8 ms·

And this is why, even with the best intentions of site operators, my browser will continue to use the best ad-block tools I can get, and my networks will be pro

And this is why, even with the best intentions of site operators, my browser will continue to use the best ad-block tools I can get, and my networks will be protected by tools like PiHole.

MRD85 7y ago
In the 2005 era when I was a young video gamer I used to play World of Warcraft. There was a site, Thottbot, that players would use to find out information about things in game. I picked up a keylogger malware from their adservers. One of the advertisers had been hacked and was serving Malware every few thousand ads. Since that day I've used an adblocker and I'll always continue to do so.
- mrosett 7y ago
  I wonder if that’s how I got hacked....
jimmaswell 7y ago
This seems melodramatic for something as trivial as an audio request.
- yifanl 7y ago
  Arbitrary code execution isnt really that trivial.
  - jimmaswell 7y ago
    Arbitrary javascript execution is generally meaningless. Very rarely you'll get a zero-day or something, or maybe a site will use too much battery when focused.
    - JetSpiegel 7y ago
      But if that page is Stack Overflow, with millions of views, you are collectively wasting tons of power. Granted, you don't pay those bills.
    - jjeaff 7y ago
      Really? Malicious JavaScript can steal anything you can see and do anything you do. It can steal your passwords, bank account information, or transfer money out of your bank account. It just depends on what kind of page is serving up the arbitrary JavaScript.
- mikeash 7y ago
  It’s incredibly disrespectful. Nobody wants some random ad listening to their microphone. That they’re trying it anyway indicates that they’re hoping to get some people with browsers that don’t block it, or trick some people into saying yes. It’s not harmful, as long as you’re not one of the people who gets tricked. But it does indicate that they want to do you harm, and try to. That they failed doesn’t make it all better.
  - jimmaswell 7y ago
    It's probably just a mistake and not actually trying to collect anything.
    - mikeash 7y ago
      You think it’s hitting the JavaScript microphone API by mistake? How?
      - ladberg 7y ago
        It's Google's fingerprinting for tracking you across the web. It won't actually listen to or play anything, it just opens it up to see if it's there.
        mikeash 7y ago
        We have no way of knowing that when a permission alert comes up. The only reason we’d ever allow it is if we were tricked or exploited.
    - deleted 7y ago
      [deleted]
  - SilasX 7y ago
    Wait, it was listening in on the microphone too? Doesn’t that break wiretapping laws?
    - 7y ago
- mort96 7y ago
  Did you click the link..? It's fingerprinting, not just trying to legitimately play audio.
- luckylion 7y ago
  It's not just audio requests btw. Google regularly serves ads that automatically redirect users to scam sites. A client I work with gets hit with that about every six months. The ads are targeting only mobile users which makes it even harder to debug. There's nothing a publisher can do to prevent this but disabling Google Adsense completely. There is no support from Google. After a few days, a week maybe, Google disables the malicious ad (or they see that the credit card didn't work) and it stops.
andrenotgiant 7y ago
Exactly. Market solutions for market problems. I'd love to see the Raspberry PI foundation develop and sell a home router with PIHole for regular consumer use. Considering the alternatives, that sounds really appealing for me. I'd also buy it for my less tech-literate parents.
- hannasanarion 7y ago
  You can't profit your way out of a problem you profited yourself into. There will never be enough people setting up PiHoles to offset the value of spying, and it's publishing platforms like StackOverflow that suffer.
  - butteroverflow 7y ago
    Wouldn't it be cool if it was solved on the provider level? They already have to set up DNS servers, might as well make it a Pi-hole instance.
    - majewsky 7y ago
      Many ISPs are part of conglomerates that also contain web content publishers, so they have a vested interest for ads to continue working. Also, ISP-level adblock will lead to tons of support requests, esp. when news websites start blocking that ISP and tell customers to call the ISP's support to "fix" the internet.
alecco 7y ago
That's not enough, sadly. Besides disabling JavaScript you can put hosts file blocklists. Simple corporation block list (e.g. Facebook, Google) https://github.com/jmdugan/blocklists/tree/master/corporations https://github.com/jmdugan/blocklists/tree/master/corporatio... "Someone Who Cares" list http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Ultimate Hosts Blacklist: 1 million blocked domains (once in a while you might need to unblock something) and also a bonus known hacking IP blocklist. https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist

And this is why, even with the best intentions of site operators, my browser will continue to use the best ad-block tools I can get, and my networks will be protected by tools like PiHole.

MRD85 7y ago

In the 2005 era when I was a young video gamer I used to play World of Warcraft. There was a site, Thottbot, that players would use to find out information about things in game. I picked up a keylogger malware from their adservers. One of the advertisers had been hacked and was serving Malware every few thousand ads. Since that day I've used an adblocker and I'll always continue to do so.

mrosett 7y ago
I wonder if that’s how I got hacked....

jimmaswell 7y ago

This seems melodramatic for something as trivial as an audio request.

yifanl 7y ago
Arbitrary code execution isnt really that trivial.
- jimmaswell 7y ago
  Arbitrary javascript execution is generally meaningless. Very rarely you'll get a zero-day or something, or maybe a site will use too much battery when focused.
  - JetSpiegel 7y ago
    But if that page is Stack Overflow, with millions of views, you are collectively wasting tons of power. Granted, you don't pay those bills.
  - jjeaff 7y ago
    Really? Malicious JavaScript can steal anything you can see and do anything you do. It can steal your passwords, bank account information, or transfer money out of your bank account. It just depends on what kind of page is serving up the arbitrary JavaScript.
mikeash 7y ago
It’s incredibly disrespectful. Nobody wants some random ad listening to their microphone. That they’re trying it anyway indicates that they’re hoping to get some people with browsers that don’t block it, or trick some people into saying yes. It’s not harmful, as long as you’re not one of the people who gets tricked. But it does indicate that they want to do you harm, and try to. That they failed doesn’t make it all better.
- jimmaswell 7y ago
  It's probably just a mistake and not actually trying to collect anything.
  - mikeash 7y ago
    You think it’s hitting the JavaScript microphone API by mistake? How?
    - ladberg 7y ago
      It's Google's fingerprinting for tracking you across the web. It won't actually listen to or play anything, it just opens it up to see if it's there.
      - mikeash 7y ago
        We have no way of knowing that when a permission alert comes up. The only reason we’d ever allow it is if we were tricked or exploited.
  - deleted 7y ago
    [deleted]
- SilasX 7y ago
  Wait, it was listening in on the microphone too? Doesn’t that break wiretapping laws?
  - 7y ago
mort96 7y ago
Did you click the link..? It's fingerprinting, not just trying to legitimately play audio.
luckylion 7y ago
It's not just audio requests btw. Google regularly serves ads that automatically redirect users to scam sites. A client I work with gets hit with that about every six months. The ads are targeting only mobile users which makes it even harder to debug. There's nothing a publisher can do to prevent this but disabling Google Adsense completely. There is no support from Google. After a few days, a week maybe, Google disables the malicious ad (or they see that the credit card didn't work) and it stops.

andrenotgiant 7y ago

Exactly. Market solutions for market problems. I'd love to see the Raspberry PI foundation develop and sell a home router with PIHole for regular consumer use. Considering the alternatives, that sounds really appealing for me. I'd also buy it for my less tech-literate parents.

hannasanarion 7y ago
You can't profit your way out of a problem you profited yourself into. There will never be enough people setting up PiHoles to offset the value of spying, and it's publishing platforms like StackOverflow that suffer.
- butteroverflow 7y ago
  Wouldn't it be cool if it was solved on the provider level? They already have to set up DNS servers, might as well make it a Pi-hole instance.
  - majewsky 7y ago
    Many ISPs are part of conglomerates that also contain web content publishers, so they have a vested interest for ads to continue working. Also, ISP-level adblock will lead to tons of support requests, esp. when news websites start blocking that ISP and tell customers to call the ISP's support to "fix" the internet.

alecco 7y ago

That's not enough, sadly. Besides disabling JavaScript you can put hosts file blocklists. Simple corporation block list (e.g. Facebook, Google) https://github.com/jmdugan/blocklists/tree/master/corporations https://github.com/jmdugan/blocklists/tree/master/corporatio... "Someone Who Cares" list http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Ultimate Hosts Blacklist: 1 million blocked domains (once in a while you might need to unblock something) and also a bonus known hacking IP blocklist. https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist