15 ms·

Despite the title being about YouTube, this is fundamentally about Safari's declarative Content Blocker API being totally inadequate in the face of modern ad de

by yliu 5y ago

Despite the title being about YouTube, this is fundamentally about Safari's declarative Content Blocker API being totally inadequate in the face of modern ad delivery technologies. Yes, it's fast and relatively more secure compared to old ad blocking techniques (which requires granting full access to effectively arbitrary JS), but ad tech has evolved since 2015 and Safari's Content Blocking API has not evolved with it. With other browsers showing varying degrees of interest in declarative content blocking, it's worth looking at Safari as a warning of what declarative content blocking, if unmaintained, will do to cripple ad blocking for users.

Flow 5y ago
I use Wipr as a content blocker on both macOS and iOS. I never see ads on YouTube. But I've always felt that it might not be enough some day. Perhaps that day is nearly here.
- js2 5y ago
  This is a recent change by YouTube. Wipr uses the same content blocking API as Adguard and has the same limitations: https://giorgiocalderolla.com/wipr-faq.html#youtube https://giorgiocalderolla.com/wipr-faq.html#youtube
- ameshkov 5y ago
  Note that YT changes aren’t yet rolled out everywhere. Also, if you’re not authorized there’ll be no issues, but it won’t stay like that forever.
  - Ballas 5y ago
    I'm not authorized and started getting the new ads about a week ago (with wipr).
- cuddlybacon 5y ago
  I've been using Wipr. I've been getting the white placeholder screen for just about a year now. Every one in a while I get actual ads getting thru, before a new update fixes it.
  - cuddlybacon 5y ago
    In response to this article, I've disabled it in place of using the standalone Adguard app. So far I haven't gotten either symptom.
- guacaswole 5y ago
  I use Wipr, I’m in Australia and on Catalina. Now see Ads on YouTube, even when I update. Now I understand why.
- lotsofpulp 5y ago
  I use Wipr and I just saw an ad today for the first time on YouTube in Safari. Usually, it throws up an error and you refresh and the video plays, but today’s it was error, then a skippable ad.
- Scarbutt 5y ago
  Adguard requires an electron app(wut?) to run in the background to provide much of its functionality, is Wipr like this too?
  - contriban 5y ago
    No. Wipr is a clean content blocker. I don’t know how it handles auto-updates of the blocklist, but I definitely don’t need to keep the app open nor does it add buttons to the interface like AdGuard does.
    - ameshkov 5y ago
      Running the app is not mandatory and neither is adding buttons to the interface. If you just need content blockers, you can simply enable just them, close the app and forget about it until you feel the need to check filters updates.
      - saagarjha 5y ago
        Last I checked, selecting elements to block also required running the Electron app, which is somewhat annoying and unnecessary.
- raydev 5y ago
  Interesting. I tried Wipr on macOS Safari for a couple weeks about a year ago, and there was effectively no ad blocking on YouTube, Twitch, or Twitter, which is coincidentally where I spend the bulk of my time. It was a frustrating experience, I've tried Safari multiple times over the years since it is so much better on battery life, but Chrome always wins in usability and adblocking. I switched back to Chrome + uBlock Origin and could use those sites ad-free again. Well, except for Twitch, since they found a workaround for adblockers last year.
  - freediver 5y ago
    Sounds like you would be interested in Orion. https://browser.kagi.com https://browser.kagi.com
shawnz 5y ago
This is basically the exact fear which was being expressed by users when Google announced that they would require Chrome extensions to only use declarative content blocking starting with Manifest v3 (which anecdotally convinced me to switch to Firefox).
- defaultname 5y ago
  If we go down that road, however, sites can make ads completely indistinguishable from desired content. Same domain, same stream, no easily marked container. All of the imperative adblocking tech in the world, short of queuing everything through a neural engine post render, can block what is possible. So there has always been a detente between adblockers and publishers, presuming the former hit a small enough set of users that it was just ignored. It seems that is no longer the case.
  - _Algernon_ 5y ago
    That would require delivering ads from first-party servers, right? So third-party ad and tracking networks would die a painful death.
    - qlm 5y ago
      Couldn't they just be proxied through a first party server?
      - _Algernon_ 5y ago
        That would be more effort than including a single html-script tag to import google analytics. I have hope that most parties would decide that the extra server load and difficulties would make it not worth it.
        nimish 5y ago
        You underestimate the desire for precision tracking, unfortunately. Hiding behind custom subdomains is common. Stepping up to cloaking it to be delivered from the application is more effort but it'll happen.
deleted 5y ago
[deleted]
acdha 5y ago
I think you’re right from the short-term perspective but largely irrelevant long-term. If Safari allowed arbitrary code execution, it’d be a little better for as long as it took publishers to deploy first-party ad injection. We’d still get the security problems, though. You can already see what that’s like with podcasts where local ads are spliced right into the audio file. You’re not stopping that short of doing something like buffering the content and running it through an AI, and if that became widespread we’d just see more embedded placement (“Hey, protagonist, why are you so irresistibly sexy?” “It’s these new briefs from My Undies”). Adtech is a multi billion dollar industry and the people making the content you want are enthusiastically supporting them. This is not a problem which technical tricks can solve – as soon as you do something effective, Google can deploy hundreds of engineers with huge resource budgets to foil you. That won’t change without something like regulatory changes to lower the financial pressure.
- lern_too_spel 5y ago
  If I can recognize an ad, I can construct JavaScript that can recognize that ad too. The current extension APIs let me inject that JavaScript, while the declarative ad blocking APIs do not.
  - acdha 5y ago
    This is a constant arms race, as anyone who’s looked at Facebook’s DOM knows, and if you’re successful it pushes to the end state I mentioned of ads becoming very similar to the content. The companies which depend on ad revenue aren’t going to go out of business voluntarily and many of them will find alternative paths to those ad dollars.
- fomine3 5y ago
  It's cat and mouse game, but currently ad blockers win all battles.
- kibwen 5y ago
  > if that became widespread we’d just see more embedded placement Which is completely desirable. The problem isn't "ads", it's "targeted, personalized ads that rely on thoroughly destroying the the privacy of everyone on the internet in order to function". If a show/podcast wants to vet its own advertisers and endorse a specific product, that's great; it establishes a concrete relationship with the advertisers that has more value to both users and content creators than the anonymous, unvettable system of opaque middlemen currently peddled by targeted ad networks.

by yliu 5y ago

Flow 5y ago

I use Wipr as a content blocker on both macOS and iOS. I never see ads on YouTube. But I've always felt that it might not be enough some day. Perhaps that day is nearly here.

js2 5y ago
This is a recent change by YouTube. Wipr uses the same content blocking API as Adguard and has the same limitations: https://giorgiocalderolla.com/wipr-faq.html#youtube https://giorgiocalderolla.com/wipr-faq.html#youtube
ameshkov 5y ago
Note that YT changes aren’t yet rolled out everywhere. Also, if you’re not authorized there’ll be no issues, but it won’t stay like that forever.
- Ballas 5y ago
  I'm not authorized and started getting the new ads about a week ago (with wipr).
cuddlybacon 5y ago
I've been using Wipr. I've been getting the white placeholder screen for just about a year now. Every one in a while I get actual ads getting thru, before a new update fixes it.
- cuddlybacon 5y ago
  In response to this article, I've disabled it in place of using the standalone Adguard app. So far I haven't gotten either symptom.
guacaswole 5y ago
I use Wipr, I’m in Australia and on Catalina. Now see Ads on YouTube, even when I update. Now I understand why.
lotsofpulp 5y ago
I use Wipr and I just saw an ad today for the first time on YouTube in Safari. Usually, it throws up an error and you refresh and the video plays, but today’s it was error, then a skippable ad.
Scarbutt 5y ago
Adguard requires an electron app(wut?) to run in the background to provide much of its functionality, is Wipr like this too?
- contriban 5y ago
  No. Wipr is a clean content blocker. I don’t know how it handles auto-updates of the blocklist, but I definitely don’t need to keep the app open nor does it add buttons to the interface like AdGuard does.
  - ameshkov 5y ago
    Running the app is not mandatory and neither is adding buttons to the interface. If you just need content blockers, you can simply enable just them, close the app and forget about it until you feel the need to check filters updates.
    - saagarjha 5y ago
      Last I checked, selecting elements to block also required running the Electron app, which is somewhat annoying and unnecessary.
raydev 5y ago
Interesting. I tried Wipr on macOS Safari for a couple weeks about a year ago, and there was effectively no ad blocking on YouTube, Twitch, or Twitter, which is coincidentally where I spend the bulk of my time. It was a frustrating experience, I've tried Safari multiple times over the years since it is so much better on battery life, but Chrome always wins in usability and adblocking. I switched back to Chrome + uBlock Origin and could use those sites ad-free again. Well, except for Twitch, since they found a workaround for adblockers last year.
- freediver 5y ago
  Sounds like you would be interested in Orion. https://browser.kagi.com https://browser.kagi.com

shawnz 5y ago

This is basically the exact fear which was being expressed by users when Google announced that they would require Chrome extensions to only use declarative content blocking starting with Manifest v3 (which anecdotally convinced me to switch to Firefox).

defaultname 5y ago
If we go down that road, however, sites can make ads completely indistinguishable from desired content. Same domain, same stream, no easily marked container. All of the imperative adblocking tech in the world, short of queuing everything through a neural engine post render, can block what is possible. So there has always been a detente between adblockers and publishers, presuming the former hit a small enough set of users that it was just ignored. It seems that is no longer the case.
- _Algernon_ 5y ago
  That would require delivering ads from first-party servers, right? So third-party ad and tracking networks would die a painful death.
  - qlm 5y ago
    Couldn't they just be proxied through a first party server?
    - _Algernon_ 5y ago
      That would be more effort than including a single html-script tag to import google analytics. I have hope that most parties would decide that the extra server load and difficulties would make it not worth it.
      - nimish 5y ago
        You underestimate the desire for precision tracking, unfortunately. Hiding behind custom subdomains is common. Stepping up to cloaking it to be delivered from the application is more effort but it'll happen.

deleted 5y ago

[deleted]

acdha 5y ago

I think you’re right from the short-term perspective but largely irrelevant long-term. If Safari allowed arbitrary code execution, it’d be a little better for as long as it took publishers to deploy first-party ad injection. We’d still get the security problems, though. You can already see what that’s like with podcasts where local ads are spliced right into the audio file. You’re not stopping that short of doing something like buffering the content and running it through an AI, and if that became widespread we’d just see more embedded placement (“Hey, protagonist, why are you so irresistibly sexy?” “It’s these new briefs from My Undies”). Adtech is a multi billion dollar industry and the people making the content you want are enthusiastically supporting them. This is not a problem which technical tricks can solve – as soon as you do something effective, Google can deploy hundreds of engineers with huge resource budgets to foil you. That won’t change without something like regulatory changes to lower the financial pressure.

lern_too_spel 5y ago
If I can recognize an ad, I can construct JavaScript that can recognize that ad too. The current extension APIs let me inject that JavaScript, while the declarative ad blocking APIs do not.
- acdha 5y ago
  This is a constant arms race, as anyone who’s looked at Facebook’s DOM knows, and if you’re successful it pushes to the end state I mentioned of ads becoming very similar to the content. The companies which depend on ad revenue aren’t going to go out of business voluntarily and many of them will find alternative paths to those ad dollars.
fomine3 5y ago
It's cat and mouse game, but currently ad blockers win all battles.
kibwen 5y ago
> if that became widespread we’d just see more embedded placement Which is completely desirable. The problem isn't "ads", it's "targeted, personalized ads that rely on thoroughly destroying the the privacy of everyone on the internet in order to function". If a show/podcast wants to vet its own advertisers and endorse a specific product, that's great; it establishes a concrete relationship with the advertisers that has more value to both users and content creators than the anonymous, unvettable system of opaque middlemen currently peddled by targeted ad networks.