arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
10.04k stars 514 forks source link

wiki: Skip Redirect : ELI5 #249

Closed Thorin-Oakenpants closed 7 years ago

Thorin-Oakenpants commented 7 years ago

@rekixex suggested that we add Skip Redirect to the wiki. I am starting a new topic to cover this, as I would like someone to explain why we need another extension

I have to admit I am a little confused - I still have Redirector disabled (too f**k hard for me to write rules) and Request Control has almost nothing in it (I still have trouble writing rules!). I have NoRedirect (legacy) about to go bye bye in 57Land (I used this to block ALL redirects by default) and I want to replace that. Now there is this Skip Redirect, and I am totally confused as to what they all achieve as a mix. Part of the problem is the names - three of these all use the word "redirect" in there titles which is confusing/misleading.

I want someone to ELI5 how and why Skip Redirect differs. Also, from those screenshots on AMO it looks like it annoys all the time with doorhanger notifications

crssi commented 7 years ago

Didn't I already suggest this one? Maybe forgot since I was sure of it. Why it is different? Because it works. lol No seriously, the skip redirects works, with minor tweaks, without false positives. The most important part was when the author implemented the same domain detection to avoid skipping on those, which eliminated almost every non-desired skipping redirect, specially where the action would break login. See here

Redirector is not match to that for skipping purposes and it has other problems.

Its almost set and forget. I have added those additional to default blacklist in the options:

cred_submit
/_login
/adfs
rover.ebay.co
grauenwolfe commented 7 years ago

Been using Skip Redirect (along with Link Cleaner) for a few months now and it works well enough by default and has been a good replacement for NoRedirect and Redirect Remover. SR has simple, basic preferences like blacklist, whitelist, etc. So far, so good, no complaints from me. I'll include a screenshot even though there's probably already one on it's AMO page.

skip redirect

Thorin-Oakenpants commented 7 years ago

Didn't I already suggest this one?

It's been in the wiki sticky issue pending list for ages. This is about adding it to the actual wiki. I do not want the wiki to end up with hundreds of extensions with duplicity and overlap (and we already have some of that) - I just want the best of the best

Duplicity?

ELI5

Here are my NoRedirect rules. They are used in order from bottom to top. The bottom rule is a BLOCK ALL, and then for me to be able to double-click RSS feed items in "Quite RSS" (standalone software program) I had to allow a few destinations as they use things like http://feedproxy.google.com/~r/SITE/~STRING/. And a couple of other sites for them to work (eg when I download PAFs from portablepps.com => sourceforge) etc. So default deny all and allow a tiny handful - set and forget forever!.

noredirect

So looking at grauenwolfe's piccy, this is the same right? I can block all in the Mode options, and create a whitelist.

So this is a great replacement for NoRedirect - right? In other words, all that link shortening crap can die, right? In my world, if people can't give me a direct link, so I know where I'm going, then screw them!

earthlng commented 7 years ago

NoRedirect blocks redirects while this and any other such addons skip redirects! Totally different thing

Thorin-Oakenpants commented 7 years ago

So what use is skip redirect then? I don't get it

PS: Thank F someone ELI5 as requested

crssi commented 7 years ago

^^ It goes directly to landing page, without some "middle" tracking URL. I hope I did write in understanding manner. Something like this and this, but much better, especially by its same domain "detection" which nulls most "false positives". Also here is the main reason why Redirector is not best,

Atavic commented 7 years ago

redirect-control is functional, allowing to see the urls and accept or refuse the redirection.

/* 2619: limit HTTP redirects

grauenwolfe commented 7 years ago

NoRedirect blocks redirects while this and any other such addons skip redirects! Totally different thing

As you're own understanding of blocking vs. skipping, please explain what you're saying here? Not challenging just genuinely curious. What would be different outcomes of the two in relation to the desired end result. You may well be on to something but only seems a syntactical difference.

Some redirecting extensions make connections to the redirected site before sending you to the intended one, as @crssi has already mentioned. From all I've been able to gather, Skip Redirect does not do this. I definitely could be wrong on this but this is what made me go with SR over others being offered. Seriously, I need to know if SR is not doing what I'm expecting of it.

Thorin-Oakenpants commented 7 years ago

@grauenwolfe I no longer know dude .. I'm like all confused :headspin: ...

I block all "redirects" in NoRedirect - this means things like an rss google feedly url will not redirect. In 3 or so years since I installed NoRedirect, I have only ever had to add those few items in the pic up above. Haven't changed it in years. I have also blocked all that utm rubbish - not sure if that counts as a redirect. Maybe NoRedirect only works with a few parameters like that ~r/SITE. I have no idea. I think the word redirect used in these extension names causes confusion

So IMO, I cannot understand why anyone want to be redirected. By this I mean the link/url lands on one page and ends up on another. I totally get the same domain issue wanting to be excluded. NoRedirect only works on domain changes.

What annoys me about this kind of approach in Skip Redirect, is it doesn't block anything if I understand it correctly. You can only "skip" either a whitelist or blacklist. Those not being "skipped" still end up on the eventual page, i.e nothing is done with them. And those being "skipped" do what - attempt to skip to the end and you still end up there. What purpose does this serve. I just don't get it. Is it skipping tracking pages in the middle or something?

tld;dr: WTF is the blocking redirects extension

grauenwolfe commented 7 years ago

I decided to just ask sblask directly. https://github.com/sblask/webextension-skip-redirect/issues/50

siric commented 7 years ago

And those being "skipped" do what - attempt to skip to the end and you still end up there. What purpose does this serve. I just don't get it. Is it skipping tracking pages in the middle or something?

Example:

https://out.reddit.com/t3_73jhqt?url=http%3A%2F%2Fwww.businessinsider.com%2Fwhy-political-ads-should-be-regulated-online-2017-9%3F&token=AQAAbrPQWTqwpYRVaStC0maxIdRe-WaW3aFH_uZyn8SQmX1H87pX&app_name=reddit.com

If you visit this "redirect" URL, Reddit will know that you have visited the article on the businessinsider website. The Skip Redirect extension extracts the businessinsider URL from the redirect URL and goes there directly, without ever visiting out.reddit.com. This prevents Reddit from knowing that you have visited that specific URL. Useful in cases where you simply want to visit a link but don't want to let the parent site know which URL you are visiting.

Then there are extensions that flat out block the redirect so you don't end up at the end URL. Useful if you don't know what the end URL is going to be (could be malicious) - ie. through URL shortener services, which "obfuscate" the end URL.

The Neat URL extension serves a completely different purpose: it strips tracking parameters from URLs - such as those set by Google Analytics, ie. utm_*.

earthlng commented 7 years ago

NoRedirect blocks redirects while this and any other such addons skip redirects! Totally different thing

As you're own understanding of blocking vs. skipping, please explain what you're saying here?

@siric1's comment explains it perfectly. Thanks @siric1

grauenwolfe commented 7 years ago

Thanks to both you.

Then there are extensions that flat out block the redirect so you don't end up at the end URL. Useful if you don't know what the end URL is going to be (could be malicious) - ie. through URL shortener services, which "obfuscate" the end URL.

OK, essentially just blocking malicious sites. Yes, I understand perfectly well the concept of "blocking" in that regard but to me seems independent of cleaning links.

The Neat URL extension serves a completely different purpose: it strips tracking parameters from URLs - such as those set by Google Analytics, ie. utm_*.

With the exception of "utm" not being included by default, how is this not exactly what Skip Redirect is doing? Sorry, if I'm misunderstanding here or are we saying the same thing?

siric commented 7 years ago

OK, essentially just blocking malicious sites. Yes, I understand perfectly well the concept of "blocking" in that regard but to me seems independent of cleaning links.

Redirect blockers such as NoRedirect block any type of redirect. So for example, https://bit.ly/1bNsLrK simply will stop loading. Since we don't know what's behind that bit.ly link (it could for example lead us to a malicious site, ip logger etc.), the block would protect against this. So yes, this is completely independent of of cleaning links.

With the exception of "utm" not being included by default, how is this not exactly what Skip Redirect is doing? Sorry, if I'm misunderstanding here or are we saying the same thing?

Neat URL does include the utm parameter by default, it uses the following default param list (and also provides a way to add more params to this default list through it's settings): https://github.com/Smile4ever/firefoxaddons/blob/master/Neat%20URL-webext/options.js#L4

Skip Redirect does not remove tracking params from the URL, it simply skips the redirects as I explained 2 posts earlier, by extracting the end URL from the redirect URL, visiting it directly and thus preventing the parent site from knowing which site you are visiting.

grauenwolfe commented 7 years ago

Skip Redirect does not remove tracking params from the URL, it simply skips the redirects as I explained 2 posts earlier...

I know what you said two posts earlier. I have been mistaken about Skip Redirect and was under the impression that this is what it has been doing all along.

What still isn't clear is how will it matter in the end? Not rhetorically, I'm genuinely asking. Give a worst-case scenario example, even if absurd in order to make the point clear. Baby steps. If you haven't the patience, I'll understand.

@siric1 Now I see what I was missing. Your main point of difference is that TRACKING is being removed, correct?

Thorin-Oakenpants commented 7 years ago
Thorin-Oakenpants commented 7 years ago

Link Cleaner strip parameters like utm etc and is a set list. And to quote siric1

Neat URL extension serves a completely different purpose: it strips tracking parameters from URLs - such as those set by Google Analytics, ie. utm_*.

So Link Cleaner & Neat URL are pretty much the same, and as per siric1's comment, Skip Redirect is completely different. See my question about 5 comments in, and I asked if Link Cleaner & Neat URL were duplicitous.

Thorin-Oakenpants commented 7 years ago

I have no idea .. its why I asked somebody to ELI5. We'll have to wait for an internet rockstar to 'splain it to us.

Edit: Hope that didn't come across as dismissive. Some things I do not have the time or will (or capability) to wrap my head around. So I too genuinely woud like someone with a better understanding to do an appraisal on these two which to me look the same

crssi commented 7 years ago

Link Cleaner tries to do both as Skip Redirect and Neat URL does, but it lacks custom settings and user control. Don't get me wrong here, I am not saying that LC is doing worse for what is hardcoded in, but it is not trough as SR and NU. SR does skipping redirect better (user control) and being "silent" when the "main" URL and redirection URL domain is the same, thus avoiding "false positives" and skipping redirect is in those cases a nonsense and leads to breakages. NU does parameters cleaning better in a way that and the cleaned parameters are known and user controllable with possibility to add/extend the operations.

When using SR and NU, then IMO LC is redundant. Using SR and NU over LC is better solution.

siric commented 7 years ago

Link Cleaner: Tries to strip url parameters as well as skip redirects, but on a very limited set. The major downside is the set is hard-coded and the extension provides no configuration to add to it's default list. It can only clean utm_* and some tracking params on amazon and ali express. And, it only skips redirects for facebook, steam and reddit: https://github.com/idlewan/link_cleaner/blob/master/background.js#L164

Skip Redirect: Skips redirects globally on all sites. Uses some smart filters to do this instead of a hard-coded list.

Neat URL: Strips many URL parameters by default and has the option to add even more.

The Skip Redirect + Neat URL combination is the clear winner here. Global redirect skipping and an unlimited set of tracking parameters as opposed to Link Cleaner's 3-4 tracking parameters and 3 redirect skips is a no-brainer to me.

Edit: @crssi posted while I was typing this and shares the same opinion :-)

Where the F is my NoRedirect web extension equivalent? I reckon a rockstar internet tech dev guru could bang that out in a day

Did a quick search for you but there seems to indeed be no extension that can block redirects entirely. I might look into creating one if the extension API provides me with enough tools to do it.

crssi commented 7 years ago

^^ :)

Thorin-Oakenpants commented 7 years ago

I'm using NoRedirect right now. I got a wee popup from Skip Redirect on a reddit link earlier (I turned on notifications because I want to see if its working), so either NoRedirect has broken recently (I am on 56) or it doesn't cover what you think it does, or it's no longer comprehensive .. i have no idea. All I know is I used this for years with no issues (and it worked initially because I had to add some exceptions) ... maybe its been broken for years, but earthlng uses this and he lives in his console ... and no it can't be broken because I sometimes click shortened links for fun to see what happens = answer nothing = blocked

Thorin-Oakenpants commented 7 years ago

If LC is redundant, then if someone can confirm that all the tracking parameters in LC are in NU, then I can remove it

crssi commented 7 years ago

From source code and from manifest LC cleans only:

So LC is very very limited.

And to answer: Yes NU deals with all parameters that LC does and much much more. And SR also deals with all skips that LC does and much much more.

earthlng commented 7 years ago

I got a wee popup from Skip Redirect on a reddit link earlier so either NoRedirect has broken recently

With a skipping addon you never load out.reddit.com and therefore NoRedirect never kicks in.

NoRedirect is useful if for example the linked-to URL is another redirect url (bitly, etc) that could take you to a malicious site.

Thorin-Oakenpants commented 7 years ago

So VOTE then .. remove LC if it's redundant and limited

:+1: = remove LC

Thorin-Oakenpants commented 7 years ago

^^ done