Hacker News Reader

Comment by wtallis | Hacker News Reader

For a browser that seems to be built with security and privacy as top priorities, it seems to be missing some obvious features. How do you allow first-party scripts and cookies while still blocking third-party scripts and cookies? Does it support surrogate scripts like NoScript does, to deal with sites that actively try not to work when you block ads and tracking scripts? Where's the AdBlock-style blacklist?

View on HN

we have another project, adsuck ( https://opensource.conformal.com/wiki/adsuck ), that blocks ads via DNS proxying. it can be setup to proxy DNS requests for a single host, e.g. a laptop, or on a network perimeter, e.g. a firewall, and it works by using blacklists to map DNS requests for 'bad' sites to return a NXDOMAIN. this way the ad images and their associated js are never downloaded or executed. see http://rlwpx.free.fr/WPFF/hosts.htm for more info about the blacklists.

you're right to point out that there is not yet a way to separate 1st and 3rd party scripts, but the cookies are handled by the xxxterm.conf setting

cookie_policy = no3rdparty

there is no handling for surrogate scripts atm. i can say that i personally don't bother with sites that require advertisements for viewing but i can understand the desire to do so.

feel free to post feature requests or bugs at https://opensource.conformal.com/flyspray/index.php?project=... .

DNS blacklisting is useful and has its place, but I would expect a secure-by-default browser to not load any resources from domains outside the one in the requested URL (like lynx) and to provide a simple way to selectively whitelist external resources for that domain only (like the RequestPolicy Firefox extension). That's one important omission from your otherwise impressive list of features that will probably make me stick with Firefox + Vimperator + RequestPolicy.

A blanket ban on third-party cookies or third-party scripts is not enough. You need to be able to specify which third-party domains are trusted. There are lots of decent sites that need to be able to load assets from a different domain in order to be functional, but which also like to load Google Analytics, or set cookies from Omniture (2o7.net). These aren't ads, but are still things I'd like to block.

Many sites also break if you don't load GA, hence the need for surrogate scripts. If you dismiss and don't try to support the secure use of sites that exhibit any of the above behavior, then your browser doesn't have anything to offer users that care about privacy and security. Privacy doesn't have to be the antithesis of compatibility.

Reply on news.ycombinator.com