4 ms·

It occurs to me that Google has some incentive to do this. Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of

It occurs to me that Google has some incentive to do this. Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of dubious origin/security.

ams6110 9y ago
Pardon me? How does this make ad blocking any more difficult. uBlock does not MITM ad sites AFAIK, it simply stops them loading.
- ronnier 9y ago
  Some people don't run adblockers on their client, they do it at centralized location, like with pihole to block at the DNS level. https can impact pihole. See this... > Since Pi-hole only knows about the domain being requested and not the protocols being used to access it, Pi-hole will intercept HTTPS advertisements and since the Pi-hole does not have the certificate of the actual server being queried, you may see slow loading times waiting for the request to time out. https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when-using-pi-hole-and-how-to-fix-it/ https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when...
craftyguy 9y ago
> Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of dubious origin/security. What do you mean? I can see how this might apply if you're trying to MITM your https requests and ad block them that way, but a browser (or its plugin) can simply choose not to display an element on the page without doing that.. right?
- kuschku 9y ago
  On Android, since 8.0, users can not override the CAs that applications use anymore. With SSL everywhere, you can't use a VPN to intercept anymore, as you can't get your own CA into the truststore. This means ad blocking in apps is now impossible. Okay, because everyone just downvotes this without reason, here's Google's official Android Dev blog stating exactly the same I just did: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to...
  - craftyguy 9y ago
    Um, you can still import custom SSL certs into Android 8.0's trust store. I do this for connecting to my OpenVPN instance.
    - kuschku 9y ago
      You can import into the User CA store, not into the system CA store. Since 8.0 these are separate, apps have to explicitly opt in to using user CA certs as well. For example, Google's News app doesn't, and as result you can't ad block on the articles it shows.
      - craftyguy 9y ago
        I see. Thanks for the clarification.
  - userbinator 9y ago
    Okay, because everyone just downvotes this without reason Notice the massive downvoting of other, otherwise reasonable, comments here too --- that is because any discussion around security seems to trigger a primitive instinct of fear, the very thing that corporations and governments have learned to harness and exploit to their advantage. It is really the same as the terrorism and "think of the children" arguments, and just as hard to have reasonable discussion or even opposition to.
- takeda 9y ago
  It wasn't meant for ad blocking, it was meant for the practice where ISPs were replacing ads on the site with their own and get the revenue.

It occurs to me that Google has some incentive to do this. Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of dubious origin/security.

ams6110 9y ago

Pardon me? How does this make ad blocking any more difficult. uBlock does not MITM ad sites AFAIK, it simply stops them loading.

ronnier 9y ago
Some people don't run adblockers on their client, they do it at centralized location, like with pihole to block at the DNS level. https can impact pihole. See this... > Since Pi-hole only knows about the domain being requested and not the protocols being used to access it, Pi-hole will intercept HTTPS advertisements and since the Pi-hole does not have the certificate of the actual server being queried, you may see slow loading times waiting for the request to time out. https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when-using-pi-hole-and-how-to-fix-it/ https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when...

craftyguy 9y ago

> Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of dubious origin/security. What do you mean? I can see how this might apply if you're trying to MITM your https requests and ad block them that way, but a browser (or its plugin) can simply choose not to display an element on the page without doing that.. right?

kuschku 9y ago
On Android, since 8.0, users can not override the CAs that applications use anymore. With SSL everywhere, you can't use a VPN to intercept anymore, as you can't get your own CA into the truststore. This means ad blocking in apps is now impossible. Okay, because everyone just downvotes this without reason, here's Google's official Android Dev blog stating exactly the same I just did: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to...
- craftyguy 9y ago
  Um, you can still import custom SSL certs into Android 8.0's trust store. I do this for connecting to my OpenVPN instance.
  - kuschku 9y ago
    You can import into the User CA store, not into the system CA store. Since 8.0 these are separate, apps have to explicitly opt in to using user CA certs as well. For example, Google's News app doesn't, and as result you can't ad block on the articles it shows.
    - craftyguy 9y ago
      I see. Thanks for the clarification.
- userbinator 9y ago
  Okay, because everyone just downvotes this without reason Notice the massive downvoting of other, otherwise reasonable, comments here too --- that is because any discussion around security seems to trigger a primitive instinct of fear, the very thing that corporations and governments have learned to harness and exploit to their advantage. It is really the same as the terrorism and "think of the children" arguments, and just as hard to have reasonable discussion or even opposition to.
takeda 9y ago
It wasn't meant for ad blocking, it was meant for the practice where ISPs were replacing ads on the site with their own and get the revenue.