Advanced Security oldschool's surfing laptop configuration

[oldschool]

TarikuOkami relies on ad- and tracker blocking on DNS level.
View: Question - NextDNS/ControlD vs Quad9, AV Web Protection

Using NextDNS here.

 

[SeriousHoax]

25,973 + 53 My filters

Judging by this rule number and the number used rule used for filters in the picture in your other comment, have you enabled the "Disable generic cosmetic filters" option in uBO?

 

[ForgottenSeer 97327]

@oldschool

Just curious: what is the reason/benefit of "enabling file hash computation"?

I guess it would be for Microsoft Defender to skip executables which hash has not been changed. Did you notice a difference?

Did you enabled it through GPO or registry (link) ?

 

[oldschool]

Judging by this rule number and the number used rule used for filters in the picture in your other comment, have you enabled the "Disable generic cosmetic filters" option in uBO?

Yes because I've never used them.

I guess it would be for Microsoft Defender to skip executables which hash has not been changed. Did you notice a difference?

No performance impact that I notice. This setting was one of a number advised by @SpyNetGirl in her hardening thread.

Did you enabled it through GPO or registry (link) ?

Via powershell command.

 

[Jan Willy]

Using NextDNS here.

Yes, I know. In your post #217 you wrote: "I'm using mostly tracker blocking like @TairikuOkami" As I said, he relies on Next DNS. Besides that he only uses the browser built-in blocking but not any blocking extension. You're using uBO. That's a significant difference. Is the Medium Mode option in uBO your motive?

 

[oldschool]

You're using uBO. That's a significant difference.

I realize that. I didn't say it was the same as @TairikuOkami's.

Is the Medium Mode option in uBO your motive?

Yes. I'm taking advantage of Kees1958 list but using this setup in my own fashion.

 

[SeriousHoax]

Yes because I've never used them.

That's alright. Gorhill and Adguard don't like generic cosmetic filters either, especially for Annoyance filters. But I notice that in your two annoyance filters there's barely any rule that's not generic. For example, "I don't care about cookies", only 1,355 out of 25,608 are being used meaning only the used ones are not generic. This indicates that the filter is almost entirely generic filter based and might not be very helpful. That's not a good thing since generic filters have performance impact (Though I don't notice in real life). So not sure how effective it is in your config. On the other hand, Adguard Annoyance (Optimized) is the reverse. They have only 1K+ generic filters out of 38K rules. So, 37k is in use even when generic cosmetic filters are disabled.
Anyway, if your current settings works then it's fine. Just letting you know.

I guess it would be for Microsoft Defender to skip executables which hash has not been changed. Did you notice a difference?

I'm also curious if there's any benefit of adding this. Does it really help in anyway? Maybe it's mainly for MD Endpoint products.
Regarding hash, what I find super helpful is the logging of sha1 hash of samples detected by MD Real-Time protection. So, it's possible to quickly copy the hash and check on Virustotal to know about the malware or potential false positives. It can be enabled via registry tweak or GPO.

 

[TairikuOkami]

Besides that he only uses the browser built-in blocking but not any blocking extension.

For the record, I am using only NextDNS, no browser built-in blocking, that is disabled for privacy reasons, just like smartscreen and etc.

 

[Jan Willy]

For the record, I am using only NextDNS, no browser built-in blocking, that is disabled for privacy reasons, just like smartscreen and etc.

Sorry. I didn't interpret well your remark "along with OS/browser mitigations" in your post Question - NextDNS/ControlD vs Quad9, AV Web Protection

 

[oldschool]

Based in part on the above discussion I re-did my µBO medium mode setup once again to stay closer to @Kees1958 original intention behind his 3rd party filter lists, so I removed more filter lists.

My total now stands @ 22,349 Network filters + 58 My filters. Hope you're well Kees!

 

[Zero Knowledge]

Thanks for you anti-paywall filters. I added them to my uBlock config. To be honest I have way too many filters, a few big lists such as OISD and LightSwitch's take up most though about 90%. However, the only time I really need to disable uBlock is on ecommerce sites, they can get a bit funny with tracker blocking and I find NextDns is the same that you need to disable it to use some ecommerce sites.

 

[oldschool]

Thanks for you anti-paywall filters.

You're welcome. These filters don't claim to be as good as the BypassPaywalls extension but are OK for my purposes.

However, the only time I really need to disable uBlock is on ecommerce sites, they can get a bit funny with tracker blocking and I find NextDns is the same that you need to disable it to use some ecommerce sites.

My purpose in using this light list Medium mode is so I'm in full control, can easily noop sites as needed, and don't have to deal with breakage from filters. I even downsized my NextDNS fitlers to disguised 3rd party tracker blocking only.

 

[Jan Willy]

Based in part on the above discussion I re-did my µBO medium mode setup once again to stay closer to @Kees1958 original intention behind his 3rd party filter lists, so I removed more filter lists.
View attachment 273961
My total now stands @ 22,349 Network filters + 58 My filters. Hope you're well Kees!

You can slimming your uBO-setup a little bit by activating the lists of Dan Pollock and Peter Lowe in NextDNS.

 

[SeriousHoax]

My purpose in using this light list Medium mode is so I'm in full control, can easily noop sites as needed, and don't have to deal with breakage from filters. I even downsized my NextDNS fitlers to disguised 3rd party tracker blocking only.

Blocking connections via extensions is not a bad idea. Things that are blocked by extensions actually stops DNS queries from happening in the first place. But the benefit of using something like NextDNS is that all the blocking is happening on their servers, there is no performance overhead on your own device. So the combination of Extension + DNS is better IMO.
For medium mode, you can check out Yuki's noop filters for English language sites.

GitHub - Yuki2718/adblock2: Personal filters and rules for AdGuard/uBlock Origin

Personal filters and rules for AdGuard/uBlock Origin - GitHub - Yuki2718/adblock2: Personal filters and rules for AdGuard/uBlock Origin

github.com

 

[oldschool]

Just for heck of it I installed VodooShield to see how it performs on the machine.

 

[Zero Knowledge]

Good luck!

Never got into VS, I'm over the whole allow/deny action of security software. I just want a simple block and forget setting or whitelisting is even better these days.

 

[ForgottenSeer 97327]

Yes, nothing beats a hard-whitelist (I like WDAC), but with SRP you can block execution for standard user and allow execution for admin using Hard_Configrator ('soft SUA-whitelist')

A problem free alterative is the 'hardened-Cloud-whitelist'. In this scenario you would be using the Avast profile of Hard_Configrator adding additional sponsors to block (script interpreters plus enhanced) with Configure_Defender on MAX. I prefer this (H_C Avast profile) over SWH + CD because of the additional sponsor blocks. Despite all post with "MD slowing down my PC" I a have not ever seen a (potato) PC launching applications faster than this combo (measured with AppTimer, not on I think or feel it is faster). Before I put this on relative's PC I always check whether MD is the fastest.

Because I like the concept of VS very much and it was free, (at that time, now not anymore) I have tried this also on a few potato-PC's (PC's of family members given to older relatives because they bough a new one). When you check the startup of Edge and Office, the Avast profile with MD on MAX is at least 1 to 2 seconds faster when first starting a program (after reboot). Consecutive (from paged out memory) starts are only 0,1 to 0,3 seconds faster (MD with SRP faster than MD + VoodooShield).

I have also noticed this (MD being faster) when measuring H_C Avast + C_D Max against Avira, BitDefender, F-secure and ESET!

 

[oldschool]

I have also noticed this (MD being faster)

Possibly still true even though VS' performance has improved, though I don't really notice a difference with or without it so far. I'm running it in relaxed Autpilot mode as this was a clean install/upgrade to the new CyberLock. I'm quite happy with Defender + SAC since I've commited to its whitelisting limitations but I'll see how it goes with VS.

 

[oldschool]

Taking AVG Free for a spin. Hardened Mode enabled. Smart Enhanced Firewall enabled.

 

[oldschool]

Switched µBO to Adguard in Chrome/Edge after the mention by @SeriousHoax.