Hacker News Reader

Comment by unicornporn | Hacker News Reader

uMatrix has been abandoned, sadly.

I'm very worried about this, to be honest. There doesn't appear to be anything even remotely close to a proper replacement for uMatrix. The thought of going back to the relentless spyware that is the web today (without uMatrix) is literally scary.

Someone here (long-ago thread) suggested uBlock Origin but it doesn't come anywhere near the functionality of uMatrix.

I'll continue using uMatrix and it continues to work perfectly but if Mozilla ever breaks it with incompatible changes, I'm at a loss what to do. Keeping fingers crossed it works for a long time.

I'd be happy to pay substantial money for something like uMatrix.

You can just use uBlock Origin in advanced mode, and the uMatrix features are in there.

https://imgur.com/a/AtZLOiO

It's nothing like the granularity of the uMatrix UI.

uBO static filters work fine as a replacement for most uM rules, except that you have to write them by hand instead of the convenient table UI that uM had.

Eg my static filters start with:

    *$css,font,frame,media,object,ping,script,websocket,xhr
    *$image,redirect=1x1.gif
    *$csp=worker-src 'none'
    @@*$1p,css,frame,image,script


    ! GitHub

    !! github.com
    @@||s3.amazonaws.com^$domain=github.com,websocket,xhr
    @@||github.com^$domain=github.com,websocket,xhr
    @@||github.githubassets.com^$domain=github.com,css,image,script
    @@||githubusercontent.com^$domain=github.com,image
    @@||pipelines.actions.githubusercontent.com^$domain=github.com,websocket,xhr
    @@||raw.githubusercontent.com^$domain=github.com,websocket,xhr
    @@||render.githubusercontent.com^$domain=github.com,css,frame,script

The first three lines disable a whole bunch of things on all websites, then the fourth selectively re-enables some of them (@@ are exception rules) in 1p cases. Then for each web property I have a section that selectively re-enables more things for that web property's domains (exception rules with a domain= filter).

Eg the first rule in the GH section says that github.com is allowed to make websocket and XHR requests to s3.amazonaws.com. If that line wasn't there, the very first line's rule would've blocked it.

Notice that 1p JS appears to be enabled by the fourth line, but I actually have dynamic rules to prevent JS by default, unless enabled per site:

    no-scripting: * true
    no-scripting: github.com false

The reason I do this with dynamic rules instead of static filters is that uBO has the ability to simulate noscript tags on websites where it disabled JS, but it only does that when JS is disabled via the `no-scripting` dynamic rule, not when it's disabled via static filters.

The only thing that uM does and uBO doesn't is cookies, so I still use uM for that.

> except that you have to write them by hand instead of the convenient table UI that uM had

Which means that this is not a proper replacement.

https://addons.palemoon.org/addon/ematrix/ if you're willing to use a fringe browser.

Reply on news.ycombinator.com