Advanced Plus Security Sampei Nihira Security Config 2026

[LinuxFan58]

Sampei-San,

I question some f the points listed here in regard to AdGuard Mv3

uBo Mv2 versus AdGuard
uBo Mv2 has as extra dynamic filtering compared to AG Mv3, but I can´t see how that translates to

a) script injection hardening?
AG requires filters to be trusted AND you need to give the extension more rights for importing user scripts, how can that be stronger than uBo (digesting 3p-filters without any threshold)?

Anti-0 day adaptibility?
What is that? What feature are you talking about?

Behavioral exploit mitigation?
What is that? What feature are you talking about?

Devalrative Net Request
Adguard LimitedIt is Mv3 compatible

By the uBol is by far not DNR only, it also handles cosmetic rules, declarative and some javascriptlets

 

[Sampei.Nihira]

Some of the AI's assessments are heavily focused on my personal security configuration.

uBo handles the injection of certain scripts that can be considered incremental security measures and are not available in AG.
For example, the `js nostif` rule.
The AI therefore assessed this omission as a potential reduction in security when using AG compared to uBo.

 

[LinuxFan58]

Some of the AI's assessments are heavily focused on my personal security configuration.

uBo handles the injection of certain scripts that can be considered incremental security measures and are not available in AG.
For example, the `js nostif` rule.
The AI therefore assessed this omission as a potential reduction in security when using AG compared to uBo.

Yes but that was separately listed, so still does not explain the magical (antt-exploit and behavioral exploit mitigation). In regard to javascript injection I consider AG (and Mv3) much more robust than uBo and Mv2, so part of the listing looks like an AI-hallucination (uBo accepts 3p-filters without any question, so it i more vulnarable to script injection, not forgetting its own vulnabilities in regard to its WebRequest permissions). I would drop uBo in favor of uBol

 

[Sampei.Nihira]

You're more likely to "AI-hallucination" if you're using the free version of ChatGPT.
I use the ChatGPT 5.5 account version, which has superior analytical capabilities.
It's hard for me to show you the analysis page in my language because it's too long.
And it’s been too long since I had my configuration analyzed by the AI.
So I’ll just list the two that I think might meet your needs; for the rest, you’ll have to take my word for it:

Anti-0day adaptability
What it means

How quickly the extension can mitigate new techniques.

uBO is very high because

The lists can:

distribute behavioral fixes
patch JS patterns
respond without a browser update

Example:

new tracker
new anti-adblock
new beacon technique

→ filter/scriptlet updated within a few hours.

MV3, on the other hand, is more rigid.

Behavioral exploit mitigation

This was the most important part of the table.

Actual meaning

It does not mean:

“blocks kernel exploits”

It means:

mitigation of exploits and attacks that depend on the page’s runtime behavior.

Therefore:

JS exploit kits
multi-stage loaders
anti-debug scripts
anti-user interaction
aggressive telemetry
exploits that use DOM/events/browser APIs
Concrete examples
A. Malvertising loaders

A script:

eval(atob(payload))

then:

fetch(remote_payload)

then:

document.createElement(“iframe”)

uBO can:

block the domain
abort inline scripts
neutralize fetch
prevent iframe injection

This is behavioral exploit mitigation.

B. Fake CAPTCHA malware

Many fake CAPTCHAs perform:

clipboard hijack
keyboard listener
PowerShell social engineering

uBO with updated filters:

blocks scripts
blocks domains
breaks the runtime chain
C. Anti-debug JS malware

Techniques:

setInterval(debugger)

or:

devtools detection

Scriptlets/filtering can neutralize part of the behavior.

Why uBO was “Yes”

Why:

it has an advanced scripting engine
it has runtime injection
it has dynamic filters
it has a rapid community response

and therefore:

it mitigates many modern browser-side techniques.
Why MV3 Lite was “No”

Manifest V3:

eliminates most of the runtime logic
no powerful scripting engine
no deep dynamic modification

Therefore:

blocks URLs
but does NOT mitigate advanced behavior.

 

[LinuxFan58]

It is highly theoretical that a filter maintainer decides to block exploits. Malware filters often simply block the domain, so the explanation made of behavioral exploit mitigation makes me even more convinced AI made some strange assumptions. Same with the zeroday exploit adoption, that depends on filters to be adopted.

 

[Sampei.Nihira]

It is highly theoretical that a filter maintainer decides to block exploits. Malware filters often simply block the domain, so the explanation made of behavioral exploit mitigation makes me even more convinced AI made some strange assumptions. Same with the zeroday exploit adoption, that depends on filters to be adopted.

Maybe, but I don't really care that much.
I've already mentioned that the AI evaluated my personal security configuration, which includes blocking third-party scripts + third-party frames + first-party scripts + custom rules outside the 9 allowed TLDs + custom rules within the 9 allowed TLDs + filter lists + DNS filtering.
And within the 9 allowed TLDs, there are always filter lists + DNS filtering + third-party frame blocking + custom rules within the 9 TLDs.

If anyone is worried about me... relax... because I’m not the least bit worried.

Have a nice day.

 

[Sampei.Nihira]

Switched from uBoL in Firefox/Chrome to the API Void Script Stop.
Allow by default
9 TLD in BlackList



The purpose of the extension is to enable Dynamic Filtering (Medium Mode) in the 9 TLDs:

Blocking mode: medium mode

With SS, I can also handle Medium Mode.
With uBoL, it was a real challenge to handle “Enhanced Easy Mode” because the extension lacked a counter for blocked elements.

I tried comparing SS's performance in the Speedometer 3.1 test to that of uBoL.
It makes no difference.

 

[LinuxFan58]

Switched from uBoL in Firefox to the API Void Script Stop.
Allow by default
9 TLD in BlackList

View attachment 297851View attachment 297852

The purpose of the extension is to enable Dynamic Filtering (Medium Mode) in the 9 TLDs:

Blocking mode: medium mode

With SS, I can also handle Medium Mode.
With uBoL, it was a real challenge to handle “Enhanced Easy Mode” because the extension lacked a counter for blocked elements.

I tried comparing SS's performance in the Speedometer 3.1 test to that of uBoL.
It makes no difference.

But in the DNS your are blocking all TLD's except the ones blacklisted by Script Block, is that correct?

 

[Sampei.Nihira]

But in the DNS your are blocking all TLD's except the ones blacklisted by Script Block, is that correct?

Yes, it blocks all non-European characters, including Cyrillic characters.
And other TLDs:

cn,ru,kp,tk,ml,ga,cf,su,work,fit,surf,review,asia,tokio,monster.

 

[Sampei.Nihira]

I've also enabled the 1p-frame block in the API Void Script Stop.
This configuration should be more challenging than Medium Mode but less so than Hard Mode.
I called it “Extended Medium Mode”

 

[simmerskool]

I've also enabled the 1p-frame block in the API Void Script Stop.
This configuration should be more challenging than Medium Mode but less so than Hard Mode.
I called it “Extended Medium Mode”

I haven't gone into this in depth -- I enabled iframe block in Script Stop and it seems less challenging than ubo medium mode (less site breakage) but I'm sure you tweak the settings more than I do...

 

[Sampei.Nihira]

I haven't gone into this in depth -- I enabled iframe block in Script Stop and it seems less challenging than ubo medium mode (less site breakage) but I'm sure you tweak the settings more than I do...

Yes, obviously less problematic because “Same Host” is always allowed + if you've also enabled “Enable built-in trusted domains.”
Always keep in mind that less problematic = less protective.
But there are always the filter lists in AdBlock + DNS + any protective rules in AdBlock......