Advanced Security Linux Mint Cinnamon Wayland setup

[Sampei.Nihira]

Add an exe rule to your rules.
If that doesn't work, none of the others will provide the protection you need.

Out of curiosity, if you press the button,

"proceed anyway"

on the AG block page (now), does it work?

 

[LinuxFan58]

Add an exe rule to your rules.
If that doesn't work, none of the others will provide the protection you need.

Out of curiosity, if you press the button,

"proceed anyway"

on the AG block page (now), does it work?

I checked the AG rules work, either it is silently blocked (third-party) or throw a AG block page (first-party), I tested with abuse.ch entries

 

[piquiteco]

One last thing, otherwise I'll be rocking the boat too much, but I don't think your rules for blocking downloads from GitHub (etc.) are correct for blocking malicious executable downloads.
URLhaus | Checking your browser

This first sample URL is already blocked by the uBlock Origin filter "Online Malicious URL Blocklist" If you proceed with uBO, it is immediately blocked by McAfee WebAdvisor and Kaspersky, as you can see in the second screenshot below.

Spoiler: uBlock Origin Block "Online Malicious URL Blocklist"

Spoiler: McAfee WebAdvisor and Kaspersky Block

URLhaus | Checking your browser

This second sample URL was even more incredible. The block was performed again by the uBlock "Online Malicious URL Blocklist" filter list, and then by uBlock, followed by a block by McAfee WebAdvisor. Although McAfee WebAdvisor blocked it, it failed and did not prevent me from downloading the malware sample. Even so, when I clicked to save it, Norton Safe rose from the ashes and sprang into action, preventing me from downloading the sample, as you can see in the third screenshot below this post. This was the first time I saw Norton Safe spring into action, and I was surprised that it prevented me from downloading the zip file.

Spoiler: uBlock Block "Online Malicious URL Blocklist"

Spoiler: McAfee WebAdvisor Block Failed

Spoiler: Norton Safe Block Download Failed/Download Cancelled

 

[Sampei.Nihira]

From version 1.86 Brave browser allows you to disable the default blocklists (when you enable brave://flags/#brave-adblock-show-hidden-components) .
Finalized tweaking extensions and filter usage for best compatibility and performance (work profile with 19.1 score on Speedometer 3.1) and best blocking and security (surfing profile with 18.5 score on Speedometer 3.1). I disabled Brave's tracking filter (replaced it with Peter Low's) and first-party filter (replaced it with Custom rules).

Spoiler: Best of both worlds two browser profile approach

View attachment 294726

Finally achieved same speedometer 3.1 benchmarks in Linux with Brave in Flatpak sandbox as my wife (on same HP laptop) on Windows 11 running standard user with Chrome and only Avira Safe Browsing extension (with its conservative anti-tracking) enabled.

Peter Lowe's Ad and tracking server list is excellent (same total rules) for use at the DNS level.
If you still have OISD and change your choice with HaGeZi, Peter Lowe's list is in the sources used.

 

[LinuxFan58]

@Sampei.Nihira

I prefer to block malware at DNS level and advertising and tracking in the browser. By replacing Brave's build-in anti-tracking filter with Peter Low's and Brave's build-in first party filter with custom cosmetic rules (in Brave), the rule count should have been reduced to a 1/3 (and Speedometer benchmark upped from 18.1 to 18.7).

I am fine as it is now and start applying the "don't fix what ain't broken rule"

 

[Parkinsond]

I prefer to block malware at DNS level and advertising and tracking in the browser

The same policy; Hagezi TIF at DNS level and Easylist at browser level.

 

[Sampei.Nihira]

Work in progress !!!

When you have finished customizing, please change what still says AG.
It's quite difficult for me to follow...
I assume it's the same for other forum members.
Thank you.

 

[Sampei.Nihira]

Yes, you are right (tried to cheat against the "don't fix what ain't broken" rule by editing the posts, which you as elite investigator noticed immediately )

Switched back to AdGuard again, because it is easier to trouble shoot (using log) and has a blockpage (triggered by $document for first-party)
View attachment 294751

Spoiler: AG blockpage when clicking link on Abuse.CH

View attachment 294752

I also split the $all rule for hosting services known to host malware phishing (like GoDaddy, Weebly, Hostinger and NameCheap). Bij splitting the $all rule in document and third-party, any website blocked has a fair chance of functioning after choosing 'Proceed anyway' button.

I still use $all for blocking file sharing services often hosting malware (e.g. anonfiles, discord.com/attachments, file.io. gofile.io, hastebin, ix.io, pastebin.com, pixeldrain. tmpfiles.org, ufile.io, uploadfiles.io, volafile.org, zippyshare) and Linux executable and script formats hosted on popular coding platforms (like bitbucket, github, githubusercontent, gitlab and sourceforge).

Latest 10 https links on phishtank: AG blocked 7, Cloudflare ZT 2, Google safe browsing 1

View attachment 294753

I had opened a problem in October 2025, but......

[investigate] $document block rules malfunction · Issue #3338 · AdguardTeam/AdguardBrowserExtension

 

[Sampei.Nihira]

@LinuxFan58

After lunch is better...

Let's analyze your fourth rule, which I also use (with only 9 TLDs).
Block 3p + 3p scripts + 3p frames (Hard Mode effect) + list of allowed TLDs.

The third rule blocks all websites outside the list.
I prefer to block 1p scripts from all websites outside the TLD list.

Because, in my opinion, my choice is more consistent.
Let's take a website outside your TLD list, for example, Chilean (.cl).

In my case, a Chilean website finds Hard Mode + 1p script block, probably usable, depending on the websites, but with very strong protection.

In your case, the third rule that completely blocks the Chilean website renders the fourth rule useless, as it will never apply Hard Mode outside the TLD list.

Think about it.

The Clinic | Reportajes, columnas, entrevistas, humor, memes y más.

 

[LinuxFan58]

@LinuxFan58

Think about it.

The Clinic | Reportajes, columnas, entrevistas, humor, memes y más.


View attachment 294762

When I click on the link, the Top Level Domain firewall rule in AdGiard shows a blockpage

After I choose Proceed anyway, I can acces the website

While third-party connections outside Schengen and 5 Eyes are blocked ,

Above behavior is exactly what I want, what am I missing, please explain?

 

[Sampei.Nihira]

As you can see, your image is identical to mine, but I also have the 1p script block.

So total protection against XSS clients.
Total protection against JS fingerprinting.
First-party tracker blocking...

Ask the AI this simple question:

"Does blocking only 3p + 3p scripts + 3p frames eliminate all possible privacy/security issues?"

Of course, I occasionally have to write a 1p script exception rule.
But with only 9 TLDs, there are only 5 exception rules so far.
It's not a big deal for me.

Have a good evening.

 

[LinuxFan58]

After six days od no False Positive (AdGuard TLD firewall breaking websites), I replaced AG by uBol (is a tad faster in Speedometer 3.1 than AG, 18.8 in stead of 18.7)

EDIT and yes the 8th day I encounter a TLD block again, so reverted back to AdGuard (using the log function I see what is blocked)

In the past I had two classic bikes and could spend saturdays fiddling with carburetors, needles, yets and pre-ignition to optimize the engine. I recognize the same tweaking frenzy with uBol and AG in my two Brave profiles.

 

[Sampei.Nihira]

I hadn't read about this recently added trick.
With two profiles, it's perfect with minimal effort.
Congratulations.

.........and uses invert allow list feature of AdGuard........

 

[LinuxFan58]

Added policy specific explanation to personalized Cloudflare block page.

Spoiler: Cloudflare Zero Trust firewall policies

Rule 8 (partly), 9 are only effective when the bad-guys don't use a Content Delivery Network with server hubs in the whitelisted resolved IP geo locations. According to latest data nearly 80% of the "advanced" attacks from well known adversaries use trusted services (bypassing these rules). Reversely 80% of the unsophisticated attacks are delivered locally (that is why these rules often trigger block screens when playing with URLhaus links).

 

[Sampei.Nihira]

Added Microsoft Defender Browser Protection as only extension to my work profile.

Spoiler: because it matches my Cloudflare block page screen colour :-)

View attachment 295385

It seems to me that it is no longer actively supported.
The last update was almost a year ago.

 

[LinuxFan58]

Back to 1 profile in Brave again added Advertisements content category in Cloudflare Zero Trust with uBlockOriginLight in basic mode with all filters disabled and only (at the moment) 35 Custom cosmetic rules and 35 DNR rules. I occasionally enable Brave Adshields for a website (which Brave forgets when closing the browser).

uBol has a problem that when disabling protection somtimes DNR rules are still applied through Chromium mechanisms (the rules which are only updated when the extension is updated). I discovered that this is not the case when using custom DNR rules because these are implemented as dynamic rules (of Chromium is something totally different than Mv2 uBO's dynamic filtering).

So I copied the Kees1958 EU + US most used (around 1700 ABP-rules) into Custom DNR and they converted to ONLY 1 DNR rule

 

[Sampei.Nihira]

Back to 1 profile in Brave again added Advertisements content category in Cloudflare Zero Trust with uBlockOriginLight in basic mode with all filters disabled and only (at the moment) 35 Custom cosmetic rules and 35 DNR rules. I occasionally enable Brave Adshields for a website (which Brave forgets when closing the browser).

uBol has a problem that when disabling protection somtimes DNR rules are still applied through Chromium mechanisms (the rules which are only updated when the extension is updated). I discovered that this is not the case when using custom DNR rules because these are implemented as dynamic rules (of Chromium is something totally different than Mv2 uBO's dynamic filtering).

So I copied the Kees1958 EU + US most used (around 1700 ABP-rules) into Custom DNR and they converted to ONLY 1 DNR rule

Even when selected:

"Automatically reload the page when you change the filter mode".

__________________________________________________________________________________

Can you explain the filtering method better within/outside TLDs?

 

[LinuxFan58]

Even when selected:

1 "Automatically reload the page when you change the filter mode".

__________________________________________________________________________________

2 Can you explain the filtering method better within/outside TLDs?

1. Yes, but it seems to happen in basic mode mostly (then uBol has no running processes of itself, only uses Chromium)

2. Not using TLD filtering at the moment (because I went back to 1 profile for all).

 

[LinuxFan58]

uBol used to get my the highest Speedometer 3.1 benchmarks, but after latest update it fell back to 18.5 to 18.6. So I tried Adguard again and Brave Shields. When I disable CSP and Procedural filtering in Brave://flags for Brave shields and I enable only Brave AdShield (with Kees1958 and my custom rules), I am getting the highest speedometer 3.1 benchmarks (18.9 to 19.1).

I know it is useless tweaking, but when I have to wait for some jobs to finish in the evening every fortnight, I either play a game of chess or kill the time with some benchmarks every fortnight when there is nothing interesting to read on MT and my bookmarked news websites.

 

[Sampei.Nihira]

Read this:

Poll Thread '[2026] What power plan do you use on your PC?'

Feb 14, 2026

What Power Plan do you use in your PC?

• Sampei.Nihira
• Replies: 17
• Forum: Member Chat

• 

https://forums.linuxmint.com/viewtopic.php?t=462863

Perhaps without making these constant changes if you set "performance" permanently, and not temporarily as in the link.

It's just an idea, think about it...