Replace Google-supplied javascripts -- How?

Post by **Thrawn** » Wed Jul 15, 2015 4:33 am

barbaz wrote: How will (2) block Google? Google domains are not blocked in that HOSTS file, I thought you said you had to customize your HOSTS file to block Google...

I think he's aiming for political pressure to change the Google-dependent behavior of the site.

markfilipak wrote:I'm not at all familiar with what you folks here call 'surrogates', but it seems that such an ad hoc approach is doomed to fail.
No it's not. Unless Mozilla seriously screws the Gecko add-ons platform in some horrible way, it's not "doomed" to anything. Even then, besides, you're using PaleMoon which is far saner on this kind of thing and less likely to kill useful functionality such as that which makes surrogates possible.

Well-written surrogates can be quite robust. It's true that they need to evolve over time, as libraries like Google Analytics evolve, but that's usually a pretty straightforward process. And when they fail, they fail closed; the site breaks, rather than running the real script.

markfilipak · Post by **markfilipak** » Thu Jul 16, 2015 2:20 am

Well, I tried to read this:
https://hackademix.net/2011/09/29/scrip ... reference/

(Sigh!) So cryptic.

I'm not very good at mind reading. How about some examples?

Post by **Thrawn** » Thu Jul 16, 2015 3:38 am

Have you tried the link-fix surrogate that I suggested? It specifies a 'sources' value of '!@', meaning that the provided script will run before any page scripts. In this case, it's looping through all the links in the page, detecting the 'data-url' attribute, and copying it to the 'href' attribute.

The different prefixes described in the quick reference determine when the script runs. So, the original one, with no prefix, just a site, runs in place of a blocked script.

Eg with page source that looks like this:

Code: Select all

<body>
Before script<br/>
<script src="http://google-analytics.com/ga.js"/><br/>
After script
</body>

If you write a surrogate with a 'sources' value of 'google-analytics.com', and a 'replacement' of 'document.write('Hello!'), you'll end up with:

Code: Select all

Before script
Hello!
After script

Post by **barbaz** » Thu Jul 16, 2015 3:49 am

markfilipak wrote:I'm not very good at mind reading. How about some examples?

I'm not very good at mind reading either. If possible can you please explain exactly what you find cryptic about that page, so that we have some idea what kinds of examples you would like to see? Or is it really all of it that's completely cryptic to you?

markfilipak · Post by **markfilipak** » Thu Jul 16, 2015 3:56 am

barbaz wrote:
markfilipak wrote:...or 2, a publicity campaign to promote 'http://winhelp2002.mvps.org/hosts.htm' to get even a small minority of people to use its HOSTS file.
... How will (2) block Google? Google domains are not blocked in that HOSTS file, I thought you said you had to customize your HOSTS file to block Google...

I didn't customize it. It comes blocking Google as standard equipment. I don't know why you wrote that "Google domains are not blocked..."

Post by **barbaz** » Thu Jul 16, 2015 5:11 am

markfilipak wrote:I didn't customize it. It comes blocking Google as standard equipment. I don't know why you wrote that "Google domains are not blocked..."

I wrote that because I don't see it blocking all Google domains. Many google domains are unblocked, e.g. googleapis and gstatic to name just a couple.
Odd that they're blocked for you but not me.. does that site serve different HOSTS files to different people?

markfilipak · Post by **markfilipak** » Thu Jul 16, 2015 5:34 am

A short sidetrack ... sorry ...

I had to leave for a bit and saved my latest reply. (The save was confirmed as successful.) Now I can't find it. Got any idea what phpbb did with it and how I can get it back?

Thank You.

Post by **barbaz** » Thu Jul 16, 2015 5:52 pm

user control panel > manage drafts ?

markfilipak · Post by **markfilipak** » Thu Jul 16, 2015 10:24 pm

barbaz wrote:user control panel > manage drafts ?

Thanks!

markfilipak · Post by **markfilipak** » Thu Jul 16, 2015 10:32 pm

barbaz wrote:
markfilipak wrote:I'm not very good at mind reading. How about some examples?
I'm not very good at mind reading either. If possible can you please explain exactly what you find cryptic about that page, so that we have some idea what kinds of examples you would like to see? Or is it really all of it that's completely cryptic to you?

Okay:

What do surrogates do? I understand that the URL is matched, but on a match, what is replaced? ...Oh, I get it. The 'replacement' script is returned as though it was fetched from the URL. Yes, that's what I need to do.

Here's an example from the default 'about:config'

Code: Select all

noscript.surrogate.glinks.sources = !@^https?://[^/]+google\..*/search

What's "!@"?
Shouldn't this: "^https?://[^/]+google\..*/" be "/^https?:\/\/[^\/]+google\..*/"?
What's "search" doing at the end of the (somewhat strangly constructed) regexp? (...or is "/search" part of the URL?)

Code: Select all

noscript.surrogate.glinks.replacement = ['focus','mouseover','mousedown','click'].forEach(function(et){addEventListener(et,function(e){var a=e.target,href=a.href&&a.getAttribute&&a.getAttribute('href');if(href&&/^(?:http|\/url)/.test(href)&&!a._href){a._href=a.href=a.href.replace(/.*\/url.*[?&](?:url|q)=(http[^&]+).*/,function(a,b)decodeURIComponent(b));do{if(/\brwt\(/.test(a.getAttribute('onmousedown')))a.removeAttribute('onmousedown')}while((a=a.parentElement))}},true)})

OMG. Are you saying that I will have to craft a suitable replacement based on minified JS that, in many cases, will be provisioning event listeners that are dynamically bound to <div>-elements? Ugh! I can't spend the rest of my life analyzing minified DOM-code just to make someone's web site work.

What if I simply roll a VM whenever I want to go to the net (and I go to the net "naked", so-to-speak), going through an anonymizer, and tear the VM down when I'm finished? Anyone doing that?

markfilipak · Post by **markfilipak** » Sat Jul 18, 2015 11:39 pm

Barbaz,
Kindly feel free to private message me...

barbaz wrote:
markfilipak wrote:[Re: https://hackademix.net/2011/09/29/scrip ... reference/]
I'm not very good at mind reading. How about some examples?
I'm not very good at mind reading either. If possible can you please explain exactly what you find cryptic about that page, so that we have some idea what kinds of examples you would like to see? Or is it really all of it that's completely cryptic to you?

Well, I think I understand what is meant by most of the notation on that web page, and it's probably sufficient for most programmers to understand, but the average person will be mystified by it.

Does surrogate processing involve GET headers? How?

I have many more questions, but I'll start small.

Post by **barbaz** » Sun Jul 19, 2015 1:47 am

markfilipak wrote:What do surrogates do?

It's just a way to run custom pieces of JS through NoScript to help un-break pages and/or make them more user/friendly to NoScript users.

markfilipak wrote:Oh, I get it. The 'replacement' script is returned as though it was fetched from the URL. Yes, that's what I need to do.

Yep, in the case of no prefix.

markfilipak wrote:What's "!@"?

It means to run the surrogate script on DOMContentLoaded, if a web page's address matches the regexp defined by the rest of the pref value

markfilipak wrote:Shouldn't this: "^https?://[^/]+google\..*/" be "/^https?:\/\/[^\/]+google\..*/"?

No, it's fine. the regexp is constructed with

Code: Select all

new RegExp(string)

which does not take enclosing / nor do / need to be excaped

markfilipak wrote:What's "search" doing at the end of the (somewhat strangly constructed) regexp?

What you said:

markfilipak wrote:(...or is "/search" part of the URL?)

markfilipak wrote:OMG. Are you saying that I will have to craft a suitable replacement based on minified JS that, in many cases, will be provisioning event listeners that are dynamically bound to <div>-elements? Ugh! I can't spend the rest of my life analyzing minified DOM-code just to make someone's web site work.

Yeah, basically...

markfilipak wrote:What if I simply roll a VM whenever I want to go to the net (and I go to the net "naked", so-to-speak), going through an anonymizer, and tear the VM down when I'm finished? Anyone doing that?

I also use a disposable VM for that kind of thing but I don't use an anonymizer/proxy because I have no way to be sure it's trustworthy.

markfilipak wrote:Does surrogate processing involve GET headers? How?

I don't know that much details about it.

markfilipak · Post by **markfilipak** » Sun Jul 19, 2015 9:06 pm

You know...

If someone started a surrogate web site -- call it 'surrogate.noscript.com' -- and provisioned that web site with javascripts, this could all be handled by the HOSTS file.

Example:
Suppose 'surrogate.noscript.com' == 111.222.333.444.

111.222.333.444 tpc.googlesyndication.com
111.222.333.444 www.googletagservices.com

The server at 111.222.333.444 could examine the GET header to determine which surrogate to send back.

PS: Do you see how this phpbb treats the 2 URLs above? tpc.googlesyndication.com is unmolested, but www.googletagservices.com is turned into a link. Well, HONK if you love PLAIN-TEXT. Is there any chance that THIS forum will get rid of all this formatting insanity and switch to PLAIN TEXT?

Post by **barbaz** » Sun Jul 19, 2015 9:12 pm

markfilipak wrote:You know...

If someone started a surrogate web site -- call it 'surrogate.noscript.com' -- and provisioned that web site with javascripts, this could all be handled by the HOSTS file.

Example:
Suppose 'surrogate.noscript.com' == 111.222.333.444.

111.222.333.444 tpc.googlesyndication.com
111.222.333.444 www.googletagservices.com

The server at 111.222.333.444 could examine the GET header to determine which surrogate to send back.

Too complicated and less secure compared to the current surrogate solution.

markfilipak wrote:PS: Do you see how this phpbb treats the 2 URLs above? tpc.googlesyndication.com is unmolested, but www.googletagservices.com is turned into a link. Well, HONK if you love PLAIN-TEXT.

Well, check "Do not automatically parse URLs" (below the posting box) if you love PLAIN-TEXT

Post by **Thrawn** » Thu Jul 23, 2015 12:39 am

barbaz wrote:
markfilipak wrote:Are you saying that I will have to craft a suitable replacement based on minified JS that, in many cases, will be provisioning event listeners that are dynamically bound to <div>-elements? Ugh! I can't spend the rest of my life analyzing minified DOM-code just to make someone's web site work.
Yeah, basically...

The good news is, in most cases, the site isn't actually making use of the third-party scripts for anything important; it just expects the script objects to be there, and crashes with a JavaScript error if not. It's a sign of poor coding, but that's life.

You also have the option of downloading the real script, editing it, and populating the 'replacement' property with a file: URL that points to it.

InformAction Forums

Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?

Re: Replace Google-supplied javascripts -- How?