Hacker News Reader

Comment by m463 | Hacker News Reader

there is SO much stuff that safari doesn't block.

Get firefox + umatrix and just see how much stuff goes on.

I recently had to give up on uMatrix. Not only is it a bit of a hassle, but things break in very bad ways. Where this is particularly problematic is with CAPTCHA (not a fan). I've been detected as a bot many times and it takes a bit to enable each little bit per detain (XHR, script, images, etc.), and by the time you enable all the right stuff, you may be locked out. The last straw was failing the CAPTCHA at Bill.com where I failed the CAPTCHA and was using a VPN and got my account banned and couldn't get paid for a contract. I'm also going to encourage people to not use their service as well, but this kinda thing happens far too often with uMatrix.

I don't remember reCAPTCHA needing more care than enabling everything minus cookies for gstatic.com.

Right, but until you know this, you'll run into issues if you try to enable each little box as needed. There's also some at google.com to enable. And this doesn't change the callbacks the site consuming reCAPTCHA might be using.

Using uBlock Origin in ‘medium’ mode (dynamic filtering turned on, static 3rd party resources like images and css allowed) achieves much of the same safety & privacy gains of uMatrix without sacrificing a ton of usability.

I think you might take the opposite viewpoint that you can relax the settings for umatrix, then fine-tune a particular site.

I just remembered I got banned from Gumtree for posting multiple times in a row because a script was blocked and wasn't giving me feedback about whether or not it was posted. As I enabled each script and tried resubmitting to get it to work, I was incrementing a counter to get banned. When I asked about it, they, like Bill.com, just pointed to the ToS saying they could terminate anyone for any reason and have no requirement to explain why or undo.

Firefox on Windows has the same problem with it's Enhanced Tracking Protection. I've just decided to disable it all together* and just use uBlock Origin and Privacy Badger.

* Actually, you can't just disable it. You have to select the "custom" preset and then disable all the "protections".

What's the problem with enhanced tracking protection?

It's a fraud. It's got an explicit whitelist of domains to allow, and those include both Google and Facebook.

Not quite. ETP blocks access to third-party storage from .doubleclick.net, .google.com, and any other source in the Disconnect.me list. You can easily verify this by visiting a site that runs Google's remarketing tags, and see the console messages and the missing "Cookie" headers from cross-site requests to these domains.

ETP doesn't block resource loads by default, unless they are known fingerprinting libraries or cryptomining sources. Only in Strict / Private Windows ETP mode is content actually being blocked, and in those cases most Google services won't work at all (as the domains have been blocklisted).

Facebook doesn't generally leverage third-party cookies anymore, as it uses the &fbclid parameter to enable first-party cross-site tracking. Thus ETP is somewhat weaponless against this behavior (except in Strict / Private Windows mode) because, as stated above, ETP doesn't block resource loads in default mode.

I use uBlock Origin, Privacy Badger and Firefox's tracking protections. I don't see why not all three.

There's actually a lot that Firefox blocks in strict mode. On iOS for example it works like a poor man's ad blocker as it breaks ad exchanges. And it blocks Google Analytics too.

Reply on news.ycombinator.com