Can you teach me this skill? I usually don't mind steep learning curves and taking a while to familiarize myself with a piece of technology if I believe that I'll end up benefiting from it (I type in dvorak, use a tiling window manager, I'm a shell power user etc...) but try as I might I just can't wrap my head around umatrix.
I understand what it does, I just don't understand how to use it effectively. Like I just tried it: I enabled uMatrix and went on the website of the NY Times. I end up with a rather large matrix with a bunch of domains like "a.nytimes.com", "api.nytimes.com", "samizdat-graphql.nytimes.com", "optimizely.com", "js-sec.indexwww.com" and many others, includind a bunch of google and amazon domains.
How am I supposed to figure out what I should whitelist in there? Trial and error?
There are a few obvious candidates for blacklisting (amazon-adsystem.com for instance) but I'm sure that those would already be blocked by my uBlock filters. Actually so far uBlock with a few ad + privacy enhancing filters seem to do a decent job which makes uMatrix even more frustrating because I feel like I'm doing something by hand that uBlock does just fine automatically.
But at the same time I often see people praise uMatrix here on HN and that makes me feel inadequate and noobish so I really want to understand what I'm not understanding.
Not sure if you know, but you don't need uMatrix when using uBlock Origin - it has build in the same functionality. You just need to tell uBlock that you're advanced user by checking option in settings.
What TekMol is using sounds like Hard Mode. Personally, I chose Medium Mode (blocking only 3rd-party scripts) as there isn't much difference between them. [1]
Generally, if the website breaks it's "scripts" from somewhere, or rarely xhr. When it's frames, it looks like a chunk of the site is missing. If media won't load it is media. And basically never allow anything from a dark red square.
I'd check umatrix's site and there are a number of presets to make major sites work you can use. After that, if a site doesn't work fiddle with allowing things from places. Save when you're content. It's pretty easy to get the hang of.
I don't run uBlock. Only umatrix. So my situation is different then yours. As I said, I don't blacklist specific hosts. I blacklist everything. And then whitelist specific hosts.
I'm asking about the whitelisting process: when something breaks how do you figure out what you have to whitelist? Many websites load dozens of external resources, how do you figure out what does what?
I usually hit the right one on the first or second try. The hostname usually tells you what it does.
Say the images of users on github.com are broken. I open umatrix and think 'Hmm.. which host could they load them from?'. I enable 'githubusercontent.com' and voila! The user images appear.
Domains that include "assets", "cdn", "static" and similar will probably be needed, at least if you want scripts to run and css to be included.
Anything with "ad" in the name you should probably not enable.
Other than that, basically trial and error. After a while it'll hopefully be easier to tell, but it will still be somewhat tedious each time you encounter a new site.
When you add Decentraleyes and add its ruleset to uMatrix, a lot of things start working.
Context: Decentraleyes is an extension that bundles a lot of those CDN-served JS frameworks and serves the locally stored version when it intercepts a matching HTTP request to fetch from those CDNs.
Basically, another extension can intercept the request before Decentraleyes can get to it.
"The race is always won by the most recently installed extension."
This works but it becomes a grind, especially on sites that fail in subtle ways until you realize why they are broken. And clicking in the matrix is kind of finicky, which the magic spots for subdomain vs domain.
There's a lot of room for streamlining the UI for enabling resources.
I use umatrix with these two default rules:
So by default a site can load whatever it wants from its own domain and nothing from 3rd party domains.Then I add rules as needed. The Umatrix interface makes this super easy.