Stealing secrets from developers using WebSockets
Heads up to anyone who doesn&#x27;t already know, uMatrix[0] can be set up to block websockets by default from 3rd-party and&#x2F;or first-party domains. In the UI, websockets are grouped under the &quot;xhr&quot; column[1].<p>I&#x27;m a pretty big Javascript advocate, but I do recommend advanced users run uMatrix and consider disabling at least 3rd-party JS by default. uMatrix is a fantastic tool and it really doesn&#x27;t take long to get used to. And honestly, a relatively large portion of the web works with only 1st party Javascript, and a surprising chunk of the web still works just fine with no Javascript at all.<p>This is also why I advise advanced users to run Firefox. uMatrix isn&#x27;t available for Safari, and it&#x27;s looking extremely likely that it&#x27;ll be at least underpowered in Chrome once Manifest v3 comes out. Or I guess run Brave or Vivaldi or whatever. Dang kids running around with their hipster browsers, I can&#x27;t keep track of them all.<p>The point is, even though I&#x27;m extremely bullish on the web as a secure application platform, part of the reason I&#x27;m bullish is because the web makes it relatively easy to take simple security measures like disabling scripts by default. You should absolutely take advantage of that, you should absolutely be disabling at least some Javascript features when you browse.<p>You can even globally turn off fingerprinting vectors like WebGL[2]&#x2F;Canvas[3] in Firefox, and just swap to a different profile whenever you want to visit the rare game&#x2F;app that requires them. Although with more and more people trying to embed their own DOM models in Canvas, maybe that&#x27;ll be harder in the future.<p>[0]: <a href="https:&#x2F;&#x2F;github.com&#x2F;gorhill&#x2F;uMatrix" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gorhill&#x2F;uMatrix</a><p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;gorhill&#x2F;uMatrix&#x2F;wiki&#x2F;The-popup-panel#the-type-cells" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gorhill&#x2F;uMatrix&#x2F;wiki&#x2F;The-popup-panel#the-...</a><p>[2]: about:config -&gt; `webgl.disabled` -&gt; true<p>[3]: <a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=967895" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=967895</a>