Hacker News Reader

Comment by alarmingfox | Hacker News Reader

I instantly install this extension whenever I work on a new machine as I could not imagine browsing the web without it.

For that reason I just went looking for a donate button to help fund the project and it turns out they don't even accept donations

https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...

View on HN

"Have a thought for the maintainers of the various lists. These lists are everything. This can't be emphasized enough."

So you can fund the project -- by donating to the lists it relies on.

While I agree on supporting the things you use. I don't think "the lists are everything". Quite the opposite, Its the blocking features. For me I like uBlocks disabling Javascript with an easy click and the other granularity (popups, multimedia) it allows on a site by site basis.

I'm thinking of it this way. A guy builds a flamethrower to burn away the creeping slime that threatens to overtake your house. Someone else then supplies the fuel. You want to donate, but the builder says no. "The fuel is everything."

That's pretty much correct from one perspective. The flamethrower is built, just needs a bit of maintenance now and then. But its everyday slime-burning power comes from the fuel.

The lists are more like an automatic targeting system for your world-saving flame thrower. Both are vital since the slime killed everyone who knew how to use it, so now you have to enlist average people who only use them to clear weeds and snow.

When your flamethrower needs to shoot hundreds of thousands of little slime balls all at once using tiny little blasts of flame I think that targeting system becomes pretty damn vital!

As a general life rule, not just for uBlock: help in the way you are asked to help.

Please explain how you are able to disable Javascript.

To disable javascript for specific site in uBlock Origin, click the extension icon, then click the "more" button in the menu several times until all options are displayed (you only have to do this step once total, not per site).

Once the 5 top menu icons are visible, click the one to the right that looks like </> to disable javascript for the site you're on.

Thanks, I did search through uBlock before asking.

how do you block popups?

It's hard to forget to install it. The first time you open a browser on a new machine and for a moment, for probably the first time in a while, see how the internet really looks, that's the best ad for uBlock Origin.

The internet with no adblock is a little like driving through Breezewood, Pennsylvania

https://imgur.com/a/qmAxHfk

A little. On the internet, the ads actively jump in front of our faces while we're trying to read something. Imagine driving under such conditions.

Be more like this virtual barrier in Sydney:

https://www.dailymail.co.uk/news/article-2325904/Water-stop-...

That's actually a pretty famous photo. You can right-click and see a much larger one. Must get that full-sized advertising goodness.

https://www.sothebys.com/en/auctions/ecatalogue/2017/postwar...

Famous and deceptive. It is a narrow angle shot, taken straight down the axis of very specific strip. Take an off axis, wide angle shot, and billboards disappear. I don't remember the details but photographic tricks like that played a large role in a trial opposing advertisers to people who considered billboard an eyesore. The former used wide angle shots while the latter used telephoto.

We saw a lot of tricks like that related to covid and social distancing. Heavily zoomed pictures of "crowded" beaches, streets, etc... where in reality, it is far less dense than the photo makes it look like.

Hilariously that won't even load for me on firefox w/ublock origin.

that picture only captures, like 5-10% of what you see as you pass through there.

I think it's always ridiculously represented as "hurr this is what America is!"

It has every chain business there because it's the intersection of major highways where there's no other meaningfully-sized rest stops around for hours.

Indeed, people outside the US (especially Europeans) don't really grasp the scale of the US interstate highway system. To paraphrase Douglas Adams, "The United States is big. You just won't believe how vastly, hugely, mind-bogglingly big it is. I mean, you may think it's a long way down the road to the chemist's, but that's just peanuts to space."

It's so big, that if you're driving long distances over the middle of the country you have to make sure you stop for fuel and food and a biology break whenever you get the chance, because there's no guarantee you're going to be able to find a place in flyover country.

Given that ads are a major vector of malware, it's more like raw dogging a prostitute.

What makes Breezewood unique is that you are forced off of a freeway to drive through that strip. Otherwise it looks like many other American roads.

I think the internet without Adblock is more like these heinous digital video billboards in Los Angeles that appear above the road, directly in the line of vision of drivers. Why these are legal is incomprehensible to me.

https://www.youtube.com/watch?v=i7ZeROERRrg

Why advertisements are legal at all is incomprehensible.

I can definitely understand his point. Some guy donates a dollar to your project and suddenly they act like you owe them the 80 hours required to implement their stupid enhancement request.

Just block them then ;)

We're two. It's so useful. I use it on those website who display the "accept all cookies", specially on those ones because I'm tired of denying cookie usage.

I still don't understand why Firefox, champion of privacy, doesn't make a uBlock native.

Blame government for not understanding unintended consequences when they pass laws regarding tech (GDPR)

The law says that agreeing or disagreeing should be equally easy. Companies are breaking that law.

Personally, I rarely come across a site that makes it harder to agree than disagree. I find both paths equally annoying.

We must not use the same internet. Agree is always one click for me, and there is generally no disagree button, but a "manage your privacy settings" button, that opens the biggest popups ever, slow as hell, when then even work,with thousand of button to click.

Examples are plentiful.

https://twitter.com/cookieshame

One interesting thing is that loads of sites use OneTrust to implement illegal banners. However OneTrust has a compliant banner on their own site.

So they can do it, but most sites deliberately configure it illegally.

It’s hard to know what a law says that requires you to read 11 chapters with 99 sections just to create a website.

https://gdpr-info.eu/

completely false, it's trivially possible to create a website without needing to involve GDPR at all.

Don't collect any information you don't actually have to, and if you do hold personal information, treat it basically like you'd want your own information treated, and you're basically good. It's really that simple.

The only people who think it's particularly hard or onerous are the people referenced by "It is difficult to get a man to understand something when his salary depends on his not understanding it."

I don’t deal with the clusterf%%% of modern front end development. I’m just tired of seeing cookie banners everywhere.

Did the law in anyway make my life better?

Obnoxious banners are not required under GDPR. In fact, unless denying consent is as easy as granting it, they're illegal.

It's not the law's fault that companies would rather implement such detrimental UX than either give up the teat of personal data or give people their rights.

It is, however, the fault of regulators for not stamping down on such behaviour when it is against both the letter and spirit of the law.

And, honestly, I consider the fact that so many websites are forced to admit that they are trying to take and sell my data to be positive.

Why do I care whose “fault” it is? Did government intervention make my life better or worse?

As Reagan said the most dangerous words in the English language “I’m from the government and I’m here to help”.

The great "mistake" of GDPR is that it has consent provisions at all.

After previous cookie banners, they really should've known better. (Or, let's be real, absolutely did know, but left it in for corporate interests anyway.)

How do you know what is needed for that without reading the GDPR?

if you don't collect personal data or analytics, you aren't covered by GDPR at all.

in the abstract sense of course everyone has to know all the laws of society - the law in its majestic equality forbids unsafe construction practices from builders and greengrocers alike - but that's not a particularly interesting or insightful observation.

I don't want to agree or disagree at all. I want my internet back pre-banners where I just get the content. The new internet is awful.

Personally I like the banners because they are an active reminder that that website is explicitly harvesting personal information.

Or, blame companies for throwing passive-aggressive shitfits that aim to mislead people. GDPR doesn't mean you have to have an intrusive confusing mess of a cookie banner, for example.

In fact, a confusing banner that makes you play a minigame to get the respect for your personal information that you have a legal right to (in the EU) is explicitly disallowed.

And if you don't want any banners, then don't collect any information you don't have to. If it's actually technically needed, you don't need consent. For example, Wikipedia has lots of cookies for things like UI elements and they don't need a banner.

That’s not really comforting to me as an end user forced to deal with punch the monkey cookie banners everywhere.

Indeed, having it repeatedly demonstrated that companies are willing to unapologetically break laws to attempt to trick me into permitting them to scrape up my personal data is not very comforting.

So maybe the government shouldn’t pass a law that it can’t or won’t enforce? See also “The War on $x” or “because terrorism”, “think of the children”.

CNIL, the French regulator, did just (last month) fine Google and Facebook 150 and 60 million euros, so there is some level of enforcement, but I agree it's not enough.

There are some big ones here: https://www.tessian.com/blog/biggest-gdpr-fines-2020. Ironically, that site also has a cookie banner that attempts to trick you into thinking that the highlighted button will save the default preferences shown (it won't, it'll turn them all in, then save that). This is illegal too.

> In fact, a confusing banner that makes you play a minigame to get the respect for your personal information that you have a legal right to (in the EU) is explicitly disallowed.

It is. So are the ones defaulting to "yes". And the ones where there is just a popup telling the user to install some blocker in their browser without giving them a choice (like https://npr.org ). Or telling them to take a subscription if they don't want to be tracked.

All these things are illegal but unfortunately they are not enforced.

The problem is that GDPR didn't go far enough.

They should have added a provision that if the user has Do Not Track turned on, the site may not present a cookie barrier and may not serve any cookies except essential ones. I know many browsers have removed DNT but they sure would bring it back in a heartbeat if it actually did anything.

This is what you get when corporate lobbying gets as big as it is in Brussels :(

Enforcing the rules for handful of "normal" websites that have illegal cookie banners would cause all the others to magically discover that it's actually not very hard to have to buttons next to each other with the same colour.

Brussels might have a corporate lobby problem, but they did create the regulations in the first place, so they're already ahead of a lot of national governments (which run the regulators).

So now you want the government making laws about how to design your website?

> I still don't understand why Firefox, champion of privacy, doesn't make a uBlock native.

That's the best technological solution but there are inherent conflicts of interest since Firefox depends on Google for money.

Not just that but due to their search for independence from Google they are increasingly relying on their own ads as well, like on the New Tabs screen :(

> I still don't understand why Firefox, champion of privacy, doesn't make a uBlock native.

Mozilla's "commitment" to privacy is all talk and no action.

Enabling Google as the default search engine, or the proprietary Pocket plugin, arguably isn’t innocent inaction. It’s actively anti-privacy action.

I don't think it is a good idea. Usually when things like that happen the project will become less and less effective, also once it is so ingrained it will be harder to switch to a new kid in town that is better.

Firefox has its own built in privacy mechanism that is enabled by default and don't prevent me to use uBlock together with it. I prefer that approach.

Just to make people aware who may not be, you can block a lot of cookie banners and other annoyances that are not blocked in uBlock Origin by default by enabling more specific filter lists in the extension options.

In the "filter lists" tab, I would recommended enabling the "Fanboy's Annoyance" list. It's a huge list that focuses on removing various annoying, recurring website components, and it's created by the maintainer of Easylist (uBlock Origin's primary filter list).

The downside, of course, is that this may in theory break some additional % of websites, but this has not been an issue in my experience.

I do that, especially those from onetrust

If a website fails to work if you don't click though the cookie banner, it's probably illegal in the EU. They cannot collect the covered data until you consent, but they also can't stop the website working if you don't. And if you didn't actively click the button, you can't have consented, and you definitely didn't consent if you deliberately hid the button.

I prefer DNS filtering over extensions as they generally want all permissions to essentially impersonate you at the browser level. Am I wrong?

Most ad services now swap their ad JS domains frequently, aggregate snippets (ads and functional) over a Tag Manager, or simply even proxy the ad scripts through the main domain, which a DNS filter cannot block reliably.

Wrong, no. It's a compromise. Addons have the ability to filter advertisements that cannot be identified by their domain name or ip. They also can take actions to compensate for website failure when ads are blocked.

You’re not necessarily wrong, however there are whole categories of ads and tracking that cannot be prevented by DNS blocking.

You're not wrong. We're all placing immense amounts of trust in uBlock Origin. I often say that the blockers should be fully integrated into the browsers themselves in order to solve the trust problem. It's sad that it can't happen due to conflicts of interest.

> the blockers should be fully integrated into the browsers themselves in order to solve the trust problem

s/solve/transfer

The browser owns the connection anyway and can do whatever it wants with the content. Of course trusting one party is better than having to trust two parties so we are back to do we trust the adblocker?

> Of course trusting one party is better than having to trust two

I wouldn't trust Google to block its own ads, it is much harder for them to intentionally fuck up a generic API that can be used by others without raising suspicion. Hence why everyone calls them out on the manifest v3 changes.

I also wouldn't trust Mozilla to invest the manpower to keep the plugin running and with them already including ads in the browser itself I would see another acceptable aids policy on the horizon.

For a job like this in specific I would rather trust someone whose goal is to provide a great internet experience over making money, I couldn't name a single browser vendor who would qualify.

I assume browsers are trustworthy user agents. If this is false, we've already lost.

If you use Chrome, you've already lost. I mean seriously what do you expect if you use a browser from the #1 targeted advertising provider in the world?

If you use Firefox, perhaps... They are becoming like the others in their quest to become a corporation. Driven by marketeers and telemetry, selling ads to get by, paying their C-suite millions of dollars...

So in effect, yes. Most people have already lost. The rest of us are on the way there.

Given that it's open source, we have the freedom to audit the code to make sure it's trustworthy.

Also, Mozilla has a vetting process it puts a popular subset of extensions through.

>Due to the curated nature of Recommended extensions, each extension undergoes a thorough technical security review to ensure it adheres to Mozilla’s add-on policies.

https://support.mozilla.org/en-US/kb/recommended-extensions-...

You can bet with every release of ublock origin that security people are all over looking at the code diffs for security issues. I don't have an issue with it. At some point you have to trust somebody. Otherwise just take wire cutters, walk outside your house, and cut the cable.

DNS is better, but I find that you need to have a dns server rather than modify/update the host files on router because it'd kill it.

Pihole is great, but you have to maintain a pi. It's not hard, but the other issue is also training and education when users/family is not on it.

In the end, subscription purchases for youtube, help because the ads are really horrible on mobile platform and not blockable easily on iphone.

I went all over the place with this comment, but I agree DNS level is better then browser level. The IP is still enumerated on a browser adblock level, but not on a DNS level.

> impersonate you at the browser level

This is a new framing for me...I don't think of ublock as impersonating me, but rather representing me, like an agent in a transaction. While it's true that agents that represent you need to be trusted, there is also a huge upside: ublock origin can do things that DNS blocking cannot. Given ublock's (gorhill's) track record, I think this is an excellent deal.

Gorhill's track record is the critical bit. He transferred maintenance responsibilities for ublock to someone who immediately exploited it to make money, which is why we now have ublock origin. In a world of 7.9 billion people, it is amazing that a decent internet experience depends so much on a single person being competent and honorable. He (and the block list folks) are the heroes that run into the virtual dumpster fire and pull us out.

Right; there's a reason we literally call the browser the "user agent", and uBlock is just a part of that. It's not impersonating me, it's a vital part of the browser being a useful tool for me.

The concept of a user agent is hilariously and sadly quaint on the modern web.

Can you imagine what a user agent to interact with Facebook would look like? Or Instagram? Or TikTok?

It shows how far we slid backwards for large, popular areas of user functionality, post-90s.

On the contrary; the browser is still generally the user's agent (although Chrome can be iffy) - we don't need to imagine, because we can compare the Facebook app to browsing Facebook in a browser, and see that the browser is still far more friendly to the user's interests than what FB ships.

It is, although both Chrome and Safari obviously have their own, non-user interests.

But browsers in 2022 are second class citizens, for business models that can generate positive ROI from developer time. They are at best dissuaded (e.g. Reddit, TikTok), and at worse actively crippled or prohibited.

The majority of users are on apps, and more users are moving to devices (e.g. Chromebooks, Portal). All of which are explicitly not user agents.

> I prefer DNS filtering over extensions

DNS filtering is weak and there are numerous bypasses [0], including ones you can never fix at the DNS layer [1]

[0] Ex: https://news.ycombinator.com/item?id=30412070

[1] https://news.ycombinator.com/item?id=30411049

I have extensions turned off in private browsing and then use this mode for banking etc.

DNS filtering sucks and can't filter ads served from the same domain as content, if all you can block is a FQDN, there's an absolute shit ton of trackers and ads that are getting past you.

This is why piholes are awful. I don't know why they get such high praise - it's just a crappy DNS filter that blocks like what 40% of the ads you see?

Pihole is contributes to a defense in depth strategy. Lots of android games are unplayable when I'm connected to the internet unless I'm on a network protected by pihole. Yes, I can run a firewall on my phone, but maintaining firewalls on every device that my family uses?

Solution: don’t play games or use any app where the business model isn’t “I give you money and you give me goods and services”.

I have one ad supported app on my phone - the Overcast podcast player. That’s only because the author created his own non scummy ad network and I find ads on the podcast player that advertise other podcasts useful.

If I didn’t, I would pay him too to get rid of ads.

That only works when they're willing to take your money and willing to then not show you ads or track you. Lots of places won't take your money and only do ads, and an upsetting number are happy to take your money and then track you and/or show you ads anyways. (My "favorite" so far is Hulu, who has the audacity to call their paid plan "no ads" and then include ads.)

Then don’t use those services or buy those products?

When I did buy Windows PCs, I either bought from the business division of Dell or the Microsoft store specifically because they weren’t bundled with adware.

That's great. I'm glad you have balanced out your morality and online browsing. We will all sleep easier tonight.

It’s not about morality, its about my preferring not to be bombarded with ads.

Defense in depth.

On my Android I have Netguard[0] configured with a hosts file, Firefox with uBlock Origin and NextDNS with comprehensive blocklists.

uBlock Origin protects only one app — the browser.

[0]: https://github.com/M66B/NetGuard/releases/

PiHole is not awful. It greatly enhances the blocking provided by browser plugins. Most valuably, it blocks an enormous amount of ads in non-browser apps. If I'm using e.g. the BBC app on my phone, PiHole blocks most of the ads (or at least it used to; I haven't checked recently). It also blocks ads in smart TVs and other places where you can't install uBlock.

it doesn't enhance anything a browser plugin does -it's a redundancy.

yes, it can block SOME ads in apps. it's also really good at breaking access to said apps too, then you must spend a great deal troublehsooting apps one at a time.

IMHO - ublock on the browser, pay for apps that have adfree versions, don't use apps that don't, and pirate the rest.

I thought part of the point is that 40% or whatever never gets sent to your device in the first place - speeding up requests, reducing usage. Those seem like good things.

And, it's 40% that don't show up even on devices and browsers where you can't install uBlock.

pi hole is great and is just another layer.

pi hole is as great as those blocklist filters people used to add into Torrent clients or using tools like PeerBlock.

It's just so faulty and pointless.

Pero ¿por qué no los dos?

Its better to do both - layered approach. And if you wanna be extra see my other comment on this thread :-)

The advantage of DNS is of course that it will generally also work on things other than your browser which is a pretty huge win.

> I don't want the project to become in need of funding in any way: no dedicated home page + no forum = no cost = no need for funding. I want to be free to move onto something else if ever I get tired working on these projects (no donations = no expectations).

This resonates with me. I'm thinking about spinning up a new open source project, and I really want it to be default-alive. I know that I don't have infinite time and attention for it... I want it to be able to live without constant feeding.

I do think that donations will be part of the picture though. Similar to uBlock, the project will have some dependencies on upstream data providers. I would love to generate revenue and pass it to those upstream providers to support the broader ecosystem.

the day is coming - between changing how 3rd party cookies work, how ads are served from the same domain as content itself, to the intended feature-creep of Trusted Computer.. that ublock origin, pihole (which is already a piss poor solution), and other tools are going to be rendered useless.

It's a great tool. But it's days are numbered. A couple more years and mark my words, things like ublock, will be defeated.

If you think that's going to happen, you definitely have never worked with an advertiser or agency.

Most would rather die than trust the content provider with reporting their own statistics.

Good luck with that. ISPs, DMCA people, etc have been saying that for 30 years.

- ublock origin

- vim c

- user agent switcher

are the big three for me.

Reply on news.ycombinator.com