Why does the Unraid documentation say to disable our browser ad-blockers?


IMTheNachoMan

Recommended Posts

According to the documentation at https://wiki.unraid.net/Articles/Getting_Started#Preparing_your_browser_.28ad-blocker_settings.29:

 

Quote

 

Unraid's management interface (the webGUI) is incompatible with most ad-blocker solutions. It is for this reason that we strongly suggest that users leveraging an ad-blocker in their browser first add the Unraid server to the ad-blocker whitelist to ensure the ad-blocker doesn't affect the webGUI.

 

Failure to do so is likely to result in parts of the webGUI not displaying correctly.

 

 

Does anyone know why?

 

From what I see online, everyone is saying they haven't disabled their ad-blockers and Unraid works fine. So it appears we don't actually have to disable it. So why does the documentation say we need to?

 

I work in Cybersecurity doing security reviews of products, including products like Unraid, and that part of the documentation doesn't sit well with me. It is a huge red flag in our review process. 

 

I am not saying Unraid is doing anything nefarious -- I am just trying to understand why the documentation says this. If it is a band aid for addressing previously reported issues, where can I find details? I tried searching around and came up dry. 

 

And before anyone says it is a low risk or common ask, it is not. I do this all day long with hundreds of products and not one of them gives a blank instruction to disable an ad-blocker. Many say to do that if you have issues with specific things/functions, but not as some blanked installation instruction.

Link to comment

adblockers can have false positives, which might interfere with the Unraid webUI. If you are having problems with the Unraid webUI, then whitelisting your server on your adblocker is one possible solution to the problem. There are other potential causes of webUI problems, such as cached code after an upgrade, difficulties with flash drive where settings in the webUI are stored, even incompatibilities with specific browsers.

 

If you are not having problems with the webUI no need to do anything, but the webUI code evolves with each release, plugins in the webUI are maintained by the user community and may change, and adblockers also change, so things that were working together might not always do so in all cases.

Link to comment
33 minutes ago, trurl said:

adblockers can have false positives, which might interfere with the Unraid webUI

 

Most false positives are legitimate blocks but the website doesn't want to or can't fix (i.e. dependency on a 3rd party library). So the ad-blocker is blocking something it should but since product team won't fix/address they flag it as a false positive.

 

And might interfere is a big chance to take to completely disable an ad-blocker.

 

And I am not expecting any issues. In fact, everyone I've spoken to said they didn't have to disable theirs. So I don't think we actually need to disable it. Which makes me wonder why the documentation says that.

 

If your car instruction manual said to leave the doors unlocked, you'd want to know why. It's not a normal/standard request. I agree there are legitimate cases for whitelisting or disabling but those should be explained. Product companies should not ask customers to make bad security decisions without explaining why. Security is a big problem in the consumer space and blanket instructions like that are very dangerous.

 

I'm just trying to better understand why the documentation says it. I am not accusing anyone of doing anything naughty. I am sure it was added for a legitimate reason. I am just trying to find the specifics of that reason. That information should be documented somewhere. :/

Link to comment

There have been some instances recently where software blocked https because it's being redirected to a local private IP.  Some programs are more aggressive than others, not all adblockers / protection software is created equal. Like you said, most blockers work just fine, but if someone experiences an issue, it's something to investigate. It's a troubleshooting step, not a blanket requirement.

 

The car door analogy is flawed for multiple reasons, but if you are parked inside your locked garage, leaving the doors unlocked is perfectly natural and not an issue.

Link to comment

I've never had an issue with any blockers. However its the first thing I think of "if" my GUI acts up. 

 

Id guess that there have been several instances of people installing all kinds of things in their browsers and honesty unraid can not be coded to solve every single possible instance of what users do. 

Link to comment

The entire problem is that ad blockers don't actually block ads.  Rather, they change the contents of certain elements on any webpage based upon their name, and that name may or may not be caught by the ad blocker even though it's not an actual ad.  (From a programming aspect of CA, anything that actually changes the code or html elements without my knowledge or permission etc is something to be avoided)

 

When this was a rather severe problem, the name of an element "Shares" was being caught by all the adblockers out there and they were preventing display of the Shares tab

 

FCP has a blatant test to see what the adblocker does with an item named "adsitem".  It's definitely not an ad, but if the adblocker changes that element, FCP tosses up an issue because there is absolutely zero reason for the adblocker to have blocked that item.

 

Every single adblocker out there (piHole operates differently) has the ability to whitelist a particular site (your server), because they realize that their algorithms are full of false positives.

 

  • Like 1
Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.