Item — HN Reader

I'm supposed to be the master, actually. It's my computer, any foreign code is essentially a subject in my digital domain. It should be literally impossible for them to do something I don't want them to do. As the god of my little digital realm, I should have maximum power and freedom, while foreign developers get the absolute minimum amount of power that works, and in the ideal case this minimum is zero.

The fact someone gave developers a turing complete language inside the browser where random code is automatically downloaded and executed is a major reason why we even have uBlock Origin in the first place. The vast majority of developers heavily abuse this privilege and cannot be trusted, and that is why we block them with extreme prejudice.

4 comments

I agree that we should able to be fully in control of what we run on our machines, but that should also include being able to decide who we trust to mark , or gatekeep, code as trustworthy. Both having to run code from any random website, and having to trust exactly one mega company, means you are not the master.

This is the way. The owner of the computer should be the ultimate authority over what gets run and not run on that computer. Not Microsoft. Not Apple. Not Google. Not Mozilla. Not some web site developer.

I think nobody is against the availability of sandboxing tools for browser extensions - they just want them to be options and not requirements or defaults.

We seem to have a similar philosophy. Have you found a good way to deal with modifying or selectively disabling things like webpacked js or react?

I've tried everything from relying on uBlock Origin's anti-sabotage injections to literally reverse engineering websites and directly using all the internal APIs their own javascripts consume.

My dream was to have a "custom HTTP client" for every website. Instead of one browser for all sites, I write "adapters" for them that scrape the data into my own schemas. Maintaining this was far too much work back then, but now that I've got AI... I think I might try it.

>uBlock Origin's anti-sabotage injections

Do you mean the rules like

    *##+js(acis, document.oncontextmenu)

(an example I just added (copied) today)? I've had a lot of trouble figuring out how to make these properly.

>reverse engineering websites and directly using all the internal APIs their own javascripts consume.

Interesting. By userscript or some other way? I've run into a number of situations where I either can't find a pointer to the internal js, or if I do find one, the browser or something ends up preventing me from accessing or modifying internal state with some sort of permission error. The latter might just be React though.

I'd be very interested in looking, if you have open sourced any of this.