search

uazo / cromite

Cromite a Bromite fork with ad blocking and privacy enhancements; take back your browser!
https://www.cromite.org/
GNU General Public License v3.0
3.41k stars 75 forks source link

Custom "Allow Snippets" toggle for Adblock Plus #1528

Open Metrokoto opened 1 week ago

Metrokoto commented 1 week ago

Preliminary checklist

Is your feature request related to privacy?

Yes

Is there a patch available for this feature somewhere?

It should be possible to patch the Adblock Plus code itself to achieve this

Describe the solution you would like

Considering the lack of extension support for the Android version of Cromite (we can only block ads with Adblock Plus), I believe it is essential to be able to allow scriptlet rules for third party lists that we trust.

For example, I use BadBlock by @celenityy as well as Ad-Void by @igorskyflyer in my custom lists, one of which, Ad-Void, has various scriptlet rules that would be overall beneficial to enhance ABP's blocking capabilities.

See:

https://raw.githubusercontent.com/the-advoid/ad-void/refs/heads/main/scriptlets/AdVoid.Scriptlets.AntiAntiAdBlock.txt

Additionally, AdGuard and uBlock already allow third party lists to define scriptlet rules, and uBlock also has a toggle to allow "custom rules requiring trust", so ABP is behind them in terms of capabilities currently.

TLDR: I think it would be beneficial to add a submenu to the scriptlets toggle to allow third party URLs to add scriptlet rules.

Describe alternatives you have considered

Not possible

uazo commented 1 week ago

interesting but lacking an explanation of why those rules are needed and what they deactivate.

Metrokoto commented 1 week ago

interesting but lacking an explanation of why those rules are needed and what they deactivate.

Allow me to point you to some relevant documentation!

https://help.adblockplus.org/hc/en-us/articles/1500002338501-Snippet-filters-tutorial

https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#scriptlet-injection

uazo commented 1 week ago

sorry, perhaps I have not made myself clear. I know what the snippets are for, I would like to know what every single instruction I see in the rule is for and possibly some urls to test them.

Metrokoto commented 1 week ago

sorry, perhaps I have not made myself clear. I know what the snippets are for, I would like to know what every single instruction I see in the rule is for and possibly some urls to test them.

For that, you would be best speaking to @igorskyflyer, but from what I understand, they are rules specifically designed to fight more advanced anti-adblock systems.

Also, this feature request isn't just about these specific snippet rules, but rather, the wider scope of them in general. A lot of paywall bypassing filterlists use them, as well as anti-cookie banner lists. They have become somewhat necessary nowadays for most things. uBlock's uAssets lists are full of ++js rules.

TLDR; I am suggesting we globally enable snippets but allow user control of what lists can use them as a middle ground between security, usability, and privacy, as uBlock allows them, AdGuard allows them, so I don't see what is stopping us.

uazo commented 1 week ago

they are rules specifically designed to fight more advanced anti-adblock systems.

I don't completely disagree with the feasibility of leaving the choice up to the user, but I would first like to understand whether it would be appropriate to activate those filters by default for everyone, since use would allow the page to understand the presence of the list. and to understand it I would at least have to know what those rules are for.

igorskyflyer commented 1 week ago

sorry, perhaps I have not made myself clear. I know what the snippets are for, I would like to know what every single instruction I see in the rule is for and possibly some urls to test them.

Hello, I am the mentioned author of the given scriptlets. In a nutshell, scriplets provide more advanced ways of blocking/hiding ads/annoyances by injecting JavaScript code into a given page, see more here. Scriplets can dismiss dialogs, accept/reject cookies, stop popup windows, rewrite URLs and many, many useful and powerful things more that are just not possible using just the filters.

The provided scriptlets block those anti-Adblock popups that block the user completely from using the site without disabling their Adblocker, i.e.:

Figure 1. Anti-Adblock popup



[!NOTE] The mentioned scriptlets are global (apply to any site), there are also site-specific ones, for reference: AdVoid.Core.Scriptlets and AdVoid.Addon.NoAnnoyances.Scriptlets.


Hope that this clears it why it's important to add them as a feature (if possible). If you have any more questions, feel free to ask.


Additional references:

celenityy commented 1 week ago

I can understand the usefulness of having snippets, but being able to inject JS does seem to have some valid privacy & security concerns.

Personally, I think an ideal solution here could maybe be to:

uazo commented 1 week ago

there are also site-specific ones, for reference: AdVoid.Core.Scriptlets and AdVoid.Addon.NoAnnoyances.Scriptlets.

@igorskyflyer thank you, that's what I was looking for.

Scriplets can dismiss dialogs, accept/reject cookies, stop popup windows, rewrite URLs and many, many useful and powerful things more that are just not possible using just the filters.

yes, but not everything is allowed in cromite. modification of the csp is not permitted by scriptlets, for example.

Disable snippets for all lists by default

@celenityy is already like that.

Allow users to toggle snippets per list for users who desire the stronger blocking

I would prefer to have default lists for all users (like your work in #1245, by the way, excuse me, but I did not forget).

but being able to inject JS does seem to have some valid privacy & security concerns.

exactly. and not only that, all changes made in javascript are a source for fingerprinting.