uBlock-Origin – 1.52.0 | Hacker News Reader

uBlock-Origin – 1.52.0

github.com

237 pointsarcho77 comments

gorhill is a hero and legend to me. One of the most important players in making the modern web.

I'm still holding out hope that either he or someone else picks uMatrix back up. It's such an incredible tool, and I'm worried about the day when it no longer works.

As far as I've seen, the most recently committed fork of uMatrix is this one:

https://github.com/nicolaasjan/nuTensor

Why not just use the final release of uMatrix? Because it has a bug where it can delete your logon cookies when you navigate to another site. It also has bugs where the wrong rule is applied for a particular request (it picks the action defined for a different site).

Personally i use AdNauseam but if i click on uBlock button and then select "more" twice i get similar interface to uMatrix. Are there any features lacking in there compared to uMatrix?

> Are there any features lacking in there compared to uMatrix?

uMatrix had a much better UI which allowed finer granularity and immediate feedback when blocking this or that for a given site.

Can you actually do anything with that display? As a fellow refuge from umatrix. I would love some of umatrix functionality there.

So to test if I was remembering correctly I just played with the ublock expanded list a bit. You can click on some things(but not everything) and the color changes(sometimes). but I still could not figure if it is just a status display or if it can be used a a tool. As far as I can tell most of ublocks power is hidden inside scripts with no real ui.

With that display you can totally block or allow (sub-)domains on the current website (or all websites) so it does have some power, but it is not as powerful as the the scripts which allow much more granularity

Yes, but it's all "network requests" for each subdomain. You can't for example allow CSS and HTML and scripts, but disallow XHR, which is a common configuration that I use :-(

Wasn't uMatrix dropped because at this point it's just a more powerful UI to do the same things uBlock Origin lets you do?

Yes, and that's exactly why other people including myself still use it.

It is objectively not a more powerful UI if you want to allow/disallow different categories of "network request." For example, allow CSS and HTML, but block scripts and XHR. If you want to to do that, you have to write the rules manually. Basically, there's no UI, not a more powerful one.

That was my understanding.

What does uMatrix have that uBlock Origin doesn't provide?

The UI is many orders of magnitude better. uMatrix vs uBlock Origin is a textbook case. UbO's matrix is the masochist's teapot in the cover page of The Design of Everyday Things https://en.wikipedia.org/wiki/The_Design_of_Everyday_Things uMatrix is a teapot with the handle where it should be.

If uMatrix will stop working I'll install NoScript. I'll keep using UbO for ads and cosmetic filtering.

How so? I think uBO has a pretty nice UX for what I want to do.

Especially like the element picker UI, where you can independantly control what element you want in the hierarchy and also how specific the selector should be.

The element picker is wonderful and I use it a lot especially on my phone but the part that reimplemented uMatrix is a huge and inexplicable regression.

> How so? I think uBO has a pretty nice UX for what I want to do.

I'm happy for you but I think uBO has a horrible UX for what I want to do.

You use both(UbO and uMatrix)? I didn’t realize uMatrix dev had been discontinued until just now, but between Brave shields and uMatrix I do a lot of clicking just to get stuff to work properly when browsing. Do you have to toggle/config uBlock often?

I use Firefox. I don't know what's a Brave shield.

I use uMatrix + uBO on desktop and NoScript + uBO on mobile.

I use uBO's UI mainly for the element picker. The part that reimplemented uMatrix is too hard to understand and to use, hence my comment about the teapot that pours tea from above the handle.

I'm using NoScript on my phone because it has a better UI for that. I use uMatrix on my desktop because it's better than NoScript. I don't use uMatrix on my phone because it's not available on mobile. I would if it was.

Sorry, I could have been more clear. Brave is a browser with a feature called Shield, an anti-tracking feature, a click of the icon disables it/reloads page. So my workflow is up to 3 clicks if I just want to disable everything, which I do when I'm in a hurry sometimes.

I was wondering how often you had to interact with uBO mostly, which was answered in sibling comment.

I'm switching back to an android phone, mostly for a better browsing experience, so I'll try Firefox/NoScript+uBO combo. I'm using uMatrix everywhere else(except on iOS) but no uBO, I thought uMatrix covered everything uBO does but I guess not so I'll try both.

Also, I believe some versions of nightly Firefox (on mobile) can support uMatrix, IIRC.

Thanks for the breakdown!

If you rely on default config uBO just works, but if you go furthur in blocking things (or add third party filters) tinkering may be required for certain webpages (or a lot depending on how hard you go)

Great that's what I was looking for, I'll try combining the two.

A better UI for fine-grained control over what kind of requests get blocked.

Exactly. Say I want to block cookies, media, and XHR requests on the current site as well as on a linked 3rd party site (like cloudfront), but allow css, scripts, and frames? In uMatrix such a configuration is trivial. In uBO AFAICT you're probably gonna have to write the rules manually. The grid UI in uBO doesn't get that granular, just "network request" level.

>gorhill is a hero and legend to me.

I wish a had an 8x10 I could gold-frame, to hang over my desk.

The internet without this, it's unusable. Same with YouTube and sponsorblock

To be fair it depends on what you watch. Not everybody who puts things on YouTube is so hard done by they need to tell you about the latest VPN or razor every 20 minutes. As far as YT premium goes, and the fact there are ads in the free tier - the best way to demonstrate how there are costs associated with their business model is.. at least for this audience:

You wouldn't pirate factorio, would you?

I did when I was broke and depressed and trying out new games. Got so hooked on it, that I ended up buying myself and a few copies for friends. But the quality of the game is what converted from being a pirate, but it didn’t stop me from being a pirate in the first place.

The difference is the value adding behaviour added by factorio vs the rent-seeking behaviour from every other game.

Anything in particular the submitter (u/archo) is excited about?

I submitted the article as uBlock is in (normal) comprehensive code review as per [1].

This allow us, (as users) time to review the changes to the app. before a notification suddenly appears to update.

[1] https://blog.mozilla.org/en/products/firefox/extensions-addo...

Thought it was curious that this was released 4 days ago, but a spot check of the Firefox Add-Ons downstream[1] still reflects 1.51.0 updated on the same day (2023-07-19) as its GitHub release[2].

Then I saw:

> Firefox: Review pending

Mozilla just seriously backlogged or is there a more nuanced story here?

[1] https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

[2] https://github.com/gorhill/uBlock/releases/tag/1.51.0

uBlock Origin is a recommended extension and according this page[1], Recommended extensions undergo full code review by staff security experts to provide a strong additional security check.

[1] - https://blog.mozilla.org/en/products/firefox/extensions-addo...

What if we implemented ublock origin in native code from Browser's side instead of implementing it as extension? Will there be performance, efficiency and memory improvements?

Yes, see https://github.com/uazo/cromite

But the history of minimalistic Chromium forks is kinda sad, as they seem to get little attention and maintaining them requires a ton of work. They tend to burn out, like the dev of Bromite did.

That's more or less the goal of DeclarativeNetRequest in Chrome/manifest v3 and similar facilities in Safari.

I somehow doubt the goal of the people behind Chrome is to make ad-blocking performance better.

That is their stated goal.

> There’s been a lot of confusion and misconception around both the motivations and implications of this change, including speculation that these changes were designed to prevent or weaken ad blockers. This is absolutely not the goal. In fact, this change is meant to give developers a way to create safer and more performant ad blockers.

-- https://blog.chromium.org/2019/06/web-request-and-declarativ...

Implementing DeclarativeNetRequest is mostly about making (simple) blocking perform better. Instituting unrealistically low limits on the number of rules that can be registered is not; if anything, the new APIs should have been enabling much larger filter lists than are currently in widespread use through the old APIs.

As Google is an ad company, anyone believing that they want to make ad-blocking better is.. not looking at the economics. What makes sense if this is what they're pushing forward with is that Google sold ads would be exempted while other ads would be ground out. My guess is there's a mix of reasons and none of them are for the benefit of the users.

It's not a particularly difficult thing to assess technically.

It achieves "efficiency" by dropping functionality and limiting rule counts. There are mitigations. Extensive discussion here: https://github.com/uBlockOrigin/uBlock-issues/issues/338

I think Brave claims to be doing something like that?

Orion blocks ads natively and also supports adblock extensions: https://blog.kagi.com/orion-features

The answer is almost certainly yes. But I wonder if the APIs it uses are already fast enough that doing so would yield negligible benefits?

> uBO works best on Firefox.

Those looking for performant adblocking in Chrome should also check out Cromite:

https://github.com/uazo/cromite

Its a resumption of Bromite for Android/Windows, hence the adblocking and tracking protection is far less limited since its native, not an extension.

Of course, YMMV with lone Chromium fork devs.

Those looking for adblocking should not use Chrome at all. If Chrome is really needed, it should be in its own container without any personal data.

Adblocking in chrome is like smoking cigarettes with filters because "it’s better for my health".

No, it’s not.

For people knowledgeable enough to read HN, there’s no excuse to still use Chrome as a daily driver.

The Chrome users don't care so much about being tracked. They just don't want to see ads.

The dilemma for me is that Firefox is extremely slow on Android. Doubly so with adblocking and dark mode extensions.

I don't want the tracking, and I am certainly not going to install vanilla Chrome, but the performance deficit is a big compromise.

Then it means that, yes, you accept being tracked to browse the web a bit faster.

Imagine the situation: your computer is slow and someone promises you to make it faster in exchange of knowing everything about what your computer is doing. Would you accept?

Well, you did.

I’m not pointing the finger at you. We are all doing compromises. I’m just saying that if you don’t want to be tracked but want all the benefits of being tracked then, really, you want being tracked.

Also, Firefox being slow on Android doesn’t seem mandatory (it works really well for me). The fact that you didn’t look to solve this issue is yet one more confirmation that, yes, you agree to be tracked.

Making choices is about the sacrifices we are ready to make for that choice. If there’s no sacrifice, there’s no choice.

The issue for me is that Firefox is funded by Google. If you're trying to avoid Google your alternative is.. Google.

Some might opt for Apple software but Apple hardware(and OS) is a non-starter for me.

If you're worried about tracking, isn't Google's OS already a non-starter?

Not if you do not include the nosy bits. Use an AOSP-derived distribution like LineageOS, do not add 'Gapps' (Google Apps), use free software 'apps' from F-Droid or something similar (including Fennec, a Firefox build minus telemetry/Pocket/...) and you're good to go. LineageOS itself has its derivatives like GrapheneOS which claim to take the idea of a leak-proof mobile OS further but since that only runs on a limited number of devices none of which I have around here I have not tested this yet.

LineageOS and derivatives are much more reasonable.

Again, its a compromise, and I dont trust it with everything.

Firefox is slow at what?

The customized forks are lightyears better than vanilla Chrome.

Still, you have a point, and this feature in particular is quite telling:

> internal firewall to block all unauthorised calls made from the browser patch (issue 147)

Firefox on Android's URL bar still, in 2023, does not understand IPv6 addresses. So, unfortunately, there are still reasons to use Chrome. I use the Bromite f-droid repo but it hasn't had a new build since 2022. I'd like to see this project take off!

Ads pay for the internet.

My CPU is not free real estate for any site to abuse as they see fit.

Nothing to do with ads but thanks for playing

Someone should inform my ISP.

Ads pay for the other end of the web, the part most folks are looking for, yet dont want to micro-pay every site they land on.

Advertisers poisoned the well.

All ads must be blocked.

99% of what goes through my browser is either SEO trash, social media attention baiting, a straight up scam, paywalled, or something ethically questionable from Big Tech.

AP News served me malware in an ad.

I whitelist good reporting and cool/niche sites, but things worth whitelisting are increasingly rare. Whatever discomfort I felt using an adblocker before is long gone.

How quickly do they patch any new security issues? What's their track record here?

> How quickly do they patch any new security issues?

Its more like patched Chromium rather than a hard fork. It stays in sync with upstream.

As for the patches themselves, they don't seem risky to me. Enhanced security is an explicit goal. But I am no expert.

> What's their track record here?

Uazo helped maintain Bromite (a longtime staple on Android). Now that the main Bromite maintainer is MIA, they just forked it.

...So the track record is not very long, no.

Just use brave

Theres a list of small things I don't like about Brave, including the ad-replacement business model and the rewards things.

I prefer "simple" forks that stick closer to Chromium, and Cromite is basically that.

They dont replace any ads. Brave ads are silent notifications, which are optional.

Brave used to edit links to insert their own referral codes. They only stopped when they were caught. That's like browser hijacking behavior, so I'm gonna stay far away.

uBlock Origin – Wiki : https://github.com/gorhill/uBlock/wiki

I would pay for gorhill to maintain uMatrix. It adds that much value to my web browsing experience.

consider contributing to filter lists with your free time :)

Is there an equivalent to uBlock-Origin for Safari?

There's nothing that offers all these features and is free. But if you'd like to try Orion browser by Kagi [1], you can install uBlock Origin and many other web extensions for it on Mac, iOS and iPadOS. A paid alternative that is similar (at least for blocking specific elements) is AdGuard [2].

[1]: https://browser.kagi.com/

[2]: https://adguard.com/

I think ublock lite got released on Safari recently.

Nope

AdGuard, Wipr, 1Blocker

Paired with dns blocker (pihole, nextdns) or local firewall (littlesnitch)

Reply on news.ycombinator.com