5 ms·

I'm always surprised people are willing to give random developers that much control over their browser when installing extensions like that. I've had so many t

I'm always surprised people are willing to give random developers that much control over their browser when installing extensions like that. I've had so many things break because someone somewhere didn't think a request was valid enough and blocked it and it was put into a common blocklist. WebRTC, several fonts, first party analytics, even whole services like Google shopping were blocked entirely because "they are ads" or they were "trackers". We even had to modify an app which was using css modules one time because class names were compiled down to a hex encoded hash of the css properties, and any class names beginning with `ad` were blocked by EasyList at one point... It is giving an uncomfortable amount of power to a very small amount of developers. And it ends up ruining efforts to avoid 3rd party analytics because not only are first party harder to implement and maintain in many cases, but they get blocked just the same for very innocuous reasons, and give worse insights in some ways. Just look at the list of what EasyList considers "unacceptable data to gather" in first party analytics [0]. Things like the useragent, timezone, IP address, and language are considered "personal information" and should be blocked even in first party scripts with EasyList! IP address or useragent alone literally makes all first party tracking impossible... [0] https://easylist.to/2011/08/31/what-is-acceptable-first-party-tracking.html https://easylist.to/2011/08/31/what-is-acceptable-first-part...

chopin 8y ago
There is no guarantee that your first party tracker does not relay information to a third party via your web server. Furthermore, at least some of the data you list is considered personal information under GDPR. Block access if you want but do not collect personal data about me. What I am hating most is that sites where I am willing to send money to (web shops) do these things and send data to ad net works too, no less.
- Klathmon 8y ago
  > There is no guarantee that your first party tracker does not relay information to a third party via your web server. You have no guarantees at all, but that information is always sent across, and in many cases must be sent to even make a request. You literally can't prevent an IP address from being "sent" because it's needed to route the information back to you. Sending an "Accept-Language" header lets a website be translated into multiple languages. And virtually 100% of my users want times and dates in their local time, not UTC. Just because it's potentially identifying information doesn't mean you can block it and pat yourself on the back as "stopping tracking". When you don't allow an IP address to be sent, you have just created a system where you can arbitrarily choose literally any request and block it under that rule. It's like making a law against breathing oxygen, then arresting anyone that you don't like for any reason because they are breaking at least that law.
pjc50 8y ago
If you take all those pieces of information together you're very close to uniquely identifying the user, in a way which could be correlated with similar analytics from other websites if and when your analytics data is leaked or sold. Sometimes people really mean it when they say they don't want to be tracked: they want to leave no footprint at all. Sometimes people just want the website to load as fast as possible by discarding as much Javascript and as many requests as they can get away with. But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts.
- Klathmon 8y ago
  >But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can update calendar notifications at the right time as "tracking" and break the application entirely because of it. They see a request they don't understand and block it because "it includes the useragent". Take Google shopping for instance, an entire service shut off because "it's tracking", while Amazon or eBay or any other online shopping service isn't blocked. If you really want that blocked, I'm more than happy to not serve you! I don't want to track you if you feel that using your timezone is over the line! But when your feelings toward that are pushed to who knows how many computers and now my site is broken for a large number of users, who are now contacting me to fix it, it becomes a problem. To use an analogy, I don't have any issue with people that are allergic to peanuts. I don't want to try and force feed you peanuts, I want to make sure everyone knows I serve peanuts, and I want to give you the option of not eating at my establishment if you are allergic or simply don't like peanuts. But if you start removing my establishment from maps, and start putting road blocks in front of my building preventing others from getting in, now it's overstepped a boundary. I don't pretend to have a good answer, this isn't an easy problem to solve, but giving a handful of devs a "break this website for all adblocker users" button seems like a lot of power, and it especially hurts those who are trying to accommodate you. If I didn't care, I'd just work around it, use server logs and send them to 3rd parties, lie and actively route around your attempts to block. And I'd not only make more money, but have to deal with less issues from users... My hope is that the devs that believe these things can give more options to the user to decide for themselves and make informed decisions about the tradeoffs, rather than saying "this is bad, I blocked it for you".
gorhill 8y ago
> I'm always surprised people are willing to give random developers that much control over their browser I will say this is why people install content blockers, to avoid giving control to random developers behind countless websites, which have shown that there is no limit in the amount of data they will try to gather without a hint of informed consent. On the other hand, content blockers are opt-in and people are free to install or not after reading the description/documentation and further researching them.
- mcny 8y ago
  This discussion got bigger than I expected. I just want to take a moment to thank you not just for your hard work but the trust you have brought in uBlock Origin. From the bottom of my heart, thank you.
- Klathmon 8y ago
  I get that, and I fully support that choice, and I agree with that feeling. But it's the lack of choice in terms of what is blocked, and the limited ability to understand that it's the content blocker that is potentially breaking the application which is what i'm lamenting here. I can't overstate how much I want to respect the user if they don't want some aspects, or some features, or anything which they just don't like, or which they feel can impact their privacy. (I'll argue with you about the ethics of blocking ads but still using a service, but that's another point entirely!) My issue is that there is a group of people that are deciding what things are allowed and which aren't, and they are going to necessarily have to make tradeoffs (I don't think that all of amazon.com should be blocked because they can track your purchase history by virtue of handling your purchase!). But for the most part the trade offs made are opaque to the user and site owner, and the UX is lacking in showing the user that the content blocker can be the cause of the problem, not to mention that by default these lists are very powerful tools able to pretty quickly harm good actors (and this isn't something i'm single-ing out content blockers for, antivirus vendors, ISPs (AKA net neutrality), and even social networks all have this issue to some extent). There might not be a good answer, and I sure as hell don't pretend to have it, but I'm just wishing for a way that users can make informed decisions on what they want to block, rather than have someone decide for them. Without some kind of give and take here, the arms race is just going to continue, and as it escalates, good actors (of which I'd like to think i'm one of) will get increasingly pushed away as they are blocked just the same as bad actors, leaving them with the options of "play dirty and survive" or "die peacefully". I'm sad to say that I ended up taking a page out of the "play dirty" book and got a new domain name for the app in question to get around the content blockers, but I'd do it again in a heartbeat since I'm not abusing that information or power, but I'm blocked as if I am. And while I feel dirty that I'm forcing my wants onto others, the ratio of "unwilling participants" to "those who actually wanted to use my app, but not one it's core features" is so unbalanced that I ended up ignoring the latter to save the former. And while I wish I could respect the wants of the latter group, if I engage there the former will have the content blocked for them as well again, and I'll be right back to square 1.

chopin 8y ago

There is no guarantee that your first party tracker does not relay information to a third party via your web server. Furthermore, at least some of the data you list is considered personal information under GDPR. Block access if you want but do not collect personal data about me. What I am hating most is that sites where I am willing to send money to (web shops) do these things and send data to ad net works too, no less.

Klathmon 8y ago
> There is no guarantee that your first party tracker does not relay information to a third party via your web server. You have no guarantees at all, but that information is always sent across, and in many cases must be sent to even make a request. You literally can't prevent an IP address from being "sent" because it's needed to route the information back to you. Sending an "Accept-Language" header lets a website be translated into multiple languages. And virtually 100% of my users want times and dates in their local time, not UTC. Just because it's potentially identifying information doesn't mean you can block it and pat yourself on the back as "stopping tracking". When you don't allow an IP address to be sent, you have just created a system where you can arbitrarily choose literally any request and block it under that rule. It's like making a law against breathing oxygen, then arresting anyone that you don't like for any reason because they are breaking at least that law.

pjc50 8y ago

If you take all those pieces of information together you're very close to uniquely identifying the user, in a way which could be correlated with similar analytics from other websites if and when your analytics data is leaked or sold. Sometimes people really mean it when they say they don't want to be tracked: they want to leave no footprint at all. Sometimes people just want the website to load as fast as possible by discarding as much Javascript and as many requests as they can get away with. But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts.

Klathmon 8y ago
>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can update calendar notifications at the right time as "tracking" and break the application entirely because of it. They see a request they don't understand and block it because "it includes the useragent". Take Google shopping for instance, an entire service shut off because "it's tracking", while Amazon or eBay or any other online shopping service isn't blocked. If you really want that blocked, I'm more than happy to not serve you! I don't want to track you if you feel that using your timezone is over the line! But when your feelings toward that are pushed to who knows how many computers and now my site is broken for a large number of users, who are now contacting me to fix it, it becomes a problem. To use an analogy, I don't have any issue with people that are allergic to peanuts. I don't want to try and force feed you peanuts, I want to make sure everyone knows I serve peanuts, and I want to give you the option of not eating at my establishment if you are allergic or simply don't like peanuts. But if you start removing my establishment from maps, and start putting road blocks in front of my building preventing others from getting in, now it's overstepped a boundary. I don't pretend to have a good answer, this isn't an easy problem to solve, but giving a handful of devs a "break this website for all adblocker users" button seems like a lot of power, and it especially hurts those who are trying to accommodate you. If I didn't care, I'd just work around it, use server logs and send them to 3rd parties, lie and actively route around your attempts to block. And I'd not only make more money, but have to deal with less issues from users... My hope is that the devs that believe these things can give more options to the user to decide for themselves and make informed decisions about the tradeoffs, rather than saying "this is bad, I blocked it for you".

gorhill 8y ago

> I'm always surprised people are willing to give random developers that much control over their browser I will say this is why people install content blockers, to avoid giving control to random developers behind countless websites, which have shown that there is no limit in the amount of data they will try to gather without a hint of informed consent. On the other hand, content blockers are opt-in and people are free to install or not after reading the description/documentation and further researching them.

mcny 8y ago
This discussion got bigger than I expected. I just want to take a moment to thank you not just for your hard work but the trust you have brought in uBlock Origin. From the bottom of my heart, thank you.
Klathmon 8y ago
I get that, and I fully support that choice, and I agree with that feeling. But it's the lack of choice in terms of what is blocked, and the limited ability to understand that it's the content blocker that is potentially breaking the application which is what i'm lamenting here. I can't overstate how much I want to respect the user if they don't want some aspects, or some features, or anything which they just don't like, or which they feel can impact their privacy. (I'll argue with you about the ethics of blocking ads but still using a service, but that's another point entirely!) My issue is that there is a group of people that are deciding what things are allowed and which aren't, and they are going to necessarily have to make tradeoffs (I don't think that all of amazon.com should be blocked because they can track your purchase history by virtue of handling your purchase!). But for the most part the trade offs made are opaque to the user and site owner, and the UX is lacking in showing the user that the content blocker can be the cause of the problem, not to mention that by default these lists are very powerful tools able to pretty quickly harm good actors (and this isn't something i'm single-ing out content blockers for, antivirus vendors, ISPs (AKA net neutrality), and even social networks all have this issue to some extent). There might not be a good answer, and I sure as hell don't pretend to have it, but I'm just wishing for a way that users can make informed decisions on what they want to block, rather than have someone decide for them. Without some kind of give and take here, the arms race is just going to continue, and as it escalates, good actors (of which I'd like to think i'm one of) will get increasingly pushed away as they are blocked just the same as bad actors, leaving them with the options of "play dirty and survive" or "die peacefully". I'm sad to say that I ended up taking a page out of the "play dirty" book and got a new domain name for the app in question to get around the content blockers, but I'd do it again in a heartbeat since I'm not abusing that information or power, but I'm blocked as if I am. And while I feel dirty that I'm forcing my wants onto others, the ratio of "unwilling participants" to "those who actually wanted to use my app, but not one it's core features" is so unbalanced that I ended up ignoring the latter to save the former. And while I wish I could respect the wants of the latter group, if I engage there the former will have the content blocked for them as well again, and I'll be right back to square 1.