4 ms·

The next step is simply proxying the tracker through the original website. /img/logo.png?uuid=..&res=1920&os=MacOS&osv=11.2 and when heuristics catch up with

The next step is simply proxying the tracker through the original website. /img/logo.png?uuid=..&res=1920&os=MacOS&osv=11.2 and when heuristics catch up with that ... /img/logo.png?757569643D2E2E267265733D31393230266F733D4D61634F53266F

lights0123 6y ago
You could do the same thing with a separate subdomain like this—the CNAME strategy is just using DNS to point to your provider so you never have to serve analytics requests yourself. If you self-host analytics, CNAME blocking was never intended to nor will prevent that.
zelphirkalt 6y ago
OK, we can still run some user script or have a browser setting, which removes the ?757569643D2E2E267265733D31393230266F733D4D61634F53266F part for things like images. What would be the level after that?
- temp667 6y ago
  You just have unique names for images - isn't that already used for email pixels? ie, se09d.png Also used sometimes for standard cache invalidation efforts so common for both nontracking purposes too. Worst case sites will just install a middleware layer to proxy all their requests and traffic back to ad tech machine I'd imagine or install some middleware on their stack.
- gruez 6y ago
  The endgame is that the browser is only a thin client (think VNC) and the actual website is rendered server-side.
  - slaymaker1907 6y ago
    I think for ads this might actually be an improvement (compared to no blocking). A big reason why ads continue to stink is because they always seem to be much more poorly optimized than the actual site. I'm probably being too optimistic though, they'll probably just move the slowdown to the server rather than on the client...
- totetsu 6y ago
  Then nightly releases or AB versions of pages that change the image file name, it's place in the Dom, the structure of the t tracking links, so user scripts are difficult to maintain. Or the tracking company could just develop a browser and convince 90 of internet users to use it, infiltrate the web standards committee to gain control of web features, release new features that are not standard but get widely adopted, make many websites check for user agents of browser to ensure they are using the tracking companies browser, so most other viable browsers fail, then implement their own tracking in the that browser that cannot be blocked by user Javascript, and release a whole new OS that has browsers without extensions, or the basic ability to manage the flow of your information .....
  - zelphirkalt 6y ago
    But wait, that is today! fakes shocked expression
- SheinhardtWigCo 6y ago
  https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography Think along these lines: website.com/blog/f5/babBys-first-bl0g-post-2f.html Can you (or a computer program) answer definitively whether there's a tracking ID in that URL?
hackcasual 6y ago
DNS is cheap, host proxying is less so
- gruez 6y ago
  Not exactly. If the site is already using a CDN it shouldn't be too hard to add a custom route or something. Even better is if the ad company is also a CDN. That doesn't seem too hard to do, just rent a few VPSes around the world and you should be set.
  - hackcasual 6y ago
    still more than just pointing to an IP address
tooltower 6y ago
In the limit, they can always send visitor statistics directly to whoever is paying, without involving your browser. This can be done entirely on the server side. But these changes are still good for privacy. These direct-proxy endgame methods will hopefully make it harder for ad companies to detect ad-fraud, making the ads less economical to begin with.
whoopdedo 6y ago
The game isn't between the host wanting to push ads and the client wanting to block ads. It's a 3-way conflict between the client wanting to see the fewest ads, the advertiser wanting their ads to be seen by the most clients, and the site host wanting the most ads to be seen by each client. And neither side trusts either of the others. If the entire transaction was only carried out between the site and the client then the advertisers would have to believe that the reports being delivered to them by the site owner are accurate. And they know from experience not to believe it. So they insist on having clients tracked themselves or by a third-party (fourth-party?) which is where all the complicated connections, alternate domains, and bloated Javascript come from.

lights0123 6y ago

You could do the same thing with a separate subdomain like this—the CNAME strategy is just using DNS to point to your provider so you never have to serve analytics requests yourself. If you self-host analytics, CNAME blocking was never intended to nor will prevent that.

zelphirkalt 6y ago

OK, we can still run some user script or have a browser setting, which removes the ?757569643D2E2E267265733D31393230266F733D4D61634F53266F part for things like images. What would be the level after that?

temp667 6y ago
You just have unique names for images - isn't that already used for email pixels? ie, se09d.png Also used sometimes for standard cache invalidation efforts so common for both nontracking purposes too. Worst case sites will just install a middleware layer to proxy all their requests and traffic back to ad tech machine I'd imagine or install some middleware on their stack.
gruez 6y ago
The endgame is that the browser is only a thin client (think VNC) and the actual website is rendered server-side.
- slaymaker1907 6y ago
  I think for ads this might actually be an improvement (compared to no blocking). A big reason why ads continue to stink is because they always seem to be much more poorly optimized than the actual site. I'm probably being too optimistic though, they'll probably just move the slowdown to the server rather than on the client...
totetsu 6y ago
Then nightly releases or AB versions of pages that change the image file name, it's place in the Dom, the structure of the t tracking links, so user scripts are difficult to maintain. Or the tracking company could just develop a browser and convince 90 of internet users to use it, infiltrate the web standards committee to gain control of web features, release new features that are not standard but get widely adopted, make many websites check for user agents of browser to ensure they are using the tracking companies browser, so most other viable browsers fail, then implement their own tracking in the that browser that cannot be blocked by user Javascript, and release a whole new OS that has browsers without extensions, or the basic ability to manage the flow of your information .....
- zelphirkalt 6y ago
  But wait, that is today! fakes shocked expression
SheinhardtWigCo 6y ago
https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography Think along these lines: website.com/blog/f5/babBys-first-bl0g-post-2f.html Can you (or a computer program) answer definitively whether there's a tracking ID in that URL?

hackcasual 6y ago

DNS is cheap, host proxying is less so

gruez 6y ago
Not exactly. If the site is already using a CDN it shouldn't be too hard to add a custom route or something. Even better is if the ad company is also a CDN. That doesn't seem too hard to do, just rent a few VPSes around the world and you should be set.
- hackcasual 6y ago
  still more than just pointing to an IP address

tooltower 6y ago

In the limit, they can always send visitor statistics directly to whoever is paying, without involving your browser. This can be done entirely on the server side. But these changes are still good for privacy. These direct-proxy endgame methods will hopefully make it harder for ad companies to detect ad-fraud, making the ads less economical to begin with.

whoopdedo 6y ago

The game isn't between the host wanting to push ads and the client wanting to block ads. It's a 3-way conflict between the client wanting to see the fewest ads, the advertiser wanting their ads to be seen by the most clients, and the site host wanting the most ads to be seen by each client. And neither side trusts either of the others. If the entire transaction was only carried out between the site and the client then the advertisers would have to believe that the reports being delivered to them by the site owner are accurate. And they know from experience not to believe it. So they insist on having clients tracked themselves or by a third-party (fourth-party?) which is where all the complicated connections, alternate domains, and bloated Javascript come from.