13 ms·
Ad network uses advanced malware technique to conceal CPU-draining mining ads
- dingo_bat 9y agoI use some advanced techniques myself: ublock origin! Seriously though, fuck ads, fuck ad companies, fuck browsers made by ad companies. Each and every one of them is actively working to erode your privacy and use your resources.
- sheepz 9y agoWhat would you consider as the alternative? People are so used to getting news and various services "for free", it's very difficult to get them to pay for it.
- rebuilder 9y agoI've been idly wondering if it would be so bad if advertising on the web simply wasn't profitable. Losing search engines seems like the biggest loss to me, and admittedly it's a doozy. But otherwise, it's not immediately obvious to me that the web is better for all the ad-funded content on it in the first place.
- kasey_junk 9y agoI'll miss gmail, gce, chrome, the google security team, etc.
- nwah1 9y agoFor text, computing resources are cheap enough that it can be entirely non-profit or run by independent bloggers, etc. Wikipedia, blogs, IRC, and sites like HN don't require all that much and could be financed without ads if they chose to be. Video, particularly HD video, absolutely requires ads or subscriptions. Social networks could probably be built atop WebRTC and run in a federated way, more like IRC... but image or video sharing would start to demand significant resources.
- pjc50 9y agoQuite a lot of material on the web is only there because of advertising, not because it's any good. Unsurprisingly the "free market" doesn't work very well when everything has a zero cost associated with it. The downside of losing ad-supported media will be ad-sponsored media paying to write the content itself.
- xoa 9y agoThis has certainly been the "common wisdom" trotted out for a long time now, but it's also always struck me as post-hoc reasoning. There simply has never been a modern industry-wide, concerted effort towards creating and requiring use of an extremely convenient web pay system, despite advances in technology and user sophistication over the last 20 years. If ads simply were no longer economically viable, would users really simply give up on all news and such? Everyone would simply throw in the towel? I'm extremely skeptical. It's not at all hard to think of a lot of different ways that would be enormously convenient and highly transparent to users to have direct pay options. I think they haven't been tried because of the standard technology issues: we're in a local minima and there is enormous inertia with what "everyone uses" already. But that's not at all the same thing as being in an absolute minima, where any change would necessarily be less efficient. Quite the contrary, in tracking flow of money and resources advertising looks to have quite a few unnecessary inefficiencies between user goals and publisher goals. That being the case I see no reason to believe inherently that something better could not be developed if there was sufficient motivation, and an existential threat would certainly be that.
- ballenf 9y ago> industry-wide, concerted effort towards creating and requiring use of an extremely convenient web pay system Without government backing, the system you envisage would ironically be prohibited by antitrust laws. It would be a rather clear example of price-fixing and collusion by competitors. Maybe there's some way to do this through peer pressure or incentives, but I think we've seen that approach fail so often that it's hard to see what could be done differently short of a hardline approach that would trigger regulatory scrutiny.
- pjc50 9y agoI very much doubt it, given the existence of Visa/Mastercard and the various app stores.
- arkh 9y agoI think you should also use quotation marks around the word news. Maybe the alternative is: if you don't want to charge for the content you produce or give it for free don't bother producing it. There are huge chances your content is just shit anyway.
- paulie_a 9y agoPeople created content on the internet before there was advertising. So to reiterate the GP's point, fuck ads and fuck ad companies, even the "legitimate" ones are a blight on the landscape and quite frankly scum.
- bjpbakker 9y ago> People are so used to getting news and various services "for free" Many people I know (myself included) pay for articles they read on the sources they choose. It's the websites that copy the articles, mix the words a bit and republish that get into trouble and in my experience have the most problems with ad blockers. I don't think that's a bad thing. Like others said here, if nobody wants to pay for your articles you either publish them for free or do something else with your life.
- IntronExon 9y agoA vast majority of that content is dog shit. Losing it would mean a net loss of precisely nothing. My favorite sites don’t run ads, and either pay for access (NYT), accept donations, or do it for the love of doing it. I’m happy to lose the endlessly nested clickbait in favor of quality that doesn’t update every 5 seconds.
- y03a 9y agoAdvertising _without tracking_. Advertising was done that way for all of human history until recently. Take away their ability to run arbitrary code on users machines and the problem is completely solved. There just needs to be an advertising company that steps up to the plate and says: We will get your ads to eyeballs and _we_ will ensure sites are holding up their end of the deal instead of deferring that role to user machines. You won't be able to track users, but you never should have been allowed to do that anyway.
- AlexandrB 9y agoThis situation is similar to dumping[1]. The only reason people aren't willing to pay for content is that there's always another company willing to give it away for "free" by leveraging ads. The reason that's economical is that all-pervasive tracking inflates the value of ad inventory and allows for a lot of additional "value" to be created even if the visitor doesn't click on an ad. If some of the most abusive adtech practices were flat out illegal paid services could compete again because a profitable, "free" alternative would not be possible. The other form of dumping comes from tech companies operating in the red but surviving on investment dollars. Frankly, this is a result of growing wealth and income inequality that leaves investors with few avenues for growth outside of ad-funded moonshots as consumers aren't able to drive growth like they used to due to flat income. [1] https://en.m.wikipedia.org/wiki/Dumping_(pricing_policy) https://en.m.wikipedia.org/wiki/Dumping_(pricing_policy) Edit: Imagine a world where the average consumer makes $10k more per year, then turns around and spends some of that on online services. You now have a situation where the interests of the user and web service provider are aligned. The user is now the customer, not the product.
- iaml 9y agoThe article is about ad companies circumventing adblockers by using autogenerated domain names. Unless you update all of your filters everyday, you are still vulnerable.
- tristor 9y agoDoesn’t bother me, I block everything by default and selectively whitelist. At this point in time it’s the only way to be safe.
- FussyZeus 9y agoOn my Mac and linux machines I do the regular block but on Windows it's full block all the way, not even so much for the ads but for the fact that so many networks distribute(d) malware. Sorry but your website's business model is an infinitely lower priority than me needing to re-image my Windows install yet again because one of your fellow companies is asleep at the wheel regarding security.
- kakarot 9y agoIs there an easy way to block everything by default with uBO?
- okanesen 9y agoAfaik you can do that with "hard mode" [0]. [0]: https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...
- kakarot 9y agoI already use Advanced Mode, but uBO makes no distinction between blocking scripts and cookies, XHR requests, and Media elements. uMatrix does make this distinction, so I'm led to believe uBO doesn't block them at all. That's necessary for me.
- ballenf 9y ago
- HugoDaniel 9y agoah! you might want to take a look at [adnauseum] :) [adnauseum]: https://adnauseam.io/ https://adnauseam.io/
- Jack5500 9y agoAdnauseum is still a really bad idea. Previous discussion: https://news.ycombinator.com/item?id=10611594 https://news.ycombinator.com/item?id=10611594 https://news.ycombinator.com/item?id=13222733 https://news.ycombinator.com/item?id=13222733
- HugoDaniel 9y agoNot if your stance is "Seriously though, fuck ads, fuck ad companies, fuck browsers made by ad companies". Which is arguably the correct one to take these days.
- manigandham 9y agoNot really, unless you're about to give up everything Google has created. Advertising is a 12-figure global industry, it takes more nuance than saying "I hate everything".
- AlexandrB 9y ago> Not really, unless you're about to give up everything Google has created. I basically have. DDG + Fastmail + Firefox. Google is not some magic technology elf that makes the web work. And frankly, their products aren't THAT good. Search has been declining in usefulness for years, YouTube is a hot mess that's in the process of demonetizing all the niche content.
- dingo_bat 9y agoI'm ready, where do I sign up so Google gets out of my life completely?
- wybiral 9y agoIt's not ads that are the problem. It's JavaScript. Plain text or image ads are fine. They can track passively without JS. The problem is that they're using JS to do all kinds of shady stuff.
- ballenf 9y agoI'd argue a more subtle point: JS is fine, it's phoning home with all sorts of personal info siphoned off my PC that is the problem. JS is used to do this usually, but isn't the only way as seen in tracking pixels in JS-less HTML emails.
- wybiral 9y agoTrue, you can track people using plain old cookies and the likes. But JS can do much more shady things than tracking people.
- zelos 9y agoExactly. Auto-executing third party code that has network access privileges seems like a massively bad idea, surely? Especially as it's virtually invisible to most users.
- eadmund 9y ago> I'd argue a more subtle point: JS is fine, it's phoning home with all sorts of personal info siphoned off my PC that is the problem. No, I think that this case demonstrates that it's JavaScript which is the ultimate problem: cryptomining is a code-execution problem (although there is a network-access component to it, since the mining code needs to get block information & submit block results somehow). I like to imagine that in a few decades we'll wonder how we ever thought it was a good idea to grant frictionless full-execute privileges to all the code everywhere, but honestly I'm far too pessimistic to believe that we'll ever wake up.
- wybiral 9y agoWe got rid of Flash, for the most part. But people seem to be in denial of JS being an issue even though it's been used time and time again to bypass security. Personally, my JS has been disabled since Meltdown/Spectre. There are sites that don't work and some of the big ones that I have more trust in I'll whitelist. But for the most part it stays off.
- zhughes3 9y agoCan someone point me in the right direction to learn about or just simply explain how modern-day browsers allow for scripts to drain CPU resources?
- deleted 9y ago[deleted]
- simias 9y agoAllow me to return the question: how do you prevent scripts from draining CPU resources? How do you distinguish between legitimate resource usage (like a heavy web application that runs a lot of javascript) from a cryptocurrency miner? How do you throttle one without hurting the other?
- xxs 9y agoYou avoid sites with heavy javascript usage.
- JD557 9y agoMost browsers already send you a warning if the main thread appears to be blocked. Maybe they could also add a warning like: > This page is consuming a lot of resources, do you want to keep executing JavaScript on this page? > Stop / Allow only this time / Allow always
- gruez 9y agosite publishers would resort to social engineering ("click yes on the popup to continue reading)
- chendragon 9y agoSafari already does this kind of. "This webpage was reloaded because it was using significant energy"
- simias 9y agoPossible but if you set the limit too low you're going to have it pop it all the time on heavier websites (especially on less powerful hardware/smartphones). Then you condition the user to dismiss these warnings without thinking about it because of the high rate of false positives. On the other hand if you set it too high then those websites will aim for that limit to maximize profit without triggering the warning. You'll still waste a ton of resources and you've only mitigated the issue somewhat. I'm not saying it's impossible, just that "just add a dialog when CPU usage is high" might be a bit naive. There's a subtle balance to these things.
- blattimwind 9y agoCalling random domains to circumvent blacklists an "advanced malware technique" is tabloid-speak.
- belorn 9y agoThe use of short lived auto generated domain names is the kind of patterns that triggers maleware warning at domain registrars and I know IIS (registry for .se) have people being paid to actually monitor such type of domain abuse. The domain industry see it as abuse and "advanced malware technique" would not be out of the question when describing it. Also, it not just random domain names. It is random registrant data. It is short lived domain names. It is obfuscated NS infrastructure.
- Cyph0n 9y agoIt's kind of related to so-called domain generation algorithms (DGAs) commonly used by malware to circumvent blacklists and network filtering.
- pentagonpapers 9y agoI would rather trade my gpu power than get ads
- xxs 9y agoI take it you don't have a powerful one that drains 150W. I can trivially hear the fans (GPU or CPU) if someone site attempts to over-utilize the available hardware resources.
- 2aa07e2 9y agoI don't see a problem with heating the room in the winter. [1] [1] https://physics.stackexchange.com/a/2184 https://physics.stackexchange.com/a/2184
- hiccuphippo 9y agoI do trade some cpu power in exchange for no ads thanks to ublock origin.
- pitaj 9y agoI don't think GPU mining is the browser is available. There's no WebCL or anything like that yet.
- bsg75 9y agoPublishers with “legitimate” ad mechanisms are using new techniques to entice people to not use ad blockers. Are any of the legit ad networks doing anything to combat the problems in the article? As long as there are bad actors, the good ones will get caught up in the net and must own the major share of combating the problem that affects their core business.
- soared 9y agoAll legit ad networks are trying - this behavior is awful for them and doesn't earn them money (it loses them money when the publisher sees these and stops using the ad network). The miners are just 1/2 a step ahead of ad networks.
- deleted 9y ago[deleted]
- simias 9y agoI'm not sure I understand that, why go through the trouble of setting up random domains to bypass filters if you then load https://coinhive.com/lib/coinhive.min.js https://coinhive.com/lib/coinhive.min.js directly? Any filter will probably already block that URL if no other. Now if they started serving the JS from random domains and URLs that would mean trouble because you couldn't just use the URL-based filter approach most adblockers use. I'm surprised this doesn't appear to be more common. If it gains steam we might have to use a whitelist approach for trusted 3rd party javascript sources. Not necessarily a bad thing IMO, although that might stifle innovation a bit on the web.
- gruez 9y ago>Now if they started serving the JS from random domains and URLs you don't even need random domains. random urls from the same domain would work fine.
- okanesen 9y ago> random urls from the same domain would work fine. What stops someone from blocking the domain? I think a combination of random domain + url would make it rather hard to detect these things.
- gruez 9y agosame domain as in first-party domain. afaik all script blockers block third party scripts if you block scripts for the first party domain.
- gorhill 9y agoYou can selectively block inline, 1st-party and 3rd-party scripts with uBlock Origin ("uBO").[0] Moreover, the Firefox/webext version allows you to remove specific inline script tags before the document is parsed by the browser.[1] uMatrix can selectively block web workers, which are typically used by coin miners.[2] I have long been thinking of bringing that ability to uBO, but I want to do it right UI-wise. * * * [0] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... [1] https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#html-filters https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#... [2] https://github.com/gorhill/uMatrix/releases/tag/1.2.0 https://github.com/gorhill/uMatrix/releases/tag/1.2.0
- SimeVidas 9y agoSo… the next line of defense is to block all third parties by default (requests to other domains) and only enable specific domains on a case-by-case basis?
- belorn 9y agoOr they can do what the spam industry has been doing for years in order to address random domains names being used for malware. For example, newly registered domain names tend to get a small added spam score when used in emails. Spammers could wait a month but that gives registrars time to detect the fraudulent registrant data and revoke the name before it can be used. Spam filters has many years to adapt and develop. The arms race for browser security is just in the beginning. I expect to see score based systems becoming popular, just like it did with spam filters.
- 0x17A 9y agoUsing uBlock Origin in medium mode will block third party domains by default. You will be safe. https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...
- oldcynic 9y agoI think only one approach works these days: Consider the whole web hostile. Browse with uBlock Origin and JS off. Enable JS for trusted domains only. Give up, blacklist, and go elsewhere if whack-a-mole enabling needs too many unknown random domains enabled just to read that article.
- PuffinBlue 9y agoWhat tool do you use to manage switching JavaScript on and off on a per site basis? I too want to default off and whitelist but I'm not sure the best way to do it as the browser addons I have found make it easy to turn JS off, but they default to on and don't have a default off capability.
- dmm 9y agoNoScript is what I've always used. It defaults all javascript to be off and you can enable it permanently or temporarily per domain.
- oldcynic 9y agoNoScript on Firefox and Scriptsafe[0] on Chrome. [0] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...
- PuffinBlue 9y agoThanks, I'll take a look.
- aiCeivi9 9y agouMatrix
- zentiggr 9y agouMatrix is great for blacklisting by default and only enabling as needed for website core operations. Also has a "don't filter on this domain" switch for things like bank sites and other fragile ops.
- drb91 9y agoI wish I could just throttle javascript execution to 1/100th its current pace. I really don’t need it for most websites after the initial load of content, which is unfortunately driven a lot by javascript these days. They mostly exist to serve more and more annoying ads, best I can tell.
- FLUX-YOU 9y agoSome kind of execution budget would be really nice for JS. I wouldn't blame browsers for not putting it in though, no normal user would touch that kind of control.
- aiCeivi9 9y agoIt was almost a thing, browsers started to suspend/rate limit tabs other than currently active one: https://docs.google.com/document/d/18_sX-KGRaHcV3xe5Xk_l6NNwXoxm-23IOepgMx4OlE4/pub https://docs.google.com/document/d/18_sX-KGRaHcV3xe5Xk_l6NNw... So far web workers are not limited but it is only a matter of time.
- 52-6F-62 9y agoYou can simulate CPU throttle in Chrome, in dev tools under the performance tab. I'm not sure how effective it would be to your use case, though.
- Daycrawler 9y ago"Conceal" is quite an ambitious term for something that literally makes noise out of your computer fan. `top` to check that Firefox is guilty and `about:performance` to close the guilty tab. There are so many shitty JS single-page sites out there that abuse clients' resources I don't even care whether it's crypto mining or just incompetence.
- yomly 9y agoPlenty of devices have loud fans irrespective of their current CPU load. Being facetious, there also exist fanless PCs submerged in oil which do not make sounds based on CPU load. Checking your CPU usage via `top` is a relatively "power-user" esque function so your experience is unlikely to be reflective of the general population.
- greglindahl 9y agoFirefox has a popup when it notices any tab using a lot of cpu -- no need to run 'top'.
- runeks 9y agoChrome displays an icon on a tab to convey that it’s playing audio. Perhaps it would be a good idea to similarly visualize tabs with high CPU/GPU consumption? A browser does most (if not all) of what an OS does, so it shouldn’t be surprising if a task manager (which shows CPU usage) is also useful for browsers.
- loeg 9y agoChrome has a task manager built in (press shift + escape) and it does show CPU usage.
- y03a 9y agoAny site running third-party JS should get the red "insecure" icon like http sites do now.
- tylerhou 9y agoSo as soon as I serve my JS from a CDN I should be marked with an insecure icon?
- NoGravitas 9y agoYes. Not because you're doing anything wrong yourself, but because the cost to the user of allowing third party scripts is too high to tolerate nowadays.
- y03a 9y agoI think so. A few days ago someone posted something [1] about how they use their own sub-domain to alias CDNs so they can simply update DNS records to easily fix issues with a CDN site suddenly moving or disappearing. I argued that this breaks any chance for content to be pre-cached before a user visits your site for the first time but I walked away convinced that this one-of-many use cases for CDNs isn't all that useful in practice. Alias real content providing CDNs all you want, but if you want to alias an ad network to get around my proposed rule, then you risk your entire domain getting blocked by the likes of uBlock Origin. I'm not an expert in any of this. I'm not even remotely sure what I'm proposing is possible or would be effective. I just want to start a conversation because I know what I don't want and throwing ideas out into the wild is better than staying quiet. I know I have no interest in giving up any privacy for a potential few seconds saved on load time for a site I'm not sure I even want to visit in the first place. Load times should be the burden of the site owner. Ideally that would be optimized by serving only what is absolutely necessary to get me to the thing I wanted to see. Not that plus the 10 other things you and/or third-parties decided they deserve to serve and hope my machine has pro-actively pre-fetched so I don't perceive the shit-show going on behind the scenes. Given all the details of how this stuff works, I don't think most users would volunteer for it either. [1] https://news.ycombinator.com/item?id=16372902 https://news.ycombinator.com/item?id=16372902
- zaroth 9y agoInstead of trying to block ad-mining, consider this; With the right PoW algorithm and the hardware access to optimize it, it really seems like an excellent economic model, specifically if you must opt-in in exchange for seeing no ads. Today we deal with advertisements that destroy the user experience and have a very real cost to the user in having to navigate through intrusive ads. Which also, by the way, often cause the same over-revving and slow downs as mining do. In response, ad blockers rewrite or block a site’s code to eliminate the ads, consuming the content but starving the site from its only revenue stream. Not theft, perhaps not even morally wrong, but certainly to the detriment of the site owner. Microtransactions or subscription-based content pools with view-based payouts have been proposed for years and have had some traction but certainly aren’t widespread. If you could opt-in to mine on behalf of the sites you visit in a way that respected your real-time compute resources, in exchange for a completely ad-free experience, would you do it? It seems like mining for someone is the ultimate micro transaction. There is no overhead and no fees and you can mine for a portion of time equal to tiny fractions of a cent of value. In fact, mining for enough cycles to produce even a penny of value would be a fairly substantial amount of computation. The crucial question is the effeciency of the process. There are no transactions fees whatsoever to mine for someone else, the bandwidth is minuscule, the code is fairly tight. But the one thing that makes it inefficient is if you’re consuming more compute than necessary to most optimally perform the PoW. In other words, if your hashrate per CPU-second is sub-optimal because the sandbox doesn’t allow an efficient PoW implementation, or because the algorithm can be run orders of magnitude more efficiently on specialized hardware, that in itself is a form of transaction fee. If we can get a PoW algorithm which runs near-optimally on general purpose computers on a blockchain that isn’t dominated by botnets, then the economics should work out that you are paying whoever you mine for approximately the cost of the electricity required to perform the mining, effectively leading to a way to make free micropayments.
- ballenf 9y agoWould be interesting if a site had a hierarchy of content, with the top-level content only available to those running fast hardware and therefore generating more revenue. Those on cheap or slow hardware might be limited to older or less valuable content. Now that is a dystopia I don't think anyone would like to see.
- bediger4000 9y agoSo it has come to this. The Advertisers are shedding their self-righteous camoflage and just being evil. Adblocking is a necessary component of defense in depth. At least nobody will be able to give the old "Oh, but advertising is necessary for Capitalism" excuse. This is way over the line. Down with the corporate capitalist "internet" of ads! Use Firefox. Use uBlock. Use NoScript. Use Privacy Badger.
- Nicksil 9y agoHear hear! and just to make it all-the-more simpler for some folks, a few links: Firefox: https://www.mozilla.org/en-US/firefox/new/ https://www.mozilla.org/en-US/firefox/new/ uBlock: https://github.com/gorhill/uBlock#installation https://github.com/gorhill/uBlock#installation NoScript: https://noscript.net/ https://noscript.net/ Privacy Badger: https://www.eff.org/privacybadger https://www.eff.org/privacybadger
- sli 9y agouMatrix: https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
- kristofferR 9y agoThis is also neccessary in addition to uBlock: https://jspenguin2017.github.io/uBlockProtector/ https://jspenguin2017.github.io/uBlockProtector/
- 908087 9y agoDecentraleyes is another one to add to that group. https://decentraleyes.org/ https://decentraleyes.org/
- soared 9y ago"The Advertisers" doesn't mean anything. That is like saying "the tech people" or "big business" are doing evil things.
- 9y ago
- maxaf 9y agoI used to get angry at ads on my laptop, but uBlock Origin took my worries away. That left my Android phone, but recently I've discovered Blokada[0]. The app - which is for obvious reasons not available on the Play Store - appears to run a "VPN" through localhost that filters out an absolutely staggering amount of ads and other nastiness. Suddenly my battery life has improved, and my phone no longer runs too hot to touch. It's a win/win. [0]: http://blokada.org/ http://blokada.org/
- mtgx 9y ago> which is for obvious reasons not available on the Play Store Only if the "obvious reason" you meant there is "Google abusing its Android monopoly power". I wish the EU would include that part into its anti-trust investigation against Google, too. It should be illegal for Google to ban ad-blockers on its store, for the same reason multiple courts in Europe have found that ad-blockers are legal: the user should have the power to block ads if he or she wants it. This is especially true in this case, because Google can't even use the "security" argument as it did in the early days of ad-blocker banning. This app is functionally the same as a regular VPN, so unless it's saying that all VPNs are a security risk and it wants to ban all of them, then Google has no technical justification for banning VPN-like ad-blockers. As as side note, why doesn't Blockada use HTTPS? My trust in that app dropped in half for this reason alone, when it's so easy and free to enable HTTPS these days.
- maxaf 9y agoYes, the lack of HTTPS is baffling. HTTPS is so pervasive these days that one has got to wonder. On the subject of banning apps: my complete lack of empathy for less technically capable users is probably showing right now, but as long as I'm able to sideload apps onto my phone running AOSP, I'm good with whatever.
- aiCeivi9 9y agoIf forced they will just add API that allows apps to check if any VPN is used. BTW was there any discussion on how Google could be split? Android doesn't bring enough money to develop it, it would make sense to just drop it. Manufacturers would need to maintain their own OSes, that might be interesting.
- hiram112 9y agoDoesn't it cost a few bucks to register a domain name? How could a malware group pay to register thousands and thousands of randomly generated top level domains?
- dspillett 9y agohttps://en.wikipedia.org/wiki/Domain_tasting https://en.wikipedia.org/wiki/Domain_tasting - still practical for some TLDs.
- chimen 9y agoI have an extension to disable WebRTC to prevent leaks (uBlobk added that too), I have another one that claims it blocks mining, I have uBlock and Disconnect - all fighting for my privacy. This is getting out of hand.
- swozey 9y agoI have the same miner blocker and it says it's never caught anything which I find interesting. Has yours?
- OnlyRepliesToBS 9y agoAdvertising is mental malware.
- fwdpropaganda 9y agoI don't run JS. Yesterday some ridiculous page on the frontpage of HN called me an "internet hipster" for having JS disabled.
- soared 9y agoThere is no "Advertisers" here - blackhats are using advertising tools but there is no advertiser involved at all. This is not a nitpick - advertisers aren't doing this. 1. Ad networks / exchanges allow (don't catch) these ads 2. Publishers don't do enough to stop them 3. Browsers allow it to happen
- tyingq 9y agoThis comment should be higher up. It's not the advertisers. It's the ad network not noticing that bad actors (that aren't advertisers) are gaming the system.
- na85 9y agoIs that distinction relevant to the user? I'm still blocking ads and javascript everywhere I browse. If the ad networks are the ones distributing this malware, they're either complicit or negligent. Either way, the source of the malware from my perspective as a user is still "ads".
- soared 9y agoI just commonly see users get mad at "advertisers" when in cases like this, advertisers aren't involved at all. Not to say they don't carry some blame, but its blackhats doing the major wrong. Advertisers and publishers should pressure ad networks and browsers to do a better job fighting fraud though.
- tyingq 9y agoIf they want to direct feedback to the right place, sure. Ad networks need the pressure. Advertisers can't do much to help.
- na85 9y agoWell, I don't think most users care about directing feedback. I know I personally would rather just deprive them of the impressions with noscript and/or ad block. I don't have time to be submitting complaints to faceless Internet corporations. I just want to use the web without being bothered.
- r1ch 9y agoAre there even any legitimate domains under these new super-cheap-50c-domain TLDs like .bid? I've seen a 100% spam bot rate for all email domains ending in .bid on our sites. I'm considering changing my local DNS to NXDOMAIN the whole TLD if it's this messy.
- codedokode 9y agoIf you disable JS you won't need any ad blockers and you will be surprised how faster the sites will load (if some sites are still not fast enough, try disabling web fonts; they are heavy and block rendering, but sadly Chrome doesn't allow to block them on per-site basis).
- einr 9y agoYou would go to those lengths to avoid ads, yet use a browser produced by an advertising company?
- Momquist 9y agoIt is possible to block web font request on a per-domain basis via an extension, even on Chrome. I have webfonts disabled by default for a while, and thought about building a whitelist of acceptable ones but have been too lazy to implement it yet.
- elorant 9y agoWhy is it that every time I read a story about online advertising it will always be something malicious? WTF is wrong with these guys.