Regarding anti-tampering: this work is in a "taking the Web as we found it" kind of model. We focused on improving the existing state of the art for content blocking and resource replacements rather than adversarial environments deliberately trying to get around SugarCoat. There are already other ways that sites try and circumvent URL-based blocking anyway—bypassing SugarCoat won't be the low-hanging fruit. We touch on this in the discussion section of the paper, but if a script is making itself too much of a problem, filter list authors can always opt to block it entirely.
Regarding patching the runtime environment: other systems have done this, but they haven't been adopted. Deep engine modifications are hard to get upstreamed and, absent an actual standard, don't give you cross-browser compatibility. SugarCoat-generated scripts can be (and are!) deployed in existing content blocking systems today, and aren't locked to one particular browser.
1. https://github.com/brave-experiments/sugarcoat/blob/master/m...
https://brave.com/privacy-updates/12-sugarcoat/
The actual paper:
https://brave.com/wp-content/uploads/2021/06/sugarcoat-ccs-2...
Though Brave has been involved in (controversial?) work that’s tangential or unrelated from the core web, such as a substitute for advertising based income for sites, a crypto wallet, etc., I do admire the relentless focus on creating features that help and protect users. It also seems to have a higher velocity of feature releases, perhaps because it can still rely a lot on the open source Chromium project (which it customizes) as opposed to the Firefox team that has to maintain and improve Gecko/Servo as well as handle end user facing features.
I also use Temporary Containers [2], Facebook Container by Mozilla [3], and Google Container [3]. There are also container extensions for Twitter, YouTube, etc.
[1]: https://addons.mozilla.org/firefox/addon/multi-account-conta...
[2]: https://addons.mozilla.org/firefox/addon/temporary-container...
[3]: https://addons.mozilla.org/firefox/addon/facebook-container/
[4]: https://addons.mozilla.org/firefox/addon/google-container/
Having a company that has chosen online ads as its "business model" sponsor researchers to "improve privacy" is inherently flawed. If this company was serious about user privacy they would not show ads. Today's online ads imply data collection and as such are are not compatible with privacy. Companies want (need) to know who looked at an ad and when. That conflicts with privacy. Solve the problem by not showing ads. Brave's customers are advertisers. Make users the customers not the targets. Forget about ads.
Will not happen. When users are not willing to pay for whatever "service" the tech company can offer, privacy problem cannot be solved.
This publication is a nice bit of "submarine PR" as PG would call it.
What's a page that's made of JSON? And isn't it less semantic and more dependent on JS to convert the page into a readable representation, than a pre-rendered static site?
In favor of third party ads.
If they kept their ad department. Ads would be native with the article.
PayPal is the absolute worst here and the process is horrendous, opaque and time-consuming. I've been blocked by Stripe as well. Sometimes I will abort a purchase when I see that the only payment option is PayPal.
even better would be if users could also analyze their own traffic, block suspicious things and contribute to the mock environment for firewalling personal data.
maybe the future of firewalls will be more about keeping user data in, rather than keeping malicious actors out...
That's basically a MITM proxy --- and I've been running one for decades now, to adjust pages and block (as well as inject) content. But if Mozilla tries to do that with its VPN, the paranoia-spreading "security" industry (and we all know whose interests they really protect...) is going to roast them for it.
i don't think the personal tools for this are all that great anyhow and tools that would allow consumers to monitor their own devices and use oss tools for defeating software that doesn't serve them could very well be a hit.
what's the alternative? a closed platform like apple? there's gotta be a middle ground between having to run your own monitoring infra and handing the reins over for everything to a company like apple.
Though does not mention any plans about integration with Firefox, it seems like it would be a matter of time
I used Firefox (rel/dev/nightly, it varied over weeks and years) from 2011 to mid 2020.
From mid 2020, I switched to Brave as my daily driver and I won't be switching back, based on daily UX and DX.
(Brendan, thank you for getting Brave off the ground, and best of luck!)
It would definitely be interesting to compare and contrast the various approaches of different browsers.
Can scripts be written to bypass such sandboxing?
Otherwise, what you're saying would be true, and this could be easy to break/bypass.
They discuss the details of this in the paper: https://brave.com/wp-content/uploads/2021/06/sugarcoat-ccs-2...
Depending on the scope of these replacement scripts, this may run into API patent & copyright issues. Additionally, the trackers can simply start using different tracker script URLs to avoid this type of implementation.
A better solution is to allow these scripts to load (without cookies) and patch all of their actual network emissions and storage access to follow consent rules.
Google vs Oracle says otherwise.
