11 ms·

This is a good counter example for whenever you find yourself in an argument with anti-adblocker folks.

euroclydon 7y ago
Why? The Great Cannon is served from a proxy. It can inject whatever it wants. It doesn’t have to swap out ad tracker JS.
myself248 7y ago
Or "Why should I care about security, I have nothing of value" folks. You do have something of value: Bandwidth.
- e2le 7y ago
  It always bothers me when I hear people say this, it's everyone's responsibility that their devices don't become part of a botnet or worse used to take part in an attack against infrastructure that we're increasingly dependent upon that either makes for an unpleasant time for people or threatens lives.
  - Waterluvian 7y ago
    99.9% of devices are owned by someone who has absolutely zero technical ability to fulfill this responsibility. So I'd say the responsibility needs to be satisfied another way. Maybe it escalates to the ISP. I mean, unless we start issuing Internet Licenses the way we do Driver's Licenses. In the early 2000s my cable provider would outright shut off our Internet if my dumb brother or my dumb self got us all virused up.
    - e2le 7y ago
      I agree, most don't have the technical ability to administrate their devices although I'm not sure if that excuses basic competence. I like the idea that an ISP would disable the connection of a subscriber however that would depend on how they define malicious activity.
      - Waterluvian 7y ago
        If ISPs were basic utilities it would probably be a fairly safe responsibility to give them. But no, they're media corporations, so they have an inherent drive to abuse that power.
      - kortilla 7y ago
        What you’re describing as “basic competence”, which is removing viruses from a PC in this case, would exclude 99% of users.
  - nradov 7y ago
    A responsibility is meaningless if most people have no practical means to exercise that responsibility.
    - hombre_fatal 7y ago
      One step in the right direction is to drop the marketing bullshit of "unlimited internet" (which doesn't exist) and always meter it, but make it completely transparent. If your smart toaster is saturating your bandwidth, it should show up as an expensive line-item on your bill. You should see that "SmartToast9000" used $80 of bandwidth, "baidu.com" used $17 because it used your bandwidth to ddos. And, of course, the tooling to catch these things before they escalate would likely become part of our computing devices. Right now, everything is completely opaque to the end-user and we all suffer except for bad actors. It's a problem when we can't even estimate how much bandwidth we used in a month off the top of our head. Instead it should be informing our decisions from the IoTrash we buy to which websites we use. Example: the internet was regularly awful at my girlfriend's house. We couldn't figure it out despite calling the ISP. On a suspicion, I helped my gf install a bandwidth monitor on her laptop. We found that a recipes website she often had open would get stuck in some sort of ad-loading retry loop due to her adblocker and would saturate her download bandwidth as long as she had it open. It's completely ridiculous to me that there's no feedback built in to the browser when I think it should be a first-class UI component. I think transparent + metered bandwidth (at a fair price of course) would start the ball rolling on this kind of tooling. Until then, it's like everything acts like bandwidth is unlimited.
MisterTea 7y ago
This is a tiring example of why the web and all its technologies thoroughly suck. It's a boiling toilet fueled by greed.
- fredley 7y ago
  And yet here you are. I'm interested how you would perceive something that might supercede the internet by being better (than a boiling toilet fueled by greed), ignoring network effects?
  - SmellyGeekBoy 7y ago
    Something similar to the web in the late 90s / early 2000s?
    - Gh0stRAT 7y ago
      The Internet of the early 2000s was consumed by greed. What changes would you make to its replacement to prevent the exact same pattern from repeating?
    - MisterTea 7y ago
      Exactly what I'm thinking. Not everything is awful but the insistence of turning the browser into a vm and loading random javascript is pure insane. I'm not advocating for stoneage html and frames but let's take a step back and realize that not every website has to be an interactive webpage some designer dreamed up. I want information, not entertainment or an experience. The experience is what I take away from the information, not the clown paint smeared all over it for show.
  - icandoit 7y ago
    Everyone has to be somewhere. I would not be surprised to find someone, who feels like the modern internet as it exists is terrible, on hacker news. I believe the sentiment is more common here than say, the comments section on CNN. I like the approach taken by the folks at the dat project and beaker browser. Let's make the web a DHT already. If we can force consumers to share what they consume then a DDOS becomes impractical for censoring speech (the speech spreads all over the network, making it counterproductive).
Someone1234 7y ago
But these folks still have no answer for how free websites they consume daily (e.g. news) are to be funded, they don't pay, and don't want to see ads either. Yet they still expect these websites to exist. I use Firefox's built Enhanced Tracking Prevention, that some sites call "ad blocking" but in reality it is super easy to have ads that don't get blocked by it, just make them non-creepy.
- andrewprock 7y ago
  On the contrary, people pay for Netflix. People also pay for the ad-free upgrade to Hulu. Speaking to text websites, people are also using Brave, though I don't know how that experiment will work out in the end.
  - Someone1234 7y ago
    I think Brave is on the right track, but I am skeptical the kind of users that are aggressively anti-ad are going to like seeing ads straight in their notifications. I'd prefer to just pay Brave e.g. $10/month and have it give out that money to sites I visit.
  - csunbird 7y ago
    When it is reasonably priced, people will pay for legal alternatives. If there was a Netflix for paid websites, which would provide subscriptions in a convenient way to all websites in bulk, people would pay for that. Current options are: > Manage subscriptions of 10 plus websites manually > Pay by your privacy It is clear that both options suck, so people opt in to ad blockers instead. Legal options are just overpriced for the demand.
    - kevin_thibedeau 7y ago
      Ad blocking is not illegal.
  - hombre_fatal 7y ago
    I think we need a solution for websites that aren't as unanimously popular as Netflix and Hulu. It's no surprise to me that the biggest entertainment services online can attract a subscription. But it would be a damn shame if those are the only services that can make much money. Just more and more centralization of content. People often respond to this with "well, hobbyists make plenty of content for free," but the thing is that we benefit when our favorite hobbyists can make money from the craft and produce more work for us to enjoy instead of waiting around for their charity. Though the growth of Patreon is a good step in the right direction, culturally. It shows a growing willingness to indeed pay content producers directly with small recurring transactions.
jefftk 7y ago
This is not a good counterexample: the attacker is only able to do this because the analytics scripts are being served over HTTP. If you include the analytics on your site over HTTPS this sort of attack is not relevant.
- ninkendo 7y ago
  I imagine China has quite a bit of infrastructure to push their own CA's onto devices in china, enough to do any MITM'ing they want.
- mminer237 7y ago
  The Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for any citizen, even over HTTPS.
  - jefftk 7y ago
    What makes this attack powerful is not that sites within China can be shut down (the government can already do that) but that sites outside of China can be tricked into DDOSing other sites outside of China. Which is why this attack only works over HTTP.
    - saagarjha 7y ago
      Right, but the traffic is coming from users in China is past the point that HTTPS would help. The requests are already in flight from people in China who've been served malicious JavaScript.
    - mminer237 7y ago
      What I mean is that China can just force a CA to give the CPC its root certificate and then just intercept and edit any HTTPS responses to Chinese citizens and resign them as secure.
    - inimino 7y ago
      It would work just as well over HTTPS, they would just have to make a different phone call (to the site hosting the script rather than to the GFW).

Why? The Great Cannon is served from a proxy. It can inject whatever it wants. It doesn’t have to swap out ad tracker JS.

myself248 7y ago

Or "Why should I care about security, I have nothing of value" folks. You do have something of value: Bandwidth.

e2le 7y ago
It always bothers me when I hear people say this, it's everyone's responsibility that their devices don't become part of a botnet or worse used to take part in an attack against infrastructure that we're increasingly dependent upon that either makes for an unpleasant time for people or threatens lives.
- Waterluvian 7y ago
  99.9% of devices are owned by someone who has absolutely zero technical ability to fulfill this responsibility. So I'd say the responsibility needs to be satisfied another way. Maybe it escalates to the ISP. I mean, unless we start issuing Internet Licenses the way we do Driver's Licenses. In the early 2000s my cable provider would outright shut off our Internet if my dumb brother or my dumb self got us all virused up.
  - e2le 7y ago
    I agree, most don't have the technical ability to administrate their devices although I'm not sure if that excuses basic competence. I like the idea that an ISP would disable the connection of a subscriber however that would depend on how they define malicious activity.
    - Waterluvian 7y ago
      If ISPs were basic utilities it would probably be a fairly safe responsibility to give them. But no, they're media corporations, so they have an inherent drive to abuse that power.
    - kortilla 7y ago
      What you’re describing as “basic competence”, which is removing viruses from a PC in this case, would exclude 99% of users.
- nradov 7y ago
  A responsibility is meaningless if most people have no practical means to exercise that responsibility.
  - hombre_fatal 7y ago
    One step in the right direction is to drop the marketing bullshit of "unlimited internet" (which doesn't exist) and always meter it, but make it completely transparent. If your smart toaster is saturating your bandwidth, it should show up as an expensive line-item on your bill. You should see that "SmartToast9000" used $80 of bandwidth, "baidu.com" used $17 because it used your bandwidth to ddos. And, of course, the tooling to catch these things before they escalate would likely become part of our computing devices. Right now, everything is completely opaque to the end-user and we all suffer except for bad actors. It's a problem when we can't even estimate how much bandwidth we used in a month off the top of our head. Instead it should be informing our decisions from the IoTrash we buy to which websites we use. Example: the internet was regularly awful at my girlfriend's house. We couldn't figure it out despite calling the ISP. On a suspicion, I helped my gf install a bandwidth monitor on her laptop. We found that a recipes website she often had open would get stuck in some sort of ad-loading retry loop due to her adblocker and would saturate her download bandwidth as long as she had it open. It's completely ridiculous to me that there's no feedback built in to the browser when I think it should be a first-class UI component. I think transparent + metered bandwidth (at a fair price of course) would start the ball rolling on this kind of tooling. Until then, it's like everything acts like bandwidth is unlimited.

MisterTea 7y ago

This is a tiring example of why the web and all its technologies thoroughly suck. It's a boiling toilet fueled by greed.

fredley 7y ago
And yet here you are. I'm interested how you would perceive something that might supercede the internet by being better (than a boiling toilet fueled by greed), ignoring network effects?
- SmellyGeekBoy 7y ago
  Something similar to the web in the late 90s / early 2000s?
  - Gh0stRAT 7y ago
    The Internet of the early 2000s was consumed by greed. What changes would you make to its replacement to prevent the exact same pattern from repeating?
  - MisterTea 7y ago
    Exactly what I'm thinking. Not everything is awful but the insistence of turning the browser into a vm and loading random javascript is pure insane. I'm not advocating for stoneage html and frames but let's take a step back and realize that not every website has to be an interactive webpage some designer dreamed up. I want information, not entertainment or an experience. The experience is what I take away from the information, not the clown paint smeared all over it for show.
- icandoit 7y ago
  Everyone has to be somewhere. I would not be surprised to find someone, who feels like the modern internet as it exists is terrible, on hacker news. I believe the sentiment is more common here than say, the comments section on CNN. I like the approach taken by the folks at the dat project and beaker browser. Let's make the web a DHT already. If we can force consumers to share what they consume then a DDOS becomes impractical for censoring speech (the speech spreads all over the network, making it counterproductive).

Someone1234 7y ago

But these folks still have no answer for how free websites they consume daily (e.g. news) are to be funded, they don't pay, and don't want to see ads either. Yet they still expect these websites to exist. I use Firefox's built Enhanced Tracking Prevention, that some sites call "ad blocking" but in reality it is super easy to have ads that don't get blocked by it, just make them non-creepy.

andrewprock 7y ago
On the contrary, people pay for Netflix. People also pay for the ad-free upgrade to Hulu. Speaking to text websites, people are also using Brave, though I don't know how that experiment will work out in the end.
- Someone1234 7y ago
  I think Brave is on the right track, but I am skeptical the kind of users that are aggressively anti-ad are going to like seeing ads straight in their notifications. I'd prefer to just pay Brave e.g. $10/month and have it give out that money to sites I visit.
- csunbird 7y ago
  When it is reasonably priced, people will pay for legal alternatives. If there was a Netflix for paid websites, which would provide subscriptions in a convenient way to all websites in bulk, people would pay for that. Current options are: > Manage subscriptions of 10 plus websites manually > Pay by your privacy It is clear that both options suck, so people opt in to ad blockers instead. Legal options are just overpriced for the demand.
  - kevin_thibedeau 7y ago
    Ad blocking is not illegal.
- hombre_fatal 7y ago
  I think we need a solution for websites that aren't as unanimously popular as Netflix and Hulu. It's no surprise to me that the biggest entertainment services online can attract a subscription. But it would be a damn shame if those are the only services that can make much money. Just more and more centralization of content. People often respond to this with "well, hobbyists make plenty of content for free," but the thing is that we benefit when our favorite hobbyists can make money from the craft and produce more work for us to enjoy instead of waiting around for their charity. Though the growth of Patreon is a good step in the right direction, culturally. It shows a growing willingness to indeed pay content producers directly with small recurring transactions.

jefftk 7y ago

This is not a good counterexample: the attacker is only able to do this because the analytics scripts are being served over HTTP. If you include the analytics on your site over HTTPS this sort of attack is not relevant.

ninkendo 7y ago
I imagine China has quite a bit of infrastructure to push their own CA's onto devices in china, enough to do any MITM'ing they want.
mminer237 7y ago
The Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for any citizen, even over HTTPS.
- jefftk 7y ago
  What makes this attack powerful is not that sites within China can be shut down (the government can already do that) but that sites outside of China can be tricked into DDOSing other sites outside of China. Which is why this attack only works over HTTP.
  - saagarjha 7y ago
    Right, but the traffic is coming from users in China is past the point that HTTPS would help. The requests are already in flight from people in China who've been served malicious JavaScript.
  - mminer237 7y ago
    What I mean is that China can just force a CA to give the CPC its root certificate and then just intercept and edit any HTTPS responses to Chinese citizens and resign them as secure.
  - inimino 7y ago
    It would work just as well over HTTPS, they would just have to make a different phone call (to the site hosting the script rather than to the GFW).