Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome disabling uBlock Origin is a serious security threat

nuage.quimerch.com

Post reply on HN
Print view View original

71–80 of 91 posts

Re: Chrome disabling uBlock Origin is a serious security threat

#71

Post by nickthegreek »

tjpnz wrote: post #35
TekMol wrote: post #10

I guess it would be easy to block ads via a proxy? An http proxy in Python is just a few lines of code. It could simply drop the requests to known ad servers. And in Chrome, there is a setting to use a proxy. So all one had to do is run ./my_ad_blocking_proxy.py and set the proxy in Chrome to something like 127.0.0.1:8080?

AdGuard does a good job if you're happy sending them your DNS queries. You'll still want to adopt a layered approach however, and that will involve a browser based ad blocker.

I second setting up AdGuard. It is the simplest solution for non-techies to use to help mitigate the problem here wihtout switching browsers. Although I would recommend doing both.

Re: Chrome disabling uBlock Origin is a serious security threat

#72

Post by soraminazuki »

nijave wrote: post #38
soraminazuki wrote: post #31

Earlier quoted context omitted.

Advocating for the entire browser landscape to be taken over by Chromium is definitely not a middle ground. It's letting the world's largest ad company be the dictator of the web.

I never advocated for that. There's nothing saying a fork has to be 100% in sync with upstream and can cherry-pick what parts it wants to keep. Besides that, there's other Blink-based browsers which are very similar but another level removed from Google Using a fork to work around Google marking addons are malicious seems like a middle ground between "living with ads" and "using a whole new browser the author has pol…

I don't see the difference. Unless the forks become completely independent, Google will have an outsized influence over them. If Firefox goes down without a replacement independent of Chromium, it'll be the end of the open web.

Re: Chrome disabling uBlock Origin is a serious security threat

#73

Post by kmlx »

solardev wrote: post #25
TekMol wrote: post #10

I guess it would be easy to block ads via a proxy? An http proxy in Python is just a few lines of code. It could simply drop the requests to known ad servers. And in Chrome, there is a setting to use a proxy. So all one had to do is run ./my_ad_blocking_proxy.py and set the proxy in Chrome to something like 127.0.0.1:8080?

No, it takes way more than that. That's basically what running a Pihole does, which barely blocks anything these days. Good ad blocking requires you to be able to look at decrypted HTTPS traffic and remove content from the DOM, including stuff added after the fact by Javascript. That's why uBlock Origin works better than Adguard (which is a https MITM ad blocker) and why Adguard works better than Pihole (which doesn'…

> Good ad blocking requires you to be able to look at decrypted HTTPS traffic and remove content from the DOM, including stuff added after the fact by Javascript.

ironically this also sounds like a security nightmare.

Re: Chrome disabling uBlock Origin is a serious security threat

#74

Post by tucnak »

nijave wrote: post #52
tucnak wrote: post #47

Earlier quoted context omitted.

The reason Firefox feels slower is because it uses a subpar caching strategy that's minimizing RAM usage. Otherwise, they could no longer claim Chromium is "wasting memory" which is Firefox-speak for "we refuse to implement comprehensive caching"

iirc more about:config tweaks from FasterFox project helped a bit. Anecdotally, I've never seen Chromium be any more or less memory efficient (well maybe 10 years ago but not recently). For the longest time, if you left Firefox sitting open > than 1-2 weeks it'd start leaking memory to the tune of 10s of GB Chromium is pretty good about suspending pages when it's left sitting for long periods of time

Chromium is amazing about suspending pages, & evictions in general. They maintain multiple levels throughout the render pipelines, and because the tabs are composed of individual processes, it can trade-off somewhat against kernel. This is what a comprehensive caching strategy is: a layered, machine-aware strategy that is both aggressive and predictable under real workloads. It wasn't always perfect, but it's pretty near-perfect these days. And this is not even considering V8 and the talent pool it has acquired due to quality engineering and the network effect that came from it.

Firefox engineers are trying, and you cannot blame them (like you would blame Mozilla) because it has not seen the kind of commitment from industry talent that Chromium. There have been multiple re-writes of major components in Chromium, and they tried really hard to keep the codebase somewhat up-to-date. Firefox is comparatively dated, it's not at all sexy; had people understood this, they wouldn't be so quick with jumping to conclusions, & all. There are many objective, engineering reasons why Firefox is lagging behind the gigantic Chromium+V8 ecosystem of browsers and JS backend industry. For some champagne-socialist reason, it's really vogue to call for Firefox adoption, donating to Mozilla, etc. However, it's rarely an argument made on merit. I think, they just hate to admit that Google has largely succeeded in elevating Chromium to the likes of Linux. If you're making a browser in 2025, unless you're making an artistic point a-la privacy, or contra Chromium specifically, you would rather pick it up at upstream like you would pick up Linux, instead of re-inventing the kernel because Linux bad. That is not to say that OpenBSD, or whatever, Plan9—is without merit, just that it wouldn't surprise anybody had you picked Linux for the job. If you hate Google's SWE people, or its leadership that ostensibly could sway the course of Chromium development, then this is probably really painful! If you don't hate them, you just carry on about your business. And so everyone complies. Because why the hell wouldn't you? There's battles to fight, and there's the other kind.

It doesn't help that Mozilla is cutting the branch from underneath itself.

Re: Chrome disabling uBlock Origin is a serious security threat

#76

Post by aceazzameen »

asterios33 wrote: post #16

"There are a few alternatives available. Unfortunately, moving to Firefox may not be a viable option for her, especially given Mozilla’s recent behavior." The world has gone crazy. So this relative has casually used the most bloated spyware disguised as a browser for literally a decade, but she can't switch to firefox because 'Mozilla’s recent behavior'.

At this point, I wouldn't be surprised if the complaints I see against Firefox is a campaign to keep people on Chrome. But more likely it's just an excuse due to laziness. Either way these people can be dismissed outright.

Re: Chrome disabling uBlock Origin is a serious security threat

#77

Post by solardev »

kmlx wrote: post #73
solardev wrote: post #25

Earlier quoted context omitted.

No, it takes way more than that. That's basically what running a Pihole does, which barely blocks anything these days. Good ad blocking requires you to be able to look at decrypted HTTPS traffic and remove content from the DOM, including stuff added after the fact by Javascript. That's why uBlock Origin works better than Adguard (which is a https MITM ad blocker) and why Adguard works better than Pihole (which doesn'…

> Good ad blocking requires you to be able to look at decrypted HTTPS traffic and remove content from the DOM, including stuff added after the fact by Javascript. ironically this also sounds like a security nightmare.

Yeah, especially since Adguard was originally Russian (they moved to Cyprus though).

But the web is unusable without ad blocking, IMO. Necessary risk.

Re: Chrome disabling uBlock Origin is a serious security threat

#78

Post by nijave »

tucnak wrote: post #74
nijave wrote: post #52

Earlier quoted context omitted.

iirc more about:config tweaks from FasterFox project helped a bit. Anecdotally, I've never seen Chromium be any more or less memory efficient (well maybe 10 years ago but not recently). For the longest time, if you left Firefox sitting open > than 1-2 weeks it'd start leaking memory to the tune of 10s of GB Chromium is pretty good about suspending pages when it's left sitting for long periods of time

Chromium is amazing about suspending pages, & evictions in general. They maintain multiple levels throughout the render pipelines, and because the tabs are composed of individual processes, it can trade-off somewhat against kernel. This is what a comprehensive caching strategy is: a layered, machine-aware strategy that is both aggressive and predictable under real workloads. It wasn't always perfect, but it's pretty…

Thanks for the details on cache & agree with the rest

LadyBird and Servo are both interesting projects however I imagine still many years out of their succeed

Re: Chrome disabling uBlock Origin is a serious security threat

#79

Post by never_inline »

irjustin wrote: post #14

I'll go against the grain and say this is not a security threat. if missing ublock is a true security concern you shouldn't be using chrome. Because the opposite is not true - that chrome+ublock is keeping you secure from tracking. We just don't want to see ads. Isn't that enough?

Many people here install ublock for elders and / or children and leave it. Now they might become target of ads that download malware.

Re: Chrome disabling uBlock Origin is a serious security threat

#80

Post by timbit42 »

gruez wrote: post #63
nijave wrote: post #43

Earlier quoted context omitted.

There are malicious ads and dark patterns around ad design to trick users into clicking them. I don't think it's security in the "vulnerability" sense or "privacy" sense but more in the "phishing prevention" sense. Think of those "click here to OPTIMIZE YOUR PC" adware junk you'd prefer anyone you provide tech support for to never see

Those ads aren't being blocked by ublock lite?

Clients that lost uBO and I put Lite on are getting hit with malware. It may be correlation but it looks like causation.
Post reply on HN