Hacker News Reader

Comment by mdellabitta | Hacker News Reader

I decided to dump extension-based privacy stuff and installed Privoxy instead.

I used to have Ghostery, Disconnect, ABP, and some other things running simultaneously. When you think about it, that's a lot of JS running and iterating the DOM multiple times every time you load a page.

Now there's a single, purpose-built, standalone process written in C doing it. Not going back.

View on HN

This doesn't work with the push to HTTPS. Either you use proxy connect, and Privoxy is no better than /etc/hosts blocking. Or you'd rely on the proxy's poorer and slower implementation of TLS. Certificate verification will suffer (no certificate pinning, no certificate blacklist, no OCSP stapling, no way to verify incomplete chains), no SPDY, no sunsetting of bad ciphers or bad protocols.

Is there some reason in principle why you can't constructively MITM yourself without using piles of Javascript in the browser?

There is no reason in principle, and you can even do it for kicks.[1] The only issue here is a practical one, as the parent poster described: from an end-user perspective, browsers do SSL/TLS better than ad-blocking proxies.

[1]: An example from the other side of the coin: http://www.wired.com/2010/03/packet-forensics/

Unfortunately HTTPS makes proxy-based privacy stuff unusable without invalidating your SSL/TLS certificate in the browser. Extensions are the only reliable method AFAIK for browsing ad-free, securely. That is, if you consider the extension secure.

Actually it can make your setup far more secure.

You could move all SSL validation off to your proxy, and generate certificates from your own CA on the fly. Then within your browser or OS you can remove everything except your own CA from the trust store.

That would open up sniffing on your local machine/network would it not? I see the benefit of blocking malicious domains at a proxy or hosts file level. But aren't you sacrificing a lot of usability by blocking at a network level?

Any issues connecting to sites over SSL using Privoxy? I'm thinking mainly of banking web-sites.

I've used Privoxy since late 2002 on a Linux gateway box - never had a single issue with SSL.

In fact the only issue I've ever had was building it an forgetting to enable threaded mode ..

I don't recall any problems, but I use Foxyproxy to connect to it. In the worst case, you can just toggle it off quickly for that site, then turn it on again.

I've used Privoxy & friends (Glitterblocker on OS X) since the days of junkbusters.com, but with SSL on the rise this no longer works very well for me.

Anyone looking to follow up on this comment should search for "GlimmerBlocker", not GlitterBlocker.

Useful stuff, though, thanks!

GlimmerBlocker works the same as Privoxy, only offering support for HTTP.

Oops, brain fart - sorry :-!

For anyone searching for a blocking solution on OSX, the name is actually Glimmerblocker. It still works on Yosemite.

It really ought to be possible to have a dynamic browser hook in Firefox's parsing phase to allow pre-manipulation of the DOM (or raw HTML) in native code. However actually finding the right spot in the giant codebase to do this is another matter.

What about when you're doing development work on a site that uses content you'd normally block (Analytics, ads, etc)? When I spend a day working I don't want to have to toggle Privoxy every time I want to search for something.

Use FoxyProxy and create rules that "whitelist" the sites you're working on

You really probably want to use a separate browser profile with no plugins installed. It really sucks when you're trying to debug a problem and it turns out it's some combination of extensions you have installed causing the problem.

I agree, you had to many things running... What is the advantage of Disconnect when have ABP and Ghostery installed?

Disconnect is an open alternative to Ghostery as Ghostery has some sketchy sponsors.

Unfortunately, Disconnect (new version is $5/month for any protection) is not as good as Ghostery and the sketchy part of it is Ghostrank which is easily disabled.

Your answer was unrelated to my question... mdellabitta stated he was running Disconnect with ABP and Ghostery all together which is redundant and I was asking why he would be doing that.

Ghostrank is easily disabled, but it's off by default so you don't need to....

So simple statements of fact get downvoted? HN aspires to be Reddit ;-)

I used to run Privoxy for years and then came the time of AdBlock, NoScript, etc. Perhaps it is indeed time to look back again.

Did you manage to make it work with skype ? (it seems that skype doesn't use the proxy parameters for ads)

To disable the banner ad you could add https://apps.skype.com/ to your restricted sites list.[1]

[1] http://www.reddit.com/r/LifeProTips/comments/27dihm/lpt_you_...

I've found it effective to just watch Skype with Fiddler, and add whatever ad servers it touches to my hosts file, and redirect them to 127.0.0.1 Entries like this work for me:

  #BEGIN: Skype ad servers
  127.0.0.1       rad.msn.com
  127.0.0.1       a.rad.msn.com
  127.0.0.1       secure.adnxs.com
  127.0.0.1       m.adnxs.com
  127.0.0.1       ads1.msads.net
  #END: Skype ad servers

All I notice is that websites like Wired.com load faster with a ad-blocker.

Privoxy blocks ads, too.

Reply on news.ycombinator.com