4 ms·

You would just block *.addomain.com at that point. Which is already what is being done on many of the blockers. There will always be domains to block, even if t

You would just block *.addomain.com at that point. Which is already what is being done on many of the blockers. There will always be domains to block, even if they add new domains, the blockers will probably be able to block them just as fast.

SamBam 10y ago
How about if they load them through *.google.com? Sure, you could whitelist www.google.com, mail.google.com, etc, but couldn't they keep ahead of you if they were ok with using their main domain? They could even start using www.google.com/ad-id
- M_Grey 10y ago
  Would Google really want to do that? It might be the impetus some people need to say "fuck it" to Google.
- j_s 10y ago
  Yes, domain fronting through Google App Engine is already helping Signal bypass censorship: https://whispersystems.org/blog/doodles-stickers-censorship/ https://whispersystems.org/blog/doodles-stickers-censorship/ Currently domain-based filtering is probably too small a proportion of traffic to even care about, but as ease-of-use comes to the masses there may come a point where the pro-ad side will implement this.
  - Xylakant 10y ago
    As far a I understand domain fronting works by sending a different host in the SNI header than later in the actual http request, thus hiding the actual requested host from an adversary watching the connection from the outside. This would require cooperation from the sending http stack, in this case the browser. I doubt that this is a viable option in this case.
- Xylakant 10y ago
  You really wouldn't want them on google.com/something since restricting cookies to sub-uris is a painful mess. Subdomains is slightly easier, but also easier to block.
  - jcfrei 10y ago
    There has been a - now defunct - working group which tried to address the issue of setting cookies on sub URIs: https://www.w3.org/TR/csp-cookies/ https://www.w3.org/TR/csp-cookies/ Particularly interesting is the proposal by someone from Akamai: https://lists.w3.org/Archives/Public/public-webappsec/2013Sep/0046.html https://lists.w3.org/Archives/Public/public-webappsec/2013Se... to include a path scope for cookies. I don't know if there are any more recent developments on cookies and their scope policies.
- deleted 10y ago
  [deleted]
- scottmf 10y ago
  Then you whitelist individual pages and assets.
  - SamBam 10y ago
    ...and never see new content? What if the New York Times decided to host all ads themselves? nytimes.com/ad-42.jpg couldn't be distinguished from nytimes.com/todays-front-page-image.jpg Obviously it's more likely for ad ad-provider like Google to do this, but even then, if there's new content from Google (say a blog post) I expect to be able to see it.
    - majewsky 10y ago
      I'm pretty sure that /ad-.jpg or something like that is already a blocking pattern. But you're correct: I'm seeing ads on some smaller sites that host the ad banners on their own servers. And you know what? I'm okay with this. I explicitly use uMatrix instead of uBlock since blocking trackers and malware is more important to me than blocking ads. (Getting rid of the more annoying ads is a bonus, though, and I might change my mind if first-party ads become annoying, too.)
    - scottmf 10y ago
      This is if Google hosted ads at google.com/* You could whitelist the search results page and nothing else. Viewing a blog post is less important IMO.
nkkollaw 10y ago
www.google.com/dslkj/ www.google.com/dog-595984hdfh/ www.google.com/cat21/

SamBam 10y ago

How about if they load them through *.google.com? Sure, you could whitelist www.google.com, mail.google.com, etc, but couldn't they keep ahead of you if they were ok with using their main domain? They could even start using www.google.com/ad-id

M_Grey 10y ago
Would Google really want to do that? It might be the impetus some people need to say "fuck it" to Google.
j_s 10y ago
Yes, domain fronting through Google App Engine is already helping Signal bypass censorship: https://whispersystems.org/blog/doodles-stickers-censorship/ https://whispersystems.org/blog/doodles-stickers-censorship/ Currently domain-based filtering is probably too small a proportion of traffic to even care about, but as ease-of-use comes to the masses there may come a point where the pro-ad side will implement this.
- Xylakant 10y ago
  As far a I understand domain fronting works by sending a different host in the SNI header than later in the actual http request, thus hiding the actual requested host from an adversary watching the connection from the outside. This would require cooperation from the sending http stack, in this case the browser. I doubt that this is a viable option in this case.
Xylakant 10y ago
You really wouldn't want them on google.com/something since restricting cookies to sub-uris is a painful mess. Subdomains is slightly easier, but also easier to block.
- jcfrei 10y ago
  There has been a - now defunct - working group which tried to address the issue of setting cookies on sub URIs: https://www.w3.org/TR/csp-cookies/ https://www.w3.org/TR/csp-cookies/ Particularly interesting is the proposal by someone from Akamai: https://lists.w3.org/Archives/Public/public-webappsec/2013Sep/0046.html https://lists.w3.org/Archives/Public/public-webappsec/2013Se... to include a path scope for cookies. I don't know if there are any more recent developments on cookies and their scope policies.
deleted 10y ago
[deleted]
scottmf 10y ago
Then you whitelist individual pages and assets.
- SamBam 10y ago
  ...and never see new content? What if the New York Times decided to host all ads themselves? nytimes.com/ad-42.jpg couldn't be distinguished from nytimes.com/todays-front-page-image.jpg Obviously it's more likely for ad ad-provider like Google to do this, but even then, if there's new content from Google (say a blog post) I expect to be able to see it.
  - majewsky 10y ago
    I'm pretty sure that /ad-.jpg or something like that is already a blocking pattern. But you're correct: I'm seeing ads on some smaller sites that host the ad banners on their own servers. And you know what? I'm okay with this. I explicitly use uMatrix instead of uBlock since blocking trackers and malware is more important to me than blocking ads. (Getting rid of the more annoying ads is a bonus, though, and I might change my mind if first-party ads become annoying, too.)
  - scottmf 10y ago
    This is if Google hosted ads at google.com/* You could whitelist the search results page and nothing else. Viewing a blog post is less important IMO.

nkkollaw 10y ago

www.google.com/dslkj/ www.google.com/dog-595984hdfh/ www.google.com/cat21/