My Preferred Firefox Extensions

• CS Lite Mod (1.4.8): cookie management
• Download Statusbar (0.9.10)
• HTTPS-Everywhere (3.0.4)
• NoScript (2.6.3)
• Padlock (0.5.0)
• Web Developer (1.2.2): reliable referer blocking

Useless crap Ubuntu adds to Firefox that is easily disabled, but not so easily uninstalled: 

• Global Menu Bar Extension
• Ubuntu Firefox Modifications

Using the Hosts File to Block Advertising

A small chunk of my linkedin page is to the right. My machine doesn't look up the IP address for doubleclick, and so I never see their content. A drawback is that it also thwarts any attempt I make to click on a targeted advertising link from Google within Gmail. That's okay.

Here's my /etc/hosts file:

127.0.0.1       localhost
127.0.1.1       asusCG

127.0.0.1       ad.doubleclick.com
127.0.0.1       ad.doubleclick.net
127.0.0.1       ad2.netshelter.net
127.0.0.1       adbrite.com
127.0.0.1       ads.adsonar.com
127.0.0.1       ads.vrx.adbrite.com
127.0.0.1       an.tacoda.net
127.0.0.1       assets.bizjournals.com
127.0.0.1       b.scorecardresearch.com
127.0.0.1       itemnotfound.com
127.0.0.1       netshelter.net
127.0.0.1       pagead2.googlesyndication.com
127.0.0.1       s24.sitemeter.com
127.0.0.1       scorecardresearch.com
127.0.0.1       sitemeter.com
127.0.0.1       sitemeter.com
127.0.0.1       static.2mdn.net
127.0.0.1       stimpy.musicbrainz.com
127.0.0.1       stimpy.musicbrainz.org
127.0.0.1       tacoda.net
127.0.0.1       vrx.adbrite.com
127.0.0.1       www.itemnotfound.com
127.0.0.1       www.sitemeter.com
127.0.0.1       www.spoke.com
127.0.0.1       www.tacoda.net
127.0.0.1       wwwv.itemnotfound.com
127.0.0.1       wwwwv.itemnotfound.com


# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

You can edit your /etc/hosts, but I'd suggest leaving the stuff at the top of the file (above the doubleclick entries) and the bottom (below wwwwv.itemnotfound.com) alone.

The way this works is as a shortcut to name resolution, e.g., I can place an IP address and a domain name on a line in this file and rather than going out to the DNS to look up the name, it uses the IP address in the first column of the line. So, any lookup to tacoda.net
resolves to the IP loop-back address, which is my machine. I don't have a web server at that port, so the connection attempt fails.

This is a very common technique, and one can google to find other people's hosts files with lists of sites they block.

For simplicity of adding entries, I place my hosts file in a subdirectory writable by my account, and then place a soft link from /etc/hosts there.

For Windows people, the file is (as of a few years ago) hosts.txt, and I think it was buried somewhere in the system32 subdirectory. Of course, Windows doesn't support links, soft links, or anything like that. Windows does support shortcuts, but these aren't within the file system, and so are much less generally useful.

Some question the ethics of freeloading on advertiser-supplied content by blocking the ads. I have three responses:
(1) Advertising often contains scripting which threatens the safety and stability of my system. If they stop using insecure scripting languages, I might revisit this issue.
(2) Advertising sometimes starts unwelcome sound or video content, including animated gifs. This is intrusive and disruptive. Advertising scripts also often eat up many CPU cycles. If advertisers start treating users with more respect, I might revisit this issue.
(3) The above two points greatly reduce the value of the content presented along with the advertising, to the point that I would be less likely to visit any particular page. They cannot argue in the general case that they are losing revenue due to my blocking advertisements, because in many cases I simply would not visit the page.

I endorse a multilayered approach against intrusive advertisement: Adblock Plus, NoScript, and the hosts file. IMHO if a machine has private data on it, e.g., student grades, then the owner has a responsibility to block scripts from questionable source, e.g., advertisers. With personal information, e.g., financial information, it is foolish to not block these things.

Security on the Client Side

Common--and good--advice is to not trust the client. If an organization has no control over the client, as is the case in web-based client-server applications, the client is not trustworthy. The Milwaukee Journal-Sentinel's Packer Insider is a very good low-stakes example of a site that has gotten this wrong. The Packer Insider is intended to be a subscription-only service, but I was reading it for a while, perhaps a long while, before I realized I was reading for-pay content.

If I visit http://www.jsonline.com/sports/packers/ in Firefox I get full access. If I visit it with Opera or Chrome, and click one of the Insider links, I get a login screen. What's the difference?

The difference is NoScript, an indispensable Firefox tool. NoScript is not intended to circumvent security, but rather to enhance client-side security. The idea is that if I let any given web site execute any script it wants on my machine, my personal data and the integrity of my machine are at risk. NoScript also helps me limit more obnoxious advertising by selectively shutting off Flash, JavaScript, Java, etc. NoScript uses a default-deny model, meaning that sites are not allowed to run client-side scripts unless I assent. NoScript is not for everyone because it does cause problems with some sites and it does require some effort on the part of the user, but it does provide a much safer browsing environment.

So, if I disable scripting, I get a much cleaner, more pleasurable view of the Journal Sentinel's Packer pages. As a side effect, I also get access to the Packer Insider materials. This is due entirely to poor security architecture at the Journal Sentinel's site, and, IMHO, strong evidence that the design was not done by an experienced professional. OTOH, there may have been other constraints making this desirable, and they may not actually care. If I were to lose access to these pages, I wouldn't really care because the Green Bay Press Gazette has comparable content that's openly-available.

As an aside, there are those that think it is bad to disable advertisements that support web sites. I have sympathy for this view, but I don't want their scripts running on my machine, eating cycles, providing animations which make it difficult to concentrate on the actual content, and, in extreme cases, making noise or damaging my system. I will aggressively block Flash, animated GIFs, etc., that damage the user experience.

This shows a general advantage of server-side over client-side scripting. Providers have a better idea of what their pages look like on the client side if they use server-side scripting--which is controlled by the provider--rather than client-side scripting, which is controlled by the end user, the browser, malware, etc.

Summary: security must be on the server side.

Different Browsers for Different Purposes, II

I previously commented on how I've started using different browsers for different purposes. I just visited the Weather Underground (wunderground.com) using Chrome, and it wasn't pretty. Right next to the weather map was this obnoxious flash animation. I quickly closed the frame and reopened it in Firefox, where NoScript screens out much of the obnoxious, much of the dangerous, and much of the insipid.

I had a similar experience last week while out of town. I don't have cable TV, and so am usually not subjected to cable news. Cable TV news is terrible, all commercials all the time and almost no news. Give me NPR and BBC any day. I've mostly stopped watching NFL games for the same reason.

Irony

Just visited the Fortify home page. NoScript, as is its wont, defaulted to no scripts (default deny). Fortify responded with Please upgrade your Flash Player. I thought Fortify was a security vendor. They're asking me to open myself up to the myriad of Flash vulnerabilities?