9 ms·

Measuring and Disrupting Anti-Adblockers Using Differential Execution Analysis [pdf]

91 points by dedalus 9y ago

lainon 9y ago
related I guess? http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-imc2017.pdf http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-imc20... http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-pets2017.pdf http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-pets2...
gottam 9y ago
This is probably not an arms race ad companies want to play. Someone who has an adblocker installed is unlikely to be respective to ads, and by installing an adblocker they currently are opting out of from the ad vendors metrics. which is better than adblock vendors trying to feign ads loading or "interest" in the ads, such as addons like https://adnauseam.io https://adnauseam.io So its debatable even they would win the ad arms race, but they would also lose credibility in their own metrics as the easiest solution will be to start fooling ad companies that their ads are loading.
- mehrdadn 9y ago
  > Someone who has an adblocker installed is unlikely to be respective to ads Any statistics to believe this is true? I know for a fact it's false for myself because I do sometimes click on ads when I don't block them.
  - gottam 9y ago
    I never said it doesn't happen. You're the odd case and of course there's someone who had adblock installed for them. I just said "unlikely", because they went out of their way to install the adblocker.
    - Feniks 9y ago
      I myself will go to any length to avoid advertising. Luckily its pretty easy.
  - belorn 9y ago
    Most call centers has a policy to stop if the recipient clearly says no. Is there statistics to support this as a business decision? How effective is continued pestering a person in order to sell a product. The Sales Pitch by Philip K. Dick comes in mind.
  - russdill 9y ago
    One of the reasons for ads is not clicks, but increased brand recognition/familiarity. Brand familiarity and brand choice are proven to be highly correlated.
  - parenthephobia 9y ago
    Ads appearing when you don't block them isn't really an issue. When you are blocking ads, do you click on them? I wouldn't: I'd instead be annoyed that I'm seeing ads when I have an adblocker running.
    - mehrdadn 9y ago
      > Ads appearing when you don't block them isn't really an issue. When you are blocking ads, do you click on them? I wouldn't: I'd instead be annoyed that I'm seeing ads when I have an adblocker running. Yeah I do, that's literally what I'm saying. I've clicked on ads that have slipped through.
- jamiequint 9y ago
  > Someone who has an adblocker installed is unlikely to be respective to ads This is false.
- Analemma_ 9y ago
  One of the Penny Arcade guys once related an anecdote about when he worked in a telemarketing call center. In this case, all the phone numbers he had were from people who had signed up for an anti-telemarketing service, which had then sold their list to telemarketers. He said that the people he called, understandably, usually responded with snarling rage unusual even by the standards of people getting telemarketing calls. The moral is, when people specifically take determined action to avoid you, and you go out of your way to circumvent them and reach them anyway, they're not going to be especially receptive or warm. I think publishers deploying anti-adblock technology are making a similar mistake. When someone takes action not to see ads, do you really think they're going to respond well when you deploy trickery to show them ads anyway? Are they going to be especially well-disposed to your brand, or are they going to be filled with determined hatred for you? This is a losing proposition.
mirimir 9y ago
This is a very cool approach for detecting anti-adblocking. However, I don't quite get the point for disruption. That is, it seems necessary to load pages at least twice, and then do some computation. How does that help users who are concerned about privacy, throughput or CPU load?
- mrob 9y ago
  This is a technique for automatically generating anti-anti-adblocking rules. They'll be added to the block lists, so you won't have to generate them each time, only when the anti-adblocking script changes enough to break them.
  - mirimir 9y ago
    Doh. Thanks.
notaboutdave 9y ago
Cross-browser support for WebAssembly was the death knell for ad blockers.
- mrob 9y ago
  Worst case scenario, we can sandbox the whole browser and detect ads visually.
  - nugi 9y ago
    Or optimise usage for less annoying, privacy invasive services. Which was always the solution.
    - amelius 9y ago
      If we visually detect and remove ads, we take away the incentive for big companies to create ads and track us in the first place.
  - amelius 9y ago
    If Apple ever builds hardware for that, they could destroy Google.
  - inetknght 9y ago
    Let me know how that works when the website "requires" DRM to function.
    - nsgi 9y ago
      Probably about as well as most forms of DRM...
- CJefferson 9y ago
  No, stopping ad blockers would be trivial today if the ad distributors let their JavaScript and ads be distributed from the same domain as page content. As long as the ads come from clearly identifiable domains, there is a good chance at stopping them.
gpderetta 9y ago
. Edit: failed at reading comprehension
taxreform 9y ago
According to the paper, they seem to have modified Chromium's JavaScript engine in order to record execution paths of JavaScript code. Does anyone know exactly how they modified Chromium (or preferably the exact patch they applied to Chromium)?
tanilama 9y ago
Won't be very useful. The internet is turning to subscription model very quickly.
- votepaunchy 9y ago
  And most subscription sites still show ads.
leeoniya 9y ago
if it weren't for CDNs, simply blocking all 3rd party domains is the fastest, most reliable and secure way to block ads and greatly reduce bandwidth. i highly recommend running both uMatrix and uBlock Origin. then whitelist cdns on a per-domain basis. with the amount of tech and data available these days, google still chooses to show me an ad for chevy on an ice cream site. the fact that the ads are so obviously out of context is truly baffling - does this seriously work for the general consumer? even if i've searched for chevy before, why would i suddenly exit my ice cream experience? if ads were contextually better, less distracting and less bandwidth/perf impactful, i may actually be convinced to view them. unfortunately none of these things are true.
- lithos 9y ago
  Blocking 3rd party domains isn't enough. Especially when there is tons of advice to link to Google fonts, and 3rd party libraries instead of your own. Also when a bunch of websites are using AWS/Cloudfront URLs for things like loading images and in some cases ads may hide behind those as well.
  - kroltan 9y ago
    > [...] when a bunch of websites are using AWS/Cloudfront URLs for things like loading images [...] You missed this part: > if it weren't for CDNs, [...]
- paulie_a 9y ago
  > with the amount of tech a d data This blows my mind. The ad industry has basically taken three steps backwards in a time with incredible analytics. Google, Facebook etc have drunkenly ruined and inundated their targets to the point people outright mentally adblock
  - jamiequint 9y ago
    Except all their internal metrics show the exact opposite when it comes to engagement, lower CPAs, higher CTRs, etc. Just because you personally think it's worse doesn't mean it's statistically worse across their entire userbase. FB didn't become a $500bn company in spite of being bad at optimizing their ads business, they became a half-a-trillion dollar company precisely because they are very very good at that.
paulie_a 9y ago
There was an article the other day on HN regarding mental burnout of ads. This morning I decided to count the ads on a news article, there were 14 between sponsored bs and banner ads. Every single one was complete garbage. Click here to find out how the tech and ad industry are lowering the bar at a "shocking" rate
- InternetUser 9y ago
  What would be an example of a non-garbage ad that could've been there?
jamiequint 9y ago
This is pretty immoral. Companies that create or provide content should at the very least be able to decide if they want to serve you content if you don't agree to see ads with it (or pay for it). How is it moral to effectively force someone to allow you to see the content you want to see without compensating them for it.
- mnthaeo98htnn 9y ago
  This is like saying that it's immoral to change the channel whenever ads come on the TV or radio, or to use the mute button on your TV. It is in no way immoral. The way HTML works is your browser sends a request for resources it wants, then renders them for you. IF you don't send the request for resources you don't want, that's not immoral. If it affects the web sites' businesses, then the onus is on them to come up with a model that works. There are other reasonable free models, such as those used by public TV and public radio.
  - jamiequint 9y ago
    You are sending the request for the resources though, e.g. if you load facebook.com there isn't a separate request for ads, they are just loaded as part of the feed. It's very much within their right (contractually) to encumber your usage of the site to rendering the full page as it's served to you. Attempting to fool them into thinking you're rendering the content as presented while you do not actually do that (as a result, imposing on them a net revenue loss) is clearly immoral. You don't agree to a TOS by watching TV and listening to the radio, the internet is fundamentally different from those media.
    - Nadya 9y ago
      That isn't how the internet works. It's a series of requests and at any point some requests can be rejected. Whether that request was critical for site functionality depends on what request that was. Consenting to requests from google.com does not guarantee or imply consent from adservices.google.com, so if google.com tells my browser to please fetch resources from adservices.google.com I'll tell them to go away. Personally, I use a giant blocklist [0] of domains I do not wish to request resources from. As a comparison, if you invite a friend to your house do you expect them to show up with 50 other people? Would you be upset with your friend for assuming it would be okay to invite other people to your house without your consent? Is it morally wrong to tell your friend they may not bring other friends to your house without your approval? If you agreed to letting them bring friends over, are you okay with any friends or is their neo-nazi friend not allowed? [0] http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ >You don't agree to a TOS by watching TV and listening to the radio, the internet is fundamentally different from those media. You don't agree to a TOS by visiting a website either. Agreement is usually done when registering an account and even those are limited in any legal ability to enforce it.

91 points by dedalus 9y ago

related I guess? http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-imc2017.pdf http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-imc20... http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-pets2017.pdf http://homepage.divms.uiowa.edu/~mshafiq/files/adblock-pets2...

gottam 9y ago

This is probably not an arms race ad companies want to play. Someone who has an adblocker installed is unlikely to be respective to ads, and by installing an adblocker they currently are opting out of from the ad vendors metrics. which is better than adblock vendors trying to feign ads loading or "interest" in the ads, such as addons like https://adnauseam.io https://adnauseam.io So its debatable even they would win the ad arms race, but they would also lose credibility in their own metrics as the easiest solution will be to start fooling ad companies that their ads are loading.

mehrdadn 9y ago
> Someone who has an adblocker installed is unlikely to be respective to ads Any statistics to believe this is true? I know for a fact it's false for myself because I do sometimes click on ads when I don't block them.
- gottam 9y ago
  I never said it doesn't happen. You're the odd case and of course there's someone who had adblock installed for them. I just said "unlikely", because they went out of their way to install the adblocker.
  - Feniks 9y ago
    I myself will go to any length to avoid advertising. Luckily its pretty easy.
- belorn 9y ago
  Most call centers has a policy to stop if the recipient clearly says no. Is there statistics to support this as a business decision? How effective is continued pestering a person in order to sell a product. The Sales Pitch by Philip K. Dick comes in mind.
- russdill 9y ago
  One of the reasons for ads is not clicks, but increased brand recognition/familiarity. Brand familiarity and brand choice are proven to be highly correlated.
- parenthephobia 9y ago
  Ads appearing when you don't block them isn't really an issue. When you are blocking ads, do you click on them? I wouldn't: I'd instead be annoyed that I'm seeing ads when I have an adblocker running.
  - mehrdadn 9y ago
    > Ads appearing when you don't block them isn't really an issue. When you are blocking ads, do you click on them? I wouldn't: I'd instead be annoyed that I'm seeing ads when I have an adblocker running. Yeah I do, that's literally what I'm saying. I've clicked on ads that have slipped through.
jamiequint 9y ago
> Someone who has an adblocker installed is unlikely to be respective to ads This is false.
Analemma_ 9y ago
One of the Penny Arcade guys once related an anecdote about when he worked in a telemarketing call center. In this case, all the phone numbers he had were from people who had signed up for an anti-telemarketing service, which had then sold their list to telemarketers. He said that the people he called, understandably, usually responded with snarling rage unusual even by the standards of people getting telemarketing calls. The moral is, when people specifically take determined action to avoid you, and you go out of your way to circumvent them and reach them anyway, they're not going to be especially receptive or warm. I think publishers deploying anti-adblock technology are making a similar mistake. When someone takes action not to see ads, do you really think they're going to respond well when you deploy trickery to show them ads anyway? Are they going to be especially well-disposed to your brand, or are they going to be filled with determined hatred for you? This is a losing proposition.

mirimir 9y ago

This is a very cool approach for detecting anti-adblocking. However, I don't quite get the point for disruption. That is, it seems necessary to load pages at least twice, and then do some computation. How does that help users who are concerned about privacy, throughput or CPU load?

mrob 9y ago
This is a technique for automatically generating anti-anti-adblocking rules. They'll be added to the block lists, so you won't have to generate them each time, only when the anti-adblocking script changes enough to break them.
- mirimir 9y ago
  Doh. Thanks.

notaboutdave 9y ago

Cross-browser support for WebAssembly was the death knell for ad blockers.

mrob 9y ago
Worst case scenario, we can sandbox the whole browser and detect ads visually.
- nugi 9y ago
  Or optimise usage for less annoying, privacy invasive services. Which was always the solution.
  - amelius 9y ago
    If we visually detect and remove ads, we take away the incentive for big companies to create ads and track us in the first place.
- amelius 9y ago
  If Apple ever builds hardware for that, they could destroy Google.
- inetknght 9y ago
  Let me know how that works when the website "requires" DRM to function.
  - nsgi 9y ago
    Probably about as well as most forms of DRM...
CJefferson 9y ago
No, stopping ad blockers would be trivial today if the ad distributors let their JavaScript and ads be distributed from the same domain as page content. As long as the ads come from clearly identifiable domains, there is a good chance at stopping them.

gpderetta 9y ago

. Edit: failed at reading comprehension

taxreform 9y ago

According to the paper, they seem to have modified Chromium's JavaScript engine in order to record execution paths of JavaScript code. Does anyone know exactly how they modified Chromium (or preferably the exact patch they applied to Chromium)?

tanilama 9y ago

Won't be very useful. The internet is turning to subscription model very quickly.

votepaunchy 9y ago
And most subscription sites still show ads.

leeoniya 9y ago

if it weren't for CDNs, simply blocking all 3rd party domains is the fastest, most reliable and secure way to block ads and greatly reduce bandwidth. i highly recommend running both uMatrix and uBlock Origin. then whitelist cdns on a per-domain basis. with the amount of tech and data available these days, google still chooses to show me an ad for chevy on an ice cream site. the fact that the ads are so obviously out of context is truly baffling - does this seriously work for the general consumer? even if i've searched for chevy before, why would i suddenly exit my ice cream experience? if ads were contextually better, less distracting and less bandwidth/perf impactful, i may actually be convinced to view them. unfortunately none of these things are true.

lithos 9y ago
Blocking 3rd party domains isn't enough. Especially when there is tons of advice to link to Google fonts, and 3rd party libraries instead of your own. Also when a bunch of websites are using AWS/Cloudfront URLs for things like loading images and in some cases ads may hide behind those as well.
- kroltan 9y ago
  > [...] when a bunch of websites are using AWS/Cloudfront URLs for things like loading images [...] You missed this part: > if it weren't for CDNs, [...]
paulie_a 9y ago
> with the amount of tech a d data This blows my mind. The ad industry has basically taken three steps backwards in a time with incredible analytics. Google, Facebook etc have drunkenly ruined and inundated their targets to the point people outright mentally adblock
- jamiequint 9y ago
  Except all their internal metrics show the exact opposite when it comes to engagement, lower CPAs, higher CTRs, etc. Just because you personally think it's worse doesn't mean it's statistically worse across their entire userbase. FB didn't become a $500bn company in spite of being bad at optimizing their ads business, they became a half-a-trillion dollar company precisely because they are very very good at that.

paulie_a 9y ago

There was an article the other day on HN regarding mental burnout of ads. This morning I decided to count the ads on a news article, there were 14 between sponsored bs and banner ads. Every single one was complete garbage. Click here to find out how the tech and ad industry are lowering the bar at a "shocking" rate

InternetUser 9y ago
What would be an example of a non-garbage ad that could've been there?

jamiequint 9y ago

This is pretty immoral. Companies that create or provide content should at the very least be able to decide if they want to serve you content if you don't agree to see ads with it (or pay for it). How is it moral to effectively force someone to allow you to see the content you want to see without compensating them for it.

mnthaeo98htnn 9y ago
This is like saying that it's immoral to change the channel whenever ads come on the TV or radio, or to use the mute button on your TV. It is in no way immoral. The way HTML works is your browser sends a request for resources it wants, then renders them for you. IF you don't send the request for resources you don't want, that's not immoral. If it affects the web sites' businesses, then the onus is on them to come up with a model that works. There are other reasonable free models, such as those used by public TV and public radio.
- jamiequint 9y ago
  You are sending the request for the resources though, e.g. if you load facebook.com there isn't a separate request for ads, they are just loaded as part of the feed. It's very much within their right (contractually) to encumber your usage of the site to rendering the full page as it's served to you. Attempting to fool them into thinking you're rendering the content as presented while you do not actually do that (as a result, imposing on them a net revenue loss) is clearly immoral. You don't agree to a TOS by watching TV and listening to the radio, the internet is fundamentally different from those media.
  - Nadya 9y ago
    That isn't how the internet works. It's a series of requests and at any point some requests can be rejected. Whether that request was critical for site functionality depends on what request that was. Consenting to requests from google.com does not guarantee or imply consent from adservices.google.com, so if google.com tells my browser to please fetch resources from adservices.google.com I'll tell them to go away. Personally, I use a giant blocklist [0] of domains I do not wish to request resources from. As a comparison, if you invite a friend to your house do you expect them to show up with 50 other people? Would you be upset with your friend for assuming it would be okay to invite other people to your house without your consent? Is it morally wrong to tell your friend they may not bring other friends to your house without your approval? If you agreed to letting them bring friends over, are you okay with any friends or is their neo-nazi friend not allowed? [0] http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ >You don't agree to a TOS by watching TV and listening to the radio, the internet is fundamentally different from those media. You don't agree to a TOS by visiting a website either. Agreement is usually done when registering an account and even those are limited in any legal ability to enforce it.