Advanced Plus Security Max90 Security Config 2023.

[Max90]

Corrected thanks

 

[Max90]

I liked MBAM Browser Guard, but back to AdGuard MV2 again with following filters
- Kees1958 EU US most used ads & trackers networks
- Kees1958 EU US most used URL trackers
- LennyFox Allow list for Dutch payment services
- LennyFox Youtube without ads
- LennyFox News websites without ads

and Jan Willy's easy-medium mode for Adguard with extra warning for Most Abused Top Level Domains (second rule with $document)
||*$third-party,script,subdocument,denyallow=NL|BE|DE|UK|EU|com|org|net|io
||*$document,domain=adult|porn|sex|sexy|xxx|webcam|cam|live|date|cyou|casino|poker|bet|best|win|racing|top|uno|support|help|email|stream|surf|site|work|review|info|review|icu|xyz|sbs|bid|moe|casa|club|rest|life|quest|gives|fit|monster|tokyo|asia|cn|ru|su|tk|pw|cc|ws|vg

Spoiler: AdGuard warning

Because of Jan Willy's rule, the third-party surface exposure is limited, allowing to create a simple strict warning ($document) rule for most abused TLD's.
For trusted websites, just add a denyallow to the end of the second rule (e.g. ......pw|cc|vg,denyallow=hardware.info)


PS. I noticed Kees1958 has updated his lists again

 

[Max90]

Set all Edge security and anti-tracking to STRICT again, therefor installed uBlockOrigin again (to see what Edge anti-tracking is missing),

uBlockOrigin (cosmetic filtering off) with the following lists
- Kees1958 - EU US most used URL trackers (remove parameters from URL)
- LennyFox - News websites without ads (for these websites Cosmetic Filtering Enabled)
- LennyFox - Videos (like Youtube) without ads

My filter rule: ||*$third-party,script,frame,to=~NL|~BE|~DE|~UK|~com|~io|~net|~org

 

[oldschool]

Kees1958 - EU US most used advertising supplement for Edge and Firefox build-in

I find this makes for troublesome breakages which I can't figure out.

 

[Max90]

I find this makes for troublesome breakages which I can't figure out.

I have removed it also, would not play a video on cnn, relying on Edge STRICT blocking plus some own created rules.

 

[Max90]

Had some issues with website functionality breaking. Therefore EDGE anti-tracking and security back to basic and also removed all adblocking filters in NextDNS.

To keep the number of rules under 30.000 (no need with MV2) I used a trick by
1. Disabled cosmetic filtering and deselected importing and applying cosmetic rules in filter lists.
2. Copying LennyFox news websites and video (youtube) filter lists into My Filters and enabled cosmetin filtering for all websites in My Filters.
3. Only using the following filter lists
- AdGuard URL parameter filter
- AdGuard optimized Base + EasyList advertising
- AdGuard optimized tracking protection

Total number of network rules 24.138 with 60 cosmetic rules

 

[oldschool]

Had some issues with website functionality breaking. Therefore anti-tracking and security back to basic and used a trick to ...

I'm enjoying using straight medium mode. For me, it's just easier to use instead of trying to find different combos of filter lists, rules, etc. But variety is the spice of life, eh?

 

[Max90]

I'm enjoying using straight medium mode. For me, it's just easier to use instead of trying to find different combos of filter lists, rules, etc. But variety is the spice of life, eh?

Do you have filters enabled with straight medium mode?

I have spend a lot of time tweaking and micro managing my AdBlocker, may be it is time for a looser approach, thanks for the wise words.

 

[oldschool]

Do you have filters enabled with straight medium mode?

Yes, most default lists plus some extras, some of which I probably don't need.

 

[Max90]

Could not sleep because I just returned from work abroad. I always seem to have more problems to overcome jetlag flying eastward. On Saturday my wife goes shopping with her friends, so I made two image backups (of my desktop and her laptop) and did a fresh install of Windows11 to see whether i could Smart Application Control working on her laptop.

By tweaking the registry key I could force SAC on without problems. Because I had Avast Free on her laptop I decided to keep it and I was also able to add H_C SRP to the mix (by setting the AppLocker rule count to zero). Only downside was that I could not run her favorite photobook software (unsigned DLL's blocked). So I reverted to the old image and decided to make a WDAC policy (Windows Defender Application Control Wizard Configure Windows Defender Application Control | WDAC and SPynetGirl automated scripts for WDAC ).

Now her Windows11 laptop runs without SAC but with WDAC ISG (no dynamic code security), Avast Free (hardened) and SRP (SWH-like & some sponsors blocked), seems to work well
To keep an eye on this setup I changed my setup identical to hers, so temporarily on different setup (with Microsoft Recommended Block rules in WDAC and additional sponsors blocked with SRP for basic user, see spoiler).

Spoiler: Sponsors blocked with SRP SUA on top of MS recommended

 

[Max90]

Decided to make my temporary setup my new setup (change from Microsoft Defender to Avast Free and fom strictly managerd WDAC to loosely managed ISG), I had to reduce Early AntiMalware protection from good only to good and unknown (since I am still using WDAC and AVAST has its own root-kit scan on startup it is no big deal). Because I decided to sort of mirror my setup with my wife's windows 11 laptop.

I am running Egde with a hardened profile with anti-racking on balanced and enhanced security on basic. For both options I have enabled STRICT mode for inprivate browsing, so when I switch to inprivate browsing, I automatically increase tracking and javascript protection.

EDIT: although I like Avast Free very much, I decided to change to F-secure Safe, which I get as a rebranded Ziggo Safe-online from my ISP for free. Years ago I read somewhere that it was better to use different Anti-Virus solutions because the chance that they both miss a sample is smaller. After installing I realized that F-secure uses Avira signatures data base, so I think I changed for a dummy reason (since Avast and Avira both belong to Norton, my guess is that they share signatures).