Block facebook.com when its a subresource

[TanviHacks]

If a webpage attempts to load facebook.com as a third party, intercept the request and block it. So if cnn.com tries to load an image or iframe to facebook.com, it will get blocked before a request is ever made.

Share buttons, likes, comments coming from facebook, signing in with facebook - will never work.

If this is too restrictive, we can consider having an option so that users can opt out of this restriction.

[TanviHacks]

If this doesn't get into v1, we can do it as a followup.

[groovecoder]

This will be quite a task. We will need to keep state of each tab's main frame's origin. I have a lot of code for this in blok code-base, but it's tricky port it over.

[TanviHacks]

Would it be easier to block facebook cookies? I'll file another issue for this - #9

[jonathanKingston]

This will be quite a task.

This should be less so if you can guarantee only Facebook can load in the facebook container.

[pauljt]

Why would we do this? In the facebook container, we need this so that facebook works, and outside the facebook container, then you aren't logged in so you aren't being tracked (except for facebook's tracking of logged out users of course).

So maybe i just answered my own question. If so, then might simpler approach to this just be to drop all the requests to known facebook domains, for all non "main_frame" requests which are NOT in the facebook container?

[groovecoder]

@TanviHacks it's actually easier to just block the connections completely. The hardest part is what @pauljt describes as "just drop all non "main_frame" requests to known facebook domains which are not in the facebook container" ...

But the logic for detecting and keeping track of all non-main_frame requests to facebook.com gets complicated ... We also have to consider that facebook.com SHOULD be able to make sub-resource requests to itself, and we need to track and detect all of these requests on a tab-by-tab basis.

Like I said, there's a significant amount of code in the blok add-on which did/does this. It would take a bit of work to port it.

[pdehaan]

Would this cover the case where a user is on breitbart.com and the site loads Facebook Ads, a few tracker images, and loads some subdocument to facebook.com/connect/ping/?

[groovecoder]

Note: this issue has been revived as a potential feature for "Facebook Container 2.0".

@ShivangiKakkar will plan to explore this.

[maxxcrawford]

2.0 blocks all FB-domain resources on any website outside of the container!