µMatrix - the HTTP Switchboard successor

Could someone tell me how to make umatrix only allow css and picture and block the rest of them for first party? I couldn't figure out how to add global rule. It only applies for specific sites.

EDIT: Nevermind. I figured out there is also an option for "*" which set it for global rules. This addon is great replacement for NoScript and Request Policy combination.

 

How to allow cloudfront.net globally and for any element? Not sure where to write this rule...
Thanks

 

From your Scope Selector at the very top left hand side of the Matrix toolbar, select the Global Scope (*), then create the rule in there. When you're done, you put the Scope Selector back to either the Domain level scope or Site level scope.

Your question has led me to a question for Raymond or anyone who knows: since umatrix evaluates requests by first looking for an explicit rule in narrower scopes, and if no matching rule is found, it will then look for an explicit rule in broader, global scopes. Since it works this way, does it make more sense to create more narrower rules based on source-hostname to destination-hostname as possible, as opposed to global-based rules?

 

Never mind...I got it all sorted, going over my rules with a "fine toothed comb", whittling them down from 61 kB to 49 kB They are now lean and mean with the emphasis on efficiency without sacrificing security.

Also: 0.9.1.0-rc.0 has been released at github.

link: https://github.com/gorhill/uMatrix/releases

Thank you Raymond for your tremendous work on this fabulous extension

 

uMatrix and uBlock Origin are fantastic! For me, they have replaced NoScript and Adblock Plus. I just wanted to stop in and give respect where respect is due. Thank you for your great work, Raymond!

 

what's difference tween uBlock and uBlock O
same developer ?

 

uBlock Origin is a fork of uBlock that is maintained only by Raymond Hill.

 

Yeah, is there a Wilders Thread...re uBlock / uBlock O

 

I'm not sure if there is a dedicated thread. I haven't checked on that.

 

I couldn't agree more! I "detected" uMatrix by reading this thread, and all I can say is: uMatrix is extremely powerful and usable at the same time. The domain- and site-specific scopes is a feature which I've missed in Noscript for years.

However, there are features in Noscript which are not available in uMatrix, particularly its XSS filter and its protection against clickjacking. While I think that the need for a specific XSS filter is greatly diminished by the built-in blacklist and domain-specific scopes in uMatrix, using them both together might be the best of two worlds. So I allowed scripts globally in Noscript and tested some XSS samples on a couple of sites (by allowing javacscipt for them in uMatrix). And indeed, I got XSS warnings by Noscript! So it seems - from my limited testing - that both extensions work together very well.

Can someone confirm - perhaps gorhill himself - that uMatrix and Noscript don't interfere, provided that scripts are allowed in Noscript?

 

Right here: https://www.wilderssecurity.com/threads/ublock-a-lean-and-fast-blocker.365273/

 

Yeah, that's where I was confused. The Forum is uBlock. Not understanding that uBlock = uBlocko. While uBlock = uBlock.

 

What uMatrix version?

Edit: I realize this was posted a while ago, probably fixed in https://github.com/gorhill/uMatrix/releases/tag/0.9.1.0. Described problem appears similar to https://github.com/gorhill/uMatrix/issues/205.

 

is the FF version supposed to auto-update? When I check it under "Extensions" still shows 0.8.1.4,

 

If you installed it from gorhill's github site it won't auto-update. The version on AMO is 0.9.1.1. This one should auto-update once gorhill uploads a new version. However, I'm not sure if it needs to be (preliminarily) reviewed first.

 

I am mostly a Chrome user these days.

Firefox is working a bit as a slow starter with running EMET. I got my Firefox uMatrix extension from Raymond's github site. I cant find it by searching add ons in firefox. Avast also did find uMatrix and uBlock Origin for firefox with "bad reputation" and wanted me to get rid of them lol.

I like that the NoScript competition killer comes in fox though.

 

Firefox starts up at exactly the same speed with or without EMET mitigations for me.

 

Currently using NoScript and RequestPolicyContinued (in FF), but would like to try uMatrix ... should I remove the other add-ons first?

 

RequestPolicy is completely superfluous with uMatrix. Regarding Noscript: uMatrix is clearly superior but Noscript has some features (notably its XSS filter and its protection against clickjacking) not available in uMatrix. However, those features still work in Noscript if you allow javascript globally. That's what I have done - no problems so far.

 

Thanks @summerheat. Have set NoScript to allow scripts globally to keep the features you mentioned enabled.

I also still use Better Privacy for LSO management; also Privacy Badger, Self-Destructing Cookies, Random Agent Spoofer., HTTPS Everywhere. I suppose the last four may be redundant, if one configures uMatrix to replace these ... though some of these amay be more 'elegant'.

 

Well, I think that Privacy Badger and Random Agent Spoofer are not needed as they don't do anything which is already done by uMatrix (and uBlock).

I also wonder if Better Privacy is still needed. Starting with Firefox 4 LSOs (aka Flash cookies) are deleted once you clear your HTTP cookies (also confirmed by Wikipedia). And this is what you're already doing with Self-Destructing Cookies (which I'm also using).

 

Thanks for your further advice @summerheat. I had seen this thread on the uBlocko thread: https://www.wilderssecurity.com/threads/ublock-a-lean-and-fast-blocker.365273/page-48#post-2493613 but I have now disabled Better Privacy, as yes, I suppose SDC would remove those.

Yes I guess Privacy Badger can go. Re: Random Agent Spoofer, it would appear that in uMatrix one would need to manually keep the User Agent Strings updated.

Re SDC, could the same/similar not be achieved by ticking the first three options in uMatrix Privacy settings i.e. Delete blocked cookies, Non-blocked session cookies, and Delete local storage?
And I assume you think HTTPS Everywhere is worth keeping? My understanding is Strict HTTPS setting only affects mixed content sites ...

 

I haven't looked into Random Agent Spoofer yet. If it automatically updates the strings in order to keep pace with newer browser versions, that would be an advantage, indeed.

Possibly. Quite frankly, I don't fully understand uMatrix' behaviour here. "Delete local storage content set by blocked hostnames" - what does "blocked hostname" mean? Is it a a blacklisted hostname or is it a hostname for which cookies are blocked in uMatrix? In the first case there should be no cookies at all as all network requests for this hostname are blocked (in my understanding) and, hence, no local storage; in the second case cookies are not prevented to enter the browser but to leave it. Once uMatrix deletes those blocked cookies, local storage for those sites is also cleared in Firefox as cookies and local storage are tied together. I guess this setting is a remnant from the Chrome version where deleting site-specific local storage is not yet possible. And the "Delete non-blocked session cookies ..." setting is also applicable for Chrome only, IMO. I don't think that Firefox shows this behaviour. It would be great if gorhill could clarify.

That's also my understanding!

 

Following some suggestions in the uBlock thread I've added the following custom hosts files to uMatrix:

Code:

https://zeustracker.abuse.ch/blocklist.php?download=hostfile
https://zeustracker.abuse.ch/blocklist.php?download=badips
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist
https://zeustracker.abuse.ch/blocklist.php?download=compromised
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
http://www.joewein.net/dl/bl/dom-bl.txt
http://malwareurls.joxeankoret.com/normal.txt
http://vxvault.net//URL_List.php
http://malc0de.com/bl/IP_Blacklist.txt
https://www.openphish.com/feed.txt
https://palevotracker.abuse.ch/blocklists.php?download=combinedblocklist
https://feodotracker.abuse.ch/blocklist/?download=ipblocklist

However, I'm not sure if entries like

Code:

xn--c1agffrl0dwb7a.xn--p1ai;1
http://novidade156.mailneton.a78.org/up/upx1.jpg
http://domdobleska.ru/wp-content/plugins/cached_data/bb.exe
205.142.104.0/22

are correctly parsed by uMatrix.

EDIT: 4 lists added.
This site mentioned by Malwar has links to more lists, among them a "compiled blocklist" which is 15 MB big - insane

 

uMatrix: newbie
Found that Auto-update Hosts files is not checked...
Should I check Auto-update Hosts..
When I manual Update I see Purge all caches...so, I'll Purge. Then I see outdated after each list...Please explain..?
With Auto-update checked I'll see Purge all caches...so, I'll Purge. Then I see outdated after each list...confused...?
With Auto-update checked. Update is bold. So, I'll update. Then I'll see purge cache after each list....?
What's best how-to on keeping Hosts updated...?