alt.hn

5/15/2026 at 6:00:03 PM

Building a UMatrix Replacement

 https://lock.cmpxchg8b.com/umatrix.html

by taviso

5/15/2026 at 8:16:29 PM

For those not aware, the article assumes you are stuck in Google Chrome. Ublock works correctly in Firefox and derivatives, I advise you to use that instead to end the suffering.

If you find yourself in a "only Internet Explorer 5.5 is supported" situation, you could perhaps use Ungoogled Chromium and manually install Ublock Origin to buy yourself time to get out of that dead lock.

by exceptione

5/16/2026 at 11:51:49 AM

I use FF and uBO (which has always worked better on FF than on the adtech browser), but I'd love uMatrix back. The interface of uBO is a typical mobile friendly simplification. As the article says, uBO can do everything if you are willing to write rules by hand. And missing is that the equivalent in uMatrix was a single click. Simply a huge step back in UX, and while I dropped uM eventually as the lack of maintenance resulted in incompatibilities, I'm now permitting far more connections than before as anything else would require too much work when I want to actually browse the web.

by Semaphor

5/16/2026 at 9:38:17 AM

Outside of "Cast" to Google Devices, what is any benefit in Chrome?

Firefox works fine now, I don't think I've had those memory issues that used to plague it in forever!

by marysol5

5/16/2026 at 9:06:51 AM

If you use a browser by a company that earns most of its revenue by selling ads and wonder why the ad-blocker is not working I may have a bridge to sell to you.

by atoav

5/15/2026 at 9:34:00 PM

The "solution" is to not use Chrome anymore.

Firefox hasn't (yet) crippled their add-ons, and says they have no plans to do so (today).

NoScript can do what you want, and more.

by anonymousiam

5/15/2026 at 8:56:01 PM

Nice work! FWIW, you can still use Manifest V2 extensions, like uMatrix, uBlock Origin, or Violentmonkey, in Chrome by passing command line flags. For example, on macOS:

    open -b com.google.Chrome --new --args --disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabled
When Google finally nerfs that, it is past time to move to Firefox or Brave, the latter of which has explicitly announced uMatrix support.

by madars

5/15/2026 at 11:49:31 PM

> For as long as we’re able (and assuming the cooperation of the extension authors), Brave will continue to support some privacy-relevant MV2 extensions—specifically AdGuard, NoScript, uBlock Origin, and uMatrix

Once Google removes MV2 and it's supporting code, Brave is not going to shoulder the cost of keeping all of that patched to run on newer builds of Chromium. Especially not because their own blocking doesn't rely on it, uMatrix has been deprecated since 2021, and AdGuard is already committed to transitioning to MV3.

by jorvi

5/16/2026 at 2:20:06 AM

I thought these stopped working altogether with the release of Chrome 142? I know you could override it for awhile there, but I've been lead to believe that option is gone.

This is part of what forced my hand and made Firefox my daily driver, at least for personal use.

by SoMomentary

5/16/2026 at 2:25:57 AM

It works fine in Chrome 148. Earlier Chrome versions removed chrome://flags versions of the above even with "Temporarily unexpire M147 flags" (and similar), but command line invocation continues to work.

by madars

5/15/2026 at 9:01:30 PM

If you are running a modern Firefox, there’s still nuMatrix: <https://codeberg.org/arek/nuMatrix>

by teddyh

5/15/2026 at 11:20:08 PM

There's still uMatrix, for that matter. gorhill hasn't updated it in 5 years, but still just werks.

by yborg

5/16/2026 at 9:21:18 AM

> There's still uMatrix, for that matter. gorhill hasn't updated it in 5 years, but still just werks.

Yes! I have uMatrix on all my computers. I wish it was still being updated but.. it still works great. The best ever.

by jjav

5/15/2026 at 11:55:19 PM

Yes, I still use it and can confirm that I have had no concerns or problems with it. On the other hand, if I had to reinstall, without research, I'm not sure how I would reinstall it. Having alternatives is a good thing.

by kencausey

5/16/2026 at 11:54:17 AM

I have had frequent enough issues with it silently blocking some things with no ui exposure of those blocks. Been a while now, but I think it was stuff like webrtc and other more "arcane" features.

by Semaphor

5/16/2026 at 12:40:21 AM

It mostly still just works. Sometimes even with everything enabled, a site won't work.

by dehrmann

5/16/2026 at 9:17:36 AM

Indeed, this is why I eventually stopped using it; sometimes a random site wouldn't function properly, and took time to figure out it was uMatrix. It was a nice plugin indeed though.

by gitaarik

5/16/2026 at 5:03:45 PM

uMatrix is very hard on sites by default. When something is glitchy, I assume it's because uMatrix blocked random third-party code.

by dehrmann

5/16/2026 at 11:56:13 AM

Oh, that is nice, I'll have a look at that when I'm back home.

by Semaphor

5/15/2026 at 8:19:32 PM

Weirdly enough I was wondering what Tavis Ormandy has been up to recently, as I haven't seen his name associated with any global show-stopping vulnerabilities from the Project Zero team for a while.

I miss uMatrix, too. Thank you for working on this!

by ldayley

5/15/2026 at 9:16:13 PM

I still use umatrix

but cloudflare blocks my "outdated browser" all the time

by m463

5/16/2026 at 5:55:44 PM

Something like uMatrix should be built right into the browser, and the fact that this isn't the case really says it all about how it's not the "user agent" anymore. It's the one extension that's absolutely essential IMO -- no third-party connections at all by default, yes it breaks a lot of sites, but then you should ask yourself if the content was really worth reading in the first place!

Besides the blocking, being able to see at the click of a button what kind of crap most sites want to load is really eye opening. And they would do so completely silently if you're using a "normie" browser created or financially supported by the largest advertising company in the world.

Instead the mainstream gets "security features" like Safe Browsing, where it connects to a Google server every day without most people's consent or even knowledge, downloading a list of hashes of "bad stuff" to block. Like open source software to download videos from YouTube (yt-dlp), which it flags as malware. Of course the tinfoil hat conspiracy theory that it's also sending every URL you visit to their server isn't true -- only the ones that match a hash, "to check for false positives". It's easy to see how this mechanism could be abused to log who is visiting particular URLs of interest, without alerting the user to it happening. As far as I see it, you would just have to trust them when they super-double-pinky-swear they would never do this. And of course the TLAs wouldn't allow them to disclose it if something like this happened on their orders.

by rep_lodsb

5/16/2026 at 6:29:22 PM

> [...] the fact that this isn't the case really says it all about how it's not the "user agent" anymore. [...] yes it breaks a lot of sites, but then you should ask yourself if the content was really worth reading in the first place!

Users want websites to work. The agent excludes a feature that, you admit, break most websites.

Yet you find it puzzling and anti-user behavior? Can you elaborate?

Would you be okay if it was built-in but disabled by default and hidden behind a setting or a flag?

by tredre3

5/16/2026 at 8:59:56 PM

Maybe websites should work without loading megabytes of scripts from third-party servers? I think that should be disabled unless you opt-in.

Also browsers by default using a blocklist from some company, and showing a giant scary warning and contacting their server when the user deliberately navigates to an URL that is on that list. That should be opt-in as well, rather than something that just happens and is considered acceptable.

by rep_lodsb

5/15/2026 at 8:22:24 PM

I don’t like Heroism, but finally a new article from Tavis Ormandy. Thanks for your work.

by comment0r

5/15/2026 at 8:11:15 PM

>I really don’t want to give that up – is there a solution?

Use Firefox, uBO works great. While I really enjoy seeing people find creative technical workarounds, the reason for it being needed in the first place is Googles fight against Adblockers with Manifest V3. Firefox allows people to sidestep this artificial downgrade of adblocking capabilities.

by lpcvoid

5/16/2026 at 12:14:39 AM

But performance? Question mark?

by tadfisher

5/17/2026 at 2:15:25 AM

Ads and other third party stuff are the major performance problem. Spending 1 millisecond of cpu time to block megabytes of ads and javascript (that would take much longer than 1 millisecond to run) is well worth it IMO.

by mrgoldenbrown

5/16/2026 at 2:21:42 AM

Webpages run a lot better when I block all that extra shit from running!

by SoMomentary