From: Roland Rosenfeld Privoxy ran out of memory while processing your request. Please contact your proxy administrator, or try again later Privoxy encountered an error while processing your request: Could not load template file Please contact your proxy administrator. If you are the proxy administrator, please put the required file(s)"
+ "in the Privoxy encountered an error while processing your request: Unexpected internal error: ";
+ static const char body_suffix[] =
+ " Please "
+ ""
+ "file a bug report.NAME
" > doc/webserver/man-page/privoxy-man-page.html
+ man ./privoxy.1 | $(MAN2HTML) -bare >> doc/webserver/man-page/privoxy-man-page.html
+ $(ECHO) "" >> doc/webserver/man-page/privoxy-man-page.html
+else
+ $(MAKE) groff2html
+endif
+
+# readme page
+dok-readme:
+ cd doc/source && $(DB) -V nochunks readme.sgml > tmp.html &&\
+ $(WDUMP) tmp.html > ../../README && $(RM) -r tmp.html
+
+# webserver files
+dok-webserver:
+ cd doc/source/webserver && $(DB)-notoc -V nochunks index.sgml > ../../webserver/index.html
+ $(PERL) -pi.bak -e 's/..\/p_doc.css/p_doc.css/;\
+ s/<\/HEAD/\n<\/HEAD/;\
+ s/<\/HEAD/\n<\/HEAD/;\
+ s/\.\d\. //'\
+ doc/webserver/index.html && $(RM) doc/source/webserver/*.bak
+
+# Main documentation target.
+dok: dok-release dok-devel dok-user dok-faq dok-readme dok-webserver dok-authors
+ @$(ECHO) Documentation created.
+
+#
+# an alternative to the above dok. disabled man page creation for the moment
+#
+redhat-dok: dok-release dok-devel dok-user dok-faq redhat-readme dok-webserver dok-authors
+ @$(ECHO) Documentation created.
+
+# For those with man2html ala RH7's.
+man2html:
+ mkdir -p doc/webserver/man-page
+ifneq ($(MAN2HTML),false)
+ $(MAN2HTML) privoxy.1 |grep -v "^Content-type" > tmp.html
+ $(PERL) -pi.bak -e 's///; s//man2html/' tmp.html
+ $(PERL) -pi.bak -e 's/(<\/HEAD>)/<\/HEAD>/' tmp.html
+# Get rid of spurious from conversion. (How to do this with perl?)
+ $(SED) -e 's///g' tmp.html > doc/webserver/man-page/privoxy-man-page.html && $(RM) tmp.*
+else
+ $(MAKE) groff2html
+endif
+
+# Otherwise we get plain groff conversion.
+groff2html:
+ $(G2H_CMD) ./privoxy.1 | $(SED) -e 's@@@' > doc/webserver/man-page/privoxy-man-page.html
+
+## Make README
+redhat-readme:
+ cd doc/source && $(DB) -V nochunks readme.sgml > tmp.html && $(WDUMP) \
+ tmp.html > ../../README && $(RM) -r tmp.html
+
+## Make AUTHORS file
+dok-authors:
+ cd doc/source && $(DB) -V nochunks authors.sgml > tmp.html && $(WDUMP) \
+ tmp.html > ../../AUTHORS && $(RM) tmp.html
+
+# make a man page, and then (lousy) HTML version.
+# Requires docbook2man (short perl script), see comments
+# in privoxy-man-page.sgml. This target is not invoked from other dok targets.
+# It is built separately due to dependencies on perl scripts.
+man:
+ mkdir -p doc/source/man
+ cd doc/source/man && docbook2man ../privoxy-man-page.sgml &&\
+ perl -pi.bak -e 's/
-", some "
-" (note the space).
+ * Standardizing on no space.
+ * - Greatly simplifying some of the code by using string_join()
+ * where appropriate.
+ *
+ * Revision 1.28 2002/04/26 12:53:15 oes
+ * - CGI AF editor now writes action lines split into
+ * single lines with line continuation
+ * - actions_to_html now embeds each action name in
+ * link to chapter
+ * - current_action_to_text is now called current_action_to_html
+ * and acts like actions_to_html
+ *
+ * Revision 1.27 2002/04/24 02:10:31 oes
+ * - Jon's patch for multiple AFs:
+ * - split load_actions_file, add load_one_actions_file
+ * - make csp->actions_list files an array
+ * - remember file id with each action
+ * - Copy_action now frees dest action before copying
+ *
+ * Revision 1.26 2002/03/26 22:29:54 swa
+ * we have a new homepage!
+ *
+ * Revision 1.25 2002/03/24 13:25:43 swa
+ * name change related issues
+ *
+ * Revision 1.24 2002/03/16 23:54:06 jongfoster
+ * Adding graceful termination feature, to help look for memory leaks.
+ * If you enable this (which, by design, has to be done by hand
+ * editing config.h) and then go to http://i.j.b/die, then the program
+ * will exit cleanly after the *next* request. It should free all the
+ * memory that was used.
+ *
+ * Revision 1.23 2002/03/07 03:46:16 oes
+ * Fixed compiler warnings
+ *
+ * Revision 1.22 2002/01/21 00:27:02 jongfoster
+ * Allowing free_action(NULL).
+ * Moving the functions that #include actionlist.h to the end of the file,
+ * because the Visual C++ 97 debugger gets extremely confused if you try
+ * to debug any code that comes after them in the file.
+ *
+ * Revision 1.21 2002/01/17 20:54:44 jongfoster
+ * Renaming free_url to free_url_spec, since it frees a struct url_spec.
+ *
+ * Revision 1.20 2001/11/22 21:56:49 jongfoster
+ * Making action_spec->flags into an unsigned long rather than just an
+ * unsigned int.
+ * Fixing a bug in the display of -add-header and -wafer
+ *
+ * Revision 1.19 2001/11/13 00:14:07 jongfoster
+ * Fixing stupid bug now I've figured out what || means.
+ * (It always returns 0 or 1, not one of it's paramaters.)
+ *
+ * Revision 1.18 2001/11/07 00:06:06 steudten
+ * Add line number in error output for lineparsing for
+ * actionsfile.
+ *
+ * Revision 1.17 2001/10/25 03:40:47 david__schmidt
+ * Change in porting tactics: OS/2's EMX porting layer doesn't allow multiple
+ * threads to call select() simultaneously. So, it's time to do a real, live,
+ * native OS/2 port. See defines for __EMX__ (the porting layer) vs. __OS2__
+ * (native). Both versions will work, but using __OS2__ offers multi-threading.
+ *
+ * Revision 1.16 2001/10/23 21:30:30 jongfoster
+ * Adding error-checking to selected functions.
+ *
+ * Revision 1.15 2001/10/14 21:58:22 jongfoster
+ * Adding support for the CGI-based editor:
+ * - Exported get_actions()
+ * - Added new function free_alias_list()
+ * - Added support for {{settings}} and {{description}} blocks
+ * in the actions file. They are currently ignored.
+ * - Added restriction to only one {{alias}} block which must appear
+ * first in the file, to simplify the editor's rewriting rules.
+ * - Note that load_actions_file() is no longer used by the CGI-based
+ * editor, but some of the other routines in this file are.
+ *
+ * Revision 1.14 2001/09/22 16:36:59 jongfoster
+ * Removing unused parameter fs from read_config_line()
+ *
+ * Revision 1.13 2001/09/16 15:47:37 jongfoster
+ * First version of CGI-based edit interface. This is very much a
+ * work-in-progress, and you can't actually use it to edit anything
+ * yet. You must #define FEATURE_CGI_EDIT_ACTIONS for these changes
+ * to have any effect.
+ *
+ * Revision 1.12 2001/09/16 13:21:27 jongfoster
+ * Changes to use new list functions.
+ *
+ * Revision 1.11 2001/09/14 00:17:32 jongfoster
+ * Tidying up memory allocation. New function init_action().
+ *
+ * Revision 1.10 2001/09/10 10:14:34 oes
+ * Removing unused variable
+ *
+ * Revision 1.9 2001/07/30 22:08:36 jongfoster
+ * Tidying up #defines:
+ * - All feature #defines are now of the form FEATURE_xxx
+ * - Permanently turned off WIN_GUI_EDIT
+ * - Permanently turned on WEBDAV and SPLIT_PROXY_ARGS
+ *
+ * Revision 1.8 2001/06/29 13:19:52 oes
+ * Removed logentry from cancelled commit
+ *
+ * Revision 1.7 2001/06/09 10:55:28 jongfoster
+ * Changing BUFSIZ ==> BUFFER_SIZE
+ *
+ * Revision 1.6 2001/06/07 23:04:34 jongfoster
+ * Made get_actions() static.
+ *
+ * Revision 1.5 2001/06/03 19:11:48 oes
+ * adapted to new enlist_unique arg format
+ *
+ * Revision 1.4 2001/06/01 20:03:42 jongfoster
+ * Better memory management - current_action->strings[] now
+ * contains copies of the strings, not the original.
+ *
+ * Revision 1.3 2001/06/01 18:49:17 jongfoster
+ * Replaced "list_share" with "list" - the tiny memory gain was not
+ * worth the extra complexity.
+ *
+ * Revision 1.2 2001/05/31 21:40:00 jongfoster
+ * Removing some commented out, obsolete blocks of code.
+ *
+ * Revision 1.1 2001/05/31 21:16:46 jongfoster
+ * Moved functions to process the action list into this new file.
+ *
+ *
+ *********************************************************************/
+
+
+#include "config.h"
+
+#include
-seperated HTML string
+ * in which each action is linked to its chapter in
+ * the user manual.
+ *
+ * Parameters :
+ * 1 : csp = Client state (for config)
+ * 2 : action = Action spec to be converted
+ *
+ * Returns : A string. Caller must free it.
+ * NULL on out-of-memory error.
+ *
+ *********************************************************************/
+char * actions_to_html(struct client_state *csp,
+ struct action_spec *action)
+{
+ unsigned mask = action->mask;
+ unsigned add = action->add;
+ char * result = strdup("");
+ struct list_entry * lst;
+
+ /* sanity - prevents "-feature +feature" */
+ mask |= add;
+
+
+#define DEFINE_ACTION_BOOL(__name, __bit) \
+ if (!(mask & __bit)) \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ } \
+ else if (add & __bit) \
+ { \
+ string_append(&result, "\n
+"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ }
+
+#define DEFINE_ACTION_STRING(__name, __bit, __index) \
+ if (!(mask & __bit)) \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ } \
+ else if (add & __bit) \
+ { \
+ string_append(&result, "\n
+"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ string_append(&result, "{"); \
+ string_join(&result, html_encode(action->string[__index])); \
+ string_append(&result, "}"); \
+ }
+
+#define DEFINE_ACTION_MULTI(__name, __index) \
+ if (action->multi_remove_all[__index]) \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ } \
+ else \
+ { \
+ lst = action->multi_remove[__index]->first; \
+ while (lst) \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ string_append(&result, "{"); \
+ string_join(&result, html_encode(lst->str)); \
+ string_append(&result, "}"); \
+ lst = lst->next; \
+ } \
+ } \
+ lst = action->multi_add[__index]->first; \
+ while (lst) \
+ { \
+ string_append(&result, "\n
+"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ string_append(&result, "{"); \
+ string_join(&result, html_encode(lst->str)); \
+ string_append(&result, "}"); \
+ lst = lst->next; \
+ }
+
+#define DEFINE_ACTION_ALIAS 0 /* No aliases for output */
+
+#include "actionlist.h"
+
+#undef DEFINE_ACTION_MULTI
+#undef DEFINE_ACTION_STRING
+#undef DEFINE_ACTION_BOOL
+#undef DEFINE_ACTION_ALIAS
+
+ /* trim leading
*/
+ if (result && *result)
+ {
+ char * s = result;
+ result = strdup(result + 5);
+ free(s);
+ }
+
+ return result;
+}
+
+
+/*********************************************************************
+ *
+ * Function : current_actions_to_html
+ *
+ * Description : Converts a curren action spec to a
seperated HTML
+ * text in which each action is linked to its chapter in
+ * the user manual.
+ *
+ * Parameters :
+ * 1 : csp = Client state (for config)
+ * 2 : action = Current action spec to be converted
+ *
+ * Returns : A string. Caller must free it.
+ * NULL on out-of-memory error.
+ *
+ *********************************************************************/
+char *current_action_to_html(struct client_state *csp,
+ struct current_action_spec *action)
+{
+ unsigned long flags = action->flags;
+ char * result = strdup("");
+ struct list_entry * lst;
+
+#define DEFINE_ACTION_BOOL(__name, __bit) \
+ if (flags & __bit) \
+ { \
+ string_append(&result, "\n
+"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ } \
+ else \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ }
+
+#define DEFINE_ACTION_STRING(__name, __bit, __index) \
+ if (flags & __bit) \
+ { \
+ string_append(&result, "\n
+"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ string_append(&result, "{"); \
+ string_join(&result, html_encode(action->string[__index])); \
+ string_append(&result, "}"); \
+ } \
+ else \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ }
+
+#define DEFINE_ACTION_MULTI(__name, __index) \
+ lst = action->multi[__index]->first; \
+ if (lst == NULL) \
+ { \
+ string_append(&result, "\n
-"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ } \
+ else \
+ { \
+ while (lst) \
+ { \
+ string_append(&result, "\n
+"); \
+ string_join(&result, add_help_link(__name, csp->config)); \
+ string_append(&result, "{"); \
+ string_join(&result, html_encode(lst->str)); \
+ string_append(&result, "}"); \
+ lst = lst->next; \
+ } \
+ }
+
+#define DEFINE_ACTION_ALIAS 0 /* No aliases for output */
+
+#include "actionlist.h"
+
+#undef DEFINE_ACTION_MULTI
+#undef DEFINE_ACTION_STRING
+#undef DEFINE_ACTION_BOOL
+#undef DEFINE_ACTION_ALIAS
+
+ return result;
+}
diff --git a/actions.h b/actions.h
new file mode 100644
index 00000000..f4365f0e
--- /dev/null
+++ b/actions.h
@@ -0,0 +1,158 @@
+#ifndef ACTIONS_H_INCLUDED
+#define ACTIONS_H_INCLUDED
+#define ACTIONS_H_VERSION "$Id: actions.h,v 1.11 2002/04/30 11:14:52 oes Exp $"
+/*********************************************************************
+ *
+ * File : $Source: /cvsroot/ijbswa/current/actions.h,v $
+ *
+ * Purpose : Declares functions to work with actions files
+ * Functions declared include: FIXME
+ *
+ * Copyright : Written by and Copyright (C) 2001 the SourceForge
+ * Privoxy team. http://www.privoxy.org/
+ *
+ * Based on the Internet Junkbuster originally written
+ * by and Copyright (C) 1997 Anonymous Coders and
+ * Junkbusters Corporation. http://www.junkbusters.com
+ *
+ * This program is free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General
+ * Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will
+ * be useful, but WITHOUT ANY WARRANTY; without even the
+ * implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE. See the GNU General Public
+ * License for more details.
+ *
+ * The GNU General Public License should be included with
+ * this file. If not, you can view it at
+ * http://www.gnu.org/copyleft/gpl.html
+ * or write to the Free Software Foundation, Inc., 59
+ * Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Revisions :
+ * $Log: actions.h,v $
+ * Revision 1.11 2002/04/30 11:14:52 oes
+ * Made csp the first parameter in *action_to_html
+ *
+ * Revision 1.10 2002/04/26 12:53:33 oes
+ * - actions_to_html signature change
+ * - current_action_to_text: renamed to current_action_to_html
+ * and signature change
+ *
+ * Revision 1.9 2002/03/26 22:29:54 swa
+ * we have a new homepage!
+ *
+ * Revision 1.8 2002/03/24 13:25:43 swa
+ * name change related issues
+ *
+ * Revision 1.7 2002/03/16 23:54:06 jongfoster
+ * Adding graceful termination feature, to help look for memory leaks.
+ * If you enable this (which, by design, has to be done by hand
+ * editing config.h) and then go to http://i.j.b/die, then the program
+ * will exit cleanly after the *next* request. It should free all the
+ * memory that was used.
+ *
+ * Revision 1.6 2001/10/23 21:30:30 jongfoster
+ * Adding error-checking to selected functions.
+ *
+ * Revision 1.5 2001/10/14 21:58:22 jongfoster
+ * Adding support for the CGI-based editor:
+ * - Exported get_actions()
+ * - Added new function free_alias_list()
+ * - Added support for {{settings}} and {{description}} blocks
+ * in the actions file. They are currently ignored.
+ * - Added restriction to only one {{alias}} block which must appear
+ * first in the file, to simplify the editor's rewriting rules.
+ * - Note that load_actions_file() is no longer used by the CGI-based
+ * editor, but some of the other routines in this file are.
+ *
+ * Revision 1.4 2001/09/16 15:47:37 jongfoster
+ * First version of CGI-based edit interface. This is very much a
+ * work-in-progress, and you can't actually use it to edit anything
+ * yet. You must #define FEATURE_CGI_EDIT_ACTIONS for these changes
+ * to have any effect.
+ *
+ * Revision 1.3 2001/09/14 00:17:32 jongfoster
+ * Tidying up memory allocation. New function init_action().
+ *
+ * Revision 1.2 2001/07/29 19:01:11 jongfoster
+ * Changed _FILENAME_H to FILENAME_H_INCLUDED.
+ * Added forward declarations for needed structures.
+ *
+ * Revision 1.1 2001/05/31 21:16:46 jongfoster
+ * Moved functions to process the action list into this new file.
+ *
+ *
+ *********************************************************************/
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+struct action_spec;
+struct current_action_spec;
+struct client_state;
+
+
+
+/* This structure is used to hold user-defined aliases */
+struct action_alias
+{
+ const char * name;
+ struct action_spec action[1];
+ struct action_alias * next;
+};
+
+
+extern jb_err get_actions (char *line,
+ struct action_alias * alias_list,
+ struct action_spec *cur_action);
+extern void free_alias_list(struct action_alias *alias_list);
+
+extern void init_action(struct action_spec *dest);
+extern void free_action(struct action_spec *src);
+extern jb_err merge_actions (struct action_spec *dest,
+ const struct action_spec *src);
+extern jb_err copy_action (struct action_spec *dest,
+ const struct action_spec *src);
+extern char * actions_to_text (struct action_spec *action);
+extern char * actions_to_html (struct client_state *csp,
+ struct action_spec *action);
+extern void init_current_action (struct current_action_spec *dest);
+extern void free_current_action (struct current_action_spec *src);
+extern jb_err merge_current_action (struct current_action_spec *dest,
+ const struct action_spec *src);
+extern char * current_action_to_html(struct client_state *csp,
+ struct current_action_spec *action);
+
+extern jb_err get_action_token(char **line, char **name, char **value);
+extern void unload_actions_file(void *file_data);
+extern int load_actions_file(struct client_state *csp);
+
+#ifdef FEATURE_GRACEFUL_TERMINATION
+void unload_current_actions_file(void);
+#endif
+
+
+/* Revision control strings from this header and associated .c file */
+extern const char actions_rcs[];
+extern const char actions_h_rcs[];
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* ndef ACTIONS_H_INCLUDED */
+
+/*
+ Local Variables:
+ tab-width: 3
+ end:
+*/
+
diff --git a/amiga.c b/amiga.c
index cd228986..493a00eb 100644
--- a/amiga.c
+++ b/amiga.c
@@ -1,12 +1,12 @@
-const char amiga_rcs[] = "$Id: amiga.c,v 1.1 2001/05/13 21:57:06 administrator Exp $";
+const char amiga_rcs[] = "$Id: amiga.c,v 1.8 2002/03/25 19:32:15 joergs Exp $";
/*********************************************************************
*
- * File : $Source: /home/administrator/cvs/ijb/jcc.c,v $
+ * File : $Source: /cvsroot/ijbswa/current/amiga.c,v $
*
* Purpose : Amiga-specific declarations.
*
* Copyright : Written by and Copyright (C) 2001 the SourceForge
- * IJBSWA team. http://ijbswa.sourceforge.net
+ * Privoxy team. http://www.privoxy.org/
*
* This program is free software; you can redistribute it
* and/or modify it under the terms of the GNU General
@@ -27,7 +27,52 @@ const char amiga_rcs[] = "$Id: amiga.c,v 1.1 2001/05/13 21:57:06 administrator E
* Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
* Revisions :
- * $Log: jcc.c,v $
+ * $Log: amiga.c,v $
+ * Revision 1.8 2002/03/25 19:32:15 joergs
+ * Name in version string changed from junkbuster to Privoxy.
+ *
+ * Revision 1.7 2002/03/24 13:25:43 swa
+ * name change related issues
+ *
+ * Revision 1.6 2002/03/09 20:03:52 jongfoster
+ * - Making various functions return int rather than size_t.
+ * (Undoing a recent change). Since size_t is unsigned on
+ * Windows, functions like read_socket that return -1 on
+ * error cannot return a size_t.
+ *
+ * THIS WAS A MAJOR BUG - it caused frequent, unpredictable
+ * crashes, and also frequently caused JB to jump to 100%
+ * CPU and stay there. (Because it thought it had just
+ * read ((unsigned)-1) == 4Gb of data...)
+ *
+ * - The signature of write_socket has changed, it now simply
+ * returns success=0/failure=nonzero.
+ *
+ * - Trying to get rid of a few warnings --with-debug on
+ * Windows, I've introduced a new type "jb_socket". This is
+ * used for the socket file descriptors. On Windows, this
+ * is SOCKET (a typedef for unsigned). Everywhere else, it's
+ * an int. The error value can't be -1 any more, so it's
+ * now JB_INVALID_SOCKET (which is -1 on UNIX, and in
+ * Windows it maps to the #define INVALID_SOCKET.)
+ *
+ * - The signature of bind_port has changed.
+ *
+ * Revision 1.5 2002/03/03 09:18:03 joergs
+ * Made jumbjuster work on AmigaOS again.
+ *
+ * Revision 1.4 2001/10/07 15:35:13 oes
+ * Replaced 6 boolean members of csp with one bitmap (csp->flags)
+ *
+ * Revision 1.3 2001/09/12 22:54:51 joergs
+ * Stacksize of main thread increased.
+ *
+ * Revision 1.2 2001/05/23 00:13:58 joergs
+ * AmigaOS support fixed.
+ *
+ * Revision 1.1.1.1 2001/05/15 13:58:46 oes
+ * Initial import of version 2.9.3 source tree
+ *
*
*********************************************************************/
@@ -39,12 +84,12 @@ const char amiga_rcs[] = "$Id: amiga.c,v 1.1 2001/05/13 21:57:06 administrator E
#include 500 Internal Privoxy Error
\r\n"
+ "500 Internal Privoxy Error
\r\n"
+ "";
+ static const char body_suffix[] =
+ "
or one of it's included components.(confdir)/templates
directory. The "
+ "location of the (confdir)
directory "
+ "is specified in the main Privoxy config
"
+ "file. (It's typically the Privoxy install directory"
+#ifndef _WIN32
+ ", or /etc/privoxy/
"
+#endif /* ndef _WIN32 */
+ ").500 Internal Privoxy Error
\r\n"
+ "\n");
+
+ for (cur_entry = the_map->first;
+ (cur_entry != NULL) && (ret != NULL);
+ cur_entry = cur_entry->next)
+ {
+ string_append(&ret, "
\n");
+ return ret;
+}
+
+
+/*
+ Local Variables:
+ tab-width: 3
+ end:
+*/
diff --git a/cgi.h b/cgi.h
new file mode 100644
index 00000000..39c6938d
--- /dev/null
+++ b/cgi.h
@@ -0,0 +1,245 @@
+#ifndef CGI_H_INCLUDED
+#define CGI_H_INCLUDED
+#define CGI_H_VERSION "$Id: cgi.h,v 1.28 2002/04/26 12:54:03 oes Exp $"
+/*********************************************************************
+ *
+ * File : $Source: /cvsroot/ijbswa/current/cgi.h,v $
+ *
+ * Purpose : Declares functions to intercept request, generate
+ * html or gif answers, and to compose HTTP resonses.
+ *
+ * Functions declared include:
+ *
+ *
+ * Copyright : Written by and Copyright (C) 2001 the SourceForge
+ * Privoxy team. http://www.privoxy.org/
+ *
+ * Based on the Internet Junkbuster originally written
+ * by and Copyright (C) 1997 Anonymous Coders and
+ * Junkbusters Corporation. http://www.junkbusters.com
+ *
+ * This program is free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General
+ * Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will
+ * be useful, but WITHOUT ANY WARRANTY; without even the
+ * implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE. See the GNU General Public
+ * License for more details.
+ *
+ * The GNU General Public License should be included with
+ * this file. If not, you can view it at
+ * http://www.gnu.org/copyleft/gpl.html
+ * or write to the Free Software Foundation, Inc., 59
+ * Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Revisions :
+ * $Log: cgi.h,v $
+ * Revision 1.28 2002/04/26 12:54:03 oes
+ * New function add_help_link
+ *
+ * Revision 1.27 2002/04/24 02:16:51 oes
+ * Moved get_char_param, get_string_param and get_number_param here from cgiedit.c
+ *
+ * Revision 1.26 2002/04/10 13:38:35 oes
+ * load_template signature changed
+ *
+ * Revision 1.25 2002/04/08 20:50:25 swa
+ * fixed JB spelling
+ *
+ * Revision 1.24 2002/03/26 22:29:54 swa
+ * we have a new homepage!
+ *
+ * Revision 1.23 2002/03/24 16:18:15 jongfoster
+ * Removing old logo
+ *
+ * Revision 1.22 2002/03/24 13:25:43 swa
+ * name change related issues
+ *
+ * Revision 1.21 2002/03/07 03:48:38 oes
+ * - Changed built-in images from GIF to PNG
+ * (with regard to Unisys patent issue)
+ * - Added a 4x4 pattern PNG which is less intrusive
+ * than the logo but also clearly marks the deleted banners
+ *
+ * Revision 1.20 2002/03/04 17:53:22 oes
+ * Fixed compiled warning
+ *
+ * Revision 1.19 2002/01/21 00:33:52 jongfoster
+ * Adding map_block_keep() to save a few bytes in the edit-actions-list HTML.
+ *
+ * Revision 1.18 2001/11/16 00:46:31 jongfoster
+ * Fixing compiler warnings
+ *
+ * Revision 1.17 2001/10/23 21:48:19 jongfoster
+ * Cleaning up error handling in CGI functions - they now send back
+ * a HTML error page and should never cause a FATAL error. (Fixes one
+ * potential source of "denial of service" attacks).
+ *
+ * CGI actions file editor that works and is actually useful.
+ *
+ * Ability to toggle Junkbuster remotely using a CGI call.
+ *
+ * You can turn off both the above features in the main configuration
+ * file, e.g. if you are running a multi-user proxy.
+ *
+ * Revision 1.16 2001/09/16 17:08:54 jongfoster
+ * Moving simple CGI functions from cgi.c to new file cgisimple.c
+ *
+ * Revision 1.15 2001/09/16 15:02:35 jongfoster
+ * Adding i.j.b/robots.txt.
+ * Inlining add_stats() since it's only ever called from one place.
+ *
+ * Revision 1.14 2001/09/16 11:38:02 jongfoster
+ * Splitting fill_template() into 2 functions:
+ * template_load() loads the file
+ * template_fill() performs the PCRS regexps.
+ * This is because the CGI edit interface has a "table row"
+ * template which is used many times in the page - this
+ * change means it's only loaded from disk once.
+ *
+ * Revision 1.13 2001/09/16 11:00:10 jongfoster
+ * New function alloc_http_response, for symmetry with free_http_response
+ *
+ * Revision 1.12 2001/09/13 23:31:25 jongfoster
+ * Moving image data to cgi.c rather than cgi.h.
+ *
+ * Revision 1.11 2001/08/05 16:06:20 jongfoster
+ * Modifiying "struct map" so that there are now separate header and
+ * "map_entry" structures. This means that functions which modify a
+ * map no longer need to return a pointer to the modified map.
+ * Also, it no longer reverses the order of the entries (which may be
+ * important with some advanced template substitutions).
+ *
+ * Revision 1.10 2001/08/01 21:19:22 jongfoster
+ * Moving file version information to a separate CGI page.
+ *
+ * Revision 1.9 2001/08/01 00:17:54 jongfoster
+ * Adding prototype for map_conditional
+ *
+ * Revision 1.8 2001/07/30 22:08:36 jongfoster
+ * Tidying up #defines:
+ * - All feature #defines are now of the form FEATURE_xxx
+ * - Permanently turned off WIN_GUI_EDIT
+ * - Permanently turned on WEBDAV and SPLIT_PROXY_ARGS
+ *
+ * Revision 1.7 2001/07/29 18:43:08 jongfoster
+ * Changing #ifdef _FILENAME_H to FILENAME_H_INCLUDED, to conform to
+ * ANSI C rules.
+ *
+ * Revision 1.6 2001/06/29 21:45:41 oes
+ * Indentation, CRLF->LF, Tab-> Space
+ *
+ * Revision 1.5 2001/06/29 13:22:44 oes
+ * - Cleaned up
+ * - Added new functions: default_exports(), make_menu(),
+ * error_response() etc, ranamed others and changed
+ * param and return types.
+ * - Removed HTTP/HTML snipplets
+ * - Removed logentry from cancelled commit
+ *
+ * Revision 1.4 2001/06/09 10:50:58 jongfoster
+ * Changing "show URL info" handler to new style.
+ * Adding "extern" to some function prototypes.
+ *
+ * Revision 1.3 2001/06/03 19:12:16 oes
+ * introduced new cgi handling
+ *
+ * No revisions before 1.3
+ *
+ **********************************************************************/
+
+
+#include "project.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Main dispatch function
+ */
+extern struct http_response *dispatch_cgi(struct client_state *csp);
+
+/* Not exactly a CGI */
+extern struct http_response * error_response(struct client_state *csp,
+ const char *templatename,
+ int err);
+
+/*
+ * CGI support functions
+ */
+extern struct http_response * alloc_http_response(void);
+extern void free_http_response(struct http_response *rsp);
+
+extern struct http_response *finish_http_response(struct http_response *rsp);
+
+extern struct map * default_exports(const struct client_state *csp, const char *caller);
+
+extern jb_err map_block_killer (struct map *exports, const char *name);
+extern jb_err map_block_keep (struct map *exports, const char *name);
+extern jb_err map_conditional (struct map *exports, const char *name, int choose_first);
+
+extern jb_err template_load(struct client_state *csp, char ** template_ptr,
+ const char *templatename, int recursive);
+extern jb_err template_fill(char ** template_ptr, const struct map *exports);
+extern jb_err template_fill_for_cgi(struct client_state *csp,
+ const char *templatename,
+ struct map *exports,
+ struct http_response *rsp);
+
+extern void cgi_init_error_messages(void);
+extern struct http_response *cgi_error_memory(void);
+extern jb_err cgi_error_no_template(struct client_state *csp,
+ struct http_response *rsp,
+ const char *template_name);
+extern jb_err cgi_error_bad_param(struct client_state *csp,
+ struct http_response *rsp);
+jb_err cgi_error_unknown(struct client_state *csp,
+ struct http_response *rsp,
+ jb_err error_to_report);
+
+extern jb_err get_number_param(struct client_state *csp,
+ const struct map *parameters,
+ char *name,
+ unsigned *pvalue);
+extern jb_err get_string_param(const struct map *parameters,
+ const char *param_name,
+ const char **pparam);
+extern char get_char_param(const struct map *parameters,
+ const char *param_name);
+
+/*
+ * Text generators
+ */
+extern void get_http_time(int time_offset, char * buf);
+extern char *add_help_link(const char *item, struct configuration_spec *config);
+extern char *make_menu(const char *self);
+extern char *dump_map(const struct map *the_map);
+
+/*
+ * Ad replacement images
+ */
+extern const char image_pattern_data[];
+extern const size_t image_pattern_length;
+extern const char image_blank_data[];
+extern const size_t image_blank_length;
+
+/* Revision control strings from this header and associated .c file */
+extern const char cgi_rcs[];
+extern const char cgi_h_rcs[];
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* ndef CGI_H_INCLUDED */
+
+/*
+ Local Variables:
+ tab-width: 3
+ end:
+*/
diff --git a/cgiedit.c b/cgiedit.c
new file mode 100644
index 00000000..0f0e46d3
--- /dev/null
+++ b/cgiedit.c
@@ -0,0 +1,4710 @@
+const char cgiedit_rcs[] = "$Id: cgiedit.c,v 1.40 2002/05/19 11:34:35 jongfoster Exp $";
+/*********************************************************************
+ *
+ * File : $Source: /cvsroot/ijbswa/current/cgiedit.c,v $
+ *
+ * Purpose : CGI-based actionsfile editor.
+ *
+ * Functions declared include: cgi_edit_*
+ *
+ * NOTE: The CGIs in this file use parameter names
+ * such as "f" and "s" which are really *BAD* choices.
+ * However, I'm trying to save bytes in the
+ * edit-actions-list HTML page - the standard actions
+ * file generated a 550kbyte page, which is ridiculous.
+ *
+ * Stick to the short names in this file for consistency.
+ *
+ * Copyright : Written by and Copyright (C) 2001 the SourceForge
+ * Privoxy team. http://www.privoxy.org/
+ *
+ * Based on the Internet Junkbuster originally written
+ * by and Copyright (C) 1997 Anonymous Coders and
+ * Junkbusters Corporation. http://www.junkbusters.com
+ *
+ * This program is free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General
+ * Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will
+ * be useful, but WITHOUT ANY WARRANTY; without even the
+ * implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE. See the GNU General Public
+ * License for more details.
+ *
+ * The GNU General Public License should be included with
+ * this file. If not, you can view it at
+ * http://www.gnu.org/copyleft/gpl.html
+ * or write to the Free Software Foundation, Inc., 59
+ * Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Revisions :
+ * $Log: cgiedit.c,v $
+ * Revision 1.40 2002/05/19 11:34:35 jongfoster
+ * Handling read-only actions files better - report the actual
+ * error, not "Out of memory"!
+ *
+ * Bug report:
+ * http://sourceforge.net/tracker/index.php?func=detail
+ * &aid=557905&group_id=11118&atid=111118
+ *
+ * Revision 1.39 2002/05/12 21:39:15 jongfoster
+ * - Adding Doxygen-style comments to structures and #defines.
+ * - Correcting function comments
+ *
+ * Revision 1.38 2002/05/03 23:00:38 jongfoster
+ * Support for templates for "standard actions" buttons.
+ * See bug #549871
+ *
+ * Revision 1.37 2002/04/30 11:14:52 oes
+ * Made csp the first parameter in *action_to_html
+ *
+ * Revision 1.36 2002/04/26 21:53:30 jongfoster
+ * Fixing a memory leak. (Near, but not caused by, my earlier commit).
+ *
+ * Revision 1.35 2002/04/26 21:50:02 jongfoster
+ * Honouring default exports in edit-actions-for-url-filter template.
+ *
+ * Revision 1.34 2002/04/26 12:54:17 oes
+ * Adaptions to changes in actions.c
+ *
+ * Revision 1.33 2002/04/24 02:17:47 oes
+ * - Moved get_char_param, get_string_param and get_number_param to cgi.c
+ * - Comments
+ * - Activated Jon's code for editing multiple AFs
+ * - cgi_edit_list_actions now provides context-sensitive
+ * help, looks up all action sets from standard.action and
+ * makes buttons for them in the catchall section
+ * - cgi_edit_action_submit now honors a p parameter, looks up
+ * the corresponding action set, and sets the catchall pattern's
+ * actions accordingly.
+ *
+ * Revision 1.32 2002/04/19 16:55:31 jongfoster
+ * Fixing newline problems. If we do our own text file newline
+ * mangling, we don't want the library to do any, so we need to
+ * open the files in *binary* mode.
+ *
+ * Revision 1.31 2002/04/18 19:21:08 jongfoster
+ * Added code to detect "conventional" action files, that start
+ * with a set of actions for all URLs (the pattern "/").
+ * These are special-cased in the "edit-actions-list" CGI, so
+ * that a special UI can be written for them.
+ *
+ * Revision 1.30 2002/04/10 13:38:35 oes
+ * load_template signature changed
+ *
+ * Revision 1.29 2002/04/08 16:59:08 oes
+ * Fixed comment
+ *
+ * Revision 1.28 2002/03/27 12:30:29 oes
+ * Deleted unsused variable
+ *
+ * Revision 1.27 2002/03/26 23:06:04 jongfoster
+ * Removing duplicate @ifs on the toggle page
+ *
+ * Revision 1.26 2002/03/26 22:59:17 jongfoster
+ * Fixing /toggle to display status consistently.
+ *
+ * Revision 1.25 2002/03/26 22:29:54 swa
+ * we have a new homepage!
+ *
+ * Revision 1.24 2002/03/24 15:23:33 jongfoster
+ * Name changes
+ *
+ * Revision 1.23 2002/03/24 13:32:41 swa
+ * name change related issues
+ *
+ * Revision 1.22 2002/03/24 13:25:43 swa
+ * name change related issues
+ *
+ * Revision 1.21 2002/03/22 18:02:48 jongfoster
+ * Fixing remote toggle
+ *
+ * Revision 1.20 2002/03/16 20:28:34 oes
+ * Added descriptions to the filters so users will know what they select in the cgi editor
+ *
+ * Revision 1.19 2002/03/16 18:38:14 jongfoster
+ * Stopping stupid or malicious users from breaking the actions
+ * file using the web-based editor.
+ *
+ * Revision 1.18 2002/03/16 14:57:44 jongfoster
+ * Full support for enabling/disabling modular filters.
+ *
+ * Revision 1.17 2002/03/16 14:26:42 jongfoster
+ * First version of modular filters support - READ ONLY!
+ * Fixing a double-free bug in the out-of-memory handling in map_radio().
+ *
+ * Revision 1.16 2002/03/07 03:46:17 oes
+ * Fixed compiler warnings
+ *
+ * Revision 1.15 2002/03/06 22:54:35 jongfoster
+ * Automated function-comment nitpicking.
+ *
+ * Revision 1.14 2002/03/05 00:24:51 jongfoster
+ * Patch to always edit the current actions file.
+ *
+ * Revision 1.13 2002/03/04 02:07:59 david__schmidt
+ * Enable web editing of actions file on OS/2 (it had been broken all this time!)
+ *
+ * Revision 1.12 2002/03/03 09:18:03 joergs
+ * Made jumbjuster work on AmigaOS again.
+ *
+ * Revision 1.11 2002/01/23 01:03:31 jongfoster
+ * Fixing gcc [CygWin] compiler warnings
+ *
+ * Revision 1.10 2002/01/23 00:22:59 jongfoster
+ * Adding new function cgi_edit_actions_section_swap(), to reorder
+ * the actions file.
+ *
+ * Adding get_url_spec_param() to get a validated URL pattern.
+ *
+ * Moving edit_read_line() out of this file and into loaders.c.
+ *
+ * Adding missing html_encode() to many CGI functions.
+ *
+ * Moving the functions that #include actionlist.h to the end of the file,
+ * because the Visual C++ 97 debugger gets extremely confused if you try
+ * to debug any code that comes after them in the file.
+ *
+ * Major optimizations in cgi_edit_actions_list() to reduce the size of
+ * the generated HTML (down 40% from 550k to 304k), with major side-effects
+ * throughout the editor and templates. In particular, the length of the
+ * URLs throughout the editor has been drastically reduced, by cutting
+ * paramater names down to 1 character and CGI names down to 3-4
+ * characters, by removing all non-essential CGI paramaters even at the
+ * expense of having to re-read the actions file for the most trivial
+ * page, and by using relative rather than absolute URLs. This means
+ * that this (typical example):
+ *
+ *
+ *
+ * is now this:
+ *
+ *
+ *
+ * Revision 1.9 2002/01/17 20:56:22 jongfoster
+ * Replacing hard references to the URL of the config interface
+ * with #defines from project.h
+ *
+ * Revision 1.8 2001/11/30 23:35:51 jongfoster
+ * Renaming actionsfile to ijb.action
+ *
+ * Revision 1.7 2001/11/13 00:28:24 jongfoster
+ * - Renaming parameters from edit-actions-for-url so that they only
+ * contain legal JavaScript characters. If we wanted to write
+ * JavaScript that worked with Netscape 4, this is nessacery.
+ * (Note that at the moment the JavaScript doesn't actually work
+ * with Netscape 4, but now this is purely a template issue, not
+ * one affecting code).
+ * - Adding new CGIs for use by non-JavaScript browsers:
+ * edit-actions-url-form
+ * edit-actions-add-url-form
+ * edit-actions-remove-url-form
+ * - Fixing || bug.
+ *
+ * Revision 1.6 2001/10/29 03:48:09 david__schmidt
+ * OS/2 native needed a snprintf() routine. Added one to miscutil, brackedted
+ * by and __OS2__ ifdef.
+ *
+ * Revision 1.5 2001/10/25 03:40:48 david__schmidt
+ * Change in porting tactics: OS/2's EMX porting layer doesn't allow multiple
+ * threads to call select() simultaneously. So, it's time to do a real, live,
+ * native OS/2 port. See defines for __EMX__ (the porting layer) vs. __OS2__
+ * (native). Both versions will work, but using __OS2__ offers multi-threading.
+ *
+ * Revision 1.4 2001/10/23 21:48:19 jongfoster
+ * Cleaning up error handling in CGI functions - they now send back
+ * a HTML error page and should never cause a FATAL error. (Fixes one
+ * potential source of "denial of service" attacks).
+ *
+ * CGI actions file editor that works and is actually useful.
+ *
+ * Ability to toggle JunkBuster remotely using a CGI call.
+ *
+ * You can turn off both the above features in the main configuration
+ * file, e.g. if you are running a multi-user proxy.
+ *
+ * Revision 1.3 2001/10/14 22:12:49 jongfoster
+ * New version of CGI-based actionsfile editor.
+ * Major changes, including:
+ * - Completely new file parser and file output routines
+ * - edit-actions CGI renamed edit-actions-for-url
+ * - All CGIs now need a filename parameter, except for...
+ * - New CGI edit-actions which doesn't need a filename,
+ * to allow you to start the editor up.
+ * - edit-actions-submit now works, and now automatically
+ * redirects you back to the main edit-actions-list handler.
+ *
+ * Revision 1.2 2001/09/16 17:05:14 jongfoster
+ * Removing unused #include showarg.h
+ *
+ * Revision 1.1 2001/09/16 15:47:37 jongfoster
+ * First version of CGI-based edit interface. This is very much a
+ * work-in-progress, and you can't actually use it to edit anything
+ * yet. You must #define FEATURE_CGI_EDIT_ACTIONS for these changes
+ * to have any effect.
+ *
+ *
+ **********************************************************************/
+
+
+#include "config.h"
+
+/*
+ * FIXME: Following includes copied from cgi.c - which are actually needed?
+ */
+
+#include \n");
+ }
+
+ string_append(&ret, "");
+ string_join (&ret, html_encode(cur_entry->name));
+ string_append(&ret, " ");
+ string_join (&ret, html_encode(cur_entry->value));
+ string_append(&ret, "
-If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. -
-To do so, -attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. -
-<one line -to give the program's name and a brief idea of what it -does.> -Copyright (C) 19yy -<name of -author> ---This program is free software; -you can redistribute it and/or modify -it under the terms of the GNU General Public License as published by -the Free Software Foundation; either version 2 of the License, or -(at your option) any later version. -
-This program -is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU General Public License for more details. -
-You should -have received a copy of the GNU General Public License -along with this program; if not, write to the Free Software -Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -
-Also add -information on how to contact you by electronic and paper mail. -
-If the program is interactive, -make it output a short notice like this -when it starts in an interactive mode: -
-Gnomovision version 69, Copyright (C) 19yy name of author -Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. -This is free software, and you are welcome to redistribute it -under certain conditions; type `show c' for details. --
-The hypothetical -commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. -
-You should also get your employer -(if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: -
-Yoyodyne, Inc., hereby disclaims all copyright interest in the program -`Gnomovision' (which makes passes at compilers) written by James Hacker. - -<signature -of -Ty Coon>, -1 April 1989 --
-Ty Coon, President of Vice -
-This General Public License -does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Library General -Public License instead of this License. -
- - -Home - · -Next - - · Site Map - - · Legal - - · Privacy - - · Cookies - - · Banner Ads - - · Telemarketing - - · Mail - - · Spam - - - - --Copyright © 1996-8 Junkbusters -® Corporation. -Copying and distribution permitted under -the GNU -General Public License. - - -1998/10/31 -http://www.junkbusters.com/ht/en/gpl.html - -
webmaster@junkbusters.com - - + ++ Website · + Manual · + FAQ · GPL
+ +Development of Junkbuster is ongoing and this document is + no longer current. However, it may provide some assistance. If + you have problems, please use the Yahoo Groups + mailing list (which includes an archive of mail), the + SourceForge.net project page, or + see the project's home + page. Please also bear in mind that versions 2.9.x of + Junkbuster are development releases, and are not production + quality.
+ +We did not write the GPL: + the Free Software + Foundation did
+ +The Free Software Foundation (FSF) is a non-profit + institution that designed the GNU General Public License (GPL) + to promote the publication of free software. The GPL is used by + thousands of programmers who want to give others the right to + copy and modify the source code of their programs. Millions of + people benefit from this.
+ +We use the GPL to allow everyone to + use, copy and modify the Internet Junkbuster as they wish. Companies can use it for commercial + purposes, but they are not permitted to use it in products + that they claim as their property.
+ +The GPL can also be used on documents + written in human languages. This documentation for the Internet + Junkbuster is also under the GPL. This means that you do not + have to break copyright laws in order to print a page or email + a screen of the text to someone, for example.
+ +The remainder of this page is the text of + the GPL. As legal documents go it's relatively clear, but + unfortunately it's fairly long because it has to cover a lot of + details. The HTML formatting is ours, and should not be + misinterpreted as changing the license in any way.
+ + + ++ Copyright 1989, 1991+ Everyone + +
+ Free Software Foundation, Inc.
+ 675 Mass Ave.
+ Cambridge, MA 02139
+ USA +
is permitted to copy and distribute verbatim copies of this + license document, but changing it is not allowed.
+ +The licenses for most software are designed to take away + your freedom to share and change it. By contrast, the GNU + General Public License is intended to guarantee your freedom to + share and change free software--to make sure the software is + free for all its users. This General Public License applies to + most of the Free Software Foundation's software and to any + other program whose authors commit to using it. (Some other + Free Software Foundation software is covered by the GNU Library + General Public License instead.) You can apply it to your + programs, too.
+ +When we speak of free software, we are + referring to freedom, not price. Our General Public Licenses + are designed to make sure that you have the freedom to + distribute copies of free software (and charge for this service + if you wish), that you receive source code or can get it if you + want it, that you can change the software or use pieces of it + in new free programs; and that you know you can do these + things.
+ +To protect your rights, we need to make + restrictions that forbid anyone to deny you these rights or to + ask you to surrender the rights. These restrictions translate + to certain responsibilities for you if you distribute copies of + the software, or if you modify it.
+ +For example, if you distribute + copies of such a program, whether gratis or for a fee, you must + give the recipients all the rights that you have. You must make + sure that they, too, receive or can get the source code. And + you must show them these terms so they know their rights.
+ +We protect your rights with two steps: + (1) copyright the software, and (2) offer you this license + which gives you legal permission to copy, distribute and/or + modify the software.
+ +Also, for each author's protection + and ours, we want to make certain that everyone understands + that there is no warranty for this free software. If the + software is modified by someone else and passed on, we want its + recipients to know that what they have is not the original, so + that any problems introduced by others will not reflect on the + original authors' reputations.
+ +Finally, any free program is threatened + constantly by software patents. We wish to avoid the danger + that redistributors of a free program will individually obtain + patent licenses, in effect making the program proprietary. To + prevent this, we have made it clear that any patent must be + licensed for everyone's free use or not licensed at all.
+ +The precise terms and conditions for + copying, distribution and modification follow.
+ +O. This License applies to any program + or other work which contains a notice placed by the copyright + holder saying it may be distributed under the terms of this + General Public License. The "Program", below, refers to any + such program or work, and a "work based on the Program" means + either the Program or any derivative work under copyright law: + that is to say, a work containing the Program or a portion of + it, either verbatim or with modifications and/or translated + into another language. (Hereinafter, translation is included + without limitation in the term "modification".) Each licensee + is addressed as "you".
+ +Activities other than copying, + distribution and modification are not covered by this License; + they are outside its scope. The act of running the Program is + not restricted, and the output from the Program is covered only + if its contents constitute a work based on the Program + (independent of having been made by running the Program).
+ +Whether that is true depends on what the
+ Program does.
+
You may charge a fee for the physical + act of transferring a copy, and you may at your option + offer warranty protection in exchange for a fee.
+These requirements apply to the + modified work as a whole. If identifiable sections of that + work are not derived from the Program, and can be + reasonably considered independent and separate works in + themselves, then this License, and its terms, do not apply + to those sections when you distribute them as separate + works. But when you distribute the same sections as part of + a whole which is a work based on the Program, the + distribution of the whole must be on the terms of this + License, whose permissions for other licensees extend to + the entire whole, and thus to each and every part + regardless of who wrote it.
+ +Thus, it is not the intent of this + section to claim rights or contest your rights to work + written entirely by you; rather, the intent is to exercise + the right to control the distribution of derivative or + collective works based on the Program.
+ +In addition, mere aggregation + of another work not based on the Program with the Program + (or with a work based on the Program) on a volume of a + storage or distribution medium does not bring the other + work under the scope of this License.
+The source code for a work means + the preferred form of the work for making modifications to + it. For an executable work, complete source code means all + the source code for all modules it contains, plus any + associated interface definition files, plus the scripts + used to control compilation and installation of the + executable. However, as a special exception, the source + code distributed need not include anything that is normally + distributed (in either source or binary form) with the + major components (compiler, kernel, and so on) of the + operating system on which the executable runs, unless that + component itself accompanies the executable.
+ +If distribution of executable or object + code is made by offering access to copy from a + designated place, then offering equivalent access to copy + the source code from the same place counts as distribution + of the source code, even though third parties are not + compelled to copy the source along with the object + code.
+If any portion of this section is + held invalid or unenforceable under any particular + circumstance, the balance of the section is intended to + apply and the section as a whole is intended to apply in + other circumstances.
+ +It is not the purpose of this + section to induce you to infringe any patents or other + property right claims or to contest validity of any such + claims; this section has the sole purpose of protecting the + integrity of the free software distribution system, which + is implemented by public license practices. Many people + have made generous contributions to the wide range of + software distributed through that system in reliance on + consistent application of that system; it is up to the + author/donor to decide if he or she is willing to + distribute software through any other system and a licensee + cannot impose that choice.
+ +This section is intended to make + thoroughly clear what is believed to be a consequence of + the rest of this License.
+END OF TERMS AND CONDITIONS
+
+
If you develop a new program, and you want it to be of the + greatest possible use to the public, the best way to achieve + this is to make it free software which everyone can + redistribute and change under these terms.
+ +To do so, attach the following notices + to the program. It is safest to attach them to the start of + each source file to most effectively convey the exclusion of + warranty; and each file should have at least the "copyright" + line and a pointer to where the full notice is found.
+ ++ <one line to give the program's name and a brief idea of + what it does.> Copyright (C) 19yy <name of author> + ++ +This program is free software; you can + redistribute it and/or modify it under the terms of the GNU + General Public License as published by the Free Software + Foundation; either version 2 of the License, or (at your + option) any later version.
+ +This program is distributed in the + hope that it will be useful, but WITHOUT ANY WARRANTY; + without even the implied warranty of MERCHANTABILITY or + FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public + License for more details.
+ +You should have received a copy of the + GNU General Public License along with this program; if not, + write to the Free Software Foundation, Inc., 675 Mass Ave, + Cambridge, MA 02139, USA.
+
Also add information on how to contact + you by electronic and paper mail.
+ +If the program is interactive, make it + output a short notice like this when it starts in an + interactive mode:
+ ++ Gnomovision version 69, Copyright (C) 19yy name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details + type `show w'. This is free software, and you are welcome to + redistribute it under certain conditions; type `show c' for + details. ++ +
The hypothetical commands `show w' and + `show c' should show the appropriate parts of the General + Public License. Of course, the commands you use may be called + something other than `show w' and `show c'; they could even be + mouse-clicks or menu items--whatever suits your program.
+ +You should also get your employer + (if you work as a programmer) or your school, if any, to sign a + "copyright disclaimer" for the program, if necessary. Here is a + sample; alter the names:
+ ++ Yoyodyne, Inc., hereby disclaims all copyright interest in + the program `Gnomovision' (which makes passes at compilers) + written by James Hacker. <signature of Ty Coon>, 1 + April 1989+ +
+ Ty Coon, President of Vice +
This General Public License does not + permit incorporating your program into proprietary programs. If + your program is a subroutine library, you may consider it more + useful to permit linking proprietary applications with the + library. If this is what you want to do, use the GNU Library + General Public License instead of this License.
+ + + ++ Website · + Manual · + FAQ · GPL
+ ++ Copyright © 1996-8 Junkbusters ® + Corporation. Copyright © 2001 + Jon + Foster. Copying and distribution permitted under the GNU General Public License. The text of the + GNU GPL itself is copyrighted by the FSF, and may be copied but + not modified.
+ +
+ http://sourceforge.net/projects/ijbswa/
-Download for UNIX - - · (Download for Windows 95/NT) - - · (Other OS) - - · Configuring Browsers - - · Installation - - · For Companies - - · Blocking - - · Cookies - - · Anonymity - - · Security - - · (Technical Manual) -
--The -Internet Junkbuster -Proxy -TM -is -free -privacy-enhancing software that can be run on your PC or by your -ISP -or company. -It blocks requests for -URLs -(typically banner ads) -that match its -blockfile. -It also deletes unauthorized -cookies -and other -unwanted identifying -header information -that is exchanged between web servers and browsers. -These headers are not normally accessible to users -(even though they may contain information that's important to your privacy), -but with the -Internet Junkbuster -you can see almost -anything you want -and control everything you're likely to need. -You -decide what's junk. -SM -Many people -publish -their blockfiles to help others get started. -
- --No, none of these. -It's completely free of charge. -Junkbusters -offers you the software to copy, use, modify and distribute -as you wish, forever, at -no charge -under the -GNU General Public License. -
-It comes with -no warranty of any kind. -
-You don't have to register, -in fact we don't even provide a way to do so: -the practice of registering software is -usually just an -excuse -to send you solicitations and -sell your name -and information about your behavior. -You are welcome to obtain and use our software as anonymously you wish. -(Your -IP -address will naturally be -disclosed -when you download it, -so if you work for a web ad company -you might want to use a service such as the -lpwa.com -when you get it. -We -never -want to be given any information that you consider private or confidential.) -
-We are often asked why we give away a product that many -would happily pay for. -The answer is that we are determined to carry out our -mission: -to free the world from junk communications. -
- --For the latest information on availability, see the -Distribution Information -page. -We -don't -think it will ever run on -Windows 3.1. -But you don't need to have it running on your computer -if you get your -ISP -or Systems Administrator at -work -to run it. -
- -
-Try their sales or support department
-(depending on whether you are already a customer).
-You might send them email including the following
-URL:
-
- http://www.junkbusters.com/ht/en/ijbfaq.html#isps
-
-You could mention that many
-other
-ISPs
-provide it,
-and that you regard it as an important part of your decision on
-where to buy Internet service.
-
-Whoever starts the -Internet Junkbuster -chooses the options and the blockfile. -If your -ISP -runs it for you, they have to make these decision -(though -some -may give you a choice of proxies, -and a way to suggest new -URLs -to block). -If you run it on your computer, -You -decide what's junk. -SM -
- --It depends on your platform. -If you are using Windows 95 or NT, -see our separate page on -installing under Windows. -If you have a C compiler and are using almost any flavor of -UNIX ® -you -download it, compile it, start it running, -and then -configure your browser. -Several precompiled packages are also available through links in our -distribution page, -which lists all available platforms. -
-If you are using a platform for which we have no current -availability, -you are welcome to port the code. -If you do this and you would like us to consider publishing your ported version, -please -tell us. -
- --Just point your browser to -http://internet.junkbuster.com/cgi-bin/show-proxy-args -or to any -URL -ending in -show-proxy-args -(even if it doesn't exist). -It needn't exist because the -Internet Junkbuster 2.0 -intercepts the request, blocks it, -and returns in its place -information about itself. -Using the -URL -above is useful for checking that your browser really is -going through an -Internet Junkbuster, -because the -junkbuster.com -server returns a warning if the request actually gets to it. -Some people set the home page of their browser to such a -URL -to be sure that it is configured to use the proxy. -
-If you wish to check the header information -your proxy is actually sending, -a visit to -http://internet.junkbuster.com/cgi-bin/show-http-headers -will give you the more relevant ones first. -You might also like to turn the proxy -off -and compare the difference. (Don't forget to turn it back on again.) -
- --Once your browser is told to use a proxy such as the -Internet Junkbuster, -it thinks of it as its server for everything, -so this message means it can't talk to the proxy. -The -Internet Junkbuster -may not be running, -or you may have specified its proxy -address -incorrectly. -Check that the details you entered are correct. -If you have -telnet -you can try connecting to the appropriate port to see if the -Internet Junkbuster -is running. -If your -ISP -is running the -Internet Junkbuster, -you may want to check with them. -If you are running it yourself under -UNIX ®, -try looking at a -ps ax -to see if it is running. -The -port -specified in its options should be the same one as your -browser has configured. -
- -
-We'd be very interested to hear it, but please bear a few things in mind.
-
-If you find using our free product -harder than you're used to for consumer software, -there are many -commercial alternatives -that you could consider. -
-The answer to detailed technical questions may be answered in -manual page, -or in the source code. -Also double-check this page for an answer: -using the ``find'' feature on your browser for likely keywords may help. -Our site also has a -search -feature. -
-Many people post requests for help and responses on -Usenet. -
-If your -ISP -is providing -the -Internet Junkbuster -for you, -and your question is about how to use it, -check their web page before asking them. -
-Even though we don't offer the kind of -support you might expect if you paid a lot of money for a software product, -you can still ask us. -But before you do, please consider whether -you could ask someone closer to you. -And please be patient if we're slow to reply: we -never charge consumers -for our services, -so we have to subsidize consumers with revenue from companies, -and our resources are limited. -
-If your company or organization -would be interested in a maintenance contract -with phone and email support, -hard copy documentation and source code and pre-compiled binaries on tape -or disk, -please -ask us -for a quote. -
- --If you set up -the -Internet Junkbuster -to run on the computer you browse from -(rather than your -ISP's server -or some networked computer at work), -the proxy will be on -localhost -(which is the special name used by every computer on the Internet to -refer to itself) -and -the port will be -8000 -(unless you have told the -Internet Junkbuster -to -run on a different port with the -listen-address -option). -So you when -configuring your browser's proxy settings -you typically enter the word -localhost -in the two boxes next to - -HTTP -and - -Secure, -and the number -8000 -in the two boxes labelled -to the right of those boxes. -
-If your -ISP -or company is running -the -Internet Junkbuster -for you, -they will tell you the address to use. -It will be the name of the computer it's running on -(or possibly its numeric IP address), -plus a port number. -Port 8000 is the default, so assume this number if it is not specified. -Sometimes a colon is used to glue them together, -as in -junkbuster.fictitous-pro-privacy-isp.net:8000 -but -with most browsers -you do not type the colon, -you enter the address and port number in separate boxes. -
- -
-All current browsers can be told the address of a proxy to use.
-You enter the same information in two fields in your browser's proxy
-configuration screen (see list below): one for
-HTTP,
-and one for the Secure Protocol (assuming your browser supports
-SSL).
-If you find some information already entered for your proxy,
-see the
-next question.
-Here are the menus you go through to get to the proxy configuration settings.
-(We also recommend that you
-disable Java,
-which is a separate operation.)
-Make notes on the changes you make so you know how to undo them!
-You will need to know what you did
-in case you wish to
-discontinue
-using the proxy.
-
-Some -ISPs -and companies require all Web traffic to go through their proxy. -In this case you would find your proxy configuration with values already set, -possibly under -Automatic Proxy Configuration -(in the case of -Netscape -and -MS-IE 3.0 -and above). -It's probably a firewall proxy between your company and the outside world, -or a -caching proxy -if you're using an -ISP. -
-What needs to be done in this case is to -use the -forwardfile -option -to tell the -Internet Junkbuster -the address of the other proxy. -Specify a different (unused) port number -with the -listen-address -option, -and configure your browser to -use that port. -If you haven't done this kind of thing before, -it's probably best to consult your systems administrator or -ISP -about it; -check their web page first. -
- --Just go through the same procedure you used to start your -browser using the -Internet Junkbuster, -but remove the details you put in -(or if there was something there before, restore it). -You may need to use - -Save Options -to make this change permanent. -On Netscape 3.0 you can go through - -Options; - -Network Preferences; - -Proxies -and click on - -No Proxy -to turn it off, and later click on - -Manual Proxy Configuration -if you want to start using it again. -(No need to enter the again details under - -View -as you did the -first time; -they should remain there unchanged.) -
-This stops your browser talking to the proxy; -shutting down the proxy -is a different matter. -
- --Some browsers (such as MSIE-4) can be configured to dial your -ISP -automatically when you click on a link, -but this feature gets disabled if you specify a proxy running on your -own computer -(with address -localhost -or -127.0.0.1) -because these addresses don't require dialing. -The -Internet Junkbuster -knows nothing about dialing, so it doesn't work. -To make automatic dialing work, -make up a name such as -junkbuster.ijb -and use that name in the proxy settings -instead of -localhost, -and then add the line -127.0.0.1 junkbuster.ijb -to the file -c:\windows\hosts -(if there already is a line beginning with -127.0.0.1 -just add -junkbuster.ijb -at the end of it.) -
-This should also work Netscape Communicator 4 on -machines where IE-4 has been installed. -
- -
-If you are running Redhat
-Linux
-you may prefer to use the
-rpm
-instead of the following procedure.
-
-
-
-If you are running a version earlier than 2.0 you can start it with -junkbuster & -
-
-A binary is currently being supplied with the source code,
-but if you prefer to compile it yourself here is the likely procedure.
-Most of these steps are repeated in our checklist for
-installation under Windows.
-
-(Version 2.0.1 and above uses -the file -junkbstr.ini -as the config file -if it exists and no argument was given. If you have an earlier -version or if you want it to use a different config file, -simply specify that file as the argument.) -
-WinNT users can put it into their own -StartUp folders or the Administrator -can put it into the system's global StartUp folder. -For details on how to make this a service under NT -see our -Windows page. -
-Pick a page from somewhere (such as your bookmarks, or just one -that your browser was pointing to) -and - -Reload -it. -If you get a message along the lines of ``server not responding, -using cached copy instead,'' see the advice -above. -If the page reloads OK, check that your browser is actually -talking to the proxy by going to -http://internet.junkbuster.com/cgi-bin/show-proxy-args -or any -URL -ending in -show-proxy-args -(as described -below, -the proxy should intercept the request.) -When you see ``Internet Junkbuster Proxy Status,'' -you'll know it's working. -
- --You may need the -forwarding -feature to ``daisy chain'' the -Internet Junkbuster -to another proxy, perhaps an -anonymizing -proxy to -conceal -your -IP -address, -or a -caching proxy -from your -ISP, -or a -firewall -proxy between your company and the outside world. -Version 2.0 -can be even configured to forward -selectively -according to the -URL -requested: -for example, connecting directly to trusted hosts, -but going through an anonymizing or firewall proxy for all other hosts. -
-Network administrators might use it to provide -transparent access to multiple networks without -modifying browser configurations. -Most browsers also provide a way of -specifying hosts that the browser -connects to directly, bypassing the proxy. Some provide a method for -Automatic Proxy Configuration. -A well written -Internet Junkbuster -configuration can be much more flexible and powerful. -
-An -ISP's -caching proxy -would typically be called something like -cache.your-isp.net:8080 -(as described on you -ISP's -web page); -you would put this information in your -forwardfile -as described in our manual. -Your browser would be configured to -the -Internet Junkbuster -for -HTTP -and Security Proxies as before, -but you probably want to tell it to use the caching proxy -for -FTP -and other protocols. -If your -ISP -is running -the -Internet Junkbuster -for you, -they have probably already decided whether to chain with a caching proxy. -
- --There is support for some -gateways -in -Version 1.4 -and above. -The gateway protocol used to be specified on the command line; -it is -now specified -in the same file as -forwarding. -Note that the browser's proxy configuration must -not -specify a -SOCKS -host; -it should specify the proxy as described -above. -
- -
-To get the proxy to do as little as possible (which means not deleting any
-sensitive headers), place in your
-configuration file the following three lines (each ending in a space
-then a period) to stop it changing sensitive headers:
-
- referer .
-
- from .
-
- user-agent .
-
- cookiefile mycookiefile
-
-The fourth line is also needed to specify a
-cookiefile
-that might be called
-mycookiefile
-containing a single line with a
-*
-character, to allow all cookies through.
-
-It depends on your platform. Under Windows, use
-
-Ctrl-Break
-in the
-DOS
-window or
-the old three-fingered salute of
-
-Ctrl-Alt-Delete
-and select
-
-End Task.
-Under
-UNIX ®
-you'll need to
-kill
-the
-junkbuster
-process.
-If you don't know the process number to give to
-kill, try this:
-ps ax | grep junkbuster
-
-
-We've seen only a few public comments from the advertising industry on this, -other than -SEC filings. -First, the president of the Internet Advertising Bureau told -CNET -that he wasn't worried by banner blockers. -Second, after the Federal Trade Commission's -workshop -where we gave a live demonstration of our proxy before -many eminent representatives of the industry, -the -Direct Marketing Association -made the following -statement in the closing paragraphs -of their -summary comments -to the Commission. -
-Clever shareware developers have come up with products that -can obliterate cookies and advertisements for those consumers -who have these concerns. -The Internet is a market that is so democratic and flexible -that it is easy for companies and software -developers to respond to a perceived market need. --Their attitude seems to be that they would prefer that -people use technical solutions -to protect their privacy than have protections -imposed by legislation or government regulations. -So, do you perceive a market need? -Then here are some ways to flex your democratic muscles. - - -
-That depends. Try this quick three-point test.
-
-Yes, -ask us -for a quote on a maintenance contract with your choice of -phone and email support, -hard copy documentation, -source code and pre-compiled binaries on tape or disk, -and email alerting of upgrades and issues. -We also offer consulting services to help set up ``stealth browsing'' -capabilities to help reduce the footprints left while doing competitive -analysis and other Web work where confidentiality is critical. -
- -
-Many
-ISPs
-who offer the proxy to their customers have told us that
-most of their customers are
-delighted with it
-(although one reported that a customer complaint that without banner ads,
-surfing was like reading a novel: we recommend making it optional).
-Many
-ISPs
-like it because it reduces bandwidth requirements.
-To help get you started,
-here's a checklist we've developed from working with a few
-ISPs.
-You may think of more,
-and we'd be interested if you're willing to
-share them
-with us.
-
-Other organizations with web presence and some bandwidth to spare -can set up as -Proxy Server Servers - -(PS2s). -The idea here is to allow users to choose their proxy configuration, -and provide it to them on a semi-permanent basis. -Users would fill in a form specifying what options they want in -their proxy, -possibly even at a very high level, such as -``no ads'' -or ``no nudity.'' -This information is sent to a -CGI -script that -configures a proxy, starts it running, and returns its address and port number -(possibly along with configuration instructions for the browser -that the user specified.) -
-Users -could be charged -a subscription fee, -or the service could be thrown in free in the hope of -improving customer retention for some existing business -(which is what -ISPs -are doing). -It might be possible to make money by -inserting new ads in the holes left where others were blocked, -but the original owners might object. -PS2s -could differentiate themselves -by providing frequently updated and comprehensive -blocking of ads, or of offensive material based on their own grading system. -Some content providers might do it for the chance to be the -only company that the consumer permits to set cookies. -(Identification could even be done via cookies, -but this might not be popular with the kind of user who wants a proxy.) -PS2s -might sell specific or aggregate information about their -users' browsing habits, -so the agreement with users on whether they are permitted to do this -would be important to both sides. -
-If your organization -establishes a -Proxy Server Service -you would like publicized, -please -notify us. -
- --The sample blockfile we provide blocks almost nothing, -and we do not publish blockfiles that stop almost all banner ads. -But others have; you can find them by -asking Altavista. -You can add any part of the new file to your old one -(probably called -sblock.ini -if you haven't changed the default name in the latest version) -or your just replace it completely. -You -probably -don't need to restart the proxy. -
-If you develop an interesting blocklist and publish it on the Web, -you might want to include the word ``junkbuster'' in it -and use the word ``blocklist'' in the file name given in the -URL -so that others can find it with the query given in the previous sentence. -
- --If your -ISP -is running the -Internet Junkbuster, -they should have a policy on whether they accept suggestions from -their customers on what to block. Consult their web page. -
-If you are running -the -Internet Junkbuster -yourself, you have complete control over what gets through. -Just add a pattern to cover the offending -URL -to your blockfile. -Version 1.3 and later automatically rereads the blockfile when it changes, -but if you're running an earlier version you'll -have to -stop it -and restart it. -
-To choose a pattern you'll first need to find the -URL -of the ad you want cover. -
-Some people use the -debug -1 -option to display each -URL -in a window as the request is sent to the server. -It's then usually an easy task to pick the offending -URL -from the list of recent candidates. -
-Alternatively, -you can use - -View Document Info -(or - -View Document Source -if your browser doesn't have that). -The - -Info -feature has the advantage of showing you the full -URL -including the host name, -which may not be specified in the source: -there you might see something like -SRC="/ads/click_here_or_die.gif" -indicating only the -path. -(The host name is assumed to be the same as the one the page came from.) -
-But ads often -come from a different site, in which case you -might see something like -SRC="grabem.n.trackem.com/Ad/Infinitum/SpaceID=1666" -or longer. -If the company looks like a pure ad warehouse -(as in the last case), -you may want to place just its domain name in the blockfile, -which blocks all -URLs -from that site. -
-If the ad comes from a server -that you really want some content from, -you can include enough of the path -to avoid zapping stuff you might want. -In the first example above, -/ads/ -would seem to be enough. -If you don't include the domain name, -the pattern applies to all sites, -so you don't want such patterns -to be too general: -for example -/ad -would block -/admin/salaries/ -on your company's internal site. -
-To speed the blocking of images, some -UNIX ® -users create a -shell script called -Image: -containing a line such as -echo $1 | sed s/http:..// >> $HOME/lib/blockfile -that adds its argument to the user's blockfile. -Once an offending image has been be found using - -View Document Info -it's easy to cut-and-paste the line (or part of it) into a shell window. -The same script can be linked to a file called -Frame: -to dealing with framed documents, -and -junkbuster: -to accept the output of the -debug -option. -
-When compiled without the -regular expressions -option, the -Internet Junkbuster -uses only very simple (and fast) matching methods. -The pattern -/banners -will not stop -/images/banners/huge.gif -getting through: you would have to include the pattern -/images/banners -or something that matches in full from the left. -So you can get what you want here, -the matcher understands -POSIX -regular expressions: -you can use -/*.*/banners -to block -and any -URL -containing -/banners -(even in the middle of the path). -(In Versions 1.1 through 1.4 -they were an option at compile time; -from Version 2.0 they have become the default.) -Regular expressions give you -many more features -than this, -but if you're not already familiar with them you probably won't -need to know anything beyond the -/*.*/ -idiom. -If you do, a -man egrep -is probably a good starting point). -
-Don't forget the -/ -(slash) -at the beginning of the path. -If you leave it out the line will be interpreted as a domain name, -so -ad -would block all sites from Andorra -(since -.ad -is the two-letter -country code -for that principality). -
-For a detailed technical description -of how pattern matching is done, -see the -manual. -
- --If the ad had been displayed before you included its -URL -in the blockfile, -it will probably be held in cache for some time, -so it will be displayed without the need for any request to the server. -Using the -debug -1 -option to show each -URL -as it is fetched is a good way to see exactly what is happening. -
-If new items seem to be getting through, -check that you are -really running -the proxy with the right blockfile in the options. -Check the blockfile for -exceptions. -
-Some sites may have different ways of inserting ads, -such as via -Java. -If you have ideas on how to block new kinds -of junk not currently covered, please -tell us. -
- --You can change the patterns so they don't cover it, -or use a simple feature in Version 1.1 and later: a line beginning with a -~ -character means that a -URL -blocked by previous patterns that matches the rest of -the line is let through. -For example, -the pattern -/ad -would block -/addasite.html -but not if followed by -~/addasite -in the blockfile. -Or suppose you want to see everything that comes from -a site you like, even if it looks like an ad: simply put -~aSiteYouLike.com -at the -end -of the blockfile. -(Order is important, because the last matching line wins.) -
-As well as unblocking -pages that were unintentionally blocked, -this feature is useful for unblocking ads from a specific source. -This might be because you are interested in those particular ones, -or if you have an explicit agreement to accept certain ads, -such as those from a free web-based email provider. -
- --Yes, but remember that -children who are technically sophisticated enough -to use the browsers' proxy configuration options -could of course bypass any proxy. -This kind of technology can be used as a gentle barrier to remind -or guide the child, -but nobody should expect it to replace the parent's role -in setting and enforcing standards of online behavior for their children. -
-Some -ISPs -are starting to provide specialized proxies to protect children. -There are two basic approaches: the ``black list'' and the ``white list'' -approach. -The black list approach allows the child -to go anywhere not explicitly prohibited; the white list permits visits -only to sites explicitly designated as acceptable. -
-It's very easy for -anyone to -compile a white list from a page of ``recommended -kids sites'' and to configure an -Internet Junkbuster -to allow access to those sites only. -If you compile with the -regex -option, -you can place a -* -(asterisk) as the first line of the blockfile (which blocks everything), -and then list -exceptions -after that. -Be careful to make the exception sufficiently broad: -for example, using -~www.uexpress.com/ups/comics/ch/ -as the exception for -Calvin and Hobbes -would block some of the graphic elements on the page; -you would probably want a wider exception such as -~www.uexpress.com/ups/ -to permit them. -
-Version 2.0 has an experimental feature -to permit only sites mentioned in a nominated -trusted site. -This allows organizations to build lists of sites for kids to browse, -and the software automatically restricts access to those on the list. -
-Many filtering -products -actually scan for keywords in -the text of pages they retrieve -before presenting it, -but -the -Internet Junkbuster -does not do this. -Building a perfectly reliable black list system is hard, -because it's very difficult to state -in advance -exactly -what is obscene or unsuitable. -For more info see our -links -page. -
- --You usually see a broken image icon, -but it depends on several factors beyond the proxy's control. -If asked for a -URL -matching its blockfile, the proxy returns an -HTML -page containing a message identifying itself -(currently the two words ``Internet Junkbuster'') -with a status 202 (Accepted) instead of the usual 200 (OK). -(Versions 1.X returned an error 404: Forbidden, which caused -strange behavior in some cases.) -Status 202 is described in the -HTTP -RFC -as indicating that the request has been accepted but not completed, -and that it might complete successfully in the future -(in our case, if the blockfile were changed). -
-The broken image icon is most common -because the browser is usually expecting a graphic. -But if it was expecting text, or if the page happens to be using certain -HTML -extensions -such as -layer -and your browser is a late model from Microsoft, -you may see the words ``Internet Junkbuster'' displayed as a hot link. -
-Clicking on the link takes you to an explanation of -the pattern in the blockfile that caused the block, -so that you can edit the blockfile and go back and reload if you really -want to see what was blocked. The explanatory link is generated by -the proxy and is automatically intercepted based on its ending in -ij-blocked-url; -even though the site is specified as -http://internet.junkbuster.com -no request should actually made to that site. -If one is, it means that the proxy was been removed after it -generated the link. -
-To summarize: -the identifying link to the blocking explanation -is usually turned into a broken image icon, -but it may be displayed on a page alone, -or they may may be restricted to the particular frame, layer or graphic area -specified in the page containing them. -The proxy has no way of knowing the context in which a -URL -will be used and cannot control how the blocking message will be rendered. -
- --Many users have suggested to us -that blocked banners should be replaced by a something like a -1x1 transparent -GIF -to make the page would look as if there was nothing ever there. -Apart from making it harder to catch unintended blocking, -this might also displease the owners of the page, -who could argue that such a change constitutes a copyright infringement. -We think that merely failing to allow an included graphic to be accessed -would probably not be considered an infringement: -after all this is what happens when a browser -is configured not to load images automatically. -However, we are -not -lawyers, -so anyone in doubt should take appropriate advice. -
-In a context where the copyright issue is resolved -satisfactorily, -a proxy could simply return a status 301 or 302 and -specify a replacement -URL -in a -Location -and/or -URI -header. -An alternative would be to use inline code to return a -1 x 1 clear -GIF. -We do not publish sample code for this, -and we have no way of stopping -others -who have. -
- --Many users have pointed out that most banner ads come in standard sizes, -so why not block all -GIFs -of those sizes? -This would theoretically be without fetching the object -because the dimensions are usually given in the -IMG -tag, -but it would require substantial changes in the code, -and we doubt whether it would be much more effective than a good block list. -
- --The -Internet Junkbuster -deliberately -does not provide a way of automatically editing the contents of a page, -to remove textual advertising or -to repair the holes left by blocked banners. -Other packages such as -WebFilter -do. -
-For the same reason, -it has no way of stopping a new browser -window being created, because this is done through the -target -attribute in the -<a> -and -<base> -elements, -not through headers. -Nor do we plan to add a feature to -paralyze animated -GIFs. -
- --We haven't tried it but we expect it would probably -work on image ads on push channels. -See also -adchoice. -
-Disabling -Javascript -stops some pop-up ads. -One problem is that some advertisers throw open a new -browser window to frame the ad. The ad is easily blocked, -but the empty window remains. You can kill it easily, but this is a chore. -We don't see how to stop them other than editing the -HTML -from the parent window, which we -don't -like to do. -
-The -TBTF -newsletter warned subscribers to push information that -in IE4, -LOGTARGET -allows -servers to determine the -URLs -viewed at their site even if accessed from cache or through a proxy. -If you use this browser see our instructions on -how to disable -this. -
-If you find you have experience using the proxy with push, -or have any other advice about it, please -tell us. -
- --Yes, you should expect the occasional cookie to make it through to your browser. -We know of at least three ways this can happen; -please -tell us -if you find any others. -One way is in secure documents, which are explained -below. -
-A -few -sites set cookies using a line such as -<META HTTP-EQUIV="Set-Cookie" CONTENT="flavor=chocolate"> -in the -HEAD -section of an -HTML -document. -Cookies can also be - -set and read -in -JavaScript. -To see if this is happening in a document, -view its source, look in the -head -for a section tagged -script language="JavaScript". -If it contains a reference to -document.cookie, -the page can manipulate your cookie file without sending any cookie headers. -The -Internet Junkbuster -does not tamper with these methods. -Fortunately they are rarely used at the moment. -If a cookie gets set, it should be stopped -by the proxy on its way back to the server when a page is requested, -but it can still be read in Javascript. -bu -
-To prevent cookies breaking through, -always -keep -cookie alerts -turned on in your browser, -and -disable -Java and Javascript. -Making the files -hard to write -may also help. -
- --When a web site's server sends you a page it also sends -certain ``header information'' which your browser records but does not display. -One of these is a -Set-Cookie -header, which specifies the cookie information that the server wants your browser to record. -Similarly, when your browser requests a page it also sends headers, specifying -information such as the graphics formats it understands. -If a cookie has previously been set by a site that matches the -URL -it is about to request, -your browser adds a -Cookie -header quoting the previous information. -
-For more background information on how cookies -can damage your privacy, see our -page on cookies. -For highly detailed technical information see the -RFC. -The -Internet Junkbuster -will show you all headers you use the -debug -8 -option, -or you can get a sample from our -demonstration page. -
- --Possibly. -Some personalized services including certain - -chat -rooms -require cookies. -Newspapers that require - -registration -or - -subscription -will not automatically recognize you if you don't send them the cookie they -assigned you. And there are a very small number of sites that do -strange things with cookies; they don't work for anyone that blocks -cookies by any means. -Some sites such as -Microsoft -explain that their content is so wonderfully compelling that -they will withhold it from you unless you submit to their -inserting cookies. -
-If you want such sites to be given your cookies, -you can use the -cookiefile -option provided you are running -Version 1.2 or later -yourself. -Simply include the domain name of those sites in the -cookiefile -specified by this option. -If it still doesn't work, -the problem may be in -other headers. -
-It's possible to let cookies out but not in, -which is enough to keep some sites happy, but not all of them: -one newspaper site seems to go into an endless frenzy -if deprived of fresh cookies. -A cookiefile containing -a single line consisting of the two characters ->* -(greater-than and star) permits server-bound cookies only. -The -* -is a -wildcard -that matches all domains. -
-If someone else is running the -Internet Junkbuster -for you and has a version -that - -passes server-bound cookies through, -you can try editing your browser's cookie -file to contain just the ones you want, -and restart your browser. -To subscribe to a new service like this -after you have started using the -Internet Junkbuster, -you can try the following: -tell your browser to -stop using -the -Internet Junkbuster, -fill out and submit your subscription details -(allowing that web site to set a cookie), -then -reconfigure your browser to use the -Internet Junkbuster -again -(and stop more cookies being sent). -This also requires the -cookiefile -option, -and its success depends on the Web site -not wanting to change your cookies at every session. -For this reason it does not work at some major newspaper sites, for example. -But you may prefer to -look at whether other sites provide the same -or better services without demanding the opportunity -to track your behavior. -The web is a buyer's market where most prices are zero: -very few people pay -for content with money, so why should you pay with your privacy? -
- --Yes, since version 1.2 the -Internet Junkbuster -has included advanced cookie management facilities. -Unless you specify otherwise, -cookies are discarded (``crumbled'') by the -Internet Junkbuster -whether they came from the server or the browser. -In Version 1.2 and later you can -use the -cookiefile -option -to specify when cookies are to be passed through intact. -It uses the same syntax and -matching -algorithm as the blockfile. -
-If the
-URL
-matches a pattern in the
-cookiefile
-then cookies are let through in both the browser's request for the
-URL
-and in the server's response.
-One-way permissions can be
-specified by starting the line with the
->
-or
-<
-character.
-For example, a cookiefile consisting of the four lines
-
- org
-
- >send-user-cookies.org
-
- <accept-server-cookies.org
-
- ~block-all-cookies.org
-
-allows cookies to and from
-.org
-domains only, with the following exceptions:
-
-If -the -junkbuster -was compiled with the regular expressions option -they may be used in paths. -Any logging to a -``cookie jar'' -is separate and not affected. -
-It's important to give hosts you want to be able -to set cookies sufficient breadth. For example, -instead of -www.yahoo.com -use -yahoo.com -because the company uses many different hosts ending in that domain. -
- -
-Yes,
-using the
-wafer
-option.
-We coined the term
-wafer
-to describe cookies chosen by a user,
-not the Web server.
-Servers may not find wafers as tasty as the cookies
-they make themselves.
-But users may enjoy controlling servers' diets for various reasons,
-such as the following.
-
--Any company that tries to argue in court that the proxy site -was breaching their copyright in the cookies would -be met with the defense that the proxy site gave that company -the opportunity to protect its copyright by simply -not sending cookies after receiving the notice. --TO WHOM IT MAY CONCERN - -
-
-Do not send me any copyrighted information other than the -document that I am requesting or any of its necessary components. -
-
-In particular do not send me any cookies that -are subject to a claim of copyright by anybody. -Take notice that I refuse to be bound by any license condition -(copyright or otherwise) applying to any cookie. - -
-Cookies can be as long as four thousand characters,
-so there's plenty of space for lawyerly verbosity,
-but white space, commas, and semi-colons are
-prohibited.
-Spaces can be turned into underscores.
-Alternatively,
-a
-URL
-could be sent as the cookie value,
-pointing to a document containing a notice,
-perhaps with a suggestive value such as
-
-http://www.junkbusters.com/ht/en/ijbfaq.html#licenses_on_cookies_refused
-
-But including the notice directly would probably be preferable
-because the addressee does not have to look it up.
-
-The -Internet Junkbuster 2.0 -currently sends a full notice as a -``vanilla wafer'' -if cookies are being logged to a cookie jar -and no other wafers have been specified. -It can be suppressed with the -suppress-vanilla-wafer -option, -which might be used in situations where there is an established understanding -between the proxy and all who serve it. -
-Junkbusters provides a -CGI -script that lets you -see -your wafers as they appear to servers. -
-Wafers confuse a few fragile servers. -If this troubles you, don't use this option. -
-Any wafers specified are sent to -all sites regardless of the cookiefile. -They are appended after any genuine cookies, -to maintain compliance with -RFC 2109 -in the event that a path was specified for a cookie. -The -RFC's provisions regarding the -$ -character -(such as the -Version -attribute) -are transparent -to the proxy; it simply quotes what was recited by the browser. -
-If you want to send wafers only to specific sites, -you could try putting them your browser's cookie file in a format -conforming to the Netscape -specification, -and then specify in the proxy's cookiefile that cookies are to be -sent to -but not accepted from those sites, so they can't overwrite the file. -This may work with Netscape but not all other browsers. -
- -
-We provided this capability just in case anyone wants it.
-There are a few possible reasons.
-
-No. Your chances of remaining anonymous are improved, -but unless you are an expert on Internet security -it would be safest to assume that everything you do on the Web -can be attributed to you personally. -
-The -Internet Junkbuster -removes various information about you, -but it's still possible that web sites can find out who you are. -Here's one way this can happen. -
-A few browsers -disclose the user's email address -in certain situations, such as when transferring a file by -FTP. -The -Internet Junkbuster 2.0 -does not filter the -FTP -stream. -If you need this feature, or are concerned about the mail handler -of your browser disclosing your email address, -you might consider -products such as -NSClean. -
-Browsers downloaded as binaries -could use non-standard headers to give out any information -they can have access to: see the manufacturer's license agreement. -It's impossible to anticipate and prevent every breach of privacy that -might occur. -The professionally paranoid prefer browsers available as source code, -because anticipating their behavior is easier. -
- --You shouldn't have to trust us, and you certainly don't have to. -We do not run the proxy as a service, -where we could observe your online behavior. -We provide source code so that everyone can see that the proxy isn't -doing anything sneaky. -
-You are already trusting your -ISP -not to look at an awful lot of information on what you do. -They probably post a -privacy policy -on their site to reassure you. -If they run a proxy for you, using it could actually -make it slightly easier for them to monitor you, -but we doubt that any sane -ISP -would try this, -because if it were discovered customers would desert them. -
- -
-The
-Internet Junkbuster
-pounces on the following
-HTTP
-headers in requests to servers,
-unless instructed otherwise in the options.
-
-Some browsers -send Referer and User-Agent information under different non-standard headers. -The -Internet Junkbuster 2.0 -stops -UA -headers, -but others may get through. -This information is also available via JavaScript, -so -disable disable -it. -Some search engines -encode the query you typed -in the -URL -that goes to advertisers to target a banner ad at you, -so you will need to block the ad as well as the referer header, -unless you want them (and anyone they might -buy data -from) -to know -everything you ever search for. -
-If you have JavaScript enabled (the default on -most browsers) servers can use it to obtain Referer and User Agent, -as well as your plug-ins. -We recommend -disabling -JavaScript and Java. -
-Currently no -HTTP -response headers (browser bound) -are removed, -not even the -Forwarded: -or -X-Forwarded-For: -headers. -Nor are any added, -unless requested. -We are considering a more flexible header management system for -a future version. -
- --Possibly. If used with a browser less advanced than Netscape 3.0 or IE-3, -indicating an advanced browser -may encourage pages containing extensions that confuse your browser. -If this becomes a problem -upgrade your browser or -use the -user-agent -option to indicate an -older browser. -In -Version 1.4 -and later you can selectively reveal your real browser -to only those sites you nominate. -
-Because different browsers -use different encodings of Russian characters, -certain web servers convert pages on-the-fly according to the User Agent -header. Giving a User Agent with the wrong operating system or -browser manufacturer causes some Russian sites to be garbled; -Russian surfers should -change it -to something closer. -
-Some -page access counters -work by looking at the referer; -they may fail or break when deprived. -
-Some sites depend on getting a referer header, -such as -uclick.com, -which serves comic strips -for many newspaper sites, -including -Doonsbury -for the -Washington Post. -(If you click on that last link, you can then get to a page containing -the strip via the -same -URL -we've linked to under -Doonsbury, -but if you click on the -Doonsbury -link directly, it gives you an error message suggesting that you -use a browser that supports referers.) -In -Version 1.4 -and later you can use the --r @ -option -and place a line like ->uclick.com -in your cookiefile. -Wired News -used to use referer to decide whether to add a navigation column to -the page, but they have changed that. -
-The weather maps of -Intellicast -have been blocked by their server when no referer or cookie is provided. -You can use the same countermeasure with a line such as ->208.194.150.32 -(or simply get your weather information -elsewhere). -
-Some software vendors, including -Intuit -use -USER_AGENT -to decide which versions of their products to display to you. -With the -default -you get Mac versions. -
-As a last resort if a site you need doesn't seem to be working, -the -proxy configuration -of many browsers allow you to specify - -No Proxy For -any hostname you want. -
-We had reports that on some versions of Netscape the -What's New -feature did not work with the proxy, -but we think we fixed this in Version 2.0.1. -
- --Almost -every -major release of both leading browsers has contained -bugs that allow malicious servers to compromise your privacy and security. -Known bugs are quickly fixed, but millions of copies of the affected -software remain out there, and yours is probably one of them. -The -header -that normally identifies your browser tells such servers exactly which attacks -to use against you. -By misidentifying your browser you reduce the likelihood that they -will be able to mount a successful attack. -
- --Web sites get the IP address of any proxy or browser they serve pages to. -If you run the proxy on your own computer the IP address disclosed -is the same as your browser would, unless you use the -forwardfile -option is used to chain to another proxy, -in which case servers only get the last IP address in the chain. -Chaining slightly slows browsing of course, but it improves anonymity. -
-One public proxy that you can -forward to is -lpwa.com -port 8000. -Read about its privacy-enhancing -features and the authentication procedures first, -and note that it blocks -referer -in almost all cases, -as well as some -other headers. -
- -
-After you log in to
-LPWA
-it tells your browser to send a
-Proxy-authorization
-header with each request.
-Whenever you shut down the browser and start again with a new browser,
-you need to log in again.
-If you are the only person using the
-Internet Junkbuster
-proxy, you can avoid repeated logins to
-LPWA
-by telling the
-Internet Junkbuster
-to send the information by placing a line such as
-
- add-header Proxy-authorization: Basic ZHVtbXk=.
-
-in the configuration file.
-The exact example above
-does not work
-because the code
-ZHVtbXk=.
-is a bogus one that
-LPWA
-would never generate;
-follow the procedure below to generate a valid one.
-
-We think so, -provided you are not the user running the -proxy. -If your computer (or your -ISP's) -is running the -identd -demon, -servers can ask it for the identity of the -user making the request at time you request a page from them. -But if you're going through a proxy, -they will identify the user name associated with the proxy, not you. -A visit to -http://ident.junkbusters.com -lets you see what's happening. -This test is (quite rightly) blocked by many -firewalls; -just interrupt the transfer if you get an abnormal wait after clicking. -Running other applications -may also expose you via -identd; -the proxy of course doesn't help then. -
- --With the default options the proxy doesn't announce itself. -Obvious indications such as -Keep-Alive -headers are -deleted, -but sites might notice that you can cancel cookies faster than -any human could possibly click on a mouse. -(If you want to provide a -plausible explanation for this, -change the User Agent header to a -cookie-free -or -cookie-crunching -browser). -
-But when certain options -are used they could figure out something's going on, -even if they're not pushing cookies. -If you use blocking -they can tell from their logs that the graphics in their pages -are not being requested selectively. -The -add-forwarded-header -option explicitly announces to the server that a proxy is present, -and -sending them -wafers -is of course a dead giveaway. -
- --If you enter a -``Secure Document Area,'' -cookies and other header information -such as User Agent and Referer -are sent encrypted, -so they cannot be filtered. -We recommend getting your browser to alert you when this happens. -(On Netscape: - -Options; - -Security; - -General; - -Show an alert before entering a secure document space.) -We also recommend adding the line -:443 -to the blockfile to stop all but sites specified in an exception -after that line from using SSL. -
-It may be possible to filter encrypted cookies -by combining the blocking proxy with a cryptographic proxy along -the lines of -SafePassage, -but we have not tried this. -
- --We're not security experts, but we don't think so. -The whole point of -SSL -is that the -contents of messages are - -encrypted -by the time -they leave the browser and the server. -Eavesdroppers (including proxies) can see where your messages are going -whether you are running a proxy or not, -but they only get to see the contents after they have been encrypted. -
- --Yes, we added an -access control -file in Version 2.0. -But before you use it please consider why you want to do it. -If the reason is security, -it probably means you need a firewall. -
-The -listen-address -option provides a way of binding the proxy to a single IP address/port. -The right way to do this is to choose a port inside your firewall, and -deny access to it to those outside the firewall. -The -Internet Junkbuster -is not a firewall proxy; -it should not be expected to solve security problems. -
-For background information on firewalls,
-see
-Yahoo
-or a
-magazine article
-or these well-known books:
-Firewalls and Internet Security: Repelling the Wily Hacker
-by
-
-Yes. -As with any service offered over the Internet, -hackers can try to misuse it. -A well-run -ISP -will have professionals who are experienced at assessing and containing -these risks. -
-It's possible to set up your machine so -that other people can have access to your proxy, -but if you lack expertise in computer security -you probably shouldn't have your computer configured to offer -this or any other service to the outside world. -
-Hackers can attempt to gain access
-to the machine by various attacks,
-which we have tried to guard against but don't guarantee to thwart.
-They can also use the ``anonymizing'' quality of proxies
-to try to cover their tracks while hacking other computers.
-For this reason we recommend preventing it being used
-as an anonymous
-telnet
-by putting the pattern
-:23
-in the blockfile (it's included as standard equipment).
-(Actually the current implementation incidentally blocks telnet due to the
-way headers are handled, but it's best not to rely on this.)
-If you wish to block all ports except the default
-HTTP
-port 80,
-you can put the lines
-
- :
-
- ~:80
-
-at the beginning of the blockfile, but be aware that some servers
-run on non-default ports (e.g. 8080). You might also want to add the line
-~:443
-to allow
-SSL.
-
-On -UNIX ® -systems it is neither necessary nor desirable for the proxy to run as root. -
-Versions 2.0.1 and below may be vulnerable to remote -exploitation of a memory buffer bug; for security reasons all users -are encouraged to -upgrade. -
-If you find any security holes in the code -please -tell us, -along with any suggestions you may have for fixing it. -However, we do not claim that we will be able to do so. -
-We distribute this code in the hope that people -will find it useful, but we provide -no warranty -for it, -and we are not responsible for anyone's use or misuse of it. -
-You may also want to check back periodically for updated versions of the code. -We do not -maintain a mailing list. -To get quick updates, bookmark our -Distribution Information -page. -
- - -Home - · -Next - - · Site Map - - · Legal - - · Privacy - - · Cookies - - · Banner Ads - - · Telemarketing - - · Mail - - · Spam - - - - --Copyright © 1996-8 Junkbusters -® Corporation. -Copying and distribution permitted under -the GNU -General Public License. - - -1998/10/31 -http://www.junkbusters.com/ht/en/ijbfaq.html - -
webmaster@junkbusters.com - - - diff --git a/doc/ijbman.html b/doc/ijbman.html deleted file mode 100644 index 710cddb0..00000000 --- a/doc/ijbman.html +++ /dev/null @@ -1,920 +0,0 @@ - - - - - - - - - - - --Options - - · Checking Options - - · Installation - - · Copyright - - · (FAQ) -
--junkbuster -- The -Internet Junkbuster -Proxy -TM -
- -
-junkbuster
-configfile
-(Version 2.0 onwards)
-
-junkbstr.exe
-configfile
-(Windows)
-
-junkbuster
-[-a]
-[-y]
-[-s]
-[-c]
-[-v]
-
-[-u user_agent]
-[-r referer]
-[-t from]
-
-[-b blockfile]
-[-j jarfile]
-[-l logfile]
-
-[-w NAME=VALUE]
-[-x Header_text]
-
-[-h [bind_host_address][:bind_port]]
-
-[-f forward_host[:port]]
-[-d N]
-
-[-g gw_protocol[:[gw_host][:gw_port]]]
-
-(Version 1.4 and earlier)
-
-junkbuster -is an instrumentable proxy that filters the -HTTP -stream between -web servers and browsers. -Its main purpose is to enhance privacy. -
-Versions before 2.0 used command-line options; -Versions from 2.0 onward use a configuration file. -The following descriptions of the options first give the older -command-line usage, then the new configfile line. -
-In Versions 2.0.1 upwards on Windows, -a start-up message is printed and the configuration is read from the file -junkbstr.ini -if it exists and no argument was given. -
-All files except the configfile -are checked for changes before each page is fetched, -so they may edited without restarting the proxy. -
-To compare the domains, -the pattern domain and the target -domain specified in the -URL -are each broken into their components. -(Components are separated by the -. -(period) character.) -Next each of the target components -is compared with the corresponding pattern component: last with last, -next-to-last with next-to-last, and so on. -(This is called -right-anchored -matching.) -If all of the pattern components find their match in the target, -then the domains are considered a match. -Case is irrelevant when comparing domain components. -
-A successfully -matching pattern can be an anchored substring of a target, but -not vice versa. -Thus if a pattern doesn't specify a domain, -it matches all domains. -Furthermore, when comparing two components, -the components must either match in their entirety or up to a wildcard -* -(star character) in the pattern. The wildcard feature -implements only a "prefix" match capability ("abc*" vs. "abcdefg"), -not suffix matching ("*efg" vs. "abcdefg") or -infix matching ("abc*efg" vs. "abcdefg"). -The feature is restricted to the domain component; -it is unrelated to the optional -regular expression -feature in the path -(described below). -
-If a numeric port -is specified in the pattern domain, then the target port must -match as well. The default port in a target is port 80. -
-If the domain and port match, -then the target -URL -path is checked for -a match against the path in the pattern. -Paths are compared with a simple case-sensitive -left-anchored substring comparison. -Once again, the pattern can be an -anchored substring of the target, but not vice versa. -A path of -/ -(slash) would match all paths. Wildcards are not considered in -path comparisons. -
-For example, the target
-URL
-
- the.yellow-brick-road.com/TinMan/has_no_brain
-
-would be matched (and blocked) by the following patterns
-
- yellow-brick-road.com
-
-and
-
- Yellow*.COM
-
-and
-
- /TinM
-
-but not
-
- follow.the.yellow-brick-road.com
-
-or
-
- /tinman
-
-
-Comments in a blockfile start with a -# -(hash) character and end at a new line. -Blank lines are also ignored. -
-Lines beginning with a -~ -(tilde) character are taken to be -exceptions: -a -URL -blocked by previous patterns that matches the rest of -the line is let through. (The last match wins.) -
-Patterns -may contain -POSIX -regular expressions -provided the -junkbuster -was compiled with this option -(the default in Version 2.0 on). -The idiom -/*.*/ad -can then be used -to match any -URL -containing -/ad -(such as -http://nomatterwhere.com/images/advert/g3487.gif -for example). -These expressions -don't work -in the domain part. -
-In version 1.3 and later -the blockfile and cookiefile are checked for changes before each request. -
-In Version 1.2 and later -this option must be followed by a -filename -containing instructions on which sites are allowed to -receive and set cookies. -By default cookies are dropped in both the browser's request -and the server's response, unless the -URL -requested matches an entry in the -cookiefile. -The matching algorithm is the same as for the blockfile. -A leading -> -character allows -server-bound -cookies only; -a -< -allows only browser-bound cookies; -a -~ -character stops cookies in -both directions. -Thus a cookiefile containing a single line with the two characters ->* -will pass on all cookies to servers but not give any new ones to the browser. -
-Version 2.0 also accepts the spelling -referrer, -which most dictionaries consider correct. -
-* lpwa.com:8000 . . --
-Each line contains four fields:
-target,
-forward_to,
-via_gateway_type
-and
-gateway.
-As usual, the
-last
-target
-domain that matches the requested
-URL
-wins,
-and the
-*
-character alone matches any domain.
-The target domain need not be a fully qualified
-hostname; it can be a general domain such as
-com
-or
-co.uk
-or even just a port number.
-For example, because
-LPWA
-does not handle
-SSL,
-the line above will typically be followed by a line such as
-
-
-:443 . . . --to allow SSL transactions to proceed directly. -The cautious would also -add an entry in their blockfile to stop transactions -to port 443 for all but specified trusted sites. -
-If the winning -forward_to -field is -. -(the dot character) the proxy connects -directly to the server given in the -URL, -otherwise it forwards to the host and port number specified. -The default port is 8000. -The -via_gateway_type -and -gateway -fields also use a dot to indicate no gateway protocol. -The gateway protocols are explained -below. -
-The example line above in a forwardfile alone -would send everything through port 8000 at -lpwa.com -with no gateway protocol, -and is equivalent to the old --f lpwa.com:8000 -with no --g -option. -For more information see the example file provided with the distribution. -
-Configure with care: no loop detection is performed. -When setting up chains of proxies that might loop back, try adding -Squid. -
-The user's browser should -not -be -configured -to use -SOCKS; -the proxy conducts the negotiations, not the browser. -
-The user identification capabilities of -SOCKS4 -are deliberately not used; -the user is always identified to the -SOCKS -server as -userid=anonymous. -If the server's policy is to reject requests from -anonymous, -the proxy will not work. -Use a -debug -value of 3 -to see the status returned by the server. -
-Because most browsers send several requests in parallel -the debugging output may appear intermingled, so the -single-threaded -option is recommended when using -debug -with -N -greater than 1. - -
-Each line of the access file begins with -either the word -permit -or -deny -followed by source and (optionally) destination addresses -to be matched against those of the -HTTP -request. -The last matching line specifies the result: if it was a -deny -line or if no line matched, -the request will be refused. -
-A source or destination -can be specified as a single numeric -IP -address, -or with a hostname, provided that the host's name -can be resolved to a numeric address: this cannot be used to block all -.mil -domains for example, -because there is no single address associated with that domain name. -Either form may be followed by a slash and an integer -N, -specifying a subnet mask of -N -bits. -For example, -permit 207.153.200.72/24 -matches the entire Class-C subnet from -207.153.200.0 -through 207.153.200.255. -(A netmask of 255.255.255.0 corresponds to 24 bits of -ones in the netmask, as with -*_MASKLEN=24.) -A value of 16 would be used for a Class-B subnet. -A value of zero for -N -in the subnet mask length will cause any address to match; -this can be used to express a default rule. -For more information see the example file provided with the distribution. -
-If you like these access controls -you should probably have -firewall; -they are not intended to replace one. -
-Browsers must be told where to find the -junkbuster -(e.g. -localhost -port 8000). -To set the -HTTP -proxy in Netscape 3.0, -go through: - -Options; - -Network Preferences; - -Proxies; - -Manual Proxy Configuration; - -View. -See the -FAQ -for other browsers. -The -Security Proxy -should also be set to the same values, -otherwise -shttp: -URLs -won't work. -
-Note the limitations -explained in the -FAQ. -
- --To allow users to -check -that a -junkbuster -is running and how it is configured, -it intercepts requests for any -URL -ending in -/show-proxy-args -and blocks it, -returning instead returns information on its -version number and -current configuration -including the contents of its blockfile. -To get an explicit warning that no -junkbuster -intervened if the proxy was not configured, -it's best to point it to a -URL -that does this, such as -http://internet.junkbuster.com/cgi-bin/show-proxy-args -on Junkbusters's website. -
- -
-http://www.junkbusters.com/ht/en/ijbfaq.html
-
-http://www.junkbusters.com/ht/en/cookies.html
-
-http://internet.junkbuster.com/cgi-bin/show-proxy-args
-
-http://www.cis.ohio-state.edu/htbin/rfc/rfc2109.html
-
-http://squid.nlanr.net/Squid/
-
-http://www-math.uni-paderborn.de/~axel/
-
-Written and copyright by the Anonymous Coders and Junkbusters Corporation -and made available under the -GNU General Public License (GPL). -This software comes with -NO WARRANTY. -Internet Junkbuster -Proxy -is a -trademark -of Junkbusters Corporation. -
- - -Home - · -Next - - · Site Map - - · Legal - - · Privacy - - · Cookies - - · Banner Ads - - · Telemarketing - - · Mail - - · Spam - - - - --Copyright © 1996-8 Junkbusters -® Corporation. -Copying and distribution permitted under -the GNU -General Public License. - - -1998/10/31 -http://www.junkbusters.com/ht/en/ijbman.html - -
webmaster@junkbusters.com - - - diff --git a/doc/obsolete/fb.gif b/doc/obsolete/fb.gif new file mode 100755 index 00000000..43059924 Binary files /dev/null and b/doc/obsolete/fb.gif differ diff --git a/doc/obsolete/ijbfaq.html b/doc/obsolete/ijbfaq.html new file mode 100644 index 00000000..3d522479 --- /dev/null +++ b/doc/obsolete/ijbfaq.html @@ -0,0 +1,1999 @@ + + + + + ++ Website · + Manual · FAQ · GPL
+ +Configuring + Browsers · + IE 5.0 · + Installation · For Companies · Blocking Ads · + Cookies · Hotmail · Children · Forwarding/Chaining + · IP + · Anonymity + · Security
+ +Development of JunkBuster is ongoing and this document is + no longer current. However, it may provide some assistance. If + you have problems, please use the Yahoo Groups + mailing list (which includes an archive of mail), the + SourceForge.net project page, or + see the project's home + page. Please also bear in mind that versions 2.9.x of + JunkBuster are development releases, and are not production + quality.
+ +The Internet Junkbuster Proxy TM + is free privacy-enhancing software that can be run on your PC + or by your ISP or company. It blocks requests for URLs + (typically banner ads) that match its blockfile. It also + deletes unauthorized cookies and other unwanted identifying + header information that is exchanged between web servers and + browsers. These headers are not normally accessible to users + (even though they may contain information that's important to + your privacy), but with the Internet Junkbuster you can see + almost anything you want and + control everything you're likely to need. Many people publish + their blockfiles to help others get started.
+ +No, none of these. It's completely free of charge. + Junkbusters offers you the software to copy, use, modify and + distribute as you wish, forever, at no charge under the GNU + General Public License.
+ +It comes with no warranty of any + kind.
+ +You don't have to register, in fact + we don't even provide a way to do so: the practice of + registering software is usually just an excuse to send you + solicitations and sell your name and information about your + behavior. You are welcome to obtain and use our software as + anonymously you wish. (Your IP address will naturally be + disclosed when you download it; use anonymizing software if you + want to conceal this. We never want to be given any information + that you consider private or confidential.)
+ +We are often asked why we give away a + product that many would happily pay for. The answer is that we + are determined to carry out our mission: to free the world from + junk communications.
+ +For the latest information on availability, see the + Distribution Information page. We don't think it will ever run + on Windows 3.1. But you don't need to have it running on your + computer if you get your ISP or Systems Administrator at work + to run it.
+ +Try their sales or support department (depending on whether
+ you are already a customer). You might
+ send them email including the following URL:
+
+ http://www.junkbusters.com/ht/en/ijbfaq.html#isps
+ You could mention that many other ISPs
+ provide it, and that you regard it as an important part of your
+ decision on where to buy Internet service.
Whoever starts the Internet Junkbuster chooses the options + and the blockfile. If your ISP runs it for you, they have to + make these decision (though some may give you a choice of + proxies, and a way to suggest new URLs to block). If you run it + on your computer, you get to choose.
+ +It depends on your platform. If you are using Windows 95 or + NT, see our separate page on installing under Windows. If you + have a C compiler and are using almost any flavor of UNIX ® + you download it, compile it, start it running, and then + configure your browser. Several precompiled packages are also + available through links in our distribution page, which lists + all available platforms.
+ +If you are using a platform for which we + have no current availability, you are welcome to port the code. + If you do this and you would like us to consider publishing + your ported version, please tell us.
+ +Just point your browser to
+ http://internet.junkbuster.com/cgi-bin/show-proxy-args or to
+ any URL ending in show-proxy-args
(even if it
+ doesn't exist). It needn't exist because the Internet
+ Junkbuster intercepts the request, blocks it, and returns in
+ its place information about itself. Using the URL above is
+ useful for checking that your browser really is going through
+ an Internet Junkbuster, because the junkbuster.com
+ server returns a warning if the request actually gets to it.
+ Some people set the home page of their browser to such a URL to
+ be sure that it is configured to use the proxy.
If you wish to check the header + information your proxy is actually sending, a visit to + http://internet.junkbuster.com/cgi-bin/show_http_headers will + give you the more relevant ones first. You might also like to + turn the proxy off and compare the difference. (Don't forget to + turn it back on again.)
+ +Once your browser is told to use a proxy such as the
+ Internet Junkbuster, it thinks of it as its server for
+ everything, so this message means it can't talk to the proxy.
+ The Internet Junkbuster may not be running, or you may have
+ specified its proxy address incorrectly. Check that the details
+ you entered are correct. If you have telnet
you
+ can try connecting to the appropriate port to see if the
+ Internet Junkbuster is running. If your ISP is running the
+ Internet Junkbuster, you may want to check with them. If you
+ are running it yourself under UNIX ®, try looking at a
+ ps ax
to see if it is running. The port specified in its options should be
+ the same one as your browser has configured.
We'd be very interested to hear it, but please bear a few + things in mind.
+ +If you find using our free product + harder than you're used to for consumer software, there are + many commercial alternatives that you could consider.
+ +The answer to detailed technical questions + may be answered in manual page, or in + the source code. Also double-check this page for an answer: + using the ``find'' feature on your browser for likely keywords + may help. Our site also has a search feature.
+ +Many people post requests for help and + responses on Usenet.
+ +If your ISP is providing the Internet + Junkbuster for you, and your question is about how to use it, + check their web page before asking them.
+ +Even though we don't offer the kind of + support you might expect if you paid a lot of money for a + software product, you can still ask us. But before you do, + please consider whether you could ask someone closer to you. + And please be patient if we're slow to reply: we never charge + consumers for our services, so we have to subsidize consumers + with revenue from companies, and our resources are limited.
+ +If your company or organization would be + interested in a maintenance contract with phone and email + support, hard copy documentation and source code and + pre-compiled binaries on tape or disk, please ask us for a + quote.
+ + + +If you set up the Internet
+ Junkbuster to run on the computer you browse from (rather than
+ your ISP's server or some networked computer at work), the
+ proxy will be on localhost
(which is the special
+ name used by every computer on the Internet to refer to itself)
+ and the port will be 8000
(unless you have told
+ the Internet Junkbuster to run on a different port with the listen-address option).
+ So you when configuring your browser's proxy settings you
+ typically enter the word localhost
in the two
+ boxes next to HTTP and
+ Secure, and the number 8000
in the two boxes
+ labeled to the right of those boxes. The
+ Internet Junkbuster does not currently handle other protocols
+ such as Gopher, FTP, or WAIS, so leave those setting unchanged.
+ Nor does it handle ICQ or Instant Messenger services.
If your ISP or company is running the
+ Internet Junkbuster for you, they will tell you the address to
+ use. It will be the name of the computer it's running on (or
+ possibly its numeric IP address), plus a port number. Port 8000
+ is the default, so assume this number if it is not specified.
+ Sometimes a colon is used to glue them together, as in
+ junkbuster.fictitious-pro-privacy-isp.net:8000
but with
+ most browsers you do not type the colon, you enter the address
+ and port number in separate boxes.
All current browsers can be told the address of a proxy to + use. You enter the same information in two fields in your + browser's proxy configuration screen (see list below): one for + HTTP, and one for the Secure Protocol (assuming your browser + supports SSL). If you find some information already entered for + your proxy, see the next question. Here are the menus you go + through to get to the proxy configuration settings. (We also + recommend that you disable Java, which is a separate + operation.) Make notes on the changes you make so you + know how to undo them! You will need to know what you + did in case you wish to discontinue using the proxy.
+ +setenv http_proxy
+ http://localhost:8000/
+ http_proxy=http://junkbuster.fictitious-pro-privacy-isp.net:8000/
+ export http_proxy
If your browser is not listed here, or if you notice an + error, please tell us the correct procedure.
+ +Some ISPs and companies require all Web traffic to go + through their proxy. In this case you would find your proxy + configuration with values already set, possibly under Automatic Proxy Configuration (in the case of + Netscape and MS-IE 3.0 and above). It's probably a firewall + proxy between your company and the outside world, or a caching proxy if you're using an ISP.
+ +What needs to be done in this case is to use + the forwardfile option to + tell the Internet Junkbuster the address of the other proxy. + Specify a different (unused) port number with the listen-address option, and + configure your browser to use that port. If you haven't done + this kind of thing before, it's probably best to consult your + systems administrator or ISP about it; check their web page + first.
+ +Just go through the same procedure you used to start your + browser using the Internet Junkbuster, but remove the details + you put in (or if there was something there before, restore + it). You may need to use Save Options to make + this change permanent. On Netscape 3.0 you can go through Options; Network Preferences; + Proxies and click on No + Proxy to turn it off, and later click on + Manual Proxy Configuration if you want to start using it + again. (No need to enter the again details under + View as you did the first time; they should remain there + unchanged.)
+ +This stops your browser talking to the + proxy; shutting down the proxy is a different matter.
+ +Some browsers (such as MSIE-4) can be configured to dial
+ your ISP automatically when you click on a link, but this
+ feature (called "automatically connect" or "autoconnect") gets
+ disabled if you specify a proxy running on your own computer
+ (with address localhost
or 127.0.0.1
)
+ because these addresses don't require dialing. The Internet
+ Junkbuster knows nothing about dialing, so it doesn't work. To
+ make automatic dialing work, make up a name such as
+ junkbuster.ijb
and use that name in the proxy settings
+ instead of localhost
, and then add the line
+ 127.0.0.1 junkbuster.ijb
to the file
+ c:\windows\hosts
(if there already is a line beginning
+ with 127.0.0.1
just add
+ junkbuster.ijb
at the end of it.)
This should also work Netscape + Communicator 4 on machines where IE-4 has been installed.
+ + + +The next two sections assume you wish to compile the code
+ with your own C compiler. If you just
+ want to use the .exe
file provided for Windows,
+ see the Windows Installation page.
If you are running Redhat Linux you may prefer to use the + rpm instead of the following procedure.
+ +uncompress -c ijb20.tar.Z | tar xf
+ -
Makefile
and make any changes
+ indicated inside.make
junkbstr.ini
, previously called
+ sconfig.txt
and other names in earlier releases) to
+ some convenient place such as
+ /usr/local/lib/junkbuster/configfile
or whatever you
+ choose. The sample file has all the options commented out.
+ You can remove the #
character on any that you
+ want, but it may be better to leave this until to later.
+ Run it asynchronously:junkbuster configfile &
+
+
+ If you are running a version earlier than 2.0 you can
+ start it with junkbuster &
kill
the process and start it again. The
+ most popular option is
+ blockfile to block ads. A
+ sample blockfile is provided as an illustration, but it
+ doesn't really stop many ads. More comprehensive ones are
+ available elsewhere./etc/rc.d/rc.local
or equivalent to start it at
+ boot time. (Any output you specify should be redirected to a
+ file. And don't forget the & at the end to run it
+ asynchronously or your system will seize up after the next
+ reboot.)A .exe
file (binary) is supplied with the
+ source code, but if you prefer to compile it yourself here is
+ the likely procedure. Most of these steps are repeated in our
+ checklist for installation under Windows.
ijb20.zip
(~208k), then uncompress
+ and unpack the zip archive using a tool like WinZip.ijb20
.
+ Go into that folder and then edit the Makefile for your
+ system, removing the comment character (#
) in
+ the lines related to Win32. Then type:nmake
+ junkbstr.exe
. For information
+ on issues with various compilers, see the Distribution
+ Information page.junkbstr
(Version 2.0.1 and above uses the file
+ junkbstr.ini
as the config file if it exists
+ and no argument was given. If you have an earlier version
+ or if you want it to use a different config file, simply
+ specify that file as the argument.)
junkbstr
executable into
+ the StartUp folder:C:\Windows\Start
+ Menu\Programs\StartUp
+ Properties->Shortcut
to Run:
+ Minimized
. If you specify the hide-console option then the
+ DOS window will vanish after it starts.
+
+ WinNT users can put it into their own + StartUp folders or the Administrator can put it into the + system's global StartUp folder. For details on how to make + this a service under NT see our Windows page.
+Pick a page from somewhere (such as your bookmarks, or just
+ one that your browser was pointing to) and
+ Reload it. If you get a message along the lines of ``server
+ not responding, using cached copy instead,'' see the advice
+ above. If the page reloads OK, check that your browser is
+ actually talking to the proxy by going to
+ http://internet.junkbuster.com/cgi-bin/show-proxy-args or any
+ URL ending in show-proxy-args
(as described below,
+ the proxy should intercept the request.) When you see
+ ``Internet Junkbuster Proxy Status,'' you'll know it's
+ working.
You may need the + forwarding feature to ``daisy chain'' the Internet + Junkbuster to another proxy, perhaps an anonymizing proxy to + conceal your IP address, or a caching proxy from your ISP, or a + firewall proxy between your company and the outside world. + Version 2.0 and above can be even configured to forward selectively according to the + URL requested: for example, connecting directly to trusted + hosts, but going through an anonymizing or firewall proxy for + all other hosts.
+ +Network administrators might use + it to provide transparent access to multiple networks without + modifying browser configurations. Most + browsers also provide a way of specifying hosts that the + browser connects to directly, bypassing the proxy. Some provide + a method for Automatic Proxy Configuration. A well written + Internet Junkbuster configuration can be much more flexible and + powerful.
+ +An ISP's caching proxy would typically
+ be called something like cache.your-isp.net:8080
+ (as described on you ISP's web page); you would put this
+ information in your
+ forwardfile as described in our manual. Your browser would
+ be configured to the Internet Junkbuster for HTTP and Security
+ Proxies as before, but you probably want to tell it to use the
+ caching proxy for FTP and other protocols.
+ If your ISP is running the Internet Junkbuster for you,
+ they have probably already decided whether to chain with a
+ caching proxy.
There is support for some gateways in Version 1.4 and above.
+ The gateway protocol used to be specified on the command line;
+ it is now specified in the same file as forwarding. Note that the
+ browser's proxy configuration must not specify a
+ SOCKS
host; it should specify the proxy as
+ described above.
To get the proxy to do as little as possible (which means
+ not deleting any sensitive headers), place in your
+ configuration file the following three lines (each ending in a
+ space then a period) to stop it changing sensitive headers:
+ referer .
+ from .
+ user-agent .
+ cookiefile mycookiefile
+ The fourth line is also needed to specify a cookiefile that might be called
+ mycookiefile
containing a single line with a
+ *
character, to allow all cookies through.
It depends on your platform.
+ +
+ kill
the junkbuster
process. If you don't know the process number to give
+ to kill
, try this:ps ax | grep junkbuster
We've seen only a few public comments from the advertising + industry on this, other than SEC filings. First, the president + of the Internet Advertising Bureau told CNET that he wasn't + worried by banner blockers. Second, after the Federal Trade + Commission's workshop where we gave a live demonstration of our + proxy before many eminent representatives of the industry, the + Direct Marketing Association made the following statement in + the closing paragraphs of their summary comments to the + Commission.
+ ++ Clever shareware developers have come up with products that + can obliterate cookies and advertisements for those consumers + who have these concerns. The Internet is a market that is so + democratic and flexible that it is easy for companies and + software developers to respond to a perceived market need. ++ +
Their attitude seems to be that they would prefer that + people use technical solutions to protect their privacy than + have protections imposed by legislation or government + regulations. So, do you perceive a market need? Then here are + some ways to flex your democratic muscles.
+ +That depends. Try this quick three-point test.
+ +If the answer to all three questions is yes, then you + probably don't have any need for this kind of product.
+ +Yes, ask us for a quote on a maintenance contract with your + choice of phone and email support, hard copy documentation, + source code and pre-compiled binaries on tape or disk, and + email alerting of upgrades and issues. We also offer consulting + services to help set up ``stealth browsing'' capabilities to + help reduce the footprints left while doing competitive + analysis and other Web work where confidentiality is + critical.
+ +Many ISPs who offer the proxy to their customers have told + us that most of their customers are delighted with it (although + one reported that a customer complaint that without banner ads, + surfing was like reading a novel: we recommend making it + optional). Many ISPs like it because it reduces bandwidth + requirements. To help get you started, here's a checklist we've + developed from working with a few ISPs. You may think of more, + and we'd be interested if you're willing to share them with + us.
+ +*
in it), User Agent specified as Lynxour-isp.net.
But it would probably be
+ safer to put an entry in your name server and call it
+ something like junkbuster.our-isp.net.
If
+ running several proxies, you could either use different ports
+ on the same machine, or if you have the opportunity to
+ distribute the load over a few machines you could use
+ different hostname aliases such as
+ banner.junkbuster.our-isp.net
,
+ lynx.junkbuster.our-isp.net
and
+ oneway.junkbuster.our-isp.net
(corresponding to the
+ examples in the previous point). You may want to set up
+ Automatic Proxy Configuration.
+ blocklist.html
or
+ blocklist.txt
).The sample blockfile we provide blocks almost nothing, and
+ we do not publish blockfiles that stop almost all banner ads.
+ But others have; you can find them by asking Google. You can
+ add any part of the new file to your old one (probably called
+ sblock.ini
if you haven't changed the default name
+ in the latest version) or your just replace it completely. You
+ probably don't need to restart the proxy.
If you develop an interesting blocklist + and publish it on the Web, you might want to include the word + ``junkbuster'' in it and use the word ``blocklist'' in the file + name given in the URL so that others can find it with the query + given in the previous sentence.
+ +If your ISP is running the Internet Junkbuster, they should + have a policy on whether they accept suggestions from their + customers on what to block. Consult their web page.
+ +If you are running the Internet + Junkbuster yourself, you have complete control over what gets + through. Just add a pattern to cover the offending URL to your + blockfile. Version 1.3 and later automatically rereads the + blockfile when it changes, but if you're running an earlier + version you'll have to stop it and restart it.
+ +To choose a pattern you'll first need + to find the URL of the ad you want cover.
+ +Some people use the debug 1
option to display
+ each URL in a window as the request is sent to the server. It's
+ then usually an easy task to pick the offending URL from the
+ list of recent candidates.
Alternatively, you can use View Document Info (or View Document
+ Source if your browser doesn't have that). The Info feature has the advantage of showing you the full
+ URL including the host name, which may not be specified in the
+ source: there you might see something like
+ SRC="/ads/click_here_or_die.gif"
indicating only the
+ path. (The host name is assumed to be the same
+ as the one the page came from.)
But ads often come from a different
+ site, in which case you might see something like
+ SRC="grabem.n.trackem.com/Ad/Infinitum/SpaceID=1666"
or
+ longer. If the company looks like a
+ pure ad warehouse (as in the last case), you may want to place
+ just its domain name in the blockfile, which blocks all URLs
+ from that site.
If the ad comes from a server that you
+ really want some content from, you can include enough of the
+ path to avoid zapping stuff you might want. In the first
+ example above, /ads/
would seem to be enough. If
+ you don't include the domain name, the pattern applies to all
+ sites, so you don't want such patterns to be too general: for
+ example /ad
would block
+ /admin/salaries/
on your company's internal site.
To speed the blocking of images, some
+ UNIX ® users create a shell script called
+ Image:
containing a line such as echo $1 | sed
+ s/http:..// >> $HOME/lib/blockfile
that adds its
+ argument to the user's blockfile. Once an offending image has
+ been be found using View Document Info it's
+ easy to cut-and-paste the line (or part of it) into a shell
+ window. The same script can be linked to a file called
+ Frame:
to dealing with framed documents, and
+ junkbuster:
to accept the output of the debug option.
When compiled without the
+ regular expressions option, the Internet Junkbuster
+ uses only very simple (and fast) matching methods. The pattern
+ /banners
will not stop
+ /images/banners/huge.gif
getting through: you would have
+ to include the pattern /images/banners
or
+ something that matches in full from the left.
+ So you can get what you want here, the matcher understands
+ POSIX regular expressions: you can use
+ /*.*/banners
to block and any URL containing
+ /banners
(even in the middle of the path). (In Versions 1.1 through 1.4 they were an option at
+ compile time; from Version 2.0 they have become the default.)
+ Regular expressions give you many more features than this, but
+ if you're not already familiar with them you probably won't
+ need to know anything beyond the /*.*/
idiom. If
+ you do, a man egrep
is probably a good starting
+ point).
Don't forget the /
(slash)
+ at the beginning of the path. If you leave it out the line will
+ be interpreted as a domain name, so ad
would block
+ all sites from Andorra (since .ad
is the
+ two-letter country code for that principality).
For a detailed technical description of + how pattern matching is done, see the manual.
+ +If the ad had been displayed before you included its URL in
+ the blockfile, it will probably be held in cache for some time,
+ so it will be displayed without the need for any request to the
+ server. Using the debug
+ 1
option to show each URL as it is fetched is a good way
+ to see exactly what is happening.
If new items seem to be getting + through, check that you are really running the proxy with the + right blockfile in the options. Check the blockfile for + exceptions.
+ +Some sites may have different ways of + inserting ads, such as via Java. If you have ideas on how to + block new kinds of junk not currently covered, please tell + us.
+ +You can change the patterns so they don't cover it, or use a
+ simple feature in Version 1.1 and later: a line beginning with
+ a ~
character means that a URL blocked by previous
+ patterns that matches the rest of the line is let through. For
+ example, the pattern /ad
would block
+ /addasite.html
but not if followed by
+ ~/addasite
in the blockfile. Or suppose you want to see
+ everything that comes from a site you like, even if it looks
+ like an ad: simply put ~aSiteYouLike.com
at the
+ end of the blockfile. (Order is important, because the
+ last matching line wins.)
As well as unblocking pages that were + unintentionally blocked, this feature is useful for unblocking + ads from a specific source. This might be because you are + interested in those particular ones, or if you have an explicit + agreement to accept certain ads, such as those from a free + web-based email provider.
+ +If you want to find out exactly which + pattern in the blockfile a given URL matched, just click on the + words ``Internet Junkbuster'' which are displayed alone on a + page when your browser requests a blocked URL. The proxy + displays a message that pinpoints the pattern for you.
+ +Yes, but remember that children who are + technically sophisticated enough to use the browsers' proxy + configuration options could of course bypass any proxy. This + kind of technology can be used as a gentle barrier to remind or + guide the child, but nobody should expect it to replace the + parent's role in setting and enforcing standards of online + behavior for their children.
+ +Some ISPs are starting to provide + specialized proxies to protect children. There are two basic + approaches: the ``black list'' and the ``white list'' approach. + The black list approach allows the child + to go anywhere not explicitly prohibited; the white list + permits visits only to sites explicitly designated as + acceptable.
+ +It's very easy for anyone to compile
+ a white list from a page of ``recommended kids sites'' and to
+ configure an Internet Junkbuster to allow access to those sites
+ only. (If you publish such a list on the web, please tell us
+ its URL). Assuming your version isn't an old one without regex,
+ you can place a *
(asterisk) as the first line of
+ the blockfile (which blocks everything), and then list
+ exceptions after that. Be careful to make the exception
+ sufficiently broad: for example, using
+ ~www.uexpress.com/ups/comics/ch/
as the exception for
+ Calvin and Hobbes would block some of the graphic
+ elements on the page; you would probably want a wider exception
+ such as ~www.uexpress.com/ups/
to permit them.
Version 2.0 has an experimental feature + to permit only sites mentioned in a nominated trusted site. This allows + organizations to build lists of sites for kids to browse, and + the software automatically restricts access to those on the + list.
+ +Many filtering products actually scan for + keywords in the text of pages they retrieve before presenting + it, but the Internet Junkbuster does not do this. Building a + perfectly reliable black list system is hard, because it's very + difficult to state in advance exactly what is obscene or + unsuitable. For more info see our links page.
+ +You usually see a broken image icon, but it depends on + several factors beyond the proxy's control. If asked for a URL + matching its blockfile, the proxy returns an HTML page + containing a message identifying itself (currently the two + words ``Internet Junkbuster'') with a status 202 (Accepted) + instead of the usual 200 (OK). (Versions 1.X returned an error + 404: Forbidden, which caused strange behavior in some cases.) + Status 202 is described in the HTTP RFC as indicating that the + request has been accepted but not completed, and that it might + complete successfully in the future (in our case, if the + blockfile were changed).
+ +The broken image icon is most common
+ because the browser is usually expecting a graphic. But if it
+ was expecting text, or if the page happens to be using certain
+ HTML extensions such as layer
and your browser is
+ a late model from Microsoft, you may see the words ``Internet
+ Junkbuster'' displayed as a hot link.
Clicking on the link takes you to an
+ explanation of the pattern in the blockfile that caused the
+ block, so that you can edit the blockfile and go back and
+ reload if you really want to see what was blocked. The
+ explanatory link is generated by the proxy and is automatically
+ intercepted based on its ending in ij-blocked-url
;
+ even though the site is specified as
+ http://internet.junkbuster.com
no request should
+ actually made to that site. If one is, it means that the proxy
+ was been removed after it generated the link.
To summarize: the identifying link to + the blocking explanation is usually turned into a broken image + icon, but it may be displayed on a page alone, or they may may + be restricted to the particular frame, layer or graphic area + specified in the page containing them. The proxy has no way of + knowing the context in which a URL will be used and cannot + control how the blocking message will be rendered.
+ +Many users have suggested to us that + blocked banners should be replaced by a something like a 1x1 + transparent GIF to make the page would look as if there was + nothing ever there. Apart from making it harder to catch + unintended blocking, this might also displease the owners of + the page, who could argue that such a change constitutes a + copyright infringement. We think that merely failing to allow + an included graphic to be accessed would probably not be + considered an infringement: after all this is what happens when + a browser is configured not to load images automatically. + However, we are not lawyers, so anyone in doubt should take + appropriate advice.
+ +In a context where the copyright issue is
+ resolved satisfactorily, a proxy could simply return a status
+ 301 or 302 and specify a replacement URL in a
+ Location
and/or URI
header. An alternative
+ would be to use inline code to return a 1 x 1 clear GIF. We do
+ not publish sample code for this, and we have no way of
+ stopping others who have.
Many users have pointed out that most banner ads come in
+ standard sizes, so why not block all GIFs of those sizes? This
+ would theoretically be without fetching the object because the
+ dimensions are usually given in the IMG
tag, but
+ it would require substantial changes in the code, and we doubt
+ whether it would be much more effective than a good block
+ list.
The Internet Junkbuster deliberately does not provide a way + of automatically editing the contents of a page, to remove + textual advertising or to repair the holes left by blocked + banners. Other packages such as WebFilter do.
+ +For the same reason, it has no way of
+ stopping a new browser window being created, because this is
+ done through the target
attribute in the
+ <a>
and <base>
elements, not
+ through headers. Nor do we plan to add a feature to paralyze
+ animated GIFs.
We haven't tried it but we expect it would probably work on + image ads on push channels. See also adchoice.
+ +Disabling Javascript stops some pop-up + ads. One problem is that some advertisers throw open a new + browser window to frame the ad. The ad is easily blocked, but + the empty window remains. You can kill it easily, but this is a + chore. We don't see how to stop them other than editing the + HTML from the parent window, which we don't like to do.
+ +The TBTF newsletter warned subscribers to + push information that in IE4, LOGTARGET + allows servers to determine the URLs viewed at their site even + if accessed from cache or through a proxy. If you use this + browser see our instructions on how to disable this.
+ +If you find you have experience using + the proxy with push, or have any other advice about it, please + tell us.
+ + + +For background information on cookies see our page + describing their dangers.
+ +Yes, you should expect the occasional cookie to make it + through to your browser. We know of at least three ways this + can happen; please tell us if you find any others. One way is + in secure documents, which are explained below.
+ +A few sites set cookies using a line
+ such as <META HTTP-EQUIV="Set-Cookie"
+ CONTENT="flavor=chocolate">
in the HEAD
+ section of an HTML document. Cookies
+ can also be
+
+ set and read in JavaScript. To see if this is happening in a
+ document, view its source, look in the head
for a
+ section tagged script language="JavaScript"
. If it
+ contains a reference to document.cookie
, the page
+ can manipulate your cookie file without sending any cookie
+ headers. The Internet Junkbuster does not tamper with these
+ methods. Fortunately they are rarely used at the moment. If a
+ cookie gets set, it should be stopped by the proxy on its way
+ back to the server when a page is requested, but it can still
+ be read in Javascript.
To prevent cookies breaking through, + always keep cookie alerts turned on in your + browser, and disable Java and Javascript. Making the files hard + to write may also help.
+ +When a web site's server sends you a page it also sends
+ certain ``header information'' which your browser records but
+ does not display. One of these is a Set-Cookie
+ header, which specifies the cookie information that the server
+ wants your browser to record. Similarly, when your browser
+ requests a page it also sends headers, specifying information
+ such as the graphics formats it understands. If a cookie has
+ previously been set by a site that matches the URL it is about
+ to request, your browser adds a Cookie
header
+ quoting the previous information.
For more background information on how
+ cookies can damage your privacy, see our page on cookies. For
+ highly detailed technical information see the RFC. The Internet
+ Junkbuster will show you all headers you use the debug 8
option, or you can
+ get a sample from our demonstration page.
Possibly. Some personalized services including certain + chat rooms require cookies. + Newspapers that require + + registration or + + subscription will not automatically recognize you if you don't + send them the cookie they assigned you. And there are a very + small number of sites that do strange things with cookies; they + don't work for anyone that blocks cookies by any means. Some + sites such as Microsoft explain that their content is so + wonderfully compelling that they will withhold it from you + unless you submit to their inserting cookies.
+ +Many free Web-based email services
+ require cookies. Hotmail also seems to require allowing both
+ msn.com
and passport.com
to set
+ cookies.
If you want such sites to be given your + cookies, you can use the + cookiefile option provided you are running Version 1.2 or + later yourself. Simply include the domain name of those sites + in the cookiefile specified by this option. If it still + doesn't work, the problem may be in other headers.
+ +It's possible to let cookies out but not
+ in, which is enough to keep some sites happy, but not all of
+ them: one newspaper site seems to go into an endless frenzy if
+ deprived of fresh cookies. A cookiefile containing a single
+ line consisting of the two characters >*
+ (greater-than and star) permits server-bound cookies only. The
+ *
is a wildcard
+ that matches all domains.
If someone else is running the Internet + Junkbuster for you and has a version that + passes server-bound + cookies through, you can try editing your browser's cookie file + to contain just the ones you want, and restart your browser. To subscribe to a new service like this after + you have started using the Internet Junkbuster, you can try the + following: tell your browser to stop using the Internet + Junkbuster, fill out and submit your subscription details + (allowing that web site to set a cookie), then reconfigure your + browser to use the Internet Junkbuster again (and stop more + cookies being sent). This also requires the cookiefile option, and its success + depends on the Web site not wanting to change your cookies at + every session. For this reason it does not work at some major + newspaper sites, for example. But you may + prefer to look at whether other sites provide the same or + better services without demanding the opportunity to track your + behavior. The web is a buyer's market where most prices are + zero: very few people pay for content with money, so why should + you pay with your privacy?
+ +Yes, since version 1.2 the Internet + Junkbuster has included advanced cookie management facilities. + Unless you specify otherwise, cookies are discarded + (``crumbled'') by the Internet Junkbuster whether they came + from the server or the browser. In Version 1.2 and later you + can use the cookiefile + option to specify when cookies are to be passed through intact. + It uses the same syntax and + matching algorithm as the blockfile.
+ +If the URL matches a pattern in the
+ cookiefile then cookies are let through in both
+ the browser's request for the URL and in the server's response.
+ One-way permissions can be specified
+ by starting the line with the >
or
+ <
character. For example, a cookiefile consisting of
+ the four lines
+ org
+ >send-user-cookies.org
+
+ <accept-server-cookies.org
+ ~block-all-cookies.org
+ allows cookies to and from .org
domains only,
+ with the following exceptions:
+
send-user-cookies.org
are blocked on their way
+ to the client, but cookies sent by the browser to that domain
+ are still be fed to them.
+ accept-server-cookies.org
check in to the proxy and
+ are passed through to the browser, but when they come back to
+ the proxy they never check out.
+ block-all-cookies.org
are blocked.If the junkbuster
+ was compiled with the regular expressions option they may be
+ used in paths. Any logging to a ``cookie jar'' is separate and
+ not affected.
It's important to give hosts you want
+ to be able to set cookies sufficient breadth. For example,
+ instead of www.yahoo.com
use
+ yahoo.com
because the company uses many different hosts
+ ending in that domain.
Yes, using the wafer option. + We coined the term wafer to describe cookies + chosen by a user, not the Web server. Servers may not find + wafers as tasty as the cookies they make themselves. But users + may enjoy controlling servers' diets for various reasons, such + as the following.
+ +++ Any company that tries to argue in court that the proxy + site was breaching their copyright in the cookies would be + met with the defense that the proxy site gave that company + the opportunity to protect its copyright by simply not + sending cookies after receiving the notice. + +TO WHOM IT + MAY CONCERN
+
+
+ Do not send me any copyrighted information other than + the document that I am requesting or any of its necessary + components.
+
+ In particular do not send me any cookies that are + subject to a claim of copyright by anybody. Take notice + that I refuse to be bound by any license condition + (copyright or otherwise) applying to any cookie.
Cookies can be as long as four
+ thousand characters, so there's plenty of space for
+ lawyerly verbosity, but white space, commas, and
+ semi-colons are prohibited.
+ Spaces can be turned into underscores. Alternatively, a URL
+ could be sent as the cookie value, pointing to a document
+ containing a notice, perhaps with a suggestive value such
+ as
+
+ http://www.junkbusters.com/ht/en/ijbfaq.html#licenses_on_cookies_refused
+
+ But including the notice directly would probably be
+ preferable because the addressee does not have to look it
+ up.
The Internet Junkbuster 2.0.2 + currently sends a full notice as a ``vanilla wafer'' if + cookies are being logged to a cookie jar and no other + wafers have been specified. It can be suppressed with the + + suppress-vanilla-wafer option, which might be used in + situations where there is an established understanding + between the proxy and all who serve it.
+Junkbusters provides a CGI script that + lets you see your wafers as they appear to servers.
+ +Wafers confuse a few fragile + servers. Hotmail appears to be one of them. If this troubles + you, don't use this option.
+ +Any wafers specified are sent to
+ all sites regardless of the cookiefile.
+ They are appended after any genuine cookies, to maintain
+ compliance with RFC 2109 in the event that a path was specified
+ for a cookie. The RFC's provisions regarding the $
+ character (such as the Version
attribute) are
+ transparent to the proxy; it simply quotes what was recited by
+ the browser.
If you want to send wafers only to + specific sites, you could try putting them your browser's + cookie file in a format conforming to the Netscape + specification, and then specify in the proxy's cookiefile that + cookies are to be sent to but not accepted from those sites, so + they can't overwrite the file. This may work with Netscape but + not all other browsers.
+ +We provided this capability just in case anyone wants it. + There are a few possible reasons.
+ +For details on how your identity can be revealed while you
+ surf, see our page on privacy. Once you start using the
+ Internet Junkbuster you should find that much of the
+ information previously indicated on that page will no longer be
+ provided. If the REMOTE HOST
indicating your IP
+ address is too close for comfort, see our suggestions below on
+ how to conceal your IP address. We also recommend that you
+ disable JavaScript and Java.
No. Your chances of remaining anonymous are improved, but + unless you are an expert on Internet security it would be + safest to assume that everything you do on the Web can be + attributed to you personally.
+ +The Internet Junkbuster removes various + information about you, but it's still possible that web sites + can find out who you are. Here's one way this can happen.
+ +A few browsers disclose the user's email + address in certain situations, such as when transferring a file + by FTP. The Internet Junkbuster 2.0.2 does not filter the FTP + stream. If you need this feature, or are concerned about the + mail handler of your browser disclosing your email address, you + might consider products such as NSClean.
+ +Browsers downloaded as binaries could + use non-standard headers to give out any information they can + have access to: see the manufacturer's license agreement. It's + impossible to anticipate and prevent every breach of privacy + that might occur. The professionally paranoid prefer browsers + available as source code, because anticipating their behavior + is easier.
+ +You shouldn't have to trust us, and you certainly don't have + to. We do not run the proxy as a service, where we could + observe your online behavior. We provide source code so that + everyone can see that the proxy isn't doing anything + sneaky.
+ +You are already trusting your ISP not to + look at an awful lot of information on what you do. They + probably post a privacy policy on their site to reassure you. + If they run a proxy for you, using it could actually make it + slightly easier for them to monitor you, but we doubt that any + sane ISP would try this, because if it were discovered + customers would desert them.
+ +We don't want institutions to use this software as an + instrument of surveillance. We have deliberately not provided + options to add timestamps or records of which IP addresses + accessed which URLs. However, because we publish source code + anyone can modify it to do such things, and there is no way a + remote user can find out if this is happening. Again, you need + to be able to trust the entity providing your proxy service, + but you were probably in that position even before using a + proxy.
+ +The Internet Junkbuster pounces on the following HTTP + headers in requests to servers, unless instructed otherwise in + the options.
+ +FROM
header, which a
+ few browsers use to tell your email address to servers, is
+ dropped unless the from option
+ is set.USER_AGENT
header is changed to indicate that the browser is
+ currently Mozilla (Netscape) 3.01 Gold with an unremarkable
+ Macintosh configuration. Misidentification helps resist
+ certain attacks. If your browser and hardware happen to be
+ accurately identified, you might want to change the default.
+ (Earlier versions of the Internet Junkbuster indicated
+ different details; by altering them periodically we aim to
+ hinder anyone trying to infer whether our proxy is present.)
+ If you don't like the idea of incorrectly
+ identifying your computer as a Mac, set it accordingly.
+ REFERER
header
+ (which indicates where the URL currently being requested was
+ found) is dropped. A single static referer to replace all
+ real referers may be specified using the referer option. Where no referer is
+ provided by the browser, none is added; the add-header option with arguments
+ such as -x 'Referer: http://me.me.me'
can be
+ used to send a bogus referer with every request.In Version 1.4 and later you can use the -r @ option to selectively disclose
+ REFERER
and USER_AGENT
to only those
+ sites you nominate.
Some browsers send Referer and User-Agent
+ information under different non-standard headers. The Internet
+ Junkbuster 2.0.2 stops UA
headers, but others may
+ get through. This information is also available via JavaScript,
+ so disable it. Some search engines
+ encode the query you typed in the URL that goes to advertisers
+ to target a banner ad at you, so you will need to block the ad
+ as well as the referer header, unless you want them (and anyone
+ they might buy data from) to know everything you ever search
+ for.
If you have JavaScript enabled (the + default on most browsers) servers can use it to obtain Referer + and User Agent, as well as your plug-ins. We recommend + disabling JavaScript and Java.
+ +Currently no HTTP response headers
+ (browser bound) are removed, not even the
+ Forwarded:
or X-Forwarded-For:
headers. Nor
+ are any added, unless requested.
+ We are considering a more flexible header management system for
+ a future version.
Possibly. If used with a browser less advanced than Netscape + 3.0 or IE-3, indicating an advanced browser may encourage pages + containing extensions that confuse your browser. If this + becomes a problem upgrade your browser or use the user-agent option to indicate an + older browser. In Version 1.4 and later you can selectively + reveal your real browser to only those sites you nominate.
+ +Because different browsers use + different encodings of Russian and Czech characters, certain + web servers convert pages on-the-fly according to the User + Agent header. Giving a User Agent with the wrong operating + system or browser manufacturer causes some sites in these + languages to be garbled; Surfers to Eastern European sites + should change it to something + closer.
+ +Some page access counters work by + looking at the referer; they may fail or break when + deprived.
+ +Some sites depend on getting a referer
+ header, such as uclick.com
, which serves comic
+ strips for many newspaper sites, including
+ Doonsbury for the Washington Post. (If you
+ click on that last link, you can then get to a page containing
+ the strip via the same URL we've linked to under
+ Doonsbury, but if you click on the
+ Doonsbury link directly, it gives you an error message
+ suggesting that you use a browser that supports referers.) In
+ Version 1.4 and later you can use the -r @ option and place a line like
+ >uclick.com
in your cookiefile. Wired News used to
+ use referer to decide whether to add a navigation column to the
+ page, but they have changed that.
The weather maps of Intellicast
+ have been blocked by their server when no referer or cookie is
+ provided. You can use the same countermeasure with a line such
+ as >208.194.150.32
(or simply get your weather
+ information elsewhere).
Some software vendors, including
+ Download.com and Intuit use USER_AGENT
to decide
+ which versions of their products to display to you. With the
+ default you get Mac versions.
As a last resort if a site you need + doesn't seem to be working, the proxy configuration of many + browsers allow you to specify No Proxy For + any hostname you want.
+ +We had reports that on some versions of + Netscape the What's New feature did not work with the proxy, + but we think we fixed this in Version 2.0.1.
+ +Almost every major release of both leading browsers has + contained bugs that allow malicious servers to compromise your + privacy and security. Known bugs are quickly fixed, but + millions of copies of the affected software remain out there, + and yours is probably one of them. The header that normally + identifies your browser tells such servers exactly which + attacks to use against you. By misidentifying your browser you + reduce the likelihood that they will be able to mount a + successful attack.
+ +Web sites get the IP address of any proxy or browser they + serve pages to. If you run the proxy on your own computer the + IP address disclosed is the same as your browser would, unless + you use the forwardfile + option is used to chain to another proxy, in which case servers + only get the last IP address in the chain. Chaining slightly + slows browsing of course, but it improves anonymity.
+ +We think so, provided you are not the user running the
+ proxy. If your computer (or your ISP's) is running the
+ identd
demon, servers can ask it for the identity of the
+ user making the request at time you request a page from them.
+ But if you're going through a proxy, they will identify the
+ user name associated with the proxy, not you. A visit to
+ http://ident.junkbusters.com lets you see what's happening.
+ This test is (quite rightly) blocked by many firewalls; just
+ interrupt the transfer if you get an abnormal wait after
+ clicking. Running other applications may also expose you via
+ identd
; the proxy of course doesn't help then.
With the default options the proxy doesn't announce itself. + Obvious indications such as Keep-Alive headers are deleted, but sites might notice that you + can cancel cookies faster than any human could possibly click + on a mouse. (If you want to provide a plausible explanation for + this, change the User Agent header to a cookie-free or + cookie-crunching browser).
+ +But when certain options are used they + could figure out something's going on, even if they're not + pushing cookies. If you use blocking they can tell from their + logs that the graphics in their pages are not being requested + selectively. The + add-forwarded-header option explicitly announces to the + server that a proxy is present, and sending them wafers is of + course a dead giveaway.
+ + + +If you enter a ``Secure Document Area,'' cookies and other
+ header information such as User Agent and Referer are sent
+ encrypted, so they cannot be filtered. We recommend getting
+ your browser to alert you when this happens. (On Netscape: Options; Security; General; Show an alert before entering a
+ secure document space.) We also recommend adding the line
+ :443
to the blockfile to stop all but sites
+ specified in an exception after that line from using SSL.
It may be possible to filter encrypted + cookies by combining the blocking proxy with a cryptographic + proxy along the lines of SafePassage, but we have not tried + this.
+ +We're not security experts, but we don't think so. The whole + point of SSL is that the contents of messages are + + encrypted by the time they leave the browser and the server. + Eavesdroppers (including proxies) can see where your messages + are going whether you are running a proxy or not, but they only + get to see the contents after they have been encrypted.
+ +Yes, we added an access + control file in Version 2.0. But before you use it please + consider why you want to do it. If the reason is security, it + probably means you need a firewall.
+ +The listen-address option provides + a way of binding the proxy to a single IP address/port. The + right way to do this is to choose a port inside your firewall, + and deny access to it to those outside the firewall. The + Internet Junkbuster is not a firewall proxy; it should not be + expected to solve security problems.
+ +For background information on + firewalls, see Yahoo or a magazine article or these well-known + books: Firewalls and Internet Security: Repelling the + Wily Hacker by William R. Cheswick and Steven M. + Bellovin or Building Internet Firewalls by D. + Brent Chapman and Elizabeth D. Zwicky. There's + + free Linux software available, and a large number of commercial + products and services. For an excellent security overview, + primer, and compendium reference, see Practical Unix and + Internet Security by Simson Garfinkel and Gene + Spafford.
+ +Yes. As with any service offered over the Internet, hackers + can try to misuse it. A well-run ISP will have professionals + who are experienced at assessing and containing these + risks.
+ +It's possible to set up your machine + so that other people can have access to your proxy, but if you + lack expertise in computer security you probably shouldn't have + your computer configured to offer this or any other service to + the outside world.
+ +Hackers can attempt to gain access to
+ the machine by various attacks, which we have tried to guard
+ against but don't guarantee to thwart. They can also use the
+ ``anonymizing'' quality of proxies to try to cover their tracks
+ while hacking other computers. For this reason we recommend
+ preventing it being used as an anonymous telnet
by
+ putting the pattern :23
in the blockfile (it's
+ included as standard equipment). (Actually the current
+ implementation incidentally blocks telnet due to the way
+ headers are handled, but it's best not to rely on this.) If you
+ wish to block all ports except the default HTTP port 80, you
+ can put the lines
+ :
+ ~:80
+ at the beginning of the blockfile, but be aware that some
+ servers run on non-default ports (e.g. 8080). You might also
+ want to add the line ~:443
to allow SSL.
On UNIX ® systems it is neither + necessary nor desirable for the proxy to run as root.
+ +Versions 2.0.1 and below may be + vulnerable to remote exploitation of a memory buffer bug; for + security reasons all users are encouraged to upgrade.
+ +If you find any security holes in the + code please tell us, along with any suggestions you may have + for fixing it. However, we do not claim that we will be able to + do so.
+ +We distribute this code in the hope + that people will find it useful, but we provide no warranty for + it, and we are not responsible for anyone's use or misuse of + it.
+ +You may also want to check back + periodically for updated versions of the code. We do not + currently maintain a mailing list. To get quick updates, + bookmark our Distribution Information page.
+ + + ++ Website · + Manual · FAQ · GPL
+ ++ Copyright © 1996-8 Junkbusters ® + Corporation. Copyright © 2001 + Jon + Foster. Copying and distribution permitted under the GNU General Public + License.
+ +
+ http://sourceforge.net/projects/ijbswa/
+ Website · Manual · FAQ · GPL
+ ++ Options · + Checking Options · Installation · Copyright · (FAQ)
+ +Development of JunkBuster is ongoing and this document is + no longer current. However, it may provide some assistance. If + you have problems, please use the Yahoo Groups + mailing list (which includes an archive of mail), the + SourceForge.net project page, or + see the project's home + page. Please also bear in mind that versions 2.9.x of + JunkBuster are development releases, and are not production + quality.
+ +A copy of this page in standard man
macro
+ format is included in the tar
+ archive.
junkbuster
- The Internet Junkbuster
+ Proxy
+ TM
junkbuster
configfile (Unix)
+ junkbstr.exe
[configfile]
+ (Windows)
junkbuster
is an instrumentable proxy
+ that filters the HTTP stream between web servers and browsers.
+ Its main purposes are to block adverts and enhance privacy.
It is configured using a configuration
+ file and several files listing URL patterns. The
+ configuration file must be specified on the command line.
+ The Windows version will default to using the configuration
+ file junkbstr.ini
if it exists and no argument was
+ given.
All files except the main configuration + file are checked for changes before each page is fetched, so + they may edited without restarting the proxy.
+ +blockfile
+ blockfileBlock requests to
+ URLs matching any pattern given in the lines of the
+ blockfile. The junkbuster
instead
+ returns status 202, indicating that the request has been
+ accepted (though not completed), and a message identifying itself (though
+ the browser may display only a broken image icon).
+ The syntax of a pattern is
+ [domain][:port][/path]
(the http://
or
+ https://
protocol part is omitted). To decide
+ if a pattern matches a target, the domains are compared
+ first, then the paths.
To compare the domains, the
+ pattern domain and the target domain specified in the URL
+ are each broken into their components. (Components are
+ separated by the .
(period) character.) Next
+ each of the target components is compared with the
+ corresponding pattern component: last with last,
+ next-to-last with next-to-last, and so on. (This is called
+ right-anchored matching.) If all of the
+ pattern components find their match in the target, then the
+ domains are considered a match. Case is irrelevant when
+ comparing domain components.
A successfully matching pattern
+ can be an anchored substring of a target, but not vice
+ versa. Thus if a pattern doesn't specify a domain, it
+ matches all domains. Furthermore,
+ when comparing two components, the components must either
+ match in their entirety or up to a wildcard *
+ (star character) in the pattern. The wildcard feature
+ implements only a "prefix" match capability ("abc*" vs.
+ "abcdefg"), not suffix matching ("*efg" vs. "abcdefg") or
+ infix matching ("abc*efg" vs. "abcdefg"). The feature is
+ restricted to the domain component; it is unrelated to the
+ optional regular expression feature in the path (described below).
If a numeric port is specified in + the pattern domain, then the target port must match as + well. The default port in a target is port 80.
+ +If the domain and port match, then
+ the target URL path is checked for a match against the path
+ in the pattern. Paths are compared with a simple
+ case-sensitive left-anchored substring comparison. Once
+ again, the pattern can be an anchored substring of the
+ target, but not vice versa. A path of /
+ (slash) would match all paths. Wildcards are not considered
+ in path comparisons.
For example, the target URL
+
+ the.yellow-brick-road.com/TinMan/has_no_brain
+ would be matched (and blocked) by the following
+ patterns
+ yellow-brick-road.com
+ and
+ Yellow*.COM
+ and
+ /TinM
+ but not
+
+ follow.the.yellow-brick-road.com
+ or
+ /tinman
+
Comments in a blockfile start
+ with a #
(hash) character and end at a new
+ line. Blank lines are also ignored.
Lines beginning with a
+ ~
(tilde) character are taken to be exceptions: a URL blocked by
+ previous patterns that matches the rest of the line is let
+ through. (The last match wins.)
Patterns may contain POSIX regular expressions provided the
+ junkbuster
was compiled with this
+ option (the default in Version 2.0 on). The idiom
+ /*.*/ad
can then be used to match any URL containing
+ /ad
(such as
+ http://nomatterwhere.com/images/advert/g3487.gif
for
+ example). These expressions don't
+ work in the domain part.
In version 1.3 and later the + blockfile and cookiefile are checked for changes before + each request.
+wafer
+ NAME=VALUESpecifies a pair to be sent as a cookie with every + request to the server. + (Such boring cookies are called wafers.) This option + may be called more than once to generate multiple wafers. + The original Netscape specification prohibited semi-colons, + commas and white space; these characters will be + URL-encoded if used in wafers. + + + The Path and Domain attributes are not currently + supported.
+cookiefile
+ cookiefileEnforce the cookie management policy specified in the + cookiefile. If this option is not + used all cookies are silently crunched, so that users who + never want cookies aren't bothered by browsers asking + whether each cookie should be accepted. However, cookies + can still get + through via + JavaScript and SSL, so alerts should be left on.
+ +In Version 1.2 and later this
+ option must be followed by a
+ filename containing instructions on which sites are
+ allowed to receive and set cookies. By
+ default cookies are dropped in both the browser's request
+ and the server's response, unless the URL requested matches
+ an entry in the cookiefile. The matching algorithm
+ is the same as for the blockfile. A leading
+ >
character allows server-bound cookies only; a
+ <
allows only browser-bound cookies; a
+ ~
character stops cookies in both directions. Thus a
+ cookiefile containing a single line with the two characters
+ >*
will pass on all cookies to servers but
+ not give any new ones to the browser.
jarfile
+ jarfileAll Set-cookie attempts by the server are logged to jarfile. If no wafer + is specified, one containing a canned notice (the vanilla + wafer) is added as an alert to the server unless the suppress-vanilla-wafer + option is invoked.
+suppress-vanilla-wafer
Suppress the vanilla wafer.
+from
fromIf the browser discloses an
+ email address in the FROM
header (most
+ don't), replace it with from. If from is set
+ to . (the period character) the FROM
is
+ passed to the server unchanged. The default is to delete
+ the FROM
header.
referer
+ refererWhenever the browser discloses the URL that led to the current request, + replace it with referer. If referer is set to + . (period) the URL is passed to the server + unchanged. If referer is set to @ (at) the URL is + sent in cases where the cookiefile specifies that a cookie + would be sent. (No way to send bogus referers selectively + is provided.) The default is to delete Referer.
+ +Junkbuster also accepts the
+ spelling referrer
, which most dictionaries
+ consider correct.
user-agent
+ user-agentInformation disclosed by the browser about itself is replaced with the
+ value user-agent. If user-agent is set to
+ . (period) the User-Agent
header is passed
+ to the server unchanged, along with any UA
+ headers produced by MS-IE (which would otherwise be
+ deleted). If user-agent is set to @ (at)
+ these headers are sent unchanged in cases where the
+ cookiefile specifies that a cookie would be sent, otherwise
+ only default User-Agent
header is sent. That
+ default is Mozilla/3.0 (Netscape) with an unremarkable Macintosh configuration. If
+ used with a browser less advanced than Mozilla/3.0 or IE-3,
+ the default may encourage pages containing extensions that
+ confuse the browser.
listen-address
+ [host][:port]If host is specified, bind the
+ junkbuster
to that IP address. If a port
+ is specified, use it. The default port is 8000; the default
+ host is localhost
.
This default host setting means that you can only + connect to the proxy from ther local computer. This is a + security measure - if you allow anyone to use the proxy, + then hackers or fraudsters could use it to help hide their + identity. It also provides a lot of protection against any + undiscovered security flaws in JunkBuster - if they can't + connect to it, then they can't attack it.
+ +If you change this value, we recommend you either
+ set the host to localhost
:
+ listen-address
+ localhost:8080
+ or, if you want to share a single internet
+ connection over your internal network, then set it to the
+ address of your internal ethernet card:
+ listen-address
+ 10.1.1.1:8080
+ (replace 10.1.1.1 with your internal IP address),
+ or set up an aclfile. To
+ make the proxy accessible from everywhere (e.g. if you're
+ using an access control list or if you just don't care
+ about security), specify just the port number - e.g:
+ listen-address :8000
+ (This binds the proxy to all IP addresses
+ (INADDR_ANY
)).
forwardfile
+ forwardfileJunkbuster has a flexible syntax for forwarding HTTP + requests. This is used e.g. if you are behind a firewall + and need to connect through it, or if you want to use a + cacheing proxy to speed up your web browsing.
+ +Every line in the forwardfile consists of four
+ components, seperated by whitespace. These are:
+
+ target forward_to via_gateway_type
+ gateway
target is a pattern used to select which line of
+ the forwardfile is used. "*
" is the most
+ commonly used value, and matches every URL. As usual, the
+ last matching target wins. (If no pattern matches, a
+ direct connection will be used)
forward_to specifies the HTTP proxy server to
+ use, or ".
" for none. This is used to connect
+ to a cacheing proxy such as Squid, and for most types of
+ firewall. The port number defaults to 8000 if it is not
+ specified.
Here is a typical line.
++* lpwa.com:8000 . . ++ +
The target domain need not be a fully qualified
+ hostname; it can be a general domain such as
+ com
or co.uk
or even just a port
+ number. For example, because LPWA does not handle SSL, the line above will
+ typically be followed by a line such as
+:443 . . . ++ +
to allow SSL transactions to proceed directly. The + cautious would also add an entry in their blockfile to stop + transactions to port 443 for all but specified trusted + sites.
+ +Configure with care: no loop + detection is performed. When setting up chains of proxies + that might loop back, try adding + Squid.
+ +via_gateway_type and gateway are used to
+ support SOCKS proxies. Some firewalls provide this type of
+ proxy. If you do not not want to use a SOCKS proxy, specify
+ both of these fields as ".
".
Note that
+ JunkBuster is a SOCKS client, not a SOCKS
+ server. The user's browser should not be configured to use
+ SOCKS
; the proxy conducts the negotiations, not the
+ browser.
The SOCKS4
protocol may be specified by
+ setting via_gateway_type to socks
or
+ socks4
. The SOCKS4A
protocol is
+ specified as socks4a
. The SOCKS5
+ protocol is not currently supported.
gateway should be the host and port of the SOCKS + server. If you just specify a hostname, then the port + number defaults to 1080.
+ +The user identification capabilities of
+ SOCKS4
are deliberately not used; the user is always
+ identified to the SOCKS
server as
+ userid=anonymous
. If the server's policy is to
+ reject requests from anonymous
, the proxy will
+ not work. Use a debug value of 3 to see
+ the status returned by the server.
If you specify both a HTTP proxy (with + forward_to) and a SOCKS proxy (with gateway) + then the SOCKS proxy is used to connect to the HTTP proxy. + If you just specify a SOCKS proxy, it is used to connect + directly to the websites.
+debug
NSet debug mode. The most common value is 1, to pinpoint offensive URLs, so they
+ can be added to the blockfile. The value of N is a
+ bitwise logical-OR of the following values:
+ 1 = URLs (show each URL requested by the browser);
+ 2 = Connections (show each connection to or from the
+ proxy);
+ 4 = I/O (log I/O errors);
+ 8 = Headers (as each header is scanned, show the header
+ and what is done to it);
+ 16 = Log everything (including debugging traces and the
+ contents of the pages).
+ 32 = Record accesses in Common Log Format, as used by most
+ web and proxy servers.
Multiple debug
lines are
+ permitted; they are logical OR-ed together.
Because most browsers send several + requests in parallel the debugging output may appear + intermingled, so the + single-threaded option is recommended when using debug with N greater than 1. +
+add-forwarded-header
Add X-Forwarded-For
headers to the
+ server-bound HTTP stream indicating the client IP address
+ to the server, in the new
+ style of Squid 1.1.4. If you want the
+ traditional HTTP_FORWARDED
response header,
+ add it manually with the -x option. This
+ also allows other X-Forwarded-For
headers to
+ be transmitted - usually they are discarded.
add-header
+ HeaderTextAdd the HeaderText verbatim to requests to the
+ server. Typical uses include adding old-style forwarding
+ notices such as Forwarded: by
+ http://pro-privacy-isp.net
and reinstating the
+ Proxy-Connection: Keep-Alive
header (which the
+ junkbuster
deletes so as not to reveal its existence). No
+ checking is done for correctness or plausibility, so it can
+ be used to throw any old trash into the server-bound HTTP
+ stream. Please don't litter.
+
single-threaded
Doesn't fork()
a separate process (or
+ create a separate thread) to handle each connection. Useful
+ when debugging to keep the process single threaded.
logfile
+ logfileWrite all debugging data into logfile. The + default logfile is the standard output.
+aclfile
+ aclfileUnless this option is used, the proxy talks to anyone + who can connect to it, and everyone who can has equal + permissions on where they can go. An access file allows + restrictions to be placed on these two policies, by + distinguishing some source IP addresses + and/or some destination addresses. (If a + forwarder or a gateway is being + used, its address is considered the destination address, + not the ultimate IP address of the URL requested.)
+ +Each line of the access file begins
+ with either the word permit
or
+ deny
followed by source and (optionally) destination
+ addresses to be matched against those of the HTTP request.
+ The last matching line specifies the result: if it was a
+ deny
line or if no line matched, the request
+ will be refused.
A source or destination can be
+ specified as a single numeric IP address, or with a
+ hostname, provided that the host's name can be resolved to
+ a numeric address: this cannot be used to block all
+ .mil
domains for example, because there is no single
+ address associated with that domain name. Either form may
+ be followed by a slash and an integer N
,
+ specifying a subnet mask of N
bits. For
+ example, permit 207.153.200.72/24
matches the
+ entire Class-C subnet from 207.153.200.0 through
+ 207.153.200.255. (A netmask of 255.255.255.0 corresponds to
+ 24 bits of ones in the netmask, as with
+ *_MASKLEN=24
.) A value of 16 would be used for a
+ Class-B subnet. A value of zero for N
in the
+ subnet mask length will cause any address to match; this
+ can be used to express a default rule. For more information
+ see the example file provided with the distribution.
If you like these access controls + you should probably have + firewall; they are not intended to replace one.
+trustfile
+ trustfileThis feature is experimental, has not been fully + documented and is very subject to change. The goal is for + parents to be able to choose a page or site whose links + they regard suitable for their young children and for the proxy + to allow access only to sites mentioned there. To do this + the proxy examines the referer variable + on each page request to check they resulted from a click on + the ``trusted referer'' site: if so the referred site is + added to a list of trusted sites, so that the child can + then move around that site. There are several uncertainties + in this scheme that experience may be able to iron out; + check back in the months ahead.
+trust_info_url
+ trust_info_urlWhen access is denied due to lack of a trusted referer, + this URL is displayed with a message pointing the user to + it for further information.
+hide-console
In the Windows command-line version only, instructs the + program to disconnect from and hide the command console + after starting.
+Browsers must be told where to find the
+ junkbuster
(e.g. localhost
port 8000).
+ To set the HTTP proxy in Netscape 3.0, go through: Options; Network Preferences; Proxies; Manual Proxy
+ Configuration; View. See the FAQ for other browsers. The Security Proxy should also be set to
+ the same values, otherwise shttp:
URLs won't
+ work.
Note the limitations explained in + the FAQ.
+ +To allow users to check that
+ a junkbuster
is running and how it is
+ configured, it intercepts requests for any URL ending in
+ /show-proxy-args
and blocks it, returning instead
+ returns information on its version number and current
+ configuration including the contents of its blockfile. To get
+ an explicit warning that no junkbuster
+ intervened if the proxy was not configured, it's best to point
+ it to a URL that does this, such as
+ http://internet.junkbuster.com/cgi-bin/show-proxy-args on
+ Junkbusters's website.
+ http://www.junkbusters.com/ht/en/ijbfaq.html
+
+ http://www.junkbusters.com/ht/en/cookies.html
+
+ http://internet.junkbuster.com/cgi-bin/show-proxy-args
+ http://www.cis.ohio-state.edu/htbin/rfc/rfc2109.html
+
+ http://squid.nlanr.net/Squid/
+
+
+ http://www-math.uni-paderborn.de/~axel/
Written and copyright by the Anonymous Coders and + Junkbusters Corporation and made available under the GNU General Public License (GPL). This software + comes with NO WARRANTY. Internet + Junkbuster Proxy is a + trademark of Junkbusters Corporation.
+ + + ++ Website · Manual · FAQ · GPL
+ ++ Copyright © 1996-8 Junkbusters ® + Corporation. Copyright © 2001 + Jon + Foster. Copying and distribution permitted under the GNU General Public + License.
+ +
+ http://sourceforge.net/projects/ijbswa/
tagsto format text and other content. SGML tags can be much + more varied, and flexible, but do much of the same kinds of things. The tags, + or
elements, are definable in SGML. There is no set +
standards. Since we are using +
stylesheets. + The stylesheets determine how each tag gets translated to HTML, or other + formats. +
closed. If not, you + will likely generate errors. Example:
sectionsfor the most part. Sections + will be processed into HTML headers (e.g.
useful. +Writing Documentation + Using DocBook - A Crash Course
My favorite site is here, which is + not real helpful in a text doc. Better like this: +
entitiesto facilitate + documentation maintenance. +
boilerplatefiles with generic text, + that is used by multiple docs. This way we can write something once, and use + it repeatedly without having to re-write the same content over and over again. + If editing such a file, keep in mind that it should be +
internal entities. These are like variables in + programming. Well, sort of. For instance, we have the +
boilerplatetext entities are defined like: +
internal entities: +
&p-version;. +
alpha,
beta, or
stable. +
not stablereleases (e.g.
beta). +
no!in case + they have pending changes/fixes in their pipelines. Announce the + freeze so that nobody will interfere with last minute changes. +
. + Don't use vX_Y_Z, ver_X_Y_Z, v_X.Y.Z (won't work) etc. +cvs tag v_X_Y_Z
Privoxypackaging before for other platform + specific issues. Conversely, please add any notes that you know + are important for your platform (or contact one of the doc + maintainers to do this if you can't). +
rhfor Red Hat or
susefor SuSE. +
Step 2. Add Files To This Release. Check the + appropriate box(es). Remember at each step to hit the +
Refresh/Submitbuttons! You should now see your + file(s) listed in Step 3. Fill out the forms with the appropriate + information for your platform, being sure to hit
Update+ for each file. If anyone is monitoring your platform, check the +
. (This is + a separate target due to dependencies on some obscure perl scripts. + See comments inmake man
Privoxy? Why a name change at all?
. Also, its content + modification and junk suppression allow you to browse your +Privacy Enhancing Proxy
of the web. +private edition
blocklist+
cookielist,
imagelistand much more has been + combined into the
actionsfiles, with a completely different + syntax. See the
proxy? How does +
banners!) + and the host (blocking the big banner hosting services like doublecklick.net + already helps a lot).
localhost, + which is the special name used by every computer on the Internet to refer + to itself) and the port will be 8118 (unless you have
localhostor the IP address
127.0.0.1+ in the boxes next to
HTTPand
Secure(HTTPS) and + then the number
8118for
port. + This tells your browser to send all web requests to
This is Privoxy..with + access to
Privoxy is not running, then the browser is not set up to use + your
actionsfile?
actionsconcept confuses me. Please list +some of these
actions.
from the menu. +View & + change the current configuration
actionsfiles. What are +the differences?
mainactions file + which is actively maintained by the
aggressivenesslevels. +
Cautious,
Mediumand
Advenceddefaults?
packagesin + the web based actions file editor at
problemsites are included, but in + general, the more aggressive your default settings are, the more + exceptions you will have to make later. See the
privoxy, with only 644 permissions. +
privoxy, + it can update the config files. +
andenable-edit-actions + 0
in theenable-remote-toggle + 0
localhost) can connect to
#symbol. Make sure + it is uncommented, and assign it the address of the LAN gateway interface, + and port number to use. Assuming your LAN address is 192.168.1.1 and you + wish to run
blank), or a redirect to a custom image of your choice. + Note that this choice only has effect for images which are blocked as images, i.e. + whose URLs match both a
blank. This can be done by editing the +
See whylink offered in the substitute page will show + you which rule blocked the page. After changing the rule and un-blocking + the HTML documents, the browser will try to load the actual banner images + and the usual image blocking will (hopefully!) kick in. +
transparent +proxy?
Filteringcontent via the
web server. +
This is Privoxy.., everything is OK. + If you get a page saying
Privoxy is not workinginstead, then + your browser didn't use
User-Agentin particular is often used in this way to identify + the browser, and adjust content accordingly. Changing this now (at least not + further than removing the OS information) is not recommended, since so many + sites do look for it. You may get undesirable results by changing this. +
User Agentwith the wrong + operating system or browser manufacturer causes some sites in these languages + to be garbled; Surfers to Eastern European sites should change it to + something closer. And then some page access counters work by looking at the +
Refererheader; they may fail or break if unavailable. The + weather maps of Intellicast have been blocked by their server when no +
Refereror cookie is provided, is another example. (But you + can forge both headers without giving information away). There are + many other ways things can go wrong when trying to fool a web server. +
cachingproxy to +speed up web browsing?
server. How +secure is it? Do I need to take any special precautions?
localhostonly. The server aspect of +
connection refused+with every web page?
dangerous+ actions, but is also likely to turn off more actions then needed, and thus lower + your privacy and protection more than necessary, +
borrowedfrom the original +
web-bugs, JavaScript and HTML annoyances, pop-up windows, etc.) +
missesto the developers. +
gatewayneeds to be running one of the above + operating systems. + + +
actions + files. +
filter file(typically +
Anatomy of an + Actionhas hints how to debug actions that +
misbehave. +
problemsites, and to spend more time adjusting the + configuration to solve these unintended consequences. In short, there is + not an easy way to eliminate
actions.
Actionsin this context, are + the directives we use to tell
action. Each + action has a unique name and function. While there are many potential +
broken imageicon). There are some limitations to this + though. For instance, you can't just brute-force an image substituion for + an entire HTML page in most situations. +
invisibleconfiguration option. +
actionsfile, and click +
. It is best to put personal or + local preferences inEdit
actions, and URLs for ad + blocking or other purposes, and make other adjustments to the configuration. +
from the + pop-up menu. +Copy Link Location
: +Edit
Actions:. + If not, click a
+ button, and in the new section that just appeared, click the +Insert new section below
Actions:. + This will bring up a list of all actions. Find +
Enabledcolumn, then
+ just below the list. +Submit
button, and paste the URL the + browser got fromAdd
. + Remove theCopy Link Location
(or +Submit
if in a pop-up window). +OK
patterns, and + the entire actions concept, see the Actions + section. +
Use Proxyand fill in the appropriate info + (Address: 127.0.0.1, Port: 8118). Include HTTPS (SSL), if you want HTTPS + proxy support too. +
configin the current directory (except on Win32 + where it will look for
config.txtinstead). Specify + full path to avoid confusion. If no config file is found, +
Toggle Privoxy On or Offis handy for sites that might + have problems with your current actions and filters. You can in fact use + it as a test to see whether it is
actionsrelating to banner-blocking, images, pop-ups, + content modification, cookie handling etc should be applied by default. It also defines many + exceptions (both positive and negative) from this default set of actions that enable +
character to denote a + comment (the rest of the line will be ignored) and understand line continuation + through placing a backslash ("#
wake uprequests + must obviously be sent to the
defaultsetting, may change, so + please check all your configuration files on important issues. + +]]> + +
/etc/privoxy/. +
, please +/
confdir. + For now, the configuration directory structure is flat, except for +
, please +/
mainactions file maintained by the developers, and +
Microsoftwith
MicroSuckwherever + it appears on a Web page. +
man cron). For Red Hat, a
/var/log/privoxy.* + +1024k 644 nobody.nogroupin
privoxy). +
trustfile. + Possible applications include limiting Internet access for children. +
local-webserver): +
debug + 512
toggled offmode, i.e. behave like a normal, content-neutral + proxy where all ad blocking, filtering, etc are disabled. See +
ACLsor HTTP authentication, + so that everybody who can access
ACLsand
ACLsor HTTP authentication, + so that everybody who can access
ACLsand
*.orgor partial domain names. If a DNS name resolves to multiple + IP addresses, only the first one is used. +
localhost+ is OK. The absence of a
single-threaded+ above. +
.to denote +
no forwarding, and the optional +
., then requests are not + forwarded to another HTTP proxy but are made directly to the web servers. +
.to denote
no HTTP forwarding), and the optional +
., then requests are not + forwarded to another HTTP proxy but are made (HTTP-wise) directly to the web servers, albeit through + a SOCKS proxy. +
internaldomains, but everything outbound goes through + their ISP's proxy by way of example.com's corporate SOCKS 4A gateway to + the Internet. +
activity-animationis set to 1, the +
Privoxyis active. To turn off, set to 0. +
log-messagesis set to 1, +
log-buffer-sizeis set to 1, the size of the log buffer, + i.e. the amount of memory used for the log messages displayed in the + console window, will be limited to
log-max-lines(see below). +
log-highlight-messagesis set to 1, +
show-on-task-barcontrols whether or not +
close-button-minimizesis set to 1, the Windows close + button will minimize
hide-consoleoption is specific to the MS-Win console + version of
aliasesin an actions file, you have to place the (optional) + alias section at the top of that file. + Then comes the default set of rules which will apply universally to all + sites and pages (be
aggressiveyour default settings (in the top section of the + actions file) are, the more exceptions for
trustedsites you + will have to make later. If, for example, you want to kill popup windows per + default, you'll have to make exceptions from that rule for sites that you + regularly use and that require popups for actually useful content, like maybe + your bank, favorite shop, or newspaper. +
Cautious,
Mediumor
Advanced. +
aliassections which will + be discussed later. For now let's concentrate on regular sections: They have a + heading line (often split up to multiple lines for readability) which consist + of a list of actions, separated by whitespace and enclosed in curly braces. + Below that, there is a list of URL patterns, each on a separate line. +
*+ stands for zero or more arbitrary characters,
?stands for + any single character, you can define character classes in square + brackets and all of that can be freely mixed: +
adserver.example.com, +
ads.example.com, etc but not
sfads.example.com+
/, + i.e. it matches as if it would start with a
^(regular expression speak + for the beginning of a line). +
(?-i)switch:
+, and turned off if preceded with a
-. So a +
do that action, e.g. +
please block URLs that match the + following patterns, and
don't + block URLs that match the following patterns, even if+ ++block + previously applied.
enabledor +
disabled. Syntax: +
actionsare + taken. So in this case
prefix + for custom headers. +X-
HTTP headersare, you definitely don't need to worry about this + one. +
BLOCKEDpage + for requests to blocked pages. This page contains links to find out why the request + was blocked, and a click-through to the blocked content (the latter only if compiled with the + force feature enabled). The
BLOCKEDpage adapts to the available + screen space -- it displays full-blown if space allows, or miniaturized and text-only + if loaded into a small frame or window. If you are using
BLOCKED+ page
blocking+ banner images and other content through rewriting the relevant URLs in the + document's HTML source, so they don't get requested in the first place. + Note that this is a totally different technique, and it's easy to confuse the two. +
Set-Cookie:HTTP headers from server replies. +
Cookie:HTTP headers from client requests. +
lastor
first+
firstis given, the first frame of the animation + is used as the replacement. If
lastis given, the last + frame of the animation is used instead, which probably makes more sense for + most banner animations, but also has the risk of not showing the entire + last frame (if it is only a delta to an earlier frame). +
rolling your own+ filters requires a knowledge of regular expressions and HTML. +
blocked+ page, or a replacement image (as determined by the
X-Forwarded-for:HTTP header from client requests, + and prevents adding a new one. +
X-Forwarded-for:headers using random IP addresses from a specified network, + to make successive requests from the same client look like requests from a pool of different + users sharing the same proxy. +
From:HTTP header, or replaces it with the + specified string. +
block, or any user defined value. +
blockwill completely remove the header + (not to be confused with the
From:headers anymore. +
Referer:(sic) HTTP header from the client request, + or replaces it with a forged one. +
blockto delete the header completely.
forgeto pretend to be coming from the homepage of the server we are talking to.
forgeis the preferred option here, since some servers will + not send images back otherwise, in an attempt to prevent their valuable + content from being embedded elsewhere (and hence, without being surrounded + by
referreris the + correct English spelling, however the HTTP specification has a bug - it + requires it to be spelled as
referer.) +
User-Agent:HTTP header + in client requests with the specified value. +
https://URLs) through proxies. It works very simply: + the proxy connects to the server on the specified port, and then + short-circuits its connections to the client and to the remote server. + This can be a big security hole, since CONNECT-enabled proxies can be + abused as TCP relays very easily. +
. +name =value
sessioncookies (for the current browser session
expiresfield from
Set-Cookie:server headers. + Most browsers will not store such cookies permanently and forget them in between sessions. +
expires+ field. If you use an exotic browser, you might want to try it out to be sure. +
patternto send a built-in checkerboard pattern image. The image is visually + decent, scales very well, and makes it obvious where banners were busted. +
blankto send a built-in transparent image. This makes banners disappear + completely, but makes it hard to detect where
to + send a redirect totarget-url
file:///URL). +
blankor
patternin + the first place, but enables your browser to cache the replacement image, instead of requesting + it over and over again. +
http://config.privoxy.org/send-banner?type=, wheretype
blankor
pattern. +
auto. It is
actions, known to
aliases, can be defined by combining other actions. + These can in turn be invoked just like the built-in actions. + Currently, an alias name can contain any character except space, tab, +
=, +
{and
}, but we
ato
z, +
0to
9,
+, and
-. + Alias names are not case sensitive, and are not required to start with a +
+or
-sign, since they are merely textually + expanded. +
shop, you can later change your policy on shops in +
shopalias is used. Calling aliases + by their purpose also makes your actions files more readable. +
/pattern): +
shopand
fragileare often used for +
problemsites that require some actions to be disabled + in order to function properly. +
, but this pattern + matches all URLs. Therefore, the + set of actions used in this/
defaultsection
++ preceding the action name enables the action, a
-disables!). + Also note how this long line has been made more readable by splitting it into + multiple lines with line continuation. +
general policythat applies + universally and won't get any exceptions defined later. Other choices, + like not blocking (which is
fragile+ sites, i.e. sites that require minimum interference, because they are either + very complex or very keen on tracking you (and have mechanisms in place that + make them unusable for people who avoid being tracked). We will simply use + our pre-defined
blocked+ by the
banners. So the above + generic patterns are surprisingly effective. +
nasty-as intended, + but alsoads .nasty-corp.com
downloor +ads .sourcefroge.net
So here come some + well-known exceptions to theads l.some-provider.net.
downloads.sourcefroge.net: Initially, all actions are deactivated, + so it wouldn't get blocked. Then comes the defaults section, which matches the + URL, but just deactivates the
cvsin them. Note that +
funtext replacements in
funfiltering specified here. +
roll your ownfilters, you should be + familiar with HTML syntax. +
foocould look + like this: +
foofilter. We have already defined + the heading, but the jobs are still missing. Since all it does is to replace +
foowith
bar, there is only one (trivial) job + needed: +
fooshould be replaced? Our current job will only take + care of the first
fooon each page. For global substitution, + we'll need to add the
Match an arbitrary number of the element left of myself, this + matches
<script, followed by
document.referrer. The dot needed to + be
document.referrer, if
document.referrerappears somewhere in between. +
eat upall + text in between
<scriptand the
document.referrer, and that the second
</script>+ tag. Furthermore, the
document.referrer. Remember the parts of the script from + (and including) the start tag up to (and excluding) the string +
document.referreras
document.referrer) replaced by
document.referrerby +
zero + or more whitespace. The
a single +. +or a double quote
window.statusobject with a dummy assignment + (using a variable name that is hopefully odd enough not to conflict with + real variables in scripts). Thus, it catches many cases where e.g. pointless + descriptions are displayed in the status bar instead of the link target when + you move your mouse over links. +
onunloadattribute in +
<body>tags with the dummy word
.comappears directly following
microsoft+ in the page. This prevents links to microsoft.com from being messed, while + still replacing the word everywhere else. +
404 - No Such Domain+ error page
BLOCKED+ page
regular + expressionsin its actions + files and filter file, + through the
regular + expressionsare, or what they can do. So this will be a very brief + introduction only. A full explanation would require a
meta-charactershave + special meanings and are used to build complex patterns to be matched against. + Perl Compatible Regular Expressions are an especially convenient +
dialectof the regular expression language. +
special+ character here is the asterisk which matches any and all characters. We can be + more specific and use
dir file?.textwould match +
file1.txt,
file2.txt, etc. We are pattern + matching, using a similar technique to
regular expressions! +
special charactersand ways of + building complex patterns however. Let's look at a few of the common ones, + and then some examples: +
a, +
A,
4,
:, or
@. +
escapecharacter denotes that + the following character should be taken literally. This is used where one of the + special characters (e.g.
.) needs to be taken literally and + not as a special meta-character. Example:
example\.com, makes + sure the period is recognized only as a period (and not expanded to its + meta-character meaning of any single character). +
[0-9]+ matches any numeric digit (zero through nine). As an example, we can combine + this with
+to match any digit one of more times:
[0-9]+. +
barcharacter works like an +
orconditional statement. A match is successful if the + sub-expression on either side of
|matches. As an example: +
/(this|that) example/uses grouping and the bar character + and would match either
this exampleor
that + example, and nothing else. +
.and
*to + denote any character, zero or more times. In other words, any string at all. + So we start with a literal forward slash, then our regular expression pattern + (
.*) another literal forward slash, the string +
banners, another forward slash, and lastly another +
.*. We are building + a directory path here. This will match any file with the path that has a + directory named
bannersin it. The
.*matches + any characters, and this could conceivably be more forward slashes, so it + might expand into a much longer looking path. For example, this could match: +
/eye/hate/spammers/banners/annoy_me_please.gif, or just +
/banners/annoying.html, or almost an infinite number of other + possible combinations, just so it has
bannersin the path + somewhere. +
/), so we are + building another expression that is a file path statement. We have another +
.*, so we are matching against any conceivable sub-path, just so + it matches our expression. The only true literal that
advstring is the + interesting part. +
?means the preceding expression (either a + literal character or anything grouped with
(...)in this case) + can exist or not, since this means either zero or one match. So +
((er)?ts?|ertis(ing|ements?))is optional, as are the + individual sub-expressions:
(er), +
(ing|ements?), and the
s. The
|+ means
or. We have two of those. For instance, +
(ing|ements?), can expand to match either
ing+
ements?. What is being done here, is an + attempt at matching as many variations of
advertisement, and + similar, as possible. So this would expand to match just
adv, + or
advert, or
adverts, or +
advertising, or
advertisement, or +
advertisements. You get the idea. But it would not match +
advertizements(with a
z). We could fix that by + changing our regular expression to: +
/.*/adv((er)?ts?|erti(s|z)(ing|ements?))?/, which would then match + either spelling. +
[]can be matched. This is using
0-9as a + shorthand expression to mean any digit one through nine. It is the same as + saying
0123456789. So any digit matches. The
++ means one or more of the preceding expression must be included. The preceding + expression here is what is in the square brackets -- in this case, any digit + one through nine. Then, at the end, we have a grouping:
(gif|jpe?g). + This includes a
|, so this needs to match the expression on + either side of that bar character also. A simple
gifon one side, and the other + side will in turn match either
jpegor
jpg, + since the
?means the letter
eis optional and + can be matched once or not at all. So we are building an expression here to + match image GIF or JPEG type image file. It must include the literal + string
advert, then one or more digits, and a
.+ (which is now a literal, and not a special character, since it is escaped + with
\), and lastly either
gif, or +
jpeg, or
jpg. Some possible matches would + include:
//advert1.jpg, +
/nasty/ads/advert1234.gif, +
/banners/from/hell/advert99.jpg. It would not match +
advert1.gif(no leading slash), or +
/adverts232.jpg(the expression does not include an +
s), or
/advert1.jsp(
jspis not + in the expression anywhere). +
+++ +http://config.privoxy.org/ +
+++ +http://config.privoxy.org/show-status +
+++ +http://config.privoxy.org/show-version +
+++ +http://config.privoxy.org/show-request +
+++ +http://config.privoxy.org/show-url-info +
Privoxycontinues + to run, but only as a pass-through proxy, with no actions taking place: +
+++ +http://config.privoxy.org/toggle +
+++ +http://config.privoxy.org/toggle?set=disable +
+++ +http://config.privoxy.org/toggle?set=enable +
bookmarkletsto allow you to easily access a +
miniversion of some of
Add to Favorites+ (IE) or
Add Bookmark(Netscape). You will get a warning that + the bookmark
may not be safe- just click OK. Then you can run the + Bookmarklet directly from your favorites/bookmarks. For even faster access, + you can put them on the
Linksbar (IE) or the
Personal + Toolbar(Netscape), and run them with a single click. +
+blockpatterns. If + so, the URL is then blocked, and the remote web server will not be contacted. +
+handle-as-image+ is then checked and if it does not match, an + HTML
BLOCKEDpage is sent back. Otherwise, if it does match, + an image is returned. The type of image depends on the setting of
+set-image-blocker+ (blank, checkerboard pattern, or an HTTP redirect to an image elsewhere). +
+fast-redirectsaction, + it is then processed. Unwanted parts of the requested URL are stripped. +
+hide-user-agent, + etc.), headers are suppressed or forged as determined by these actions and + their parameters. +
+crunch-incoming-cookies, +
+session-cookies-only, + and
+downgrade-http-version+ actions. +
+kill-popups+ action applies, and it is an HTML or JavaScript document, the popup-code in the + response is filtered on-the-fly as it is received. +
+filter+ or
+deanimate-gifs+ action applies (and the document type fits the action), the rest of the page is + read into memory (up to a configurable limit). Then the filter rules (from +
+filter+ or
+deanimate-gifs+ matches, then
+filteraction) from + the
View + Page Sourceoption for this. Or right click on the ad, and grab the + URL. +
actions, and + which ones match for our example,
google.com. The first listing + is any matches for the
standard. Then next is
default, or + our
actionsfile, this would be the section + just below the
aliasessection near the top. This will apply to + all URLs as signified by the single forward slash at the end of the listing + --
/. +
.google.com. The first is negating our previous cookie setting, + which was for
+session-cookies-only+ (i.e. not persistent). So we will allow persistent cookies for google. The + second turns
+fast-redirects+ action, allowing this to take place unmolested. Note that there is a leading + dot here --
.google.com. This will match any hosts and + sub-domains, in the google.com domain also, such as +
www.google.com. So, apparently, we have these two actions + defined somewhere in the lower part of our
google.comis referenced somewhere in these latter + sections. +
actions+ to
google.com: + +
fast-redirectsand
session-cookies-only. +
ad.doubleclick.net: +
+block +handle-as-image, + which is the expanded form of one of our aliases that had been defined as: +
+imageblock. (
Aliasesare defined in + the first section of the actions file and typically used to combine more + than one action.) +
ad.doubleclick.net+ is done here -- as both a
+block+
+handle-as-image. + The custom alias
+imageblockjust simplifies the process and make + it more readable. +
http://www.rhapsodyk.net/adsl/HOWTO/. + This one is giving us problems. We are getting a blank page. Hmmm ... +
/adsl/is matching
/ads! But + we did not want this at all! Now we see why we get the blank page. We could + now add a new action below this that explicitly does
{-block}) paths with
adsl. There are + various ways to handle such exceptions. Example: +
{+filter}actions. Try + adding the URL for the site to one of aliases that turn off
+filter: +
{shop}is an
aliasthat expands to +
{ -filter -session-cookies-only }. + Or you could do your own exception to negate filtering: + +
{fragile}is an alias that disables most actions. This can be + used as a last resort for problem sites. Remember to flush caches! If this + still does not work, you will have to go through the remaining actions one by + one to find which one(s) is causing the problem. +
, more or less. +, list with bullets. + , member of the above. + , screen output, implies . + , like HTML tag. + , for, doh, quoting text. + +Look at any of the existing docs for examples of all these and more. + +You might also find "Writing Documentation Using DocBook - A Crash Course" +useful. + +------------------------------------------------------------------------------- + +3.2. Privoxy Documentation Style + +It will be easier if everyone follows a similar writing style. This just makes +it easier to read what someone else has written if it is all done in a similar +fashion. + +Here it is: + + * All tags should be lower case. + + * Tags delimiting a block of text (even small blocks) should be on their own + line. Like: + ++ Some text goes here. + + + + Tags marking individual words, or few words, should be in-line: + + Just toemphasize , some text goes here. + + + * Tags should be nested and step indented for block text like: (except + in-line tags) + ++ + + + This makes it easier to find the text amongst the tags ;-) + + * Use white space to separate logical divisions within a document, like + between sections. Running everything together consistently makes it harder + to read and work on. + + * Do not hesitate to make comments. Comments can either use the+ ++ ++ Some text goes here in our list example. + ++ element, or the style comment familiar from HTML. (Note in Docbook + v4.x is replaced by .) + + * We have an international audience. Refrain from slang, or English + idiosyncrasies (too many to list :). Humor also does not translate well + sometimes. + + * Try to keep overall line lengths in source files to 80 characters or less + for obvious reasons. This is not always possible, with lengthy URLs for + instance. + + * Our documents are available in differing formats. Right now, they are just + plain text, and HTML, but PDF, and others is always a future possibility. + Be careful with URLs ( ), and avoid this mistake: + + My favorite site is here . + + This will render as "My favorite site is here", which is not real helpful + in a text doc. Better like this: + + My favorite site isexample.com . + + * All documents should be spell checked occasionally. aspell can check SGML + with the -H option. (ispell I think too.) + +------------------------------------------------------------------------------- + +3.3. Privoxy Custom Entities + +Privoxy documentation is using a number of customized "entities" to facilitate +documentation maintenance. + +We are using a set of "boilerplate" files with generic text, that is used by +multiple docs. This way we can write something once, and use it repeatedly +without having to re-write the same content over and over again. If editing +such a file, keep in mind that it should be generic. That is the purpose; so it +can be used in varying contexts without additional modifications. + +We are also using what Docbook calls "internal entities". These are like +variables in programming. Well, sort of. For instance, we have the p-version +entity that contains the current Privoxy version string. You are strongly +encouraged to use these where possible. Some of these obviously require +re-setting with each release (done by the Makefile). A sampling of custom +entities are listed below. See any of the main docs for examples. + + * Re- "boilerplate" text entities are defined like: + + + + In this example, the contents of the file, supported.sgml is available for + inclusion anywhere in the doc. To make this happen, just reference the now + defined entity: &supported; (starts with an ampersand and ends with a + semi-colon), and the contents will be dumped into the finished doc at that + point. + + * Commonly used "internal entities": + + p-version: the Privoxy version string, e.g. "2.9.15". + p-status: the project status, either "alpha", "beta", or "stable". + p-not-stable: use to conditionally include text in "not stable" releases + (e.g. "beta"). + p-stable: just the opposite. + p-text: this doc is only generated as text. + +There are others in various places that are defined for a specific purpose. +Read the source! + +------------------------------------------------------------------------------- + +4. Coding Guidelines + +4.1. Introduction + +This set of standards is designed to make our lives easier. It is developed +with the simple goal of helping us keep the "new and improved Privoxy" +consistent and reliable. Thus making maintenance easier and increasing chances +of success of the project. + +And that of course comes back to us as individuals. If we can increase our +development and product efficiencies then we can solve more of the request for +changes/improvements and in general feel good about ourselves. ;-> + +------------------------------------------------------------------------------- + +4.2. Using Comments + +4.2.1. Comment, Comment, Comment + +Explanation: + +Comment as much as possible without commenting the obvious. For example do not +comment "aVariable is equal to bVariable". Instead explain why aVariable should +be equal to the bVariable. Just because a person can read code does not mean +they will understand why or what is being done. A reader may spend a lot more +time figuring out what is going on when a simple comment or explanation would +have prevented the extra research. Please help your brother IJB'ers out! + +The comments will also help justify the intent of the code. If the comment +describes something different than what the code is doing then maybe a +programming error is occurring. + +Example: + +/* if page size greater than 1k ... */ +if ( PageLength() > 1024 ) +{ + ... "block" the page up ... +} + +/* if page size is small, send it in blocks */ +if ( PageLength() > 1024 ) +{ + ... "block" the page up ... +} + +This demonstrates 2 cases of "what not to do". The first is a +"syntax comment". The second is a comment that does not fit what +is actually being done. + +------------------------------------------------------------------------------- + +4.2.2. Use blocks for comments + +Explanation: + +Comments can help or they can clutter. They help when they are differentiated +from the code they describe. One line comments do not offer effective +separation between the comment and the code. Block identifiers do, by +surrounding the code with a clear, definable pattern. + +Example: + +/********************************************************************* + * This will stand out clearly in your code! + *********************************************************************/ +if ( thisVariable == thatVariable ) +{ + DoSomethingVeryImportant(); +} + + +/* unfortunately, this may not */ +if ( thisVariable == thatVariable ) +{ + DoSomethingVeryImportant(); +} + + +if ( thisVariable == thatVariable ) /* this may not either */ +{ + DoSomethingVeryImportant(); +} + +Exception: + +If you are trying to add a small logic comment and do not wish to "disrupt" the +flow of the code, feel free to use a 1 line comment which is NOT on the same +line as the code. + +------------------------------------------------------------------------------- + +4.2.3. Keep Comments on their own line + +Explanation: + +It goes back to the question of readability. If the comment is on the same line +as the code it will be harder to read than the comment that is on its own line. + +There are three exceptions to this rule, which should be violated freely and +often: during the definition of variables, at the end of closing braces, when +used to comment parameters. + +Example: + +/********************************************************************* + * This will stand out clearly in your code, + * But the second example won't. + *********************************************************************/ +if ( thisVariable == thatVariable ) +{ + DoSomethingVeryImportant(); +} + +if ( thisVariable == thatVariable ) /*can you see me?*/ +{ + DoSomethingVeryImportant(); /*not easily*/ +} + + +/********************************************************************* + * But, the encouraged exceptions: + *********************************************************************/ +int urls_read = 0; /* # of urls read + rejected */ +int urls_rejected = 0; /* # of urls rejected */ + +if ( 1 == X ) +{ + DoSomethingVeryImportant(); +} + + +short DoSomethingVeryImportant( + short firstparam, /* represents something */ + short nextparam /* represents something else */ ) +{ + ...code here... + +} /* -END- DoSomethingVeryImportant */ + +------------------------------------------------------------------------------- + +4.2.4. Comment each logical step + +Explanation: + +Logical steps should be commented to help others follow the intent of the +written code and comments will make the code more readable. + +If you have 25 lines of code without a comment, you should probably go back +into it to see where you forgot to put one. + +Most "for", "while", "do", etc... loops _probably_ need a comment. After all, +these are usually major logic containers. + +------------------------------------------------------------------------------- + +4.2.5. Comment All Functions Thoroughly + +Explanation: + +A reader of the code should be able to look at the comments just prior to the +beginning of a function and discern the reason for its existence and the +consequences of using it. The reader should not have to read through the code +to determine if a given function is safe for a desired use. The proper +information thoroughly presented at the introduction of a function not only +saves time for subsequent maintenance or debugging, it more importantly aids in +code reuse by allowing a user to determine the safety and applicability of any +function for the problem at hand. As a result of such benefits, all functions +should contain the information presented in the addendum section of this +document. + +------------------------------------------------------------------------------- + +4.2.6. Comment at the end of braces if the content is more than one screen +length + +Explanation: + +Each closing brace should be followed on the same line by a comment that +describes the origination of the brace if the original brace is off of the +screen, or otherwise far away from the closing brace. This will simplify the +debugging, maintenance, and readability of the code. + +As a suggestion , use the following flags to make the comment and its brace +more readable: + +use following a closing brace: } /* -END- if() or while () or etc... */ + +Example: + +if ( 1 == X ) +{ + DoSomethingVeryImportant(); + ...some long list of commands... +} /* -END- if x is 1 */ + +or: + +if ( 1 == X ) +{ + DoSomethingVeryImportant(); + ...some long list of commands... +} /* -END- if ( 1 == X ) */ + +------------------------------------------------------------------------------- + +4.3. Naming Conventions + +4.3.1. Variable Names + +Explanation: + +Use all lowercase, and separate words via an underscore ('_'). Do not start an +identifier with an underscore. (ANSI C reserves these for use by the compiler +and system headers.) Do not use identifiers which are reserved in ANSI C++. +(E.g. template, class, true, false, ...). This is in case we ever decide to +port Privoxy to C++. + +Example: + +int ms_iis5_hack = 0; + +Instead of: + +int msiis5hack = 0; int msIis5Hack = 0; + +------------------------------------------------------------------------------- + +4.3.2. Function Names + +Explanation: + +Use all lowercase, and separate words via an underscore ('_'). Do not start an +identifier with an underscore. (ANSI C reserves these for use by the compiler +and system headers.) Do not use identifiers which are reserved in ANSI C++. +(E.g. template, class, true, false, ...). This is in case we ever decide to +port Privoxy to C++. + +Example: + +int load_some_file( struct client_state *csp ) + +Instead of: + +int loadsomefile( struct client_state *csp ) +int loadSomeFile( struct client_state *csp ) + +------------------------------------------------------------------------------- + +4.3.3. Header file prototypes + +Explanation: + +Use a descriptive parameter name in the function prototype in header files. Use +the same parameter name in the header file that you use in the c file. + +Example: + +(.h) extern int load_aclfile( struct client_state *csp ); +(.c) int load_aclfile( struct client_state *csp ) + +Instead of: + +(.h) extern int load_aclfile( struct client_state * ); or +(.h) extern int load_aclfile(); +(.c) int load_aclfile( struct client_state *csp ) + +------------------------------------------------------------------------------- + +4.3.4. Enumerations, and #defines + +Explanation: + +Use all capital letters, with underscores between words. Do not start an +identifier with an underscore. (ANSI C reserves these for use by the compiler +and system headers.) + +Example: + +(enumeration) : enum Boolean { FALSE, TRUE }; +(#define) : #define DEFAULT_SIZE 100; + +Note: We have a standard naming scheme for #defines that toggle a feature in +the preprocessor: FEATURE_>, where > is a short (preferably 1 or 2 word) +description. + +Example: + +#define FEATURE_FORCE 1 + +#ifdef FEATURE_FORCE +#define FORCE_PREFIX blah +#endif /* def FEATURE_FORCE */ + +------------------------------------------------------------------------------- + +4.3.5. Constants + +Explanation: + +Spell common words out entirely (do not remove vowels). + +Use only widely-known domain acronyms and abbreviations. Capitalize all letters +of an acronym. + +Use underscore (_) to separate adjacent acronyms and abbreviations. Never +terminate a name with an underscore. + +Example: + +#define USE_IMAGE_LIST 1 + +Instead of: + +#define USE_IMG_LST 1 or +#define _USE_IMAGE_LIST 1 or +#define USE_IMAGE_LIST_ 1 or +#define use_image_list 1 or +#define UseImageList 1 + +------------------------------------------------------------------------------- + +4.4. Using Space + +4.4.1. Put braces on a line by themselves. + +Explanation: + +The brace needs to be on a line all by itself, not at the end of the statement. +Curly braces should line up with the construct that they're associated with. +This practice makes it easier to identify the opening and closing braces for a +block. + +Example: + +if ( this == that ) +{ + ... +} + +Instead of: + +if ( this == that ) { ... } + +or + +if ( this == that ) { ... } + +Note: In the special case that the if-statement is inside a loop, and it is +trivial, i.e. it tests for a condition that is obvious from the purpose of the +block, one-liners as above may optically preserve the loop structure and make +it easier to read. + +Status: developer-discretion. + +Example exception: + +while ( more lines are read ) +{ + /* Please document what is/is not a comment line here */ + if ( it's a comment ) continue; + + do_something( line ); +} + +------------------------------------------------------------------------------- + +4.4.2. ALL control statements should have a block + +Explanation: + +Using braces to make a block will make your code more readable and less prone +to error. All control statements should have a block defined. + +Example: + +if ( this == that ) +{ + DoSomething(); + DoSomethingElse(); +} + +Instead of: + +if ( this == that ) DoSomething(); DoSomethingElse(); + +or + +if ( this == that ) DoSomething(); + +Note: The first example in "Instead of" will execute in a manner other than +that which the developer desired (per indentation). Using code braces would +have prevented this "feature". The "explanation" and "exception" from the point +above also applies. + +------------------------------------------------------------------------------- + +4.4.3. Do not belabor/blow-up boolean expressions + +Example: + +structure->flag = ( condition ); + +Instead of: + +if ( condition ) { structure->flag = 1; } else { structure->flag = 0; } + +Note: The former is readable and concise. The later is wordy and inefficient. +Please assume that any developer new to the project has at least a "good" +knowledge of C/C++. (Hope I do not offend by that last comment ... 8-) + +------------------------------------------------------------------------------- + +4.4.4. Use white space freely because it is free + +Explanation: + +Make it readable. The notable exception to using white space freely is listed +in the next guideline. + +Example: + +int firstValue = 0; +int someValue = 0; +int anotherValue = 0; +int thisVariable = 0; + +if ( thisVariable == thatVariable ) + +firstValue = oldValue + ( ( someValue - anotherValue ) - whatever ) + +------------------------------------------------------------------------------- + +4.4.5. Don't use white space around structure operators + +Explanation: + +- structure pointer operator ( "->" ) - member operator ( "." ) - functions and +parentheses + +It is a general coding practice to put pointers, references, and function +parentheses next to names. With spaces, the connection between the object and +variable/function name is not as clear. + +Example: + +aStruct->aMember; +aStruct.aMember; +FunctionName(); + +Instead of: aStruct -> aMember; aStruct . aMember; FunctionName (); + +------------------------------------------------------------------------------- + +4.4.6. Make the last brace of a function stand out + +Example: + +int function1( ... ) +{ + ...code... + return( retCode ); + +} /* -END- function1 */ + + +int function2( ... ) +{ +} /* -END- function2 */ + +Instead of: + +int function1( ... ) { ...code... return( retCode ); } int function2( ... ) { } + +Note: Use 1 blank line before the closing brace and 2 lines afterward. This +makes the end of function standout to the most casual viewer. Although function +comments help separate functions, this is still a good coding practice. In +fact, I follow these rules when using blocks in "for", "while", "do" loops, and +long if {} statements too. After all whitespace is free! + +Status: developer-discretion on the number of blank lines. Enforced is the end +of function comments. + +------------------------------------------------------------------------------- + +4.4.7. Use 3 character indentions + +Explanation: + +If some use 8 character TABs and some use 3 character TABs, the code can look * +very* ragged. So use 3 character indentions only. If you like to use TABs, pass +your code through a filter such as "expand -t3" before checking in your code. + +Example: + +static const char * const url_code_map[256] = +{ + NULL, ... +}; + + +int function1( ... ) +{ + if ( 1 ) + { + return( ALWAYS_TRUE ); + } + else + { + return( HOW_DID_YOU_GET_HERE ); + } + + return( NEVER_GETS_HERE ); + +} + +------------------------------------------------------------------------------- + +4.5. Initializing + +4.5.1. Initialize all variables + +Explanation: + +Do not assume that the variables declared will not be used until after they +have been assigned a value somewhere else in the code. Remove the chance of +accidentally using an unassigned variable. + +Example: + +short anShort = 0; +float aFloat = 0; +struct *ptr = NULL; + +Note: It is much easier to debug a SIGSEGV if the message says you are trying +to access memory address 00000000 and not 129FA012; or arrayPtr[20] causes a +SIGSEV vs. arrayPtr[0]. + +Status: developer-discretion if and only if the variable is assigned a value +"shortly after" declaration. + +------------------------------------------------------------------------------- + +4.6. Functions + +4.6.1. Name functions that return a boolean as a question. + +Explanation: + +Value should be phrased as a question that would logically be answered as a +true or false statement + +Example: + +ShouldWeBlockThis(); +ContainsAnImage(); +IsWebPageBlank(); + +------------------------------------------------------------------------------- + +4.6.2. Always specify a return type for a function. + +Explanation: + +The default return for a function is an int. To avoid ambiguity, create a +return for a function when the return has a purpose, and create a void return +type if the function does not need to return anything. + +------------------------------------------------------------------------------- + +4.6.3. Minimize function calls when iterating by using variables + +Explanation: + +It is easy to write the following code, and a clear argument can be made that +the code is easy to understand: + +Example: + +for ( size_t cnt = 0; cnt < blockListLength(); cnt ++ ) +{ + .... +} + +Note: Unfortunately, this makes a function call for each and every iteration. +This increases the overhead in the program, because the compiler has to look up +the function each time, call it, and return a value. Depending on what occurs +in the blockListLength() call, it might even be creating and destroying +structures with each iteration, even though in each case it is comparing "cnt" +to the same value, over and over. Remember too - even a call to blockListLength +() is a function call, with the same overhead. + +Instead of using a function call during the iterations, assign the value to a +variable, and evaluate using the variable. + +Example: + +size_t len = blockListLength(); + +for ( size_t cnt = 0; cnt < len; cnt ++ ) +{ + .... +} + +Exceptions: if the value of blockListLength() *may* change or could * +potentially* change, then you must code the function call in the for/while +loop. + +------------------------------------------------------------------------------- + +4.6.4. Pass and Return by Const Reference + +Explanation: + +This allows a developer to define a const pointer and call your function. If +your function does not have the const keyword, we may not be able to use your +function. Consider strcmp, if it were defined as: extern int strcmp( char *s1, +char *s2 ); + +I could then not use it to compare argv's in main: int main( int argc, const +char *argv[] ) { strcmp( argv[0], "privoxy" ); } + +Both these pointers are *const*! If the c runtime library maintainers do it, we +should too. + +------------------------------------------------------------------------------- + +4.6.5. Pass and Return by Value + +Explanation: + +Most structures cannot fit onto a normal stack entry (i.e. they are not 4 bytes +or less). Aka, a function declaration like: int load_aclfile( struct +client_state csp ) + +would not work. So, to be consistent, we should declare all prototypes with +"pass by value": int load_aclfile( struct client_state *csp ) + +------------------------------------------------------------------------------- + +4.6.6. Names of include files + +Explanation: + +Your include statements should contain the file name without a path. The path +should be listed in the Makefile, using -I as processor directive to search the +indicated paths. An exception to this would be for some proprietary software +that utilizes a partial path to distinguish their header files from system or +other header files. + +Example: + +#include/* This is not a local include */ +#include "config.h" /* This IS a local include */ + +Exception: + +/* This is not a local include, but requires a path element. */ +#include + +Note: Please! do not add "-I." to the Makefile without a _very_ good reason. +This duplicates the #include "file.h" behavior. + +------------------------------------------------------------------------------- + +4.6.7. Provide multiple inclusion protection + +Explanation: + +Prevents compiler and linker errors resulting from redefinition of items. + +Wrap each header file with the following syntax to prevent multiple inclusions +of the file. Of course, replace PROJECT_H with your file name, with "." Changed +to "_", and make it uppercase. + +Example: + +#ifndef PROJECT_H_INCLUDED +#define PROJECT_H_INCLUDED + ... +#endif /* ndef PROJECT_H_INCLUDED */ + +------------------------------------------------------------------------------- + +4.6.8. Use `extern "C"` when appropriate + +Explanation: + +If our headers are included from C++, they must declare our functions as +`extern "C"`. This has no cost in C, but increases the potential re-usability +of our code. + +Example: + +#ifdef __cplusplus +extern "C" +{ +#endif /* def __cplusplus */ + +... function definitions here ... + +#ifdef __cplusplus +} +#endif /* def __cplusplus */ + +------------------------------------------------------------------------------- + +4.6.9. Where Possible, Use Forward Struct Declaration Instead of Includes + +Explanation: + +Useful in headers that include pointers to other struct's. Modifications to +excess header files may cause needless compiles. + +Example: + +/********************************************************************* + * We're avoiding an include statement here! + *********************************************************************/ +struct file_list; +extern file_list *xyz; + +Note: If you declare "file_list xyz;" (without the pointer), then including the +proper header file is necessary. If you only want to prototype a pointer, +however, the header file is unnecessary. + +Status: Use with discretion. + +------------------------------------------------------------------------------- + +4.7. General Coding Practices + +4.7.1. Turn on warnings + +Explanation + +Compiler warnings are meant to help you find bugs. You should turn on as many +as possible. With GCC, the switch is "-Wall". Try and fix as many warnings as +possible. + +------------------------------------------------------------------------------- + +4.7.2. Provide a default case for all switch statements + +Explanation: + +What you think is guaranteed is never really guaranteed. The value that you +don't think you need to check is the one that someday will be passed. So, to +protect yourself from the unknown, always have a default step in a switch +statement. + +Example: + +switch( hash_string( cmd ) ) +{ + case hash_actions_file : + ... code ... + break; + + case hash_confdir : + ... code ... + break; + + default : + log_error( ... ); + ... anomaly code goes here ... + continue; / break; / exit( 1 ); / etc ... + +} /* end switch( hash_string( cmd ) ) */ + +Note: If you already have a default condition, you are obviously exempt from +this point. Of note, most of the WIN32 code calls `DefWindowProc' after the +switch statement. This API call *should* be included in a default statement. + +Another Note: This is not so much a readability issue as a robust programming +issue. The "anomaly code goes here" may be no more than a print to the STDERR +stream (as in load_config). Or it may really be an ABEND condition. + +Status: Programmer discretion is advised. + +------------------------------------------------------------------------------- + +4.7.3. Try to avoid falling through cases in a switch statement. + +Explanation: + +In general, you will want to have a 'break' statement within each 'case' of a +switch statement. This allows for the code to be more readable and +understandable, and furthermore can prevent unwanted surprises if someone else +later gets creative and moves the code around. + +The language allows you to plan the fall through from one case statement to +another simply by omitting the break statement within the case statement. This +feature does have benefits, but should only be used in rare cases. In general, +use a break statement for each case statement. + +If you choose to allow fall through, you should comment both the fact of the +fall through and reason why you felt it was necessary. + +------------------------------------------------------------------------------- + +4.7.4. Use 'long' or 'short' Instead of 'int' + +Explanation: + +On 32-bit platforms, int usually has the range of long. On 16-bit platforms, +int has the range of short. + +Status: open-to-debate. In the case of most FSF projects (including X/ +GNU-Emacs), there are typedefs to int4, int8, int16, (or equivalence ... I +forget the exact typedefs now). Should we add these to IJB now that we have a +"configure" script? + +------------------------------------------------------------------------------- + +4.7.5. Don't mix size_t and other types + +Explanation: + +The type of size_t varies across platforms. Do not make assumptions about +whether it is signed or unsigned, or about how long it is. Do not compare a +size_t against another variable of a different type (or even against a +constant) without casting one of the values. Try to avoid using size_t if you +can. + +------------------------------------------------------------------------------- + +4.7.6. Declare each variable and struct on its own line. + +Explanation: + +It can be tempting to declare a series of variables all on one line. Don't. + +Example: + +long a = 0; +long b = 0; +long c = 0; + +Instead of: + +long a, b, c; + +Explanation: - there is more room for comments on the individual variables - +easier to add new variables without messing up the original ones - when +searching on a variable to find its type, there is less clutter to "visually" +eliminate + +Exceptions: when you want to declare a bunch of loop variables or other trivial +variables; feel free to declare them on 1 line. You should, although, provide a +good comment on their functions. + +Status: developer-discretion. + +------------------------------------------------------------------------------- + +4.7.7. Use malloc/zalloc sparingly + +Explanation: + +Create a local struct (on the stack) if the variable will live and die within +the context of one function call. + +Only "malloc" a struct (on the heap) if the variable's life will extend beyond +the context of one function call. + +Example: + +If a function creates a struct and stores a pointer to it in a +list, then it should definitely be allocated via `malloc'. + +------------------------------------------------------------------------------- + +4.7.8. The Programmer Who Uses 'malloc' is Responsible for Ensuring 'free' + +Explanation: + +If you have to "malloc" an instance, you are responsible for insuring that the +instance is `free'd, even if the deallocation event falls within some other +programmer's code. You are also responsible for ensuring that deletion is +timely (i.e. not too soon, not too late). This is known as "low-coupling" and +is a "good thing (tm)". You may need to offer a free/unload/destuctor type +function to accommodate this. + +Example: + +int load_re_filterfile( struct client_state *csp ) { ... } +static void unload_re_filterfile( void *f ) { ... } + +Exceptions: + +The developer cannot be expected to provide `free'ing functions for C run-time +library functions ... such as `strdup'. + +Status: developer-discretion. The "main" use of this standard is for allocating +and freeing data structures (complex or nested). + +------------------------------------------------------------------------------- + +4.7.9. Add loaders to the `file_list' structure and in order + +Explanation: + +I have ordered all of the "blocker" file code to be in alpha order. It is +easier to add/read new blockers when you expect a certain order. + +Note: It may appear that the alpha order is broken in places by POPUP tests +coming before PCRS tests. But since POPUPs can also be referred to as +KILLPOPUPs, it is clear that it should come first. + +------------------------------------------------------------------------------- + +4.7.10. "Uncertain" new code and/or changes to existing code, use FIXME + +Explanation: + +If you have enough confidence in new code or confidence in your changes, but +are not *quite* sure of the repercussions, add this: + +/* FIXME: this code has a logic error on platform XYZ, * attempting to fix */ # +ifdef PLATFORM ...changed code here... #endif + +or: + +/* FIXME: I think the original author really meant this... */ ...changed code +here... + +or: + +/* FIXME: new code that *may* break something else... */ ...new code here... + +Note: If you make it clear that this may or may not be a "good thing (tm)", it +will be easier to identify and include in the project (or conversely exclude +from the project). + +------------------------------------------------------------------------------- + +4.8. Addendum: Template for files and function comment blocks: + +Example for file comments: + +const char FILENAME_rcs[] = "$Id: developer-manual.sgml,v 1.42 2002/05/05 20:26:02 hal9 Exp $"; +/********************************************************************* + * + * File : $Source$ + * + * Purpose : (Fill me in with a good description!) + * + * Copyright : Written by and Copyright (C) 2001 the SourceForge + * Privoxy team. http://www.privoxy.org/ + * + * Based on the Internet Junkbuster originally written + * by and Copyright (C) 1997 Anonymous Coders and + * Junkbusters Corporation. http://www.junkbusters.com + * + * This program is free software; you can redistribute it + * and/or modify it under the terms of the GNU General + * Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will + * be useful, but WITHOUT ANY WARRANTY; without even the + * implied warranty of MERCHANTABILITY or FITNESS FOR A + * PARTICULAR PURPOSE. See the GNU General Public + * License for more details. + * + * The GNU General Public License should be included with + * this file. If not, you can view it at + * http://www.gnu.org/copyleft/gpl.html + * or write to the Free Software Foundation, Inc., 59 + * Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Revisions : + * $Log$ + * + *********************************************************************/ + + +#include "config.h" + + ...necessary include files for us to do our work... + +const char FILENAME_h_rcs[] = FILENAME_H_VERSION; + +Note: This declares the rcs variables that should be added to the +"show-proxy-args" page. If this is a brand new creation by you, you are free to +change the "Copyright" section to represent the rights you wish to maintain. + +Note: The formfeed character that is present right after the comment flower box +is handy for (X|GNU)Emacs users to skip the verbiage and get to the heart of +the code (via `forward-page' and `backward-page'). Please include it if you +can. + +Example for file header comments: + +#ifndef _FILENAME_H +#define _FILENAME_H +#define FILENAME_H_VERSION "$Id: developer-manual.sgml,v 1.42 2002/05/05 20:26:02 hal9 Exp $" +/********************************************************************* + * + * File : $Source$ + * + * Purpose : (Fill me in with a good description!) + * + * Copyright : Written by and Copyright (C) 2001 the SourceForge + * Privoxy team. http://www.privoxy.org/ + * + * Based on the Internet Junkbuster originally written + * by and Copyright (C) 1997 Anonymous Coders and + * Junkbusters Corporation. http://www.junkbusters.com + * + * This program is free software; you can redistribute it + * and/or modify it under the terms of the GNU General + * Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will + * be useful, but WITHOUT ANY WARRANTY; without even the + * implied warranty of MERCHANTABILITY or FITNESS FOR A + * PARTICULAR PURPOSE. See the GNU General Public + * License for more details. + * + * The GNU General Public License should be included with + * this file. If not, you can view it at + * http://www.gnu.org/copyleft/gpl.html + * or write to the Free Software Foundation, Inc., 59 + * Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Revisions : + * $Log$ + * + *********************************************************************/ + + +#include "project.h" + +#ifdef __cplusplus +extern "C" { +#endif + + ... function headers here ... + + +/* Revision control strings from this header and associated .c file */ +extern const char FILENAME_rcs[]; +extern const char FILENAME_h_rcs[]; + + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* ndef _FILENAME_H */ + +/* + Local Variables: + tab-width: 3 + end: +*/ + +Example for function comments: + +/********************************************************************* + * + * Function : FUNCTION_NAME + * + * Description : (Fill me in with a good description!) + * + * parameters : + * 1 : param1 = pointer to an important thing + * 2 : x = pointer to something else + * + * Returns : 0 => Ok, everything else is an error. + * + *********************************************************************/ +int FUNCTION_NAME( void *param1, const char *x ) +{ + ... + return( 0 ); + +} + +Note: If we all follow this practice, we should be able to parse our code to +create a "self-documenting" web page. + +------------------------------------------------------------------------------- + +5. Testing Guidelines + +To be filled. + +------------------------------------------------------------------------------- + +5.1. Testplan for releases + +Explain release numbers. major, minor. developer releases. etc. + + 1. Remove any existing rpm with rpm -e + + 2. Remove any file that was left over. This includes (but is not limited to) + + + /var/log/privoxy + + + /etc/privoxy + + + /usr/sbin/privoxy + + + /etc/init.d/privoxy + + + /usr/doc/privoxy* + + 3. Install the rpm. Any error messages? + + 4. start,stop,status Privoxy with the specific script (e.g. /etc/rc.d/init/ + privoxy stop). Reboot your machine. Does autostart work? + + 5. Start browsing. Does Privoxy work? Logfile written? + + 6. Remove the rpm. Any error messages? All files removed? + +------------------------------------------------------------------------------- + +5.2. Test reports + +Please submit test reports only with the test form at sourceforge. Three simple +steps: + + * Select category: the distribution you test on. + + * Select group: the version of Privoxy that we are about to release. + + * Fill the Summary and Detailed Description with something intelligent (keep + it short and precise). + +Do not mail to the mailinglist (we cannot keep track on issues there). + +------------------------------------------------------------------------------- + +6. Releasing a New Version + +When we release versions of Privoxy, our work leaves our cozy secret lab and +has to work in the cold RealWorld[tm]. Once it is released, there is no way to +call it back, so it is very important that great care is taken to ensure that +everything runs fine, and not to introduce problems in the very last minute. + +So when releasing a new version, please adhere exactly to the procedure +outlined in this chapter. + +The following programs are required to follow this process: ncftpput (ncftp), +scp, ssh (ssh), gmake (GNU's version of make), autoconf, cvs. + +------------------------------------------------------------------------------- + +6.1. Version numbers + +First you need to determine which version number the release will have. Privoxy +version numbers consist of three numbers, separated by dots, like in X.Y.Z, +where: + + * X, the version major, is rarely ever changed. It is increased by one if + turning a development branch into stable substantially changes the + functionality, user interface or configuration syntax. Majors 1 and 2 were + Junkbuster, and 3 will be the first stable Privoxy release. + + * Y, the version minor, represents the branch within the major version. At + any point in time, there are two branches being maintained: The stable + branch, with an even minor, say, 2N, in which no functionality is being + added and only bugfixes are made, and 2N+1, the development branch, in + which the further development of Privoxy takes place. This enables us to + turn the code upside down and inside out, while at the same time providing + and maintaining a stable version. The minor is reset to zero (and one) when + the major is inrcemented. When a development branch has matured to the + point where it can be turned into stable, the old stable branch 2N is given + up (i.e. no longer maintained), the former development branch 2N+1 becomes + the new stable branch 2N+2, and a new development branch 2N+3 is opened. + + * Z, the point or sub version, represents a release of the software within a + branch. It is therefore incremented immediately before each code freeze. In + development branches, only the even point versions correspond to actual + releases, while the odd ones denote the evolving state of the sources on + CVS in between. It follows that Z is odd on CVS in development branches + most of the time. There, it gets increased to an even number immediately + before a code freeze, and is increased to an odd number again immediately + thereafter. This ensures that builds from CVS snapshots are easily + distinguished from released versions. The point version is reset to zero + when the minor changes. + +------------------------------------------------------------------------------- + +6.2. Before the Release: Freeze + +The following must be done by one of the developers prior to each new release. + + * Make sure that everybody who has worked on the code in the last couple of + days has had a chance to yell "no!" in case they have pending changes/fixes + in their pipelines. Announce the freeze so that nobody will interfere with + last minute changes. + + * Increment the version number (point from odd to even in development + branches!) in configure.in. + + * If default.action has changed since last release (i.e. software release or + standalone actions file release), bump up its version info to A.B in this + line: + + {+add-header{X-Actions-File-Version: A.B} -filter -no-popups} + + Then change the version info in doc/webserver/actions/index.php, line: + '$required_actions_file_version = "A.B";' + + * If the HTML documentation is not in sync with the SGML sources you need to + regenerate and upload it to the webserver. (If in doubt, just do it.) See + the Section "Updating the webserver" in this manual for details. + + * Commit all files that were changed in the above steps! + + * Tag all files in CVS with the version number with "cvs tag v_X_Y_Z". Don't + use vX_Y_Z, ver_X_Y_Z, v_X.Y.Z (won't work) etc. + + * If the release was in a development branch, increase the point version from + even to odd (X.Y.(Z+1)) again in configure.in and commit your change. + + * On the webserver, copy the user manual to a new top-level directory called + X.Y.Z. This ensures that help links from the CGI pages, which have the + version as a prefix, will go into the right version of the manual. If this + is a development branch release, also symlink X.Y.(Z-1) to X.Y.Z and X.Y. + (Z+1) to . (i.e. dot). + +------------------------------------------------------------------------------- + +6.3. Building and Releasing the Packages + +Now the individual packages can be built and released. Note that for GPL +reasons the first package to be released is always the source tarball. + +For all types of packages, including the source tarball, you must make sure +that you build from clean sources by exporting the right version from CVS into +an empty directory:. + + mkdir dist # delete or choose different name if it already exists + cd dist + cvs -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa login + cvs -z3 -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa export -r v_X_Y_Z current + +Do NOT change a single bit, including, but not limited to version information +after export from CVS. This is to make sure that all release packages, and with +them, all future bug reports, are based on exactly the same code. + +Please find additional instructions for the source tarball and the individual +platform dependent binary packages below. + +------------------------------------------------------------------------------- + +6.3.1. Source Tarball + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then run: + + cd current + autoheader && autoconf && ./configure + +Then do: + + make tarball-dist + +To upload the package to Sourceforge, simply issue + + make tarball-upload + +Go to the displayed URL and release the file publicly on Sourceforge. For the +change log field, use the relevant section of the ChangeLog file. + +------------------------------------------------------------------------------- + +6.3.2. SuSE or Red Hat RPM + +In following text, replace dist with either "rh" for Red Hat or "suse" for +SuSE. + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). + +As the only exception to not changing anything after export from CVS, now +examine the file privoxy-dist.spec and make sure that the version information +and the RPM release number are correct. The RPM release numbers for each +version start at one. Hence it must be reset to one if this is the first RPM +for dist which is built from version X.Y.Z. Check the file list if unsure. +Else, it must be set to the highest already available RPM release number for +that version plus one. + +Then run: + + cd current + autoheader && autoconf && ./configure + +Then do + + make dist-dist + +To upload the package to Sourceforge, simply issue + + make dist-upload rpm_packagerev + +where rpm_packagerev is the RPM release number as determined above. Go to the +displayed URL and release the file publicly on Sourceforge. Use the release +notes and change log from the source tarball package. + +------------------------------------------------------------------------------- + +6.3.3. OS/2 + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then get the OS/2 +Setup module: + + cvs -z3 -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa co os2setup + +You will need a mix of development tools. The main compilation takes place with +IBM Visual Age C++. Some ancillary work takes place with GNU tools, available +from various sources like hobbes.nmsu.edu. Specificially, you will need +autoheader, autoconf and sh tools. The packaging takes place with WarpIN, +available from various sources, including its home page: xworkplace. + +Change directory to the os2setup directory. Edit the os2build.cmd file to set +the final executable filename. For example, + + installExeName='privoxyos2_setup_X.Y.Z.exe' + +Next, edit the IJB.wis file so the release number matches in the PACKAGEID +section: + + PACKAGEID="Privoxy Team\Privoxy\Privoxy Package\X\Y\Z" + +You're now ready to build. Run: + + os2build + +You will find the WarpIN-installable executable in the ./files directory. +Upload this anonymously to uploads.sourceforge.net/incoming, create a release +for it, and you're done. Use the release notes and Change Log from the source +tarball package. + +------------------------------------------------------------------------------- + +6.3.4. Solaris + +Login to Sourceforge's compilefarm via ssh: + + ssh cf.sourceforge.net + +Choose the right operating system (not the Debian one). When logged in, make +sure that you have freshly exported the right version into an empty directory. +(See "Building and releasing packages" above). Then run: + + cd current + autoheader && autoconf && ./configure + +Then run + + gmake solaris-dist + +which creates a gzip'ed tar archive. Sadly, you cannot use make solaris-upload +on the Sourceforge machine (no ncftpput). You now have to manually upload the +archive to Sourceforge's ftp server and release the file publicly. Use the +release notes and Change Log from the source tarball package. + +------------------------------------------------------------------------------- + +6.3.5. Windows + +You should ensure you have the latest version of Cygwin (from http:// +www.cygwin.com/). Run the following commands from within a Cygwin bash shell. + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then get the Windows +setup module: + + cvs -z3 -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa co winsetup + +Then you can build the package. This is fully automated, and is controlled by +winsetup/GNUmakefile. All you need to do is: + + cd winsetup + make + +Now you can manually rename privoxy_setup.exe to privoxy_setup_X_Y_Z.exe, and +upload it to SourceForge. When releasing the package on SourceForge, use the +release notes and Change Log from the source tarball package. + +------------------------------------------------------------------------------- + +6.3.6. Debian + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then, run: + + cd current + autoheader && autoconf && ./configure + +Then do FIXME. + +------------------------------------------------------------------------------- + +6.3.7. Mac OSX + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then get the Mac OSX +setup module: + + cvs -z3 -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa co osxsetup + +Then run: + + cd osxsetup + build + +This will run autoheader, autoconf and configure as well as make. Finally, it +will copy over the necessary files to the ./osxsetup/files directory for +further processing by PackageMaker. + +Bring up PackageMaker with the PrivoxyPackage.pmsp definition file, modify the +package name to match the release, and hit the "Create package" button. If you +specify ./Privoxy.pkg as the output package name, you can then create the +distributable zip file with the command: + +zip -r privoxyosx_setup_x.y.z.zip Privoxy.pkg + +You can then upload privoxyosx_setup_x.y.z.zip anonymously to +uploads.sourceforge.net/incoming, create a release for it, and you're done. Use +the release notes and Change Log from the source tarball package. + +------------------------------------------------------------------------------- + +6.3.8. FreeBSD + +Login to Sourceforge's compilefarm via ssh: + + ssh cf.sourceforge.net + +Choose the right operating system. When logged in, make sure that you have +freshly exported the right version into an empty directory. (See "Building and +releasing packages" above). Then run: + + cd current + autoheader && autoconf && ./configure + +Then run: + + gmake freebsd-dist + +which creates a gzip'ed tar archive. Sadly, you cannot use make freebsd-upload +on the Sourceforge machine (no ncftpput). You now have to manually upload the +archive to Sourceforge's ftp server and release the file publicly. Use the +release notes and Change Log from the source tarball package. + +------------------------------------------------------------------------------- + +6.3.9. HP-UX 11 + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then run: + + cd current + autoheader && autoconf && ./configure + +Then do FIXME. + +------------------------------------------------------------------------------- + +6.3.10. Amiga OS + +First, make sure that you have freshly exported the right version into an empty +directory. (See "Building and releasing packages" above). Then run: + + cd current + autoheader && autoconf && ./configure + +Then do FIXME. + +------------------------------------------------------------------------------- + +6.3.11. AIX + +Login to Sourceforge's compilefarm via ssh: + + ssh cf.sourceforge.net + +Choose the right operating system. When logged in, make sure that you have +freshly exported the right version into an empty directory. (See "Building and +releasing packages" above). Then run: + + cd current + autoheader && autoconf && ./configure + +Then run: + + make aix-dist + +which creates a gzip'ed tar archive. Sadly, you cannot use make aix-upload on +the Sourceforge machine (no ncftpput). You now have to manually upload the +archive to Sourceforge's ftp server and release the file publicly. Use the +release notes and Change Log from the source tarball package. + +------------------------------------------------------------------------------- + +6.4. Uploading and Releasing Your Package + +After the package is ready, it is time to upload it to SourceForge, and go +through the release steps. The upload is done via FTP: + + * Upload to: ftp://upload.sourceforge.net/incoming + + * user: anonymous + + * password: ijbswa-developers@lists.sourceforge.net + +Once this done go to http://sourceforge.net/project/admin/editpackages.php? +group_id=11118, making sure you are logged in. Find your target platform in the +second column, and click Add Release. You will then need to create a new +release for your package, using the format of $VERSION ($CODE_STATUS), e.g. +2.9.15 (beta). + +Now just follow the prompts. Be sure to add any appropriate Release notes. You +should see your freshly uploaded packages in "Step 2. Add Files To This +Release". Check the appropriate box(es). Remember at each step to hit the +"Refresh/Submit" buttons! You should now see your file(s) listed in Step 3. +Fill out the forms with the appropriate information for your platform, being +sure to hit "Update" for each file. If anyone is monitoring your platform, +check the "email" box at the very bottom to notify them of the new package. +This should do it! + +If you have made errors, or need to make changes, you can go through +essentially the same steps, but select Edit Release, instead of Add Release. + +------------------------------------------------------------------------------- + +6.5. After the Release + +When all (or: most of the) packages have been uploaded and made available, send +an email to the announce mailing list, Subject: "Version X.Y.Z available for +download". Be sure to include the download location, the release notes and the +change log. + +------------------------------------------------------------------------------- + +7. Update the Webserver + +When updating the webserver, please follow these steps to make sure that no +broken links, incosistent contents or permission problems will occur: + +If you have changed anything in the documentation source SGML files, do: + + make dok # (or make redkat-dok if make dok doesn't work for you) + +That will generate doc/webserver/user-manual, doc/webserver/developer-manual, +doc/webserver/faq and doc/webserver/index.html automatically. + +If you changed the manual page source, generate doc/webserver/man-page/ +privoxy-man-page.html by running "make man". (This is a separate target due to +dependencies on some obscure perl scripts. See comments in GNUmakefile.) + +If you want to add new files to the webserver, create them locally in the doc/ +webserver/* directory (or create new directories under doc/webserver). + +Next, commit any changes from the above steps to CVS. All set? Then do + + make webserver + +This will do the upload to the webserver (www.privoxy.org) and ensure all files +and directories there are group writable. + +Please do NOT use any other means of transferring files to the webserver to +avoid permission problems. + +------------------------------------------------------------------------------- + +8. Contacting the developers, Bug Reporting and Feature Requests + +We value your feedback. However, to provide you with the best support, please +note the following sections. + +------------------------------------------------------------------------------- + +8.1. Get Support + +To get support, use the Sourceforge Support Forum: + + http://sourceforge.net/tracker/?group_id=11118&atid=211118 + +------------------------------------------------------------------------------- + +8.2. Report bugs + +To submit bugs, use the Sourceforge Bug Forum: + + http://sourceforge.net/tracker/?group_id=11118&atid=111118. + +Make sure that the bug has not already been submitted. Please try to verify +that it is a Privoxy bug, and not a browser or site bug first. If you are using +your own custom configuration, please try the stock configs to see if the +problem is a configuration related bug. And if not using the latest development +snapshot, please try the latest one. Or even better, CVS sources. Please be +sure to include the Privoxy version, platform, browser, any pertinent log data, +any other relevant details (please be specific) and, if possible, some way to +reproduce the bug. + +------------------------------------------------------------------------------- + +8.3. Request new features + +To submit ideas on new features, use the Sourceforge feature request forum: + + http://sourceforge.net/tracker/?atid=361118&group_id=11118&func=browse. + +------------------------------------------------------------------------------- + +8.4. Report ads or other filter problems + +You can also send feedback on websites that Privoxy has problems with. Please +bookmark the following link: "Privoxy - Submit Filter Feedback". Once you surf +to a page with problems, use the bookmark to send us feedback. We will look +into the issue as soon as possible. + +New, improved default.action files will occasionally be made available based on +your feedback. These will be announced on the ijbswa-announce list. + +------------------------------------------------------------------------------- + +8.5. Other + +For any other issues, feel free to use the mailing lists: + + http://sourceforge.net/mail/?group_id=11118. + +Anyone interested in actively participating in development and related +discussions can also join the appropriate mailing list. Archives are available, +too. See the page on Sourceforge. + +------------------------------------------------------------------------------- + +9. Privoxy Copyright, License and History + +Copyright © 2001, 2002 by Privoxy Developers + +Some source code is based on code Copyright © 1997 by Anonymous Coders and +Junkbusters, Inc. and licensed under the GNU General Public License. + +------------------------------------------------------------------------------- + +9.1. License + +Privoxy is free software; you can redistribute it and/or modify it under the +terms of the GNU General Public License, version 2, as published by the Free +Software Foundation. + +This program is distributed in the hope that it will be useful, but WITHOUT ANY +WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A +PARTICULAR PURPOSE. See the GNU General Public License for more details, which +is available from the Free Software Foundation, Inc, 59 Temple Place - Suite +330, Boston, MA 02111-1307, USA. + +You should have received a copy of the GNU General Public License along with +this program; if not, write to the + + Free Software + Foundation, Inc. 59 Temple Place - Suite 330 + Boston, MA 02111-1307 + USA + +------------------------------------------------------------------------------- + +9.2. History + +Privoxy is evolved, and derived from, the Internet Junkbuster, with many +improvments and enhancements over the original. + +Junkbuster was originally written by Anonymous Coders and Junkbusters +Corporation, and was released as free open-source software under the GNU GPL. +Stefan Waldherr made many improvements, and started the SourceForge project +Privoxy to rekindle development. There are now several active developers +contributing. The last stable release of Junkbuster was v2.0.2, which has now +grown whiskers ;-). + +------------------------------------------------------------------------------- + +10. See also + +Other references and sites of interest to Privoxy users: + +http://www.privoxy.org/, The Privoxy Home page. + +http://sourceforge.net/projects/ijbswa, the Project Page for Privoxy on +Sourceforge. + +http://p.p/, access Privoxy from your browser. Alternately, http:// +config.privoxy.org may work in some situations where the first does not. + +http://p.p/, and select "Privoxy - Submit Filter Feedback" to submit "misses" +to the developers. + +http://www.junkbusters.com/ht/en/cookies.html + +http://www.waldherr.org/junkbuster/ + +http://privacy.net/analyze/ + +http://www.squid-cache.org/ + + + diff --git a/doc/text/faq.txt b/doc/text/faq.txt new file mode 100644 index 00000000..5c4cbeb8 --- /dev/null +++ b/doc/text/faq.txt @@ -0,0 +1,1022 @@ +Privoxy Frequently Asked Questions + +Copyright © 2001, 2002 by Privoxy Developers + +$Id: faq.sgml,v 1.57 2002/05/05 20:26:02 hal9 Exp $ + +This FAQ gives users and developers alike answers to frequently asked questions +about Privoxy . + +Privoxy is a web proxy with advanced filtering capabilities for protecting +privacy, filtering web page content, managing cookies, controlling access, and +removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a +very flexible configuration and can be customized to suit individual needs and +tastes. Privoxy has application for both stand-alone systems and multi-user +networks. + +Privoxy is based on Internet Junkbuster (tm). + +You can find the latest version of the document at http://www.privoxy.org/faq/. +Please see the Contact section if you want to contact the developers. + +------------------------------------------------------------------------------- + +Table of Contents +1. General Information + + 1.1. What is this new version of Privoxy? + 1.2. Why "Privoxy"? Why a name change at all? + 1.3. How does Privoxy differ from the old Junkbuster? + 1.4. What are some of the new features? + 1.5. What is a "proxy"? How does Privoxy work? + 1.6. How does Privoxy know what is an ad, and what is not? + 1.7. Can Privoxy make mistakes? This does not sound very scientific. + 1.8. My browser does the same things as Privoxy. Why should I use Privoxy + at all? + 1.9. Is there is a license or fee? What about a warranty? Registration? + 1.10. I would like to help you, what do I do? + + 1.10.1. Money Money Money + 1.10.2. You want to work with us? + +2. Installation + + 2.1. Which browsers are supported by Privoxy? + 2.2. Which operating systems are supported? + 2.3. Can I install Privoxy over Junkbuster? + 2.4. I just installed Privoxy. Is there anything special I have to do now? + 2.5. What is the proxy address of Privoxy? + 2.6. I just installed Privoxy, and nothing is happening. All the ads are + there. What's wrong? + +3. Configuration + + 3.1. Can I use my old config files? + 3.2. What is an "actions" file? + 3.3. The "actions" concept confuses me. Please list some of these + "actions". + 3.4. How are actions files configured? What is the easiest way to do this? + 3.5. There are several different "actions" files. What are the differences? + 3.6. Why can I change the configuration with a browser? Does that not raise + security issues? + 3.7. What is "default.filter"? + 3.8. How can I set up Privoxy to act as a proxy for my LAN? + 3.9. Instead of ads, now I get a checkerboard pattern. I don't want to see + anything. + 3.10. Why would anybody want to see a checkerboard pattern? + 3.11. I see large red banners on some pages that say "Blocked". Why and how + do I get rid of this? + 3.12. I cannot see all of the "Blocked" page banner. Help. + 3.13. Can Privoxy run as a service on Win2K/NT? + 3.14. How can I make Privoxy work with other proxies like Squid? + 3.15. Can Privoxy run as a "transparent" proxy? + +4. Miscellaneous + + 4.1. How much does Privoxy slow my browsing down? This has to add extra + time to browsing. + 4.2. I noticed considerable delays in page requests compared to the old + Junkbuster. What's wrong? + 4.3. What is the "http://p.p/"? + 4.4. Do you still maintain the blocklists? + 4.5. How can I submit new ads? + 4.6. How can I hide my IP address? + 4.7. Can Privoxy guarantee I am anonymous? + 4.8. Might some things break because header information is being altered? + 4.9. Can Privoxy act as a "caching" proxy to speed up web browsing? + 4.10. What about as a firewall? Can Privoxy protect me? + 4.11. The Privoxy logo that replaces ads is very blocky and ugly looking. + Can't a better font be used? + 4.12. I have large empty spaces now where ads used to be. Why? + 4.13. How can Privoxy filter Secure (HTTPS) URLs? + 4.14. Privoxy runs as a "server". How secure is it? Do I need to take any + special precautions? + 4.15. How can I temporarily disable Privoxy? + 4.16. Where can I find more information about Privoxy and related issues? + +5. Troubleshooting + + 5.1. I just upgraded and am getting "connection refused" with every web + page? + 5.2. I just added a new rule, but the steenkin ad is still getting through. + How? + 5.3. One of my favorite sites does not work with Privoxy. What can I do? + +6. Contacting the developers, Bug Reporting and Feature Requests + + 6.1. Get Support + 6.2. Report bugs + 6.3. Request new features + 6.4. Report ads or other filter problems + 6.5. Other + +7. Privoxy Copyright, License and History + + 7.1. License + 7.2. History + +1. General Information + +1.1. What is this new version of Privoxy? + +The original Internet JunkbusterTM (tm) is a copyrighted product of Junkbusters +Corporation. Development of this effort stopped some time ago as of version +2.0.2. Stefan Waldherr started the ijbswa project on Sourceforge to rekindle +development. Other developers subsequently joined with Stefan, and have since +added many new features, refinements and enhancements. The result of this +effort is Privoxy. + +Privoxy has evolved from the Junkbuster 2.0.2 code base, and has advanced +significantly at this point. + +Please see the History section for more information on the history of +Junkbuster and Privoxy. + +------------------------------------------------------------------------------- + +1.2. Why "Privoxy"? Why a name change at all? + +Privoxy is the "Privacy Enhancing Proxy". + +There are potential legal complications from the continued use of the +Junkbuster name, which is a registered trademark of Junkbusters Corporation. +And thus they "own" the rights to the name. (There are, however, no objections +from Junkbusters Corporation to the Privoxy project itself, and they, in fact, +still share our ideals and goals.) + +The developers also believed that there are so many changes from the original +code, that it was time to make a clean break from the past and make a name in +their own right, especially now with the pending release of version 3.0. + +------------------------------------------------------------------------------- + +1.3. How does Privoxy differ from the old Junkbuster? + +Privoxy picks up where Junkbuster left off. All the old features remain. The +new Privoxy still blocks ads and banners, still manages cookies, and still +helps protect your privacy. But, these are all enhanced, and many new features +have been added, all in the same vein. + +The configuration has changed significantly as well. This is something that +users will notice right off the bat if you are upgrading from Junkbuster 2.0.x. +The "blocklist" file does not exist any more. This is replaced by "actions" +files, such as default.actions. This is where most of the per site +configuration is now. + +------------------------------------------------------------------------------- + +1.4. What are some of the new features? + + * Integrated browser based configuration and control utility at http:// + config.privoxy.org/ (shortcut: http://p.p/). Browser-based tracing of rule + and filter effects. Remote toggling. + + * Web page content filtering (removes banners based on size, invisible + "web-bugs", JavaScript and HTML annoyances, pop-up windows, etc.) + + * Modularized configuration that allows for standard settings and user + settings to reside in separate files, so that installing updated actions + files won't overwrite idividual user settings. + + * HTTP/1.1 compliant (but not all optional 1.1 features are supported). + + * Support for Perl Compatible Regular Expressions in the configuration files, + and generally a more sophisticated and flexible configuration syntax over + previous versions. + + * Improved cookie management features (e.g. session based cookies). + + * GIF de-animation. + + * Bypass many click-tracking scripts (avoids script redirection). + + * Multi-threaded (POSIX and native threads). + + * User-customizable HTML templates for all proxy-generated pages (e.g. + "blocked" page). + + * Auto-detection and re-reading of config file changes. + + * Improved signal handling, and a true daemon mode (Unix). + + * Every feature now controllable on a per-site or per-location basis, + configuration more powerful and versatile over-all. + + * Many smaller new features added, limitations and bugs removed, and security + holes fixed. + +------------------------------------------------------------------------------- + +1.5. What is a "proxy"? How does Privoxy work? + +When you connect to a web site with Privoxy, you are really connecting to your +locally running version of Privoxy. Privoxy intercepts your requests for the +web page, and relays that to the "real" web site. The web site sends the HTTP +data stream back to Privoxy, where Privoxy can work its magic before it relays +this data back to your web browser. + +Since Privoxy sits between you and the WWW, it is in a position to intercept +and completely manage all web traffic and HTTP content before it gets to your +browser. Privoxy uses various programming methods to do this, all of which is +under your control via the various configuration files and options. + +There are many kinds of proxies. Privoxy best fits the "filtering proxy" +category. + +------------------------------------------------------------------------------- + +1.6. How does Privoxy know what is an ad, and what is not? + +Privoxy processes all the raw content of every web page. So it reads everything +on each page. It then compares this to the rules as set up in the configuration +files, and looks for any matches to these rules. Privoxy makes heavy use of +"regular expressions". (If you are not familiar with regular expressions, it is +explained briefly in the user manual.) Regular expressions facilitate matching +of one text string against another, using wildcards to build complex patterns. +So Privoxy will typically look for URLs and other content that match certain +key words and expressions as defined in the configuration files. For instance a +URL that contains "/banners", has a high probability of containing ad banners, +and thus would be a prime candidate to have a matching rule. + +So Privoxy will look for these kinds of obvious looking culprits. And also, +will use lists of known organizations that specialize in ads. Again, using +complex patterns to match as many potential combinations as possible since +there tend to be many, many variations used by advertisers, and new ones are +being introduced all the time. + +------------------------------------------------------------------------------- + +1.7. Can Privoxy make mistakes? This does not sound very scientific. + +Actually, it's a black art ;-) And yes, it is always possible to have a broad +rule accidentally block something by mistake. There is a good chance you may +run into such a situation at some point. It is tricky writing rules to cover +every conceivable possibility, and not occasionally get false positives. + +But this should not be a big concern since the Privoxy configuration is very +flexible, and includes tools to help identify these types of situations so they +can be addressed as needed, allowing you to customize your installation. (See +the Troubleshooting section below.) + +------------------------------------------------------------------------------- + +1.8. My browser does the same things as Privoxy. Why should I use Privoxy at +all? + +Modern browsers do indeed have some of the same functionality as Privoxy. Maybe +this is adequate for you. But Privoxy is much more versatile and powerful, and +can do a number of things that browsers just can't. + +In addition, a proxy is good choice if you use multiple browsers, or have a LAN +with multiple computers. This way all the configuration is in one place, and +you don't have to maintain a similar configuration for possibly many browsers. + +------------------------------------------------------------------------------- + +1.9. Is there is a license or fee? What about a warranty? Registration? + +Privoxy is licensed under the GNU General Public License (GPL). It is free to +use, copy, modify or distribute as you wish under the terms of this license. +Please see the Copyright section for more information on the license and +copyright. Or the LICENSE file that should be included. + +There is no warranty of any kind, expressed, implied or otherwise. That is +something that would cost real money ;-) There is no registration either. +Privoxy really is free in every respect! + +------------------------------------------------------------------------------- + +1.10. I would like to help you, what do I do? + +1.10.1. Money Money Money + +We, of course, welcome donations and use the money for domain registering, +regular world-wide get-togethers (hahaha). Anyway, we'll soon describe the +process how to donate money to the team. + +------------------------------------------------------------------------------- + +1.10.2. You want to work with us? + +Well, helping the team is always a good idea. We welcome new developers, RPM +gurus or documentation makers. Simply get an account on sourceforge.net and +mail your id to the developer mailing list. Then read the section Quickstart in +the Developer's Manual. + +Once we have added you to the team, you'll have write access to the CVS +repository, and together we'll find a suitable task for you. + +------------------------------------------------------------------------------- + +2. Installation + +2.1. Which browsers are supported by Privoxy? + +Any browser that can be configured to use a "proxy", which should be virtually +all browsers. Direct browser support is not necessary since Privoxy runs as a +separate application and just exchanges standard HTML data with your browser, +just like a web server does. + +------------------------------------------------------------------------------- + +2.2. Which operating systems are supported? + +At present, Privoxy is known to run on Windows(95, 98, ME, 2000, XP), Linux +(RedHat, Suse, Debian), Mac OSX, OS/2, AmigaOS, FreeBSD, NetBSD, BeOS, and many +more flavors of Unix. + +But any operating system that runs TCP/IP, can conceivably take advantage of +Privoxy in a networked situation where Privoxy would run as a server on a LAN +gateway. Then only the "gateway" needs to be running one of the above operating +systems. + +Source code is freely available, so porting to other operating systems, is +always a possibility. + +------------------------------------------------------------------------------- + +2.3. Can I install Privoxy over Junkbuster? + +We recommend you uninstall Junkbuster first to minimize conflicts and +confusion. You may want to save your old configuration files for future +reference. The configuration is substantially changed. + +See the user-manual for platform specific installation instructions. + +Note: Some installers may automatically uninstall Junkbuster, if present! + +------------------------------------------------------------------------------- + +2.4. I just installed Privoxy. Is there anything special I have to do now? + +All browsers must be told to use Privoxy as a proxy by specifying the correct +proxy address and port number in the appropriate configuration area for the +browser. See below. Also, you should flush your browser's memory and disk cache +to get rid of any cached items. + +------------------------------------------------------------------------------- + +2.5. What is the proxy address of Privoxy? + +If you set up the Privoxy to run on the computer you browse from (rather than +your ISP's server or some networked computer on a LAN), the proxy will be on +"localhost" (which is the special name used by every computer on the Internet +to refer to itself) and the port will be 8118 (unless you have Privoxy to run +on a different port with the listen-address config option). + +When configuring your browser's proxy settings you typically enter the word +"localhost" in the boxes next to "HTTP" and "Secure" (HTTPS) and then the +number "8118" for "port". This tells your browser to send all web requests to +Privoxy instead of directly to the Internet. + +Privoxy can also be used to proxy for a Local Area Network. In this case, your +would enter either the IP address of the LAN host where Privoxy is running, or +the equivalent hostname. Port assignment would be same as above. + +Privoxy does not currently handle protocols such as FTP, SMTP, IM, IRC, ICQ, or +other Internet protocols. + +------------------------------------------------------------------------------- + +2.6. I just installed Privoxy, and nothing is happening. All the ads are there. +What's wrong? + +Did you configure your browser to use Privoxy as a proxy? It does not sound +like it. See above. You might also try flushing the browser's caches to force a +full re-reading of pages. You can verify that Privoxy is running, and your +browser is correctly configured by entering the special URL: http://p.p/. This +should give you a banner that says "This is Privoxy" and access to Privoxy's +internal configuration. If you see this, then you are good to go. If not, the +browser or Privoxy are not set up correctly. + +------------------------------------------------------------------------------- + +3. Configuration + +3.1. Can I use my old config files? + +There are major changes to Junkbuster/ Privoxy configuration from version 2.0.x +to 2.9.x and later. Most of the older files will not work at all. This is +especially true of blocklist. If this is the case, you will need to re-enter +your old data into the new configuration structure. This is probably also a +good recommendation even if upgrading from 2.9.x to 3.x since there were many +minor changes along the way. + +------------------------------------------------------------------------------- + +3.2. What is an "actions" file? + +"actions" files are where various actions that Privoxy might take, are +configured. Typically, you would define a set of default actions that apply to +all URLs, then add exceptions to these defaults where needed. + +Actions can be defined on a per site basis, or for groups of sites. Actions can +also be grouped together and then applied to one or more sites. There are many +possible actions that might apply to any given site. As an example, if we are +blocking cookies as one of our default actions, but need to accept cookies from +a given site, we would define this in our "actions" file. + +------------------------------------------------------------------------------- + +3.3. The "actions" concept confuses me. Please list some of these "actions". + +These are all explained in the user-manual. Please refer to that. + +------------------------------------------------------------------------------- + +3.4. How are actions files configured? What is the easiest way to do this? + +The easiest way to do this, is to access Privoxy with your web browser at http: +//p.p/, and then select "View & change the current configuration" from the +selection list. You can also do this by editing the appropriate file with a +text editor. + +Please see the user-manual for a detailed explanation of these and other +configuration files, and their various options and syntax. + +------------------------------------------------------------------------------- + +3.5. There are several different "actions" files. What are the differences? + +As of Privoxy v2.9.15, three actions files are being included, to be used for +different purposes. These are default.action, standard.action, and user.action. +Please see the User Manual for an explanation of each. + +Earlier versions included three different versions default.action files. The +new scheme allows for greater flexibility of local configuration, and for +browser based configuration. + +------------------------------------------------------------------------------- + +3.6. Why can I change the configuration with a browser? Does that not raise +security issues? + +What I don't understand, is how I can browser edit the config file as a regular +user, while the whole /etc/privoxy hierarchy belongs to the user "privoxy", +with only 644 permissions. + +When you use the browser-based editor, Privoxy itself is writing to the config +files. Because Privoxy is running as the user "privoxy", it can update the +config files. + +If you don't like this, setting "enable-edit-actions 0" in the config file will +disable the browser-based editor. If you're that paranoid, you should also +consider setting "enable-remote-toggle 0" to prevent browser-based enabling/ +disabling of Privoxy. + +Note that normally only local users can connect to Privoxy, so this is not +(normally) a security problem. + +------------------------------------------------------------------------------- + +3.7. What is "default.filter"? + +The "default.filter" file is where "filters" are defined, which are used to +"filter" any web page content. By "filtering" we mean it can modify, remove, or +change anything on the page, including HTML tags, and JavaScript. Regular +expressions are used to accomplish this, and operate on a line by line basis. +This is potentially a very powerful feature, but requires some expertise. + +If you are familiar with regular expressions, and HTML, you can look at the +provided default.filter with a text editor and see some of things it can be +used for. + +Presently, there is no GUI editor option for this part of the configuration, +but you can disable/enable various sections of the included default file with +the "View & change the current configuration" from your browser. + +------------------------------------------------------------------------------- + +3.8. How can I set up Privoxy to act as a proxy for my LAN? + +By default, Privoxy only responds to requests from localhost. To have it act as +a server for a network, this needs to be changed in the main config file where +the Privoxy configuration is located. In that file is a "listen-address" +option. It may be commented out with a "#" symbol. Make sure it is uncommented, +and assign it the address of the LAN gateway interface, and port number to use: + + listen-address 192.168.1.1:8118 + +Save the file, and restart Privoxy. Configure all browsers on the network then +to use this address and port number. + +------------------------------------------------------------------------------- + +3.9. Instead of ads, now I get a checkerboard pattern. I don't want to see +anything. + +This is a configuration option for images that Privoxy is stopping. You have +the choice of a checkerboard pattern, a transparent 1x1 GIF image (aka +"blank"), or a custom URL of your choice. Note that to fit this category, the +URL must match both the "+handle-as-image" and "+block" actions. + +If you want to see nothing, then change the "+set-image-blocker" action to +"+image-blocker{blank}". This can be done from the "View & change the current +configuration" selection at http://p.p/. Or by hand editing the appropriate +actions file. This will only effect what is defined as "images" though. Also, +some URLs that generate the bright red "Blocked" banner, can be moved to the +"+set-image-blocker" section for the same reason, but there are some limits and +risks to this (see below). + +------------------------------------------------------------------------------- + +3.10. Why would anybody want to see a checkerboard pattern? + +This can be helpful for troubleshooting problems. It might also be good for +anyone new to Privoxy so that they can see if their favorite pages are +displaying correctly, and Privoxy is not inadvertently removing something +important. + +------------------------------------------------------------------------------- + +3.11. I see large red banners on some pages that say "Blocked". Why and how do +I get rid of this? + +These are URLs that match something in one of Privoxy's block actions ("+block" +). It is meant to be a warning so that you know something has been blocked and +an easy way for you to see why. These are handled differently than what has +been defined explicitly as "images" (e.g. ads that are GIF image files). +Depending on the URL itself, it is sometimes hard for Privoxy to really know +whether there is indeed an ad image there or not. And there are limitations as +to what Privoxy can do to "fool" the browser. + +For instance, if the ad is in a frame, then it is embedded in the separate HTML +page used for the frame. In this case, you cannot just substitute an aribitrary +image (like we would for a "blank" image), for an HTML page. The browser is +expecting an HTML page, and that is what it must have for frames. Such +situations can be a little trickier to deal with, and Privoxy may show the +"Blocked" page, despite your best efforts. + +If you want these to be treated as if they were images, so that they can be +made invisible, you can try moving the offending URL from the "+block" section +to the "+imageblock" section of your actions file. Just be forewarned, if any +URL is made "invisible", you may not have any inkling that something has been +removed from that page, or why. If this approach does not work, then you are +probably dealing with a frame (or "ilayer"), and the only thing that can go +there is an HTML page of some sort. + +To deal with this situation, you could modify the "block" HTML template that is +used by Privoxy to display this, and make it something more to your liking. +Currently, there is no configuration option for this. You will have to modify, +or create your own page, and use this to replace templates/blocked, which is +what Privoxy uses to display the "Blocked" page. + +Another way to deal with this is find why and where Privoxy is blocking the +frame, and diable this. Then let the "+set-image-blocker" action handle the ad +that is embedded in the frame's HTML page. + +------------------------------------------------------------------------------- + +3.12. I cannot see all of the "Blocked" page banner. Help. + +There is not enough available space to fit the entire Blocked page. Try right +clicking on the visible portion, and select "Show Frame", or equivalent. This +will usually allow you to see the entire Privoxy "Blocked" page, and from there +you can see just what is being blocked, and why. + +As of Privoxy 2.9.14, the Blocked banner page is re-sizeable, and tries to +adjust to the allotted space. There may be occassions where there just isn't +enough room to display much of anything useful though. + +------------------------------------------------------------------------------- + +3.13. Can Privoxy run as a service on Win2K/NT? + +Yes, it can run as a system service using srvany.exe. The only catch is that +this will effectively disable the Privoxy icon in the taskbar. You can have one +or the other, but not both at this time :( + +There is a pending feature request for this functionality. See thread: http:// +sourceforge.net/tracker/?func=detail&atid=361118&aid=485617&group_id=11118, for +details, and a sample configuration. + +------------------------------------------------------------------------------- + +3.14. How can I make Privoxy work with other proxies like Squid? + +This can be done. See the user manual, which describes how to do this. + +------------------------------------------------------------------------------- + +3.15. Can Privoxy run as a "transparent" proxy? + +No, Privoxy currently does not have this ability, though it is planned for a +future release. Transparent proxies require special handling of the request +headers beyond what Privoxy is now capable of. + +Chaining Privoxy with another proxy that has this ability should work though. +See the user manual, which describes this, and also http:// +www.transproxy.nlc.net.au/. + +------------------------------------------------------------------------------- + +4. Miscellaneous + +4.1. How much does Privoxy slow my browsing down? This has to add extra time to +browsing. + +It should not slow you down any in real terms, and may actually help speed +things up since ads, banners and other junk are not being displayed. The actual +processing time required by Privoxy itself for each page, is relatively small +in the overall scheme of things, and happens very quickly. This is typically +more than offset by time saved not downloading and rendering ad images. + +"Filtering" via the filterfile mechanism may cause a perceived slowdown, since +the entire page is buffered before displaying. See below. + +------------------------------------------------------------------------------- + +4.2. I noticed considerable delays in page requests compared to the old +Junkbuster. What's wrong? + +The entire page content must be loaded into memory in order for the filtering +mechanism to work, and nothing is sent to the browser during this time. The +loading time does not really change in real numbers, but the feeling is +different, because most browsers are able to start rendering incomplete +content, giving the user a feeling of "it works". + +To modify the content of a page (i.e. make frames resizeable again, etc.) and +not just replace ads, Privoxy needs to download the entire page first, do its +content magic and then send the page to the browser. + +------------------------------------------------------------------------------- + +4.3. What is the "http://p.p/"? + +Since Privoxy sits between your web browser and the Internet, it can be +programmed to handle certain pages specially. + +With recent versions of Privoxy (version 2.9.x and greater), you can get some +information about Privoxy and change some settings by going to http://p.p/ or, +equivalently, http://config.privoxy.org/ (Note that p.p is far easier to type +but may not work in some configurations. With the name change to Privoxy, this +is changed from the previous http://i.j.b/ and earlier 2.9.x versions). + +These pages are not forwarded to a server on the Internet - instead they are +handled by a special web server which is built in to Privoxy. + +If you are not running Privoxy, then http://p.p/ will fail, and http:// +config.privoxy.org/ will return a web page telling you you're not running +Privoxy. + +If you have version 2.0.2, then the equivalent is http://example.com/ +show-proxy-args (but you get far less information, and you should really +consider upgrading to 2.9.15). + +------------------------------------------------------------------------------- + +4.4. Do you still maintain the blocklists? + +No, not by this name. The format of the blocklists has changed significantly in +versions 2.9.x and later. This functionality is done by the "actions" file now. +See next question ... + +------------------------------------------------------------------------------- + +4.5. How can I submit new ads? + +Please see the Contact section. + +This process does not work with earlier versions of Privoxy or Junkbuster. + +------------------------------------------------------------------------------- + +4.6. How can I hide my IP address? + +You cannot hide your IP address with Privoxy or any other software, since the +server needs to know your IP address to send the answers back to you. + +Fortunately there are many publicly usable anonymous proxies out there, which +solve the problem by providing a further level of indirection between you and +the web server, shared by many people and thus letting your requests "drown" in +white noise of unrelated requests as far as user tracking is concerned. + +Most of them will, however, log your IP address and make it available to the +authorities in case you abuse that anonymity for criminal purposes. In fact you +can't even rule out that some of them only exist to *collect* information on +(those suspicious) people with a more than average preference for privacy. + +You can find a list of anonymous public proxies at multiproxy.org and many more +through Google. + +------------------------------------------------------------------------------- + +4.7. Can Privoxy guarantee I am anonymous? + +No. Your chances of remaining anonymous are greatly improved, but unless you +are an expert on Internet security it would be safest to assume that everything +you do on the Web can be traced back to you. + +Privoxy can remove various information about you, and allows you more freedom +to decide which sites you can trust, and what details you want to reveal. But +it's still possible that web sites can find out who you are. Here's one way +this can happen. + +A few browsers disclose the user's email address in certain situations, such as +when transferring a file by FTP. Privoxy does not filter FTP. If you need this +feature, or are concerned about the mail handler of your browser disclosing +your email address, you might consider products such as NSClean. + +Browsers available only as binaries could use non-standard headers to give out +any information they can have access to: see the manufacturer's license +agreement. It's impossible to anticipate and prevent every breach of privacy +that might occur. The professionally paranoid prefer browsers available as +source code, because anticipating their behavior is easier. Trust the source, +Luke! + +------------------------------------------------------------------------------- + +4.8. Might some things break because header information is being altered? + +Definitely. More and more sites use HTTP header content to decide what to +display and how to display it. There is many ways that this can be handled, so +having hard and fast rules, is tricky. + +"USER AGENT" in particular is often used in this way to identify the browser, +and adjust content accordingly. Changing this now is not recommended, since so +many sites do look for this. You may get undesirable results by changing this. + +For instance, different browsers use different encodings of Russian and Czech +characters, certain web servers convert pages on-the-fly according to the User +Agent header. Giving a "User Agent" with the wrong operating system or browser +manufacturer causes some sites in these languages to be garbled; Surfers to +Eastern European sites should change it to something closer. And then some page +access counters work by looking at the "REFERER" header; they may fail or break +if unavailable. The weather maps of Intellicast have been blocked by their +server when no "REFERER" or cookie is provided, is another example. There are +many, many other ways things can go wrong when trying to fool a web server. + +If you have problems with a site, you will have to adjust your configuration +accordingly. Cookies are probably the most likely adjustment that may be +required, but by no means the only one. + +------------------------------------------------------------------------------- + +4.9. Can Privoxy act as a "caching" proxy to speed up web browsing? + +No, it does not have this ability at all. You want something like Squid for +this. And, yes, before you ask, Privoxy can co-exist with other kinds of +proxies like Squid. + +------------------------------------------------------------------------------- + +4.10. What about as a firewall? Can Privoxy protect me? + +Not in the way you mean, or in the way a true firewall can, or a proxy that has +this specific capability. Privoxy can help protect your privacy, but not really +protect you from intrusion attempts. + +------------------------------------------------------------------------------- + +4.11. The Privoxy logo that replaces ads is very blocky and ugly looking. Can't +a better font be used? + +This is not a font problem. The logo is an image that is created by Privoxy on +the fly. So as to not waste memory, the image is rather small. The blockiness +comes when the image is scaled to fill a largish area. There is not much to be +done about this, other than to use one of the other "imageblock" directives: +pattern, blank, or a URL of your choosing. + +Given the above problem, we have decided to remove the logo option entirely [as +of v2.9.13]. + +------------------------------------------------------------------------------- + +4.12. I have large empty spaces now where ads used to be. Why? + +It would be easy enough to just eliminate this space altogether, rather than +fill it with blank space. But, this would create problems with many pages that +use the overall size of the ad to help organize the page layout and position +the various components of the page where they were intended to be. It is best +left this way. + +------------------------------------------------------------------------------- + +4.13. How can Privoxy filter Secure (HTTPS) URLs? + +This is a limitation since HTTPS transactions are encrypted SSL sessions +between your browser and the secure site, and are meant to be reliably secure +and private. This means that all cookies and HTTP header information are also +encrypted from the time they leave your browser, to the site, and vice versa. +Privoxy does not try to unencrypt this information, so it just passes through +as is. Privoxy can still catch images and ads that are embedded in the SSL +stream though. + +------------------------------------------------------------------------------- + +4.14. Privoxy runs as a "server". How secure is it? Do I need to take any +special precautions? + +There are no known exploits that might effect Privoxy. On Unix-like systems, +Privoxy can run as a non-privileged user, which is how we recommend it be run. +Also, by default Privoxy only listens to requests from "localhost". The server +aspect of Privoxy is not itself directly exposed to the Internet in this +configuration. If you want to have Privoxy serve as a LAN proxy, this will have +to be opened up to allow for LAN requests. In this case, we'd recommend you +specify only the LAN gateway address, e.g. 192.168.1.1, in the main Privoxy +config file. All LAN hosts can then use this as their proxy address in the +browser proxy configuration. In this way, Privoxy will not listen on any +external ports. Of course, a firewall is always good too. Better safe than +sorry. + +------------------------------------------------------------------------------- + +4.15. How can I temporarily disable Privoxy? + +The easiest way is to access Privoxy with your browser by using the special +URL: http://p.p/ and select "Toggle Privoxy on or off" from that page. + +------------------------------------------------------------------------------- + +4.16. Where can I find more information about Privoxy and related issues? + +Other references and sites of interest to Privoxy users: + +http://www.privoxy.org/, The Privoxy Home page. + +http://sourceforge.net/projects/ijbswa, the Project Page for Privoxy on +Sourceforge. + +http://p.p/, access Privoxy from your browser. Alternately, http:// +config.privoxy.org may work in some situations where the first does not. + +http://p.p/, and select "Privoxy - Submit Filter Feedback" to submit "misses" +to the developers. + +http://www.junkbusters.com/ht/en/cookies.html + +http://www.waldherr.org/junkbuster/ + +http://privacy.net/analyze/ + +http://www.squid-cache.org/ + + + +------------------------------------------------------------------------------- + +5. Troubleshooting + +5.1. I just upgraded and am getting "connection refused" with every web page? + +Either Privoxy is not running, or your browser is configured for a different +port than what Privoxy is using. + +The old Privoxy (and also Junkbuster) used port 8000 by default. This has been +changed to port 8118 now, due to a conflict with NAS (Network Audio Service), +which uses port 8000. If you haven't, you need to change your browser to the +new port number, or alternately change Privoxy's "listen-address" setting in +the config file used to start Privoxy. + +------------------------------------------------------------------------------- + +5.2. I just added a new rule, but the steenkin ad is still getting through. +How? + +If the ad had been displayed before you added its URL, it will probably be held +in the browser's cache for some time, so it will be displayed without the need +for any request to the server, and Privoxy will not be in the picture. The best +thing to do is try flushing the browser's caches. And then try again. + +If this doesn't help, you probably have an error in the rule you applied. Try +pasting the full URL of the offending ad into http://config.privoxy.org/ +show-url-info and see if any actions match your new rule. + +------------------------------------------------------------------------------- + +5.3. One of my favorite sites does not work with Privoxy. What can I do? + +First verify that it is indeed a Privoxy problem, by disabling Privoxy +filtering and blocking. Go to http://p.p/ and click on "Toggle Privoxy On or +Off", then disable it. Now try that page again. It's probably a good idea to +flush the browser cache as well with Shift+Reload to flush caches. + +If still a problem, go to "Show which actions apply to a URL and why" from +http://p.p/ and paste the full URL of the page in question into the prompt. See +which actions are being applied to the URL. Now, armed with this information, +go to "View & change the current configuration". Here you should see various +sections that have various Privoxy features disabled for specific sites. Most +disabled "actions" will have a "-" (minus sign) in front of them. Some aliases +are used just to disable other actions, e.g. "shop" and "fragile", and won't +necessarily use a "+" or "-" sign. Add your problem page URL to one of these +sections that looks like it is disabling the feature that is causing the +problem. Rember to flush your browser's caches when making such changes! As a +last resort, try "fragile" which disables most actions. Now re-try the page. +There might be some trial and error involved. This is discussed in more detail +in the user-manual appendix. + +Alternately, if you are comfortable with a text editor, you can accomplish the +same thing by editing the appropriate "actions" file. + +------------------------------------------------------------------------------- + +6. Contacting the developers, Bug Reporting and Feature Requests + +We value your feedback. However, to provide you with the best support, please +note the following sections. + +------------------------------------------------------------------------------- + +6.1. Get Support + +To get support, use the Sourceforge Support Forum: + + http://sourceforge.net/tracker/?group_id=11118&atid=211118 + +------------------------------------------------------------------------------- + +6.2. Report bugs + +To submit bugs, use the Sourceforge Bug Forum: + + http://sourceforge.net/tracker/?group_id=11118&atid=111118. + +Make sure that the bug has not already been submitted. Please try to verify +that it is a Privoxy bug, and not a browser or site bug first. If you are using +your own custom configuration, please try the stock configs to see if the +problem is a configuration related bug. And if not using the latest development +snapshot, please try the latest one. Or even better, CVS sources. Please be +sure to include the Privoxy version, platform, browser, any pertinent log data, +any other relevant details (please be specific) and, if possible, some way to +reproduce the bug. + +------------------------------------------------------------------------------- + +6.3. Request new features + +To submit ideas on new features, use the Sourceforge feature request forum: + + http://sourceforge.net/tracker/?atid=361118&group_id=11118&func=browse. + +------------------------------------------------------------------------------- + +6.4. Report ads or other filter problems + +You can also send feedback on websites that Privoxy has problems with. Please +bookmark the following link: "Privoxy - Submit Filter Feedback". Once you surf +to a page with problems, use the bookmark to send us feedback. We will look +into the issue as soon as possible. + +New, improved default.action files will occasionally be made available based on +your feedback. These will be announced on the ijbswa-announce list. + +------------------------------------------------------------------------------- + +6.5. Other + +For any other issues, feel free to use the mailing lists: + + http://sourceforge.net/mail/?group_id=11118. + +Anyone interested in actively participating in development and related +discussions can also join the appropriate mailing list. Archives are available, +too. See the page on Sourceforge. + +------------------------------------------------------------------------------- + +7. Privoxy Copyright, License and History + +Copyright © 2001, 2002 by Privoxy Developers + +Some source code is based on code Copyright © 1997 by Anonymous Coders and +Junkbusters, Inc. and licensed under the GNU General Public License. + +Portions of this document are "borrowed" from the original Junkbuster (tm) FAQ, +and modified as appropriate for Privoxy. + +------------------------------------------------------------------------------- + +7.1. License + +Privoxy is free software; you can redistribute it and/or modify it under the +terms of the GNU General Public License, version 2, as published by the Free +Software Foundation. + +This program is distributed in the hope that it will be useful, but WITHOUT ANY +WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A +PARTICULAR PURPOSE. See the GNU General Public License for more details, which +is available from the Free Software Foundation, Inc, 59 Temple Place - Suite +330, Boston, MA 02111-1307, USA. + +You should have received a copy of the GNU General Public License along with +this program; if not, write to the + + Free Software + Foundation, Inc. 59 Temple Place - Suite 330 + Boston, MA 02111-1307 + USA + +------------------------------------------------------------------------------- + +7.2. History + +Privoxy is evolved, and derived from, the Internet Junkbuster, with many +improvments and enhancements over the original. + +Junkbuster was originally written by Anonymous Coders and Junkbusters +Corporation, and was released as free open-source software under the GNU GPL. +Stefan Waldherr made many improvements, and started the SourceForge project +Privoxy to rekindle development. There are now several active developers +contributing. The last stable release of Junkbuster was v2.0.2, which has now +grown whiskers ;-). + diff --git a/doc/text/user-manual.txt b/doc/text/user-manual.txt new file mode 100644 index 00000000..e3566a08 --- /dev/null +++ b/doc/text/user-manual.txt @@ -0,0 +1,4396 @@ +Privoxy User Manual + +Copyright © 2001, 2002 by Privoxy Developers + +$Id: user-manual.sgml,v 1.117 2002/05/17 13:56:16 oes Exp $ + +The user manual gives users information on how to install, configure and use +Privoxy. + +Privoxy is a web proxy with advanced filtering capabilities for protecting +privacy, filtering web page content, managing cookies, controlling access, and +removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a +very flexible configuration and can be customized to suit individual needs and +tastes. Privoxy has application for both stand-alone systems and multi-user +networks. + +Privoxy is based on Internet Junkbuster (tm). + +You can find the latest version of the user manual at http://www.privoxy.org/ +user-manual/. Please see the Contact section on how to contact the developers. + +------------------------------------------------------------------------------- + +Table of Contents +1. Introduction + + 1.1. Features + +2. Installation + + 2.1. Binary Packages + + 2.1.1. Red Hat, SuSE RPMs and Conectiva + 2.1.2. Debian + 2.1.3. Windows + 2.1.4. Solaris, NetBSD, FreeBSD, HP-UX + 2.1.5. OS/2 + 2.1.6. Max OSX + 2.1.7. AmigaOS + + 2.2. Building from Source + +3. Note to Upgraders +4. Quickstart to Using Privoxy + + 4.1. Quickstart to Ad Blocking + +5. Starting Privoxy + + 5.1. RedHat, Conectiva and Debian + 5.2. SuSE + 5.3. Windows + 5.4. Solaris, NetBSD, FreeBSD, HP-UX and others + 5.5. OS/2 + 5.6. MAX OSX + 5.7. AmigaOS + 5.8. Command Line Options + +6. Privoxy Configuration + + 6.1. Controlling Privoxy with Your Web Browser + 6.2. Configuration Files Overview + +7. The Main Configuration File + + 7.1. Configuration and Log File Locations + + 7.1.1. confdir + 7.1.2. logdir + 7.1.3. actionsfile + 7.1.4. filterfile + 7.1.5. logfile + 7.1.6. jarfile + 7.1.7. trustfile + + 7.2. Local Set-up Documentation + + 7.2.1. user-manual + 7.2.2. trust-info-url + 7.2.3. admin-address + 7.2.4. proxy-info-url + + 7.3. Debugging + + 7.3.1. debug + 7.3.2. single-threaded + + 7.4. Access Control and Security + + 7.4.1. listen-address + 7.4.2. toggle + 7.4.3. enable-remote-toggle + 7.4.4. enable-edit-actions + 7.4.5. ACLs: permit-access and deny-access + 7.4.6. buffer-limit + + 7.5. Forwarding + + 7.5.1. forward + 7.5.2. forward-socks4 and forward-socks4a + 7.5.3. Advanced Forwarding Examples + + 7.6. Windows GUI Options + +8. Actions Files + + 8.1. Finding the Right Mix + 8.2. How to Edit + 8.3. How Actions are Applied to URLs + 8.4. Patterns + + 8.4.1. The Domain Pattern + 8.4.2. The Path Pattern + + 8.5. Actions + + 8.5.1. add-header + 8.5.2. block + 8.5.3. crunch-incoming-cookies + 8.5.4. crunch-outgoing-cookies + 8.5.5. deanimate-gifs + 8.5.6. downgrade-http-version + 8.5.7. fast-redirects + 8.5.8. filter + 8.5.9. handle-as-image + 8.5.10. hide-forwarded-for-headers + 8.5.11. hide-from-header + 8.5.12. hide-referrer + 8.5.13. hide-user-agent + 8.5.14. kill-popups + 8.5.15. limit-connect + 8.5.16. prevent-compression + 8.5.17. send-vanilla-wafer + 8.5.18. send-wafer + 8.5.19. session-cookies-only + 8.5.20. set-image-blocker + 8.5.21. Summary + + 8.6. Aliases + 8.7. Actions Files Tutorial + + 8.7.1. default.action + 8.7.2. user.action + +9. The Filter File + + 9.1. Filter File Tutorial + +10. Templates +11. Contacting the Developers, Bug Reporting and Feature Requests + + 11.1. Get Support + 11.2. Report Bugs + 11.3. Request New Features + 11.4. Report Ads or Other Actions-Related Problems + 11.5. Other + +12. Privoxy Copyright, License and History + + 12.1. License + 12.2. History + 12.3. Authors + +13. See Also +14. Appendix + + 14.1. Regular Expressions + 14.2. Privoxy's Internal Pages + + 14.2.1. Bookmarklets + + 14.3. Chain of Events + 14.4. Anatomy of an Action + +1. Introduction + +This documentation is included with the current beta version of Privoxy, +v.2.9.15, and is mostly complete at this point. The most up to date reference +for the time being is still the comments in the source files and in the +individual configuration files. Development of version 3.0 is currently nearing +completion, and includes many significant changes and enhancements over earlier +versions. The target release date for stable v3.0 is "soon" ;-). + +Since this is a beta version, not all new features are well tested. This +documentation may be slightly out of sync as a result (especially with CVS +sources). And there may be bugs, though hopefully not many! + +------------------------------------------------------------------------------- + +1.1. Features + +In addition to Internet Junkbuster's traditional features of ad and banner +blocking and cookie management, Privoxy provides new features, some of them +currently under development: + + * Integrated browser based configuration and control utility at http:// + config.privoxy.org/ (shortcut: http://p.p/). Browser-based tracing of rule + and filter effects. Remote toggling. + + * Web page content filtering (removes banners based on size, invisible + "web-bugs", JavaScript and HTML annoyances, pop-up windows, etc.) + + * Modularized configuration that allows for standard settings and user + settings to reside in separate files, so that installing updated actions + files won't overwrite individual user settings. + + * HTTP/1.1 compliant (but not all optional 1.1 features are supported). + + * Support for Perl Compatible Regular Expressions in the configuration files, + and generally a more sophisticated and flexible configuration syntax over + previous versions. + + * Improved cookie management features (e.g. session based cookies). + + * GIF de-animation. + + * Bypass many click-tracking scripts (avoids script redirection). + + * Multi-threaded (POSIX and native threads). + + * User-customizable HTML templates for all proxy-generated pages (e.g. + "blocked" page). + + * Auto-detection and re-reading of config file changes. + + * Improved signal handling, and a true daemon mode (Unix). + + * Every feature now controllable on a per-site or per-location basis, + configuration more powerful and versatile over-all. + + * Many smaller new features added, limitations and bugs removed, and security + holes fixed. + +------------------------------------------------------------------------------- + +2. Installation + +Privoxy is available both in convenient pre-compiled packages for a wide range +of operating systems, and as raw source code. For most users, we recommend +using the packages, which can be downloaded from our Privoxy Project Page. + +Note: If you have a previous Junkbuster or Privoxy installation on your system, +you will need to remove it. On some platforms, this may be done for you as part +of their installation procedure. (See below for your platform). In any case be +sure to backup your old configuration if it is valuable to you. See the note to +upgraders section below. + +------------------------------------------------------------------------------- + +2.1. Binary Packages + +How to install the binary packages depends on your operating system: + +------------------------------------------------------------------------------- + +2.1.1. Red Hat, SuSE RPMs and Conectiva + +RPMs can be installed with rpm -Uvh privoxy-2.9.15-1.rpm, and will use /etc/ +privoxy for the location of configuration files. + +Note that on Red Hat, Privoxy will not be automatically started on system boot. +You will need to enable that using chkconfig, ntsysv, or similar methods. Note +that SuSE will automatically start Privoxy in the boot process. + +If you have problems with failed dependencies, try rebuilding the SRC RPM: rpm +--rebuild privoxy-2.9.15-1.src.rpm;. This will use your locally installed +libraries and RPM version. + +Also note that if you have a Junkbuster RPM installed on your system, you need +to remove it first, because the packages conflict. Otherwise, RPM will try to +remove Junkbuster automatically, before installing Privoxy. + +------------------------------------------------------------------------------- + +2.1.2. Debian + +FIXME. + +------------------------------------------------------------------------------- + +2.1.3. Windows + +Just double-click the installer, which will guide you through the installation +process. You will find the configuration files in the same directory as you +installed Privoxy in. We do not use the registry of Windows. + +------------------------------------------------------------------------------- + +2.1.4. Solaris, NetBSD, FreeBSD, HP-UX + +Create a new directory, cd to it, then unzip and untar the archive. For the +most part, you'll have to figure out where things go. FIXME. + +------------------------------------------------------------------------------- + +2.1.5. OS/2 + +First, make sure that no previous installations of Junkbuster and / or Privoxy +are left on your system. You can do this by + +Then, just double-click the WarpIN self-installing archive, which will guide +you through the installation process. A shadow of the Privoxy executable will +be placed in your startup folder so it will start automatically whenever OS/2 +starts. + +The directory you choose to install Privoxy into will contain all of the +configuration files. + +------------------------------------------------------------------------------- + +2.1.6. Max OSX + +Unzip the downloaded package (you can either double-click on the file in the +finder, or on the desktop if you downloaded it there). Then, double-click on +the package installer icon and follow the installation process. Privoxy will be +installed in the subdirectory /Applications/Privoxy.app. Privoxy will set +itself up to start automatically on system bring-up via /System/Library/ +StartupItems/Privoxy. + +------------------------------------------------------------------------------- + +2.1.7. AmigaOS + +Copy and then unpack the lha archive to a suitable location. All necessary +files will be installed into Privoxy directory, including all configuration and +log files. To uninstall, just remove this directory. + +Start Privoxy (with RUN <>NIL:) in your startnet script (AmiTCP), in s: +user-startup (RoadShow), as startup program in your startup script (Genesis), +or as startup action (Miami and MiamiDx). Privoxy will automatically quit when +you quit your TCP/IP stack (just ignore the harmless warning your TCP/IP stack +may display that Privoxy is still running). + +------------------------------------------------------------------------------- + +2.2. Building from Source + +The most convenient way to obtain the Privoxy sources is to download the source +tarball from our project page. + +If you like to live on the bleeding edge and are not afraid of using possibly +unstable development versions, you can check out the up-to-the-minute version +directly from the CVS repository or simply download the nightly CVS tarball. + +To build Privoxy from source, autoconf, GNU make (gmake), and, of course, a C +compiler like gcc are required. + +When building from a source tarball (either release version or nightly CVS +tarball), first unpack the source: + + tar xzvf privoxy-2.9.15-beta-src* [.tgz or .tar.gz] + cd privoxy-2.9.15-beta + +For retrieving the current CVS sources, you'll need CVS installed. Note that +sources from CVS are development quality, and may not be stable, or well +tested. To download CVS source: + + cvs -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa login + cvs -z3 -d:pserver:anonymous@cvs.ijbswa.sourceforge.net:/cvsroot/ijbswa co current + cd current + +This will create a directory named current/, which will contain the source +tree. + +Then, in either case, to build from unpacked tarball or CVS source: + + autoheader + autoconf + ./configure # (--help to see options) + make # (the make from gnu, gmake for *BSD) + su + make -n install # (to see where all the files will go) + make install # (to really install) + +If you have gnu make, you can have the first four steps automatically done for +you by just typing: + + make + +in the freshly downloaded or unpacked source directory. + +For more detailed instructions on how to build Redhat and SuSE RPMs, Windows +self-extracting installers, building on platforms with special requirements +etc, please consult the developer manual. + +------------------------------------------------------------------------------- + +3. Note to Upgraders + +There are very significant changes from earlier Junkbuster versions to the +current Privoxy. The number, names, syntax, and purposes of configuration files +have substantially changed. Junkbuster 2.0.x configuration files will not +migrate, Junkbuster 2.9.x and Privoxy configurations will need to be ported. +The functionalities of the old blockfile, cookiefile and imagelist are now +combined into the "actions files". default.action, is the main actions file. +Local exceptions should best be put into user.action. + +A "filter file" (typically default.filter) is new as of Privoxy 2.9.x, and +provides some of the new sophistication (explained below). config is much the +same as before. + +If upgrading from a 2.0.x version, you will have to use the new config files, +and possibly adapt any personal rules from your older files. When porting +personal rules over from the old blockfile to the new actions files, please +note that even the pattern syntax has changed. If upgrading from 2.9.x +development versions, it is still recommended to use the new configuration +files. + +A quick list of things to be aware of before upgrading: + + * The default listening port is now 8118 due to a conflict with another + service (NAS). + + * Some installers may remove earlier versions completely. Save any important + configuration files! + + * Privoxy is controllable with a web browser at the special URL: http:// + config.privoxy.org/ (Shortcut: http://p.p/). Many aspects of configuration + can be done here, including temporarily disabling Privoxy. + + * The primary configuration files for cookie management, ad and banner + blocking, and many other aspects of Privoxy configuration are the actions + files. It is strongly recommended to become familiar with the new actions + concept below, before modifying these files. Locally defined rules should + go into user.action. + + * Some installers may not automatically start Privoxy after installation. + +------------------------------------------------------------------------------- + +4. Quickstart to Using Privoxy + + * If upgrading, from versions before 2.9.16, please back up any configuration + files. See the Note to Upgraders Section. + + * Install Privoxy. See the Installation Section below for platform specific + information. + + * Advanced users and those who want to offer Privoxy service to more than + just their local machine should check the main config file, especially the + security-relevant options. These are off by default. + + * Start Privoxy, if the installation program has not done this already (may + vary according to platform). See the section Starting Privoxy. + + * Set your browser to use Privoxy as HTTP and HTTPS proxy by setting the + proxy configuration for address of 127.0.0.1 and port 8118. (Junkbuster and + earlier versions of Privoxy used port 8000.) See the section Starting + Privoxy below for more details on this. + + * Flush your browser's disk and memory caches, to remove any cached ad + images. + + * A default installation should provide a reasonable starting point for most. + There will undoubtedly be occasions where you will want to adjust the + configuration, but that can be dealt with as the need arises. Little to no + initial configuration is required in most cases. + + See the Configuration section for more configuration options, and how to + customize your installation. + + * If you experience ads that slipped through, innocent images that are + blocked, or otherwise feel the need to fine-tune Privoxy's behaviour, take + a look at the actions files. As a quick start, you might find the richly + commented examples helpful. You can also view and edit the actions files + through the web-based user interface. The Appendix "Anatomy of an Action" + has hints how to debug actions that "misbehave". + + * Please see the section Contacting the Developers on how to report bugs or + problems with websites or to get help. + + * Now enjoy surfing with enhanced comfort and privacy! + +------------------------------------------------------------------------------- + +4.1. Quickstart to Ad Blocking + +Ad blocking is but one of Privoxy's array of features. Many of these features +are for the technically minded advanced user. But, ad and banner blocking is +surely common ground for everybody. + +This section will provide a quick summary of ad blocking so you can get up to +speed quickly without having to read the more extensive information provided +below, though this is highly recommeneded. + +First a bit of a warning ... blocking ads is much like blocking SPAM: the more +aggressive you are about it, the more likely you are to block things that were +not intended. So there is a trade off here. If you want extreme ad free +browsing, be prepared to deal with more "problem" sites, and to spend more time +adjusting the configuration to solve these unintended consequences. In short, +there is not an easy way to eliminate all ads. Either take the easy way and +settle for most ads blocked with the default configuration, or jump in and +tweak it for your personal surfing habits and preferences. + +Secondly, a brief explanation of Privoxy's "actions". "Actions" in this +context, are the directives we use to tell Privoxy to perform some task +relating to HTTP transactions (i.e. web browsing). We tell Privoxy to take some +"action". Each action has a unique name and function. While there are many +potential actions in Privoxy's arsenal, only a few are used for ad blocking. +Actions, and action configuration files, are explained in depth below. + +Actions are specified in Privoxy's configuration, followed by one or more URLs +to which the action should apply. URLs can actually be URL type patterns that +use wildcards so they can apply potentially to a range of similar URLs. + +When you connect to a website, the full path of the URL will either match one +of the "actions" as defined in Privoxy's configuration, or not. If so, then +Privoxy will perform the action accordingly. If not, then nothing special +happens. Futhermore, web pages may contain embedded, secondary URLs that your +web browser will display as it parses the original page's HTML content. An ad +image for instance, is just a URL embedded in the page somewhere. The image +itself may be on the same server, or a server somewhere else on the Internet. +Complex web pages will have many such embedded URLs. + +The actions we need to know about for ad blocking are: block, handle-as-image, +and set-image-blocker: + + * block - this action stops any contact between your browser and any URL + patterns that match this action's configuration. It can be used for + blocking ads, but also anything that is determined to be unwanted. By + itself, it simply stops any communication with the remote server. If this + is the only action that matches for this particular URL, then Privoxy will + display its own BLOCKED page to let you now what has happened. + + * handle-as-image - forces Privoxy to treat this URL as if it were an image. + Privoxy knows about common image types (e.g. GIF), but there are many + situations where this does not apply. So we'll force it. This is + particularly important for ad blocking, since once we can treat it as an + image, we can make more intelligent decisisions on how to handle it. There + are some limitations to this though. For instance, you can't just force an + image substituion for an entire HTML page in most situations. + + * set-image-blocker - tells Privoxy what to display in place of an ad image + that has hit a block rule. For this to come into play, the URL must match a + block action somewhere in the configuration. And, it must also either be of + a known image type, or match an handle-as-image action. + + The configuration options on what to display instead of the ad are: + + pattern - a checkboard pattern, so that an ad replacement is obvious. + This is the default. + + blank - A very small empty GIF image is displayed. This is the so-called + "invisible" configuration option. + + http:// - A redirect to any URL of the user's choosing (advanced + usage). + +The quickest way to adjust any of these settings is with your browser through +the special Privoxy editor at http://config.privoxy.org/show-status (shortcut: +http://p.p/show-status). This is an internal page, and does not require +Internet access. Select the appropriate "actions" file, and click "Edit". It is +best to put personal or local preferences in user.action since this is not +meant to be overwritten during upgrades, and will over-ride the settings in +other files. Here you can insert new "actions", and URLs for ad blocking or +other purposes, and make other adjustments to the configuration. Privoxy will +detect these changes automatically. + +A quick and simple step by step example: + + * Right click on the ad image to be blocked, then select "Copy Link Location" + from the pop-up menu. + + * Set your browser to http://config.privoxy.org/show-status + + * Find user.action in the top section, and click on "Edit": + + Figure 1. Actions Files in Use + + Screenshot of Files in Use + + * You should have an Actions section labeled +block. If not, click the "Edit" + button just under the word "Actions". This will bring up a list of all + actions. Find block near the top, and click in the "Enabled" column, then + "Submit" just below the list. + + * Now, in the +block actions section, click the "Add" button, and paste the + URL the browser got from "Copy Link Location". Remove the http:// at the + beginning of the URL. Then, click "Submit". + + * Now go back to the original page, and press SHIFT-Reload (or flush all + browser caches). The image should be gone now. + +This is a very crude and simple example. There might be good reasons to use a +wildcard pattern match to include potentially similar images from the same +site. For a more extensive explanation of "patterns", and the entire actions +concept, see the Actions section. + +For advanced users who want to hand edit their config files, you might want to +now go to the Actions Files Tutorial. + +------------------------------------------------------------------------------- + +5. Starting Privoxy + +Before launching Privoxy for the first time, you will want to configure your +browser(s) to use Privoxy as a HTTP and HTTPS proxy. The default is 127.0.0.1 +(or localhost) for the proxy address, and port 8118 (earlier versions used port +8000). This is the one configuration step that must be done! + +With Netscape (and Mozilla), this can be set under Edit -> Preferences -> +Advanced -> Proxies -> HTTP Proxy. For Internet Explorer: Tools -> Internet +Properties -> Connections -> LAN Setting. Then, check "Use Proxy" and fill in +the appropriate info (Address: 127.0.0.1, Port: 8118). Include if HTTPS proxy +support too. + +After doing this, flush your browser's disk and memory caches to force a +re-reading of all pages and to get rid of any ads that may be cached. You are +now ready to start enjoying the benefits of using Privoxy! + +Privoxy is typically started by specifying the main configuration file to be +used on the command line. If no configuration file is specified on the command +line, Privoxy will look for a file named config in the current directory. +Except on Win32 where it will try config.txt. + +------------------------------------------------------------------------------- + +5.1. RedHat, Conectiva and Debian + +We use a script. Note that RedHat does not start Privoxy upon booting per +default. It will use the file /etc/privoxy/config as its main configuration +file. FIXME: Debian?? + + # /etc/rc.d/init.d/privoxy start + +------------------------------------------------------------------------------- + +5.2. SuSE + +We use a script. It will use the file /etc/privoxy/config as its main +configuration file. Note that SuSE starts Privoxy upon booting your PC. + + # rcprivoxy start + +------------------------------------------------------------------------------- + +5.3. Windows + +Click on the Privoxy Icon to start Privoxy. If no configuration file is +specified on the command line, Privoxy will look for a file named config.txt. +Note that Windows will automatically start Privoxy upon booting you PC. + +------------------------------------------------------------------------------- + +5.4. Solaris, NetBSD, FreeBSD, HP-UX and others + +Example Unix startup command: + + # /usr/sbin/privoxy /etc/privoxy/config + +------------------------------------------------------------------------------- + +5.5. OS/2 + +FIXME. + +------------------------------------------------------------------------------- + +5.6. MAX OSX + +FIXME. + +------------------------------------------------------------------------------- + +5.7. AmigaOS + +FIXME. + +------------------------------------------------------------------------------- + +5.8. Command Line Options + +Privoxy may be invoked with the following command-line options: + + * --version + + Print version info and exit. Unix only. + + * --help + + Print short usage info and exit. Unix only. + + * --no-daemon + + Don't become a daemon, i.e. don't fork and become process group leader, and + don't detach from controlling tty. Unix only. + + * --pidfile FILE + + On startup, write the process ID to FILE. Delete the FILE on exit. Failure + to create or delete the FILE is non-fatal. If no FILE option is given, no + PID file will be used. Unix only. + + * --user USER[.GROUP] + + After (optionally) writing the PID file, assume the user ID of USER, and if + included the GID of GROUP. Exit if the privileges are not sufficient to do + so. Unix only. + + * configfile + + If no configfile is included on the command line, Privoxy will look for a + file named "config" in the current directory (except on Win32 where it will + look for "config.txt" instead). Specify full path to avoid confusion. If no + config file is found, Privoxy will fail to start. + +------------------------------------------------------------------------------- + +6. Privoxy Configuration + +All Privoxy configuration is stored in text files. These files can be edited +with a text editor. Many important aspects of Privoxy can also be controlled +easily with a web browser. + +------------------------------------------------------------------------------- + +6.1. Controlling Privoxy with Your Web Browser + +Privoxy's user interface can be reached through the special URL http:// +config.privoxy.org/ (shortcut: http://p.p/), which is a built-in page and works +without Internet access. You will see the following section: + + Privoxy Menu + ? View & change the current configuration + ? View the source code version numbers + ? View the request headers. + ? Look up which actions apply to a URL and why + ? Toggle Privoxy on or off + + +This should be self-explanatory. Note the first item leads to an editor for the +actions files, which is where the ad, banner, cookie, and URL blocking magic is +configured as well as other advanced features of Privoxy. This is an easy way +to adjust various aspects of Privoxy configuration. The actions file, and other +configuration files, are explained in detail below. + +"Toggle Privoxy On or Off" is handy for sites that might have problems with +your current actions and filters. You can in fact use it as a test to see +whether it is Privoxy causing the problem or not. Privoxy continues to run as a +proxy in this case, but all manipulation is disabled, i.e. Privoxy acts like a +normal forwarding proxy. There is even a toggle Bookmarklet offered, so that +you can toggle Privoxy with one click from your browser. + +------------------------------------------------------------------------------- + +6.2. Configuration Files Overview + +For Unix, *BSD and Linux, all configuration files are located in /etc/privoxy/ +by default. For MS Windows, OS/2, and AmigaOS these are all in the same +directory as the Privoxy executable. The name and number of configuration files +has changed from previous versions, and is subject to change as development +progresses. + +The installed defaults provide a reasonable starting point, though some +settings may be aggressive by some standards. For the time being, the principle +configuration files are: + + * The main configuration file is named config on Linux, Unix, BSD, OS/2, and + AmigaOS and config.txt on Windows. This is a required file. + + * default.action (the main actions file) is used to define which "actions" + relating to banner-blocking, images, pop-ups, content modification, cookie + handling etc should be applied by default. It also defines many exceptions + (both positive and negative) from this default set of actions that enable + Privoxy to selectively eliminate the junk, and only the junk, on as many + websites as possible. + + Multiple actions files may be defined in config. These are processed in the + order they are defined. Local customizations and locally preferred + exceptions to the default policies as defined in default.action (which you + will most probably want to define sooner or later) are probably best + applied in user.action, where you can preserve them across upgrades. + standard.action is for Privoxy's internal use. + + There is also a web based editor that can be accessed from http:// + config.privoxy.org/show-status (Shortcut: http://p.p/show-status) for the + various actions files. + + * default.filter (the filter file) can be used to re-write the raw page + content, including viewable text as well as embedded HTML and JavaScript, + and whatever else lurks on any given web page. The filtering jobs are only + pre-defined here; whether to apply them or not is up to the actions files. + +All files use the "#" character to denote a comment (the rest of the line will +be ignored) and understand line continuation through placing a backslash ("\") +as the very last character in a line. If the # is preceded by a backslash, it +looses its special function. Placing a # in front of an otherwise valid +configuration line to prevent it from being interpreted is called "commenting +out" that line. + +The actions files and default.filter can use Perl style regular expressions for +maximum flexibility. + +After making any changes, there is no need to restart Privoxy in order for the +changes to take effect. Privoxy detects such changes automatically. Note, +however, that it may take one or two additional requests for the change to take +effect. When changing the listening address of Privoxy, these "wake up" +requests must obviously be sent to the old listening address. + +While under development, the configuration content is subject to change. The +below documentation may not be accurate by the time you read this. Also, what +constitutes a "default" setting, may change, so please check all your +configuration files on important issues. + +------------------------------------------------------------------------------- + +7. The Main Configuration File + +Again, the main configuration file is named config on Linux/Unix/BSD and OS/2, +and config.txt on Windows. Configuration lines consist of an initial keyword +followed by a list of values, all separated by whitespace (any number of spaces +or tabs). For example: + + confdir /etc/privoxy + +Assigns the value /etc/privoxy to the option confdir and thus indicates that +the configuration directory is named "/etc/privoxy/". + +All options in the config file except for confdir and logdir are optional. +Watch out in the below description for what happens if you leave them unset. + +The main config file controls all aspects of Privoxy's operation that are not +location dependent (i.e. they apply universally, no matter where you may be +surfing). + +------------------------------------------------------------------------------- + +7.1. Configuration and Log File Locations + +Privoxy can (and normally does) use a number of other files for additional +configuration, help and logging. This section of the configuration file tells +Privoxy where to find those other files. + +The user running Privoxy, must have read permission for all configuration +files, and write permission to any files that would be modified, such as log +files. + +------------------------------------------------------------------------------- + +7.1.1. confdir + +Specifies: + + The directory where the other configuration files are located + +Type of value: + + Path name + +Default value: + + /etc/privoxy (Unix) or Privoxy installation dir (Windows) + +Effect if unset: + + Mandatory + +Notes: + + No trailing "/", please + + When development goes modular and multi-user, the blocker, filter, and + per-user config will be stored in subdirectories of "confdir". For now, the + configuration directory structure is flat, except for confdir/templates, + where the HTML templates for CGI output reside (e.g. Privoxy's 404 error + page). + +------------------------------------------------------------------------------- + +7.1.2. logdir + +Specifies: + + The directory where all logging takes place (i.e. where logfile and jarfile + are located) + +Type of value: + + Path name + +Default value: + + /var/log/privoxy (Unix) or Privoxy installation dir (Windows) + +Effect if unset: + + Mandatory + +Notes: + + No trailing "/", please + +------------------------------------------------------------------------------- + +7.1.3. actionsfile + +Specifies: + + The actions file(s) to use + +Type of value: + + File name, relative to confdir, without the .action suffix + +Default values: + + standard # Internal purposes, no editing recommended + + default # Main actions file + + user # User customizations + +Effect if unset: + + No actions are taken at all. Simple neutral proxying. + +Notes: + + Multiple actionsfile lines are permitted, and are in fact recommended! + + The default values include standard.action, which is used for internal + purposes and should be loaded, default.action, which is the "main" actions + file maintained by the developers, and user.action, where you can make your + personal additions. + + Actions files are where all the per site and per URL configuration is done + for ad blocking, cookie management, privacy considerations, etc. There is + no point in using Privoxy without at least one actions file. + +------------------------------------------------------------------------------- + +7.1.4. filterfile + +Specifies: + + The filter file to use + +Type of value: + + File name, relative to confdir + +Default value: + + default.filter (Unix) or default.filter.txt (Windows) + +Effect if unset: + + No textual content filtering takes place, i.e. all +filter{name} actions in + the actions files are turned neutral. + +Notes: + + The filter file contains content modification rules that use regular + expressions. These rules permit powerful changes on the content of Web + pages, e.g., you could disable your favorite JavaScript annoyances, + re-write the actual displayed text, or just have some fun replacing + "Microsoft" with "MicroSuck" wherever it appears on a Web page. + + The +filter{name} actions rely on the relevant filter (name) to be defined + in the filter file! + + A pre-defined filter file called default.filter that contains a bunch of + handy filters for common problems is included in the distribution. See the + section on the filter action for a list. + +------------------------------------------------------------------------------- + +7.1.5. logfile + +Specifies: + + The log file to use + +Type of value: + + File name, relative to logdir + +Default value: + + logfile (Unix) or privoxy.log (Windows) + +Effect if unset: + + No log file is used, all log messages go to the console (stderr). + +Notes: + + The windows version will additionally log to the console. + + The logfile is where all logging and error messages are written. The level + of detail and number of messages are set with the debug option (see below). + The logfile can be useful for tracking down a problem with Privoxy (e.g., + it's not blocking an ad you think it should block) but in most cases you + probably will never look at it. + + Your logfile will grow indefinitely, and you will probably want to + periodically remove it. On Unix systems, you can do this with a cron job + (see "man cron"). For Red Hat, a logrotate script has been included. + + On SuSE Linux systems, you can place a line like "/var/log/privoxy.* +1024k + 644 nobody.nogroup" in /etc/logfiles, with the effect that cron.daily will + automatically archive, gzip, and empty the log, when it exceeds 1M size. + + Any log files must be writable by whatever user Privoxy is being run as + (default on UNIX, user id is "privoxy"). + +------------------------------------------------------------------------------- + +7.1.6. jarfile + +Specifies: + + The file to store intercepted cookies in + +Type of value: + + File name, relative to logdir + +Default value: + + jarfile (Unix) or privoxy.jar (Windows) + +Effect if unset: + + Intercepted cookies are not stored at all. + +Notes: + + The jarfile may grow to ridiculous sizes over time. + +------------------------------------------------------------------------------- + +7.1.7. trustfile + +Specifies: + + The trust file to use + +Type of value: + + File name, relative to confdir + +Default value: + + Unset (commented out). When activated: trust (Unix) or trust.txt (Windows) + +Effect if unset: + + The whole trust mechanism is turned off. + +Notes: + + The trust mechanism is an experimental feature for building white-lists and + should be used with care. It is NOT recommended for the casual user. + + If you specify a trust file, Privoxy will only allow access to sites that + are named in the trustfile. You can also mark sites as trusted referrers + (with +), with the effect that access to untrusted sites will be granted, + if a link from a trusted referrer was used. The link target will then be + added to the "trustfile". Possible applications include limiting Internet + access for children. + + If you use + operator in the trust file, it may grow considerably over + time. + +------------------------------------------------------------------------------- + +7.2. Local Set-up Documentation + +If you intend to operate Privoxy for more users than just yourself, it might be +a good idea to let them know how to reach you, what you block and why you do +that, your policies, etc. + +------------------------------------------------------------------------------- + +7.2.1. user-manual + +Specifies: + + Location of the Privoxy User Manual. + +Type of value: + + A fully qualified URI + +Default value: + + Unset + +Effect if unset: + + http://www.privoxy.org/version/user-manual/ will be used, where version is + the Privoxy version. + +Notes: + + The User Manual URI is used for help links from some of the internal CGI + pages. The manual itself is normally packaged with the binary + distributions, so you probably want to set this to a locally installed + copy. For multi-user setups, you could provide a copy on a local webserver + for all your users and use the corresponding URL here. + + Examples: + + Unix, in local filesystem: + + user-manual file:///usr/share/doc/privoxy-2.9.15/user-manual/ + + Any platform, on local webserver (called "local-webserver"): + + user-manual http://local-webserver/privoxy-user-manual/ + + +-----------------------------------------------------------------+ + | Warning | + |-----------------------------------------------------------------| + |If set, this option should be the first option in the config | + |file, because it is used while the config file is being read. | + +-----------------------------------------------------------------+ + +------------------------------------------------------------------------------- + +7.2.2. trust-info-url + +Specifies: + + A URL to be displayed in the error page that users will see if access to an + untrusted page is denied. + +Type of value: + + URL + +Default value: + + Two example URL are provided + +Effect if unset: + + No links are displayed on the "untrusted" error page. + +Notes: + + The value of this option only matters if the experimental trust mechanism + has been activated. (See trustfile above.) + + If you use the trust mechanism, it is a good idea to write up some on-line + documentation about your trust policy and to specify the URL(s) here. Use + multiple times for multiple URLs. + + The URL(s) should be added to the trustfile as well, so users don't end up + locked out from the information on why they were locked out in the first + place! + +------------------------------------------------------------------------------- + +7.2.3. admin-address + +Specifies: + + An email address to reach the proxy administrator. + +Type of value: + + Email address + +Default value: + + Unset + +Effect if unset: + + No email address is displayed on error pages and the CGI user interface. + +Notes: + + If both admin-address and proxy-info-url are unset, the whole "Local + Privoxy Support" box on all generated pages will not be shown. + +------------------------------------------------------------------------------- + +7.2.4. proxy-info-url + +Specifies: + + A URL to documentation about the local Privoxy setup, configuration or + policies. + +Type of value: + + URL + +Default value: + + Unset + +Effect if unset: + + No link to local documentation is displayed on error pages and the CGI user + interface. + +Notes: + + If both admin-address and proxy-info-url are unset, the whole "Local + Privoxy Support" box on all generated pages will not be shown. + + This URL shouldn't be blocked ;-) + +------------------------------------------------------------------------------- + +7.3. Debugging + +These options are mainly useful when tracing a problem. Note that you might +also want to invoke Privoxy with the --no-daemon command line option when +debugging. + +------------------------------------------------------------------------------- + +7.3.1. debug + +Specifies: + + Key values that determine what information gets logged to the logfile. + +Type of value: + + Integer values + +Default value: + + 12289 (i.e.: URLs plus informational and warning messages) + +Effect if unset: + + Nothing gets logged. + +Notes: + + The available debug levels are: + + debug 1 # show each GET/POST/CONNECT request + debug 2 # show each connection status + debug 4 # show I/O status + debug 8 # show header parsing + debug 16 # log all data into the logfile + debug 32 # debug force feature + debug 64 # debug regular expression filter + debug 128 # debug fast redirects + debug 256 # debug GIF de-animation + debug 512 # Common Log Format + debug 1024 # debug kill pop-ups + debug 4096 # Startup banner and warnings. + debug 8192 # Non-fatal errors + + To select multiple debug levels, you can either add them or use multiple + debug lines. + + A debug level of 1 is informative because it will show you each request as + it happens. 1, 4096 and 8192 are highly recommended so that you will notice + when things go wrong. The other levels are probably only of interest if you + are hunting down a specific problem. They can produce a hell of an output + (especially 16). + + The reporting of fatal errors (i.e. ones which crash Privoxy) is always on + and cannot be disabled. + + If you want to use CLF (Common Log Format), you should set "debug 512" ONLY + and not enable anything else. + +------------------------------------------------------------------------------- + +7.3.2. single-threaded + +Specifies: + + Whether to run only one server thread + +Type of value: + + None + +Default value: + + Unset + +Effect if unset: + + Multi-threaded (or, where unavailable: forked) operation, i.e. the ability + to serve multiple requests simultaneously. + +Notes: + + This option is only there for debug purposes and you should never need to + use it. It will drastically reduce performance. + +------------------------------------------------------------------------------- + +7.4. Access Control and Security + +This section of the config file controls the security-relevant aspects of +Privoxy's configuration. + +------------------------------------------------------------------------------- + +7.4.1. listen-address + +Specifies: + + The IP address and TCP port on which Privoxy will listen for client + requests. + +Type of value: + + [IP-Address]:Port + +Default value: + + 127.0.0.1:8118 + +Effect if unset: + + Bind to 127.0.0.1 (localhost), port 8118. This is suitable and recommended + for home users who run Privoxy on the same machine as their browser. + +Notes: + + You will need to configure your browser(s) to this proxy address and port. + + If you already have another service running on port 8118, or if you want to + serve requests from other machines (e.g. on your local network) as well, + you will need to override the default. + + If you leave out the IP address, Privoxy will bind to all interfaces + (addresses) on your machine and may become reachable from the Internet. In + that case, consider using access control lists (ACL's) (see "ACLs" below), + or a firewall. + +Example: + + Suppose you are running Privoxy on a machine which has the address + 192.168.0.1 on your local private network (192.168.0.0) and has another + outside connection with a different address. You want it to serve requests + from inside only: + + listen-address 192.168.0.1:8118 + +------------------------------------------------------------------------------- + +7.4.2. toggle + +Specifies: + + Initial state of "toggle" status + +Type of value: + + 1 or 0 + +Default value: + + 1 + +Effect if unset: + + Act as if toggled on + +Notes: + + If set to 0, Privoxy will start in "toggled off" mode, i.e. behave like a + normal, content-neutral proxy where all ad blocking, filtering, etc are + disabled. See enable-remote-toggle below. This is not really useful + anymore, since toggling is much easier via the web interface than via + editing the conf file. + + The windows version will only display the toggle icon in the system tray if + this option is present. + +------------------------------------------------------------------------------- + +7.4.3. enable-remote-toggle + +Specifies: + + Whether or not the web-based toggle feature may be used + +Type of value: + + 0 or 1 + +Default value: + + 1 + +Effect if unset: + + The web-based toggle feature is disabled. + +Notes: + + When toggled off, Privoxy acts like a normal, content-neutral proxy, i.e. + it acts as if none of the actions applied to any URL. + + For the time being, access to the toggle feature can not be controlled + separately by "ACLs" or HTTP authentication, so that everybody who can + access Privoxy (see "ACLs" and listen-address above) can toggle it for all + users. So this option is not recommended for multi-user environments with + untrusted users. + + Note that you must have compiled Privoxy with support for this feature, + otherwise this option has no effect. + +------------------------------------------------------------------------------- + +7.4.4. enable-edit-actions + +Specifies: + + Whether or not the web-based actions file editor may be used + +Type of value: + + 0 or 1 + +Default value: + + 1 + +Effect if unset: + + The web-based actions file editor is disabled. + +Notes: + + For the time being, access to the editor can not be controlled separately + by "ACLs" or HTTP authentication, so that everybody who can access Privoxy + (see "ACLs" and listen-address above) can modify its configuration for all + users. So this option is not recommended for multi-user environments with + untrusted users. + + Note that you must have compiled Privoxy with support for this feature, + otherwise this option has no effect. + +------------------------------------------------------------------------------- + +7.4.5. ACLs: permit-access and deny-access + +Specifies: + + Who can access what. + +Type of value: + + src_addr[/src_masklen] [dst_addr[/dst_masklen]] + + Where src_addr and dst_addr are IP addresses in dotted decimal notation or + valid DNS names, and src_masklen and dst_masklen are subnet masks in CIDR + notation, i.e. integer values from 2 to 30 representing the length (in + bits) of the network address. The masks and the whole destination part are + optional. + +Default value: + + Unset + +Effect if unset: + + Don't restrict access further than implied by listen-address + +Notes: + + Access controls are included at the request of ISPs and systems + administrators, and are not usually needed by individual users. For a + typical home user, it will normally suffice to ensure that Privoxy only + listens on the localhost (127.0.0.1) or internal (home) network address by + means of the listen-address option. + + Please see the warnings in the FAQ that this proxy is not intended to be a + substitute for a firewall or to encourage anyone to defer addressing basic + security weaknesses. + + Multiple ACL lines are OK. If any ACLs are specified, then the Privoxy + talks only to IP addresses that match at least one permit-access line and + don't match any subsequent deny-access line. In other words, the last match + wins, with the default being deny-access. + + If Privoxy is using a forwarder (see forward below) for a particular + destination URL, the dst_addr that is examined is the address of the + forwarder and NOT the address of the ultimate target. This is necessary + because it may be impossible for the local Privoxy to determine the IP + address of the ultimate target (that's often what gateways are used for). + + You should prefer using IP addresses over DNS names, because the address + lookups take time. All DNS names must resolve! You can not use domain + patterns like "*.org" or partial domain names. If a DNS name resolves to + multiple IP addresses, only the first one is used. + + Denying access to particular sites by ACL may have undesired side effects + if the site in question is hosted on a machine which also hosts other + sites. + +Examples: + + Explicitly define the default behavior if no ACL and listen-address are + set: "localhost" is OK. The absence of a dst_addr implies that all + destination addresses are OK: + + permit-access localhost + + Allow any host on the same class C subnet as www.privoxy.org access to + nothing but www.example.com: + + permit-access www.privoxy.org/24 www.example.com/32 + + Allow access from any host on the 26-bit subnet 192.168.45.64 to anywhere, + with the exception that 192.168.45.73 may not access + www.dirty-stuff.example.com: + + permit-access 192.168.45.64/26 + deny-access 192.168.45.73 www.dirty-stuff.example.com + +------------------------------------------------------------------------------- + +7.4.6. buffer-limit + +Specifies: + + Maximum size of the buffer for content filtering. + +Type of value: + + Size in Kbytes + +Default value: + + 4096 + +Effect if unset: + + Use a 4MB (4096 KB) limit. + +Notes: + + For content filtering, i.e. the +filter and +deanimate-gif actions, it is + necessary that Privoxy buffers the entire document body. This can be + potentially dangerous, since a server could just keep sending data + indefinitely and wait for your RAM to exhaust -- with nasty consequences. + Hence this option. + + When a document buffer size reaches the buffer-limit, it is flushed to the + client unfiltered and no further attempt to filter the rest of the document + is made. Remember that there may be multiple threads running, which might + require up to buffer-limit Kbytes each, unless you have enabled + "single-threaded" above. + +------------------------------------------------------------------------------- + +7.5. Forwarding + +This feature allows routing of HTTP requests through a chain of multiple +proxies. It can be used to better protect privacy and confidentiality when +accessing specific domains by routing requests to those domains through an +anonymous public proxy (see e.g. http://www.multiproxy.org/anon_list.htm) Or to +use a caching proxy to speed up browsing. Or chaining to a parent proxy may be +necessary because the machine that Privoxy runs on has no direct Internet +access. + +Also specified here are SOCKS proxies. Privoxy supports the SOCKS 4 and SOCKS +4A protocols. + +------------------------------------------------------------------------------- + +7.5.1. forward + +Specifies: + + To which parent HTTP proxy specific requests should be routed. + +Type of value: + + target_domain[:port] http_parent[/port] + + Where target_domain is a domain name pattern (see the chapter on domain + matching in the default.action file), http_parent is the address of the + parent HTTP proxy as an IP addresses in dotted decimal notation or as a + valid DNS name (or "." to denote "no forwarding", and the optional port + parameters are TCP ports, i.e. integer values from 1 to 64535 + +Default value: + + Unset + +Effect if unset: + + Don't use parent HTTP proxies. + +Notes: + + If http_parent is ".", then requests are not forwarded to another HTTP + proxy but are made directly to the web servers. + + Multiple lines are OK, they are checked in sequence, and the last match + wins. + +Examples: + + Everything goes to an example anonymizing proxy, except SSL on port 443 + (which it doesn't handle): + + forward .* anon-proxy.example.org:8080 + forward :443 . + + Everything goes to our example ISP's caching proxy, except for requests to + that ISP's sites: + + forward .*. caching-proxy.example-isp.net:8000 + forward .example-isp.net . + +------------------------------------------------------------------------------- + +7.5.2. forward-socks4 and forward-socks4a + +Specifies: + + Through which SOCKS proxy (and to which parent HTTP proxy) specific + requests should be routed. + +Type of value: + + target_domain[:port] socks_proxy[/port] http_parent[/port] + + Where target_domain is a domain name pattern (see the chapter on domain + matching in the default.action file), http_parent and socks_proxy are IP + addresses in dotted decimal notation or valid DNS names (http_parent may be + "." to denote "no HTTP forwarding"), and the optional port parameters are + TCP ports, i.e. integer values from 1 to 64535 + +Default value: + + Unset + +Effect if unset: + + Don't use SOCKS proxies. + +Notes: + + Multiple lines are OK, they are checked in sequence, and the last match + wins. + + The difference between forward-socks4 and forward-socks4a is that in the + SOCKS 4A protocol, the DNS resolution of the target hostname happens on the + SOCKS server, while in SOCKS 4 it happens locally. + + If http_parent is ".", then requests are not forwarded to another HTTP + proxy but are made (HTTP-wise) directly to the web servers, albeit through + a SOCKS proxy. + +Examples: + + From the company example.com, direct connections are made to all "internal" + domains, but everything outbound goes through their ISP's proxy by way of + example.com's corporate SOCKS 4A gateway to the Internet. + + forward-socks4a .*. socks-gw.example.com:1080 www-cache.example-isp.net:8080 + forward .example.com . + + A rule that uses a SOCKS 4 gateway for all destinations but no HTTP parent + looks like this: + + forward-socks4 .*. socks-gw.example.com:1080 . + +------------------------------------------------------------------------------- + +7.5.3. Advanced Forwarding Examples + +If you have links to multiple ISPs that provide various special content only to +their subscribers, you can configure multiple Privoxies which have connections +to the respective ISPs to act as forwarders to each other, so that your users +can see the internal content of all ISPs. + +Assume that host-a has a PPP connection to isp-a.net. And host-b has a PPP +connection to isp-b.net. Both run Privoxy. Their forwarding configuration can +look like this: + +host-a: + + forward .*. . + forward .isp-b.net host-b:8118 + +host-b: + + forward .*. . + forward .isp-a.net host-a:8118 + +Now, your users can set their browser's proxy to use either host-a or host-b +and be able to browse the internal content of both isp-a and isp-b. + +If you intend to chain Privoxy and squid locally, then chain as browser -> +squid -> privoxy is the recommended way. + +Assuming that Privoxy and squid run on the same box, your squid configuration +could then look like this: + + # Define Privoxy as parent proxy (without ICP) + cache_peer 127.0.0.1 parent 8118 7 no-query + + # Define ACL for protocol FTP + acl ftp proto FTP + + # Do not forward FTP requests to Privoxy + always_direct allow ftp + + # Forward all the rest to Privoxy + never_direct allow all + +You would then need to change your browser's proxy settings to squid's address +and port. Squid normally uses port 3128. If unsure consult http_port in +squid.conf. + +------------------------------------------------------------------------------- + +7.6. Windows GUI Options + +Privoxy has a number of options specific to the Windows GUI interface: + +If "activity-animation" is set to 1, the Privoxy icon will animate when +"Privoxy" is active. To turn off, set to 0. + + activity-animation 1 + + +If "log-messages" is set to 1, Privoxy will log messages to the console window: + + log-messages 1 + + +If "log-buffer-size" is set to 1, the size of the log buffer, i.e. the amount +of memory used for the log messages displayed in the console window, will be +limited to "log-max-lines" (see below). + +Warning: Setting this to 0 will result in the buffer to grow infinitely and eat +up all your memory! + + log-buffer-size 1 + + +log-max-lines is the maximum number of lines held in the log buffer. See above. + + log-max-lines 200 + + +If "log-highlight-messages" is set to 1, Privoxy will highlight portions of the +log messages with a bold-faced font: + + log-highlight-messages 1 + + +The font used in the console window: + + log-font-name Comic Sans MS + + +Font size used in the console window: + + log-font-size 8 + + +"show-on-task-bar" controls whether or not Privoxy will appear as a button on +the Task bar when minimized: + + show-on-task-bar 0 + + +If "close-button-minimizes" is set to 1, the Windows close button will minimize +Privoxy instead of closing the program (close with the exit option on the File +menu). + + close-button-minimizes 1 + + +The "hide-console" option is specific to the MS-Win console version of Privoxy. +If this option is used, Privoxy will disconnect from and hide the command +console. + + #hide-console + + +------------------------------------------------------------------------------- + +8. Actions Files + +The actions files are used to define what actions Privoxy takes for which URLs, +and thus determine how ad images, cookies and various other aspects of HTTP +content and transactions are handled, and on which sites (or even parts +thereof). There are three such files included with Privoxy (as of version +2.9.15), with differing purposes: + + * default.action - is the primary action file that sets the initial values + for all actions. It is intended to provide a base level of functionality + for Privoxy's array of features. So it is a set of broad rules that should + work reasonably well for users everywhere. This is the file that the + developers are keeping updated, and making available to users. + + * user.action - is intended to be for local site preferences and exceptions. + As an example, if your ISP or your bank has specific requirements, and need + special handling, this kind of thing should go here. This file will not be + upgraded. + + * standard.action - is used by the web based editor, to set various + pre-defined sets of rules for the default actions section in + default.action. These have increasing levels of aggressiveness and have no + influence on your browsing unless you select them explicitly in the editor. + It is not recommend to edit this file. + +The list of actions files to be used are defined in the main configuration +file, and are processed in the order they are defined. The content of these can +all be viewed and edited from http://config.privoxy.org/show-status. + +An actions file typically has multiple sections. If you want to use "aliases" +in an actions file, you have to place the (optional) alias section at the top +of that file. Then comes the default set of rules which will apply universally +to all sites and pages (be very careful with using such a universal set in +user.action or any other actions file after default.action, because it will +override the result from consulting any previous file). And then below that, +exceptions to the defined universal policies. You can regard user.action as an +appendix to default.action, with the advantage that is a separate file, which +makes preserving your personal settings across Privoxy upgrades easier. + +Actions can be used to block anything you want, including ads, banners, or just +some obnoxious URL that you would rather not see. Cookies can be accepted or +rejected, or accepted only during the current browser session (i.e. not written +to disk), content can be modified, JavaScripts tamed, user-tracking fooled, and +much more. See below for a complete list of actions. + +------------------------------------------------------------------------------- + +8.1. Finding the Right Mix + +Note that some actions, like cookie suppression or script disabling, may render +some sites unusable that rely on these techniques to work properly. Finding the +right mix of actions is not always easy and certainly a matter of personal +taste. In general, it can be said that the more "aggressive" your default +settings (in the top section of the actions file) are, the more exceptions for +"trusted" sites you will have to make later. If, for example, you want to kill +popup windows per default, you'll have to make exceptions from that rule for +sites that you regularly use and that require popups for actually useful +content, like maybe your bank, favorite shop, or newspaper. + +We have tried to provide you with reasonable rules to start from in the +distribution actions files. But there is no general rule of thumb on these +things. There just are too many variables, and sites are constantly changing. +Sooner or later you will want to change the rules (and read this chapter again +:). + +------------------------------------------------------------------------------- + +8.2. How to Edit + +The easiest way to edit the actions files is with a browser by using our +browser-based editor, which can be reached from http://config.privoxy.org/ +show-status. The editor allows both fine-grained control over every single +feature on a per-URL basis, and easy choosing from wholesale sets of defaults +like "Cautious", "Medium" or "Advanced". + +If you prefer plain text editing to GUIs, you can of course also directly edit +the the actions files. Look at default.action which is richly commented. + +------------------------------------------------------------------------------- + +8.3. How Actions are Applied to URLs + +Actions files are divided into sections. There are special sections, like the " +alias" sections which will be discussed later. For now let's concentrate on +regular sections: They have a heading line (often split up to multiple lines +for readability) which consist of a list of actions, separated by whitespace +and enclosed in curly braces. Below that, there is a list of URL patterns, each +on a separate line. + +To determine which actions apply to a request, the URL of the request is +compared to all patterns in each action file file. Every time it matches, the +list of applicable actions for the URL is incrementally updated, using the +heading of the section in which the pattern is located. If multiple matches for +the same URL set the same action differently, the last match wins. If not, the +effects are aggregated (e.g. a URL might match both the "+handle-as-image" and +"+block" actions). + +You can trace this process for any given URL by visiting http:// +config.privoxy.org/show-url-info. + +More detail on this is provided in the Appendix, Anatomy of an Action. + +------------------------------------------------------------------------------- + +8.4. Patterns + +Generally, a pattern has the form / , where both the and + are optional. (This is why the pattern / matches all URLs). + +www.example.com/ + + is a domain-only pattern and will match any request to www.example.com, + regardless of which document on that server is requested. + +www.example.com + + means exactly the same. For domain-only patterns, the trailing / may be + omitted. + +www.example.com/index.html + + matches only the single document /index.html on www.example.com. + +/index.html + + matches the document /index.html, regardless of the domain, i.e. on any web + server. + +index.html + + matches nothing, since it would be interpreted as a domain name and there + is no top-level domain called .html. + +------------------------------------------------------------------------------- + +8.4.1. The Domain Pattern + +The matching of the domain part offers some flexible options: if the domain +starts or ends with a dot, it becomes unanchored at that end. For example: + +.example.com + + matches any domain that ENDS in .example.com + +www. + + matches any domain that STARTS with www. + +.example. + + matches any domain that CONTAINS .example. (Correctly speaking: It matches + any FQDN that contains example as a domain.) + +Additionally, there are wild-cards that you can use in the domain names +themselves. They work pretty similar to shell wild-cards: "*" stands for zero +or more arbitrary characters, "?" stands for any single character, you can +define character classes in square brackets and all of that can be freely +mixed: + +ad*.example.com + + matches "adserver.example.com", "ads.example.com", etc but not + "sfads.example.com" + +*ad*.example.com + + matches all of the above, and then some. + +.?pix.com + + matches www.ipix.com, pictures.epix.com, a.b.c.d.e.upix.com etc. + +www[1-9a-ez].example.c* + + matches www1.example.com, www4.example.cc, wwwd.example.cy, + wwwz.example.com etc., but not wwww.example.com. + +------------------------------------------------------------------------------- + +8.4.2. The Path Pattern + +Privoxy uses Perl compatible regular expressions (through the PCRE library) for +matching the path. + +There is an Appendix with a brief quick-start into regular expressions, and +full (very technical) documentation on PCRE regex syntax is available on-line +at http://www.pcre.org/man.txt. You might also find the Perl man page on +regular expressions (man perlre) useful, which is available on-line at http:// +www.perldoc.com/perl5.6/pod/perlre.html. + +Note that the path pattern is automatically left-anchored at the "/", i.e. it +matches as if it would start with a "^" (regular expression speak for the +beginning of a line). + +Please also note that matching in the path is case INSENSITIVE by default, but +you can switch to case sensitive at any point in the pattern by using the "(? +-i)" switch: www.example.com/(?-i)PaTtErN.* will match only documents whose +path starts with PaTtErN in exactly this capitalization. + +------------------------------------------------------------------------------- + +8.5. Actions + +All actions are disabled by default, until they are explicitly enabled +somewhere in an actions file. Actions are turned on if preceded with a "+", and +turned off if preceded with a "-". So a +action means "do that action", e.g. ++block means "please block URLs that match the following patterns", and -block +means "don't block URLs that match the following patterns, even if +block +previously applied." + +Again, actions are invoked by placing them on a line, enclosed in curly braces +and separated by whitespace, like in {+some-action -some-other-action +{some-parameter}}, followed by a list of URL patterns, one per line, to which +they apply. Together, the actions line and the following pattern lines make up +a section of the actions file. + +There are three classes of actions: + + * Boolean, i.e the action can only be "enabled" or "disabled". Syntax: + + +name # enable action name + -name # disable action name + + Example: +block + + * Parameterized, where some value is required in order to enable this type of + action. Syntax: + + +name{param} # enable action and set parameter to param, + # overwriting parameter from previous match if necessary + -name # disable action. The parameter can be omitted + + Note that if the URL matches multiple positive forms of a parameterized + action, the last match wins, i.e. the params from earlier matches are + simply ignored. + + Example: +hide-user-agent{ Mozilla 1.0 } + + * Multi-value. These look exactly like parameterized actions, but they behave + differently: If the action applies multiple times to the same URL, but with + different parameters, all the parameters from all matches are remembered. + This is used for actions that can be executed for the same request + repeatedly, like adding multiple headers, or filtering through multiple + filters. Syntax: + + +name{param} # enable action and add param to the list of parameters + -name{param} # remove the parameter param from the list of parameters + # If it was the last one left, disable the action. + -name # disable this action completely and remove all parameters from the list + + Examples: +add-header{X-Fun-Header: Some text} and +filter{html-annoyances} + +If nothing is specified in any actions file, no "actions" are taken. So in this +case Privoxy would just be a normal, non-blocking, non-anonymizing proxy. You +must specifically enable the privacy and blocking features you need (although +the provided default actions files will give a good starting point). + +Later defined actions always over-ride earlier ones. So exceptions to any rules +you make, should come in the latter part of the file (or in a file that is +processed later when using multiple actions files). For multi-valued actions, +the actions are applied in the order they are specified. Actions files are +processed in the order they are defined in config (the default installation has +three actions files). It also quite possible for any given URL pattern to match +more than one pattern and thus more than one set of actions! + +The list of valid Privoxy actions are: + +------------------------------------------------------------------------------- + +8.5.1. add-header + +Typical use: + + Confuse log analysis, custom applications + +Effect: + + Sends a user defined HTTP header to the web server. + +Type: + + Multi-value. + +Parameter: + + Any string value is possible. Validity of the defined HTTP headers is not + checked. It is recommended that you use the "X-" prefix for custom headers. + +Notes: + + This action may be specified multiple times, in order to define multiple + headers. This is rarely needed for the typical user. If you don't know what + "HTTP headers" are, you definitely don't need to worry about this one. + +Example usage: + + +add-header{X-User-Tracking: sucks} + +------------------------------------------------------------------------------- + +8.5.2. block + +Typical use: + + Block ads or other obnoxious content + +Effect: + + Requests for URLs to which this action applies are blocked, i.e. the + requests are not forwarded to the remote server, but answered locally with + a substitute page or image, as determined by the handle-as-image and + set-image-blocker actions. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + Privoxy sends a special "BLOCKED" page for requests to blocked pages. This + page contains links to find out why the request was blocked, and a + click-through to the blocked content (the latter only if compiled with the + force feature enabled). The "BLOCKED" page adapts to the available screen + space -- it displays full-blown if space allows, or miniaturized and + text-only if loaded into a small frame or window. If you are using Privoxy + right now, you can take a look at the "BLOCKED" page. + + A very important exception occurs if both block and handle-as-image, apply + to the same request: it will then be replaced by an image. If + set-image-blocker (see below) also applies, the type of image will be + determined by its parameter, if not, the standard checkerboard pattern is + sent. + + It is important to understand this process, in order to understand how + Privoxy deals with ads and other unwanted content. + + The filter action can perform a very similar task, by "blocking" banner + images and other content through rewriting the relevant URLs in the + document's HTML source, so they don't get requested in the first place. + Note that this is a totally different technique, and it's easy to confuse + the two. + +Example usage (section): + + {+block} # Block and replace with "blocked" page + .nasty-stuff.example.com + + {+block +handle-as-image} # Block and replace with image + .ad.doubleclick.net + .ads.r.us + +------------------------------------------------------------------------------- + +8.5.3. crunch-incoming-cookies + +Typical use: + + Prevent the web server from setting any cookies on your system + +Effect: + + Deletes any "Set-Cookie:" HTTP headers from server replies. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + This action is only concerned with incoming cookies. For outgoing cookies, + use crunch-outgoing-cookies. Use both to disable cookies completely. + + It makes no sense at all to use this action in conjunction with the + session-cookies-only action, since it would prevent the session cookies + from being set. + +Example usage: + + +crunch-incoming-cookies + +------------------------------------------------------------------------------- + +8.5.4. crunch-outgoing-cookies + +Typical use: + + Prevent the web server from reading any cookies from your system + +Effect: + + Deletes any "Cookie:" HTTP headers from client requests. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + This action is only concerned with outgoing cookies. For incoming cookies, + use crunch-incoming-cookies. Use both to disable cookies completely. + + It makes no sense at all to use this action in conjunction with the + session-cookies-only action, since it would prevent the session cookies + from being read. + +Example usage: + + +crunch-outgoing-cookies + +------------------------------------------------------------------------------- + +8.5.5. deanimate-gifs + +Typical use: + + Stop those annoying, distracting animated GIF images. + +Effect: + + De-animate GIF animations, i.e. reduce them to their first or last image. + +Type: + + Parameterized. + +Parameter: + + "last" or "first" + +Notes: + + This will also shrink the images considerably (in bytes, not pixels!). If + the option "first" is given, the first frame of the animation is used as + the replacement. If "last" is given, the last frame of the animation is + used instead, which probably makes more sense for most banner animations, + but also has the risk of not showing the entire last frame (if it is only a + delta to an earlier frame). + + You can safely use this action with patterns that will also match non-GIF + objects, because no attempt will be made at anything that doesn't look like + a GIF. + +Example usage: + + +deanimate-gifs{last} + +------------------------------------------------------------------------------- + +8.5.6. downgrade-http-version + +Typical use: + + Work around (very rare) problems with HTTP/1.1 + +Effect: + + Downgrades HTTP/1.1 client requests and server replies to HTTP/1.0. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + This is a left-over from the time when Privoxy didn't support important + HTTP/1.1 features well. It is left here for the unlikely case that you + experience HTTP/1.1 related problems with some server out there. Not all + (optional) HTTP/1.1 features are supported yet, so there is a chance you + might need this action. + +Example usage (section): + + {+downgrade-http-version} + problem-host.example.com + +------------------------------------------------------------------------------- + +8.5.7. fast-redirects + +Typical use: + + Fool some click-tracking scripts and speed up indirect links + +Effect: + + Cut off all but the last valid URL from requests. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + Many sites, like yahoo.com, don't just link to other sites. Instead, they + will link to some script on their own servers, giving the destination as a + parameter, which will then redirect you to the final target. URLs resulting + from this scheme typically look like: http://some.place/click-tracker.cgi? + target=http://some.where.else. + + Sometimes, there are even multiple consecutive redirects encoded in the + URL. These redirections via scripts make your web browsing more traceable, + since the server from which you follow such a link can see where you go to. + Apart from that, valuable bandwidth and time is wasted, while your browser + ask the server for one redirect after the other. Plus, it feeds the + advertisers. + + This feature is currently not very smart and is scheduled for improvement. + It is likely to break some sites. You should expect to need possibly many + exceptions to this action, if it is enabled by default in default.action. + Some sites just don't work without it. + +Example usage: + + {+fast-redirects} + +------------------------------------------------------------------------------- + +8.5.8. filter + +Typical use: + + Get rid of HTML and JavaScript annoyances, banner advertisements (by size), + do fun text replacements, etc. + +Effect: + + Text documents, including HTML and JavaScript, to which this action + applies, are filtered on-the-fly through the specified regular expression + based substitutions. + +Type: + + Parameterized. + +Parameter: + + The name of a filter, as defined in the filter file (typically + default.filter, set by the filterfile option in the config file) + +Notes: + + For your convenience, there are a bunch of pre-defined filters available in + the distribution filter file that you can use. See the example below for a + list. + + This is potentially a very powerful feature! But "rolling your own" filters + requires a knowledge of regular expressions and HTML. + + Filtering requires buffering the page content, which may appear to slow + down page rendering since nothing is displayed until all content has passed + the filters. (It does not really take longer, but seems that way since the + page is not incrementally displayed.) This effect will be more noticeable + on slower connections. + + At this time, Privoxy cannot (yet!) uncompress compressed documents. If you + want filtering to work on all documents, even those that would normally be + sent compressed, use the prevent-compression action in conjunction with + filter. + + Filtering can achieve some of the effects as the block action, i.e. it can + be used to block ads and banners. + + Feedback with suggestions for new or improved filters is particularly + welcome! + +Example usage (with filters from the distribution default.filter file): + + +filter{html-annoyances} # Get rid of particularly annoying HTML abuse. + + +filter{js-annoyances} # Get rid of particularly annoying JavaScript abuse + + +filter{banners-by-size} # Kill banners by size (very efficient!) + + +filter{content-cookies} # Kill cookies that come sneaking in the HTML or JS content + + +filter{popups} # Kill all popups in JS and HTML + + +filter{webbugs} # Squish WebBugs (1x1 invisible GIFs used for user tracking) + + +filter{fun} # Text replacements for subversive browsing fun! + + +filter{frameset-borders} # Give frames a border and make them resizeable + + +filter{refresh-tags} # Kill automatic refresh tags (for dial-on-demand setups) + + +filter{nimda} # Remove Nimda (virus) code. + + +filter{shockwave-flash} # Kill embedded Shockwave Flash objects + + +filter{crude-parental} # Kill all web pages that contain the words "sex" or "warez" + +------------------------------------------------------------------------------- + +8.5.9. handle-as-image + +Typical use: + + Mark URLs as belonging to images (so they'll be replaced by images if they + get blocked) + +Effect: + + This action alone doesn't do anything noticeable. It just marks URLs as + images. If the block action also applies, the presence or absence of this + mark decides whether an HTML "blocked" page, or a replacement image (as + determined by the set-image-blocker action) will be sent to the client as a + substitute for the blocked content. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + The below generic example section is actually part of default.action. It + marks all URLs with well-known image file name extensions as images and + should be left intact. + + Users will probably only want to use the handle-as-image action in + conjunction with block, to block sources of banners, whose URLs don't + reflect the file type, like in the second example section. + + Note that you cannot treat HTML pages as images in most cases. For + instance, (inline) ad frames require an HTML page to be sent, or they won't + display properly. Forcing handle-as-image in this situation will not + replace the ad frame with an image, but lead to error messages. + +Example usage (sections): + + # Generic image extensions: + # + {+handle-as-image} + /.*\.(gif|jpg|jpeg|png|bmp|ico)$ + + # These don't look like images, but they're banners and should be + # blocked as images: + # + {+block +handle-as-image} + some.nasty-banner-server.com/junk.cgi?output=trash + + # Banner source! Who cares if they also have non-image content? + ad.doubleclick.net + +------------------------------------------------------------------------------- + +8.5.10. hide-forwarded-for-headers + +Typical use: + + Improve privacy by hiding the true source of the request + +Effect: + + Deletes any existing "X-Forwarded-for:" HTTP header from client requests, + and prevents adding a new one. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + It is fairly safe to leave this on. + + This action is scheduled for improvement: It should be able to generate + forged "X-Forwarded-for:" headers using random IP addresses from a + specified network, to make successive requests from the same client look + like requests from a pool of different users sharing the same proxy. + +Example usage: + + +hide-forwarded-for-headers + +------------------------------------------------------------------------------- + +8.5.11. hide-from-header + +Typical use: + + Keep your (old and ill) browser from telling web servers your email address + +Effect: + + Deletes any existing "From:" HTTP header, or replaces it with the specified + string. + +Type: + + Parameterized. + +Parameter: + + Keyword: "block", or any user defined value. + +Notes: + + The keyword "block" will completely remove the header (not to be confused + with the block action). + + Alternately, you can specify any value you prefer to be sent to the web + server. If you do, it is a matter of fairness not to use any address that + is actually used by a real person. + + This action is rarely needed, as modern web browsers don't send "From:" + headers anymore. + +Example usage: + + +hide-from-header{block} + + or + + +hide-from-header{spam-me-senseless@sittingduck.example.com} + +------------------------------------------------------------------------------- + +8.5.12. hide-referrer + +Typical use: + + Conceal which link you followed to get to a particular site + +Effect: + + Deletes the "Referer:" (sic) HTTP header from the client request, or + replaces it with a forged one. + +Type: + + Parameterized. + +Parameter: + + + "block" to delete the header completely. + + + "forge" to pretend to be coming from the homepage of the server we are + talking to. + + + Any other string to set a user defined referrer. + +Notes: + + "forge" is the preferred option here, since some servers will not send + images back otherwise, in an attempt to prevent their valuable content from + being embedded elsewhere (and hence, without being surrounded by their + banners). + + hide-referer is an alternate spelling of hide-referrer and the two can be + can be freely substituted with each other. ("referrer" is the correct + English spelling, however the HTTP specification has a bug - it requires it + to be spelled as "referer".) + +Example usage: + + +hide-referrer{forge} + + or + + +hide-referrer{http://www.yahoo.com/} + +------------------------------------------------------------------------------- + +8.5.13. hide-user-agent + +Typical use: + + Conceal your type of browser and client operating system + +Effect: + + Replaces the value of the "User-Agent:" HTTP header in client requests with + the specified value. + +Type: + + Parameterized. + +Parameter: + + Any user-defined string. + +Notes: + + +-----------------------------------------------------------------+ + | Warning | + |-----------------------------------------------------------------| + |This breaks many web sites that depend on looking at this header | + |in order to customize their content for different browsers | + |(which, by the way, is NOT a smart way to do that!). | + +-----------------------------------------------------------------+ + + Using this action in multi-user setups or wherever different types of + browsers will access the same Privoxy is not recommended. In single-user, + single-browser setups, you might use it to delete your OS version + information from the headers, because it is an invitation to exploit known + bugs for your OS. It is also occasionally useful to forge this in order to + access sites that won't let you in otherwise (though there may be a good + reason in some cases). Example of this: some MSN sites will not let Mozilla + enter, yet forging to a Netscape 6.1 user-agent works just fine. (Must be + just a silly MS goof, I'm sure :-). + + This action is scheduled for improvement. + +Example usage: + + +hide-user-agent{Netscape 6.1 (X11; I; Linux 2.4.18 i686)} + +------------------------------------------------------------------------------- + +8.5.14. kill-popups + +Typical use: + + Eliminate those annoying pop-up windows + +Effect: + + While loading the document, replace JavaScript code that opens pop-up + windows with (syntactically neutral) dummy code on the fly. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + This action is easily confused with the built-in, hardwired filter action, + but there are important differences: For kill-popups, the document need not + be buffered, so it can be incrementally rendered while downloading. But + kill-popups doesn't catch as many pop-ups as filter{popups} does. + + Think of it as a fast and efficient replacement for a filter that you can + use if you don't want any filtering at all. Note that it doesn't make sense + to combine it with any filter action, since as soon as one filter applies, + the whole document needs to be buffered anyway, which destroys the + advantage of the kill-popups action over its filter equivalent. + + Killing all pop-ups is a dangerous business. Many shops and banks rely on + pop-ups to display forms, shopping carts etc, and killing only the unwanted + pop-ups would require artificial intelligence in Privoxy. If the only kind + of pop-ups that you want to kill are exit consoles (those really nasty + windows that appear when you close an other one), you might want to use + filter{js-annoyances} instead. + +Example usage: + + +kill-popups + +------------------------------------------------------------------------------- + +8.5.15. limit-connect + +Typical use: + + Prevent abuse of Privoxy as a TCP proxy relay + +Effect: + + Specifies to which ports HTTP CONNECT requests are allowable. + +Type: + + Parameterized. + +Parameter: + + A comma-separated list of ports or port ranges (the latter using dashes, + with the minimum defaulting to 0 and the maximum to 65K). + +Notes: + + By default, i.e. if no limit-connect action applies, Privoxy only allows + HTTP CONNECT requests to port 443 (the standard, secure HTTPS port). Use + limit-connect if more fine-grained control is desired for some or all + destinations. + + The CONNECT methods exists in HTTP to allow access to secure websites + ("https://" URLs) through proxies. It works very simply: the proxy connects + to the server on the specified port, and then short-circuits its + connections to the client and to the remote server. This can be a big + security hole, since CONNECT-enabled proxies can be abused as TCP relays + very easily. + + If you don't know what any of this means, there probably is no reason to + change this one, since the default is already very restrictive. + +Example usages: + + +limit-connect{443} # This is the default and need not be specified. + +limit-connect{80,443} # Ports 80 and 443 are OK. + +limit-connect{-3, 7, 20-100, 500-} # Ports less than 3, 7, 20 to 100 and above 500 are OK. + +limit-connect{-} # All ports are OK (gaping security hole!) + +------------------------------------------------------------------------------- + +8.5.16. prevent-compression + +Typical use: + + Ensure that servers send the content uncompressed, so it can be passed + through filters + +Effect: + + Adds a header to the request that asks for uncompressed transfer. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + More and more websites send their content compressed by default, which is + generally a good idea and saves bandwidth. But for the filter, + deanimate-gifs and kill-popups actions to work, Privoxy needs access to the + uncompressed data. Unfortunately, Privoxy can't yet(!) uncompress, filter, + and re-compress the content on the fly. So if you want to ensure that all + websites, including those that normally compress, can be filtered, you need + to use this action. + + This will slow down transfers from those websites, though. If you use any + of the above-mentioned actions, you will typically want to use + prevent-compression in conjunction with them. + + Note that some (rare) ill-configured sites don't handle requests for + uncompressed documents correctly (they send an empty document body). If you + use prevent-compression per default, you'll have to add exceptions for + those sites. See the example for how to do that. + +Example usage (sections): + + # Set default: + # + {+prevent-compression} + / # Match all sites + + # Make exceptions for ill sites: + # + {-prevent-compression} + www.debianhelp.org + www.pclinuxonline.com + +------------------------------------------------------------------------------- + +8.5.17. send-vanilla-wafer + +Typical use: + + Feed log analysis scripts with useless data. + +Effect: + + Sends a cookie with each request stating that you do not accept any + copyright on cookies sent to you, and asking the site operator not to track + you. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + The vanilla wafer is a (relatively) unique header and could conceivably be + used to track you. + + This action is rarely used and not enabled in the default configuration. + +Example usage: + + +send-vanilla-wafer + +------------------------------------------------------------------------------- + +8.5.18. send-wafer + +Typical use: + + Send custom cookies or feed log analysis scripts with even more useless + data. + +Effect: + + Sends a custom, user-defined cookie with each request. + +Type: + + Multi-value. + +Parameter: + + A string of the form "name=value". + +Notes: + + Being multi-valued, multiple instances of this action can apply to the same + request, resulting in multiple cookies being sent. + + This action is rarely used and not enabled in the default configuration. + +Example usage (section): + + {+send-wafer{UsingPrivoxy=true}} + my-internal-testing-server.void + +------------------------------------------------------------------------------- + +8.5.19. session-cookies-only + +Typical use: + + Allow only temporary "session" cookies (for the current browser session + only). + +Effect: + + Deletes the "expires" field from "Set-Cookie:" server headers. Most + browsers will not store such cookies permanently and forget them in between + sessions. + +Type: + + Boolean. + +Parameter: + + N/A + +Notes: + + This is less strict than crunch-incoming-cookies / crunch-outgoing-cookies + and allows you to browse websites that insist or rely on setting cookies, + without compromising your privacy too badly. + + Most browsers will not permanently store cookies that have been processed + by session-cookies-only and will forget about them between sessions. This + makes profiling cookies useless, but won't break sites which require + cookies so that you can log in for transactions. This is generally turned + on for all sites, and is the recommended setting. + + It makes no sense at all to use session-cookies-only together with + crunch-incoming-cookies or crunch-outgoing-cookies. If you do, cookies will + be plainly killed. + + Note that it is up to the browser how it handles such cookies without an + "expires" field. If you use an exotic browser, you might want to try it out + to be sure. + +Example usage: + + +session-cookies-only + +------------------------------------------------------------------------------- + +8.5.20. set-image-blocker + +Typical use: + + Choose the replacement for blocked images + +Effect: + + This action alone doesn't do anything noticeable. If both block and + handle-as-image also apply, i.e. if the request is to be blocked as an + image, then the parameter of this action decides what will be sent as a + replacement. + +Type: + + Parameterized. + +Parameter: + + + "pattern" to send a built-in checkerboard pattern image. The image is + visually decent, scales very well, and makes it obvious where banners + were busted. + + + "blank" to send a built-in transparent image. This makes banners + disappear completely, but makes it hard to detect where Privoxy has + blocked images on a given page and complicates troubleshooting if + Privoxy has blocked innocent images, like navigation icons. + + + "target-url" to send a redirect to target-url. You can redirect to any + image anywhere, even in your local filesystem (via "file:///" URL). + + A good application of redirects is to use special Privoxy-built-in + URLs, which send the built-in images, as target-url. This has the same + visual effect as specifying "blank" or "pattern" in the first place, + but enables your browser to cache the replacement image, instead of + requesting it over and over again. + +Notes: + + The URLs for the built-in images are "http://config.privoxy.org/ + send-banner?type=type", where type is either "blank" or "pattern". + + There is a third (advanced) type, called "auto". It is NOT to be used in + set-image-blocker, but meant for use from filters. Auto will select the + type of image that would have applied to the referring page, had it been an + image. + +Example usage: + + Built-in pattern: + + +set-image-blocker{pattern} + + Redirect to the BSD devil: + + +set-image-blocker{http://www.freebsd.org/gifs/dae_up3.gif} + + Redirect to the built-in pattern for better caching: + + +set-image-blocker{http://config.privoxy.org/send-banner?type=pattern} + +------------------------------------------------------------------------------- + +8.5.21. Summary + +Note that many of these actions have the potential to cause a page to +misbehave, possibly even not to display at all. There are many ways a site +designer may choose to design his site, and what HTTP header content, and other +criteria, he may depend on. There is no way to have hard and fast rules for all +sites. See the Appendix for a brief example on troubleshooting actions. + +------------------------------------------------------------------------------- + +8.6. Aliases + +Custom "actions", known to Privoxy as "aliases", can be defined by combining +other actions. These can in turn be invoked just like the built-in actions. +Currently, an alias name can contain any character except space, tab, "=", "{" +and "}", but we strongly recommend that you only use "a" to "z", "0" to "9", +"+", and "-". Alias names are not case sensitive, and are not required to start +with a "+" or "-" sign, since they are merely textually expanded. + +Aliases can be used throughout the actions file, but they must be defined in a +special section at the top of the file! And there can only be one such section +per actions file. Each actions file may have its own alias section, and the +aliases defined in it are only visible within that file. + +There are two main reasons to use aliases: One is to save typing for frequently +used combinations of actions, the other one is a gain in flexibility: If you +decide once how you want to handle shops by defining an alias called "shop", +you can later change your policy on shops in one place, and your changes will +take effect everywhere in the actions file where the "shop" alias is used. +Calling aliases by their purpose also makes your actions files more readable. + +Currently, there is one big drawback to using aliases, though: Privoxy's +built-in web-based action file editor honors aliases when reading the actions +files, but it expands them before writing. So the effects of your aliases are +of course preserved, but the aliases themselves are lost when you edit sections +that use aliases with it. This is likely to change in future versions of +Privoxy. + +Now let's define some aliases... + + # Useful custom aliases we can use later. + # + # Note the (required!) section header line and that this section + # must be at the top of the actions file! + # + {{alias}} + + # These aliases just save typing later: + # (Note that some already use other aliases!) + # + +crunch-all-cookies = +crunch-incoming-cookies +crunch-outgoing-cookies + -crunch-all-cookies = -crunch-incoming-cookies -crunch-outgoing-cookies + block-as-image = +block +handle-as-image + mercy-for-cookies = -crunch-all-cookies -session-cookies-only + + # These aliases define combinations of actions + # that are useful for certain types of sites: + # + fragile = -block -crunch-all-cookies -filter -fast-redirects -hide-referer -kill-popups + shop = -crunch-all-cookies -filter{popups} -kill-popups + + # Short names for other aliases, for really lazy people ;-) + # + c0 = +crunch-all-cookies + c1 = -crunch-all-cookies + +...and put them to use. These sections would appear in the lower part of an +actions file and define exceptions to the default actions (as specified further +up for the "/" pattern): + + # These sites are either very complex or very keen on + # user data and require minimal interference to work: + # + {fragile} + .office.microsoft.com + .windowsupdate.microsoft.com + .nytimes.com + + # Shopping sites: + # Allow cookies (for setting and retrieving your customer data) + # + {shop} + .quietpc.com + .worldpay.com # for quietpc.com + .scan.co.uk + + # These shops require pop-ups: + # + {shop -kill-popups -filter{popups}} + .dabs.com + .overclockers.co.uk + +Aliases like "shop" and "fragile" are often used for "problem" sites that +require some actions to be disabled in order to function properly. + +------------------------------------------------------------------------------- + +8.7. Actions Files Tutorial + +The above chapters have shown which actions files there are and how they are +organized, how actions are specified and applied to URLs, how patterns work, +and how to define and use aliases. Now, let's look at an example default.action +and user.action file and see how all these pieces come together: + +------------------------------------------------------------------------------- + +8.7.1. default.action + +Every config file should start with a short comment stating its purpose: + +# Sample default.action file + +Then, since this is the default.action file, the first section is a special +section for internal use that you needn't change or worry about: + +########################################################################## +# Settings -- Don't change! For internal Privoxy use ONLY. +########################################################################## + +{{settings}} +for-privoxy-version=3.0 + +After that comes the (optional) alias section. We'll use the example section +from the above chapter on aliases, that also explains why and how aliases are +used: + +########################################################################## +# Aliases +########################################################################## +{{alias}} + +# These aliases just save typing later: +# (Note that some already use other aliases!) +# ++crunch-all-cookies = +crunch-incoming-cookies +crunch-outgoing-cookies +-crunch-all-cookies = -crunch-incoming-cookies -crunch-outgoing-cookies +block-as-image = +block +handle-as-image +mercy-for-cookies = -crunch-all-cookies -session-cookies-only + +# These aliases define combinations of actions +# that are useful for certain types of sites: +# +fragile = -block -crunch-all-cookies -filter -fast-redirects -hide-referer -kill-popups +shop = mercy-for-cookies -filter{popups} -kill-popups + +Now come the regular sections, i.e. sets of actions, accompanied by URL +patterns to which they apply. Remember all actions are disabled when matching +starts, so we have to explicitly enable the ones we want. + +The first regular section is probably the most important. It has only one +pattern, "/", but this pattern matches all URLs.. Therefore, the set of actions +used in this "default" section will be applied to all requests as a start. It +can be partly or wholly overridden by later matches further down this file, or +in user.action, but it will still be largely responsible for your overall +browsing experience. + +Again, at the start of matching, all actions are disabled, so there is no real +need to disable any actions here, but we will do that nonetheless, to have a +complete listing for your reference. (Remember: A "+" preceding the action name +enables the action, a "-" disables!). Also note how this long line has been +made more readable by splitting it into multiple lines with line continuation. + +########################################################################## +# "Defaults" section: +########################################################################## + { \ + -add-header \ + -block \ + -crunch-incoming-cookies \ + -crunch-outgoing-cookies \ + +deanimate-gifs \ + -downgrade-http-version \ + +fast-redirects \ + +filter{html-annoyances} \ + +filter{js-annoyances} \ + -filter{content-cookies} \ + +filter{popups} \ + +filter{webbugs} \ + -filter{refresh-tags} \ + -filter{fun} \ + +filter{nimda} \ + +filter{banners-by-size} \ + -filter{shockwave-flash} \ + -filter{crude-parental} \ + -handle-as-image \ + +hide-forwarded-for-headers \ + +hide-from-header{block} \ + +hide-referrer{forge} \ + -hide-user-agent \ + -kill-popups \ + -limit-connect \ + +prevent-compression \ + -send-vanilla-wafer \ + -send-wafer \ + +session-cookies-only \ + +set-image-blocker{pattern} \ + } + / # forward slash will match *all* potential URL patterns. + +The default behavior is now set. Note that some actions, like not hiding the +user agent, are part of a "general policy" that applies universally and won't +get any exceptions defined later. Other choices, like not blocking (which is +understandably the default!) need exceptions, i.e. we need to specify +explicitly what we want to block in later sections. We will also want to make +exceptions from our general pop-up-killing, and use our defined aliases for +that. + +The first of our specialized sections is concerned with "fragile" sites, i.e. +sites that require minimum interference, because they are either very complex +or very keen on tracking you (and have mechanisms in place that make them +unusable for people who avoid being tracked). We will simply use our +pre-defined fragile alias instead of stating the list of actions explicitly: + +########################################################################## +# Exceptions for sites that'll break under the default action set: +########################################################################## + +# "Fragile" Use a minimum set of actions for these sites (see alias above): +# +{ fragile } +.office.microsoft.com # surprise, surprise! +.windowsupdate.microsoft.com + +Shopping sites are not as fragile, but they typically require cookies to log +in, and pop-up windows for shopping carts or item details. Again, we'll use a +pre-defined alias: + +# Shopping sites: +# +{ shop } +.quietpc.com +.worldpay.com # for quietpc.com +.jungle.com +.scan.co.uk + +Then, there are sites which rely on pop-up windows (yuck!) to work. Since we +made pop-up-killing our default above, we need to make exceptions now. Mozilla +users, who can turn on smart handling of unwanted pop-ups in their browsers, +can safely choose -filter{popups} (and -kill-popups) above and hence don't need +this section. Anyway, disabling an already disabled action doesn't hurt, so +we'll define our exceptions regardless of what was chosen in the defaults +section: + +# These sites require pop-ups too :( +# +{ -kill-popups -filter{popups} } +.dabs.com +.overclockers.co.uk +.deutsche-bank-24.de + +The fast-redirects action, which we enabled per default above, breaks some +sites. So disable it for popular sites where we know it misbehaves: + +{ -fast-redirects } +login.yahoo.com +edit.*.yahoo.com +.google.com +.altavista.com/.*(like|url|link):http +.altavista.com/trans.*urltext=http +.nytimes.com + +It is important that Privoxy knows which URLs belong to images, so that if they +are to be blocked, a substitute image can be sent, rather than an HTML page. +Contacting the remote site to find out is not an option, since it would destroy +the loading time advantage of banner blocking, and it would feed the +advertisers (in terms of money and information). We can mark any URL as an +image with the handle-as-image action, and marking all URLs that end in a known +image file extension is a good start: + +########################################################################## +# Images: +########################################################################## + +# Define which file types will be treated as images, in case they get +# blocked further down this file: +# +{ +handle-as-image } +/.*\.(gif|jpe?g|png|bmp|ico)$ + +And then there are known banner sources. They often use scripts to generate the +banners, so it won't be visible from the URL that the request is for an image. +Hence we block them and mark them as images in one go, with the help of our +block-as-image alias defined above. (We could of course just as well use +block ++handle-as-image here.) Remember that the type of the replacement image is +chosen by the set-image-blocker action. Since all URLs have matched the default +section with its +set-image-blocker{pattern} action before, it still applies +and needn't be repeated: + +# Known ad generators: +# +{ block-as-image } +ar.atwola.com +.ad.doubleclick.net +.ad.*.doubleclick.net +.a.yimg.com/(?:(?!/i/).)*$ +.a[0-9].yimg.com/(?:(?!/i/).)*$ +bs*.gsanet.com +bs*.einets.com +.qkimg.net + +One of the most important jobs of Privoxy is to block banners. A huge bunch of +them are already "blocked" by the filter{banners-by-size} action, which we +enabled above, and which deletes the references to banner images from the pages +while they are loaded, so the browser doesn't request them anymore, and hence +they don't need to be blocked here. But this naturally doesn't catch all +banners, and some people choose not to use filters, so we need a comprehensive +list of patterns for banner URLs here, and apply the block action to them. + +First comes a bunch of generic patterns, which do most of the work, by matching +typical domain and path name components of banners. Then comes a list of +individual patterns for specific sites, which is omitted here to keep the +example short: + +########################################################################## +# Block these fine banners: +########################################################################## +{ +block } + +# Generic patterns: +# +ad*. +.*ads. +banner?. +count*. +/.*count(er)?\.(pl|cgi|exe|dll|asp|php[34]?) +/(?:.*/)?(publicite|werbung|rekla(ma|me|am)|annonse|maino(kset|nta|s)?)/ + +# Site-specific patterns (abbreviated): +# +.hitbox.com + +You wouldn't believe how many advertisers actually call their banner servers +ads.company.com, or call the directory in which the banners are stored simply +"banners". So the above generic patterns are surprisingly effective. + +But being very generic, they necessarily also catch URLs that we don't want to +block. The pattern .*ads. e.g. catches "nasty-ads.nasty-corp.com" as intended, +but also "downloads.sourcefroge.net" or "adsl.some-provider.net." So here come +some well-known exceptions to the +block section above. + +Note that these are exceptions to exceptions from the default! Consider the URL +"downloads.sourcefroge.net": Initially, all actions are deactivated, so it +wouldn't get blocked. Then comes the defaults section, which matches the URL, +but just deactivates the block action once again. Then it matches .*ads., an +exception to the general non-blocking policy, and suddenly +block applies. And +now, it'll match .*loads., where -block applies, so (unless it matches again +further down) it ends up with no block action applying. + +########################################################################## +# Save some innocent victims of the above generic block patterns: +########################################################################## + +# By domain: +# +{ -block } +adv[io]*. # (for advogato.org and advice.*) +adsl. # (has nothing to do with ads) +ad[ud]*. # (adult.* and add.*) +.edu # (universities don't host banners (yet!)) +.*loads. # (downloads, uploads etc) + +# By path: +# +/.*loads/ + +# Site-specific: +# +www.globalintersec.com/adv # (adv = advanced) +www.ugu.com/sui/ugu/adv + +Filtering source code can have nasty side effects, so make an exception for our +friends at sourceforge.net, and all paths with "cvs" in them. Note that -filter +disables all filters in one fell swoop! + +# Don't filter code! +# +{ -filter } +/.*cvs +.sourceforge.net + +The actual default.action is of course more comprehensive, but we hope this +example made clear how it works. + +------------------------------------------------------------------------------- + +8.7.2. user.action + +So far we are painting with a broad brush by setting general policies, which +would be a reasonable starting point for many people. Now, you'd maybe want to +be more specific and have customized rules that are more suitable to your +personal habits and preferences. These would be for narrowly defined situations +like your ISP or your bank, and should be placed in user.action, which is +parsed after all other actions files and hence has the last word, over-riding +any previously defined actions. user.action is also a safe place for your +personal settings, since default.action is actively maintained by the Privoxy +developers and you'll probably want to install updated versions from time to +time. + +So let's look at a few examples of things that one might typically do in +user.action: + +# My user.action file. + +As aliases are local to the actions file that they are defined in, you can't +use the ones from default.action, unless you repeat them here: + +# (Re-)define aliases for this file: +# +{{alias}} +-crunch-all-cookies = -crunch-incoming-cookies -crunch-outgoing-cookies +mercy-for-cookies = -crunch-all-cookies -session-cookies-only +fragile = -block -crunch-all-cookies -filter -fast-redirects -hide-referer -kill-popups +shop = mercy-for-cookies -filter{popups} -kill-popups +allow-ads = -block -filter{banners-by-size} # (see below) + +Say you have accounts on some sites that you visit regularly, and you don't +want to have to log in manually each time. So you'd like to allow persistent +cookies for these sites. The mercy-for-cookies alias defined above does exactly +that, i.e. it disables crunching of cookies in any direction, and processing of +cookies to make them temporary. + +{ mercy-for-cookies } +sunsolve.sun.com +slashdot.org +.yahoo.com +.msdn.microsoft.com +.redhat.com + +Your bank needs popups and is allergic to some filter, but you don't know +which, so you disable them all: + +{ -filter -kill-popups } +.your-home-banking-site.com + +While browsing the web with Privoxy you noticed some ads that sneaked through, +but you were too lazy to report them through our fine and easy feedback system, +so you have added them here: + +{ +block } +www.a-popular-site.com/some/unobvious/path +another.popular.site.net/more/junk/here/ + +Note that, assuming the banners in the above example have regular image +extensions (most do), +handle-as-image need not be specified, since all URLs +ending in these extensions will already have been tagged as images in the +relevant section of default.action by now. + +Then you noticed that the default configuration breaks Forbes Magazine, but you +were too lazy to find out which action is the culprit, and you were again too +lazy to give feedback, so you just used the fragile alias on the site, and -- +whoa! -- it worked: + +{ fragile } +.forbes.com + +You like the "fun" text replacements in default.filter, but it is disabled in +the distributed actions file. (My colleagues on the team just don't have a +sense of humour, that's why! ;-). So you'd like to turn it on in your private, +update-safe config, once and for all: + +{ +filter{fun} } +/ # For ALL sites! + +Note that the above is not really a good idea: There are exceptions to the +filters in default.action for things that really shouldn't be filtered, like +code on CVS->Web interfaces. Since user.action has the last word, these +exceptions won't be valid for the "fun" filtering specified here. + +Finally, you might think about how your favourite free websites are funded, and +find that they rely on displaying banner advertisements to survive. So you +might want to specifically allow banners for those sites that you feel provide +value to you: + +{ allow-ads } +.sourceforge.net +.slashdot.org +.osdn.net + +Note that allow-ads has been aliased to -block -filter{banners-by-size} above. + +------------------------------------------------------------------------------- + +9. The Filter File + +All text substitutions that can be invoked through the filter action must first +be defined in the filter file, which is typically called default.filter and +which can be selected through the filterfile config option. + +Typical reasons for doing such substitutions are to eliminate common annoyances +in HTML and JavaScript, such as pop-up windows, exit consoles, crippled windows +without navigation tools, the infamous tag etc, to suppress images with +certain width and height attributes (standard banner sizes or web-bugs), or +just to have fun. The possibilities are endless. + +Filtering works on any text-based document type, including plain text, HTML, +JavaScript, CSS etc. (all text/* MIME types). Substitutions are made at the +source level, so if you want to "roll your own" filters, you should be familiar +with HTML syntax. + +Just like the actions files, the filter file is organized in sections, which +are called filters here. Each filter consists of a heading line, that starts +with the keyword FILTER:, followed by the filter's name, and a short (one line) +description of what it does. Below that line come the jobs, i.e. lines that +define the actual text substitutions. By convention, the name of a filter +should describe what the filter eliminates. The comment is used in the +web-based user interface. + +Once a filter called name has been defined in the filter file, it can be +invoked by using an action of the form +filter{name} in any actions file. + +A filter header line for a filter called "foo" could look like this: + +FILTER: foo Replace all "foo" with "bar" + +Below that line, and up to the next header line, come the jobs that define what +text replacements the filter executes. They are specified in a syntax that +imitates Perl's s/// operator. If you are familiar with Perl, you will find +this to be quite intuitive, and may want to look at the PCRS man page for the +subtle differences to Perl behaviour. Most notably, the non-standard option +letter U is supported, which turns the default to ungreedy matching. + +If you are new to regular expressions, you might want to take a look at the +Appendix on regular expressions, and see the Perl manual for the s/// +operator's syntax and Perl-style regular expressions in general. The below +examples might also help to get you started. + +------------------------------------------------------------------------------- + +9.1. Filter File Tutorial + +Now, let's complete our "foo" filter. We have already defined the heading, but +the jobs are still missing. Since all it does is to replace "foo" with "bar", +there is only one (trivial) job needed: + +s/foo/bar/ + +But wait! Didn't the comment say that all occurrences of "foo" should be +replaced? Our current job will only take care of the first "foo" on each page. +For global substitution, we'll need to add the g option: + +s/foo/bar/g + +Our complete filter now looks like this: + +FILTER: foo Replace all "foo" with "bar" +s/foo/bar/g + +Let's look at some real filters for more interesting examples. Here you see a +filter that protects against some common annoyances that arise from JavaScript +abuse. Let's look at its jobs one after the other: + +FILTER: js-annoyances Get rid of particularly annoying JavaScript abuse + +# Get rid of JavaScript referrer tracking. Test page: http://www.randomoddness.com/untitled.htm +# +s|( )|$1"Not Your Business!"$2|Usg + +Following the header line and a comment, you see the job. Note that it uses | +as the delimiter instead of /, because the pattern contains a forward slash, +which would otherwise have to be escaped by a backslash (\). + +Now, let's examine the pattern: it starts with the text tag. + +That's more than we want, but the pattern continues: document\.referrer matches +only the exact string "document.referrer". The dot needed to be escaped, i.e. +preceded by a backslash, to take away its special meaning as a joker, and make +it just a regular dot. So far, the meaning is: Match from the start of the +first . You already know what .* means, so the whole +pattern translates to: Match from the start of the first " tag. Furthermore, the s +option says that the match may span multiple lines in the page, and the g +option again means that the substitution is global. + +So, to summarize, the pattern means: Match all scripts that contain the text +"document.referrer". Remember the parts of the script from (and including) the +start tag up to (and excluding) the string "document.referrer" as $1, and the +part following that string, up to and including the closing tag, as $2. + +Now the pattern is deciphered, but wasn't this about substituting things? So +lets look at the substitute: $1"Not Your Business!"$2 is easy to read: The text +remembered as $1, followed by "Not Your Business!" (including the quotation +marks!), followed by the text remembered as $2. This produces an exact copy of +the original string, with the middle part (the "document.referrer") replaced by +"Not Your Business!". + +The whole job now reads: Replace "document.referrer" by "Not Your Business!" +wherever it appears inside a + +]*?src=[\'"]?(.*?)[\'" >]|i', $page, $matches); + + foreach (array_unique($matches[1]) as $image_link) + { + $result[] = link_to_absolute($url, $image_link); + } + + return count($result) ? $result : 0; +} + +/* + * Function: get_image_urls + * + * Purpose: If the page is a frameset, rerurn the image URLs from all + * its frame SRCes, else from the page itself. + */ +function get_image_urls($page, $url) +{ + + preg_match_all('|]*?src=[\'"]?(.*?)[\'" >]|i', $page, $matches); + + if (count($matches[1])) + { + foreach(array_unique($matches[1]) as $frame_link) + { + $framebuf = slurp_page(link_to_absolute($url, $frame_link)); + $result = array_merge($result, get_image_urls_sp($framebuf, link_to_absolute($url, $frame_link))); + } + } + else + { + $result = get_image_urls_sp($page, $url); + } + + return array_values(array_unique($result)); +} + + +/* + * Function: error_abort + * Purpose: Return an error page with $title and $message + */ +function error_abort($title, $message) +{ + if ($title == "invalid") /* shortcut */ + { + $title = "Invalid Feedback Submission"; + } + + echo (" Privoxy: $title + + ++++ Privoxy: $title +
++ ++ $message ++Valid HTML 4.01 Transitional
+ +