Report URI appears to depend on CSPs being submitted. There was recently a discussion about uBlock Origin blocking CSPs on privacy grounds. [0]
So this will only work for sites that use CSP and users who don't have uBlock Origin installed, unless uBlock Origin changes their default policy on CSPs.
ninja edit: I see uBlock Origin has changed their defaults to permit CSP submission [1]
Troy very publicly carrying water for Scott Helme/Report URI looks quite a bit different in hindsight, as the number of Report URI marketers doubles to 2.
The uBlock Origin dev compromised with an opt-out for CSP reports, even though they can be used for things like IP address leaks to 3rd party servers (similar to the as-seen-in-court Tor-busting captcha mess). Personally I would prefer only same-origin reports.
--
My biggest problem in all of this is that Scott was not careful to always document his not-quite-obvious conflict of interest, and even worse: Troy's association is only now being revealed weeks later. I do appreciate the work being done to improve the effectiveness of CSP reports in default configurations of open source tools, but can't help wondering about the motivation. Disclaimers go a long way toward keeping unsuspecting maintainers informed of both sides of an issue.
Scott was also blamed here on HN last week for his part in promoting the death of HKHP (public key pinning) apparently due to ease of misconfiguration.
Looking back now I'm left wondering how HKHP affected Report URI and Scott's other project, Security Headers. I will disclose my bias as I watch highly effective marketing of convenience (top of HN!) triumph over my personal flavor of slightly paranoid privacy yet again.
I don't understand the argument that it's bad because it leaks the IP address to a third party. So would embedding any other resource hosted on a different domain - from JavaScript CDNs to images. No one is suggesting these should be blocked, right?
I have no problem with uBlock blocking requests to the CSP report-uri if the domain in question is on the user's filter list (I'd probably consider it a bug if it didn't do that), but that's not what is happening here (before this was fixed, that is).
The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar.
It is 100% clear to me that differences of opinion will result in drawing the line on an ad blocker's default configuration in different places.
Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I personally was unaware [edit]this could happen to me in Chrome with uBlock Origin installed[/edit] until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true.
> JavaScript CDNs to images. No one is suggesting these should be blocked, right?
Many of these [edit](specifically: tracking pixels and just straight up ad images)[/edit] are blocked by ad blockers in the default configuration.
> The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar.
Thank you for the correction. I apparently imagined this referenced when partial VPN or Tor is insecurely used only to access specific domains, or DNS is not also routed through.
> Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it?
I'm not sure what you're asking - when did I become aware of this possibility? I guess when I learned about CSP?
> I personally was unaware this was possible until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true.
Adblockers block requests to things like Google Analytics by matching the domain (and other patterns). Why is this not an acceptable solution for CSP? If tracking tools start using CSP for this, they'll be added to the filter lists, just like any other tracking script. We're not asking uBlock to block all third-party requests on the off-chance it might be an ad or tracking service, so why would we do that for CSP?
> Many of these are blocked by ad blockers in the default configuration.
Do you have a source for this? This would break a large number of sites. uBlock seems to have an experimental feature that mirrors certain popular CDN URLs locally, but it doesn't seem to be enabled by default and the Wiki page hasn't been updated in over two years. AIUI, even with this feature enabled, requests to non-popular (non-local) assets would still go through.
> Why is this not an acceptable solution for CSP? If tracking tools start using CSP for this, they'll be added to the filter lists, just like any other tracking script. We're not asking uBlock to block all third-party requests on the off-chance it might be an ad or tracking service
This is a good question! When a new technology arrives that allows tracking, I prefer uBlock default to blocking it. Advertising/tracking companies pursue the bleeding edge in their cat & mouse game; this way the barn door is closed before the horse leaves (two too many animal analogies?). I do understand that others will pursue a different choice, and encourage disclosure by those doing so because money is on the line.
The discussion regarding CSP has resulted in a change in uBlock's default behavior which I will take into consideration the next time I re-evaluate which ad blocker to use.
PS. In case it's not clear, I originally commented: >Personally I would prefer only same-origin reports.
PPS. This is a much jucier target assuming it works when JavaScript is disabled.
Just a quick clarification:
uBlock Origin only blocks CSP reports if it has injected "neutered" scripts into a page - typically if the site uses some third party scripts like GA. Because these neutered scripts might create extra CSP reports, which would then leak data about the client.
If the site only uses first party scripts, CSP reports are very unlikely to be affected by any version of uBlock Origin.
Also, uBlock doesn't block any CSPs. Only some CSP reports.
Luckily, the next version of uBlock will let us block CSP reports alltogether.
If CSP reports become a reliable way to gather data, they _will_ be used for tracking. This is why we can't have nice things. And why I have to disable all nice things we do have, in my browser.
So this will only work for sites that use CSP and users who don't have uBlock Origin installed, unless uBlock Origin changes their default policy on CSPs.
ninja edit: I see uBlock Origin has changed their defaults to permit CSP submission [1]
[0] https://www.theregister.co.uk/2017/10/17/ublock_origin_csp_r...
[1] https://github.com/gorhill/uBlock/issues/3140