Page 2 of 3
Re: Replace Google-supplied javascripts -- How?
Posted: Wed Jul 15, 2015 4:33 am
by Thrawn
barbaz wrote:
How will (2) block Google? Google domains are not blocked in that HOSTS file, I thought you said you had to customize your HOSTS file to block Google...
I think he's aiming for political pressure to change the Google-dependent behavior of the site.
markfilipak wrote:I'm not at all familiar with what you folks here call 'surrogates', but it seems that such an ad hoc approach is doomed to fail.
No it's not. Unless Mozilla seriously screws the Gecko add-ons platform in some horrible way, it's not "doomed" to anything. Even then, besides, you're using PaleMoon which is far saner on this kind of thing and less likely to kill useful functionality such as that which makes surrogates possible.
Well-written surrogates can be quite robust. It's true that they need to evolve over time, as libraries like Google Analytics evolve, but that's usually a pretty straightforward process. And when they fail, they fail closed; the site breaks, rather than running the real script.
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 2:20 am
by markfilipak
Well, I tried to read this:
https://hackademix.net/2011/09/29/scrip ... reference/
(Sigh!) So cryptic.
I'm not very good at mind reading. How about some examples?
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 3:38 am
by Thrawn
Have you tried the link-fix surrogate that I suggested? It specifies a 'sources' value of '!@', meaning that the provided script will run before any page scripts. In this case, it's looping through all the links in the page, detecting the 'data-url' attribute, and copying it to the 'href' attribute.
The different prefixes described in the quick reference determine when the script runs. So, the original one, with no prefix, just a site, runs in place of a blocked script.
Eg with page source that looks like this:
Code: Select all
<body>
Before script<br/>
<script src="http://google-analytics.com/ga.js"/><br/>
After script
</body>
If you write a surrogate with a 'sources' value of 'google-analytics.com', and a 'replacement' of 'document.write('Hello!'), you'll end up with:
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 3:49 am
by barbaz
markfilipak wrote:I'm not very good at mind reading. How about some examples?
I'm not very good at mind reading either. If possible can you please explain exactly what you find cryptic about that page, so that we have some idea what kinds of examples you would like to see? Or is it really all of it that's completely cryptic to you?
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 3:56 am
by markfilipak
barbaz wrote:
... How will (2) block Google? Google domains are not blocked in that HOSTS file, I thought you said you had to customize your HOSTS file to block Google...
I didn't customize it. It comes blocking Google as standard equipment. I don't know why you wrote that "Google domains are not blocked..."
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 5:11 am
by barbaz
markfilipak wrote:I didn't customize it. It comes blocking Google as standard equipment. I don't know why you wrote that "Google domains are not blocked..."
I wrote that because I don't see it blocking all Google domains. Many google domains are unblocked, e.g. googleapis and gstatic to name just a couple.
Odd that they're blocked for you but not me.. does that site serve different HOSTS files to different people?
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 5:34 am
by markfilipak
A short sidetrack ... sorry ...
I had to leave for a bit and saved my latest reply. (The save was confirmed as successful.) Now I can't find it. Got any idea what phpbb did with it and how I can get it back?
Thank You.
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 5:52 pm
by barbaz
user control panel > manage drafts ?
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 10:24 pm
by markfilipak
barbaz wrote:user control panel > manage drafts ?
Thanks!
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 16, 2015 10:32 pm
by markfilipak
barbaz wrote:markfilipak wrote:I'm not very good at mind reading. How about some examples?
I'm not very good at mind reading either. If possible can you please explain exactly what you find cryptic about that page, so that we have some idea what kinds of examples you would like to see? Or is it really all of it that's completely cryptic to you?
Okay:
What do surrogates do? I understand that the URL is matched, but on a match, what is replaced? ...Oh, I get it. The 'replacement' script is returned as though it was fetched from the URL. Yes, that's what I need to do.
Here's an example from the default 'about:config'
Code: Select all
noscript.surrogate.glinks.sources = !@^https?://[^/]+google\..*/search
What's "!@"?
Shouldn't this: "^https?://[^/]+google\..*/" be "/^https?:\/\/[^\/]+google\..*/"?
What's "search" doing at the end of the (somewhat strangly constructed) regexp? (...or is "/search" part of the URL?)
Code: Select all
noscript.surrogate.glinks.replacement = ['focus','mouseover','mousedown','click'].forEach(function(et){addEventListener(et,function(e){var a=e.target,href=a.href&&a.getAttribute&&a.getAttribute('href');if(href&&/^(?:http|\/url)/.test(href)&&!a._href){a._href=a.href=a.href.replace(/.*\/url.*[?&](?:url|q)=(http[^&]+).*/,function(a,b)decodeURIComponent(b));do{if(/\brwt\(/.test(a.getAttribute('onmousedown')))a.removeAttribute('onmousedown')}while((a=a.parentElement))}},true)})
OMG. Are you saying that I will have to craft a suitable replacement based on minified JS that, in many cases, will be provisioning event listeners that are dynamically bound to <div>-elements? Ugh! I can't spend the rest of my life analyzing minified DOM-code just to make someone's web site work.
What if I simply roll a VM whenever I want to go to the net (and I go to the net "naked", so-to-speak), going through an anonymizer, and tear the VM down when I'm finished? Anyone doing that?
Re: Replace Google-supplied javascripts -- How?
Posted: Sat Jul 18, 2015 11:39 pm
by markfilipak
Barbaz,
Kindly feel free to private message me...
barbaz wrote:
I'm not very good at mind reading either. If possible can you please explain exactly what you find cryptic about that page, so that we have some idea what kinds of examples you would like to see? Or is it really all of it that's completely cryptic to you?
Well, I think I understand what is meant by most of the notation on that web page, and it's probably sufficient for most programmers to understand, but the average person will be mystified by it.
Does surrogate processing involve GET headers? How?
I have many more questions, but I'll start small.
Re: Replace Google-supplied javascripts -- How?
Posted: Sun Jul 19, 2015 1:47 am
by barbaz
markfilipak wrote:What do surrogates do?
It's just a way to run custom pieces of JS through NoScript to help un-break pages and/or make them more user/friendly to NoScript users.
markfilipak wrote:Oh, I get it. The 'replacement' script is returned as though it was fetched from the URL. Yes, that's what I need to do.
Yep, in the case of no prefix.
markfilipak wrote:What's "!@"?
It means to run the surrogate script on DOMContentLoaded, if a web page's address matches the regexp defined by the rest of the pref value
markfilipak wrote:Shouldn't this: "^https?://[^/]+google\..*/" be "/^https?:\/\/[^\/]+google\..*/"?
No, it's fine. the regexp is constructed with
which does not take enclosing / nor do / need to be excaped
markfilipak wrote:What's "search" doing at the end of the (somewhat strangly constructed) regexp?
What you said:
markfilipak wrote:(...or is "/search" part of the URL?)
markfilipak wrote:OMG. Are you saying that I will have to craft a suitable replacement based on minified JS that, in many cases, will be provisioning event listeners that are dynamically bound to <div>-elements? Ugh! I can't spend the rest of my life analyzing minified DOM-code just to make someone's web site work.
Yeah, basically...
markfilipak wrote:What if I simply roll a VM whenever I want to go to the net (and I go to the net "naked", so-to-speak), going through an anonymizer, and tear the VM down when I'm finished? Anyone doing that?
I also use a disposable VM for that kind of thing but I don't use an anonymizer/proxy because I have no way to be sure it's trustworthy.
markfilipak wrote:Does surrogate processing involve GET headers? How?
I don't know that much details about it.
Re: Replace Google-supplied javascripts -- How?
Posted: Sun Jul 19, 2015 9:06 pm
by markfilipak
You know...
If someone started a surrogate web site -- call it 'surrogate.noscript.com' -- and provisioned that web site with javascripts, this could all be handled by the HOSTS file.
Example:
Suppose 'surrogate.noscript.com' == 111.222.333.444.
111.222.333.444 tpc.googlesyndication.com
111.222.333.444
www.googletagservices.com
The server at 111.222.333.444 could examine the GET header to determine which surrogate to send back.
PS: Do you see how this phpbb treats the 2 URLs above? tpc.googlesyndication.com is unmolested, but
www.googletagservices.com is turned into a link. Well,
HONK if you love PLAIN-TEXT. Is there any chance that THIS forum will get rid of all this formatting insanity and switch to PLAIN TEXT?
Re: Replace Google-supplied javascripts -- How?
Posted: Sun Jul 19, 2015 9:12 pm
by barbaz
markfilipak wrote:You know...
If someone started a surrogate web site -- call it 'surrogate.noscript.com' -- and provisioned that web site with javascripts, this could all be handled by the HOSTS file.
Example:
Suppose 'surrogate.noscript.com' == 111.222.333.444.
111.222.333.444 tpc.googlesyndication.com
111.222.333.444 www.googletagservices.com
The server at 111.222.333.444 could examine the GET header to determine which surrogate to send back.
Too complicated and less secure compared to the current surrogate solution.
markfilipak wrote:PS: Do you see how this phpbb treats the 2 URLs above? tpc.googlesyndication.com is unmolested, but www.googletagservices.com is turned into a link. Well, HONK if you love PLAIN-TEXT.
Well, check "Do not automatically parse URLs" (below the posting box) if you love PLAIN-TEXT
Re: Replace Google-supplied javascripts -- How?
Posted: Thu Jul 23, 2015 12:39 am
by Thrawn
barbaz wrote:markfilipak wrote:Are you saying that I will have to craft a suitable replacement based on minified JS that, in many cases, will be provisioning event listeners that are dynamically bound to <div>-elements? Ugh! I can't spend the rest of my life analyzing minified DOM-code just to make someone's web site work.
Yeah, basically...
The good news is, in most cases, the site isn't actually making use of the third-party scripts for anything important; it just expects the script objects to be there, and crashes with a JavaScript error if not. It's a sign of poor coding, but that's life.
You also have the option of downloading the real script, editing it, and populating the 'replacement' property with a file: URL that points to it.