Hacker News new | past | comments | ask | show | jobs | submit login
uBlock Origin 1.48 adds readiness status, code viewer, and other fixes (github.com/gorhill)
391 points by rc00 on March 21, 2023 | hide | past | favorite | 127 comments



I somewhat wished that when Chrome switches to manifest v3, uBlock Origin would stop supporting Chrome and its clones.

Firefox is the only browser where uBlock Origin is actually working as intended, Chrome on the other hand (even in manifest v2) is blocking so many features that uBO isn't actually able to work as a privacy and anti-malware tool. CNAME uncloaking is essential because websites can counter any filter rule by just aliasing the Google Analytics domain but Chrome doesn't have an API for that. Instead you need a gigantic list of filter rules, one for each domain, making loading web pages slower.

uBO is even slower in Chrome because Chrome doesn't allow extensions to use wasm.

https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...


>CNAME uncloaking is essential

>Chrome doesn't have an API for that.

It rolled out a year ago.

https://bugs.chromium.org/p/chromium/issues/detail?id=115104...

>Chrome because Chrome doesn't allow extensions to use wasm.

Chrome doesn't allow loading remote web assembly in mv3 extentions. You can't run remote javascript either. It's fine if you bundle the wasm with your extension.


>remote javascript

When Google says "remote" they really mean "remote to Google". You cant execute any of your own code from local drive, everything must be controlled by Google.


How can a malware scan be effective if all the code can't be scanned? Imagine if antimalware only scanned exe files and ignored dll files.


Loading remote wasm after installing should be allowed. Your extension would still need bindings in javascript for whatever the wasm is doing.


Just knowing the bindings isn't enough to be able to classify a wasm file as being malicious.


"Instead you need a gigantic list of filter rules, one for each domain, making loading web pages slower."

By not using recursive DNS, including open resolvers or other third party DNS providers, I avoid this problem. I do not need to maintain a list of domains to block,^1 I only need to maintain a list of domains for hosts that I actually want to access. I do not even make remote DNS lookups because generally I already have the DNS data stored (gathered in bulk beforehand), so the web becomes faster, not slower. One of the requirements for the web to suck the way it does, and for so-called "tech" companies to proliferate by collecting data and selling ad services, is that the web browser and webpages must be give free reign to resolve any domain name. IME over nearly 20 years of controlling own DNS, restricting that ability makes the web instantly readable, even so-called "dumpster fire" webpages.

1. AFAICT no one actually does this anyway. They delegate the task to third parties, "blocklist" maintainers.


But DNS has its own weakness, that's dealing with first party ads and anti-adblockers, which websites use a tons nowadays.


while I do some dnsmasq tweaks to raise minimum ttl on my terms, doing bulk gathering ahead of time and sinkhole anything not cached (I assume) is interesting. What's your refresh interval? source of domains you query in bulk (browser history / bookmarks?). Any place you described your process to read into?


do you mind sharing your setup for this? sounds like umatrix but on the dns level



I wished it had been named "uBlock Neutered" or something that more strongly highlighted the relationship to uBlock Origin.


Or uBlock Chrome Edition. When it doesn't work as good as uBO on FF, let it be known whose fault it is.


uBlock Reduced Functionality exclusive to Chrome


Chrome will still be faster even if ublock doesn't block as much as FF does. In fact the new declarative filters will most likely be faster than the current ones.


In the same way that a car is faster if you make it lighter by removing parts that aren't technically needed to drive down the road :) Airbags, ABS, Crossmembers? Meh.


How much faster does it need to be? I have some complaints about FF, but not on the account of speed. I don't care about microbenchmarks, for me it works fast enough to not notice any lag.

Besides, I really don't care how fast it it when displaying ads and tracking me. I'd prefer not to see them, thank you very much.


"uBlock Crippled Edition" sounds good.


uBlock Gutted imo.


There is a solution for Chromium based browsers:

https://github.com/brave/adblock-rust

but you will only have it built-in in Brave currently.


With the Code Viewer, uBlock may (un?)intentionally win a separate war: one where pages are acting against users who open the inspector.

Source: https://news.ycombinator.com/item?id=35235732


How is it even possible for sites to detect that dev tools are open? How do I stop them from detecting it?


One of the threads discussing it: https://news.ycombinator.com/item?id=35236608



while (true) { debugger; }

Not really detecting it, but avoiding useful usage at first moment


Unfortunately, uMatrix (the other gorhill project) has bad bugs on Firefox.

When you navigate to another page, it will sometimes get the host for a web request wrong, causing it to apply the wrong rules for that request. This can cause you to lose your login cookies. And since uMatrix has been discontinued, so there's no more central repository to collect bug fixes.

A fork is available called nuTensor which does resolve the cookie clearing problem, but I often see hosts that are not part of the current page (they were from the page I was previously viewing) appearing on the grid.


I believe uMatrix development was discontinued a few years ago, so it is not surprising that it doesn't work reliably anymore.


Correct, it was discontinued awhile ago, sadly. I loved that project.


Me too. I still use it.


>This can cause you to lose your login cookies

Huh, so that was why that was randomly happening. Sigh, I totally understand gorhill not wanting to have to support another overlapping tool, but uMatrix is unparalleled for visualizing the sheer mass of privacy vampirism on the modern Web. I've learned a lot from using it on sites, and am now kind of a cottage expert on CDNs thanks to determining the minimum whitelisting to get a site's basic functionality to run.


Do you have an example of how one can test that? Or be more specific? I don’t remember ever encountering any issue like that, but that might simply be because I didn’t know about that bug.


I can not even thank the existence of this project enough!

the simple improvement in internet speed is well worth it, even though i do too have a pihole running.

Sometimes when i visits friends i barely recognize sites that i use frequently.


Yeah, I feel the same way. Let's take a moment to thank gorhill for his work.

Thank you, gorhill.


I just run AdGuard Home network wide and have never seen a huge need to run a browser blocker as well. What are you getting out of using both?


I block all sorts of stuff thats not even ads. Stuff like "suggested for you" sidebars on websites I frequent I will just right click and block. All sorts of stuff. If I don't use it, no need to load it next time, so out it goes.


DNS-based ad blockers only block connections to domains known to serve ads.

A browser-based blocker is able to block ads served by the same domain as the content you actually want, without blocking said content. They are also able to apply fixes to pages that break or have bad layouts when ads fail to load in.


A concrete example here is YouTube. I also run AdGuard Home, but that does nothing for YouTube ads. Firefox + uBlock kills them.


I once sent someone a YouTube link and they were wondering why I sent them a link to an ad. It didn't even occur to me there would be an ad there because I was using FF and UBO, and obviously he wasn't. UBO just makes it so seamless that it is easy to forget.


$12/mo to remove ads with YouTube Premium


Or save $144/year and just install UBO in 10 seconds.


UBO catches things for me that Adguard doesn't, so having both is pretty useful to me.

UBO also blocks harmful elements inside of a page, not just page loads. I've used it to automatically remove the annoying paywalls that are just an element over the text I want to read.


Is Adguard better than Pihole? I always thought that adguard were baddies, but maybe I’m conlflating them with another product…


Maybe you are confusing AdGuard with AdBlockPlus? The latter[1] and the parent company Eyeo GmbH have some points of criticism.

AdGuard is basically pi-hole, just with different pre-configured filter lists and especially child and parental control settings. IIRC, some services can also be blocked there directly, Instagram for example.

1: https://en.wikipedia.org/wiki/Adblock_Plus#Controversies


This is exactly what happened! Thank you for clearing that up.


The ability to leave the house for one :)


Does anyone know if there is a way to sync settings/filters across multiple uBlock Origin installations? I use a ton of browsers and find the manual export/import to be a hassle.


I think there’s a setting to enable cloud storage, so as long as you’re logged into Firefox Sync/Chrome it can be synced but has to be triggered manually to sync/merge the filter lists.


I've got that set up, but it doesn't seem to work: https://github.com/gorhill/uBlock/wiki/Cloud-storage I've followed the steps carefully a coupe of times, but still no luck. The page does include the caveat "Cloud storage services offered by specific browser vendors have limitations and quirks and are out of the control of uBO" which seems to be the case for me.


Your list/filters is probably too large.

> If syncing is enabled, the data is synced to any Chrome browser that the user is logged into. If disabled, it behaves like storage.local. When the browser is offline, Chrome stores the data locally and resumes syncing when it's back online. The quota limitation is 100 KB approx, 8 KB per item. Consider using it to preserve user settings across synced browsers.

https://developer.chrome.com/docs/extensions/reference/stora...


Unfortunately not - I only have 121 lines in my filter list. I might dig into it again at some point, but it's only a nice-to-have for me.


Is it possible to sync between Firefox, Chrome, Brave, Edge? I assume we're limited to the same browser only though?


Yes, same browser since uBO just uses the `browser.storage.sync` API.[1] The sync storage is quite limited but uBO compresses the data to make the most of the limited storage.

* * *

[1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...


uBlock Origin is what makes the Internet usable.

I am saddened that I do not know how to best express my gratitude towards gorhill, and the filter list maintainers, for their incredibly valuable, tireless work, so "Thank you, so, so much!" will have to do here.

It's only thanks to uBlock Origin, I believe, that my parents (of rather old age) are able to make positive use of the Internet. A world without uBlock Origin would see them drowning in an onslaught of noise, attacks, flashing attention-grabbing spam, none of which improves the quality of their lives.

So, thank you, thank very very much, gorhill, and the filter list maintainers!


Donate to the filter list maintainers if they accept it.

https://github.com/gorhill/uBlock/wiki/Why-don%27t-you-accep...


uBo is great, but can sometimes break sites who ask you to 'disable your AD blocker to view this page'. That's rare though, but it does happen.


By default we defuse such anti-blocker. If it happens, it's just a matter of reporting it to filter list maintainers. The more people report issues, the better the default filter lists get.

Also, a common cause of such anti-blocker walls is the use of other content blockers beside uBO, as this often breaks uBO's own anti-blocker mechanisms -- we often resolve such issues by asking people to disable other content blockers.


My solution is to leave the site :) and then add the domain to an add-on I made for myself that hides any links to it, on any page, any where.

I was hoping uBO would eventually get a dedicated feature like that, I don't think it's possible with filters. I tried pretty hard. I think knowing anyone could decide to completely erase a domain from their entire internet experience, down to the link level, would motivate sites not to do stupid things like this.


> I don't think it's possible with filters

We constantly create filters for detection issues[1]. Filter list maintainers have a lot of experience on how to work around such issues, with solutions that are often not obvious to people that are less familiar with filtering capabilities and syntax. The only way to know for sure whether it can be addressed is by reporting it.

* * *

[1] https://github.com/uBlockOrigin/uAssets/issues?q=is%3Aissue+...


I would totally use that add-on if you were interested in maintaining it as a publically available add-on.

Does it just strip out the <a> tag?


It is in the official extension repository [1]. I had to put it there because of how difficult/impossible it is to run a local extensions. But it's definitely not designed for general use. I'll be glad to guide you if the tiny amount of help I've included isn't enough.

The source [2] is available too.

The actual idea of the extension is "Style stuff using regular expressions". So you specify a regex; what to search, attributes and/or text (text can cause a lot of undesired results so I don't use it much); and css styles to add to the elements containing matches. I only really use it to apply visibility: hidden to any element with an attribute matching one big regex that's basically just a bunch of domains regex |'d together. The example in the options UI is what I'm still using years later, I've just added more domains.

EDIT: I just realize the example has "searchText" set to true, you'll probably want to set that to false.

To give you some idea of how user unfriendly it is, configuration is JSON in a textarea and the regexs are defined in a string in that JSON, necessitating the use of many backslashes for escaping from both regex and strings. It's basically brainfuck :)

I originally started with just taking out tags but that idea was quickly shot down. Lots of links aren't <a> tags. Sometimes the domain being linked to is buried in some JS in a onX event attribute, or some data-* attr that the UI framework uses and a bunch of other oddities. So the code searches all attrs. It's not super efficient but I've never noticed it causing a slow down.

Another problem is, often, the original request doesn't even contain the links, they're loaded after. So it uses a MutationObserver and looks at the new elements for matches.

[1] https://addons.mozilla.org/en-US/firefox/addon/ssure/

[2] https://github.com/7w0/ssure/blob/master/content/content.js


> I do not know how to best express my gratitude towards gorhill

Them opening a Patreon and you patronizing them would work great. And ensure the continuity of the project.


Gorhill has clearly said he won't accept money for this project, Cf the project Readme : https://github.com/gorhill/uBlock

I wish I could repay in some way the happiness this extension is bringing me though


My biggest wish ever is to get a Safari version of uBlock Origin. I know how unlikely it is and to be honest Wipr does a pretty good job blocking ads, but it's something I think about often.


Doesn’t recent changes that removed restrictions around what could run as a browser on iOS enable some of this now? Or is it still restricted to t he point that it’s untenable?


Nothing has changed yet, we will see nearer to 2024.


var internetExperience = uBO ? Experience.NICE : Experience.DIE_A_LITTLE_INSIDE;

var internetSafety = -10;

internetSafety += windows ? -5 : 3;

internetSafety += uBO ? 4 : -9;

internetSafety += uMatrix ? 13 : -99;


uMatrix is redundant with uBO Dynamic filtering:

https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...


I just wish it used the uMatrix UI, which I think was easier to parse, at the cost of much more space of course. But I have plenty of room on my desktop display.


How do I block cookies (and only cookies) for a domain using uBO?


What is the difference with hard mode?


This isn't even remotely comparable to the uMatrix interface.


"Remotely" is a very strong word given that uBO has the vast majority of uMatrix functionality. Care to give some examples?


A browser also has all of the functionality of uBO and uMatrix ... if you just write the equivalent code yourself. After all, what is extension code if not a very complex configuration file. But I didn't talk about functionality - I specifically said the interface wasn't comparable. And it isn't.


wish we can use ublock as a proxy to do a network wide adblock !


I used https://www.privoxy.org/ around 2002-2005, before adblockers as browser extensions existed. Proxy based adblocking was much easier when basically no website used SSL.


There are hosted DNS solutions, I use NextDNS to good effect but I'm sure there are others


https://openwrt.org/docs/guide-user/services/ad-blocking

OpenWrt has Ad blocking capabilities built-in.



Pro tip: if you are concerned that you are spending too much time reading the internet, just uninstall ublock. You'll be so disgusted by the current state of affairs that you'll want to spend as little time online as possible.


Yeah, I've said before that whenever my wife wants to show me something from the web on her laptop, I blown away by how bad it is. The experience in her browser (Chrome with all defaults, usually on ad-supported social media or puzzle or pop culture news sites, or shopping sites) is like being assaulted to me.

Of course the other thing that's been happening is that most of it isn't "reading the internet" anymore; it's all watching short-form videos (also laced with ads).


Not installing ublock on your wife's laptop? Why are you so cruel?


I've offered, but she declined. She really likes sales and coupon offers, extensions for cash-back that are based on tracking, etc. Someone else said it best about their spouse on another thread:

"...whenever a website doesn't work for any reason I get an earfull about my 'damn adblocker'..."

https://news.ycombinator.com/item?id=30150762


I hooked up my pihole’s on/off switch to HomeKit. Whenever a website doesn’t work, my wife knows she can open the home app and turn off the Pi-hole and try again.


Do you have any more details on this? Sounds like a great idea for the rest of my household.


Yea, it’s a homebridge plugin: https://github.com/arendruni/homebridge-pihole

Really easy to setup once you have homebridge itself running. Just enter in your Pi-hole api key and add it to HomeKit.


Thank you!


x3

"I like the ads." - Wife


And this is exactly why I don't feel bad about blocking ads and not purchasing YouTube Premium and the like. There are zillions of people out there who actually like looking at all these annoying ads, so the advertisers don't need to bother me when I'm not going to buy their crap anyway, and these other ad-lovers will happily do so.


The real difficulty hurdle isn't installing it (or having someone install it), the real hurdle is when it breaks something important and you have to realize that Ad Block belongs on the suspect list and you have to know how to disable it, reset cookies, and try again.


This basically never happens if you're using default config uBlock origin


Happens occasionally. It is uncommon but happens enough to ruin the day of unsuspecting users.

For example, go to https://community.ee.co.uk/t5/My-EE-app-and-website/EE-Site-... and search for "Adblocker" in this page. You will find a story where their mobile service provider blacklisted their IP because they clicked on a button on the website while their adblocker was enabled.

Exactly the same thing happened to me with the same mobile service provider except that I was using uBlock origin when my mobile service provider blacklisted my IP.

Bank websites sometimes breaking in the presence of an adblocker is a common occurrence in many parts of the world.

You live in one geography and you visit websites that you need in your life. Do not assume everyone else is having the same experience as you. Websites breaking in the presence of adblockers is a real thing that sometimes makes us hesitate to install it on the browsers of our friends and family who may not be as tech savvy as we are.


My no contract phone provider is broken by adblock, and will shadow ban my IP temporarily if I forget to entirely disable it and then grant all permissions the site requests.

I still install uBlock Origin on most of my friends computers, but make sure they know to open any sites that break in a private tab.


I just use Firefox with unblock for general browsing. Chrome if I'm trying to buy something and I need the page not to break.


Yeah, except that has never happened to me in 20+ years of using ad blockers.


Never? So many news websites detect adblocker use and stop you from reading the article till you disable it


I feel like it's not that it never happens to me but that I quickly leave and forget the site that blocks me. Non-survivorship bias.


It depends on how strongly you filter.

The default rules probably won't cause issues, but you'll still see a lot of ads. As you optimize these away, things start breaking


i think that is grounds for divorce


I would highly recommend installing pihole at home.


My work does not filter anything ( it won't let me use some websites, but will happily let me see ads for new yard gizmos ) so the few times I actually am forced to look for something on work PC, it is a quick reminder why I bother doing all the things I do.


Every time I setup a new OS and forget to install uBO, I'm instantly reminded when I go anywhere but HN. Then I feel like I have to wipe the harddrive again just to be sure I'm not infected with something after the exposure.


HOLY CRAP! this is a good statement.

As someone who has sat in front of a computer daily for nearly 30 years, this really hit me.

I am REALLY good at maintaining a no-ad/no-spam experience for my self with high-density-information content, that I almost never see ads.

My viewing is clean, I have never been accidentally rick-rolled, I have never seen TG1C, TubGirl, etc... no Ogrish or other crap...

I am my own 'curator'

-

But yeah - if you dont take time to set mental-health-boundaries against the internet - then the internet is the same as the experiments when they just plugged in a machine (win98? xp? cant reacall) - pwnd in matter of minutes.

Thats the same as your mind.

put mental firewalls up.

Be open to positive content, but destroy negative impacts on your mental health with impunity.


I've been using uBo since the start. Went to use the web without it and it was like using the web naked. It didn't feel right.


ad agencies: caring about you since -oo


Pro Tip: That's why you need to pay for what you read.


I bit the bullet and subscribe to Bloomberg, WSJ and NY Times which is a good mix of center, moderate-right and left

and this is far improved my experience. it makes me sad that people arent/cant get these articles and have this other rage-bait experience, but I’m glad I opted out of that crap


anyone visiting HN should be able to install Bypass paywalls chrome clean and uBlock origin


none of which work for the default mobile browser, or those service's associated mobile apps

and there's an experience beyond archive.is

moving on


HN crowd is unable to install non-default browser? Firefox and Kiwi browser both sorry extensions including these two

not sure what has archive.is to do with extensions I mentioned


I'm not going to subscribe to some random regional newspaper to read one article. And some of the most egregious advertising implementations don't come with a way to pay to make it go away, like Fandom.


This is uBlock Origin. uBlock is, sadly, a separate project.


Ah ok, we've put Origin in the title above. Thanks!


Yep. Title should be: uBlock Origin 1.48.0 Adds Readiness Status, Code Viewer, and Other Fixes

uBlock Origin is the good one


I knew uBlock Origin was "the good one" but I didn't know its repo is called uBlock, it's quite confusing. Can you rename repos in github?


It is confusing. I find it easier to remember that gorhill is the good guy.


To make things even more confusing gorhill is actually the creator of the original ublock too.


The way that I recall it is like this:

gorhill created uBlock.

After some amount of time gorhill found that the uBlock project was taking up too much of his time.

gorhill handed over the uBlock project to someone else.

That other person or other group of people took the uBlock project in a direction that gorhill did not agree with.

gorhill decided that because of this, he should continue to maintain a version of uBlock.

Thus was born uBlock Origin.


Short version of it is, gorhill actually willingly gave the project away to a contributor who later started to ask for donations. This was not appreciated (hence the very explicit "no donations" policy gorhill now has) and caused a bit of drama and gorhill started developing his own version again. This part I didn't know, but apparently he's not that bitter about it as the guy who took over the project is quite young. https://github.com/gorhill/uBlock/issues/130#issuecomment-96...


If i recall correctly, they have the same name because they were once the same project. Renaming would likely break many workflows/bookmarks that people use to tell the difference. Maybe mirroring the existing repo to another with origin in the name would be a compromise?


>Can you rename repos in github?

Yes you can, and GH sets up an automatic redirect from the old name to the new name (as long as you don't create a new repo with the old name).


why on earth would they add their own beautifying code viewer to the extension. this thing has become bloat city


This is an auxiliary tool, it does not affect uBO's efficiency when not using the auxiliary tools (logger, viewers, etc.) You won't find a leaner content blocker than uBO CPU- and memory-wise, by quite a good margin, and this new auxiliary tool changes nothing about this.

Being a volunteer filter list maintainer is a thankless and time-consuming task, and when I myself investigate filter issues, I repeatedly have to go through the same steps which is looking at the source code of pages and JS resources, which most often are minified, and it's also difficult to navigate between the different resources back and forth. If you want to understand the benefits, I suggest you regularly try to contribute to filter lists.[1]

* * *

[1] https://github.com/uBlockOrigin/uAssets/issues


You help make the Internet more usable and less dangerous for countless people every day. This isn't to mention the real world impact of less power usage due to fewer assets being transferred and rendered (or executed.) Thank you!


I’ve never thought of it that way before, but between all the blocked ad payloads, cryptominers, and other malware that uBlock Origin stops from going onto millions of PCs every day, gorhill is probably one of the world’s greatest individual fighters of climate change.


Thank you for everything that you do with Ublock Origin.


Thank you for all your efforts!


Thank you soooo much!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: