23 ms·

This was always coming. Next we will have unblockable ads delivered through first party and using obfuscated techniques like canvas or webassembly. The endgame

This was always coming. Next we will have unblockable ads delivered through first party and using obfuscated techniques like canvas or webassembly. The endgame will be all/most websites embedding 1st party ads and tracking and the only way to not see them would be to not use the WWW at all. At that point we will have lost.

squiggleblaz 7y ago
I guess the solution at that point will be to develop a free (foss) internet alternative. The internet will partition: the corporate internet will be what you say, and the independent internet will be people writing and hosting their own content, like the internet of the olden days. Some of them might interact with corporate services via apis. The independent internet will be small, but it will be enough. If you want to buy something anonymously, go to a shop and pay cash with your phone turned off.
- jjordan 7y ago
  I'm intrigued by the possibilities offered by decentralized technologies like IPFS and the like. I think whomever can come up with a viable economic model that allows for the sustainable decentralization of web services will change the world.
syshum 7y ago
Thank W3C for caving into the Corporations that want to remove the Openness from the web-standards that allow for this kind of nonsense. Google is the biggest offender after all their entire business is Tracking and Ads but it seems they get a pass as being an "offender" from most people
- ekianjo 7y ago
  > Google is the biggest offender after all their entire business is Tracking and Ads but it seems they get a pass as being an "offender" from most people Note that "most people" (even individuals) also happily insert Google Analytics snippets on their own blogs or websites. I see that all the time thru uMatrix. So it's far from "Google being a bad actor" alone.
  - hombre_fatal 7y ago
    People also pile on Google for Recaptcha when it's actually users like website operators and Cloudflare who are using it to avoid abuse. Might as while pile on the bad/abusive actors for causing the scenario that makes people use captchas at all.
cyborgx7 7y ago
I wasn't aware putting trackers on subdomains was a working adblocker workaround. Now that I know it, I'm surprised it hasn't been a massive problem since much earlier.
- Normal_gaussian 7y ago
  Essentially most sites are not "owned" by a single technical authority in the business - this is the main reason such a simple workaround goes unused. The key parts there are: - single - technical - authority Watching businesses attempt an integration of a line code anywhere to download the third party tool is painfully hilarious. Getting them to set up a DNS record to point to you is often so far off the table its playing in the forest with the faeries. Having them pull your code and serve it statically alongside their site... I couldn't imagine
  - cyborgx7 7y ago
    I believe you, but this still seems strange to me with the overdesigned behemoths, on the verge of toppling over at any moment, most big corporate sites appear to be nowadays.
    - mobjack 7y ago
      Websites get bloated because the companies aren't aware of all the tracking going on in the first place. What usually happens is that the marketing team signs a contract then developers copy and paste a JavaScript snippet to embed on the website and move on. The work arounds require much more intention and the solutions can be hacky like modifying urls in a minified JS file. If that tracking is blocked, it is invisible to the company especially if only the third party who has access to the data.
  - paol 7y ago
    I agree, but given enough incentive these barriers can be overcome. I thing these are signs that ad-blocking is becoming sufficiently painful to provide that incentive.
- 7y ago
riffraff 7y ago
if canvas become a medium for nasty ad delivery it will go the same way of <object>, I am not too worried. But as always, it will be an arms race.
lma21 7y ago
We can surely find ways to block canvas or webassembly from such websites no?
walrus01 7y ago
Image recognition algorithms client side. Accept and load the ad, render page, replace it with a white square over it. If you're willing to get cpu/gpu intensive on the page rendering a lot can be done.
- bloak 7y ago
  Yes, I think that's the right approach. You just forgot to mention that in order to prevent tracking a new VM is spun up for fetching each page. (Of course this wouldn't be necessary if the browser were implemented by someone who was on the same side as the user.)
  - psv1 7y ago
    > You just forgot to mention that in order to prevent tracking a new VM is spun up for fetching each page. Make sure the travel to a different country between clicks. Just in case.
    - yjftsjthsd-h 7y ago
      I mean. I think you're joking, but if you use Tor then you're perfectly welcome to make a new circuit per website or whatever.
- vbezhenar 7y ago
  Ad blocking is supposed to improve performance. If you still need to download ad and then perform additional computations, I, personally, would opt-out from that ad-blocking, it's not hard to ignore ad myself.
  - Freak_NL 7y ago
    > it's not hard to ignore ad myself. It's a constant cognitive drain on your mental resources. That's even ignoring the fact that almost everyone is influenced by ads to varying degrees.
    - 7y ago
Quarrelsome 7y ago
but this is all we ever asked, wasn't it? That the content creator take direct responsibility for their advertising instead of shipping us off someplace else.
- cyborgx7 7y ago
  They are still shipping us off someplace else. The fact that they technically put their name in front of it to trick the browser, doesn't change this.
  - Quarrelsome 7y ago
    I feel like it at least makes the arrangement explicit and IMO its as much as we could ever ask for. This was always the technological trick that ad-blocking employed.
    - cyborgx7 7y ago
      > its as much as we could ever ask for I can ask for a lot more, don't worry.
- sbarre 7y ago
  Agreed. If ads are served by the site I'm visiting and don't include cross-site tracking bugs, then I think that should be acceptable to most. Speaking for myself, I've never been opposed to ads on sites (within reason - popovers are trash), because I understand that creating content costs money, but I don't like all the tracking that comes with them.
  - cyborgx7 7y ago
    It's always fun to read comments by people who clearly only read the title and haven't clicked on the link.
    - sbarre 7y ago
      I did actually click the link and read the whole Github issue thread, and the discussion here, before commenting. But I was actually responding to the parent's comment (this is a threaded discussion, yes?) about how actual first-party ads are less objectionable than third-party tracking. But thanks for adding your thoughts.
have_faith 7y ago
There's no losing if people voted with their attention instead. If the terms of exchanging data are unacceptable then don't accept any data from that source. The digital equivalent of voting with your wallet. Kind of like climate change, there are actions we all know would help but individually giving up those conveniences is difficult.
- cyborgx7 7y ago
  > The digital equivalent of voting with your wallet. And like voting with your wallet, it will be completely ineffectual in actually addressing the problem. > Kind of like climate change Another area where the need for comprehensive societal solutions gets dumped on the individual instead, rendering it ineffectual.
  - have_faith 7y ago
    Exactly. In theory they are effectual, if people actually did it... I'm a big proponent of top down climate change policy to force change as opposed to hoping if we virtue signal enough people will be shamed into driving a bit less etc.
    - cyborgx7 7y ago
      I misread your comment then. I assumed you were saying this is the strategy we should adopt on those issues.
      - have_faith 7y ago
        With regards to climate change, definitely not. I just wanted to highlight that it's a similar mechanic at play. Perhaps I phrased it oddly. With regards to Ads I don't take as much a hard line approach as yourself (I remember our last discussion!). I'm very pro ad blocker use but not to go as far as banning them in any way. Something I've been thinking about is sending a header to websites informing them I'm going to block their ads so they decide not to send me the content if they don't want to. I feel no entitlement to their content as they should not feel any entitlement to what code gets to run on my machine once it reaches me. I might expand on this in a blog post some time soon but it's probably closer to an art project than something actually viable.
Normal_gaussian 7y ago
I'm imagining the horror of having to do it with output analysis. An advanced renderer scans the page to identify and plaster over adverts..
pdkl95 7y ago
> unblockable ads delivered through first party and using obfuscated techniques like canvas or webassembly When I said basically the same thing 4 years ago[1], most people seemed to think it wasn't a serious concern or could be easily bypassed. However, after observing how certain types of businesses use the World Wide Web over the past 3 decades, it's obvious what they want: to send an opaque binary blob to the user that nobody can investigate or modify, that gives them full control over what the user sees and is allowed to do. Just like TV. The only safe response to this is to stop allowing documents (or docs with 3270-styole forms) to embed software in a Turing complete language. Add functionality that is used declaritively, or the answer to "should this be blocked" is undecidable. Give them the ability to run a Turing complete language that renders to a canvas, and adblocking becomes a hard image recognition problem (or requires solving the Halting Problem). [1] https://news.ycombinator.com/item?id=10211050 https://news.ycombinator.com/item?id=10211050
- pingyong 7y ago
  I'm not saying no one will try to do this, but YouTube had the technical option of splicing ads directly into the video stream and simply not sending the actual video content for the duration of the ad for several years now. They chose not to do it. Potentially the lost revenue from people not using YouTube as much anymore / migrating to a different platform would be bigger here than the increase in ad traffic. People who don't want to see ads (i.e. a large part of adblock users) are also more likely to engage in toxic (to advertisers and YouTube) behavior, such as intentionally clicking on ads but never buying anything (or even writing scripts to do that), or intentionally avoiding the advertised product, etc.
  - JoeSamoa 7y ago
    Honestly I wish people cared this much. Most people just roll over and deal with the ad or pay for premium so they don't have to see ads.
    - nirvdrum 7y ago
      Is paying to remove the ads a big deal? Presumably the content creator wants to earn something for putting the effort into creating something. Ads are one way to support content creation. Directly paying is another. Many advocates to remove ads say they want a direct pay model.
zaarn 7y ago
WebAssembly can still be detected; the filepath or subdomain can be blocked as normal (would already work) and optionally you can run a fingerprinting method similar to AVs to detect scripts similar to trackers.
- Red_Leaves_Flyy 7y ago
  Exactly. The only way to create a black boxed env on devices outside of the attackers premises is if the attackers built the devices themselves and have thrown decades of iterative development out the window to create equipment resistant to endless physical attacks. Transporting state secrets is a simpler task. That just moves the goalposts though. People will still deconstruct and reverse engineer the black box, or sniff the lines it uses and attack the traffic. Or anything else. There are countless attack vectors against a device in physical possession. So unless the devices are melting down into slag and can perfectly detect even passive attacks then the advertisers will always lose. This doesn't stop them from trying. If advertising can be made more expensive then the roi the advertisers will stop. Some will irrationally throw money at the problem way past the point they should've given up but even they will taper off eventually.
jimmy2020 7y ago
i've seen this in Black Mirror Season-1.
mgreenleaf 7y ago
Like in security, could work with a "block all" with an explicit whitelist of HTML that can be used. If it needs a canvas to display, then it isn't part of the trusted environment. That would mean you couldn't use sites that required both the ads and the content were in canvas/webassembly, but at that point they aren't really a trusted actor.
- t0astbread 7y ago
  Isn't this just kinda uMatrix already?
worldsayshi 7y ago
We could start blacklisting such websites (with opt-in and toggle-able blacklists) and move to search engines that allow such blacklist opt-in features. I'm already seeing a big use case for having such a (opt-in) domain filtered search engine since there's soo many spammy and SEO-hacking web sites out there.
cm2187 7y ago
Perhaps a solution is for websites to have to request authorization to run javascript/wasm on browsers (enforced by the browser). It will allow legitimate uses of client side code, while eliminating the vast majority of abuses. I wonder if it is also not how GDPR should have been implemented. Forcing browsers to implement a request for storing tracking data, which would avoid dark patterns in consent forms and would keep websites honest. It would also allow to remember the decision. If you delete cookies when the browser closes, you get asked for the same consent you denied on every visit.
CuriouslyC 7y ago
Nah. That's when we'll start serving scraped, mirrored content over a P2P network.
aequitas 7y ago
That will be the time we switch from ad-blockers to content-allowers. It can already be seen with distraction free modes. Maybe there is a market for a proxy that converts any page you visit to bare and functional HTML with just content and navigation. No ad's, distractions, disfunctional scrolling, etc.
- userbinator 7y ago
  Maybe there is a market for a proxy that converts any page you visit to bare and functional HTML with just content and navigation. No ad's, distractions, disfunctional scrolling, etc. https://en.wikipedia.org/wiki/Proxomitron https://en.wikipedia.org/wiki/Proxomitron and other MITM-proxies can do that and more, although the security-paranoid may disapprove (but then again --- what are you more concerned about, what is your threat model, etc.) The recent "security vulturism" and things like DoH and other anti-user ostensibly-privacy things certainly doesn't help.
- vbsteven 7y ago
  Browsing with no-script is essentially that. In my configuration every page opens with no JS, and I temp enable or whitelist the domains I want scripts to load from. I’m not sure if it can also enable individual scripts, that might become necessary very soon if this article is an example of what is coming.
- gbear605 7y ago
  The reader mode that comes in most browsers is essentially that, although it needs the navigation too.
- kodablah 7y ago
  There is definitely a market for this and has been an idea I've been toying with for some time. Instead of a proxy per se, it'd be an API on top of a headless browser scraper then a simple web UI that uses that API. It'll have easy-to-update content extraction/interaction scripts for popular sites. Essentially you'll have "craigslist-ified" much of the popular web into an almost AOL like portal. Users will be encouraged to run client side (this won't be hosted, too many legal issues) and while this won't prevent tracking per se (headless browser still tracks), it is an easily exposed web server from your desktop. So you could even expose via Tor (time lost is made up for lack of content) and if you wanted to share, you could. Caching/storage and eager ahead of time loading/scraping of common sites, and it'll perform even better. Anyone can use the API for whatever they want. Wrap it up with an easy to install bow and easy self updating to keep up with sites (and easy fallback to original sites/links), and I'll never browse the mainstream sites again. There are a couple of things that do this, but none as well as I'd like to see.
userbinator 7y ago
There will hopefully always be those personal/ad-free sites that are plain HTML and don't require any JS, but they might get a lot harder to find through the search engines...
JohnBooty 7y ago
Yeah, literally no way to stop tracking. Suppose I have an apache module (or the equivalent in some modern http server) that's (a) injecting the necessary code (b) forwarding the traffic information to my nefarious third-party tracking provider. Or, heck, just a third-party solution that consumes my apache logs. It's doing all of this without using the browser itself as a middleman, like the clumsy CNAME masking discussed in the linked Github discussion. This could never be stopped client-side since one's web browser would have no say. Only reason this isn't more widespread already is because a lot of web properties don't have full control over their shared hosting environments. First-party ads are theoretically kinda sorta maybe blockable via various levels of heuristics, which of course adblockers are already doing to various extents today. But as far as preventing your information from being forwarded behind the scenes, there's no technical solution. Legislation is the only hope to curb it.
- jannes 7y ago
  As far as I know, Urchin [0] (Google Analytics predecessor) was that third-party solution that consumes Apache logs. However, Google bought and discontinued the product. Google still has an old help site referencing its log analysis features [1]. > Urchin WebAnalytics Software is discontinued and is no longer supported. All Urchin documentation applies only to the Urchin product as it was at the time of discontinuation, and does not apply to any Google Analytics products or services. [0]: https://en.wikipedia.org/wiki/Urchin_(software) https://en.wikipedia.org/wiki/Urchin_(software) [1]: https://support.google.com/urchin/answer/28570 https://support.google.com/urchin/answer/28570
Cthulhu_ 7y ago
I don't understand why that isn't already a thing, just set up a proxy on your own domain to the ad / tracking server and you'll already avoid existing blocklists.
- pedro_hab 7y ago
  They also want your sweet 3rd party cookies, 1st party requests don't send those. Ads need to know what you googled, what you did in the competitors website, 1st party domains are a huge handicap for it. They either will need excellent fingerprinting or accept subpar tracking.
  - electrotype 7y ago
    Cookies could be send to an API of the publisher by the server, and information could then be received back to update the cookie.
    - pedro_hab 7y ago
      You can't read 3rd party cookies, neither the browser sends it to the 1st party server. The max they can do is track you in their website, but that's terrible, they need to know more. edit: this means the 3rd party server can't know who you are, even if they get your tracking events, they can't know what you did in the other sites. thats why fingerprinting could fix this, the 3rd party server could find your profile with a good enough fingerprint.
      - electrotype 7y ago
        I'm not talking about 3rd party cookies. I'm talking about a sameSite cookie made for the publisher, via a proxy on the server.
        pedro_hab 7y ago
        I don't think I understood you then, if they send 1st party cookies they won't be able to match you against a 3rd party profile, will they?
JoeSamoa 7y ago
It should be clear at this point the www is a not what it was. Honestly the ads could still be 3rd party, but they would just be stored on the same web server as the site. Then the 3rd party would just collect the info from the site instead of directly through the user. I'm ready to move on. In my eyes we already lost the www.
deleted 7y ago
[deleted]
dallasrpi 7y ago
Good, me and other content providers attempting to make a living fully applaud this.
- maze-le 7y ago
  You could also try to provide paid content. I am more than willing to pay for content I like, if the price is reasonable and I can avoid ads and tracking -- I already support a number of media-outlets and podcasts with donations. If you provide paid content AND try to track me or make even more money with me via ads: goodbye... On the other hand: If you rely on ads only, it is doubtful that your media-outlet is truly neutral -- would you really do analysis and investigations on your highest paying ad clients (?) -- I doubt it...
egdod 7y ago
Disable JavaScript.
voidmain 7y ago
The next step after that will be machine vision based transformation of the rendered output. I think as long as end users can keep control of the browser and computing device hope is not lost. There is also the option of actively attacking the business model of the ad and tracking industry. Ad blockers could simulate lots of "fake" traffic to make ad analytics harder (this is another arms race against attempts to filter out the fake traffic)
- jackdh 7y ago
  >machine vision based transformation of the rendered output This would be awesome!
- BlueTemplar 7y ago
  > as long as end users can keep control of the browser and computing device hope is not lost. Mandatory : "Why Rosyna Can't Take A Movie Screenshot" http://web.archive.org/web/20180919021829/https://www.alexrad.me/discourse/why-rosyna-cant-take-a-movie-screenshot.html http://web.archive.org/web/20180919021829/https://www.alexra...
IvanK_net 7y ago
The first thing is, how do you distinguish between the ad and a non-ad? If my friend mentions a famous brand in a chat with me, should there be some entity to remove the name of that brand from the chat, so that I don't see it? There are many videos on Youtube recommending stuff. You never know if the author has been paid. Even if you try to detect popular ad networks and services, the ad techniques will also evolve. If ads were the only source of my income, and my content was unique, I would show the user a "quiz" every 5 minutes, asking him to answer, what is shown in the ads at the moment :D and deny the access, if the answer is wrong.
- geofft 7y ago
  The common motivation for ad-blocking is to prevent third-party tracking (the discussion here is about first parties proxying that tracking), JS attack surface, cryptominers, auto-playing videos, etc. - not to prevent advertising per se. Back when Google sold text-only ads, people were quite happy with them for doing it.
  - hombre_fatal 7y ago
    > Back when Google sold text-only ads, people were quite happy with them for doing it. Those are some rose-tinted glasses. People on forums like HN were always annoyed that they looked like navbar links and you were only clicking them out of confusion with actual links.
derefr 7y ago
Nah; presuming the page’s real content continues to just be plain HTML, the worst things will get is that you’ll have to browse some sites with JavaScript disabled. Also, re: “inline” static images, there could totally be client-side ML-model cosmetic filters that recognize and remove known as images, regardless of how they got to the page. The filter could even just throw a floating rectangle over then, so it wouldn’t even have to understand how they’re made in the DOM. This is the “thermonuclear backup plan” we’ve been expecting to need to pull out for a while now, though advertisers have been lazy about getting sneaky enough to necessitate it.
- BlueTemplar 7y ago
  My issue is that while blocking third-party scripts breaks a small part of the "Web", this now requires me to block even the first-party JavaScript, breaking most of the Web !
Blaiz0r 7y ago
We have lost the WWW since corporate interests took over from personal interest. Small community sites are still interesting, distributed web technologies may start to rise, or there's always gophernet...
Pxtl 7y ago
Good. That means if there's a terrible exploit in the adtech, it will be attacking the host's server instead of my browser.
dspillett 7y ago
> The endgame will be all/most websites embedding 1st party ads and tracking The problem with first party tracking from the PoV of the advertisers is that the feedback they need goes through the site their ad is on so it is possible to be faked: "Yes Mr Advertiser, we really did send x000 ad impressions to {addresses} this day, honest guv'ner." And from the site's point of view the adverts now become a little more admin to manage beyond just slapping in a reference to 3rd party JS and adding a <div> for that code to target to insert the advert.
- tzs 7y ago
  They could address that by going the other way. Instead of serving the ads from the content provider's server, serve the content from the ad provider's server. Essentially, the ad providers would also become hosting services.
  - 1_player 7y ago
    > serve the content from the ad provider's server. So.. Google AMP?
  - dspillett 7y ago
    Many content providers won't like handing over as much control as such a situation may imply though. It also creates single points of failure that did not exist before. If the ad service is down, your content is (potentially) down too rather than just being served without working ads.
manigandham 7y ago
Ads also pay for the content so without them eventually you'll lose the content too.
kbenson 7y ago
Well, if it's first party you've at least mitigated some of the privacy concerns, and it's then about the privacy policy of the company in question. If they want to make ads extremely hard to block but reduce privacy concerns, I'm all for that. It puts the discussion back on a more even level, and if you don't like the ads, don't use the service. The only reason I'm okay with running an ad blocker now is because of the privacy concerns. If those were eliminated (which isn't the case in this theoretical situation, they're just reduced) then I'm not sure how to justify running an ad-blocker. To my eyes, it's basically stealing cable or satellite service. I understand other people don't see it the same way though.
rapind 7y ago
I run a SaaS with tens of thousands of users and am not even tempted to run ads or even add third party analytics. Firefox, Safari, and Chrome all work fine on it. Just because there are a lot of bad actors and massive amounts of advertising doesn't mean the entire internet needs to go down that path.
booteille 7y ago
The answer must be political. Hackers have protected users since years. It's time for politicians to protect their citizens.
mihaaly 7y ago
well, at least the most bit. to be honest huge portion of pages would not be missed. myself avoiding quite some already, just out of principle. and I am fine without those!
burtonator 7y ago
> At that point we will have lost. I'm actually hoping it paves the way for more independent publishers that focus on quality content and charging. Ads have ALWAYS sucked and been a horrible solution to funding news, journalism, etc. The problem is that ads basically cause other users to defect to platforms that are free (but sponsored by ads).
jakeogh 7y ago
Or we stop executing arb code. https://news.ycombinator.com/item?id=21560258 https://news.ycombinator.com/item?id=21560258

squiggleblaz 7y ago

I guess the solution at that point will be to develop a free (foss) internet alternative. The internet will partition: the corporate internet will be what you say, and the independent internet will be people writing and hosting their own content, like the internet of the olden days. Some of them might interact with corporate services via apis. The independent internet will be small, but it will be enough. If you want to buy something anonymously, go to a shop and pay cash with your phone turned off.

jjordan 7y ago
I'm intrigued by the possibilities offered by decentralized technologies like IPFS and the like. I think whomever can come up with a viable economic model that allows for the sustainable decentralization of web services will change the world.

syshum 7y ago

Thank W3C for caving into the Corporations that want to remove the Openness from the web-standards that allow for this kind of nonsense. Google is the biggest offender after all their entire business is Tracking and Ads but it seems they get a pass as being an "offender" from most people

ekianjo 7y ago
> Google is the biggest offender after all their entire business is Tracking and Ads but it seems they get a pass as being an "offender" from most people Note that "most people" (even individuals) also happily insert Google Analytics snippets on their own blogs or websites. I see that all the time thru uMatrix. So it's far from "Google being a bad actor" alone.
- hombre_fatal 7y ago
  People also pile on Google for Recaptcha when it's actually users like website operators and Cloudflare who are using it to avoid abuse. Might as while pile on the bad/abusive actors for causing the scenario that makes people use captchas at all.

cyborgx7 7y ago

I wasn't aware putting trackers on subdomains was a working adblocker workaround. Now that I know it, I'm surprised it hasn't been a massive problem since much earlier.

Normal_gaussian 7y ago
Essentially most sites are not "owned" by a single technical authority in the business - this is the main reason such a simple workaround goes unused. The key parts there are: - single - technical - authority Watching businesses attempt an integration of a line code anywhere to download the third party tool is painfully hilarious. Getting them to set up a DNS record to point to you is often so far off the table its playing in the forest with the faeries. Having them pull your code and serve it statically alongside their site... I couldn't imagine
- cyborgx7 7y ago
  I believe you, but this still seems strange to me with the overdesigned behemoths, on the verge of toppling over at any moment, most big corporate sites appear to be nowadays.
  - mobjack 7y ago
    Websites get bloated because the companies aren't aware of all the tracking going on in the first place. What usually happens is that the marketing team signs a contract then developers copy and paste a JavaScript snippet to embed on the website and move on. The work arounds require much more intention and the solutions can be hacky like modifying urls in a minified JS file. If that tracking is blocked, it is invisible to the company especially if only the third party who has access to the data.
- paol 7y ago
  I agree, but given enough incentive these barriers can be overcome. I thing these are signs that ad-blocking is becoming sufficiently painful to provide that incentive.
7y ago

riffraff 7y ago

if canvas become a medium for nasty ad delivery it will go the same way of <object>, I am not too worried. But as always, it will be an arms race.

lma21 7y ago

We can surely find ways to block canvas or webassembly from such websites no?

walrus01 7y ago

Image recognition algorithms client side. Accept and load the ad, render page, replace it with a white square over it. If you're willing to get cpu/gpu intensive on the page rendering a lot can be done.

bloak 7y ago
Yes, I think that's the right approach. You just forgot to mention that in order to prevent tracking a new VM is spun up for fetching each page. (Of course this wouldn't be necessary if the browser were implemented by someone who was on the same side as the user.)
- psv1 7y ago
  > You just forgot to mention that in order to prevent tracking a new VM is spun up for fetching each page. Make sure the travel to a different country between clicks. Just in case.
  - yjftsjthsd-h 7y ago
    I mean. I think you're joking, but if you use Tor then you're perfectly welcome to make a new circuit per website or whatever.
vbezhenar 7y ago
Ad blocking is supposed to improve performance. If you still need to download ad and then perform additional computations, I, personally, would opt-out from that ad-blocking, it's not hard to ignore ad myself.
- Freak_NL 7y ago
  > it's not hard to ignore ad myself. It's a constant cognitive drain on your mental resources. That's even ignoring the fact that almost everyone is influenced by ads to varying degrees.
  - 7y ago

Quarrelsome 7y ago

but this is all we ever asked, wasn't it? That the content creator take direct responsibility for their advertising instead of shipping us off someplace else.

cyborgx7 7y ago
They are still shipping us off someplace else. The fact that they technically put their name in front of it to trick the browser, doesn't change this.
- Quarrelsome 7y ago
  I feel like it at least makes the arrangement explicit and IMO its as much as we could ever ask for. This was always the technological trick that ad-blocking employed.
  - cyborgx7 7y ago
    > its as much as we could ever ask for I can ask for a lot more, don't worry.
sbarre 7y ago
Agreed. If ads are served by the site I'm visiting and don't include cross-site tracking bugs, then I think that should be acceptable to most. Speaking for myself, I've never been opposed to ads on sites (within reason - popovers are trash), because I understand that creating content costs money, but I don't like all the tracking that comes with them.
- cyborgx7 7y ago
  It's always fun to read comments by people who clearly only read the title and haven't clicked on the link.
  - sbarre 7y ago
    I did actually click the link and read the whole Github issue thread, and the discussion here, before commenting. But I was actually responding to the parent's comment (this is a threaded discussion, yes?) about how actual first-party ads are less objectionable than third-party tracking. But thanks for adding your thoughts.

have_faith 7y ago

There's no losing if people voted with their attention instead. If the terms of exchanging data are unacceptable then don't accept any data from that source. The digital equivalent of voting with your wallet. Kind of like climate change, there are actions we all know would help but individually giving up those conveniences is difficult.

cyborgx7 7y ago
> The digital equivalent of voting with your wallet. And like voting with your wallet, it will be completely ineffectual in actually addressing the problem. > Kind of like climate change Another area where the need for comprehensive societal solutions gets dumped on the individual instead, rendering it ineffectual.
- have_faith 7y ago
  Exactly. In theory they are effectual, if people actually did it... I'm a big proponent of top down climate change policy to force change as opposed to hoping if we virtue signal enough people will be shamed into driving a bit less etc.
  - cyborgx7 7y ago
    I misread your comment then. I assumed you were saying this is the strategy we should adopt on those issues.
    - have_faith 7y ago
      With regards to climate change, definitely not. I just wanted to highlight that it's a similar mechanic at play. Perhaps I phrased it oddly. With regards to Ads I don't take as much a hard line approach as yourself (I remember our last discussion!). I'm very pro ad blocker use but not to go as far as banning them in any way. Something I've been thinking about is sending a header to websites informing them I'm going to block their ads so they decide not to send me the content if they don't want to. I feel no entitlement to their content as they should not feel any entitlement to what code gets to run on my machine once it reaches me. I might expand on this in a blog post some time soon but it's probably closer to an art project than something actually viable.

Normal_gaussian 7y ago

I'm imagining the horror of having to do it with output analysis. An advanced renderer scans the page to identify and plaster over adverts..

pdkl95 7y ago

> unblockable ads delivered through first party and using obfuscated techniques like canvas or webassembly When I said basically the same thing 4 years ago[1], most people seemed to think it wasn't a serious concern or could be easily bypassed. However, after observing how certain types of businesses use the World Wide Web over the past 3 decades, it's obvious what they want: to send an opaque binary blob to the user that nobody can investigate or modify, that gives them full control over what the user sees and is allowed to do. Just like TV. The only safe response to this is to stop allowing documents (or docs with 3270-styole forms) to embed software in a Turing complete language. Add functionality that is used declaritively, or the answer to "should this be blocked" is undecidable. Give them the ability to run a Turing complete language that renders to a canvas, and adblocking becomes a hard image recognition problem (or requires solving the Halting Problem). [1] https://news.ycombinator.com/item?id=10211050 https://news.ycombinator.com/item?id=10211050

pingyong 7y ago
I'm not saying no one will try to do this, but YouTube had the technical option of splicing ads directly into the video stream and simply not sending the actual video content for the duration of the ad for several years now. They chose not to do it. Potentially the lost revenue from people not using YouTube as much anymore / migrating to a different platform would be bigger here than the increase in ad traffic. People who don't want to see ads (i.e. a large part of adblock users) are also more likely to engage in toxic (to advertisers and YouTube) behavior, such as intentionally clicking on ads but never buying anything (or even writing scripts to do that), or intentionally avoiding the advertised product, etc.
- JoeSamoa 7y ago
  Honestly I wish people cared this much. Most people just roll over and deal with the ad or pay for premium so they don't have to see ads.
  - nirvdrum 7y ago
    Is paying to remove the ads a big deal? Presumably the content creator wants to earn something for putting the effort into creating something. Ads are one way to support content creation. Directly paying is another. Many advocates to remove ads say they want a direct pay model.

zaarn 7y ago

WebAssembly can still be detected; the filepath or subdomain can be blocked as normal (would already work) and optionally you can run a fingerprinting method similar to AVs to detect scripts similar to trackers.

Red_Leaves_Flyy 7y ago
Exactly. The only way to create a black boxed env on devices outside of the attackers premises is if the attackers built the devices themselves and have thrown decades of iterative development out the window to create equipment resistant to endless physical attacks. Transporting state secrets is a simpler task. That just moves the goalposts though. People will still deconstruct and reverse engineer the black box, or sniff the lines it uses and attack the traffic. Or anything else. There are countless attack vectors against a device in physical possession. So unless the devices are melting down into slag and can perfectly detect even passive attacks then the advertisers will always lose. This doesn't stop them from trying. If advertising can be made more expensive then the roi the advertisers will stop. Some will irrationally throw money at the problem way past the point they should've given up but even they will taper off eventually.

jimmy2020 7y ago

i've seen this in Black Mirror Season-1.

mgreenleaf 7y ago

Like in security, could work with a "block all" with an explicit whitelist of HTML that can be used. If it needs a canvas to display, then it isn't part of the trusted environment. That would mean you couldn't use sites that required both the ads and the content were in canvas/webassembly, but at that point they aren't really a trusted actor.

t0astbread 7y ago
Isn't this just kinda uMatrix already?

worldsayshi 7y ago

We could start blacklisting such websites (with opt-in and toggle-able blacklists) and move to search engines that allow such blacklist opt-in features. I'm already seeing a big use case for having such a (opt-in) domain filtered search engine since there's soo many spammy and SEO-hacking web sites out there.

cm2187 7y ago

Perhaps a solution is for websites to have to request authorization to run javascript/wasm on browsers (enforced by the browser). It will allow legitimate uses of client side code, while eliminating the vast majority of abuses. I wonder if it is also not how GDPR should have been implemented. Forcing browsers to implement a request for storing tracking data, which would avoid dark patterns in consent forms and would keep websites honest. It would also allow to remember the decision. If you delete cookies when the browser closes, you get asked for the same consent you denied on every visit.

CuriouslyC 7y ago

Nah. That's when we'll start serving scraped, mirrored content over a P2P network.

aequitas 7y ago

That will be the time we switch from ad-blockers to content-allowers. It can already be seen with distraction free modes. Maybe there is a market for a proxy that converts any page you visit to bare and functional HTML with just content and navigation. No ad's, distractions, disfunctional scrolling, etc.

userbinator 7y ago
Maybe there is a market for a proxy that converts any page you visit to bare and functional HTML with just content and navigation. No ad's, distractions, disfunctional scrolling, etc. https://en.wikipedia.org/wiki/Proxomitron https://en.wikipedia.org/wiki/Proxomitron and other MITM-proxies can do that and more, although the security-paranoid may disapprove (but then again --- what are you more concerned about, what is your threat model, etc.) The recent "security vulturism" and things like DoH and other anti-user ostensibly-privacy things certainly doesn't help.
vbsteven 7y ago
Browsing with no-script is essentially that. In my configuration every page opens with no JS, and I temp enable or whitelist the domains I want scripts to load from. I’m not sure if it can also enable individual scripts, that might become necessary very soon if this article is an example of what is coming.
gbear605 7y ago
The reader mode that comes in most browsers is essentially that, although it needs the navigation too.
kodablah 7y ago
There is definitely a market for this and has been an idea I've been toying with for some time. Instead of a proxy per se, it'd be an API on top of a headless browser scraper then a simple web UI that uses that API. It'll have easy-to-update content extraction/interaction scripts for popular sites. Essentially you'll have "craigslist-ified" much of the popular web into an almost AOL like portal. Users will be encouraged to run client side (this won't be hosted, too many legal issues) and while this won't prevent tracking per se (headless browser still tracks), it is an easily exposed web server from your desktop. So you could even expose via Tor (time lost is made up for lack of content) and if you wanted to share, you could. Caching/storage and eager ahead of time loading/scraping of common sites, and it'll perform even better. Anyone can use the API for whatever they want. Wrap it up with an easy to install bow and easy self updating to keep up with sites (and easy fallback to original sites/links), and I'll never browse the mainstream sites again. There are a couple of things that do this, but none as well as I'd like to see.

userbinator 7y ago

There will hopefully always be those personal/ad-free sites that are plain HTML and don't require any JS, but they might get a lot harder to find through the search engines...

JohnBooty 7y ago

Yeah, literally no way to stop tracking. Suppose I have an apache module (or the equivalent in some modern http server) that's (a) injecting the necessary code (b) forwarding the traffic information to my nefarious third-party tracking provider. Or, heck, just a third-party solution that consumes my apache logs. It's doing all of this without using the browser itself as a middleman, like the clumsy CNAME masking discussed in the linked Github discussion. This could never be stopped client-side since one's web browser would have no say. Only reason this isn't more widespread already is because a lot of web properties don't have full control over their shared hosting environments. First-party ads are theoretically kinda sorta maybe blockable via various levels of heuristics, which of course adblockers are already doing to various extents today. But as far as preventing your information from being forwarded behind the scenes, there's no technical solution. Legislation is the only hope to curb it.

jannes 7y ago
As far as I know, Urchin [0] (Google Analytics predecessor) was that third-party solution that consumes Apache logs. However, Google bought and discontinued the product. Google still has an old help site referencing its log analysis features [1]. > Urchin WebAnalytics Software is discontinued and is no longer supported. All Urchin documentation applies only to the Urchin product as it was at the time of discontinuation, and does not apply to any Google Analytics products or services. [0]: https://en.wikipedia.org/wiki/Urchin_(software) https://en.wikipedia.org/wiki/Urchin_(software) [1]: https://support.google.com/urchin/answer/28570 https://support.google.com/urchin/answer/28570

Cthulhu_ 7y ago

I don't understand why that isn't already a thing, just set up a proxy on your own domain to the ad / tracking server and you'll already avoid existing blocklists.

pedro_hab 7y ago
They also want your sweet 3rd party cookies, 1st party requests don't send those. Ads need to know what you googled, what you did in the competitors website, 1st party domains are a huge handicap for it. They either will need excellent fingerprinting or accept subpar tracking.
- electrotype 7y ago
  Cookies could be send to an API of the publisher by the server, and information could then be received back to update the cookie.
  - pedro_hab 7y ago
    You can't read 3rd party cookies, neither the browser sends it to the 1st party server. The max they can do is track you in their website, but that's terrible, they need to know more. edit: this means the 3rd party server can't know who you are, even if they get your tracking events, they can't know what you did in the other sites. thats why fingerprinting could fix this, the 3rd party server could find your profile with a good enough fingerprint.
    - electrotype 7y ago
      I'm not talking about 3rd party cookies. I'm talking about a sameSite cookie made for the publisher, via a proxy on the server.
      - pedro_hab 7y ago
        I don't think I understood you then, if they send 1st party cookies they won't be able to match you against a 3rd party profile, will they?

JoeSamoa 7y ago

It should be clear at this point the www is a not what it was. Honestly the ads could still be 3rd party, but they would just be stored on the same web server as the site. Then the 3rd party would just collect the info from the site instead of directly through the user. I'm ready to move on. In my eyes we already lost the www.

deleted 7y ago

[deleted]

dallasrpi 7y ago

Good, me and other content providers attempting to make a living fully applaud this.

maze-le 7y ago
You could also try to provide paid content. I am more than willing to pay for content I like, if the price is reasonable and I can avoid ads and tracking -- I already support a number of media-outlets and podcasts with donations. If you provide paid content AND try to track me or make even more money with me via ads: goodbye... On the other hand: If you rely on ads only, it is doubtful that your media-outlet is truly neutral -- would you really do analysis and investigations on your highest paying ad clients (?) -- I doubt it...

egdod 7y ago

Disable JavaScript.

voidmain 7y ago

The next step after that will be machine vision based transformation of the rendered output. I think as long as end users can keep control of the browser and computing device hope is not lost. There is also the option of actively attacking the business model of the ad and tracking industry. Ad blockers could simulate lots of "fake" traffic to make ad analytics harder (this is another arms race against attempts to filter out the fake traffic)

jackdh 7y ago
>machine vision based transformation of the rendered output This would be awesome!
BlueTemplar 7y ago
> as long as end users can keep control of the browser and computing device hope is not lost. Mandatory : "Why Rosyna Can't Take A Movie Screenshot" http://web.archive.org/web/20180919021829/https://www.alexrad.me/discourse/why-rosyna-cant-take-a-movie-screenshot.html http://web.archive.org/web/20180919021829/https://www.alexra...

IvanK_net 7y ago

The first thing is, how do you distinguish between the ad and a non-ad? If my friend mentions a famous brand in a chat with me, should there be some entity to remove the name of that brand from the chat, so that I don't see it? There are many videos on Youtube recommending stuff. You never know if the author has been paid. Even if you try to detect popular ad networks and services, the ad techniques will also evolve. If ads were the only source of my income, and my content was unique, I would show the user a "quiz" every 5 minutes, asking him to answer, what is shown in the ads at the moment :D and deny the access, if the answer is wrong.

geofft 7y ago
The common motivation for ad-blocking is to prevent third-party tracking (the discussion here is about first parties proxying that tracking), JS attack surface, cryptominers, auto-playing videos, etc. - not to prevent advertising per se. Back when Google sold text-only ads, people were quite happy with them for doing it.
- hombre_fatal 7y ago
  > Back when Google sold text-only ads, people were quite happy with them for doing it. Those are some rose-tinted glasses. People on forums like HN were always annoyed that they looked like navbar links and you were only clicking them out of confusion with actual links.

derefr 7y ago

Nah; presuming the page’s real content continues to just be plain HTML, the worst things will get is that you’ll have to browse some sites with JavaScript disabled. Also, re: “inline” static images, there could totally be client-side ML-model cosmetic filters that recognize and remove known as images, regardless of how they got to the page. The filter could even just throw a floating rectangle over then, so it wouldn’t even have to understand how they’re made in the DOM. This is the “thermonuclear backup plan” we’ve been expecting to need to pull out for a while now, though advertisers have been lazy about getting sneaky enough to necessitate it.

BlueTemplar 7y ago
My issue is that while blocking third-party scripts breaks a small part of the "Web", this now requires me to block even the first-party JavaScript, breaking most of the Web !

Blaiz0r 7y ago

We have lost the WWW since corporate interests took over from personal interest. Small community sites are still interesting, distributed web technologies may start to rise, or there's always gophernet...

Pxtl 7y ago

Good. That means if there's a terrible exploit in the adtech, it will be attacking the host's server instead of my browser.

dspillett 7y ago

> The endgame will be all/most websites embedding 1st party ads and tracking The problem with first party tracking from the PoV of the advertisers is that the feedback they need goes through the site their ad is on so it is possible to be faked: "Yes Mr Advertiser, we really did send x000 ad impressions to {addresses} this day, honest guv'ner." And from the site's point of view the adverts now become a little more admin to manage beyond just slapping in a reference to 3rd party JS and adding a <div> for that code to target to insert the advert.

tzs 7y ago
They could address that by going the other way. Instead of serving the ads from the content provider's server, serve the content from the ad provider's server. Essentially, the ad providers would also become hosting services.
- 1_player 7y ago
  > serve the content from the ad provider's server. So.. Google AMP?
- dspillett 7y ago
  Many content providers won't like handing over as much control as such a situation may imply though. It also creates single points of failure that did not exist before. If the ad service is down, your content is (potentially) down too rather than just being served without working ads.

manigandham 7y ago

Ads also pay for the content so without them eventually you'll lose the content too.

kbenson 7y ago

Well, if it's first party you've at least mitigated some of the privacy concerns, and it's then about the privacy policy of the company in question. If they want to make ads extremely hard to block but reduce privacy concerns, I'm all for that. It puts the discussion back on a more even level, and if you don't like the ads, don't use the service. The only reason I'm okay with running an ad blocker now is because of the privacy concerns. If those were eliminated (which isn't the case in this theoretical situation, they're just reduced) then I'm not sure how to justify running an ad-blocker. To my eyes, it's basically stealing cable or satellite service. I understand other people don't see it the same way though.

rapind 7y ago

I run a SaaS with tens of thousands of users and am not even tempted to run ads or even add third party analytics. Firefox, Safari, and Chrome all work fine on it. Just because there are a lot of bad actors and massive amounts of advertising doesn't mean the entire internet needs to go down that path.

booteille 7y ago

The answer must be political. Hackers have protected users since years. It's time for politicians to protect their citizens.

mihaaly 7y ago

well, at least the most bit. to be honest huge portion of pages would not be missed. myself avoiding quite some already, just out of principle. and I am fine without those!

burtonator 7y ago

> At that point we will have lost. I'm actually hoping it paves the way for more independent publishers that focus on quality content and charging. Ads have ALWAYS sucked and been a horrible solution to funding news, journalism, etc. The problem is that ads basically cause other users to defect to platforms that are free (but sponsored by ads).

jakeogh 7y ago

Or we stop executing arb code. https://news.ycombinator.com/item?id=21560258 https://news.ycombinator.com/item?id=21560258