"Legitimate URL Shortener" General

[DandelionSprout]

This is now the place to share new parameters that you want to see be filtered by "➗ Actually Legitimate URL Shortener Tool" and by "⚙️ Dandelion Sprout's Annoyances List".

There is currently no set time for when new reports are looked into, due to e.g. vacations, other computer work, and hobbies, but it's currently less than 2 weeks.

This also is the place to report issues related to the ClearURLs for uBo list. Note that new params for that list must either be reported upstream to https://github.com/ClearURLs/Rules or added to "Legit URL"

READ BEFORE POSTING

Important notes:

• Legitimate URL Shortener can not bypass tracker redirects
• Legitimate URL Shortener can not remove anything after the # in urls
• Legitimate URL Shortener can only remove query parameters (only what is after the ? in URLs)
• Legitimate URL Shortner can not clean URLs on the Chrome Web Store, Microsoft Edge Add-ons website, and Mozilla Addons Store, as their respective browsers by default do not permit extensions to access and modify these pages (see "Legitimate URL Shortener" General #163 (comment))

For example, for the url https://example.com/content/badtracker/?utm_source=secret&tracker=true#utm_source=othersecret, Legitimate URL Shortener could shorten it down to https://example.com/content/badtracker/#utm_source=othersecret. However, Legitimate URL Shortener can not clean https://example.com/content/ref=somewhere because /ref=somewhere is not a query parameter. For more information, read the documentation on removeparam.

• Please make sure that Legit URL is installed and up-to-date, and your content/ad blocker is enabled on the affected website before reporting an issue
• ClearURLs for uBo is known to have broad allowlisting rules which can completely nullify Legitimate URL Shortener (i.e. preventing removal of ?ref=thing from Amazon). Please test with it disabled before reporting unblocked parameters.
• Parameters added without reloading the page (such as on Bilibili or Netflix) can not be removed as uBlock Origin/AdGuard never sees them added & thus can not remove them. At best, we can prevent the page from using this trick, but in many cases that is not possible without causing breakage.
  To quote the uBo documentation (added emphasis):

To remove query parameters from the URL of network requests [...]
Cosmetically added params cannot be removed via removeparam

This method does not result in a new network request.

Additional rules:

• Added 11th of July 2024: If a hidden, secret, private or offline source for entries is hinted to, talked about or linked to, you agree to that we will have dirt on you. Publicly available sources are not affected by this.

[DandelionSprout]

@wout-codes I'm moving the discussion and future parameter comments to here, to make it more clear that there's no need to panic if I don't immediately reply to your comments.

As for 88d1cd0#commitcomment-47741008, there is the theorethical possibility that you could submit entries to AdGuard Annoyances Filter or even uBlock Filters. The AdGuard team seemed in my eyes to imply back in November that they'd include "Legitimate URL Shortener" in AdGuard, but I never heard back from them about it after that.

[wout-codes]

@DandelionSprout
Link: https://www.bing.com/search?q=hello&form=QBLH&sp=-1&pq=hello&sc=8-5&qs=n&sk=&cvid=49B83A335B1C4884B71B2FAD4A8027A9

Parameter cvid is not needed.

[SeriousHoax]

@yokoffing It's happening for me for all Bing searches. Here I am attaching a GIF of what happens on my system.

GIF:

BTW, the extension "ClearURLs" also has this issue. Check this:
https://gitlab.com/KevinRoebert/ClearUrls/-/issues/391

[yokoffing]

I see what you're saying now. Thanks for providing the GIF.

I am reproducing this issue: Search suggestions on bing.com do not appear.

[SeriousHoax]

It should be fixed hopefully because search suggestion is one of the fundamental features of a search engine IMO.

[DandelionSprout]

I have now removed that entry. Thanks for the tip.

[yokoffing]

I'd like to keep an eye on this. ClearURLs seem to be leaning to towards creating a static value for cvid:

At the moment I'm still thinking if it's better to use static values or randomized values. Static values have the advantage that the anonymity group grows with every ClearURLs user, similar to TOR. However, static values at least allow the conclusion that the user is a ClearURLs user, this could be used to exclude all ClearURLs users from certain pages.

Randomized values have the disadvantage that they are possibly unique and can therefore be used for tracking, so there would be nothing to be gained.

So I think I will implement static values and design workarounds for possible problems.

[kowith337]

Multi-layers wrapped Facebook external URL

• c[0]
• h

EV from kowith337/PersonalFilterListCollection#19 (comment) : image

Google

• rlz in chrome
• pcampaignid (Play store: Track app campaign promote)

Instagram

• igshid

Steam

• curator_clanid (Click game banners in steam curators)
• ser (Found in hyperlinks inside e-mail newsletters)
• snr (Everywhre, even in AJAX/XHR)

[DandelionSprout]

This is now covered by the list. Thanks for the tip.

[karosserie]

This doesn't work:
$removeparam=curator_clanid,domain=~store.steampowered.*

Example:
https://store.steampowered.com/app/660160/Field_of_Glory_II/?curator_clanid=4777282

Any reason why we're not applying this filter on Steam?

[Nojuuu]

AdguardTeam/AdguardFilters#128512

[iam-py-test]

$removeparam=curator_clanid,domain=~store.steampowered.*

This removes curator_clanid from everywhere but store.steampowered.com. You need:

$removeparam=curator_clanid,domain=store.steampowered.*

Or drop the domain restriction and just remove it from everywhere (but will break both steam and other websites):

$removeparam=curator_clanid

Though, as @Nojuuu shared, this will cause problems
Edit: I have removed that rule in d3fd48c

[karosserie]

The only breakage I can see is the removal of the curator review, but you must open the game page from the curator page(curator_clanid) to see that review to begin with.

Understandable why it might not be wanted in the list.

[wout-codes]

@DandelionSprout
Link: https://www.bing.com/search?q=hello&sp=-1&pq=hello&sk=&sc=8-5&qs=n
sp not needed.

Link: https://safe-offers.net/bitcoinrevolution/lp.php?intgrtn_clickID=pA1gWYeKrzdZb0jxPLDRJ8EnyZLkNam95yv4q3VkoMl6Q2OnG&intgrtn_custom1=wrkuk28bb4ug07u5ihuv5aak&country=ZA&intgrtn_redirectReturningLead=auto&intgrtn_language=gb

Few tracking parameters.

[DandelionSprout]

I've now added your Bing fix.

safe-offers.net seems to be a Bitcoin scam site, and will instead be added to Dandelion Sprout's Anti-Malware List.

[wout-codes]

Yes.

[wout-codes]

@DandelionSprout
Link: https://www.bing.com/search?q=hello&pq=hello&sc=8-5&sk=&qs=n

Add: sc, sk, qs.

[wout-codes]

@DandelionSprout
Link: `https://www.bing.com/search?PC=U531&q=hello&FORM=ANNTA1
If searched from Microsoft Edge Browser, there are still some parameters.

PC, FORM not needed.

[DandelionSprout]

This is now covered by the list. Thanks for the tip.

[yokoffing]

Gorhill of uBlock Origin recommended this filter list to me since uBlock Origin supports $removeparam.

Are the various utm parameters purposefully left out? I didn't see $removeparam=/^utm_/ to strip utm, utm_source, etc.

In the meantime, I've added *$doc,frame,xhr,removeparam=/^utm_/ to my personal filter list.

[DandelionSprout]

I've used /[a-z]tm_.*/ instead of /^utm_/, believing the former to work better. I am not personally aware that an initial ^ is needed, whereas I feel the .* as an infinite-length wildcard is. Additionally, it also covers itm_ and stm_.

[yokoffing]

Ahhh. Excuse my ignorance on the subject matter. I wasn't aware that /[a-z]tm_.*/ encompasses utm, much less itm_ and stm_.

utm is a pretty well-known tracking parameter, so I started to get the feeling that I had some misunderstanding on the matter. (Surprise! lol)

Thanks for clarifying, Dandelion! Excellent work as usual.

[squeak9]

https://www.tradera.com/item/111111111111/1111111111/fakelisting?transactionalEmail=wishlist-reminder&utm_source=wishlist-reminder&utm_medium=email&utm_campaign=transactional_wishlist-reminder&utm_nooverride=1
It removes most of it but not all of it.

I am also new to this list, I used to use this list https://github.com/kowith337/PersonalFilterListCollection/blob/master/filterlist/other/SurvivedTrackingLinkWarning.txt
But your list should cover all this stuff right? It will remove and not warn obviously but maybe there is some thing there you haven't seen?

[DandelionSprout]

That list seems to attempt to block the links with the trackers entirely, instead of removing the trackers; but I do see considerable potential in borrowing from it. I'll take care of tradera.com as well.

[gorhill]

I've used /[a-z]tm_.*/ instead of /^utm_/, believing the former to work better.

/[a-z]tm_.*/ is untokenizable, and as a result the content blocker will have to scan every URLs just to find out whether there are utm_... parameters to remove. Additionally, the trailing .* accomplish nothing useful, beside asking to regex engine to match more stuff. There is always between 0 and infinite number of characters after any match, so it's a pointless pattern match, and pointless pattern matches are best avoided.

/^utm_/is tokenizable, and hence only URLs with instances of utm_ in them will be processed. The performance benefits of tokenizable filters is such that it's worth to have have two separate filters for /^itm_/ and /^stm_/.

[DandelionSprout]

Took me some hours to think about what "tokenizable" could mean in this context, but I do understand it now.

My use of .* was because I had no knowledge at all that RegEx = no start-end boundaries by default; in sharp contrast to non-RegEx, where $removeparam=utm_ would not block utm_source that I'm aware of.

Although it is tempting for me to meet at the halfway point with ?*tm_$removeparam=/^[a-z]tm_/, I'll implement your suggestion instead for now, provided I don't stumble across additional ones like (hypothetically) ptm_.

[ghost]

I have few notes for my own filters in "My filters", they may not bee 100% accurate (I don't have much time to investigate), but may be helpful for you:

$removeparam=ref,domain=~github.com|~behind-the-scene #caused issue on github
! ref_$removeparam=/^ref_/ #issues on one of the many rarbg mirrors
! $removeparam=cid #rarbg
! origin=$removeparam=/^origin=(?=.*\W)/ # allegro.pl notification counter was broken - using ^origin=(?=.*\W)/ fixed this, still - gmail.com contacts list do not load, allegro uses words/tokens, gmail uses addresses
! $removeparam=usegapi #gmail contacts stop working

[DandelionSprout]

Of those five, only ref affected me directly and had to be fixed, which I've done now.

[squeak9]

Spotify links could be shorter, example:

https://open.spotify.com/playlist/37i9dQZF1DWXRvPx3nttRN?si=asdf1234567890&utm_source=copy-link

[yokoffing]

Are there some places that extensions can't touch? For instance, when I'm on Reddit and click Share > Copy Link to share a post, there's always a utm attached to it. Example: https://www.reddit.com/r/NatureIsFuckingLit/comments/m8stpe/picture_taken_by_my_mom_we_pic_mushrooms_every/?utm_source=share&utm_medium=web2x&context=3

No matter if I run ClearURLs, Neat URLS, or Dandelion's filter list in uBlock Origin, clicking Share > Copy Link always gives me a link with utm_* attached. Problematic if I'm just copy+pasting a link to share with a friends.

Now if I take that same link and copy+paste it in my URL bar and press enter while using Dandelion's list, I get: https://www.reddit.com/r/NatureIsFuckingLit/comments/m8stpe/picture_taken_by_my_mom_we_pic_mushrooms_every/?context=3 and Dandelion's list in uBlock Origin removes the tracking parameter.

But no solution I've found removes the tracking parameter upon copy, and looks like what you're describing except with Spotify instead of Reddit.

[gorhill]

uBO will remove query parameters only from outgoing network requests, it does not modify the DOM to rewrite the href attribute of all a tags in the DOM. The removeparam option applies to network filters, it's not a DOM-based utility.

[yokoffing]

wsj.com urls can be made shorter by removing ?mod=
Original: https://www.wsj.com/articles/the-christian-baker-who-said-no-11616452331?mod=trending_now_opn_pos1
Proposed: https://www.wsj.com/articles/the-christian-baker-who-said-no-11616452331

nyt.com urls appeared fine but there was one that would not shorten:
Original: https://www.nytimes.com/2021/03/22/parenting/covid-children-isolation-mental-health.html?surface=home-discovery-vi-prg&fellback=false&req_id=137890943&algo=identity&variant=no-exp&imp_id=960654917
Proposed: https://www.nytimes.com/2021/03/22/parenting/covid-children-isolation-mental-health.html

[liamengland1]

Some might not want this, for example, links to WSJ on techmeme have the param ?mod=djemalertNEWS which bypasses the paywall.

[DandelionSprout]

Both of these points are now taken care of by the list. Thanks for the tip.

[yokoffing]

@llacb47 whoops. I use Bypass Paywalls Clean. So we should just leave this alone then, @DandelionSprout?

[DandelionSprout]

I've made it so that $removeparam=mod only applies if the mod value starts with trending.

[yokoffing]

TCGPlayer: everything after ?xid= can be removed.

Example 1 (includes my original search query as indicated by &q= )
Original: https://shop.tcgplayer.com/yugioh/legendary-duelists-sisters-of-the-rose/harpie-lady-elegance?xid=pi59304a70-e073-4a6a-96f1-4ae63bc02dea&q=harpie
Proposed: https://shop.tcgplayer.com/yugioh/legendary-duelists-sisters-of-the-rose/harpie-lady-elegance

Example 2
Original: https://shop.tcgplayer.com/yugioh/legendary-duelists-sisters-of-the-rose/lunalight-blue-cat?xid=piac3287f7-0eee-4e0a-a8c1-bf49f478e4dc&productLineName=yugioh&setName=legendary-duelists-sisters-of-the-rose
Proposed: https://shop.tcgplayer.com/yugioh/legendary-duelists-sisters-of-the-rose/lunalight-blue-cat

[DandelionSprout]

On most sites, blocking q would be a bad idea, because most stores' search criteria determines the placeholder text in the search bar on store pages (e.g. on Amazon). However, that does not seem to be the case on tcgplayer, making it superfluous and indeed removable.

This is now covered by the list. Thanks for the tip.

[yokoffing]

@DandelionSprout, we need a fix for TCGplayer. I cannot fetch search results from https://www.tcgplayer.com/search/all/product.

With the URL Shortener list disabled: The appropriate results show.

With the URL Shortener list enabled: The products from https://www.tcgplayer.com/search/all/product refresh on the page and it doesn't find search results.

Can we still remove ?xid but retain &q somehow?

[DandelionSprout]

Thanks for the headsup. This has been fixed in version 15June2021v2-Beta.

[yokoffing]

Would it be possible for us to handle redirect tracking?

Specifically:

• YouTube redirect links
• Google link tracking
• Bing search result redirects (when "Open links in new tabs" is active):
  • Original: https://www.bing.com/newtabredir?url=https%3A%2F%2Fwww.cnn.com%2Fstyle%2Farticle%2Flil-nas-x-mschf-satan-nike-shoes%2Findex.html
  • Proposed: https://www.cnn.com/style/article/lil-nas-x-mschf-satan-nike-shoes/index.html

[DandelionSprout]

Sadly not. However, https://github.com/DandelionSprout/adfilt/tree/master/Dandelion%20Sprout-s%20Redirector%20Assistant%20List offers it on a very small scale.

[yokoffing]

utm_source, utm_medium, and utm_content are not being removed from the Firefox addons page.

https://addons.mozilla.org/en-US/firefox/addon/to-google-translate/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search

[SeriousHoax]

Did you make the change that is required for extensions to work on Firefox addons page? By default, extensions can't do anything on the addons page as well as some other Firefox related sites.
On my system the above link you posted is being cleared by ClearURLs.

[yokoffing]

Did you make the change that is required for extensions to work on Firefox addons page?

Yes.

[liamengland1]

uBO does not have the permission to run on browser protected pages afaik. So it will not work.

[kowith337]

It's may only work when you...

• set pref (and maybe you should lockPref(); it?)
• open in new tab instead of click straight.
• refresh page once after clicked.

[rusty-snake]

uBlockOrigin/uBlock-issues#1704 / uBlockOrigin/uBlock-issues#1767

[rd-su]

When I use this list, it blocks a lot of images in Facebook.

Every post of this link have it's image blocked:
https://www.facebook.com/permalink.php?story_fbid=3578168542306148&id=321420801314288

With ClearURLs works fine...

[DandelionSprout]

This has now been fixed by the list. Thanks for the tip.

[yokoffing]

Academia.edu | ?email_work_card

Original: https://www.academia.edu/9513828/Open_Theism_and_the_Millennial_in_the_Pew_Evangelical_Theology_and_Marketing_in_the_Age_of_the_World_Wide_Web?email_work_card=view-paper

Proposed: https://www.academia.edu/9513828/Open_Theism_and_the_Millennial_in_the_Pew_Evangelical_Theology_and_Marketing_in_the_Age_of_the_World_Wide_Web

[in-plaintext]

this Finnish retailer adds some ID string to the product page URLs (see any item; after #): https://www.verkkokauppa.com/fi/catalog/tietokoneiden-komponentit/products

[Banaanae]

The extension can't remove anything past #

[de-soot]

Instagram adds an unnecessary "entry_point" to their URL links:

*.instagram.com/*?entry_point=

for example:

https://accountscenter.instagram.com/info_and_permissions/off_facebook_activity/?entry_point=ACCOUNTS_CENTER

can be

https://accountscenter.instagram.com/info_and_permissions/off_facebook_activity

,

https://accountscenter.instagram.com/?entry_point=app_settings

can be

https://accountscenter.instagram.com

, and

https://privacycenter.instagram.com/?entry_point=instagram_settings_page

can be

https://privacycenter.instagram.com

Fix:

$removeparam=entry_point

[iam-py-test]

Thank you for reporting this. I have fixed it in 90f5482.
Would you mind testing to see if ||instagram.com^$doc,removeparam=entrypoint breaks anything (seen on e.g. https://familycenter.instagram.com/accounts/[id]/?entrypoint=supervision_web&fc_session_id=[session]&account_type=INSTAGRAM&is_home_entry=1)? Thanks

[de-soot]

Startpage has unneeded parameters when searching: cat=web & pl=opensearch

e.g.

https://www.startpage.com/sp/search?query=is startpage private&cat=web&pl=opensearch

can be

https://www.startpage.com/sp/search?query=is startpage private

Fix:

$removeparam=cat
$removeparam=pl

[iam-py-test]

cat specifies what tab is selected, such as the web results (cat=web), images (cat=images), etc. Removing cat makes it impossible to switch between the different "tabs" and see other types of search results.
I have not been able to reproduce pl. How are you making these searches? Do you have a specific configuration?
Thanks

[I-I-IT]

When searching "Proton VPN" from the addon menu in Firefox, and after clicking on the Proton VPN option, I finally end up on https://addons.mozilla.org/en-US/firefox/addon/proton-vpn-firefox-extension/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search
Should be fixed with:
$removeparam=utm_source $removeparam=utm_medium $removeparam=utm_content

[DandelionSprout]

There is 1 option that I know of. In Firefox, go to "about:config" → Search for "extensions.webextensions.restrictedDomains" → Remove addons.mozilla.org from the existing text in that setting.

[iam-py-test]

Added to the FAQ.

[I-I-IT]

There is 1 option that I know of. In Firefox, go to "about:config" → Search for "extensions.webextensions.restrictedDomains" → Remove addons.mozilla.org from the existing text in that setting.

Thanks. But that means all extensions will have that permission, right? Ideally, I will just want uBo to have it.

[iam-py-test]

Edit: see #163 (reply in thread)
Any other extension with uBo's level of access, yes.

[stephenhawk8054]

Thanks. But that means all extensions will have that permission, right? Ideally, I will just want uBo to have it.

You can add the domain into extensions.quarantinedDomains.list. It will at least only allow "Recommended" extensions to access to that domain.

[injust]

I encountered the tw_medium and tw_profile_id parameters in a marketing email link. It's a Triple Whale parameter: https://kb.triplewhale.com/en/articles/5740620-klaviyo-integration#h_d0fb8c7039

The list already includes tw_source.

[DandelionSprout]

Thanks for the tip. This has now been fixed in 8d867b1

[Saharash]

On my website, the list make the website break.

Without list:

With the list:

It crash after i select a name for my announce, you have to select a category, and when you select it, this page appear.

Here is a video to show you the break if it can help:

https://www.dropbox.com/scl/fi/hu63o7lkcojyv4mvf3dsx/firefox_8wq1AYBx7H.mp4?rlkey=5vbimreeotqux1lm3exzdpc19&dl=0

I don't know what i can do, i'm just an user 🤣

Thanks if you can help!

[Saharash]

Thanks to you! I was wondering if i should post it cause it's a french selling website i guess no many peoples got the list + using the website but if it can fix aswell for peoples i'm glad too! Thanks for fast answers

[DandelionSprout]

I usually take an unqualified guess that around 1.7〜2.0 million people use the list worldwide, but it also means the number of French residents who use the list is pretty low from a statistical standpoint, likely not more than 130,000.

The fix should however make the site(s) work again for most users pretty fast, ranging from "Already" to "Within 3 days" depending on how they've set up their uBO/AdGuard auto-update settings.

[Saharash]

Alright, all can i say is that is now working for me so thanks for this!

[Yuki2718]

Probably it's now better to specifically remove than speciffically exempt.

[DandelionSprout]

On paper, yes.

[yokoffing]

||amazon.*/dp/$document,removeparam=s
breaks navigating to the page https://www.amazon.com/Funny-Office-Desk-Sign-Decorative/dp/B0DR7ZHMVC/?_encoding=UTF8&s=bazaar&psc=1&ref_=hul_hp_d_esc_reco_all&pos=title

[I-I-IT]

Maybe include a screenshot, what does it break ?

[DandelionSprout]

Amazon is a high-difficulty site in the list, and the link goes to a browser "ERR_TOO_MANY_REDIRECTS" error page, so I'll handle that entry soon now.

[DandelionSprout]

This has now been fixed in 714a7c0

[injust]

https://em.dynamicyield.com/v1/email/dc/click/8788930/1141527/1141526?&cuid=558415&cuid_type=id&locale=default&version=030425&tag_ids=1141526 is broken by the removal of the cuid parameter.

The tag_ids parameter can be removed, however.

||em.dynamicyield.com^$removeparam=tag_ids
@@||em.dynamicyield.com^$removeparam=cuid

[DandelionSprout]

Thanks for the tip. This has now been fixed in 714a7c0

[gnadgnaoh]

Please remove uls_trackid. Its make shopee required login to view product

https://shopee.vn/Qu%E1%BA%A1t-PC-TEUCER-T20-S-FDB-12V-4Pin-2500RPM-Khung-Xe-%C3%81p-L%E1%BB%B1c-Cao-Qu%E1%BA%A1t-L%C3%A0m-M%C3%A1t-Qu%E1%BA%A1t-CPU-i.785449062.29932260744?uls_trackid=XXXXXXXXXXXXXXXXXXXXXXXXX&utm_campaign=id_XXXXXXXXXXXXXXXXXXXXXXXXX&utm_content=XXXXXXXXXXXXXXXXXXXXXXXXX----&utm_medium=affiliates&utm_source=an_XXXXXXXXXXXXXXXXXXXXXXXXX&utm_term=XXXXXXXXXXXXXXXXXXXXXXXXX

[DandelionSprout]

Thanks for the tip. This has now been fixed in 714a7c0

I know there's been several cases of Shopee requiring logins in general, so it'd be a game-changer if removing that parameter indeed fixes that.

[gnadgnaoh]

here is mine flter to fix force login in shopee. Can you add to filter?
||shopee.vn^$removeparam=uls_trackid
||shopee.vn^$removeparam=sp_atk
||shopee.vn^$removeparam=xptdk
||shopee.vn^$removeparam=utm_campaign
||shopee.vn^$removeparam=utm_content
||shopee.vn^$removeparam=utm_medium
||shopee.vn^$removeparam=utm_source
||shopee.vn^$removeparam=utm_term
||shopee.vn^$removeparam=d_id

[DandelionSprout]

I'll look into these sometime this week at latest (The other ones are already in the list):

||shopee.$removeparam=sp_atk
||shopee.$removeparam=xptdk
||shopee.$removeparam=d_id

[DandelionSprout]

I honestly forgot all about it. 😓 And I at least don't think I've got spare time enough for it that I know of.

[hippopotamusgoldfish]

I have no proof. But I think modifying anything with YouTube watchtime requests invalidates it. Isn't ideal for the uploaders. Maybe whitelist YouTube on these filters?
Filters in question (from logger):

$removeparam=cmt
$removeparam=sourceid,domain=~google.*

[hippopotamusgoldfish]

You need to provide an example of a webpage where that occurs (with an url). And also describe what the problem is more specifically.

Example: https://youtu.be/nTasT5h0LEg
YouTube sends watchtime requests automatically and contains parameters which the shortener removes. I think removing anything invalidates the watchtime metric you sent, negatively impacting the uploader's statistics. I don't think this is intended.
Those specific filters are filtering things out of the watchtime requests. Could YouTube be excluded from them?

[I-I-IT]

Not sure I understand, what is watchtime requests? And what is broken?

If you are complaining about analytics being broken by this list, I think this is precisely the point, to reduce tracking.

[Banaanae]

Another point worth mentioning is the number of users with this list also watching youtube is low enough that analytics aren't greatly affected.

[DandelionSprout]

Since the parameters only seem to be matched in scripts in the list, and not in the URL title bar, I'm inclined to side with hippopotamusgoldfish on this one. I'll handle the whitelistings later today.

[injust]

I opened easylist/easylist#21865 to add the watchtime endpoint to EasyPrivacy.

[injust]

https://myaccount.google.com/signinoptions/passkeys?source=marketing on https://www.google.com/account/about/passkeys/, any of the blue "Create a passkey" buttons

Proposed rule:

||myaccount.google.com^$removeparam=source

[iam-py-test]

Thank you for reporting this. DandelionSprout appears to have fixed it in 0c3fee6.

[injust]

Clicking on the logo on any hCAPTCHA gives you a link like https://www.hcaptcha.com/what-is-hcaptcha-about?ref=accounts.hcaptcha.com&..., e.g. on https://accounts.hcaptcha.com/demo

Proposed rule:

||www.hcaptcha.com^$removeparam=ref

[I-I-IT]

Can confirm, for example on smspool.net/register, click switch to hCaptcha and then on the hcaptcha logo. You will end up on hcaptcha.com/what-is-hcaptcha-about?ref=www.smspool.net&hl=en

[iam-py-test]

Thank you for reporting this. I have fixed it in d7c5999.

[injust]

Sharing a YouTube channel will give you a URL like https://youtube.com/@[channel_name]?si=....

Proposed rule:

||youtube.com^$removeparam=si

[Yuki2718]

No need for regex

://youtube.com/@*?si=$doc,removeparam=si

will be good enough. But I guess

||youtu.be^$doc,removeparam=si

where you share each video will also be fine. Added to AdGuard URL Tracking Protection AdguardTeam/AdguardFilters@9857cb9 (AG applies to only doc by default).

[stephenhawk8054]

uAssets is also using ||youtu.be^$removeparam=si by default already, so I think we can add ://youtube.com/@*?si=$doc,removeparam=si

---

uBlockOrigin/uAssets@8d2b45e

[I-I-IT]

Can you provide a real example URL? Seems risky unless it has some unique identifer.

[Yuki2718]

I don't understand. If "some unique identifer" means the name of the channel/video, the rule(s) will be almost useless. Anyway e.g. https://youtu.be/ULp_1P9uzew?si=iDFuPlMDQxUCMR_3

[I-I-IT]

I was wondering whether this was an id that was uniquer per session (so directly tracking users) or one that maybe was unique per another metric (could be time-based for example). Anyway, tI can confirm that this is definitely tracking users, it is a unique, one time identifier. It is important to note that this identifier is only generated when you use non-Chrome/chromium browsers, including Firefox.

This is what seems to be causing this identifier :

var ytcsi={gt:function(n){n=(n||"")+"data_";return ytcsi[n]||(ytcsi[n]={tick:{},info:{},gel:{preLoggedGelInfos:[]}})},now:window.performance&&window.performance.timing&&window.performance.now&&window.performance.timing.navigationStart?function(){return window.performance.timing.navigationStart+window.performance.now()}:function(){return(new Date).getTime()},tick:function(l,t,n){var ticks=ytcsi.gt(n).tick;var v=t||ytcsi.now();if(ticks[l]){ticks["_"+l]=ticks["_"+l]||[ticks[l]];ticks["_"+l].push(v)}ticks[l]=
v},info:function(k,v,n){ytcsi.gt(n).info[k]=v},infoGel:function(p,n){ytcsi.gt(n).gel.preLoggedGelInfos.push(p)},setStart:function(t,n){ytcsi.tick("_start",t,n)}};
(function(w,d){function isGecko(){if(!w.navigator)return false;try{if(w.navigator.userAgentData&&w.navigator.userAgentData.brands&&w.navigator.userAgentData.brands.length){var brands=w.navigator.userAgentData.brands;var i=0;for(;i<brands.length;i++)if(brands[i]&&brands[i].brand==="Firefox")return true;return false}}catch(e){setTimeout(function(){throw e;})}if(!w.navigator.userAgent)return false;var ua=w.navigator.userAgent;return ua.indexOf("Gecko")>0&&ua.toLowerCase().indexOf("webkit")<0&&ua.indexOf("Edge")<
0&&ua.indexOf("Trident")<0&&ua.indexOf("MSIE")<0}ytcsi.setStart(w.performance?w.performance.timing.responseStart:null);var isPrerender=(d.visibilityState||d.webkitVisibilityState)=="prerender";var vName=!d.visibilityState&&d.webkitVisibilityState?"webkitvisibilitychange":"visibilitychange";if(isPrerender){var startTick=function(){ytcsi.setStart();d.removeEventListener(vName,startTick)};d.addEventListener(vName,startTick,false)}if(d.addEventListener)d.addEventListener(vName,function(){ytcsi.tick("vc")},
false);if(isGecko()){var isHidden=(d.visibilityState||d.webkitVisibilityState)=="hidden";if(isHidden)ytcsi.tick("vc")}var slt=function(el,t){setTimeout(function(){var n=ytcsi.now();el.loadTime=n;if(el.slt)el.slt()},t)};w.__ytRIL=function(el){if(!el.getAttribute("data-thumb"))if(w.requestAnimationFrame)w.requestAnimationFrame(function(){slt(el,0)});else slt(el,16)}})(window,document);

[Loxlux]

Hi there, the side https://eu.startpage.com/ is constantly asking me for capchas when I try to enter the second search-result page. And I get in a loop after filling out the captcha, it does not remember that I have already filed out the form. After I disabled the Actually Legitimate URL Shortener Tool list the problem stopped. Thanks for looking into this.

[I-I-IT]

Please upload a log with infos about what is being blocked

[iam-py-test]

Sorry for the delay.
I have attempted to reproduce this issue, and have been unable to. Would you mind sharing more information, such as a log (instructions for uBlock Origin), what other lists you are using as other lists can conflict, etc.
Thank you

[Loxlux]

Hi there, f course, here it is:

Logger output

+2
eu.startpage.com
1
get
image
https://eu.startpage.com/do/captcha?image=b04c658e91edd115dc3f52d8c7719f0b38980cb1ba344c3dd2ed4bf1e5956de35a6a0eb74a881b9f&cmd=gen_image

+2
eu.startpage.com
1
post
xhr
https://eu.startpage.com/do/cp-d

+2
||startpage.com/sp/dplpxs
--
eu.startpage.com
1
post
beacon
https://eu.startpage.com/sp/dplpxs

+2
eu.startpage.com
1
get
image
https://eu.startpage.com/sp/cdn/favicons/favicon-gradient.ico

+2
eu.startpage.com
1
get
image
https://eu.startpage.com/sp/cdn/favicons/android-icon-192x192.png

+2
##+js(trusted-replace-argument, Array.prototype.find, 0, undefined, condition, affinity-qi)
eu.startpage.com
get
scriptlet
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+2
##+js(spoof-css, .ad.a-bg, display, block)
eu.startpage.com
get
scriptlet
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+2
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/app-data.json

+2
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/sq/d/1741461370.json

+2
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/sq/d/123005526.json

+2
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/captcha/page-data.json

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/component---src-pages-captcha-js-f1b23693293bd507cbea.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/61d6a51fa456977bf9d459804f978f1e85cbddbe-09f0026f4447139c20d8.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/9f770d9209dd3edb93079c35a4daa9fe14309bf3-bbfec4815243dd513d37.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/8fd93bdc4c61807af2418fd1da7fc6b8b12a0570-cc1bc10f6fc21183c9b2.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/b8eb8e311ac2f83219437a904c5330a6ff6f2a5d-b426b410111145716b70.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/app-f51b2111ca682d5b39ef.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/framework-5e304a30c2ce78680c11.js

+2
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/webpack-runtime-7e431915a16de4f9fec9.js

+2
@@||startpage.com^$generichide
++
eu.startpage.com
1
get
generichide
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+2
eu.startpage.com
1
get
doc
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+2
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+1
eu.startpage.com
1
get
image
https://eu.startpage.com/do/captcha?image=26919f1bf2fed241dc3f52d8c7719f0b28d1a9855ce32c5ad2ed4bf1e5956de35a6a0eb74a881b9f&cmd=gen_image

+1
eu.startpage.com
1
post
xhr
https://eu.startpage.com/do/cp-d

+1
||startpage.com/sp/dplpxs
--
eu.startpage.com
1
post
beacon
https://eu.startpage.com/sp/dplpxs

+1
eu.startpage.com
1
get
image
https://eu.startpage.com/sp/cdn/favicons/favicon-gradient.ico

+1
eu.startpage.com
1
get
image
https://eu.startpage.com/sp/cdn/favicons/android-icon-192x192.png

+1
##+js(trusted-replace-argument, Array.prototype.find, 0, undefined, condition, affinity-qi)
eu.startpage.com
get
scriptlet
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+1
##+js(spoof-css, .ad.a-bg, display, block)
eu.startpage.com
get
scriptlet
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+1
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/app-data.json

+1
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/sq/d/1741461370.json

+1
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/sq/d/123005526.json

+1
eu.startpage.com
1
get
xhr
https://eu.startpage.com/static-pages-assets/page-data/captcha/page-data.json

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/component---src-pages-captcha-js-f1b23693293bd507cbea.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/61d6a51fa456977bf9d459804f978f1e85cbddbe-09f0026f4447139c20d8.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/9f770d9209dd3edb93079c35a4daa9fe14309bf3-bbfec4815243dd513d37.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/8fd93bdc4c61807af2418fd1da7fc6b8b12a0570-cc1bc10f6fc21183c9b2.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/b8eb8e311ac2f83219437a904c5330a6ff6f2a5d-b426b410111145716b70.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/app-f51b2111ca682d5b39ef.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/framework-5e304a30c2ce78680c11.js

+1
eu.startpage.com
1
get
script
https://eu.startpage.com/static-pages-assets/webpack-runtime-7e431915a16de4f9fec9.js

+1
@@||startpage.com^$generichide
++
eu.startpage.com
1
get
generichide
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+0
eu.startpage.com
1
get
doc
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

+0
https://eu.startpage.com/sp/captcha#?bc=DE&bi=1%261+Versatel&be=845fd68e70c41ef70aaf54a32e4160a4&bds_t=1751485585T522f7a8ccd38e1f946f6dc8918041e049ad31f5696570bb41de51bab85b4cfc8&bds_s=3ff9577ef97e4361b08dee7f797c146b&bds_cq=&query=startpage+&cat=web&t=device&lui=english&language=english&cmd=gen_page

[Loxlux]

my-ublock-backup_2025-07-02_11.45.07.txt
and that is my current config.