Hacker News Reader

Comment by Timshel | Hacker News Reader

The switch from full acces to white-listing for full blocking is just awesome imo.

You can just decide for each case the tradeoff between advanced blocking and security.

That tradeoff is already possible with the normal uBlock Origin; it just has a different (preferable IMO) default.

The only apparent upside to this version is if you don't trust Raymond Hill to refrain from spying on your browsing sessions via his add-on. By every other metric this seems like a downgrade.

If you use a non-declarative adblocker, you're not just trusting the developer, but also all the third-party filter lists you've subscribed to. These filters have powerful capabilities and can even exfiltrate website data [1], and they are updated in real time, so if a bad actor pushed a malicious update (e.g. by gaining access to any EasyList contributor account), you would most likely be affected.

However, it's true some websites (like YouTube) are especially problematic and a declarative adblocker is not enough. What you can do is combine both approaches: use a declarative adblocker (uBlock Origin Lite) as a baseline, and selectively enable non-declarative adblockers (uBlock Origin) for specific websites (see [2] for a detailed overview).

I like this layered approach because it gets you the best of both worlds: the security and performance of a declarative adblocker, and the functionality of a non-declarative adblocker when you need it, without compromising your entire browsing session.

[1] https://portswigger.net/research/ublock-i-exfiltrate-exploit...

[2] https://seirdy.one/posts/2022/06/04/layered-content-blocking...

Why do you think so?

Say I open HN on my morning coffee and open 5 links in new tabs. They don't have to be to sites I've opened before. I will be tracked until i go to each tab and add it to uBlock Origin.

How is that an improvement?

It truly does seem like a misinformed take on security, believing that being actively tracked is better than the possibility of being tracked if uBlock Origin were ever to be compromised.

Those evil hackers always compromise open source code first, never the ads that no one is reviewing!

I'm unsure of how it exactly differs and whether there are features missing. I will admit that if I were to install uBOL today, I would be worried that it would be less capable and my browsing experience less-safe.

There are many features missing, more prone to anti-adblock/ads-reinsertion (problems with `redirect-rule` and unable to fast updates) and ads/trackers/popups can slip through if cannot be caught by regex filters.

also:

- one thing that is much less powerful is cosmetic filters, which means ads may be replaced with gray squares if uBOL can't remove them entirely

- less filters overall, because the limits on how many filters are possible are pretty strict

- extension updates will be both larger and much more frequent because filter lists can no longer be updated separately from the extension

Why is there a filter limit at all? Why did Firefox add that? Can config change it?

Filters aren't free

They are quite often better than free, blocking unwanted content that would consume more memory and CPU time than the filter itself.

Filters take a minuscule amount of resources. E.g. Even if you had to loop over a list with thousands of entries this would be unlikely to matter, and can in fact even be optimized quite significantly with various algorithms. However, because a database is most likely used, this is not even an issue, and the resource use will in fact be truly minimal.

I can not give you an exact number, but it is massively bigger than the number of trackers / elements that any usable web page can realistically implement. Probably you can do several thousands database calls in less than a second due to indexing; and that can be further optimized by doing it in batches, bringing it up to tens of thousands, if not in the hundreds on modern PCs. It is literally not an issue.

Is the limit still around 30,000 or is it higher? That could be 600,000 filter checks on a page load with 20 requests.

I'm sure it's fast but if people want unlimited number of rules that number could start exploding.

> Why did Firefox add that?

They didn't, Google did. It is part of MV3 specs, afaik.

But Firefox still didn't have to implement the limit.

Then don't use the downgraded version of the ad blocker? What is the point of having two versions of MV3 when you can use a superior adblocker on Firefox anyway?

Google doesn't make Firefox. I flatly don't understand why Mozilla has that limit.

Hmm, it looks like the uBO "Enter element picker mode" feature is not available. I've found that pretty useful occasionally in the past on websites where uBO doesn't catch an ad.

Reply on news.ycombinator.com