Hacker News Reader

Comment by fdb | Hacker News Reader

On Firefox, I use the RequestPolicy plugin: by default, it only allows requests to the current domain, so nytimes.com can't access connect.facebook.com. You can enable requests to go through, so that reddit.com can access redditstatic.com.

I think it strikes a good balance between blocking everything (a la NoScript) and total openness.

https://addons.mozilla.org/en-US/firefox/addon/requestpolicy...

View on HN

"blocking everything (a la NoScript)"

This seems to be a really popular misconception (presumably the name), but NoScript works pretty much as you describe, too.

You do not need a plugin to turn "everything" off, the browsers all ship with that capability and have for over 15 years.

NoScript and RequestPolicy are best used together (as recommended by the creator of the latter) as they serve different purposes. This, plus a few other add-ons in these areas are my set-up and that works well.

You often have to trade off security for convenience – for me, NoScript is too inconvenient to be worth it, because so many sites silently break when JavaScript is not available.

I sometimes dream of a browser that would just fetch the page content and no extra other resources, showing it like Instapaper. The reality is more complex: images, css, CDN's, dynamic content, ...

RequestPolicy realizes the most important part of that dream: not telling Google, Facebook and a host of obscure tracking companies about every website I visit.

Reply on news.ycombinator.com