6 ms·

I'm generally not inclined to fully whitelist anyplace because even if everything it loads today is safe, who's to say what's going to be loaded after the site

I'm generally not inclined to fully whitelist anyplace because even if everything it loads today is safe, who's to say what's going to be loaded after the site gets hacked. That said, I tried to go through and do some allowing of requests and scripts for places I recognized, including whitelisting the site in Ghostery to keep it from interfering. After adding 19 separate exceptions in uMatrix for both whole domains and for types of requests/actions on domains, I still don't see any ads but I do see an ever-increasing list of third-party sites Wired is pulling requests from. Given a choice between throwing up my hands and saying "Fine, f*ckit, do whatever the hell you want" and whitelisting Wired's requests to all of (disqus, optimizely, amazon-adsystem, condenastdigital, demdex, typekit, adobetm, chartbeat, cloudfront, doubleclick, googleadservices, googlesyndication, googletagservices, mediavoice, mookie1, omtrdc, outbrain, parsely, scorecardresearch, yldbt and zqtk) plus whatever others would be pulled in were I actually to whitelist, I guess I'll have to do without Wired. So far without ever actually loosening things up far enough to see ads that's AT LEAST 21 different top-level domains Wired is pulling from, not counting its own (and yes, I realize it's part of Conde Nast). Most of those top-level domains have at least 2 subdomains being pulled from, sometimes more. My basic reaction to this is that even if I trust Wired and Conde Nast, I don't know that I trust all those other sites like "mookie1," "yldbt," "zqtk" and whatever other obscurely-named domains. Frankly, were I to see "yldbt" or "zqtk" as a running process or folder name on a system I was working on, I'd immediately rename them and start virus and malware scans. So I guess my reading of Wired online will suffer much the same fate as my reading of Wired on paper, because while I like seeing occasional items from Wired it's not a daily destination for me, and I'm certainly not coughing up $50+/year for it.

monkmartinez 11y ago
It is crazy what kinds of BS you find when you run something like Little Snitch for OSX. On a fresh install of Firefox before I've had a chance to download adblock, there are two dozen popups requesting outbound connections... most of the time, I have NO idea who is behind the request or what these request really want. This is just the start page... news pages are even worse. Run some apps with Little Snitch turned on and you see the same thing. Tons of outbound requests to domains that I have never heard of and have no idea what they want on my machine. I just block everything with reckless abandon. I don't give a shit if my "experience" is degraded. Frankly, with small kids in the house who I would like to protect to the extent I am able... I am considering installing Pi Hole and whatever else I can find in addition to the spartan whitelist I've set up for them to use via parental controls.
- mkriss 11y ago
  Is there a good open source "Little Snitch" alternative?
  - grahamburger 11y ago
    Wireshark or even tcpdump will get you most of the way there, I think.
    - lucaspiller 11y ago
      Little Snitch doesn't just show you traffic, but also allows to block requests per domain per application.
      - grahamburger 11y ago
        Then add iptables to that list and I think you're set :-) seriously, all due respect to Little Snitch - I've heard a lot of good things about it and I'm sure it's much easier to use than the raw tools. But I doubt it's doing anything that can't be done with tcpdump/iptables.
  - monkmartinez 11y ago
    Maybe, but I haven't found anything as polished as Little Snitch. The level of control is amazingly high. I really don't use it to the full extent with profiles and the like. I set up some basic rules and let it work for awhile, then I pick and choose what to allow/disallow permanently... like a King :P It's one of the first things I install on my Macs. Worth every penny.
  - afandian 11y ago
    Not exactly the same, but Privacy Badger from EFF is great.
  - deleted 11y ago
    [deleted]
  - keeperofdakeys 11y ago
_greim_ 11y ago
> who's to say what's going to be loaded after the site gets hacked Never mind even getting hacked. Ad providers routinely violate the trust of content providers by activating audio, throwing up full screen overlays and who knows what else. I'm not an expert but I'm given to understand that it's hard for content providers to quality control these sort of ads. The whole delivery system is gamed to a ridiculous degree.
thirdsun 11y ago
Agreed. I think Wired, as well as other publishers, are missing the point here. I don't have any issue with ads in general - but if we're talking about ads that Wired has no control over and just fetches from a network, it's a whole different story. The same applies to ads that significantly increase page load times, bandwidth usage (I'm forced to use a metered LTE connection) or privacy concerns. Simple static ads would render most of these concerns unnecessary, but I doubt there's any incentive to go back to that kind of "outdated" advertising.
- gcb0 11y ago
  > slow ads heck i block ads as a side effect of blocking things like Google analytics.
- chrischen 11y ago
  But most people who block ads just don't want to see ads. Your technical concerns are in the minority.
  - macns 11y ago
    I think adblockers block content which usually is offsite, so it's not a matter of "technical concern". EDIT: rephrase
  - thirdsun 11y ago
    I think they just don't want to see ads as intrusive as the ones found these days. Neither do I. While my main concerns are performance, bandwidth, security and privacy, I don't think that simple static image ads would have led to the widespread adoption of ad blockers we're currently seeing. In my opinion it's due to the fact that ads became very intrusive lately - video, audio, flash, popups, fullscreen overlays, endless scripts, you name it.
    - Freak_NL 11y ago
      Absolutely. The number of people who would still resort to blocking ads if they were non-targeted, static, tastefully done yet clearly recognizable as advertisements, served locally, non-tracking, and non-obtrusive would probably have been negligible. But now there is an entire economy that depends on advertisements that track you and know you and need to be served via third party brokers, because if they didn't they wouldn't sell. I don't know the solution to fix this mess, but I will gladly help pop the current bubble so something more useful can replace it.
bambax 11y ago
The reason blocking is so easy and works so well is because everyone got lazy. Publishers want ads but don't want to actually do the job of selling them; ads used to be free money, and this is coming to an end. Ads from their own domain would be a little harder to block, especially because blocking would have to be done on a page-by-page basis (or at least, website-by-website).
- majewsky 11y ago
  Personally, I do not block first-party ads (i.e. ad images served from the same domain as the original content). For me, the point of using an adblocker is to reduce attack surface and tracking opportunities. I see, of course, that I'm likely not representing the majority of adblock users.
  - timonovici 11y ago
    I have ublock myself for privacy concerns, but I install ad blockers on all my relatives computers just because they are trustful and dumb enough to click any shiny green button that says "Download". Otherwise, I have to pull my hair when I look at their computers full of crap, which they can't explain how it got there. If the internet with ads wasn't such a dangerous place, I wouldn't do it in the first place.
iSnow 11y ago
Could someone enlighten me why a lot of sites don't only pull in google analytics, but also a handful of other analytics sites like scorecaredresearch or chartbeat?
- Falkon1313 11y ago
  Sure. Every analytics company tries to differentiate themselves by claiming that they do something the others don't and showing off some pretty charts. The marketers buy the hype and want all of that. "If I take this pretty chart from here, and that table that from there, and these numbers from over here, I can make a really impressive report!" And they want to make sure that they're collecting all the data they could possibly be collecting (because they never know when they might suddenly need the last 6 months data about something they never thought of), even though they don't know what queries they want to be able to make. So they make the developers add all of them, end up with tons of data but very little information, and start talking about 'this big data thing' that could maybe give them answers even though they still don't know what questions they want to ask. And to use it, you just have to add this little snippet of javascript...
  - soared 11y ago
    It sounds like the points you're making are all negative, but it also sounds like a fairly valid argument to me. Sure marketers add too much js with the allure of big data, but whats the cost? 0.1% of users (hn readers and the like) are annoyed by it? I'd gladly piss off a tiny fraction of my users to better understand the other 99.9%.
- blueskittle 11y ago
  Google Analytics is used primarily for internal reporting and analysis. bscorecardresearch is part of ComScore, which is a third-party reporting company. Advertisers often require publishers to provide third-party reports for traffic so that they can validate the ad campaign numbers that the publisher reports. Chartbeat and others can provide supplemental reporting to a publisher if they think that there are gaps with what Google Analytics provides.
sedatk 11y ago
> who's to say what's going to be loaded after the site gets hacked when a site gets hacked, you get malicious content regardless you block ads or not.
- majewsky 11y ago
  Depends on whether it's the site itself that gets hacked, or the ad network. (The latter is going to be a much more valuable target in practice since it allows malware to spread via multiple sites, not just one.)
- fencepost 11y ago
  That depends on whether they hack the site to actually feed the malicious content or just get enough of a foot in to get it linked from an actual hosting location. If what they have is a database hack where they can inject some content but don't have full control, they may be pushing links while trying to get further access.
deleted 11y ago
[deleted]
torgoguys 11y ago
They're not talking to you or me. If they were, this article would have been "How Wired Is Going to Handle Tracking and Web Cruft" and address the underlying problem causing people to install ad blockers. I want people to get paid--really I do--but I'm not stepping barefoot into a cesspool of web cruft to do it. Blockers are like putting boots on so you can wade through it safely. Clean up your mess and I don't mind going barefoot.
- oneeyedpigeon 11y ago
  > We know that there are many reasons for running an ad blocker, from simply wanting a faster, cleaner browsing experience to concerns about security and tracking software. They sound as though they're trying to accommodate 'us', but the proof will be in what the 'ad-free' experience is really like. I wonder if they're considered a paid RSS feed as an alternative - that would certainly solve much of the issue for many.
runholm 11y ago
I tried to allow their ads after reading this article, but they still didn't load because they depend on several trackers (which I still block).
coldpie 11y ago
Silly me trying to read a news article: https://twitter.com/ColdPie1/status/654350476612272128 https://twitter.com/ColdPie1/status/654350476612272128
CydeWeys 11y ago
> So far without ever actually loosening things up far enough to see ads that's AT LEAST 21 different top-level domains Wired is pulling from, not counting its own (and yes, I realize it's part of Conde Nast). Most of those top-level domains have at least 2 subdomains being pulled from, sometimes more. Nit: Those aren't top-level domains. TLDs are things like com, net, org, uk, io, etc. More info here: https://en.wikipedia.org/wiki/Top-level_domain https://en.wikipedia.org/wiki/Top-level_domain
a3n 11y ago
tl;dr: Their attack surface is huge. They probably don't even know at any moment why a page is pulling everything it pulls. No thanks.

monkmartinez 11y ago

It is crazy what kinds of BS you find when you run something like Little Snitch for OSX. On a fresh install of Firefox before I've had a chance to download adblock, there are two dozen popups requesting outbound connections... most of the time, I have NO idea who is behind the request or what these request really want. This is just the start page... news pages are even worse. Run some apps with Little Snitch turned on and you see the same thing. Tons of outbound requests to domains that I have never heard of and have no idea what they want on my machine. I just block everything with reckless abandon. I don't give a shit if my "experience" is degraded. Frankly, with small kids in the house who I would like to protect to the extent I am able... I am considering installing Pi Hole and whatever else I can find in addition to the spartan whitelist I've set up for them to use via parental controls.

mkriss 11y ago
Is there a good open source "Little Snitch" alternative?
- grahamburger 11y ago
  Wireshark or even tcpdump will get you most of the way there, I think.
  - lucaspiller 11y ago
    Little Snitch doesn't just show you traffic, but also allows to block requests per domain per application.
    - grahamburger 11y ago
      Then add iptables to that list and I think you're set :-) seriously, all due respect to Little Snitch - I've heard a lot of good things about it and I'm sure it's much easier to use than the raw tools. But I doubt it's doing anything that can't be done with tcpdump/iptables.
- monkmartinez 11y ago
  Maybe, but I haven't found anything as polished as Little Snitch. The level of control is amazingly high. I really don't use it to the full extent with profiles and the like. I set up some basic rules and let it work for awhile, then I pick and choose what to allow/disallow permanently... like a King :P It's one of the first things I install on my Macs. Worth every penny.
- afandian 11y ago
  Not exactly the same, but Privacy Badger from EFF is great.
- deleted 11y ago
  [deleted]
- keeperofdakeys 11y ago

_greim_ 11y ago

> who's to say what's going to be loaded after the site gets hacked Never mind even getting hacked. Ad providers routinely violate the trust of content providers by activating audio, throwing up full screen overlays and who knows what else. I'm not an expert but I'm given to understand that it's hard for content providers to quality control these sort of ads. The whole delivery system is gamed to a ridiculous degree.

thirdsun 11y ago

Agreed. I think Wired, as well as other publishers, are missing the point here. I don't have any issue with ads in general - but if we're talking about ads that Wired has no control over and just fetches from a network, it's a whole different story. The same applies to ads that significantly increase page load times, bandwidth usage (I'm forced to use a metered LTE connection) or privacy concerns. Simple static ads would render most of these concerns unnecessary, but I doubt there's any incentive to go back to that kind of "outdated" advertising.

gcb0 11y ago
> slow ads heck i block ads as a side effect of blocking things like Google analytics.
chrischen 11y ago
But most people who block ads just don't want to see ads. Your technical concerns are in the minority.
- macns 11y ago
  I think adblockers block content which usually is offsite, so it's not a matter of "technical concern". EDIT: rephrase
- thirdsun 11y ago
  I think they just don't want to see ads as intrusive as the ones found these days. Neither do I. While my main concerns are performance, bandwidth, security and privacy, I don't think that simple static image ads would have led to the widespread adoption of ad blockers we're currently seeing. In my opinion it's due to the fact that ads became very intrusive lately - video, audio, flash, popups, fullscreen overlays, endless scripts, you name it.
  - Freak_NL 11y ago
    Absolutely. The number of people who would still resort to blocking ads if they were non-targeted, static, tastefully done yet clearly recognizable as advertisements, served locally, non-tracking, and non-obtrusive would probably have been negligible. But now there is an entire economy that depends on advertisements that track you and know you and need to be served via third party brokers, because if they didn't they wouldn't sell. I don't know the solution to fix this mess, but I will gladly help pop the current bubble so something more useful can replace it.

bambax 11y ago

The reason blocking is so easy and works so well is because everyone got lazy. Publishers want ads but don't want to actually do the job of selling them; ads used to be free money, and this is coming to an end. Ads from their own domain would be a little harder to block, especially because blocking would have to be done on a page-by-page basis (or at least, website-by-website).

majewsky 11y ago
Personally, I do not block first-party ads (i.e. ad images served from the same domain as the original content). For me, the point of using an adblocker is to reduce attack surface and tracking opportunities. I see, of course, that I'm likely not representing the majority of adblock users.
- timonovici 11y ago
  I have ublock myself for privacy concerns, but I install ad blockers on all my relatives computers just because they are trustful and dumb enough to click any shiny green button that says "Download". Otherwise, I have to pull my hair when I look at their computers full of crap, which they can't explain how it got there. If the internet with ads wasn't such a dangerous place, I wouldn't do it in the first place.

iSnow 11y ago

Could someone enlighten me why a lot of sites don't only pull in google analytics, but also a handful of other analytics sites like scorecaredresearch or chartbeat?

Falkon1313 11y ago
Sure. Every analytics company tries to differentiate themselves by claiming that they do something the others don't and showing off some pretty charts. The marketers buy the hype and want all of that. "If I take this pretty chart from here, and that table that from there, and these numbers from over here, I can make a really impressive report!" And they want to make sure that they're collecting all the data they could possibly be collecting (because they never know when they might suddenly need the last 6 months data about something they never thought of), even though they don't know what queries they want to be able to make. So they make the developers add all of them, end up with tons of data but very little information, and start talking about 'this big data thing' that could maybe give them answers even though they still don't know what questions they want to ask. And to use it, you just have to add this little snippet of javascript...
- soared 11y ago
  It sounds like the points you're making are all negative, but it also sounds like a fairly valid argument to me. Sure marketers add too much js with the allure of big data, but whats the cost? 0.1% of users (hn readers and the like) are annoyed by it? I'd gladly piss off a tiny fraction of my users to better understand the other 99.9%.
blueskittle 11y ago
Google Analytics is used primarily for internal reporting and analysis. bscorecardresearch is part of ComScore, which is a third-party reporting company. Advertisers often require publishers to provide third-party reports for traffic so that they can validate the ad campaign numbers that the publisher reports. Chartbeat and others can provide supplemental reporting to a publisher if they think that there are gaps with what Google Analytics provides.

sedatk 11y ago

> who's to say what's going to be loaded after the site gets hacked when a site gets hacked, you get malicious content regardless you block ads or not.

majewsky 11y ago
Depends on whether it's the site itself that gets hacked, or the ad network. (The latter is going to be a much more valuable target in practice since it allows malware to spread via multiple sites, not just one.)
fencepost 11y ago
That depends on whether they hack the site to actually feed the malicious content or just get enough of a foot in to get it linked from an actual hosting location. If what they have is a database hack where they can inject some content but don't have full control, they may be pushing links while trying to get further access.

deleted 11y ago

[deleted]

torgoguys 11y ago

They're not talking to you or me. If they were, this article would have been "How Wired Is Going to Handle Tracking and Web Cruft" and address the underlying problem causing people to install ad blockers. I want people to get paid--really I do--but I'm not stepping barefoot into a cesspool of web cruft to do it. Blockers are like putting boots on so you can wade through it safely. Clean up your mess and I don't mind going barefoot.

oneeyedpigeon 11y ago
> We know that there are many reasons for running an ad blocker, from simply wanting a faster, cleaner browsing experience to concerns about security and tracking software. They sound as though they're trying to accommodate 'us', but the proof will be in what the 'ad-free' experience is really like. I wonder if they're considered a paid RSS feed as an alternative - that would certainly solve much of the issue for many.

runholm 11y ago

I tried to allow their ads after reading this article, but they still didn't load because they depend on several trackers (which I still block).

coldpie 11y ago

Silly me trying to read a news article: https://twitter.com/ColdPie1/status/654350476612272128 https://twitter.com/ColdPie1/status/654350476612272128

CydeWeys 11y ago

> So far without ever actually loosening things up far enough to see ads that's AT LEAST 21 different top-level domains Wired is pulling from, not counting its own (and yes, I realize it's part of Conde Nast). Most of those top-level domains have at least 2 subdomains being pulled from, sometimes more. Nit: Those aren't top-level domains. TLDs are things like com, net, org, uk, io, etc. More info here: https://en.wikipedia.org/wiki/Top-level_domain https://en.wikipedia.org/wiki/Top-level_domain

a3n 11y ago

tl;dr: Their attack surface is huge. They probably don't even know at any moment why a page is pulling everything it pulls. No thanks.