24 ms·

Sirubo: Packet filtering to block Google and Facebook tracking

253 points by signa11 5y ago

chovybizzass 5y ago
Can I use this on my routers?
dang-guefever 5y ago
As someone with more time, I prefer to maintain a massive whitelist for my router. Daily websites receive permanent privileges, incidental websites (such as peguero.xyz) receive temporary privileges (e.g. allow traffic for the next minute), everything else is dropped. I don't have to worry about what chicanery advertising companies are up to when they can't reach me even if they tried. "So the fourth herd of deer took up residence where the poison-grass sower & his followers couldn’t go and—having taken up residence there—ate food without venturing unwarily into the poison-grass sown by the poison-grass sower. By eating food without venturing unwarily into the poison-grass sown by the poison-grass sower, they didn’t become intoxicated. Not being intoxicated, they didn’t become heedless. When they weren’t heedless, the poison-grass sower wasn’t able to do with them as he liked on account of that poison-grass."
- MrWiffles 5y ago
  I have no idea where that literary quote is from but it’s pertinent here. In related news, what software or tools do you use to manage that whitelist? I’ve been considering stunting similar.
  - danuker 5y ago
    Not OP, but I am using uBlock Origin. Here's how I do it: https://danuker.go.ro/how-to-protect-your-personal-data.html#what-you-can-do-as-a-user https://danuker.go.ro/how-to-protect-your-personal-data.html...
- omnicognate 5y ago
  How do you implement that? I have a whitelisting transparent proxy for my kids (contrary to the popular meme around here that all kids are NSA grade hackers determined to defy your every attempt to protect them, it's uncontroversial in my house and works very well). I use squid for that and have a shonky web UI I made to access the logs and update the whitelist acl. I'd like to make it more capable (stuff like temporary unblock like you mention). AFAICT the only way to do such things is writing a squid "helper" that runs as a separate process (/processes). Is that what you're doing?
  - dang-guefever 5y ago
    I use adblock on openwrt with a basic script to write to and revert the whitelist, and to restart dnsmasq. I use qutebrowser and made whitelisting a hints shortcut. There's almost certainly a better system, but this works for me.
- shepik 5y ago
  Honest question: is it worth it? Why would you spend your time on managing that temporary white list? Do you think that time is wasted, or not? (I apologize if my phrasing is a bit rude, but i'm really curious about that, and want to understand your thinking)
  - samhw 5y ago
    I think people like this see it as a 'win' – as if they, John Smith, have beaten the dastardly BigCorp. Whereas, in fact, the most that happens is a Junior Marketing Executive at BigCorp says "Right, that guy falls within the 0.5% of techy customers who make things difficult for us. Ah well, it's only been 80,000 of them, well within our margin for this month."
    - samstave 5y ago
      True - however, IMO, the value is in the awareness of tracking and the knowledge of how to block things as such. Its better to know how your network operates that you rely on for your daily life than to know nothing about its internals. My biggest issue as I age is that I FORGET how to do some of the higher level networking that I used to know innately - and I also lose interest in doing such things and become lazy, complacent, and as I forget things, more and more ignorant to it all... Take PC Gaming as an example, or server rebuilds. I could build SUN 650s and many many PC based servers with a blindfold on. I grew up gaming and ran Intel's Game Development Lab for some time and was super knowledgable about all things PC/PCGaming when I had the lastest and best hardware literally delivered to me every day at intel... Now I don't knwo shit about 'PCMasterRace' and building these days....
      - samhw 5y ago
        The issue is that people like this fetishise avoiding tracking. It doesn't seem like they have a clear reason why they want to avoid tracking. Do they have sensitive data to hide? Do they ideologically disagree with large companies gathering data? Is it anything else? It honestly doesn't seem like it. It seems more like "stopping them from getting my data" is treated as an end unto itself.
- chaz6 5y ago
  Do you use an SSL proxy to catch unwanted requests to CDN's like Cloudflare that would otherwise be allowed?
- luckydata 5y ago
  seems like an enormous amount of effort for essentially no benefit.
dr-detroit 5y ago
Its factually incorrect that Facebook is an advertising company. They are a sex-app turned surveillance company started up by the CIA this has been extensively reported on by ABC news.
ocdtrekkie 5y ago
I would love to block their autonomous systems entirely this way, but I fear that for Google it would be impossible without significant impact to my life. Frustratingly, Google is also the hosting provider for a massive number of critical services. Consider that for many households today, you cannot block Google without also blocking your kid's homework, as Google Classroom has been made a mandatory part of a large portion of schools.
filchermcurr 5y ago
I've been using a similar technique found here[1] in macOS and it's very effective! The only issue I've had is I always have to redo it after an update. Admittedly I never did much research into why or if that could be overcome... clearly a macOS thing. Pretty cool. [1]: https://www.perpetual-beta.org/weblog/blocking-facebook-on-os-x.html https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...
marketingtech 5y ago
This is cool, but not super useful in 2021. Google and Facebook have already moved their tracking technologies beyond frontend network calls due to a rise in browser-level blocking (browser security policies, international regulations, AdBlock, PiHole, etc). The next generation of tracking tech relies on the backend transfer of data between a website and the ad platform, which is invisible to your own network. It also shifts the story from "Google and Facebook nonconsensually tracking your every digital move through websites and applications" as described in the article into "websites and applications actively transmitting customer data to Google and Facebook." The websites and applications are no longer passive partners, and they assume the responsibility of managing user consent.
- blakesterz 5y ago
  > The next generation of tracking tech relies on the backend transfer of server logs between a website and the ad platform, which is invisible to your own network I've not heard of this, what sites are giving logs to networks?
  - georgyo 5y ago
    Shipping logs would be an extreme breach in my mind. But I can BS. Without a cross site unique identifier, the logs would not be usable across different sites... Though... I guess a browser fingerprint could be used as a non-centralized method to generate that unique key...
    - reaperducer 5y ago
      Login name, email address, credit card number. Lots of ways for companies to get together like this to follow you around the web and apps. All invisibly. And you'd never know it.
      - willvarfar 5y ago
        Matching up is called “entity resolution” and reminds me of this recent showHN https://news.ycombinator.com/item?id=28127650 https://news.ycombinator.com/item?id=28127650
seqizz 5y ago
Good idea. I wonder when they'll start using a backup ASN from a subsidiary.
Radim 5y ago
I applaud the effort (Boston FTW!). But what can we do to treat the cause, instead of just the symptoms? Stopping big-tech's tracking is cool, but strictly inferior to removing their incentive to track you. How to do that? The ads are valuable for a reason – they work. If they stop working (or rather work less – it's a spectrum), then the collected data becomes just impotent bits filling up some HDD somewhere. I feel the fix will be more along the lines of improving individual psychology and mental wellbeing, rather than entering the arms race of adversarial technology to block packet traffic (or whatever).
- contravariant 5y ago
  The tricky bit here is that advertisers don't need their ads to work, they just need to convince their customers they do. Even if there are reasons to question the metrics used to measure effectiveness (see e.g. [1]) this is all meaningless if ad companies still succeed in convincing people they are selling something of value. Which ironically does mean that one way or another advertising companies are good at advertising something it just might not be the thing they're getting paid for. [1]: https://thecorrespondent.com/100/the-new-dot-com-bubble-is-here-its-called-online-advertising https://thecorrespondent.com/100/the-new-dot-com-bubble-is-h... [1, hn]: https://news.ycombinator.com/item?id=21465873 https://news.ycombinator.com/item?id=21465873
  - bookofjoe 5y ago
    I am reminded of Keynes' remark: "The secret of success in the stock market is not predicting which stocks will increase in value, but rather identifying stocks a majority of people think will increase in value."
  - Radim 5y ago
    This is a good point, and thanks for the links. Sometimes it does feel like gimmicks all the way down. So much of the "digital market economy" is about generating demand, as opposed to answering demand. Conservatively, I'm in favour of serving people's existing needs rather than making them anxious of FOMO something new. But I can see how demand-generation is more profitable: if you get to define what "useful" or "desirable" means, you're gold. "Competition is for losers." But I see the solution as essentially the same: education and mental resilience. To move the needle back to personal agency, do the "malicious packet blocking" internally, rather than ex-post with technology.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
Road001 5y ago
http://www.roadrunner.support/ http://www.roadrunner.support/ Roadrunner Support Number we play a very important role in delecering cost-effective soluations to the customers
Road001 5y ago
Roadrunner Support Number we play a very important role in delecering cost-effective soluations to the customers. http://www.roadrunner.support/ http://www.roadrunner.support/
Yetino 5y ago
I have just started to learn differential privacy (https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy), and am wondering if the following might be feasible in principle: on the browser level, instead of blocking the trackers, add a certain level of noise to the submitted data. This might form a truce between the end users and the trackers. Through statistics, the trackers might still be able to learn something about the end user group as a population; at the same time, each individual user's privacy isn't breached much more than they are completely offline. Admittedly this might be ridiculous and is just me under Dunning–Kruger effect as a beginner in this field.
- dang-guefever 5y ago
  https://github.com/dhowe/AdNauseam https://github.com/dhowe/AdNauseam
rubynerd 5y ago
Does this not also prevent you from connecting to anything hosted on Google Cloud Platform? I would imagine Spotify access would be heavily affected by such a block, considering their sizeable GCP deployments.
falcolas 5y ago
A somewhat more simplistic method is the hosts file. It won't stop hard-coded IPs, but it still works pretty well in my experience. https://someonewhocares.org/hosts/hosts https://someonewhocares.org/hosts/hosts
- blacksmith_tb 5y ago
  Hmm, not sure how that would work if some-merchant.com is sending logs of your browsing to FB or GOOG? You likely don't want to block the shop you're browsing (though maybe you'd leave abd shop on a different site if you knew...). I don't see how ublock, hostfile adblocking/filtering or DNS adblocking/filtering could help, really.
literallyaduck 5y ago
Work with your state government to outlaw even consensual tracking, include fines, and make fines also apply to the development staff. The first a step is a "know your developer" act to prevent software creation being anonymous. We have regulation around who can practice medicine, practice law, provide the same regulations to software. Remove the license for developers, business analysts, tech writers and project managers who write code to support tracking. It is easy to write evil code when your are protected by behemoth corporations and their lawyers.
- 3np 5y ago
  Code is speech. Your proposed law sounds more draconian and dangerous to free thought than the thing it’s supposed to prevent, and can be abused to have the opposite effect of what your intentions are. We need more general technical literacy, not further increasing the gap between those who have and know between those who don’t. Regulation around tracking, fine, but the consequences seem to far outweigh any benefits with the rest of your proposal.
  - deleted 5y ago
    [deleted]
useful 5y ago
It would be nice if there was an effort that pulled the public/prviate keys hidden in the binaries of apps like facebook/google and decrypted the traffic for inspection/blocking. Rewriting would be nice but everything seems to be certificate pinned now. Can an app just use the CT logs? I'm a little out of my depth on this topic.
- gnu8 5y ago
  How does certificate pinning work on corporate networks where all of the clients have a certificate from the local root CA installed and a proxy server examines all encrypted traffic? Presumably that doesn’t break Facebook so maybe there is a loophole there.
taftster 5y ago
I wish the ad industry (especially web) would just break and just completely fall over. Sure, we'd have this period of time where the world would feel like it's on fire. All your "news sources" (air-quotes) would disappear and everyone would be lost for a bit. But then, innovation would happen. And the original web would re-emerge. And all the good things that we pine about for the old days of tech would return. People would pay for good news again or maybe Jethro would create the website he's been dreaming about. Sure the stock market would probably collapse. And we'd probably have another great depression. But I sure think the world would be a better place after all the dust settled.

253 points by signa11 5y ago

Can I use this on my routers?

As someone with more time, I prefer to maintain a massive whitelist for my router. Daily websites receive permanent privileges, incidental websites (such as peguero.xyz) receive temporary privileges (e.g. allow traffic for the next minute), everything else is dropped. I don't have to worry about what chicanery advertising companies are up to when they can't reach me even if they tried. "So the fourth herd of deer took up residence where the poison-grass sower & his followers couldn’t go and—having taken up residence there—ate food without venturing unwarily into the poison-grass sown by the poison-grass sower. By eating food without venturing unwarily into the poison-grass sown by the poison-grass sower, they didn’t become intoxicated. Not being intoxicated, they didn’t become heedless. When they weren’t heedless, the poison-grass sower wasn’t able to do with them as he liked on account of that poison-grass."

MrWiffles 5y ago
I have no idea where that literary quote is from but it’s pertinent here. In related news, what software or tools do you use to manage that whitelist? I’ve been considering stunting similar.
- danuker 5y ago
  Not OP, but I am using uBlock Origin. Here's how I do it: https://danuker.go.ro/how-to-protect-your-personal-data.html#what-you-can-do-as-a-user https://danuker.go.ro/how-to-protect-your-personal-data.html...
omnicognate 5y ago
How do you implement that? I have a whitelisting transparent proxy for my kids (contrary to the popular meme around here that all kids are NSA grade hackers determined to defy your every attempt to protect them, it's uncontroversial in my house and works very well). I use squid for that and have a shonky web UI I made to access the logs and update the whitelist acl. I'd like to make it more capable (stuff like temporary unblock like you mention). AFAICT the only way to do such things is writing a squid "helper" that runs as a separate process (/processes). Is that what you're doing?
- dang-guefever 5y ago
  I use adblock on openwrt with a basic script to write to and revert the whitelist, and to restart dnsmasq. I use qutebrowser and made whitelisting a hints shortcut. There's almost certainly a better system, but this works for me.
shepik 5y ago
Honest question: is it worth it? Why would you spend your time on managing that temporary white list? Do you think that time is wasted, or not? (I apologize if my phrasing is a bit rude, but i'm really curious about that, and want to understand your thinking)
- samhw 5y ago
  I think people like this see it as a 'win' – as if they, John Smith, have beaten the dastardly BigCorp. Whereas, in fact, the most that happens is a Junior Marketing Executive at BigCorp says "Right, that guy falls within the 0.5% of techy customers who make things difficult for us. Ah well, it's only been 80,000 of them, well within our margin for this month."
  - samstave 5y ago
    True - however, IMO, the value is in the awareness of tracking and the knowledge of how to block things as such. Its better to know how your network operates that you rely on for your daily life than to know nothing about its internals. My biggest issue as I age is that I FORGET how to do some of the higher level networking that I used to know innately - and I also lose interest in doing such things and become lazy, complacent, and as I forget things, more and more ignorant to it all... Take PC Gaming as an example, or server rebuilds. I could build SUN 650s and many many PC based servers with a blindfold on. I grew up gaming and ran Intel's Game Development Lab for some time and was super knowledgable about all things PC/PCGaming when I had the lastest and best hardware literally delivered to me every day at intel... Now I don't knwo shit about 'PCMasterRace' and building these days....
    - samhw 5y ago
      The issue is that people like this fetishise avoiding tracking. It doesn't seem like they have a clear reason why they want to avoid tracking. Do they have sensitive data to hide? Do they ideologically disagree with large companies gathering data? Is it anything else? It honestly doesn't seem like it. It seems more like "stopping them from getting my data" is treated as an end unto itself.
chaz6 5y ago
Do you use an SSL proxy to catch unwanted requests to CDN's like Cloudflare that would otherwise be allowed?
luckydata 5y ago
seems like an enormous amount of effort for essentially no benefit.

dr-detroit 5y ago

Its factually incorrect that Facebook is an advertising company. They are a sex-app turned surveillance company started up by the CIA this has been extensively reported on by ABC news.

ocdtrekkie 5y ago

I would love to block their autonomous systems entirely this way, but I fear that for Google it would be impossible without significant impact to my life. Frustratingly, Google is also the hosting provider for a massive number of critical services. Consider that for many households today, you cannot block Google without also blocking your kid's homework, as Google Classroom has been made a mandatory part of a large portion of schools.

filchermcurr 5y ago

I've been using a similar technique found here[1] in macOS and it's very effective! The only issue I've had is I always have to redo it after an update. Admittedly I never did much research into why or if that could be overcome... clearly a macOS thing. Pretty cool. [1]: https://www.perpetual-beta.org/weblog/blocking-facebook-on-os-x.html https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...

marketingtech 5y ago

This is cool, but not super useful in 2021. Google and Facebook have already moved their tracking technologies beyond frontend network calls due to a rise in browser-level blocking (browser security policies, international regulations, AdBlock, PiHole, etc). The next generation of tracking tech relies on the backend transfer of data between a website and the ad platform, which is invisible to your own network. It also shifts the story from "Google and Facebook nonconsensually tracking your every digital move through websites and applications" as described in the article into "websites and applications actively transmitting customer data to Google and Facebook." The websites and applications are no longer passive partners, and they assume the responsibility of managing user consent.

blakesterz 5y ago
> The next generation of tracking tech relies on the backend transfer of server logs between a website and the ad platform, which is invisible to your own network I've not heard of this, what sites are giving logs to networks?
- georgyo 5y ago
  Shipping logs would be an extreme breach in my mind. But I can BS. Without a cross site unique identifier, the logs would not be usable across different sites... Though... I guess a browser fingerprint could be used as a non-centralized method to generate that unique key...
  - reaperducer 5y ago
    Login name, email address, credit card number. Lots of ways for companies to get together like this to follow you around the web and apps. All invisibly. And you'd never know it.
    - willvarfar 5y ago
      Matching up is called “entity resolution” and reminds me of this recent showHN https://news.ycombinator.com/item?id=28127650 https://news.ycombinator.com/item?id=28127650

seqizz 5y ago

Good idea. I wonder when they'll start using a backup ASN from a subsidiary.

Radim 5y ago

I applaud the effort (Boston FTW!). But what can we do to treat the cause, instead of just the symptoms? Stopping big-tech's tracking is cool, but strictly inferior to removing their incentive to track you. How to do that? The ads are valuable for a reason – they work. If they stop working (or rather work less – it's a spectrum), then the collected data becomes just impotent bits filling up some HDD somewhere. I feel the fix will be more along the lines of improving individual psychology and mental wellbeing, rather than entering the arms race of adversarial technology to block packet traffic (or whatever).

contravariant 5y ago
The tricky bit here is that advertisers don't need their ads to work, they just need to convince their customers they do. Even if there are reasons to question the metrics used to measure effectiveness (see e.g. [1]) this is all meaningless if ad companies still succeed in convincing people they are selling something of value. Which ironically does mean that one way or another advertising companies are good at advertising something it just might not be the thing they're getting paid for. [1]: https://thecorrespondent.com/100/the-new-dot-com-bubble-is-here-its-called-online-advertising https://thecorrespondent.com/100/the-new-dot-com-bubble-is-h... [1, hn]: https://news.ycombinator.com/item?id=21465873 https://news.ycombinator.com/item?id=21465873
- bookofjoe 5y ago
  I am reminded of Keynes' remark: "The secret of success in the stock market is not predicting which stocks will increase in value, but rather identifying stocks a majority of people think will increase in value."
- Radim 5y ago
  This is a good point, and thanks for the links. Sometimes it does feel like gimmicks all the way down. So much of the "digital market economy" is about generating demand, as opposed to answering demand. Conservatively, I'm in favour of serving people's existing needs rather than making them anxious of FOMO something new. But I can see how demand-generation is more profitable: if you get to define what "useful" or "desirable" means, you're gold. "Competition is for losers." But I see the solution as essentially the same: education and mental resilience. To move the needle back to personal agency, do the "malicious packet blocking" internally, rather than ex-post with technology.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

Road001 5y ago

http://www.roadrunner.support/ http://www.roadrunner.support/ Roadrunner Support Number we play a very important role in delecering cost-effective soluations to the customers

Road001 5y ago

Roadrunner Support Number we play a very important role in delecering cost-effective soluations to the customers. http://www.roadrunner.support/ http://www.roadrunner.support/

Yetino 5y ago

I have just started to learn differential privacy (https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy), and am wondering if the following might be feasible in principle: on the browser level, instead of blocking the trackers, add a certain level of noise to the submitted data. This might form a truce between the end users and the trackers. Through statistics, the trackers might still be able to learn something about the end user group as a population; at the same time, each individual user's privacy isn't breached much more than they are completely offline. Admittedly this might be ridiculous and is just me under Dunning–Kruger effect as a beginner in this field.

dang-guefever 5y ago
https://github.com/dhowe/AdNauseam https://github.com/dhowe/AdNauseam

rubynerd 5y ago

Does this not also prevent you from connecting to anything hosted on Google Cloud Platform? I would imagine Spotify access would be heavily affected by such a block, considering their sizeable GCP deployments.

falcolas 5y ago

A somewhat more simplistic method is the hosts file. It won't stop hard-coded IPs, but it still works pretty well in my experience. https://someonewhocares.org/hosts/hosts https://someonewhocares.org/hosts/hosts

blacksmith_tb 5y ago
Hmm, not sure how that would work if some-merchant.com is sending logs of your browsing to FB or GOOG? You likely don't want to block the shop you're browsing (though maybe you'd leave abd shop on a different site if you knew...). I don't see how ublock, hostfile adblocking/filtering or DNS adblocking/filtering could help, really.

literallyaduck 5y ago

Work with your state government to outlaw even consensual tracking, include fines, and make fines also apply to the development staff. The first a step is a "know your developer" act to prevent software creation being anonymous. We have regulation around who can practice medicine, practice law, provide the same regulations to software. Remove the license for developers, business analysts, tech writers and project managers who write code to support tracking. It is easy to write evil code when your are protected by behemoth corporations and their lawyers.

3np 5y ago
Code is speech. Your proposed law sounds more draconian and dangerous to free thought than the thing it’s supposed to prevent, and can be abused to have the opposite effect of what your intentions are. We need more general technical literacy, not further increasing the gap between those who have and know between those who don’t. Regulation around tracking, fine, but the consequences seem to far outweigh any benefits with the rest of your proposal.
- deleted 5y ago
  [deleted]

useful 5y ago

It would be nice if there was an effort that pulled the public/prviate keys hidden in the binaries of apps like facebook/google and decrypted the traffic for inspection/blocking. Rewriting would be nice but everything seems to be certificate pinned now. Can an app just use the CT logs? I'm a little out of my depth on this topic.

gnu8 5y ago
How does certificate pinning work on corporate networks where all of the clients have a certificate from the local root CA installed and a proxy server examines all encrypted traffic? Presumably that doesn’t break Facebook so maybe there is a loophole there.

taftster 5y ago

I wish the ad industry (especially web) would just break and just completely fall over. Sure, we'd have this period of time where the world would feel like it's on fire. All your "news sources" (air-quotes) would disappear and everyone would be lost for a bit. But then, innovation would happen. And the original web would re-emerge. And all the good things that we pine about for the old days of tech would return. People would pay for good news again or maybe Jethro would create the website he's been dreaming about. Sure the stock market would probably collapse. And we'd probably have another great depression. But I sure think the world would be a better place after all the dust settled.