byoogle

Also encephalitis lethargica, the treatment of which even got turned into a movie (and book and play): http://en.wikipedia.org/wiki/Awakenings.

(Spoiler: The patients, unfortunately, developed a tolerance for the treatment within a few months.)

Why? I believe that sentence refers to extra software/services that’d normally be paid.

This Verge article [1] says “The company will open source the vast majority of its code for the phone in order for third parties to properly audit its techniques, find holes, and ultimately help to improve the product.”

1. http://www.theverge.com/2014/2/24/5441642/blackphone-silent-...

The site doesn't seem to say a thing about what they actually did to make money (the AngelList description does, though).

Hmm, that FAQ isn't the best (will fix). This explanation is better: https://news.ycombinator.com/item?id=6888514.

If you install Disconnect first on Firefox then install other filtering add-ons (ABP et al.), you should get faster overall performance. The reason is Disconnect filters faster, so requests that Disconnect blocks won't have to be processed by your other add-ons. All other requests will still be processed by them.

Disconnect, which I work on, is designed to filter requests faster: https://disconnect.me/faster.

Disconnect also does some fancy visualizations, if you're into that sort of thing: http://youtu.be/Lvem1Z66C7Q?t=40s.

Congrats on your first post! [1]

1. http://www.catb.org/jargon/html/A/astroturfing.html

Cool, ping me if you need help (byoogle everywhere).

> You are suggesting that Disconnect knows exactly which 3rd-party is legit when visiting a web page.

Yes! You now know how Disconnect works - Disconnect's filter list is based on weekly crawl data that identifies what the most prevalent third parties on the web are.

> `static-serve.appspot.com` is no different than `ajax.googleapis.com` (you didn't list this one, why?)

You think that URL might belong to Google, which I already called an exception 2x?

> I will note that you completely disregarded the other results which are even more embarrassing to explain (like `simplereach.cc`: "SimpleReach tracks every social action on each piece of published content to deliver detailed insights and clear metrics around social behavior.")

I examined and debunked the entirety of the first example on your page, so I'm not inclined to waste any more time on your so-called "science".

[You think maybe you should start identifying that you're promoting your own product with these comments?]

The first thing I tried when I wrote Disconnect was to block every third-party domain. Within an hour, I realized that I broke the whole web. So I built a crawler to identify and categorize the most prevalent third-party services instead. The domains you list under Disconnect would all be categorized as content by our crawler - resources that most people would consider pages broken without and that Disconnect doesn't block by default.

[Replying to aroch, who's too nested.]

> And how exactly is it trickery if users have to opt-in to the program and they're told what the program does?

Ghostery seems to rely on vague messaging (last I looked, they don't actually say anywhere in their extension that they sell the data you share to ad co's and data brokers) and UX "optimization" (what quesera dubbed the "reconfigure-on-update dance", for example) to get less attentive users to leave blocking off and to send data - as the numbers show.

That's a pretty cheap shot:

* Disconnect has more than a million active users and Ghostery has more than two million.

* Disconnect is also as public as ABP: https://github.com/disconnectme/disconnect.

As of the last time I tested:

* Chrome, Safari, and Opera give precedence to the newest extension - if that extension blocks a request, older extensions don't see the request.

* Firefox gives precedence to the oldest add-on.

quesera described what's sneaky about Ghostery - their users think they're protected but aren't and don't know they're sending data to Evidon that the company sells but are:

> So you offer a very useful product, for free, and make money off of the people who fail to configure it so that it performs the only service they would ever purposely download it for.

I gave some numbers above that show, in practice, just how many users are in one of these unexpected configurations:

> Ghostery's game seems to be tricking users into sending their data to Evidon. Going off the company's own numbers, something like 45% of Ghostery users send Evidon data (by comparison, only 2% of Firefox users share data through Telemetry).

See the commit message at https://github.com/disconnectme/disconnect/commit/691897e21d....

The unencrypted list is at https://github.com/disconnectme/disconnect/blob/b27abbf033c6....

And formatted as JSON at https://disconnect.me/services-plaintext.json.

The encrypted list is also trivial to decrypt with the SJCL code in https://github.com/disconnectme/disconnect/blob/master/firef....

Thanks.

#2 first: Code to block everything marked as content with one click was either just checked in or is about to be.

For #1: Disconnect groups tracking requests by company. If you want to see all the Google services that Disconnect filters, you could look through the filter list (services are grouped by category and company here, so start at lines 33, 1,882, and 2,326): https://github.com/disconnectme/disconnect/blob/b27abbf033c6....

Ghostery's game seems to be tricking users into sending their data to Evidon. Going off the company's own numbers, something like 45% of Ghostery users send Evidon data (by comparison, only 2% of Firefox users share data through Telemetry).

To answer your reply to my reply:

> Given the results, I am quite surprise you would say "look to be first parties serving content for the page".

I believe every single domain name you listed (except the Google and Twitter domains, like I said) is a domain owned by or a CDN used by the Guardian or hosts an app run by the Guardian - prove me wrong:

> facebook-web-clients.appspot.com

> guardian-notifications.appspot.com

> related-info-hrd.appspot.com

> static-serve.appspot.com

> cdnjs.cloudflare.com

> discussion.guardianapis.com

> s.ophan.co.uk

Not true, Disconnect detects 13 trackers on http://www.washingtonpost.com/. If you're running multiple filtering extensions all at the same time, install order matters as far as which extension sees which HTTP requests.

I work on Disconnect and don't quite understand what your page is getting at (you probably ought to be disclosing that this is your page and project, btw). If you consider the Guardian page, for instance, all the domains you've listed as third parties except Google and Twitter actually look to be first parties serving content for the page. In other words: If you go to the Guardian, you're going to be tracked by the Guardian. If you'd like, you can also prevent their pages from working properly by blocking some secondary domains they use.

This.

I work on Disconnect. I don't understand why any hacker would still put Ghostery on their machine:

* Ghostery is run by former ad execs (7/9ths of their executive team): http://www.evidon.com/our-team

* They make their money (I've heard tens of millions of dollars per year) selling user data to ad co's and data brokers: http://www.evidon.com/#block-views-from_our_partners-block

Obama didn't read The Mythical Man-Month.

Actually, I think Opera has the same policy as Mozilla. If you reply to the reviewers (who are very responsive), they seem to let you minify as long as you show them the unminified sources.

Our extension (https://addons.opera.com/en/extensions/details/disconnect/) uses the minified versions of seven libraries, which are about half the size of the unminified versions. Why not give users a better experience by shaving a few seconds off the install time?

> This is backed by hard data on malicious attacks from the Dept. of Homeland Security and the FBI.

These seem like nice, trustworthy sources.

> State may finance the project through ad sales.

We'll just go ahead and let these advertisers spy on you instead.

I maintain a library (a more comprehensive fork of AdBlock's porting library) that emulates most of the Chrome API in Safari: https://github.com/disconnectme/port (we use this library for Disconnect). Now that Opera is based on Chromium, you can pretty easily develop an extension for three browsers with one code base.

Sort of. :-) We're using iOS's VPN capabilities but not actually running a VPN. As the Wireshark session in the video shows (but please verify yourself!), blocked tracking requests never leave your iPhone or iPad (are never sent) with Disconnect Kids installed.

(I'm one of the devs.)

This: http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe....

I don't know of any, but I imagine there are a bunch on YouTube and so forth. I will say that of the two, Charles is the easier to use and I don't think too hard to figure out without any docs.

I'm one of the Disconnect devs and these definitely aren't stupid questions:

1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup (https://disconnect.me/help#syncing), but unlike in the Amazon case, the file is both transferred over HTTPS and encrypted (with the Stanford Javascript Crypto Library). Also unlike in the Amazon case, the file has a limited functional scope (which third-party sites to block) so is less susceptible to being rewritten in an abusive way.

2. One of our other Chrome extensions, Collusion for Chrome, will actually show you requests that are coming from other extensions. The more technical approach, which isn't that hard and I'd like to see more people try, is to run a packet sniffer (recommended: http://www.wireshark.org/) or proxy server (recommended: http://www.charlesproxy.com/).