▲ 292 points
back
128 comments
The title seems to be wrong, uBlock Origin supported it for many years at this point (only on Firefox). This seems to be a refactor of that code, not a whole new feature.
Well, it does support it now. It supported it before, too :P
i used to use ublock origin. i still do, but i used to, too
And there are at least 3 fish
It sounds to me like more than just a refactor, it now allows blocking based on ip earlier, before the request is actually made. Although, that isn't perfect because it doesn't know which ip address the browser will choose if there are multiple ips for a single domain.
Ok, I've reverted the title to that of the page. Submitted title was "uBlock Origin supports filtering CNAME cloaking sites on Firefox now". If someone wants to suggest a more accurate and neutral title, we can change it again. Github commits without additional context don't usually make for great HN threads though...
Something akin to "uBlock Origin CNAME uncloaking now supports filtering by IP address" should be fine.
It did not hit me yet, but I'm already rewriting my extensions to firefox to switch if Chrome really axes uBO
It's not if. It's when. It has been 'when' since 2020. It is coming. It is not going to not come. It will be here in mere releases. Get ready.
I am switching family over to Brave. They don’t even notice the difference and I’m more confident the browser will continue to support user centric content filtering.
It's already axed in canary release
> I'm already rewriting my extensions to firefox
What does that mean? Firefox uses the same API. At most you have to change `background.service_worker` to `background.scripts` (literally just rename the key)
For those unaware, what is uBO and how would it affect most extensions?
uBlock Origin is what makes Firefox even greater and definitely one big reason I use Firefox over Chrome etc. It make the Internet browsable.
I moved many years ago to this combo, and never saw a single reason to switch away. Same for android phone, the only usable mobile web experience I've seen. Those few sites over a decade that had some display issues had issues also under chrome.
Plus I personally consider ads a cancer of modern society. White and not so white lies, manipulation... nothing respectable regardless (or because ) of tremendous money circulating in it.
I really wish I could agree but sadly this has not been my experience with Firefox, and I have so many issues I've started to switch away recently. Wasting way too much time fighting with websites that turn out to work perfectly fine on Chrome, and the captchas I get on Firefox are becoming genuinely impossible for me to solve. I'm with you on the ads though, and glad it's working out for someone at least!
I mean there are appropriate applications for advertising (like classifieds in a newspaper), but there is no reason why advertising should be so pervasive that it requires a massive surveillance apparatus like it does today. Advertisements are the reason why everyone switched from TV to Netflix, and that's back when cable TV was a paid service.
secushare[1] makes the case that this is because the internet lacks a secure micropayments layer, so the funding model for everything has to be advertising-based instead of patronage-based. Paypal and the like are exploited as cash cows because of their centralized nature. Cryptocurrencies were later tried but have technical limitations that broadly prohibit this use case (even with payment channels/LN).
That may change since Mozilla is becoming an ad company
They are not, but they are adding in support for more anonymous ads as they see it as a “compromise”, I don’t but I also don’t think they are as malevolent as a lot of people on HN and Reddit like to make them out to be.
Honestly I’ve used brave and Firefox and don’t see a huge difference. I still prefer Firefox though because of its philosophy and status as coming from a nonprofit. Brave is a quality project too though, and is my back up, although sometimes I throw Vivaldi in the mix because of its windows splitting and much superior tab management.
Firefox is developed by the for profit company not the nonprofit org.
CNAME cloaking? Does this mean an ad site may use a randomly generated subdomain pointing to a wildcard record?
That's part of it.
Normally when you visit contentsite.com which serves ads from adsite.com. Adblocker rules can just block adsite.com and the ads won't be shown. CNAME cloaking would have the main site have a subdomain like adsite.contentsite.com point to adsite.com, now the adblockers have the impossible task of blocking millions of subdomains that seemingly belong to legit sites, this also allows the legit sites to keep changing the subdomain since the adblocker will have no idea which subdomains serve legit content vs ads. As a bonus since the content is being served from the same domain, they can bypass certain cookie browser policies and track users even better.
This update allows you to set rules so that you can filter by resolved ip.
i hope that this results in sites that host malicious ads and use wildcard session-cookies get hacked to all hell by their ads.
this reminds me of domainfronting, who was a super smart way to get around of ads and other sites blockers, not sure if it's all 'fixed' now.
Yes. Ads and analytics providers have started doing this to get around third-party cookie protections.
I always find this development curious. About a decade ago I worked in this space. When someone brought up ad blockers I just said "put the analytics on our main domain. No one is going to block the entire website". The answer I got was "no one would ever do that because of the implications of serving advertising from your main domain". Yet, here we are.
There is a part of me that, at a high level, appreciates the back and forth between the user and the ad industry. On a personal level, I am slowly getting to the point, where I am less.. uhh.. understanding.
That said, the average person's conception of what acceptable needs to change. I did briefly think that they need suffer through more ad-infestation first, but I realized that the answer is more in line with what my wife seemed to have gone through. The low exposure to ads made her less willing to deal with them. This might be the way forward.
It is hard for a person used to existing ecosystem to even imagine, there could be something better.
Randomly generated domains are a major red flag for abuse and malware detection, and seems to have become a rather large part of how the domain industry manage abuse. Domain "credit score" is also something that is used in the email industry to score links and thus spam values. A large part of providing score values is behind security companies that offer their service as a paid services, but as with a lot of this stuff there are a lot of movement to offer it for free similar to spam block lists.
It will be interesting when this kind of technology moves down to browser add-ons.
This a good example of why manifest v3 sucks. By definition, it can't do anything like this...no live code hueristics are possible.
It's a war of escalation with advertisers. Google is the arms dealer to both sides. They won't give you what you would need to win.
There's no reason why a declarative manifest v3 API couldn't offer this. If I'm reading the commit details correctly, it could work even better by being better integrated into the request flow to block the request on the actual IP address used before anything is sent to the servers.
Of course, this all relies on browser vendor (Google) wanting to add this API. Doing this imperatively with "live code" allows for innovations in userland before browser makers add built in support for it.
>This a good example of why manifest v3 sucks. By definition, it can't do anything like this...
Technically manifest v3 has nothing to do with APIs that the browser makes available to extensions. On firefox manifest v3 is supported with blocking web request[1], which is the filtering api prior to "manifest v3". Therefore the statement that it certain functionality "by definition" is false.
[1] https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...
Abandon Chrome, embrace Firefox.
As an example of what CNAME cloaking is, let's say that a SAAS provider A wants to provide you, company Q, with fancy ad tracking software. In the olden days, they'd tell you to embed a script at e.g. https://A-ads-tracking.example into your website at address https://q-company.example
To block those ads, blocklists that uBlock Origin use have rules then that say "block requests being made to the domain name A-ads-tracking.example", which blocks the ads.
CNAME cloaking is where SAAS provider A sets up their ad-tracking services not on domain A-ads-tracking.example, but instead at a specific IP address of e.g. 29.1.2.3; then (and here's the important part) SAAS A tells you Company Q that you need to set up a subdomain of q-company.example which has a CNAME record pointing to 23.1.2.3, a subdomain with an innocuous name like media.q-company.example; once you've set up that CNAME, you at Company Q add a script tag to your website for `media.q-company.example` and now SAAS A is able to track all the users on your site. This indirection allows for effectively infinite cat-and-mouse on the part of you the owner of the Q Company vs the blocklists that the public assemble.
To get around this CNAME cloaking problem, the software powering extensions like uBlock Origin need to be able to see not only the destination domain of requests by browsers, but the underlying IP addresses of those domains as well. This commit makes that behavior possible, or at least is related to making that code work better.
That's not quite right; as the name suggests, it uses CNAMEs (which point to other records), not A records (which point to IPs). So you would have something like `media.q-company.example` as a CNAME to `q-company.ads-tracking.example` which then has an A record to give an IP.
Browsers might not offer intermediate DNS names to extensions (I don't know), so something like uBlock might need to rely on IP lists, but DNS-based filtering like pihole should just block it by a rule against `ads-tracking.example`. In any case, it's good to use both browser based and DNS based malware blockers.
Thank you for the breakdown!
And this is a good reason to block all JavaScript in unlock advanced and slowly whitelist the scripts you see until the site works properly. Slow and error prone but once you get used to it it's a breeze. And you're completely immune to this sort of shittery.
Is chrome going to block uBO im never up to date on the latest. I do know theyre allowing 3rd party cookies now... so maybe theres a chance
They're not blocking uBO, they're removing the features in the browser that allowed uBO to work by releasing new plugin APIs, "Manifest v3". They're eliminating the key APIs needed for uBO to identify things that it shouldn't load, and then not load them. Google claims this was for "performance" or "security" reasons. Of course, the only major 'performance' or 'security' affected is the ability to identify, intercept, and stop harmful or ad related downloads before they start.
Not updating your browser is also hazardous - much better to switch to FF, and have a browser that gets updates and also fully supports uBO.
They’re doing a slow phase-out over a long time to try to avert a wave of bad publicity that threatens their browser monopoly, but that timeline has already started as of June.
https://developer.chrome.com/docs/extensions/develop/migrate...
https://www.bleepingcomputer.com/news/google/google-chrome-w...
For right now, uBlock Origin is still on the Chrome Web Store for Chromium browsers which support Manifest V2. If you use a Manifest V3 only version of Chromium, it is hidden.
Honestly, it probably is going to depend on whether the US continues to have an administration that's willing to take blatant monopolists to court.
Don't some DNS servers implement something that acts like a server-resolved CNAME, where the admin puts in a record that points to some other DNS name but the client just sees an A (out AAAA) record?
I think you are referring to ALIAS records
uBO has had this feature for awhile, since 1.34.0 (or 1.25.0 in advanced settings).
https://github.com/gorhill/uBlock/wiki/Dashboard:-Settings#u...
I think that's around 2021 time frame. FYI.
What is the uBI status on Brave, Edge and Opera?
I don't care about the two proprietary browsers you've mentioned, but Brave is going to (partially) support manifest v2 and maintain uBO compatibility for as long as they're able to:
https://brave.com/blog/brave-shields-manifest-v3/
Not that you really need it as Brave has its own very capable built-in ad blocker with -- last time I checked -- higher performance than uBO (since it's compiled into native code) and full support for same ad lists.