The transparent pixel tracking trick is common enough now that it should be blocked by default in all 'Private' modes.
If you're not aware, the HTTP protocol specification[1] doesn't have a technical way of knowing ahead of time if it's a 1x1 tracking pixel.
So the remaining realistic options are:
(1) block ALL <img> tags downloads which then blocks any 1x1 tracking pixels
(2) allow <img> tags but block some (and maybe most but not all) 1x1 pixels via a blacklist of url domains (e.g. doubleclick.net) ... and/or heuristics based on the "style" attribute
The (1) already happens in many email clients that render HTML.
The (2) is happening with the ongoing cat & mouse game with AdBlock, EasyList, etc
[1] https://www.google.com/search?q=http+protocol+request+get+sy...
The bigger problem is that anything like this and the providers go up in size 1px at a time until it’s harder to distinguish from real content (at first transparent, then positioned off-screen, then overlays hiding it, then visible in a part of the page that doesn’t get as many views, dual-purposed with images/ads already on-screen, etc).
A better way is if Firefox just bundled an ad blocker and pushed ad blocking technology forward (eg more hooks to do expensive processing natively to save on power like Safari does). The challenge though is that something like 100% of their funding comes from an ad company.
- The browser does not load any images by default. <img> tags are replaced by gray rectangles
- User must click on the placeholder rectangle to load the image
- User can add image URLs to a whitelist so they load by default
I see that as a feature
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects - but it’s also helped me build more resilient applications that work just as well for people who don’t have trackers enabled.
As a web dev I'm running into a lot of security products dorking up web projects and processes these days. It seems to be increasing.
I've got customers with security software or other privacy related tools that are constantly 'trying' to do the right thing ... but just become support ticket overhead for me.
It's ULTRA frustrating at this point.
I've run into several customers now whose email scanners not just block emails arbitrary, but also follow links (fine by me) ... and even SUBMIT A FORM (NOT ok). Presumably to avoid some malware delivery, but now they've submitted something to us on a one time use form...
So just sending them an email means their software submits accept or decline options on a form (with our without the email reaching them) and we get a ton of "but I didn't get the email and I didn't decline anything".
Meanwhile the end customer is too technically behind the ball to entirely understand what is going on, and some ultra aggressive IT admin just keeps doing it. If you have a lot of customers it just seems to never end.
I kinda want to abandon email because of it but there's not a lot of good options.
Other issues include some unknown software installed by someone's kid (their IT guy) that blocks rando boring API calls ... the list never seems to end.
I support these privacy / security initiatives 100%, we don't do any insidious tracking or anything like that, but it is starting to hit entirely innocuous stuff.
How does this not break large parts of the existing web, ex. 80+% of password reset mechanisms?
When you get enough established paying clients, consider firewalling work gear from home gear.
My client work computers are not my personal computers. My client computers have their own router that is separate from my personal router. At one time I had my personal internet on cable, and my clients on DSL, but unfortunately that's not possible where I am now.
I get a lot of peace of mind from knowing the two are isolated from one another. The only thing they share is a desk. But when work time is done, client laptops go into the closet. Helps with the work-home balance, which is harder working from home.
Thinking about it, I might just do that when I get back home :)
I have a family member who works in marketing and am regularly asked to either turn off the pihole or add a new URL to the ignored list for exactly this reason.
Or they could ask their employer to pay for a VPN services that comes with DNS. Your family member will then have an easy to understand and easy to spot (VPN is ON) way to 'go into work mode' and out of it for private.
If you care about privacy at all, the web is a very broken place.
By the way, I use VPN to bypass PiHole when I encounter these problems. It's a lot less hassle than switching the sinkhole off/on.
Those third party scripts may not be able to track, but I wonder if the act of loading the stand-in scripts quickly (?) from within Firefox would lead to other issues.
> We also want to acknowledge the NoScript and uBlock Origin teams for helping to pioneer this approach.
Not to belittle the effort by others and other projects, but these two extensions, along with some others (like Privacy Badger), have helped users immensely in protecting themselves.
I haven't received any reports so far during the six-month-or-so nightly cycle where SmartBlock was only on nightly builds, so I'm optimistic. In the worst case we might be able to just add in an artificial delay to fix that, but of course I'd rather waste user's time like that unless that's 100% necessary.
And ultimately, problems are at least as likely (in my experience) to manifest with scripts loading too slowly, or not loading at all due to random networking hiccups.. many sites just aren't very tolerant at all of script loading failures.
That's essentially the same as if they are loaded from the browser cache. What sort of issues are you concerned about?
Mozilla does everything in the open, if you care to look at their bugtracker you will probably find all the conversation there, pros and cons, etc.
The shims are here: https://searchfox.org/mozilla-central/source/browser/extensi...
And the config file for how they are used is here: https://searchfox.org/mozilla-central/source/browser/extensi...
> In Firefox 87, SmartBlock will silently stand in for a number of common scripts classified as trackers on the Disconnect Tracking Protection List.
Which, I assume, would be pulled from here [0]
I wonder what Mozilla's plan is for blocking/mitigating server-side tracking?
