Hacker News Reader

This is why I keep uMatrix around still

https://i.imgur.com/9MYqLvj.png

I can quickly disable XHR to confirm websites don't do anything server-side when I don't expect them to.

You'd really need to block fetch(), websockets, WebRTC, all external images/stylesheets/scripts added to the DOM later, and service workers (to prevent the upload from just being deferred). It's not easy to make sure a web page can't phone home.

Throttling inside of Devtools should do all of those.

Well, and writing cookies which would upload at a later visit. And probably a dozen other paths.

Reply on news.ycombinator.com