From f903dd17a79cbafcff8610a7025b027af7991467 Mon Sep 17 00:00:00 2001 From: Fabian Keil Date: Thu, 22 Mar 2007 14:10:59 +0000 Subject: [PATCH] - Fix minor mistakes and add some details. - Document "enforce-blocks". - Stop calling HTTP proxies anon proxies and give examples how parent proxies can decrease the user's privacy level. --- doc/source/p-config.sgml | 164 +++++++++++++++++++++++++++++++-------- 1 file changed, 131 insertions(+), 33 deletions(-) diff --git a/doc/source/p-config.sgml b/doc/source/p-config.sgml index 90369627..78019823 100644 --- a/doc/source/p-config.sgml +++ b/doc/source/p-config.sgml @@ -3,9 +3,9 @@ Purpose : Used with other docs and files only. - $Id: p-config.sgml,v 2.12 2006/09/22 01:27:55 hal9 Exp $ + $Id: p-config.sgml,v 2.13 2007/01/27 13:13:44 fabiankeil Exp $ - Copyright (C) 2001-2007 Privoxy Developers http://www.privoxy.org + Copyright (C) 2001-2007 Privoxy Developers http://www.privoxy.org/ See LICENSE. ======================================================================== @@ -95,10 +95,10 @@ Sample Configuration File for Privoxy v&p-version; - $Id: p-config.sgml,v 2.12 2006/09/22 01:27:55 hal9 Exp $ + $Id: p-config.sgml,v 2.13 2007/01/27 13:13:44 fabiankeil Exp $ -Copyright (C) 2001-2006 Privoxy Developers http://privoxy.org +Copyright (C) 2001-2007 Privoxy Developers http://www.privoxy.org/ @@ -125,15 +125,21 @@ Copyright (C) 2001-2006 Privoxy Developers http://privoxy.org =============== - This file holds the Privoxy configuration. If you modify this - file, you will need to send a couple of requests (of any kind) to the proxy - before any changes take effect. + This file holds Privoxy's main configuration. Privoxy detects + configuration changes automatically, so you don't have to restart it + unless you want to load a different configuration file. - When starting Privoxy on Unix systems, give the name of this - file as an argument. On Windows systems, Privoxy will look for - this file with the name 'config.txt' in the same directory where - Privoxy is installed. + The configuration will be reloaded with the first request after the + change was done, this request itself will still use the old configuration, + though. In other words: it takes two requests before you see the result of + your changes. Requests that are dropped due to ACL don't trigger reloads. + + + When starting Privoxy on Unix systems, give the location of this + file as last argument. On Windows systems, Privoxy will look for + this file with the name 'config.txt' in the current working directory + of the Privoxy process. @@ -160,10 +166,11 @@ II. FORMAT OF THE CONFIGURATION FILE Thus, by placing a # at the start of an existing configuration line, you can make it a comment and it will be treated as if it weren't there. - This is called "commenting out" an option and can be useful. + This is called "commenting out" an option and can be useful. Removing + the # again is called "uncommenting". - Note that commenting out and option and leaving it at its default + Note that commenting out an option and leaving it at its default are two completely different things! Most options behave very differently when unset. See the the "Effect if unset" explanation in each option's description for details. @@ -1041,9 +1048,9 @@ actionsfile debug 2 # show each connection status debug 4 # show I/O status debug 8 # show header parsing - debug 16 # log all data into the logfile + debug 16 # log all data written to the network into the logfile debug 32 # debug force feature - debug 64 # debug regular expression filter + debug 64 # debug regular expression filters debug 128 # debug redirects debug 256 # debug GIF de-animation debug 512 # Common Log Format @@ -1066,13 +1073,18 @@ actionsfile - The reporting of fatal errors (i.e. ones which crash - Privoxy) is always on and cannot be disabled. + The reporting of fatal errors (i.e. ones which causes + Privoxy to exit) is always on and cannot be disabled. If you want to use CLF (Common Log Format), you should set debug 512 ONLY and not enable anything else. + + Privoxy has a hard-coded limit for the + length of log messages. If it's reached, messages are logged truncated + and marked with ... [too long, truncated]. + @@ -1267,8 +1279,8 @@ actionsfile If set to 0, Privoxy will start in - toggled off mode, i.e. behave like a normal, content-neutral - proxy where all ad blocking, filtering, etc are disabled. See + toggled off mode, i.e. mostly behave like a normal, + content-neutral proxy where all ad blocking, filtering, etc are disabled. See enable-remote-toggle below. This is not really useful anymore, since toggling is much easier via the web interface than via @@ -1322,7 +1334,7 @@ actionsfile Notes: - When toggled off, Privoxy acts like a normal, + When toggled off, Privoxy mostly acts like a normal, content-neutral proxy, i.e. it acts as if none of the actions applied to any URL. @@ -1454,6 +1466,81 @@ actionsfile @@enable-edit-actions 1]]> + +enforce-blocks + + + Specifies: + + + Whether the user is allowed to ignore blocks and can go there anyway. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + 0 + + + + Effect if unset: + + + Blocks are not enforced. + + + + + Notes: + + + Privoxy is mainly used to block and filter + requests as a service to the user, for example to block ads and other + junk that clogs the pipes. Privoxy's configuration + isn't perfect and sometimes innocent pages are blocked. In this situation it + makes sense to allow the user to enforce the request and have + Privoxy ignore the block. + + + In the default configuration Privoxy's + Blocked page contains a go there anyway + link to adds a special string (the force prefix) to the request URL. + If that link is used, Privoxy will + detect the force prefix, remove it again and let the request pass. + + + Of course Privoxy can also be used to enforce + a network policy. In that case the user obviously should not be able to + bypass any blocks, and that's what the enforce-blocks + option is for. If it's enabled, Privoxy hides + the go there anyway link. If the user adds the force + prefix by hand, it will not be accepted and the circumvention attempt + is logged. + + + + + Examples: + + + enforce-blocks 1 + + + + +@@enforce-blocks 0]]> + + + ACLs: permit-access and deny-access @@ -1519,8 +1606,8 @@ ACLs: permit-access and deny-access Multiple ACL lines are OK. - If any ACLs are specified, then the Privoxy - talks only to IP addresses that match at least one permit-access line + If any ACLs are specified, Privoxy only talks + to IP addresses that match at least one permit-access line and don't match any subsequent deny-access line. In other words, the last match wins, with the default being deny-access. @@ -1540,7 +1627,8 @@ ACLs: permit-access and deny-access Denying access to particular sites by ACL may have undesired side effects - if the site in question is hosted on a machine which also hosts other sites. + if the site in question is hosted on a machine which also hosts other sites + (most sites are). @@ -1560,7 +1648,7 @@ ACLs: permit-access and deny-access Allow any host on the same class C subnet as www.privoxy.org access to - nothing but www.example.com: + nothing but www.example.com (or other domains hosted on the same system): @@ -1569,7 +1657,8 @@ ACLs: permit-access and deny-access Allow access from any host on the 26-bit subnet 192.168.45.64 to anywhere, - with the exception that 192.168.45.73 may not access www.dirty-stuff.example.com: + with the exception that 192.168.45.73 may not access the IP address behind + www.dirty-stuff.example.com: @@ -1654,11 +1743,20 @@ ACLs: permit-access and deny-access This feature allows routing of HTTP requests through a chain of multiple proxies. - It can be used to better protect privacy and confidentiality when - accessing specific domains by routing requests to those domains - through an anonymous public proxy. Or to use a caching proxy to speed up browsing. Or chaining to a parent - proxy may be necessary because the machine that Privoxy - runs on has no direct Internet access. + + + Forwarding can be used to chain Privoxy with a caching proxy to speed + up browsing. Using a parent proxy may also be necessary if the machine + that Privoxy runs on has no direct Internet access. + + + Note that parent proxies can severely decrease your privacy level. + For example a parent proxy could add your IP address to the request + headers and if it's a caching proxy it may add the Etag + header to revalidation requests again, even though you configured Privoxy + to remove it. It may also ignore Privoxy's header time randomization and use the + original values which could be used by the server as cookie replacement + to track your steps between visits. @@ -1724,11 +1822,11 @@ ACLs: permit-access and deny-access Examples: - Everything goes to an example anonymizing proxy, except SSL on port 443 (which it doesn't handle): + Everything goes to an example parent proxy, except SSL on port 443 (which it doesn't handle): - forward / anon-proxy.example.org:8080 + forward / parent-proxy.example.org:8080 forward :443 . @@ -1759,7 +1857,7 @@ forward-socks4 and forward-socks4a Specifies: - Through which SOCKS proxy (and to which parent HTTP proxy) specific requests should be routed. + Through which SOCKS proxy (and optionally to which parent HTTP proxy) specific requests should be routed. -- 2.39.2