63 ms·

uBlock Origin: Address first-party tracker blocking

• cm2187 7y ago
  I don't really have a problem with first party tracking, unless it can correlate my identity across websites. But otherwise I have no problem with website X knowing that I browse website X. Can first party tracking do this sort of correlation other than through browser fingerprinting?
  • cyborgx7 7y ago
    If I'm understanding this correctly, it's only first party tracking in that it comes from a subdomain of the domain of the website you are browsing. But that subdomain points at a third party tracking provider. So this still seems like a single tracking provider on multiple website being able to correlate your browsing.
    • wongarsu 7y ago
      You still get full cookie separation because each website has a different subdomain and thus a different cookie. The analytics provider can track you across the internet, but they have to invest work and resources instead of getting it basically free.
      • cyborgx7 7y ago
        I agree that this is not an insignificant aspect. But I still don't think it is therefore something that should be tolerated.
      • cm2187 7y ago
        But how would the provider track you across the internet with cookie separation (other than through fingerprinting)?
        • Red_Leaves_Flyy 7y ago
          Do you have a great way to block every fingerprinting method?
          • cm2187 7y ago
            Firefox seems to be on the case. There is really no good reason to give any means for a website to fingerprint a browser.
        • gpvos 7y ago
          I wouldn't know, but fingerprinting is a thing and is bad enough.
        • kasey_junk 7y ago
          The provider a) is the other parts of the internet (think big cdn) and b) they communicate with other data brokers via a side channel instead of via cookie syncing. This is already happening with large web publishers.
          • cm2187 7y ago
            But even if they do that, how can they tell it is the same user on two different domains?
      • squiggleblaz 7y ago
        Well, I'm hardly about to accept that it's legitimate to spy on me "because they invested work and resources instead of getting it basically for free". It's like, a peeping Tom who just looks through a window - yuck that's gross. But a peeping Tom who spies by building a microdrone that can fly in the door when it opens and mount itself on the ceiling with suction pads - oh that's perfectly legitimate because of the work and resources Tom invested. I mean, if it's gross to do something by accident and it's gross to do something without any investment, it's super gross to do it with resources. It's not all that hard to track someone across the internet. I think many people have demonstrate hacks that steal legitimate functionality and get you there. I think we'll probably have to go for a containerised internet (separate apps) and just deal with the disadvantages.
    • input_sh 7y ago
      uBlock origin (more specifically, EasyPrivacy list) blocks 1st party tracking as well. For example, you could spin up an instance of Matomo (formerly Piwik) for your own website and still see no traffic from adblock users by default.
      • ddtaylor 7y ago
        This is also why if you're using Matamo you should have it parse your access logs instead.
  • stilisstuk 7y ago
    Yes. E.g. Danish newspapers are working in a joint effort to do just that, via 1st party tracking. https://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.com&sl=da&sp=nmt4&tl=en&u=https://jppol.dk/pressemeddelelser/jp-politikens-hus-lancerer-ny-dataplatform-til-det-digitale-annoncemarked/&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265,15700271,15700283&usg=ALkJrhgePYTeTSRO_Bb3l3qDQDGLCcckMQ https://translate.googleusercontent.com/translate_c?depth=1&...
  • Jestar342 7y ago
    Think of this as SSR for adverts/trackers. The harvested data is still going to 3rd parties, even if your browser connection(s) aren't.
  • pdkl95 7y ago
    This is about 3rd party trackers masquerading as the 1st party by asking the hosting page to provide a CNAME under their own domain. With the tracker hosted under the 1st party's domain, they work around people that deny 3rd party cookies. The example at the top of the thread: https://www.liberation.fr/ https://www.liberation.fr/ has a tracker from f7ds.liberation.fr, which is really part of tracking provider Eulerian. f7ds.liberation.fr. 3599 IN CNAME liberation.eulerian.net. TL;DR - the entire point of this is to let 3rd parties continue to correlate your identity by hiding as part of the 1st party.
  • throwaway6845 7y ago
    I agree. I have a big problem with UBO etc. blocking self-hosted, single-site Piwik. It feels like being penalised for doing the right thing.
    • ekianjo 7y ago
      In the world of tracking a self hosted, self-owned tracking solution would probably be by far the exception rather than the rule.
    • account42 7y ago
      > It feels like being penalised for doing the right thing. Just because there are worse things to do does not make Piwik the right thing. The right thing is not to collect the data at all.
      • throwaway6845 7y ago
        What's wrong with finding out how people use my site, so I can write more of the content they like, and make it easier for them to navigate through?
  • beagle3 7y ago
    Google and Facebook have been adding gclid and fbclid arguments to outgoing links for a while. Click one of those, and the linked site can conspire with googbook to correlate identities. More sites could do that. This is generally better than 3rd partyies because the sites would have to actually conspire, cooperate and trust each other, which is a huge hurdle. And if the trust is actually there, they could correlate offline without any indication. Facebook already does that (with credit records, likely phone records and medical records as well) and I wouldn’t be surprised if others don’t. Correlation is less than perfect this way - but e.g. zip, gender and age are enough to give a pretty good correlation, and name makes it almost perfect - if you have an account somewhere, you probably gave these details.
    • jedimastert 7y ago
      > Google and Facebook have been adding gclid and fbclid arguments to outgoing links for a while. Can you you send me an example of both of those please?
      • Hello71 7y ago
        gclid seems to be for adwords only. imo, if you're already the type to click on ads, you shouldn't object to tracking of which site you came from. fbclid on the other hand applies to all links from facebook. it was a major story on HN: https://hn.algolia.com/?query=fbclid https://hn.algolia.com/?query=fbclid
  • Iv 7y ago
    Browser and IP fingerprinting are already good enough to pinpoint you.
• Santosh83 7y ago
  This was always coming. Next we will have unblockable ads delivered through first party and using obfuscated techniques like canvas or webassembly. The endgame will be all/most websites embedding 1st party ads and tracking and the only way to not see them would be to not use the WWW at all. At that point we will have lost.
  • squiggleblaz 7y ago
    I guess the solution at that point will be to develop a free (foss) internet alternative. The internet will partition: the corporate internet will be what you say, and the independent internet will be people writing and hosting their own content, like the internet of the olden days. Some of them might interact with corporate services via apis. The independent internet will be small, but it will be enough. If you want to buy something anonymously, go to a shop and pay cash with your phone turned off.
    • jjordan 7y ago
      I'm intrigued by the possibilities offered by decentralized technologies like IPFS and the like. I think whomever can come up with a viable economic model that allows for the sustainable decentralization of web services will change the world.
  • syshum 7y ago
    Thank W3C for caving into the Corporations that want to remove the Openness from the web-standards that allow for this kind of nonsense. Google is the biggest offender after all their entire business is Tracking and Ads but it seems they get a pass as being an "offender" from most people
    • ekianjo 7y ago
      > Google is the biggest offender after all their entire business is Tracking and Ads but it seems they get a pass as being an "offender" from most people Note that "most people" (even individuals) also happily insert Google Analytics snippets on their own blogs or websites. I see that all the time thru uMatrix. So it's far from "Google being a bad actor" alone.
• founderling 7y ago
  1st party ads are not unblockable. They only lack one aspect that helps identify them (the 3rd party hostname). But they still can be dealt with. One way browsers try to take away that freedom is by limting what extensions can do. If that continues, at one point we would need a new browser to accomplish it. My favorite vision of the future would be if Debian would provide a version of Chrome or Firefox that: a) is stripped of all tracking and b) gives extensions full access to everything.
  • ekianjo 7y ago
    So what is the strategy to deal with legitimate 1st party subdomains and tracking/ads subdomains if they use random strings as identifiers? (I am guessing this is where we will need a combination of crawlers and machine learning algorithms)
    • XorNot 7y ago
      Looking for suspiciously high entropy values compared to ones native language would be one way.
      • TonyTheSlayer 7y ago
        Devil's advocate: then instead of using subdomains with randomly generated strings, we use words from a dictionary instead.
        • Moru 7y ago
          Then we block those words :-)
          • 0xC0ncord 7y ago
            You would have to block entire wordlists to combat subdomains like that. It would make more sense to whitelist subdomains instead, but it would require much more effort in order to determine what subdomains are required for the website to function. Additionally, if the site in question ever decided to change anything around, someone would have to catch the breaking change and have it corrected on the whitelists for the site to function again.
• Iv 7y ago
  Forbid advertisements. We can't solve a political problem with purely technical solutions. We can provide workarounds for 5 to 10 years but the core problem has to be shut down at one point.
  • hakanensari 7y ago
    Printed media can have ads. So should digital media? That said, I wish digital media stopped wholesale delegating the work of serving ads to third parties and had proper control over experience and privacy—what is delivered how and who tracks whom.
    • II2II 7y ago
      The difference between printed, radio, and television ads is that they are tracking distribution rather than people. (I realize that this is not strictly true, but people had to opt-in to tracking with traditional media.) The web has taken an industry that already had reputation for deceptive tactics and have handed them tremendous powers through data collection. Should advertising be banned because of that? I doubt that it would be effective since the advertising industry has created an environment where tracking people is the norm. Banning advertising would simply shift the focus of that data collection so that it is less visible. It would also be incredibly difficult to ban advertising. Legislation would have to create a clear definition of what advertising is and deal with a medium and business world that crosses national borders. If you don't consider the former, such legislation would have unintended consequences of the freedom of speech. In the case of the latter, it would be far more difficult to reach international agreements than with other online regulations (regulations that are already difficult to enforce) since advertising is considered legitimate in many cases while standards for advertising will differ.
      • cf141q5325 7y ago
        Require a strictly unconditional opt-in you can revoke at any time and the problem of data collection solves itself. None of these business models would work if they required meaningful consent. The missunderstanding about who is allowed to use my data is at the core of this problem. We tend to talk a lot of the lawless west that (was) the internet, but we somehow fail to mention an industry who has exploited missing regulations on private data. Just because they werent banned from exploiting this until now, doesnt mean it should continue any longer.
• cobbzilla 7y ago
  Can’t an ad blocker do the CNAME resolution and then not load the URL if it resolves to a 3rd-party hostname? Using an A/AAAA record would be harder, you’d need to have an IP blacklist, and the trackers would probably be constantly shifting IPs, using a low TTL on the record. This might require giving your tracker programmatic access to your DNS, not sure if many first parties are ready to go there.
  • saagarjha 7y ago
    I have CNAME record for my website that points at GitHub. Would your suggestion block this?
    • cobbzilla 7y ago
      Not likely — only if “github.com” was classified as an ad-tracker by the ad blocker.
  • cyborgx7 7y ago
    That is one of the proposed solutions in that thread. I think somewhat to that effect is what will have to happen. Though it seems like it's possible, in some browsers, for the adblocker with the right permissions to inject itself in the original DNS resolution process and just stop the process when it encounters a blocked domain.
• 01acheru 7y ago
  I've done something like that some years ago to ensure that the tracking we were using on our website worked even if a user had an AdBlock. (it wasn't a tracker as in ad tracker, but a tracker nontheless) It was fairly trivial: instead of asking for the tracking script directly I put a small service of ours in front of it, so our website asked for foo.mycompany.com/stats.js that fetched the correct script and changed all URLs inside of it from mycomp.mytrack.com to foo.mycompany.com. Our service than acted as a proxy to mycomp.mytrack.com. A simple solution that worked out for a while, lost by now, in a server, somewhere in Ireland...
  • Valmar 7y ago
    Evil, but clever.
    • 01acheru 7y ago
      Thanks for the cleverness! As for the evil, it was a tracker whose data wasn't shared with 3rd parties, we needed to gather as much data about our users as possible since we are incredibly understaffed (one handles the business, one sells the product and I do the tech)... it helped us a lot with support requests and customer acquisition
  • kingartur44 7y ago
    In this way, you are opening a lot of things of your site to the advertizer. They can grab your users session cookies or even intercept everything they send to you
    • 01acheru 7y ago
      Just to clarify, as I said it was not an ad tracker, all data was ours and ours only. It was 1st party tracking using a 3rd party service that was blocked by ad blockers. Anyway we don't use cookies for *.mycompany.com, and it was a session-less website.
• nkrisc 7y ago
  If these first party ads are just showing me some sponsored message, then I'm totally ok with that. It's the tracking and arbitrary execution of third party code that drives me to block ads. And if a site has a truly awful first party ad experience and I can't block it? I'll probably stop using it, because I don't use sites that frustrate me if I don't have to.
  • close04 7y ago
    This. If HN decides to put their own sponsored post on the first page that's OK. If they start serving random ads, scripts, and generically crap from who knows what ad (malware) network that's not OK.
    • close04 7y ago
      Ok... feels to me like many people on HN don't realize this already happens. The first page does show "sponsored posts" (you'll easily spot them by the fact that there's no upvote arrow) and it's a good way for HN to promote its own stuff without ever delivering any crap to the user's browser.
  • buboard 7y ago
    > tracking and arbitrary execution of third party Those are two separate things. You can track without code, and you can make a page terribly slow without any tracking. Interestingly, for most people it's primarily the code size and slowness leads them to adblocking, tracking is secondary. > I can't block it? I'll probably stop using it, As a publisher I 'd welcome that behaviour. Of course i should be partly responsible for the ads my users see, I actually try to be but it's impossible with today's technology. It's a total fallacy that the adtech of today is the best we can have. It has become a pissing contest about "who can give you the biggest, most complex analytics dashboard" rather than providing actual value to advertisers. There is also tons of unsold inventory due to the duopolization of ad platforms by google&FB. In that sense, i 'm thankful that adblocking is expanding to upend this ecosystem.
    • nkrisc 7y ago
• ComodoHacker 7y ago
  As gorhill mentioned in the comments, this isn't really a 1st-party tracking, it's "3rd-party disguised as 1st-party". Tracking URL is on a subdomain of 1st-party domain, but it resolves to 3rd-party IP ang request goes to 3rd-party infrastructure.
  • jimktrains2 7y ago
    That doesn't need to be true at all. You could imagine a service that acts as a can and proxy for the 1st party that injects ads into the HTML directly and handles certain urls on the main domain. Also, 3rd party infrastructure could be something like aws. Are you really going to block all ec2 address ranges?
    • M2Ys4U 7y ago
      Forcing people who want to include adware on their sites to run and maintain a proxy is an additional overhead that many won't want to do. This reduces the attractiveness of adverts, which means they won't be as prevalent, which means tracking concerns are lessened. That's a win, no?
      • jimktrains2 7y ago
        There are already companies that do this for other thing. It's basically the model cloudflare uses, but they don't have the ad injection part. I believe brandingbrand did the same model for mobile sites. To the site owner, they're just pointing dns at the ad company and treating it like a cdn.
      • kgwxd 7y ago
        I feel like it is a win. It forces the 2 companies into a trust relationship with each other instead of using my machine as a intermediary.
      • jrockway 7y ago
        I doubt we will win anything from this. Some advertising provider will provide an easily-runnable proxy and say "we give you double CPM if you give us the logged-in user's email address". Now you have even less privacy. Third-party requests with cookies made it easy to start tracking people across sites... but there are other ways if that is made to stop working. Given how much money flows through the advertising industry, I am sure someone will pay for the week or so of engineering to make advertising more invasive.
• tilolebo 7y ago
  Naive question: if media.liberation.fr is a CNAME to a 3rd party ad tracker, why not simply add liberation.fr to the uBO list?
  • lpellis 7y ago
    liberation.fr is the site you want to access, blocking it will kinda defeat the purpose. Blocking *.liberation.fr also is not really an option as it contains some legitimate subdomains. You would have to look up the CNAME for every subdomain and block those on the fly (it seems to randomly rotate)
• cookie_monsta 7y ago
  Maybe it's just the circles I move in, but I feel like there are enough users who don't want to be tracked and enough websites that don't want to track that maybe some sort of code of ethics would work. Sign up, promise not to track your users and be open to lawsuits if you're found to be lying. Granted, it would just be another whack in the game of whack a mole, but we have to keep whacking.
  • djsumdog 7y ago
    You get the GDPR and a ton of little banners people click through or a disable button no one sees where, if you click it, you get confusing sliders that you can't tell if they're on or off (intentionally).
    • cookie_monsta 7y ago
      No. You sign up, you don't track. You get caught, you get sued. The UI has nothing to do with this.
  • hombre_fatal 7y ago
    People will care about that as much as they care about ceasing to use websites that are hostile towards them: pretty much not at all. The entire ad-blocking concept shows that people will do anything to continue visiting a website they are desperate to consume no matter how user-hostile it might be. Also, this "No-Tracking" pledge seems like a thought experiment that only considers the rare website with more or less drop-in alternatives. So, maybe just general news and some brochure info sites?
    • cookie_monsta 7y ago
      I guess it's possible at any moment in history to say that nothing will change because nobody cares. There will always be some truth to that. But I feel like we're reaching some sort of tipping point. 200k+ people just signed up to a new social network whose only real usp is no tracking. I don't know what a drop in alternative is so I can't answer your question, but if your assertion is that generally speaking sites need to allow their users to be tracked I would disagree.
• polskibus 7y ago
  Does anyone know if pihole could help here? If not now, does pihole work on blocking 1st party trackers?
  • gowthamgts12 7y ago
    A possible solution proposed for this problem is to do DNS checks, which is already done by PiHole. So, yes if you have the 3rd party in your filter, it will be blocked.
• djsumdog 7y ago
  If this is a French company/website, doesn't this violate the GDPR?
  • shdon 7y ago
    The GDPR doesn't outlaw tracking. It outlaws tracking without consent. People will allow the tracking pretty much whenever they have to when not doing so is an obstacle to accessing a website (Or simply because they get annoyed at the popup or it doesn't allow opting out). uBO (in the common case) prevents tracking even when consent has been given. Subverting that is not against the GDPR because for the law, the consent is the only thing that matters.
    • cornedor 7y ago
      Those pop-ups should be privacy first, if not, they are still violating the GDPR
• rmsaksida 7y ago
  uBlock Origin aside, it feels like browsers should have built-in support for dealing with this technique (I'm thinking of Safari content blockers and Chrome declarative net requests). Otherwise it's all too easy for trackers to get around browser protections, rendering content blocking APIs almost useless. You should be able to block the resolved domain for a CNAME, not just the source domain...
  • account42 7y ago
    CNAME is a red herring - it would not take that much more effort to delegate the subdomain to a name server controlled by the tracking service or just dynamically update the A/AAAA records yourself.
• acoye 7y ago
  GDPR much?
• tyingq 7y ago
  A good example of why taking away the blocking feature of chrome.webRequest cripples full featured ad blockers. Gorhill shows both a DOM based rule and a CNAME uncloak that kills this tracker. Neither will work post manifest V3.
  • sheeshkebab 7y ago
    Chrome is not the only browser out there, and anyone who cares about privacy shouldn’t be using it.
• protomyth 7y ago
  From the thread: This would require uBO to send browsing history information to a remote server, this is anti-uBO. This is why I love UBlockOrigin, that basic principled approach is a great thing.
  • hnarn 7y ago
    Well, it could be opt-in and disabled by default.
    • middleload 7y ago
      Taking care of a server that receives browsing data from lots of users in lots of countries must be a nightmare.
    • bertil 7y ago
      This does sound like “the user decide” indeed. The issue is: allowing that will likely be popular among people who should know better (like me) and it puts uBO into a position to be able to do some shady things that are hard to prove. They’ve been in that situation before, with the original uBlock, and they’ve learned not to trust their own team.
      • hnarn 7y ago
        Tech savvy developers could opt in to send their data and only do so from a controlled environment. If they notice a site misbehaving, open up an incognito window, go into "call home" mode and start collecting useful info. Sure, it's not for "regular people" but this type of reporting never will be if you also want to respect the integrity of your users.
  • wfriesen 7y ago
    Their most basic principle, "the user decides", had been stated here since 2014 https://github.com/gorhill/uBlock/blob/master/MANIFESTO.md https://github.com/gorhill/uBlock/blob/master/MANIFESTO.md
• drawkbox 7y ago
  Hosting ads server side rather than served from client side javascript networks has always been around though. Originally ad networks were something you rendered out on server side hitting their APIs from the server, and in some cases dns via subdomain. Content hosts were more careful of the content of the ads because it hits their main host ranking. First party / server side ads are actually preferred if you have to choose as you can limit the ads server side and rogue ads can be dealt with. Ad networks from the late 90s to early 2000s were this way. Once popup ads took off they started making ad networks client side to not impact rendering on the server and ads could show progressively when inlined into the layout/script. Today the ads/trackers are almost all client side as it is easier to integrate as more of a widget and less resources used on the server. The ad networks and trackers of today want to own all the data and not share it with content providers, plus being client-side it makes it easy to link data without the need for integration in each endpoint backend just the third party endpoints. Additionally third party ad networks may not trust that page views are organic with the api calls being implemented first-party server side, so they went client-side where they can validate actual page renders and lots of other time/click based metrics. Ultimately sponsor ads that show up on sites/blogs/portals are usually first party server-side ads still. So as long as there aren't rogue ad networks on the server side or via DNS/subdomain then it may improve ads overall. Since first party ads are server side, unless routed via DNS to the ad network, at least the content provider incurs some cost from hosting it at least in bandwidth. If it is a subdomain that goes to an ad network that is full of dark patterns, that is not so great but it will still impact the host reputation in ranking. Right now ads are a mess for a few reasons: so much tracking, taking up screen real estate and the marketing team pushing people to subscribe making the free content experience painful. Email/subscribe and ad popups are more prevalent than the behind the browser popups in the early days, very bad experiences. I sometimes think the days of server side/first party ads and popups from the early internet are preferable to today's inline ads with videos that follow you down and autoplay nightmares all over the page with dozens of trackers and networks all in one. At least first party server side ads that are served up from a backend API hit to a third party or sponsors doesn't cause excessive connections, it also puts an upper limit on the amount of ads that can be shown before it hits costs of hosting and rogue ad networks impact the url reputation so the content hoster may be more of a curating check on ad quality.
• bronlund 7y ago
  Stop visiting those sites already!
  • Valmar 7y ago
    Eventually, more and more sites will push these things on users, so it will not be enough to not visit these sites.
• buboard 7y ago
  Don't worry though, google is safe. They 'll strongarm people to use AMP and Signed HTTP Exchanges for first party access. I think however it's time to grow up and stop playing this cat-and-mouse game. Advertising is crucial to the web and should be allowed. We should be shifting towards ideas that decentralize the tracking itself (like Brave does) or allow users to completely control and explicitly switch their advertising tracking identities
• deleted 7y ago
  [deleted]
• SeanMacConMara 7y ago
  im happy to just block/not visit those entire domains there comes a point when the content is just not worth it doesnt scale obviously we're headed back to the "golden age" of TV advertising except via http instead of radio waves/cable
  • devicetray0 7y ago
    Same, I've been avoiding domains that I know will just show me an unacceptable banner (on mobile) or paywall (desktop). It's funny that I've trained myself to avoid them. I wouldn't really mind them being blocked in these lists, as long as I can optionally disable/enable the domains, or whitelist them if I want (there are some news websites I've paid for)
  • xiphias2 7y ago
    The problem is that the links to these sites already grab my attention. If ads can't be blocked on a web site, links to the web site should be blocked, so I never see them in the first place.
    • lazypenguin 7y ago
      I’ve installed an addon to filter duckduckgo and google searches to avoid hide the SEO spammy websites. Maybe you would be interested. https://addons.mozilla.org/en-US/firefox/addon/hohser/?src=search https://addons.mozilla.org/en-US/firefox/addon/hohser/?src=s...
  • deleted 7y ago
    [deleted]
  • zerocrates 7y ago
    Web advertising is, and long has been, far worse and more intrusive than TV ads.
    • SeanMacConMara 7y ago
      i was referring to the "golden age" of captive eyeballs ie eveyone watched lots of TV and mostly could not avoid seeing most of the ads. at least we've had ad blockser on browsers that work well up to now the tracking of web ads obviously vastly overshadows what happened with TV. they obviously want the best of both worlds "avoidable ads" and "extreme tracking"
• juskrey 7y ago
  Maybe finally let's adopt, you know, the best strategy: stop visiting distracting sites?
  • sashimy 7y ago
    Websites that are involved are french news papers, french Amazon like marketplace and a french mobile provider. I don't think you can categorise those as "distracting".
    • squiggleblaz 7y ago
      A website with unblockable ads is surely distracting. I mean, isn't the entire point of an ad to be distracting? "Instead of paying attention to what you want to pay attention to, remember that I have bridge to sell you at basement bargain rates just buy my kettle for 20 euros"
• going_to_800 7y ago
  uBlock is too aggresive, I stopped using it. As an example it's blocking live-chat widgets like Intercom. Also, as a website owner, I don't see how web can work without any sort of tracking like uBlock suggests, simply you won't see any high quality services if all tracking, even safe one is blocked. You can't optimize a service from both technical and business perspective if you are blind/have no data to base your assumptions on.
  • vesinisa 7y ago
    The issue is not with uBlock itself but the filter set you are using. Also, 95% of the time the live-chat functions on websites are obnoxious. If I have a concern, I am happy to open a dedicated chat page. Having a chat widget on every single page is annoying and unnecessary. But that's just my opinion. Are you sure you are not able to do your website performance analytics from your server logs? More often than not, user agent side analytics end up collecting lots of unnecessary sensitive data, and sharing it with third parties like Google.
    • going_to_800 7y ago
      It's not about having access to server logs, you need tools to make business and technical decisions and no tool will use server logs to show you how users interact on your app or website. What's the privacy concern if I'm tracking on what pages my users visit? I'm not sharing those with anyone. Small business owners like myself are hurt by these things, I can't afford to pay 4-5 figures to a developer to build a tool to analyze my server logs and won't give even 5% of the quality of data analysis Google Analytics or Mixpanel gives.
      • vesinisa 7y ago
        > What's the privacy concern if I'm tracking on what pages my users visit? You can get this very easily on the backend side. > I can't afford to pay 4-5 figures to a developer to build a tool to analyze my server logs No need to bother, there are tons of easy SaaS tools like Splunk in that marketplace already.
  • 7y ago
• danielrpa 7y ago
  I can see a future where safe browsing of the web will only be possible through some sort of whitelisting. Search engines or crowdsourced lists will exist to tell you which places you should or shouldn't go in the web based on Ads or tracking features, just like you can find out the relatively few places that serve Vegan or Kosher food. This isn't exactly a great future but we need to accept that nowadays most people don't care about tracking or ads. This might change one day, but it's the status quo. I think that anti-ads and anti-tracking, if trying to work alongside the full feature set of the Internet, is fighting a honorable but eventually losing war. Even if someone sorts out this particular issue, you are still tracked by 1) Your ISP and 2) other subtle client fingerprinting technologies. You can use Tor/VPN/disable JS but all of these have downsides. All we can do is to fight with our time and wallets by not visiting places that don't support our values. This is possible and not different from the world we live in already.
  • capdeck 7y ago
    Next step in ad blocking is using local trained AI to figure out what is an ad and what is not based on the content that it shows (regardless of origin). May be more of a challenge with trackers as they don't to show ads per se, but may be the same technique can be used with "randomly" generated URLs - train an AI to dynamically make a guess whether the sub-domain (even first party) is a tracker or not. There may not be a clear marker, but there is always a pattern...
    • jimktrains2 7y ago
      > whether the sub-domain (even first party) It need not be a subdomain. Analytics could be proxied from the main domain.
    • sails 7y ago
      Interesting idea, I like the sound of that. Currently I use uBlock Origin's "Block Element" function to block "non-ad" components of websites that bother me (HN orange top bar for example). Something similar that was "trained" based on my/crowd input would be an interesting start.
  • 7y ago
• taf2 7y ago
  I mean this is nothing compared to what you can accomplish with a multi origin cdn or how about a scriptable edge cdn... fastly, cloudflare or cloud front with edge lambda... then you can effectively proxy everything on the same origin with zero ip or domain difference... only content analysis could be effective and even then it’ll become a real arms race
  • minitech 7y ago
    You can do that with any web server, just by serving trackers the same way as all other content.
    • taf2 7y ago
      That’s right but small business owner doesn’t know how - this is about ease of deployment
  • kodablah 7y ago
    You lose out on cookies from those other origins. When we reach the point where ads served from the same site are the primary problem, a partial victory has been gained. I already suggest people use these edge workers to anonymize-then-collect analytics (e.g. via [0]) if they can't be bothered to host their own solution. Of course we all prefer self hosted, but even this is better than third party js. 0 - https://developers.google.com/analytics/devguides/collection/protocol/v1 https://developers.google.com/analytics/devguides/collection...
• davidhyde 7y ago
  Ad blocking seems to be a perfect use case for machine learning. Ads can usually be trivially spotted by humans. Why not have the ad blocker "look at" the web page before you see it and decide what it thinks are ads regardless of where they come from or how they got onto the page.
  • CharlesColeman 7y ago
    The issue here is tracking, not ad-blocking. Tracking does not need to provide any visual indication to the user.
    • davidhyde 7y ago
      I see. To keep tracking under control I have my browser delete all cookies on exit except a couple of whitelisted sites I wish to remain logged into. I use the firefox CookieBro plugin for this. I also run the firefox "I don't care about cookies" plugin to stop those nuisance banners you get when you visit a site for the first time. Lastly, I use ublock origin to clean things up.
  • ojosilva 7y ago
    Very hard to do. Humans get tricked into ads all the time, so imagine AI. Besides, an AI trying to understand the intentions and meaning of a Turing-complete system from a slice of its code and data is like a brain trying to guess another brain's intentions from looking at partial imaging of its neurons. Actually think about the problem the other way around, as it seems easier to do the opposite in most cases (or at least for news/articles sites such as liberation.fr): a page readability extraction plugin, sometimes called summarization. It identifies the "meat" (ie. the main article or video), extracts it and gives it to the user bare bones. No ads, no tracking. At least that's what I'd prefer once everything else fails, and that's why I'm using Firefox's reader mode and Pocket a lot these days, and if ads take over again like in 1998 that's were I'll be surfing the readable web.
    • davidhyde 7y ago
      This is true. Those "Download Now" ads on download pages are case in point.
• deleted 7y ago
  [deleted]
• neilv 7y ago
  I mentioned non-same-origin subdomain problems a while ago, while suggesting a feature that would help with my particular approach: https://github.com/uBlockOrigin/uBlock-issues/issues/44 https://github.com/uBlockOrigin/uBlock-issues/issues/44
• iramiller 7y ago
  So what we need is a DNS service that takes in all of the DNS record updates per normal DNS replication and flags these CNAME record entries into an easily consumable blocklist.
  • EvanAnderson 7y ago
    DNS-based filtering will be useless once DNS-over-HTTPS and pinned certificates are the norm. That will come to embedded devices first, but it'll come to consumer OS's too.
    • iramiller 7y ago
      Right. But it is still possible to run a DNS resolver and dump those domains in a address based blacklist at the firewall.
• alibert 7y ago
  Someone made a script that generate a list of first party domain to block. It seems to crawl websites and extract all requests and compare domains with regex of known first party tracker. https://git.frogeye.fr/geoffrey/eulaurarien https://git.frogeye.fr/geoffrey/eulaurarien (for running your own script) https://hostfiles.frogeye.fr/firstparty-only-trackers-hosts.txt https://hostfiles.frogeye.fr/firstparty-only-trackers-hosts.... (to be imported in your adblocker)
  • 713233eb 7y ago
    I'd love to run this in Docker without manually setting the dependencies up
• JakaJancar 7y ago
  I don't see the problem. If the publisher develops an analytics, user profile or whatever solution themselves, then it's 1st party - OK. But outsource the development or hosting to someone, and suddenly it's a problem? How is this different to using AWS? Now if the data from their different clients is merged to build a unified view of what you do on the web, that's different, but the place to prevent that is in the browser using cookie partitioning, not by caring about the tracker developer/hosting provider.
  • sigwinch28 7y ago
    > If the publisher develops an analytics, user profile or whatever solution themselves, then it's 1st party - OK. How have you reached the conclusion that this is okay?
• novaRom 7y ago
  If me as a human can identify ads easily, Machine Learning and Computer Vision could be used instead of black-listing domains like in this case.
• SaturateDK 7y ago
  At what point does spamming the tracking endpoint with crap data become the next tool?
  • rahidz 7y ago
    Similar to what AdNauseam does: https://news.ycombinator.com/item?id=20048216 https://news.ycombinator.com/item?id=20048216
• yason 7y ago
  It's fun to see the contrast to paper magazines. Advertisements in magazines are often somewhat interesting, well-made to be entertaining, or even useful. I used to read ads in magazines and I still sometimes do. It doesn't give me a bad feeling, at worst/best I'll just emit an indifferent "huh", and proceed to the next page. And I've never, ever seen a single internet advertisement that wouldn't make me irritated and start gradually boiling my blood. Early Google-style ad boxes were closest to bearable so far but I still never read them nor showed any slightest interest in them. They were just kind enough to not irritate that much but merely be mentally blocked right off the bat. I can't stand a web page with ads yet I would find a magazine boring without them. I don't think it's the ads: I think it's the presentation and the media that differs between paper and web. My eyes can wander to an ad and then back to text quite easily on paper, but my browser can't fit several columns of the article and a full-page ad on the same screen. This either-or proposition interrupts my reading and causes agitation. On paper I'm in control, on web I'm not.
  • glitcher 7y ago
    I tend to agree with you, but for me personally I think the difference comes down to intent. When I open a magazine, even if I have a specific article in mind I want to read, I will slowly turn through the pages happy to browse through other random content. It is a very leisurely, less focused interaction. When I go to a website it is almost always for a very specific purpose. My mindset is goal oriented - I want exactly the content I came here for, nothing more (with rare exception, like HN). And probably years of navigating through horrible websites has helped shape that mindset in me, but I have to wonder, if websites delivered curated content and ads at the level of a magazine, would I even care?
    • yason 7y ago
      I thought of the same but realised that I have contradicting examples from myself alone. I sometimes go to a magazine to read about something specific yet I might eyeball the ads while I'm around the target content. If it's a long multi-page article that I'm interested in specifically, or a single page thing, I still might pop out of the text into an advertisement occasionally. Conversely I do browsing (in the traditional sense) on the web as well: I often find myself looking around some website, reading this and that around here and there, trying to figure out how much of the stuff is interesting vs boring, and generally not diving deep on anything and thus I'm theoretically quite open to subject myself to advertising but I still don't look at ads, and I'm still not interested. I sometimes wonder how would it be if web had started with good ads and I had conditioned myself from the start to expect interesting stuff in the ads. It's just that the web went the opposite way, innocently starting with a <blink>, and going to JavaScript, Flash, and cookie-infested ad networks and whatnot to deliver involuntary injections of striking advertisements, and now I'm practically allergic to anything that moves or stands out.
• floatingatoll 7y ago
  WebKit Intelligent Tracking Protection 2.0 and later seem to treat all subdomain as equal for tracking purposes. Does Safari recognize these trackers? https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/ https://webkit.org/blog/8311/intelligent-tracking-prevention... > Does ITP differentiate between my subdomains? No. ITP captures statistics and applies its rules for the effective top-level domain plus one, or eTLD+1. An eTLD is .com or .co.uk so an example of an eTLD+1 would be social.co.uk but not sub.social.co.uk (eTLD+2) or just co.uk (eTLD). https://webkit.org/blog/9521/intelligent-tracking-prevention-2-3/ https://webkit.org/blog/9521/intelligent-tracking-prevention... ITP 2.3 counteracts this by downgrading document.referrer to the referrer’s eTLD+1 if the referrer has link decoration and the user was navigated from a classified domain. Say the user is navigated from social.example to website.example and the referrer is https://sub.social.example/some/path/?clickID=0123456789 https://sub.social.example/some/path/?clickID=0123456789. When social.example’s script on website.example reads document.referrer to retrieve and store the click ID, ITP will make sure only https://social.example https://social.example is returned.
• newscracker 7y ago
  So Chrome doesn’t support the API that uBlock Origin could use to block such ads whereas Firefox does (with the user’s permission). [1] One more reason why Chrome will soon be seen as mostly useless for users of ad blocking extensions. Hope Firefox keeps alive the things that make uBlock Origin a necessity for a decent browsing experience. [1]: https://github.com/uBlockOrigin/uBlock-issues/issues/780#issuecomment-552477648 https://github.com/uBlockOrigin/uBlock-issues/issues/780#iss...
  • pythux 7y ago
    Once Manifestv3 is rolled-out, Chrome will not support uBlock Origin at all.
    • arthurfm 7y ago
      The developer of Nano Adblocker (which is a fork of uBlock Origin) may continue working on a manifest v3 compatible adblocking extension for Chromium-based browsers. https://github.com/NanoAdblocker/NanoCore/issues/238 https://github.com/NanoAdblocker/NanoCore/issues/238
    • jackdh 7y ago
      I look it up but I can't see a clear answer of why?
      • newscracker 7y ago
        Manifest V3 doesn’t allow requests to be intercepted and modified by extensions, which is something uBlock Origin requires to block ads and elements on a page. The proposed way for content blocking in Manifest V3 is how Safari on iOS implemented it a few years ago — a declarative list of URLs to be blocked is provided by the extension and the browser engine looks that up and blocks them. The extension doesn’t see the actual page URLs or requests, leave alone block them. This is a positive for privacy since the browsing behavior of the user is not exposed to malicious extensions. But uBlock Origin is not some-random-extension-that-wants-to-steal-information. Treating uBlock Origin like any other extension isn’t good. Since Google makes money by selling ads, there will likely not be any concessions on this front.
• 6gvONxR4sf7o 7y ago
  For what it's worth, I hardly see ads anymore because I use a browser extension that disables javascript on a site by site basis. You can have javascript be opt-in or opt-out. With opt-in, you get such a better web browsing experience on 95% of sites, and for the others, you just click a little button next to the address bar to make it work. No pop ups, fewer paywalls, less tracking, no videos (except the video site I whitelisted, like youtube). What should be static content actually stays static content. The web is a much better place when you disable javascript where there doesn't need to be javascript. Combine it with cookie auto-delete and whitelisting, and disabled third party everything, and the web is mostly nice again.
• danShumway 7y ago
  One takeaway from this[0]: > Can't this be "emulated" in Chromium by resolving the hostnames using DNS over HTTPS in JSON format? > - This would require uBO to send browsing history information to a remote server, this is anti-uBO. > - Chromium does not support non-blocking webRequest.onBeforeRequest listeners, so this can't work reliably when the result depends on an asynchronous operation such as a DNS lookup. > - Chromium's webRequest.onBeforeRequest blocking ability is being deprecated with Manifest V3, so even without the above issues, this would be wasted development efforts. I suspect (and suspected) that Ublock Origin may eventually be deprecated for Chrome after the V3 changes shipped the same way it was deprecated for Safari, although to the best of my knowledge Gorhill hasn't made any kind of official announcement about that -- so I want to be clear that it's purely conjecture on my end. This thread reinforces that suspicion. I don't know if Gorhill has explicit plans to do anything with Chrome, but I suspect that in the future it will become more and more annoying to support the browser. I also previously made a prediction[1] that within 2 years, Firefox would have clearly better tracker-blocking extensions than Chrome (65% likelyhood). This is roughly in line with what I would expect to see with that prediction -- a few rare fringe-case scenarios that creators can quickly address in Firefox, but that require more extensive work and conversations around Chrome. If this kind of issue becomes more common in the future, then I'll feel more confident about that prediction. [0]: https://github.com/uBlockOrigin/uBlock-issues/issues/780#issuecomment-555954450 https://github.com/uBlockOrigin/uBlock-issues/issues/780#iss... [1]: https://news.ycombinator.com/item?id=21506330 https://news.ycombinator.com/item?id=21506330
  • freeAgent 7y ago
    I would be surprised if uBlock Origin continues to be published/available for Chrome at all in its current form. In order to comply with the new restrictions Google are placing on it, it would have to be severely neutered. They are not giving uBO an option to continue support. Any post-Manifest V3 ad blocker would essentially be a different product.
  • jzl 7y ago
    One possibly good outcome would be if Chrome's embrace of V3 is the catalyst that causes Firefox usage to shoot up again. By most measures, around 40% of users use ad blockers.
• Pxtl 7y ago
  It occurs to me - doesn't this mean that the ad company will have access to the users' session cookies? That seems like a terrifying security risk.
  • hombre_fatal 7y ago
    By default, cookies are limited to [subdomain.]example.com not *.example.com.
    • Pxtl 7y ago
      Still, sharing cookies across subdomains is a pretty common workflow.
• brnt 7y ago
  "We have noticed that you are using an unsupported browser. Please install Google Chrome."
  • bloblaw 7y ago
    Reminds me of the "Best viewed with Internet Explorer" tags. When is Chrome going to reinvent Active-X (which only works in Chrome)???
    • saxonww 7y ago
      8 years ago? https://en.wikipedia.org/wiki/Google_Native_Client https://en.wikipedia.org/wiki/Google_Native_Client
      • arbie 7y ago
        Isn't NaCl deprecated now?
        • emn13 7y ago
          Yeah, Active-X is deprecated.
        • takeda 7y ago
          Yeah, WebAssembly replaced it.
      • mintplant 7y ago
        12 years ago, even. https://en.m.wikipedia.org/wiki/Gears_(software) https://en.m.wikipedia.org/wiki/Gears_(software)
        • deleted 7y ago
          [deleted]
      • vlovich123 7y ago
        The major differences being that P/NaCL was: 1. An open standard/implementation 2. Used regular OSS code 3. Was actually written to be secure The effort spurred ASM.js & eventually the WebAssembly standard because of the discomfort of deploying a cutting edge research to billions of people on the web (the initial NaCL implementation was very large & eventually turned out to have security holes, the original research was improved upon but by then the industry had spoken).
• manigandham 7y ago
  What exactly is the problem with first-party ads? This is what the general consensus was - to move towards ads that were delivered directly by the publisher that you had a connection to instead of 3rd-party networks. At some point, you have to admit that you just want the content for free.
  • ATsch 7y ago
    They aren't, though. It's simply a CNAME alias to a third party ad and tracking provider.
    • manigandham 7y ago
      Publishers aren't going to build their own ad software. This is no different than running wordpress. The issue is data and privacy, and first-party means it's a much more direct relationship with the site you're on.
  • sigwinch28 7y ago
    The way I read it, the discussion is about third-party ads which are disguised as first-party ads by using CNAME DNS records, so that `totallyfirstpartyads.mywebsite.com` is actually just referring to `serveads.thirdpartyadcompany.com`. More than that, random subdomains are used to subvert adblockers. To me, it seems that the discussion is about third-party ads which are masquerading as first-party content. It's not about first-party ads or whether the content should be free, but about third-party advertisers pretending to be first-party.
    • manigandham 7y ago
      There's no such thing as pretending to be first-party. All ads are going to be served through a service/software provider the same way sites run on Wordpress or use a CDN. The data relationship changes with first-party serving because it's now isolated to that site.
      • sigwinch28 7y ago
• scoutt 7y ago
  I am glad to see that websites are struggling to ruthlessly track users for showing ads. It means that the efforts so far are working. They have our attention. Now it's time for standards creators to be responsible and to do something in favor of their users: the user should have the final decision about being tracked/shown ads. But when the most used web browser is in the hands of the biggest ad vendor, then there is little hope... I guess we can only expect for web pages to turn into a sort of dynamically-generated JPEG that cannot be parsed/analyzed.
• pessamistic_dev 7y ago
  So here's the thing. It's easy for any first-party to circumvent any of these attempts with a simple node proxy on aws lambda that passes data between the web browser and the tracking service.
• cogidub 7y ago
  From https://en.wikipedia.org/wiki/Lib%C3%A9ration https://en.wikipedia.org/wiki/Lib%C3%A9ration > Libération (French: [li.be.ʁa.sjɔ̃]), popularly known as Libé ([li.be]), is a daily newspaper in France, founded in Paris by Jean-Paul Sartre and Serge July in 1973 in the wake of the protest movements of May 1968. > For its first six or seven years it was a uniquely vibrant and pluralist publication and hugely influential. This > was mainly due to its refusal to take paid advertising which meant there was no direct or indirect pressure from advertisers. Seems they're now helping to push boundaries of pushing advertising since their founding.
• mehdix 7y ago
  If a webpage does not render correctly in Firefox, I close the tab and support an alternative. It doesn't work for every case, but nevertheless it makes a difference. I also use and support Firefox everywhere, at home, at work, and on mobile.