Stories
Slash Boxes
Comments

SoylentNews is people

uBlock Origin Criticized for Blocking Content Security Policy

posted by Fnord666 on Monday October 23 2017, @09:09AM   Printer-friendly
from the Digital-Arms-Race dept.

MrPlow writes:

Submitted via IRC for TheMightyBuzzard

The popular content blocking extension uBlock Origin blocks CSP reporting on websites that make use of it if it injects neutered scripts.

CSP, Content Security Policy, can be used by web developers to whitelist code that is allowed to run on web properties. The idea behind the feature is to prevent attackers from injecting JavaScript on websites protected by CSP.

CSP reports any attempt of interfering with the site's policies in regards to scripts to the webmaster. This happens when users connect to the site, and is used by webmasters to analyze and resolve the detected issues.

[...] Raymond Hill, the developer of uBlock Origin, replied stating that this was not a bug but by design. The extension blocks the sending of CSP reports if it injects a neutered Google Analytics script.

Source: https://www.ghacks.net/2017/10/19/ublock-criticized-for-blocking-csp/

Original Submission

 
This discussion has been archived. No new comments can be posted.
uBlock Origin Criticized for Blocking Content Security Policy | Log In/Create an Account | Top | 89 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Insightful) by crafoo on Monday October 23 2017, @12:57PM (11 children)

    by crafoo (6639) on Monday October 23 2017, @12:57PM (#586305)

    The balls on these people. To claim they have ANY right to decide what code is executed on my system. Execute it on your fucking server if it's so important to you. Fuck off.

    Starting Score:    1  point
    Moderation   +3  
       Insightful=3, Total=3
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   5  

  • (Score: 2) by Grishnakh on Monday October 23 2017, @02:48PM

    by Grishnakh (2831) on Monday October 23 2017, @02:48PM (#586345)

    But.. but.. but... their terms of service require you to run the code that they point to on their webpage!!!

  • (Score: 2) by Pino P on Monday October 23 2017, @03:08PM (8 children)

    by Pino P (4721) on Monday October 23 2017, @03:08PM (#586359) Journal

    The balls on these people. To claim they have ANY right to decide what code is executed on my system. Execute it on your fucking server if it's so important to you.

    Enjoy having to submit a form and wait for a round trip and full page reload every time you make the smallest change to the piece of information that you are editing in the web application you are using. For example, in an online whiteboard web application, enjoy having to click-wait-click-wait-click-wait-click to draw a polyline instead of dragging to draw a curve.

    • (Score: 3, Touché) by KilroySmith on Monday October 23 2017, @03:22PM (5 children)

      by KilroySmith (2113) on Monday October 23 2017, @03:22PM (#586365)

      I guess I would decide to run that whiteboard code then. That doesn't mean that, just because I find some code useful, that I must then allow all code to run...

      • (Score: 2) by Pino P on Monday October 23 2017, @03:55PM (4 children)

        by Pino P (4721) on Monday October 23 2017, @03:55PM (#586377) Journal

        That doesn't mean that, just because I find some code useful, that I must then allow all code to run

        Agreed. But how should an end user go about determining which code is trustworthy to run?

        • (Score: 2) by KilroySmith on Monday October 23 2017, @05:18PM

          by KilroySmith (2113) on Monday October 23 2017, @05:18PM (#586423)

          I'm computer savvy, fairly well-read on the privacy and security issues of running web scripts on my PC, and even I have no idea how to go about determining which code is trustworthy to run. So, by default, I block it all, and decide on a case-by-case basis whether to allow a script to run so that I can access content, or to leave it blocked and forego the content because my risk-reward judgement decides it's not worth it. And even when I do run scripts, I love NoScripts granularity in temporarily allowing scripts from the site I'm visiting, while leaving scripts from ad and tracking networks blocked. I just hate the occasional annoyance of temporarily allowing one site's scripts, see the site still isn't displaying correctly, enable another set of scripts, see the site is still broken, repeat ad infinitum.

        • (Score: 0) by Anonymous Coward on Monday October 23 2017, @06:01PM (2 children)

          by Anonymous Coward on Monday October 23 2017, @06:01PM (#586459)

          But how should an end user go about determining which code is trustworthy to run?

          Isn't that why they're trying to teach basic comp sci to everyone?

          • (Score: 0) by Anonymous Coward on Monday October 23 2017, @06:37PM

            by Anonymous Coward on Monday October 23 2017, @06:37PM (#586480)
            Basic computer science would tell you that solving the halting problem is impossible ;).

            "which code is trustworthy to run?" is similar to the halting problem. Except that in many cases you don't get the full code and inputs till you run the initial code. Heck you might never get the full code either.

            Of course in that case you can probably deduce that particular code is not safe to run, but you might go all the way and decide that no javascript is safe to run.

            A workaround of course is to sandbox and restrict stuff (solving the halting problem by making sure that everything will halt even if the code isn't written that way ;) ). CSP was supposed to be one of those tools to help limit damage.

          • (Score: 1, Informative) by Anonymous Coward on Monday October 23 2017, @09:15PM

            by Anonymous Coward on Monday October 23 2017, @09:15PM (#586577)

            They're not. They're mostly just teaching people to use Microsoft and Apple tools and calling it computer science.

    • (Score: 2) by crafoo on Saturday October 28 2017, @02:05AM (1 child)

      by crafoo (6639) on Saturday October 28 2017, @02:05AM (#588512)

      OOOOh oooh ooh! You know what? Javascript is a mistake. If I want to run a fucking white board app I will fucking run a white board app. Not a shitpile javascript app INSIDE A FUCKING BROWSER.

      • (Score: 2) by Pino P on Saturday October 28 2017, @02:28PM

        by Pino P (4721) on Saturday October 28 2017, @02:28PM (#588682) Journal

        If I want to run a fucking white board app I will fucking run a white board app.

        The difference between web apps and native apps is that native apps run only on one operating system. If your computer isn't a Mac, good luck unpacking and running the .dmg of a whiteboard app made for Mac. Even if the source code is available, good luck building and running the source code of a whiteboard app that uses Cocoa.

  • (Score: 2) by DannyB on Monday October 23 2017, @05:00PM

    by DannyB (5839) Subscriber Badge on Monday October 23 2017, @05:00PM (#586413) Journal

    The balls on these people. To claim they have ANY right to decide what code is executed on my system.

    To claim that they have ANY balls is as deceptive and misleading as . . . well, as an advertisement.

    --
    Revolver, or semi automatic modified to be fully automatic -- which is best for senior citizens in their porch swings?