

    * * * block
    * 1st-party * allow

So by default a site can load whatever it wants from its own domain and nothing from 3rd party domains.

Then I add rules as needed. The Umatrix interface makes this super easy.

View on HN

Can you teach me this skill? I usually don't mind steep learning curves and taking a while to familiarize myself with a piece of technology if I believe that I'll end up benefiting from it (I type in dvorak, use a tiling window manager, I'm a shell power user etc...) but try as I might I just can't wrap my head around umatrix.

I understand what it does, I just don't understand how to use it effectively. Like I just tried it: I enabled uMatrix and went on the website of the NY Times. I end up with a rather large matrix with a bunch of domains like "a.nytimes.com", "api.nytimes.com", "samizdat-graphql.nytimes.com", "optimizely.com", "js-sec.indexwww.com" and many others, includind a bunch of google and amazon domains.

How am I supposed to figure out what I should whitelist in there? Trial and error?

There are a few obvious candidates for blacklisting (amazon-adsystem.com for instance) but I'm sure that those would already be blocked by my uBlock filters. Actually so far uBlock with a few ad + privacy enhancing filters seem to do a decent job which makes uMatrix even more frustrating because I feel like I'm doing something by hand that uBlock does just fine automatically.

But at the same time I often see people praise uMatrix here on HN and that makes me feel inadequate and noobish so I really want to understand what I'm not understanding.

Not sure if you know, but you don't need uMatrix when using uBlock Origin - it has build in the same functionality. You just need to tell uBlock that you're advanced user by checking option in settings.

What TekMol is using sounds like Hard Mode. Personally, I chose Medium Mode (blocking only 3rd-party scripts) as there isn't much difference between them. [1]

[1]: https://github.com/gorhill/uBlock/wiki/Blocking-mode

Thank you for posting that, I had no idea it existed. I've been running both but this looks like something I could get used to.

Generally, if the website breaks it's "scripts" from somewhere, or rarely xhr. When it's frames, it looks like a chunk of the site is missing. If media won't load it is media. And basically never allow anything from a dark red square.

I'd check umatrix's site and there are a number of presets to make major sites work you can use. After that, if a site doesn't work fiddle with allowing things from places. Save when you're content. It's pretty easy to get the hang of.

I don't run uBlock. Only umatrix. So my situation is different then yours. As I said, I don't blacklist specific hosts. I blacklist everything. And then whitelist specific hosts.

I'm asking about the whitelisting process: when something breaks how do you figure out what you have to whitelist? Many websites load dozens of external resources, how do you figure out what does what?

I usually hit the right one on the first or second try. The hostname usually tells you what it does.

Say the images of users on github.com are broken. I open umatrix and think 'Hmm.. which host could they load them from?'. I enable 'githubusercontent.com' and voila! The user images appear.

Ok, thank you all for your replies, I'm going to give it a try.

Nothing else than the name to go by really.

Domains that include "assets", "cdn", "static" and similar will probably be needed, at least if you want scripts to run and css to be included.

Anything with "ad" in the name you should probably not enable.

Other than that, basically trial and error. After a while it'll hopefully be easier to tell, but it will still be somewhat tedious each time you encounter a new site.

uMatrix's gui is incomprehensible to me. I stick with noscript and ublock origin. It may be a pain but I understand how to use it.

Except most sites use a CDN to serve static content, so this will block a lot of files

And it's "its own domain"

When you add Decentraleyes and add its ruleset to uMatrix, a lot of things start working.

Context: Decentraleyes is an extension that bundles a lot of those CDN-served JS frameworks and serves the locally stored version when it intercepts a matching HTTP request to fetch from those CDNs.

I've had that installed for about a week now and the counter is still stuck at zero...

If you're using a Chromium based browser it might be an issue with the 'HTTPS Everywhere' extension: https://git.synz.io/Synzvato/decentraleyes/wikis/Frequently-...

Basically, another extension can intercept the request before Decentraleyes can get to it. "The race is always won by the most recently installed extension."

To fix: https://decentraleyes.org/configure-https-everywhere/

Yes, but as I said, it's very easy to add those via umatrix. And you only have to do it the first time you visit a new site.

Example: You go to meetup.com for the first time. You click on the umatrix icon. You click on meetupstatic.com. You click on the save symbol. Done.

This works but it becomes a grind, especially on sites that fail in subtle ways until you realize why they are broken. And clicking in the matrix is kind of finicky, which the magic spots for subdomain vs domain.

There's a lot of room for streamlining the UI for enabling resources.

This is what I've been doing but with noscript since I consider JS to be the number one delivery method of browser based exploits.

Side effect is that it also blocks most ads.

Reply on news.ycombinator.com