First, a quick review of what a TPL does on IE9. A TPL is a plain text file that you can open up and read directly to see what's in it. Nothing compiled or hidden here.
When you add and enable a list in your browser, it checks that list for instructions on how to handle the stuff the web page you want to view is trying to download. Each thing that comes in is evaluated for two things:
- Is it coming from the same site where you're browsing? An example of this is news site like LA Times with ads from Double-click. If the content is coming from the LA Times, it is allowed. If it is not, the next thing kicks in.
- Is there a rule for it in one of the TPLs loaded in the browser? The rules are relatively simple - yes, let it downlaod or no, block that sucker. If it is blocked, the browser refuses the connection and the junk doesn't download.
- If you have multiple TPLs, and one says No, don't download X and another says Yes, download X, the Yes rule wins. The exception to this is your built-in personalized list. The rules in that list take precedence over the rules in all other lists. The problem I find with the personalized list is that it will block cookies and tracking stuff, but it doesn't let you specify exactly what things you want to block.
- The professionally prepared lists may block advertisement and tracking stuff, but they don't block annoying sites as such. They really don't handle the social media sites very well, letting Facebook in particular run rough-shod across a page.
Be sure to install Easy List, which is from the same company that produces the Ad Block plug-in for Firefox. The lists from Abine and Privacy Choice are pretty good, too. Once in place, your browser will automatically go and check them for updates. They work sliently in the background at all times. The updates are delivered transparently and you don't have to restart the browser.
The issue that happened today was a site I use all the time suddenly and obnoxiously displayed the Facebook "Like" button. I started checking other sites I frequent and realized that this miserable bit of crapware was infesting everything. I looked at the various TPLs I have installed, and found that none of them attempted to block any Facebook stuff downloaded as a 3rd party item on a web site. The Like button sits inside an Iframe in the page, which further masks its presence.
After a little searching, I found some great information from the W3C on how to build a TPL. It's located here: http://www.w3.org/Submission/2011/SUBM-web-tracking-protection-20110224/ A little dense to get through, but if you use Easy List's TPL as a model, not hard to figure out. Start at section 4 - List Format, and read down.
Armed with a bit of knowledge, I opened up Notepad and created a TPL that blocked Facebook as a 3rd party download to my system. The file reads:
: Expires = 5
# blocked strings
# domain rules
After I uploaded the files, I browsed to the HTML page, clicked the link and installed the new TPL. Bye-bye Facebook Like buttons. The extra nice thing is I can add whatever other blocks I want to the file at any time and block the stuff the other lists won't do. When I go to a third party site (making it first party), then the list doesn't block stuff because it is being delivered directly and it's assumed that if you are on the site, you want stuff from that site.
So there's a little tutorial on how to take blocking into your own hands if you're using IE9. You can actually also use this method in IE8, it's just harder to install the lists.
The TPL list method is efficient and effective. You can see the marketing hyenas trying to keep people from using it by turning it off by default in IE9 and not promoting the TPL list links. In truth, it is as or more easy to use than downloading Ad Block for Firefox. After all, Firefox doesn't come with it installed and ready to switch on, does it? You have to know about it and go find it. Here's how to get "Ad Block" for IE9, easy.
- Click the Gear icon in the upper right corner of the browser window.
- In the menu, select Saftey/Tracking Protection. A new window opens.
- In that window, look for the item "Your Personalized List" in the main window. Select it.
- Click the "Enable" button.
Now, see, that wasn't so hard, was it? If you want to block even more, build a custom TPL and put it on your own website or ask a friend with a site to post it for you.
For how to get the same protection on XP with IE8, read over my Safe Browsing article, especially Chapter 15, How I Browse. It is a more manual version of what I told you to do with IE9, plus you can't add pre-compiled lists of blocked 3rd party sites, you have to build your own list, but it works and you don't have to worry about ad-ons breaking or being incompatible with the latest update.
It's popular among the technorati to scream and howl about how awful IE is, and never offer a hint to ordinary users on how to turn on built-in features of the product that are as if not more effective than the plug-ins for other browsers. This post is for the majority of web site users who are on IE and who are getting sick and tired of being sneered at instead of helped by your allegedly technically literate friends. The sad truth is they don't know about the real differences between browsers, don't understand security, confuse blocking ads with being secure, and reflexively bash Microsoft instead of critically interrogate all corporate claims. They probably don't know about TPL and its status as a proposed standard for dealing with attempts to track you, or about how your personal list trumps commercially prepared TPLs. Etc.
Safe browsing means not being railroaded by corporation or the conventional wisdom of the hip crowd.
Update - with thanks to commenter John, I have been pointed at a very interesting site by Hal Berenson. Hal has three links of relevance to this particular post: