Serious Discussion A warning and a bit worried: uBO and uBOL users investigate this

@LinuxFan58 has highlighted a powerful feature that could be misused, though this does not prove that anyone has actually used it maliciously.

The filter lists you’ve been using for years are the best guarantee that nothing has happened so far and that nothing will likely happen in the future either, because the teams managing those filter lists are on the side of the “good guys,” not the “bad guys.”

My advice:

Limit the number of filter lists you subscribe to (the usual advice) and use filter lists with a proven track record.
 
Sampei.Nihira said:
@LinuxFan58 has highlighted a powerful feature that could be misused, though this does not prove that anyone has actually used it maliciously.

The filter lists you’ve been using for years are the best guarantee that nothing has happened so far and that nothing will likely happen in the future either, because the teams managing those filter lists are on the side of the “good guys,” not the “bad guys.”
Click to expand...
This only applies to uBo and specifically uBO-filters, not other filter lists or extensions.

The json-edit.js scriptlet capabilities are a risk, but not an active threat!
The "only" way to abuse these capabilities is through a supply chain attack (one of the uAssets maintainers turning bad). The identification and authorization process of Github is weak, uBO assets team onboarding is the achilles-heel in this process. that is something that needs attention.

Nothing will likely happen in the future, because the teams managing those filters are on the side of the "good guys" is questionable IMO
It is as sound as saying cops and civil servants are the good guys, so there are no corrupt cops or civil servants. Your advice to carry-on is as sound as Chamberlain's ¨peace for our time, you can all go home and get a nice quiet sleep" advice (we all know how that panned out). 😱
 
Last edited:
I checked json-edit.js in the uBo filters (which, as far as I can tell, all refer to specific websites - Youtube.....Facebook....):

uBlock Filters -Ads = 68
uBlock Filters - Badware Risk = 0
uBlock Filters - Privacy = 1
uBlock Filters - Quick Fixes = 4
uBlock Filters -Unbreak = 0
 
LinuxFan58 said:
My advice:

1. Disable trust for UBO-filters in the advanced settings
2. Replace EasyList with AG+Easylist optimzied (a combined filter of AdGuard)

AG and uBO share 80% of the scriptlets, so you probably won´t notice any difference while browsing.
Click to expand...

I've been using AG+Easylist Optimized for some time now:

Which Ubo filters do you use ? | Page 15 | MalwareTips

I don't really use all those filter lists today.

Regarding tip #1, my AI would have advised me yesterday against making this change, considering my entire security configuration, which it has been analyzing line by line for some time now.

It’s always a pleasure to talk and/or debate with you.
Even though we don’t always see eye to eye, I believe we both give a lot of thought to what each of us writes.

P.S.

Today is my wife's birthday, and she'll receive lots of birthday wishes from her relatives in Germany—she was born in Koblenz.
We're both Libras, so my birthday will also be in October.;):cool:
 
Last edited:
uBlock-Stripped has 16 out of the box privacy & security enhancements for users not bothering to invest time in constructing fine grained scriptlet protections (like Sampei-san).

I just make specific protection scriptlets (e.g allowing only safe use of Eval, blocking only command line writes to clipboard as Clickfix defense etc), with one important limitation: they will never require trust or user script permissions.

Another extra is the use of Sandbox Content Policies (a build in Chrome feature), no need to allow unsafe long scriptlet imports or give scriptlets super powers.

Be humble use what is already available and proven is Google's number 1 design and programming principle. When you can't solve a problem, step back, widen your scope and rethink the application of existing modules.
 
Last edited:
But he is a great programmer, it took many iterations to break down large JS modules into smaller easier to maintain pieces.

I think he created on purpose a few monsters modules to prevent copy-cat coders offer uBO-clones only with some UI changes and some questionable code added (which happened a lot in the beginning when CWS had little build-in checks).

The monster monoliths looked like a big spagetti bowl, but when you analysed the workflows of the functions it looked more like a bowl of macaroni (security through obscurity).
 
Last edited:
I conducted a more thorough analysis.

uBlock Filters - Privacy = 1
uBlock Filters - Quick Fixes = 4

They do not have any “trusted-json-edit” entries (which we’ve been discussing as potentially harmful in this thread), so all of these filter lists can be left enabled.

On the other hand, uBlock Filters – Ads has 45 “trusted-json-edit” entries, but as I explained earlier, based on what I’ve been able to analyze in this short period of time, they are all tied to specific websites.
And only 11 are “trusted-json-edit-xhr-response,” which are also strictly tied to specific websites:

1.png

So these are very specific anti-ads rules.
Some users may want to consider disabling only this filter list.

P.S.

I won't be doing that.
Of course, it's much more difficult to analyze those js in uBoL.
 
Last edited:
LinuxFan58 said:
@Jan Willy

Did you also reduce number of UBO-filters, e.g only use quick fixes
Click to expand...
Normally I don't use uBO's experimental filter. The other uBO filters I do.
After removing 'ublock' from the setting 'trustedListPrefixes' the uBO filters show following number of errors:
Ads 598
Badware risks 1
Privacy 252
Quick fixes 98
Unbreak 15
Ublock Cookie notices 2012

BTW, I don't use any other specific ad filter as uBO Ads and adblock-youtube-ads.
Non-uBO filters don't show errors.
 
7Oz-64 said:
@LinuxFan58
your old friend:ROFLMAO:;), Brummelchen seems to disagree : https://www.wilderssecurity.com/threads/ublock-a-lean-and-fast-blocker.365273/page-361#post-3286957
Click to expand...
His quote explains a lot!
Brummelchen said:
"..users should not speak about things they never had understood.."
Click to expand...

Learning starts with discussing things you DON'T understand.
A forum is an online meeting place to discuss stuff, and to share and gain knowledge.
Quite hilarious he shares this wisdom on a forum :ROFLMAO: no wonder WS community is dropping in numbers.
 
Last edited:
nickstar1 said:
Has anyone received a response from the extension creator regarding this issue? Just curious about what their opinion is or would be.
Click to expand...

I’ll take a guess.

Answer:

What’s the issue? :oops::unsure:
Where, how, why......:oops::unsure:

I got “kicked in the teeth” when I pointed out on uBoL that the Firefox.signed version was still available even a month after the previous one, that it wasn’t their problem, etc...etc....etc....

Today, the Firefox.signed version is immediately available with every new release of uBoL.

This is my final, definitive report.
I don’t think @LinuxFan58 will waste any time either.

So good luck to anyone who wants to report it.(y)(y)


Just look at the tricks Fate plays on you sometimes........
 
Last edited:
nickstar1 said:
Has anyone received a response from the extension creator regarding this issue? Just curious about what their opinion is or would be.
Click to expand...
@Sampei.Nihira is right. The responses to suggestions or questions is sometimes strange (and when you asks questions like what happened with the permission less philosophy you get unpleasant answers).

I have asked questions regarding the code which were never answered, but this seems to be standard procedure (to ignore). Someone has forked uBol and solved a problem, but the code change is not accepted (link), it is a solution for issue (link), reported by another user, but it states ¨this branche has not been deployed".
 
Last edited:
It’s interesting to note that sometimes a scriptlet from the uBlock filters can cause the webpage layout to break.

Very few users know how to check for this.
(Me,Yuki2718,LinuxFan58,Mr. Hill.....)

You need to search the log for the offending line, which is dark yellow.
Although there are often as many as 10 such lines.
In this case, the usual “block/allow” rule feature isn’t helpful.
You’ll need to do everything manually.

So, find the filter causing the malfunction.
Write the exception rule.
And add it to “My Filters.”

I believe that AI is NOT capable of performing this difficult task.
Although, of course, I haven’t tried it.

In the image below is a scriptlet—still incorrect—in uBlock Origin, located in:

  • uBlock filters – Ads

which causes the issue described above, as can be seen in the image below:

1.png

which I corrected.;)(y)

With UD, you won't have this potential problem—which, I must admit, is quite rare.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top