3 ms·

I can already give everyone a unique URL to the same resource at the cost of it not being cached (which is a cost this mechanism doesn't avoid). The article ad

by saurik 6y ago

I can already give everyone a unique URL to the same resource at the cost of it not being cached (which is a cost this mechanism doesn't avoid). The article admits this, but then simultaneously tries to claim that the loss of caching would prevent that from being common... but this loses caching. I can already give everyone unique resources for the same URL by keying the response on the Referer (which I would also add to the Vary header). The article also admits this, but then tries to claim problems that are out of scope... the "first visit" will never be to a subresource of a page. The article further tries to claim that this is difficult or defeats caching, but adding Referer to Vary is trivial and works with all CDNs and caches. Meanwhile, if we believe this kind of argument about "people won't bother to do it because it is slightly hard" (I don't), then we need to be consistent. It will take work to generate the multiple obfuscated copies of this bundle and be maximally disadvantageous to caching to do so for each visitor. Ad blockers that work using URLs are fundamentally only possible because they aren't common: if you make them common, they will break. I mean, ad blockers are so uncommon right now that you can often get away with blocking hosts at the DNS level... that is so trivially defeated! If you want to do something useful, work on post-download ad "view" blocking by having an AI classify regions of the page as ads and then erase them. This is also an arms war, but it is one that will more than likely at least result in subtle ads that you don't mind (as the AI "lets them slide") ;P.

saagarjha 6y ago
One of the problems with ad "view" blocking is that the problematic code still downloads and loads, so you lose much of the benefits of content blocking making your page lighter and only get the benefit of removing mental overhead/distractions (I say "only", but I'm not trying to say it's not a huge gain). Ideally this AI would work at the network level, but the fundamental problem is that a URL doesn't have to tell you anything about what is on the other end, and we haven't tried "browser antivirus" software yet that blocks JavaScript by matching it against (say) an ad network's "fingerprint"…
- saurik 6y ago
  Yeah. For various article-context reasons I am concentrating on the blocking of "ads" here rather than on "malicious code". The latter is a much more complex problem to solve in the first place, though: like, it relies on a specific model of opponent that is also extremely dumb; amazingly, this opponent exists in the wild, but I swear it is only because people who go out of their way to block them with simple techniques are so rare as to not be worth investing into including in your un-targeted resource utilization attack. (And FWIW, the ad pages I run into that are maximally bad -- ones that abuse the browser using history state tricks, popping up notification boxes and printer dialogs, sometimes even managing to lock up the entire rendering engine on purpose in an attempt to get the user to agree to the terms of the scam -- all have URLs that are constantly being randomized so often that I have a hard time showing them to other people.)
pes10k 6y ago
Its definitely true that you can key responses to request information beyond the URLs, but I think theres more to it than this: - Lots of tools don't allow you to block requests off those additional keys (Google's Manifest v3 for one, Apple's iOS content blocking too) - In many cases, making consistent replies based off those keys requires additional information privacy tools also try to limit (referrer fields, cookies, etc) - There is practical, real world value in making things more difficult for trackers / folks sending you stuff you don't want; decisions are made at the margins! - Ad blockers are common on the web (estimates 10-30% of users!); they're effective bc they work with the grain of the web, and circumvention is deterred (though not prevented) bc there are costs to circumventing adblockers; WebBundles push those costs to zero. Again, decisions are made at the margins

by saurik 6y ago

saagarjha 6y ago

One of the problems with ad "view" blocking is that the problematic code still downloads and loads, so you lose much of the benefits of content blocking making your page lighter and only get the benefit of removing mental overhead/distractions (I say "only", but I'm not trying to say it's not a huge gain). Ideally this AI would work at the network level, but the fundamental problem is that a URL doesn't have to tell you anything about what is on the other end, and we haven't tried "browser antivirus" software yet that blocks JavaScript by matching it against (say) an ad network's "fingerprint"…

saurik 6y ago
Yeah. For various article-context reasons I am concentrating on the blocking of "ads" here rather than on "malicious code". The latter is a much more complex problem to solve in the first place, though: like, it relies on a specific model of opponent that is also extremely dumb; amazingly, this opponent exists in the wild, but I swear it is only because people who go out of their way to block them with simple techniques are so rare as to not be worth investing into including in your un-targeted resource utilization attack. (And FWIW, the ad pages I run into that are maximally bad -- ones that abuse the browser using history state tricks, popping up notification boxes and printer dialogs, sometimes even managing to lock up the entire rendering engine on purpose in an attempt to get the user to agree to the terms of the scam -- all have URLs that are constantly being randomized so often that I have a hard time showing them to other people.)

pes10k 6y ago

Its definitely true that you can key responses to request information beyond the URLs, but I think theres more to it than this: - Lots of tools don't allow you to block requests off those additional keys (Google's Manifest v3 for one, Apple's iOS content blocking too) - In many cases, making consistent replies based off those keys requires additional information privacy tools also try to limit (referrer fields, cookies, etc) - There is practical, real world value in making things more difficult for trackers / folks sending you stuff you don't want; decisions are made at the margins! - Ad blockers are common on the web (estimates 10-30% of users!); they're effective bc they work with the grain of the web, and circumvention is deterred (though not prevented) bc there are costs to circumventing adblockers; WebBundles push those costs to zero. Again, decisions are made at the margins