Starting a new thread here, but the subject came up of the places.sqlite file and visiting sites
that loaded other sites etc etc etc.

The conversation hit upon plugins/addons that stopped this. I'm sure a good number of you try to
stop the intrusions into your browser, so my question is, what tweaks/add-ons/plugins do you use to
do this?
Specifically the name and why so others might load the add-on too.
I'm more curious than paranoid but I might just learn something. Hell, Ublock Origin was unknown
till I was told about it.

--
Linux Mint 21.3 Cinnamon 6.0.4
Al

On 3/18/2024 7:41 AM, Big Al wrote:
> Starting a new thread here, but the subject came up of the places.sqlite file and visiting sites
> that loaded other sites etc etc etc.
>
> The conversation hit upon plugins/addons that stopped this. I'm sure a good number of you try to
> stop the intrusions into your browser, so my question is, what tweaks/add-ons/plugins do you use to
> do this?
> Specifically the name and why so others might load the add-on too.
> I'm more curious than paranoid but I might just learn something. Hell, Ublock Origin was unknown
> till I was told about it.
>

I use Privacy Badger and DuckDuckGo Privacy Essentials. Depending upon
which web site I'm on and what I'm trying to do, I sometimes have to
turn off Privacy Badger for a specific site or web page to get a page to
work properly. However, it's surprising to see how often many sites or
cookies are blocked without affecting the utility of some web sites. In
almost all circumstances, government web sites aren't affected by those
2 add-ons.

On Mon, 18 Mar 2024 07:41:58 -0400
Big Al <alan@invalid.com> wrote:

> Starting a new thread here, but the subject came up of the
> places.sqlite file and visiting sites that loaded other sites etc
> etc etc.
>
> The conversation hit upon plugins/addons that stopped this. I'm
> sure a good number of you try to stop the intrusions into your
> browser, so my question is, what tweaks/add-ons/plugins do you use
> to do this? Specifically the name and why so others might load the
> add-on too. I'm more curious than paranoid but I might just learn
> something. Hell, Ublock Origin was unknown till I was told about
> it.
>

https://noscript.net/

Al,

> ... the subject came up of the places.sqlite file and visiting sites that
> loaded other sites etc etc etc.

> what tweaks/add-ons/plugins do you use to do this?

I mentioned a setting to change the automatically following of redirections
into a manual one. I was mistaken. That behaviour - and the "only
first-party resources allowed" (configurable) I mentioned - is provided by
an extension named "RequestPolicy".

As others have mentioned, have a bit more control over which websites are
allowed to run scripts you could take a peek at the "NoScript" extension.

As I sometimes dislike how websites present themselves I've got an extension
with the name "GreaseMonkey" installed, which uses user-written JS to change
how the webpage looks. I also use it to remove "you've got an ad-blocker
installed, get rid of it" (which I have not) messages. :-)

Thats it for me. It seems to cover all my needs.

So, "RequestPolicy", "NoScript" and "GreaseMonkey".

A remark though : I'm still running FF v52 on XPsp3, and have no idea if
extensions still exists for a more recent version of FF (the extension
mechanism has changed quite a bit).

Regards,
Rudy Wieser

"Big Al" <alan@invalid.com> wrote

| The conversation hit upon plugins/addons that stopped this. I'm sure a
good number of you try to
| stop the intrusions into your browser, so my question is, what
tweaks/add-ons/plugins do you use to
| do this?
| Specifically the name and why so others might load the add-on too.
| I'm more curious than paranoid but I might just learn something. Hell,
Ublock Origin was unknown
| till I was told about it.
|

This is a big topic. I use NoScript and a CSS toggler
in Firefox, to minimize script and make webpages more
flexible. For most of my purposes I can avoid enabling script.

In Firefox I also set FF Accessibility.blockautorefresh and
disable the various types of prefetching, which have become a
whole new aspect of online spying. If you look at the source
code of commercial pages these days you may see code in
the header, calling on the browser to invisibly load several
other webpages and make several DNS calls. For example,
yesterday I was trying to figure out how to shut off the idiotic
message at login that my password had expired in Win10.
I don't even have a password! I found a webpage with a good
explanation and downloaded the page to save. This was in
the header:
<link rel="dns-prefetch" href="//www.google-analytics.com" />
<link rel="dns-prefetch" href="//ajax.googleapis.com" />
<link rel="dns-prefetch" href="//www.googleadservices.com/" />
<link rel="dns-prefetch" href="//www.googletagmanager.com/" />
<link rel="dns-prefetch" href="//c.disquscdn.com/" /> That's just DNS
prefetching. Some pages tell the browser
to prefetch whole webpages. But even DNS, if people are
using something like Google or their ISP, is a potential tracking
source.

For most of my browsing I'm also still using an outdated
extension called Secret Agent that messes with such obscure
items as etags.

I close the browser when not using it, only use Firefox
or *Moon browsers, and set cookies to delete when the
browser closes. I also disable "supercookie" cache and set
webpage cache to 10 MB limit. Web cache is all but outdated
today. 304 server responses are rare. And web cache is used
in tracking, by doing things like using script to see whether links
in the page are visited color after you load it.

I've always used a HOSTS file and now use Acrylic DNS proxy
with its own wildcard HOSTS file, which can block things
like *.googletagmanager.com.

For friends I set up UBlock Origin and possibly a limited Acrylic
HOSTS file. That's for people who won't do anything themselves
and can't handle NoScript. UO is better than nothing. But it's
not clear exactly what it's doing. It runs on various publixcly
available lists and HOSTS files. Does it actually block Google's
various spyware domains, or are the developers only trying
to offer a tidbit of privacy without disturbing "online commerce"?
I don't know. To really research and control UO would be a lot
more work than just having a HOSTS file and NoScript.

I've also used firewalls since 1999 when I bought AtGuard.
That's increasingly important to block software calling home.
On OpenSuse I just set up OpenSnitch. It seems to work well.
On XP I have Online Armor. On 10 I think I was using Tinywall.
But then I found Simplewall which seems to be more comprehensive,
asking me about all outgoing attempts.

On 3/18/24 10:15 AM, Newyana2 wrote:
> But then I found Simplewall which seems to be more comprehensive,
> asking me about all outgoing attempts.
I remember back in the win9x days maybe that I had a firewall like that, and may have been, as you
used it, it asked for every outgoing request. A bit annoying on first setup, but refreshing to know
what was going on. Especially nice for loading software that called home during install.
--
Linux Mint 21.3 Cinnamon 6.0.4
Al

"Big Al" <alan@invalid.com> wrote

| I remember back in the win9x days maybe that I had a firewall like that,
and may have been, as you
| used it, it asked for every outgoing request. A bit annoying on first
setup, but refreshing to know
| what was going on. Especially nice for loading software that called home
during install.

Yes. And usually one can choose to block one attempt
or enable/block all. Some of them also allow choosing what
ports are enabled.

On Win7 I think I have Private Firewall. I'm not so wild
about that one because it doesn't ask, so I have to
remember to specifically enable new programs.

I like Simplewall because it asks and also provides
clear settings. I can switch the status of anything at any
time. And it seems to be able to block all the Windows
reporting. It doesn't whitelist a pile of processes the
way that some firewalls do.

AtGuard was among the best ever. In '99 it was $30,
as I recall, but it was way ahead of its time. It controlled
outgoing and incoming. It also blocked ads based on
HTML code snippets. If it missed an ad one could drag it
to the rubbish barrel icon to teach AtGuard to recognize it.

One time I saw an ad for Visual Studio. For fun I decided
to drag it to the rubbish barrel icon, but apparently I used
the wrong mouse button or some such. Suddenly AtGuard
popped up and asked whether I wanted to allow DCOM to
go out. DCOM?! At the time I had no idea what that was.
I discovered that it meant runing COM objects remotely.
Apparently MS was going to run a COM object on my system
to check me out while I looked at their VS ad.... Interesting
lesson in privacy.

Not long after AtGuard came out, Symantec licensed it
exclusively and rebranded it as Norton. They doubled the price,
paid for fancy displays in stores selling software, and set some
700 programs to have online access by default. So it probably
seemed very stable, since it did almost nothing.

One could always tell the best software because Symantec would
buy it and ruin it. Norton utilities. Quarterdeck Clean Sweep.
Powerquest Drive Image. They bought all of them. With the
latter two Symantec pretty much removed all the functionality,
reducing them to useless backup utilities. Did MS pay them to
do that? I wonder. What sense is there is buying good software
only to break it?

On 18.03.24 12:41, Big Al wrote:
> till I was told about it.

In FF on all OSs and also in Vivaldi:

uBlock Origin (easy to use out of the box)
NoScript (not so easy to use but extremely powerful)
DuckDuckGo Privacy Essentials (as part of DucDuckGo Search)

A different set in Safari.

--
"Manus manum lavat."

On 18/03/2024 11:41, Big Al wrote:
> Starting a new thread here, but the subject came up of the
> places.sqlite file and visiting sites that loaded other sites etc etc
> etc.
>
> The conversation hit upon plugins/addons that stopped this.� I'm sure
> a good number of you try to stop the intrusions into your browser, so
> my question is, what tweaks/add-ons/plugins do you use to do this?
> Specifically the name and why so others might load the add-on too.
> I'm more curious than paranoid but I might just learn something. Hell,
> Ublock Origin was unknown till I was told about it.
>
I don't use anything. Just simple vanilla browser and login to Tik-Tok &
YouTube and post videos in the normal way. I don't worry about privacy.
I am just a normal serial killer and privacy doesn't affect me. Already
killed about 10 people and still free to walk without hindrance.

Big Al <alan@invalid.com> wrote:
> I'm sure a good number of you try to stop the intrusions into
> your browser, so my question is, what tweaks/add-ons/plugins do
> you use to do this?

NoScript and a whole bunch of about:config settings. Many of the
latter are about improving performance rather than privacy though,
so it would take time to pick out the ones relevent to this
question. The annoying ones are beacon.enabled = false and
network.http.sendRefererHeader = 0 because some websites won't work
with these settings. The extension that I used to toggle the
referer header automatically went wonky after a browser update, and
I can't find one to toggle beacon, so I'm doing both manually.

What I'd love is an extension to toggle any user-set about:config
setting depending on the website that is visited. In fact I'd like
similar functionality in NoScript where for example Google scripts
can be enabled just for certain websites where I'm forced to let
them through manually in order to pass through Google Captchas
without whitelisting them and allowing Google to track me on other
sites where that's not required.

--
__ __
#_ < |\| |< _#

Computer Nerd Kev <not@telling.you.invalid> wrote at 21:53 this Monday (GMT):
> Big Al <alan@invalid.com> wrote:
>> I'm sure a good number of you try to stop the intrusions into
>> your browser, so my question is, what tweaks/add-ons/plugins do
>> you use to do this?
>
> NoScript and a whole bunch of about:config settings. Many of the
> latter are about improving performance rather than privacy though,
> so it would take time to pick out the ones relevent to this
> question. The annoying ones are beacon.enabled = false and
> network.http.sendRefererHeader = 0 because some websites won't work
> with these settings. The extension that I used to toggle the
> referer header automatically went wonky after a browser update, and
> I can't find one to toggle beacon, so I'm doing both manually.
>
> What I'd love is an extension to toggle any user-set about:config
> setting depending on the website that is visited. In fact I'd like
> similar functionality in NoScript where for example Google scripts
> can be enabled just for certain websites where I'm forced to let
> them through manually in order to pass through Google Captchas
> without whitelisting them and allowing Google to track me on other
> sites where that's not required.

NoScript is pretty good for that, I usually leave it on.
--
user <candycane> is generated from /dev/urandom

candycanearter07 <candycanearter07@candycanearter07.nomail.afraid> wrote:
> Computer Nerd Kev <not@telling.you.invalid> wrote at 21:53 this Monday (GMT):
>> What I'd love is an extension to toggle any user-set about:config
>> setting depending on the website that is visited. In fact I'd like
>> similar functionality in NoScript where for example Google scripts
>> can be enabled just for certain websites where I'm forced to let
>> them through manually in order to pass through Google Captchas
>> without whitelisting them and allowing Google to track me on other
>> sites where that's not required.
>
> NoScript is pretty good for that, I usually leave it on.

I think you missed my point. If I always leave it blocking Google
scripts then lots of websites requiring Google Captchas become
off-limits. But if I allow Google scripts by default in NoScript,
they get run on lots of websites that don't actually have Captchas,
so Google gets more info about my browsing than I need to give
them.

As it is I manually allow the Google scripts required for Captchas
when I need to, but it would be good to have a way in NoScript to
permit those scripts only on that website, so I wouldn't have to
keep doing it manually after the first visit.

It also applies to other scripts which often pop up where they're
not required, but on some sites they are. The Google Captchas are
especially annoying though because you need to reload the page
twice so one Google script can load another Google script which
also needs to be manually permitted before the Captcha will work.
Particularly annoying when my internet connection is being
slow/unreliable.

--
__ __
#_ < |\| |< _#

"Computer Nerd Kev" <not@telling.you.invalid> wrote

| I think you missed my point. If I always leave it blocking Google
| scripts then lots of websites requiring Google Captchas become
| off-limits. But if I allow Google scripts by default in NoScript,
| they get run on lots of websites that don't actually have Captchas,
| so Google gets more info about my browsing than I need to give
| them.
| | As it is I manually allow the Google scripts required for Captchas
| when I need to, but it would be good to have a way in NoScript to
| permit those scripts only on that website, so I wouldn't have to
| keep doing it manually after the first visit.
|

I've found that the source you need to allow is
from gstatic.com. I block over a dozen Google domains
in HOSTS. Pretty much everything except www.google.com,
which I occasionally use when I'm desperate to find
some info and I'm willing to wade through 3 pages of
ads, maps, bullshit categories, comparison shopping, and
so on. To the extent that their search actually works, it's
undeniably good.

The captchas disappear if I don't allow gstatic, but
otherwise seem to work. You could try that: whitelist
gstatic.com.

But I expect this situation is only going to get worse.
The line between website domains is disappearing. To a
great extent it's deliberate. It started way back when
Yahoo started using yimg.com to load images, breaking
the Firefox ability to block 3rd-party files. A 3rd-party
source is generally an ad or spyware (or worse) by definition,
but with CDN servers and multiple in-house domains, the
original design for online privacy is out the window. And now
there are often giant javascript "libraries" loading from
remote sources. It's getting to be like every page is an app,
and it's all obfuscated... and it's coming from a dozen domains.

With Flash at least you knew what Flash was, you could assess
the source, and you could decide whether to let it run. When
you're being dumped on by 5-20 MB of javascript, which
could even be compilable to native code, and which may be
coming from sources you've never heard of, all bets are off.
You're essentially running a medium-size software program from
an anonymous source.

Many of these sites are taking part in what the ad people call
a "program", meaning some kind of datamining arrangement.
A program like Akamai's "pixel-free" surveillance doesn't even
require loading remote files. Akamai is spying on the Internet
itself, acting as a massive backend CDN service. And of course,
Google is arguably the grandfather of sleazeball surveillance
programs, getting multiple spyware plants on nearly all commercial
websites through analytics, adsense, maps, fonts and so on.

On Tue, 19 Mar 2024 08:49:47 -0400
"Newyana2" <Newyana2@invalid.nospam> wrote:

> "Computer Nerd Kev" <not@telling.you.invalid> wrote
>
>
> | I think you missed my point. If I always leave it blocking Google
> | scripts then lots of websites requiring Google Captchas become
> | off-limits. But if I allow Google scripts by default in NoScript,
> | they get run on lots of websites that don't actually have
> Captchas, | so Google gets more info about my browsing than I need
> to give | them.
> |
> | As it is I manually allow the Google scripts required for Captchas
> | when I need to, but it would be good to have a way in NoScript to
> | permit those scripts only on that website, so I wouldn't have to
> | keep doing it manually after the first visit.
> |
>
> I've found that the source you need to allow is
> from gstatic.com. I block over a dozen Google domains
> in HOSTS. Pretty much everything except www.google.com,
> which I occasionally use when I'm desperate to find
> some info and I'm willing to wade through 3 pages of
> ads, maps, bullshit categories, comparison shopping, and
> so on. To the extent that their search actually works, it's
> undeniably good.
>
> The captchas disappear if I don't allow gstatic, but
> otherwise seem to work. You could try that: whitelist
> gstatic.com.
>
> But I expect this situation is only going to get worse.
> The line between website domains is disappearing. To a
> great extent it's deliberate. It started way back when
> Yahoo started using yimg.com to load images, breaking
> the Firefox ability to block 3rd-party files. A 3rd-party
> source is generally an ad or spyware (or worse) by definition,
> but with CDN servers and multiple in-house domains, the
> original design for online privacy is out the window. And now
> there are often giant javascript "libraries" loading from
> remote sources. It's getting to be like every page is an app,
> and it's all obfuscated... and it's coming from a dozen domains.
>
> With Flash at least you knew what Flash was, you could assess
> the source, and you could decide whether to let it run. When
> you're being dumped on by 5-20 MB of javascript, which
> could even be compilable to native code, and which may be
> coming from sources you've never heard of, all bets are off.
> You're essentially running a medium-size software program from
> an anonymous source.
>
> Many of these sites are taking part in what the ad people call
> a "program", meaning some kind of datamining arrangement.
> A program like Akamai's "pixel-free" surveillance doesn't even
> require loading remote files. Akamai is spying on the Internet
> itself, acting as a massive backend CDN service. And of course,
> Google is arguably the grandfather of sleazeball surveillance
> programs, getting multiple spyware plants on nearly all commercial
> websites through analytics, adsense, maps, fonts and so on.

I never use Google, and block all Google scripts with NoScript.

On 19.03.24 13:49, Newyana2 wrote:
> I've found that the source you need to allow is
> from gstatic.com.

This one allows the access to pictures. It is not clever to block this
script. One of the very few I accept from Google.

--
"Manus manum lavat."

On 19.03.24 14:04, Johnny wrote:

> I never use Google, and block all Google scripts with NoScript.

Not very clever and does not improve your privacy. Accept the two:

google.com
gstatic.com

--
"Manus manum lavat."

"Johnny" <johnny@invalid.net> wrote

| I never use Google, and block all Google scripts with NoScript.
| That helps, though blocking the domains is better. In many
cases these snoops will use web bugs (1x1 pixel fake images)
to make you call their server and thereby get tracking data.

These are my Acrylic HOSTS entries for Google alone (which
doesn't include the maps URL):

127.0.0.1 *.googleusercontent.com
127.0.0.1 *.googlesyndication.com
127.0.0.1 *.googleadservices.com
127.0.0.1 *.googlecommerce.com
127.0.0.1 *.1e100.com
127.0.0.1 *.1e100.net
127.0.0.1 *.doubleclick.net
127.0.0.1 *.doubleclick.com
127.0.0.1 *.googletagservices.com
127.0.0.1 *.googletagmanager.com
127.0.0.1 *.google-analytics.com
127.0.0.1 google-analytics.com
127.0.0.1 fonts.googleapis.com
127.0.0.1 *.2mdn.net
127.0.0.1 googleadapis.l.google.com
#127.0.0.1 *.gstatic.com
127.0.0.1 plusone.google.com
127.0.0.1 cse.google.com
127.0.0.1 www.google.com/cse
127.0.0.1 www.youtube-nocookie.com
127.0.0.1 *.appspot.com

Am 19.03.24 um 18:09 schrieb Newyana2:
> "Johnny" <johnny@invalid.net> wrote
>
> | I never use Google, and block all Google scripts with NoScript.
> |
> That helps, though blocking the domains is better. In many
> cases these snoops will use web bugs (1x1 pixel fake images)
> to make you call their server and thereby get tracking data.
>
> These are my Acrylic HOSTS entries for Google alone (which
> doesn't include the maps URL):
>
> 127.0.0.1 *.googleusercontent.com
> 127.0.0.1 *.googlesyndication.com
> 127.0.0.1 *.googleadservices.com
> 127.0.0.1 *.googlecommerce.com
> 127.0.0.1 *.1e100.com
> 127.0.0.1 *.1e100.net
> 127.0.0.1 *.doubleclick.net
> 127.0.0.1 *.doubleclick.com
> 127.0.0.1 *.googletagservices.com
> 127.0.0.1 *.googletagmanager.com
> 127.0.0.1 *.google-analytics.com
> 127.0.0.1 google-analytics.com
> 127.0.0.1 fonts.googleapis.com
> 127.0.0.1 *.2mdn.net
> 127.0.0.1 googleadapis.l.google.com
> #127.0.0.1 *.gstatic.com
> 127.0.0.1 plusone.google.com
> 127.0.0.1 cse.google.com
> 127.0.0.1 www.google.com/cse
> 127.0.0.1 www.youtube-nocookie.com
> 127.0.0.1 *.appspot.com

These are no news.

--
"Gutta cavat lapidem." (Ovid)

Newyana2 wrote:
> "Computer Nerd Kev" <not@telling.you.invalid> wrote
>

> |
> | As it is I manually allow the Google scripts required for Captchas
> | when I need to, but it would be good to have a way in NoScript to
> | permit those scripts only on that website, so I wouldn't have to
> | keep doing it manually after the first visit.
> |
>
> I've found that the source you need to allow is
> from gstatic.com. I block over a dozen Google domains
> in HOSTS. Pretty much everything except www.google.com,
> which I occasionally use when I'm desperate to find
> some info and I'm willing to wade through 3 pages of
> ads, maps, bullshit categories, comparison shopping, and
> so on. To the extent that their search actually works, it's
> undeniably good.

A lot depends on what sites you go to, and what scripting they're
running. With gstatic, I can leave that blocked a lot of the time, but
there are sites that won't work unless it's active. The same things
apply to things like googletagmanager and ajax.googleapis.com.

Yes, I know that there's a lot of Google information collection with
some of those domains, but if an application is built in AJAX, it won't
run if the necessary scripting isn't enabled. I've also seen plenty of
sites that use googletagmanager as the tool for doing field-level
validity checking in forms. If the scripting isn't enabled, you can't
even enter data into fields. And I've also seen sites that use Google's
fonts that won't work unless they can get the fonts from
fonts.gstatic.com. I don't know if the top level of gstatic is
necessary or not, but the site definitely needs the fonts.

The only Google site that I'm entirely confident of permanently
blacklisting via NoScript is Google Analytics.

Thus, I blacklist everything as a default, but if a site isn't rendering
properly, I'm not surprised if I have to manually enable one or more
Google domains to get things working.

>
> The captchas disappear if I don't allow gstatic, but
> otherwise seem to work. You could try that: whitelist
> gstatic.com.

I've noticed that captchas are more prevalent if scripting is blocked,
although I never made the link with gstatic.

Smith

Newyana2 <Newyana2@invalid.nospam> wrote:
> "Computer Nerd Kev" <not@telling.you.invalid> wrote
>
> | I think you missed my point. If I always leave it blocking Google
> | scripts then lots of websites requiring Google Captchas become
> | off-limits. But if I allow Google scripts by default in NoScript,
> | they get run on lots of websites that don't actually have Captchas,
> | so Google gets more info about my browsing than I need to give
> | them.
> |
> | As it is I manually allow the Google scripts required for Captchas
> | when I need to, but it would be good to have a way in NoScript to
> | permit those scripts only on that website, so I wouldn't have to
> | keep doing it manually after the first visit.
> |
>
> I've found that the source you need to allow is
> from gstatic.com. I block over a dozen Google domains
> in HOSTS. Pretty much everything except www.google.com,
> which I occasionally use when I'm desperate to find
> some info and I'm willing to wade through 3 pages of
> ads, maps, bullshit categories, comparison shopping, and
> so on. To the extent that their search actually works, it's
> undeniably good.
>
> The captchas disappear if I don't allow gstatic, but
> otherwise seem to work. You could try that: whitelist
> gstatic.com.

Oh I know, that's exactly what I was just talking about. Except you
only see "gstatic.com" in the NoScript menu after it's requested by
another Google script from "google.com" first, which I also need to
manually allow.

So eg.
webpage with form to submit.
v
enter details and submit.
v
receive meaningless error message
or no response at all.
v
NoScript -> temp. allow google.com.
v
page reloads (often with a blank form
missing all the info I just filled in - argh!).
v
NoScript -> temp. allow gstatic.com.
v
page reloads again now displaying some Google
reCaptcha button/symbol that wasn't there before.
v
finally I can fill in the form again, maybe
solve a captcha or two, and eventually submit
the damn form!

Can people here understand that? That's why I want the feature to
whitelist those scripts on sites (or, even better, specific pages)
using Google Captchas.

> Many of these sites are taking part in what the ad people call
> a "program", meaning some kind of datamining arrangement.
> A program like Akamai's "pixel-free" surveillance doesn't even
> require loading remote files. Akamai is spying on the Internet
> itself, acting as a massive backend CDN service. And of course,
> Google is arguably the grandfather of sleazeball surveillance
> programs, getting multiple spyware plants on nearly all commercial
> websites through analytics, adsense, maps, fonts and so on.

Yes and that's exactly why I don't allow gstatic.com and google.com
everywhere. I do always block googleanalytics.com by default, which
is what Google use to collect analytics data for others. What's to
say they don't collect data for themselves from google.com and
gstatic.com? Nothing at all, in fact they probably do, and that data
can be used to track what site you're visiting just like
googleanalytics.com. Blocking one and allowing the other is
borderline pointless, since the others not found only where Captchas
are used. Which I thought would be obvious to anyone using NoScript,
but I guess maybe it isn't.

--
__ __
#_ < |\| |< _#