21 ms·
Ad Blockers Are Also Changing the Game for SaaS and Web Developers
- petercooper 11y agoNote that the key issue in this story is not the blocking of analytics tools, but that they had a legitimate URL in their app of /api/analytics and it was getting blocked. That's quite a problem, especially as I see things like /js/dart.js also in that list which could destroy an app's functionality if you knew no better.
- gnud 11y agoWorth having a look at https://easylist-downloads.adblockplus.org/easyprivacy.txt https://easylist-downloads.adblockplus.org/easyprivacy.txt There are some possibly problematic blocks with the words 'analytics', 'log', 'event' that might be used in a log viewer, for example. Also worth noting that I don't think EasyPrivacy is on by deafault in uBlock.
- sandstrom 11y agoInteresting list. Grep on `.cloudfront.net`, hopefully AWS don't reuse these.
- HappyTypist 11y agoThey don't. Same origin policy, cookies etc.. You just don't.
- deleted 11y ago[deleted]
- cremno 11y ago>Also worth noting that I don't think EasyPrivacy is on by deafault in uBlock. It is. See the readme: https://github.com/chrisaljoudi/uBlock https://github.com/chrisaljoudi/uBlock or https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
- Animats 11y agoRight. Time to dump Google Analytics, which is now heavily blocked, and start processing your server logs.
- eropple 11y agoYou can dump events at Google Analytics, too, and leverage their infrastructure (instead of expensive options around handling your own).
- steventhedev 11y agoThis is why I use server side analytics almost exclusively. You just can't rely on every browser running all your javascript.
- strommen 11y agoHow do you filter out crawlers, bots, pre-fetchers, etc.? I've personally never even tried using server-side analytics because I assumed there would be so much noise it wouldn't be worth the trouble.
- TillE 11y agoEvery well-behaved bot (ie, almost all of them) has its own user agent string. You can just grep -v those out.
- mjn 11y agoI wish that were true, but I'd estimate that less than half of the bot hits on my website properly identify themselves as bots. Most of the crawlers running on DigitalOcean/AWS/etc. seem to use a user-agent string lifted from one of the common browsers.
- kuschku 11y agoCheck for the order of the headers and the TLS protocols it claims to support – those are useful for identification.
- th0ma5 11y agoI must be getting old, never? There's a lot of techniques like doings stats on blank pixels and such that have been around for a long time. A lot of ad blocking techniques start at the DNS of the hosted resource, so having a single domain for everything (if practical) can present some reliable information.
- pgrote 11y agoWhat interfaces akin to Google Analytics read web server logs?
- Scaevolus 11y agoGoogle recommends against hosting their tracking javascript locally, but that in combination with a server-side proxy (POSTING to https://example.com/a https://example.com/a forwards to https://analytics.google.com/collect https://analytics.google.com/collect) might be the most resilient to ad blocking techniques.
- tarr11 11y agoYeah, this feels like the next step in the arms race. Just use some random URL to post this to, to avoid any regex based ad blockers.
- JupiterMoon 11y agoGood. I would like to encourage people to move to a whitelist based approach to filtering javascript...
- HappyTypist 11y agoWe will then have rules based on file hashes. People will obfuscate them, so it'll now be based on function signatures and API calls (get locale, screen size, OS, set cookie? No network requests for you). When that's bypassed, maybe we will see DPI of network requests for patterns. The arms race is only going to continue if trackers play the game. I think we'll probably see server side analytics instead, with Google and so making Apache/nginx/express modules and middlewear.
- pdkl95 11y agoWow. This would be great; once I have a few examples of this kind of behavior, I'm certain I can get a lot more people to turn off Javascript by default. (I know quite a few people that don't want Google logging their web browsing and who take active to prevent it) This is another "tragedy of the commons" situation, just like what we've seen recently in advertising, where escalating behavior forced a backlash. If you want to prevent a future backlash against analytics, stop aggregating the data.
- 11y ago
- suprjami 11y agoPerhaps the SaaS industry could use its cloudy-buzzword momentum to rage against the ad industry which necessitates the use of these plugins. I really have no problem with most ads. It's the one too-invasive full-page flyover or auto-playing video which ruins it for everyone else. If the ad industry was sensible and moderated itself, there would be far less ad blockers out there.
- vitd 11y agoBut it's not just ads. I don't want Google Analytics putting cookies on my machine and then tracking every other web site I go to. It's a privacy issue as much as an annoyance at ads.
- mirimir 11y agoIt's instructive to play with NoScript, Lightbeam and Cookie Controller in a fresh VM, connecting through a fresh VPN exit.
- collyw 11y agoI think it was defenetly a factor in Googles early success that they were subtle and unobtrusive about the way they did ads.
- manigandham 11y agoGoogle ad servers also power a lot of the worst formats today, just not on Google properties.
- joosters 11y agoGood! We need to ditch all the analytics software that rely on clients to make pointless HTTP requests. They are offloading their work on to the website visitors, wasting every user's bandwidth and slowing down internet connections worldwide. If you want to know who is visiting your site, try reading your server logs.
- praxulus 11y agoYou can't read their Google Analytics cookies in your server logs though.
- HappyTypist 11y agoUnless you patch your web server of your choice.
- joosters 11y agoMost web servers can log cookie data or even arbitrary HTTP headers, you just have to modify the log format.
- amelius 11y agoThe point is that third-party cookies will never reach your server (in this case Google Analytics' cookies), because the request they are piggy-backed on is going to Google, not to your server.
- oldmanjay 11y agoFor clarity, as some replies seem to have missed the point: because conforming clients will not send the cookie in the origin server request due to domain name differences.
- mahyarm 11y agoWhy don't they proxy host client-side analytics on their side, and don't put the word analytics in the endpoint names? Most ads would be unblockable if you made the ads come from your domain and have them indistinguishable from your normal content in the URIs as far as I know.
- adzicg 11y agoI'm working on a collaboration tool that uses google drive APIs, and we occasionally get e-mails from people claiming that the product is broken, but in 99% of the cases they installed disconnect or an overly zealous ad-blocker to explicitly block access to drive APIs. I assume this is just a blanket block on anything being loaded from google domains using ajax. Even though the error message suggests that they blocked it themselves, somehow that thought doesn't come across to users before they start complaining that our product is broken. Given that google loads APIs mostly in the background through several chains of dynamic JS, there isn't much to do about this, really.
- syed99 11y agoI've always used both server side analytics and JS based analytics, some external analytics tools have been long in a black list by EasyPrivacy and their constant addition and removal of those services from that list means sporadic stat charts. The only problem with server side analytics is that they're pretty limited with functionality unless you have your own internal analytics system which can track alot more information than just page views and general traffic stats.
- draw_down 11y agoIt's good to be proactive about such things as a developer. But it's also worth considering that if you're using things that take such a zealous approach to blocking that you are trading some of the UX of well-behaved sites and apps to deal with the poorly-behaved ones.
- tacticus 11y agoUnfortunately the well behaved sites are one in a thousand. to cater for those you need to expose yourself to a wide range of threats and spies. not to mention making your eyeballs bleed and your sites perform so poorly it isn't funny.
- spullara 11y agoWhat is the best first-party web analytics product?
- kylek 11y ago> Needless to say, we were slightly irritated at the fact that a valuable feature for our merchants, totally unrelated to online privacy issues, was blocked by the software. Why would the author think tracking/analytics is "totally unrelated to online privacy issues"? Baffling
- lifeisstillgood 11y agoBecause if I understand it, the people who were blocking "api/analytics" we're actually paying in order to see the page that was being blocked.
- hartator 11y agoI've a business that rely only on online advertising and directly lose revenue from ad blockers. Never felt irritated about that, it's just fair game. As a publisher, if you want to be profitable, you have to load a bunch of crap from Google, Criteo and others. And, I feel the quality of the JS loaded are slowly degrading. That's shameful point. Advertising networks should buy the best JS talents and release top quality JS. Until then, people should use Ad blockers.
- wmeredith 11y agoI think you meant to say "lose" not "loose".
- stevesearer 11y ago
- lifeisstillgood 11y agoIs one way around this to have analysis packages on my site? Is there now a upload your raw stats and get a nice analysis SaaS?
- alexatkeplar 11y agoA quick scan of the EasyPrivacy list reveals partial or full blocking of the JavaScript trackers and/or event collection endpoints of the following YC-backed SaaS analytics companies: - Mixpanel (17 matches) - Heap (heapanalytics.com^$third-party only) - Segment (11 matches) Disclaimer: co-founder of Snowplow Analytics, a first-party event analytics platform (https://github.com/snowplow/snowplow https://github.com/snowplow/snowplow). I see 2 entries in the list related to Snowplow, and 26 for Piwik (https://github.com/piwik/piwik https://github.com/piwik/piwik), another first-party solution.
- frik 11y agoThat EasyPrivacy apparently even blocks self hosted first-parts solutions is really bad. They are the good guys.
- alexatkeplar 11y agoWell, any blocking of self-hosted first-party analytics is easily circumvented by the site owner: you just rename the JavaScript Tracker filename to something new (or even safer, just minify the code into your own JS bundle), and put a new CNAME on your event collector.
- xdinomode 11y agoI run uBlock Origin and I block third party cookies. Because screw trackers and spammy ads.
- voltagex_ 11y agoUnfortunately you're blocking people self-hosting piwik.js too.
- stan_rogers 11y agoWell, isn't that a bummer. I'd block it manually if it weren't blocked automatically since it uses my resources (including, but not limited to, simply requesting and downloading the file) to do things the server ought to be doing at its own end. And no, you don't need to be more granular than that.
- manigandham 11y agoThat comes across as quite an entitled attitude. It's not really using your resources, that's the package deal for the site. And there are plenty of reasons for granular data - or do you claim to know every use case and rule over the internet?
- icebraining 11y agoThere is no package deal for websites. I know website owners really wish there was, but it's just that - wishful thinking. Maybe for sites which require registration (and hence explicitly accepting terms) that could be argued, but there's certainly no implicit agreement to download and process all the stuff the site is offering to the browser. And "entitled" is just a lazy insult.
- voltagex_ 11y agoShit, do you block Mustache/Handlebars too because it's using your resources to render a template? That's quite a reductive argument - you get to the point where you don't turn the computer on because it's using your electricity.
- dredmorbius 11y agoThis makes me wonder at the next generation of Web-based spyware. Presently, surveillance and monitoring is accomplished through third-party requests. Including, yes, sites' own monitoring tools -- Google Analytics, New Relic, and related services. If the monitoring can be brought in-house, and assembled back-end on the server side, so can the advertising. Which will means that the present generation of site-and-domain based blocking will eventually become less effective. Have fun storming the castle, kids.
- nacs 11y agoThey already go beyond site-and-domain based blocking. Most Adblock extensions support CSS-based rules that will block based on CSS IDs, class names, div-sizes (468x60 is a common ad size) or more complex rules. For the sites that can't be blocked with those, there are even more advanced blockers via Greasemonkey/Tampermonkey JS scripts.
- dredmorbius 11y agoI actually remember the _old_ regime of userContent.css with hacks for specific banner sizes and such. I've found a set of rules which are quite helpful at removing / reducing online Web annoyances myself, including killing variants of interstitials, popups, and flyovers. To the extent I'd strongly recommend current Web devs avoid use of those and similar terms in their own CSS. (ProTip: if you're calling an element "nag" or "tease", it probably shouldn't be there in the first place.)
- gPphX 11y agothis snipcart link is full of tracking: https://snipcart.com/blog/ad-blockers-saas-web-developers?utm_content=bufferd7420&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer https://snipcart.com/blog/ad-blockers-saas-web-developers?ut... "clean" it to: https://snipcart.com/blog/ad-blockers-saas-web-developers https://snipcart.com/blog/ad-blockers-saas-web-developers by: https://github.com/diegocr/cleanlinks https://github.com/diegocr/cleanlinks for Mozilla Firefox
- neilellis 11y agoProbably a good idea to use one of these on your SaaS portals for safety: https://github.com/nicjansma/adblock-detector.js https://github.com/nicjansma/adblock-detector.js , https://github.com/sitexw/BlockAdBlock https://github.com/sitexw/BlockAdBlock
- kleinsch 11y agoFor SaaS analytics companies, take a lesson learned from online advertising: host your corporate site and dashboard on a different domain than your ads/analytics pixels are hosted on. That way if your domain inevitably ends up on ad block lists, your corporate website and dashboard still work.