15 ms·

There is a lot of confusion around this issue. Some people are taking this to mean that Safari has completely banned ad blockers, which isn't the case. Instea

There is a lot of confusion around this issue. Some people are taking this to mean that Safari has completely banned ad blockers, which isn't the case. Instead they've switched to a model that matches what they've been doing on iOS which is content blocking[1]. Content blockers give Safari a list of triggers and actions to take when something matches a trigger. For example; you can have a trigger which contains a regex that matches all images and stylesheets for a given domain. The action can be one of several options, one of which is to block that item. One advantage this technique provides over ad blocking is that there's no data to be phoned back home. It is, in essence, a mask that is applied to a web page before rendering. Also, it's very lightweight. It's literally just a JSON document which means Safari can perform better. Now, I'll admit it's not foolproof. Apple and the content blockers have some work to do on it. I'm noticing some issues with it myself after having upgraded to Safari 13. But from a privacy perspective, I personally much prefer this technique. 1: https://developer.apple.com/documentation/safariservices/creating_a_content_blocker https://developer.apple.com/documentation/safariservices/cre...

littlestymaar 7y ago
> One advantage this technique provides over ad blocking is that there's no data to be phoned back home. […] But from a privacy perspective, I personally much prefer this technique. Are you suggesting uBO is sending data “back home”? It doesn't, and this comment is borderline FUD.
- dmix 7y ago
  If only everyone used uBlock instead of the countless other scammy adblockers with millions of active users, which do not take privacy nearly as seriously. OP also never mentioned uBlock specifically, so I wouldn't be so quick to call it FUD. Whether or not this is a sufficient solution is one thing, but there are some legitimate problems with the current state of adblocking. Being able to provide a similar solution in a far more limited fashion would be a good thing for users.
- dpkonofa 7y ago
  They never suggested anything of the sort. That being said, for every uBO that doesn't send that data back home, there are 1000s of "ad-blockers" that do exactly that.
- loeg 7y ago
  Nah, uBO is fantastic. The problem is nearly all other purported adblockers. Some of them are ok/mediocre; most (like most browser extensions) are just outright crap or malware. The moral dilemma here seems to be that Google is unwilling to privilege a good-citizen adblocker like uBO over other extensions; they're an ad company and any explicit step towards promoting an adblocker probably is hard to explain at shareholder meetings, even if the engineers want to.
jkp56 7y ago
Which is same as banning ad blockers. With the declarative API you can't know what domains this website connects to and you can't prevent it from connecting to bad domains. Moreover, trackers and ads can choose a random domain to completely avoid any blacklists.
- Zelphyr 7y ago
  The content block lists will get updated frequently just like the ad block lists. And, sure, it’s a cat and mouse game just like it is with the add blockers. But at least this way is more performant and secure. In the end, as has been said by others, if you don’t like it then use Firefox. That’s what’s great about the browser ecosystem we have right now. There are some really great options in browsers.
  - jkp56 7y ago
    It's one cat and millions of mice that multiply rapidly. Ads networks that use random unpredictable domains are intractable by the static blacklist approach. Not only that: ads networks can watch the public blacklist and adjust their domains accordingly. If declarative API was about security, Apple would rather block network access for adblockers. Agreed about Firefox. My goal here is to call out the hypocrisy of the declarative API. So I want to repeat myself that the declarative API is about giving ads networks an easy way to not get blocked, while using performance and security as false arguments that impress only those who know nothing about performance and security.
    - Zelphyr 7y ago
      Actually, I've been using content blockers on iOS and I haven't noticed any ads coming through. That's not to say they won't/don't ever but my browsing experience is noticeably smooth on that platform.
    - Zelphyr 7y ago
      You know; I just realized I should clarify some confusion I myself may have introduced here. My original comment suggests the trigger is always matching a domain regex but domain isn't the only trigger. Content blocker authors can make use of one or more of seven different triggers. For example: `load-type`: An array of strings that can include one of two mutually exclusive values. If not specified, the rule matches all load types. `first-party` is triggered only if the resource has the same scheme, domain, and port as the main page resource. `third-party` is triggered if the resource is not from the same domain as the main page resource. So our concerns about the cat and mouse game is true, but only for domain triggers.
doctoboggan 7y ago
What content blocker would you recommend?
- Zelphyr 7y ago
  Apple themselves recommended Ghostery Lite. I feel like that one had some trouble in the past but I can't recall why. Regardless, I installed it and Magic Lasso to see how they do. I used to use Wipr with some success but it appears to be no longer free. Still, if Ghostery Lite and Magic Lasso don't work out, I'll pony up for Wipr.
  - emptysea 7y ago
    I gave Ghostery Lite and Ka-Block! a shot and they blocked ads on most sites except for reddit. Pretty good for free. Wipr blocks the same ads as the above combo, but also blocks those on reddit. YMMY
om2 7y ago
This model is also a big performance win. The content blocker rules are compiled to an [efficient byte code format](https://webkit.org/blog/3476/content-blockers-first-look/ https://webkit.org/blog/3476/content-blockers-first-look/) which can be evaluated insanely fast (microseconds not milliseconds), compared to doing IPC and running JavaScript for each resource in a page.
ulucs 7y ago
If they really care about privacy, they can just whitelist uBO/uMatrix and everyone will be happy.
thirdsun 7y ago
As a happy Firefox and uBlock Origin user I wonder what is so fundamentally different about uBlock Origin that its filter list can't be converted/translated to the JSON format Safari's content blocking API expects. Is it more difficult than I imagine?
muddi900 7y ago
OK any argument in favor of this technique shatters in front of the fact that in practice, Ad blocking on iOS is useless, and requires more resources, since some older devices still cant use it.
brianpgordon 7y ago
What are you saying is the privacy advantage exactly? Regular adblockers also block requests before they happen - there's no "phoning home."
- ianlevesque 7y ago
  Browser extensions are becoming a notable security vulnerability, with many high profile extensions falling into the hands of (or being sold to!) bad actors. The arbitrary code execution method of ad blocking (e.g. uBlock) is very flexible but it means that without ongoing comprehensive code review using one puts you at risk if the extension ever changes hands or has a backdoor added. Apple's method avoids this issue by never letting the extension see the page contents, it only provides match lists of what to block that the browser then enforces. Even if the extension became malicious it has no access to private data on the webpages it is ad blocking on.
- bryanculver 7y ago
  What I think they're saying is that with Adblockers, they can phone home which ads they block, URLs they see, etc. Content blockers impose rules at the outset and the rule generator won't see what the URLs/content actually is. The way I would think of it would be like "let me see what you're seeing and I'll let you know what to let through" vs "here are a list of things you shouldn't let through but I don't need to know about what the hit rate actually is". Although I could be misunderstanding the implementation.
  - cptskippy 7y ago
    In the later scenarios, what assurance does the Ablocker have that their requests are respected? I could easily see a scenario where an Adblocker says "Hey Chrome block all requests to ads.google.com" and Chrome saying "Sure thing buddy" then completely ignoring that request.
    - zie 7y ago
      SHHH!!! That's for Chrome 100 ;P I agree it's totally possible they would do that, but one could figure it out pretty easily with a touch of detective work.
srbby 7y ago
This is exactly what Chrome intends to do and everybody hates Google for it. Defending this when Apple does it is a double standard.
- throwawayy1001 7y ago
  Google is an Adtech company.
- hoten 7y ago
  It's also good for performance. The blocking can happen immediately in the browser/network process, instead of waiting for the extension code to run in its own process and tell the network service what to do.
  - pythux 7y ago
    In principle yes. But in practice, we are talking about nanoseconds; and I would very much like to see benchmarks/measurements showing anything that can be perceived by users. Also, this blocking cost is still orders of magnitude lower than network latency and blocking requests (even with a slow adblocker) will result in a noticeable performance boost while browsing the web.
    - hoten 7y ago
      It certainly does not take merely nanoseconds to wait for JS to run in another process.
  - loeg 7y ago
    This comparison is only apples to apples if exact same content can be filtered. If you lose some filtering due to the added restrictions on blockers, the page may load more resources (in particular, javascript), easily negating any CPU performance benefit.
- loeg 7y ago
  From OP's argument, it seems likely they'd support Chrome doing the same thing. A double standard requires the same person or population to hold logically contradictory viewpoints. That isn't what is happening here.
eof 7y ago
Wouldn't you prefer if both options were available? I certainly would. I had been using Safari on mac only because it was fine and I had no need to switch to firefox or chrome. Now I will definitely not be using safari anymore.

littlestymaar 7y ago

> One advantage this technique provides over ad blocking is that there's no data to be phoned back home. […] But from a privacy perspective, I personally much prefer this technique. Are you suggesting uBO is sending data “back home”? It doesn't, and this comment is borderline FUD.

dmix 7y ago
If only everyone used uBlock instead of the countless other scammy adblockers with millions of active users, which do not take privacy nearly as seriously. OP also never mentioned uBlock specifically, so I wouldn't be so quick to call it FUD. Whether or not this is a sufficient solution is one thing, but there are some legitimate problems with the current state of adblocking. Being able to provide a similar solution in a far more limited fashion would be a good thing for users.
dpkonofa 7y ago
They never suggested anything of the sort. That being said, for every uBO that doesn't send that data back home, there are 1000s of "ad-blockers" that do exactly that.
loeg 7y ago
Nah, uBO is fantastic. The problem is nearly all other purported adblockers. Some of them are ok/mediocre; most (like most browser extensions) are just outright crap or malware. The moral dilemma here seems to be that Google is unwilling to privilege a good-citizen adblocker like uBO over other extensions; they're an ad company and any explicit step towards promoting an adblocker probably is hard to explain at shareholder meetings, even if the engineers want to.

jkp56 7y ago

Which is same as banning ad blockers. With the declarative API you can't know what domains this website connects to and you can't prevent it from connecting to bad domains. Moreover, trackers and ads can choose a random domain to completely avoid any blacklists.

Zelphyr 7y ago
The content block lists will get updated frequently just like the ad block lists. And, sure, it’s a cat and mouse game just like it is with the add blockers. But at least this way is more performant and secure. In the end, as has been said by others, if you don’t like it then use Firefox. That’s what’s great about the browser ecosystem we have right now. There are some really great options in browsers.
- jkp56 7y ago
  It's one cat and millions of mice that multiply rapidly. Ads networks that use random unpredictable domains are intractable by the static blacklist approach. Not only that: ads networks can watch the public blacklist and adjust their domains accordingly. If declarative API was about security, Apple would rather block network access for adblockers. Agreed about Firefox. My goal here is to call out the hypocrisy of the declarative API. So I want to repeat myself that the declarative API is about giving ads networks an easy way to not get blocked, while using performance and security as false arguments that impress only those who know nothing about performance and security.
  - Zelphyr 7y ago
    Actually, I've been using content blockers on iOS and I haven't noticed any ads coming through. That's not to say they won't/don't ever but my browsing experience is noticeably smooth on that platform.
  - Zelphyr 7y ago
    You know; I just realized I should clarify some confusion I myself may have introduced here. My original comment suggests the trigger is always matching a domain regex but domain isn't the only trigger. Content blocker authors can make use of one or more of seven different triggers. For example: `load-type`: An array of strings that can include one of two mutually exclusive values. If not specified, the rule matches all load types. `first-party` is triggered only if the resource has the same scheme, domain, and port as the main page resource. `third-party` is triggered if the resource is not from the same domain as the main page resource. So our concerns about the cat and mouse game is true, but only for domain triggers.

doctoboggan 7y ago

What content blocker would you recommend?

Zelphyr 7y ago
Apple themselves recommended Ghostery Lite. I feel like that one had some trouble in the past but I can't recall why. Regardless, I installed it and Magic Lasso to see how they do. I used to use Wipr with some success but it appears to be no longer free. Still, if Ghostery Lite and Magic Lasso don't work out, I'll pony up for Wipr.
- emptysea 7y ago
  I gave Ghostery Lite and Ka-Block! a shot and they blocked ads on most sites except for reddit. Pretty good for free. Wipr blocks the same ads as the above combo, but also blocks those on reddit. YMMY

om2 7y ago

This model is also a big performance win. The content blocker rules are compiled to an [efficient byte code format](https://webkit.org/blog/3476/content-blockers-first-look/ https://webkit.org/blog/3476/content-blockers-first-look/) which can be evaluated insanely fast (microseconds not milliseconds), compared to doing IPC and running JavaScript for each resource in a page.

ulucs 7y ago

If they really care about privacy, they can just whitelist uBO/uMatrix and everyone will be happy.

thirdsun 7y ago

As a happy Firefox and uBlock Origin user I wonder what is so fundamentally different about uBlock Origin that its filter list can't be converted/translated to the JSON format Safari's content blocking API expects. Is it more difficult than I imagine?

muddi900 7y ago

OK any argument in favor of this technique shatters in front of the fact that in practice, Ad blocking on iOS is useless, and requires more resources, since some older devices still cant use it.

brianpgordon 7y ago

What are you saying is the privacy advantage exactly? Regular adblockers also block requests before they happen - there's no "phoning home."

ianlevesque 7y ago
Browser extensions are becoming a notable security vulnerability, with many high profile extensions falling into the hands of (or being sold to!) bad actors. The arbitrary code execution method of ad blocking (e.g. uBlock) is very flexible but it means that without ongoing comprehensive code review using one puts you at risk if the extension ever changes hands or has a backdoor added. Apple's method avoids this issue by never letting the extension see the page contents, it only provides match lists of what to block that the browser then enforces. Even if the extension became malicious it has no access to private data on the webpages it is ad blocking on.
bryanculver 7y ago
What I think they're saying is that with Adblockers, they can phone home which ads they block, URLs they see, etc. Content blockers impose rules at the outset and the rule generator won't see what the URLs/content actually is. The way I would think of it would be like "let me see what you're seeing and I'll let you know what to let through" vs "here are a list of things you shouldn't let through but I don't need to know about what the hit rate actually is". Although I could be misunderstanding the implementation.
- cptskippy 7y ago
  In the later scenarios, what assurance does the Ablocker have that their requests are respected? I could easily see a scenario where an Adblocker says "Hey Chrome block all requests to ads.google.com" and Chrome saying "Sure thing buddy" then completely ignoring that request.
  - zie 7y ago
    SHHH!!! That's for Chrome 100 ;P I agree it's totally possible they would do that, but one could figure it out pretty easily with a touch of detective work.

srbby 7y ago

This is exactly what Chrome intends to do and everybody hates Google for it. Defending this when Apple does it is a double standard.

throwawayy1001 7y ago
Google is an Adtech company.
hoten 7y ago
It's also good for performance. The blocking can happen immediately in the browser/network process, instead of waiting for the extension code to run in its own process and tell the network service what to do.
- pythux 7y ago
  In principle yes. But in practice, we are talking about nanoseconds; and I would very much like to see benchmarks/measurements showing anything that can be perceived by users. Also, this blocking cost is still orders of magnitude lower than network latency and blocking requests (even with a slow adblocker) will result in a noticeable performance boost while browsing the web.
  - hoten 7y ago
    It certainly does not take merely nanoseconds to wait for JS to run in another process.
- loeg 7y ago
  This comparison is only apples to apples if exact same content can be filtered. If you lose some filtering due to the added restrictions on blockers, the page may load more resources (in particular, javascript), easily negating any CPU performance benefit.
loeg 7y ago
From OP's argument, it seems likely they'd support Chrome doing the same thing. A double standard requires the same person or population to hold logically contradictory viewpoints. That isn't what is happening here.

eof 7y ago

Wouldn't you prefer if both options were available? I certainly would. I had been using Safari on mac only because it was fine and I had no need to switch to firefox or chrome. Now I will definitely not be using safari anymore.