9 ms·

Reddit uses “reddit.com” itself as the endpoint for logging usage data

77 points by decrypt 5y ago

skizm 5y ago
Probably the norm going forward to thwart ad-blockers. Also ads will most likely be generated server-side and served from the main domain in the future. I'm surprised this hasn't happened already TBH. I guess the ad-networks like their JS on user's pages enough to slow the progress?
- SteveNuts 5y ago
  They probably just don't trust their customers enough to let them serve all the content and not fudge the numbers
  - OJFord 5y ago
    It's literally just 'reddit.com' though, surely if that were the case (not that you didn't want people to block it) you would use `/metrics` or whatever path.
- oddevan 5y ago
  Isn't that the goal, though? The best arguments I've heard for casual ad-blocking is that you can't trust the code running through ad networks. If we take the ad networks out of the equation (first-party analytics and ads), I'm much more okay with that.
  - sokoloff 5y ago
    I suspect many of these become “first party domain hosting a proxy [or using CDN config] which serves the same third-party code as today” which is no more trustworthy in practice though some users might feel better about it.
  - chadlavi 5y ago
    I also just don't want to see annoying fucking ads.
    - hyperbovine 5y ago
      The future of adblocking is an AI-based system that detects already loaded ads visually and simply masks them from you on the client side. Such an approach (sans AI) has been used in the past, but it fell out of favor due to bandwidth and CPU usage concerns. Since then, bandwidth and computing power have grown exponentially, such that the disincentive of the load-and-hide approach will continue to diminish over time.
      - vmception 5y ago
        By “orders of magnitude” not exponentially Say it with me so we can normalize this usage
        waterhouse 5y ago
        There are plenty of people who misuse the word "exponential", but in this case, assuming much of the period in question was during Moore's Law growth, "doubling every N months for many years on end" is genuinely exponential.
        vmception 5y ago
        At higher numbers it is very hard for any whole number exponent >1 to be reached In any case what year was AI adblock attempted so we can check if this is one of the narrow use cases where exponential performance improvements occurred within computing “Orders of magnitude” will be more frequently correct and also include “exponential”, whereas “exponential” will be less frequently correct
        netr0ute 5y ago
        > not exponentially We don't know that the growth was n^x and not x^n.
  - m-p-3 5y ago
    The ad networks will likely provide a framework to serve and cache those on the first-party server, so you'll probably see the same level of untrustworthiness in the code.
  - matheusmoreira 5y ago
    Those networks will still be there. Their ads will simply be proxied through first party servers. Nothing wrong with simply not wanting to see ads either. They're noise, to be filtered out.
- doliveira 5y ago
  Much easier for the marketing team to add another analytics script via Tag Manager than it is to go through the process of adding it server-side
  - rohansingh 5y ago
    They're one step ahead of you: https://developers.google.com/tag-manager/serverside https://developers.google.com/tag-manager/serverside
- omegalulw 5y ago
  Why would ad blockers just not block reddit.com on non Reddit sites if Reddit were to start a tracking ad platform?
  - carl_dr 5y ago
    He meant first-party tracking. Reddit aren’t doing that.
- patrakov 5y ago
  Of course it did happen already. Look at this site with card games and patiences, and try to block ads: https://razlozhi.ru/patience-spider2 https://razlozhi.ru/patience-spider2 And no, these are not their own ads, they proxy the requests from their own domain to the Yandex Direct ad network. Even worse, there is some evil javascript that tries even different non-sensical HTML element names to try to get past the blockers.
  - mdre 5y ago
    I see no ads on my Firefox with ublock and privacybadger ¯\_(ツ)_/¯
  - echelon 5y ago
    The future of ad blocking is a neural network ad detector that can detect ads, classify them, and replace them with anti-ads for the same products. McDonald's ad? Replace it with a McD's Roach Sandwich ad. Facebook ad? Replace it with "Zuck causes Genocide". We can fight back.
  - usefulcat 5y ago
    I see no ads on that page. Using an 'ad-blocking' DNS.
  - KronisLV 5y ago
    Firefox + uBlock Origin here. Visible impact on page: empty right sidebar Blocked requests: - https://mc.yandex.ru/metrika/watch.js - https://counter.yadro.ru/hit?unique_data_here - https://yandex.ru/ads/system/context.js Actually, it makes me wonder what's keeping these companies that want to serve ads generate JS dynamically server side and include the code for ads in the same file as the main application logic. Then, when you'd block the entire file from downloading because of it containing ad logic, the site would break, so viewing ads would be required to use the functionality. I do feel thankful that toolchains like that don't seem to be in widespread use yet.
    - patrakov 5y ago
      Refresh a few times. The page does not serve the same ad scripts every time.
- spansoa 5y ago
  > ads will most likely be generated server-side and served from the main domain in the future Well one thing webmasters can do is place wrap an image in an <A> element and the URL is some affiliate link that they control. Good luck blocking that since the image is the first party domain. It's a tactic I've been using for years now, and I've gotten thousands of referrals and confirmed purchases of products.
  - nobody9999 5y ago
    >It's a tactic I've been using for years now, and I've gotten thousands of referrals and confirmed purchases of products. What website(s) do you run so I can make sure never to visit them?
  - tomjen3 5y ago
    That would as a minimum not slow anybody down much, it won't contain JS, both of which are an advantage. Of course, my adblocker will still block it, using the block element feature (also useful with nag bars etc).
- mook 5y ago
  > Probably the norm going forward to thwart ad-blockers. Also ads will most likely be generated server-side and served from the main domain in the future. That sounds great to me; it means getting cross-domain tracking to work would be much harder. Hopefully that means we'll also get ads that are actually relevant to the page instead of random unrelated stuff.
  - iratewizard 5y ago
    With how I've seen ad tech evolve so far, I am sure they would include cross-domain tracking in their payloads and you would need to turn it off via a good ad blocker.
  - theshadowknows 5y ago
    Until companies begin just sharing specific parts of their server side logging. I can see a future where all the tracking happens in a fully server-side network of companies just sharing data back and forth or between a central database.
- volker48 5y ago
  It is easier to do a complete block of an ad serving domain, but in terms of ad blockers it doesn't really matter if the ad is coming from the front or back end. The ad blocker can remove the content on the page holding the ad based on some CSS selectors.
BoysenberryPi 5y ago
I use teddit and have generally refused to use reddit ever since they made the mobile experience unusable with the constant "Please download our shitty app" screens. https://teddit.net/ https://teddit.net/
- darthvoldemort 5y ago
  old.reddit.com
- tomjen3 5y ago
  i.reddit.com for the mobile experience. Bonus is it looks like iOS 6.
mseepgood 5y ago
The last sentence seems to be speculation.
calrueb 5y ago
I'd be curious to hear from someone that feels strongly about blocking first-party front end tracking. I generally assume that whatever website I am on would have a good sense of what I am up to just based on server side logs. Sure, if I block 1p logging they might not have a down to the second understanding of how long I am impressing on something, but overall I feel the point is moot.
- hn_throwaway_99 5y ago
  Yeah, this take on "I also try to block first party tracking" is just weird in my opinion, or at least impossible (beyond just normal cookie blocking tools). The ways most sites utilize AJAX and JS, there is just no consistent way to block "tracking calls" vs. blocking requests needed for particular pieces of functionality and data.
  - forgotmypw17 5y ago
    Exactly, there is a lot of trust involved, even without executing JavaScript, but especially when so. This is why I stay away from sites I don't find trustworthy. I also close the tab if I'm presented with a paywall, a modal newsletter subscription prompt, impossible cookie banners, etc. I think of it as a "the medium is the message" type of thing, and if the medium is tainted then the message can't be any better, so why read it?
  - matheusmoreira 5y ago
    > there is just no consistent way to block "tracking calls" vs. blocking requests needed for particular pieces of functionality and data At some point, browsers will gain firewalls and packet inspection and filtering capabilities. We should be able to inspect the data sites are sending and receiving asynchronously via Javascript. We should be able to automatically delete or redact private information from JSON payloads. What if uBlock Origin could automatically anonymize unique identifiers that some Javascript code is trying to exfiltrate?
    - abestic9 5y ago
tbeseda 5y ago
I guess I'm surprised anyone is surprised by this. Using a third party for analytics is only a convenience. Given enough effort, any system can build in their own analytics. It's probably just a proxy to something like Segment.
- amerkhalid 5y ago
  Yeah I am old enough to remember setting up various analytics tools in early 2000s. Most people ran them on subdomains but some ran them in on same domain. Also we had tons of server-side tools like webalyzer.
  - tbeseda 5y ago
    Back when we were trying to do smart things with Apache logs. And so when JS was prevalent enough and Google (+ others) started handing out snippets to get great macro data about visitors, we were all about it. It wasn't until that data became intricate user interactions that were bought and sold, did we worry. edit: So I guess that gets to where my surprise comes from. I expect first parties to gather all kinds of info about how I use their service. It's even fine. I literally signed up for it. The next step is to examine the TOS (in this case: Reddit) and see what I agreed they're allowed to then do with that data. ie. sell it so others can sell to me.
  - leetrout 5y ago
    Not even that long ago. I've used Piwik / Matamo at a couple places in the past 5 years. Honestly a lot of analytics for an app can be done serverside and client side is just icing on the cake to make the data richer.
gruez 5y ago
They were doing this for a while now. eg. https://web.archive.org/web/20181220022532/https://www.reddit.com/r/stopadvertising/comments/87d1sq/psa_reddit_has_enhanced_their_tracking_they_now/ https://web.archive.org/web/20181220022532/https://www.reddi... from a few years ago

77 points by decrypt 5y ago

Probably the norm going forward to thwart ad-blockers. Also ads will most likely be generated server-side and served from the main domain in the future. I'm surprised this hasn't happened already TBH. I guess the ad-networks like their JS on user's pages enough to slow the progress?

SteveNuts 5y ago
They probably just don't trust their customers enough to let them serve all the content and not fudge the numbers
- OJFord 5y ago
  It's literally just 'reddit.com' though, surely if that were the case (not that you didn't want people to block it) you would use `/metrics` or whatever path.
oddevan 5y ago
Isn't that the goal, though? The best arguments I've heard for casual ad-blocking is that you can't trust the code running through ad networks. If we take the ad networks out of the equation (first-party analytics and ads), I'm much more okay with that.
- sokoloff 5y ago
  I suspect many of these become “first party domain hosting a proxy [or using CDN config] which serves the same third-party code as today” which is no more trustworthy in practice though some users might feel better about it.
- chadlavi 5y ago
  I also just don't want to see annoying fucking ads.
  - hyperbovine 5y ago
    The future of adblocking is an AI-based system that detects already loaded ads visually and simply masks them from you on the client side. Such an approach (sans AI) has been used in the past, but it fell out of favor due to bandwidth and CPU usage concerns. Since then, bandwidth and computing power have grown exponentially, such that the disincentive of the load-and-hide approach will continue to diminish over time.
    - vmception 5y ago
      By “orders of magnitude” not exponentially Say it with me so we can normalize this usage
      - waterhouse 5y ago
        There are plenty of people who misuse the word "exponential", but in this case, assuming much of the period in question was during Moore's Law growth, "doubling every N months for many years on end" is genuinely exponential.
        vmception 5y ago
        At higher numbers it is very hard for any whole number exponent >1 to be reached In any case what year was AI adblock attempted so we can check if this is one of the narrow use cases where exponential performance improvements occurred within computing “Orders of magnitude” will be more frequently correct and also include “exponential”, whereas “exponential” will be less frequently correct
      - netr0ute 5y ago
        > not exponentially We don't know that the growth was n^x and not x^n.
- m-p-3 5y ago
  The ad networks will likely provide a framework to serve and cache those on the first-party server, so you'll probably see the same level of untrustworthiness in the code.
- matheusmoreira 5y ago
  Those networks will still be there. Their ads will simply be proxied through first party servers. Nothing wrong with simply not wanting to see ads either. They're noise, to be filtered out.
doliveira 5y ago
Much easier for the marketing team to add another analytics script via Tag Manager than it is to go through the process of adding it server-side
- rohansingh 5y ago
  They're one step ahead of you: https://developers.google.com/tag-manager/serverside https://developers.google.com/tag-manager/serverside
omegalulw 5y ago
Why would ad blockers just not block reddit.com on non Reddit sites if Reddit were to start a tracking ad platform?
- carl_dr 5y ago
  He meant first-party tracking. Reddit aren’t doing that.
patrakov 5y ago
Of course it did happen already. Look at this site with card games and patiences, and try to block ads: https://razlozhi.ru/patience-spider2 https://razlozhi.ru/patience-spider2 And no, these are not their own ads, they proxy the requests from their own domain to the Yandex Direct ad network. Even worse, there is some evil javascript that tries even different non-sensical HTML element names to try to get past the blockers.
- mdre 5y ago
  I see no ads on my Firefox with ublock and privacybadger ¯\_(ツ)_/¯
- echelon 5y ago
  The future of ad blocking is a neural network ad detector that can detect ads, classify them, and replace them with anti-ads for the same products. McDonald's ad? Replace it with a McD's Roach Sandwich ad. Facebook ad? Replace it with "Zuck causes Genocide". We can fight back.
- usefulcat 5y ago
  I see no ads on that page. Using an 'ad-blocking' DNS.
- KronisLV 5y ago
  Firefox + uBlock Origin here. Visible impact on page: empty right sidebar Blocked requests: - https://mc.yandex.ru/metrika/watch.js - https://counter.yadro.ru/hit?unique_data_here - https://yandex.ru/ads/system/context.js Actually, it makes me wonder what's keeping these companies that want to serve ads generate JS dynamically server side and include the code for ads in the same file as the main application logic. Then, when you'd block the entire file from downloading because of it containing ad logic, the site would break, so viewing ads would be required to use the functionality. I do feel thankful that toolchains like that don't seem to be in widespread use yet.
  - patrakov 5y ago
    Refresh a few times. The page does not serve the same ad scripts every time.
spansoa 5y ago
> ads will most likely be generated server-side and served from the main domain in the future Well one thing webmasters can do is place wrap an image in an <A> element and the URL is some affiliate link that they control. Good luck blocking that since the image is the first party domain. It's a tactic I've been using for years now, and I've gotten thousands of referrals and confirmed purchases of products.
- nobody9999 5y ago
  >It's a tactic I've been using for years now, and I've gotten thousands of referrals and confirmed purchases of products. What website(s) do you run so I can make sure never to visit them?
- tomjen3 5y ago
  That would as a minimum not slow anybody down much, it won't contain JS, both of which are an advantage. Of course, my adblocker will still block it, using the block element feature (also useful with nag bars etc).
mook 5y ago
> Probably the norm going forward to thwart ad-blockers. Also ads will most likely be generated server-side and served from the main domain in the future. That sounds great to me; it means getting cross-domain tracking to work would be much harder. Hopefully that means we'll also get ads that are actually relevant to the page instead of random unrelated stuff.
- iratewizard 5y ago
  With how I've seen ad tech evolve so far, I am sure they would include cross-domain tracking in their payloads and you would need to turn it off via a good ad blocker.
- theshadowknows 5y ago
  Until companies begin just sharing specific parts of their server side logging. I can see a future where all the tracking happens in a fully server-side network of companies just sharing data back and forth or between a central database.
volker48 5y ago
It is easier to do a complete block of an ad serving domain, but in terms of ad blockers it doesn't really matter if the ad is coming from the front or back end. The ad blocker can remove the content on the page holding the ad based on some CSS selectors.

BoysenberryPi 5y ago

I use teddit and have generally refused to use reddit ever since they made the mobile experience unusable with the constant "Please download our shitty app" screens. https://teddit.net/ https://teddit.net/

darthvoldemort 5y ago
old.reddit.com
tomjen3 5y ago
i.reddit.com for the mobile experience. Bonus is it looks like iOS 6.

mseepgood 5y ago

The last sentence seems to be speculation.

calrueb 5y ago

I'd be curious to hear from someone that feels strongly about blocking first-party front end tracking. I generally assume that whatever website I am on would have a good sense of what I am up to just based on server side logs. Sure, if I block 1p logging they might not have a down to the second understanding of how long I am impressing on something, but overall I feel the point is moot.

hn_throwaway_99 5y ago
Yeah, this take on "I also try to block first party tracking" is just weird in my opinion, or at least impossible (beyond just normal cookie blocking tools). The ways most sites utilize AJAX and JS, there is just no consistent way to block "tracking calls" vs. blocking requests needed for particular pieces of functionality and data.
- forgotmypw17 5y ago
  Exactly, there is a lot of trust involved, even without executing JavaScript, but especially when so. This is why I stay away from sites I don't find trustworthy. I also close the tab if I'm presented with a paywall, a modal newsletter subscription prompt, impossible cookie banners, etc. I think of it as a "the medium is the message" type of thing, and if the medium is tainted then the message can't be any better, so why read it?
- matheusmoreira 5y ago
  > there is just no consistent way to block "tracking calls" vs. blocking requests needed for particular pieces of functionality and data At some point, browsers will gain firewalls and packet inspection and filtering capabilities. We should be able to inspect the data sites are sending and receiving asynchronously via Javascript. We should be able to automatically delete or redact private information from JSON payloads. What if uBlock Origin could automatically anonymize unique identifiers that some Javascript code is trying to exfiltrate?
  - abestic9 5y ago

tbeseda 5y ago

I guess I'm surprised anyone is surprised by this. Using a third party for analytics is only a convenience. Given enough effort, any system can build in their own analytics. It's probably just a proxy to something like Segment.

amerkhalid 5y ago
Yeah I am old enough to remember setting up various analytics tools in early 2000s. Most people ran them on subdomains but some ran them in on same domain. Also we had tons of server-side tools like webalyzer.
- tbeseda 5y ago
  Back when we were trying to do smart things with Apache logs. And so when JS was prevalent enough and Google (+ others) started handing out snippets to get great macro data about visitors, we were all about it. It wasn't until that data became intricate user interactions that were bought and sold, did we worry. edit: So I guess that gets to where my surprise comes from. I expect first parties to gather all kinds of info about how I use their service. It's even fine. I literally signed up for it. The next step is to examine the TOS (in this case: Reddit) and see what I agreed they're allowed to then do with that data. ie. sell it so others can sell to me.
- leetrout 5y ago
  Not even that long ago. I've used Piwik / Matamo at a couple places in the past 5 years. Honestly a lot of analytics for an app can be done serverside and client side is just icing on the cake to make the data richer.

gruez 5y ago

They were doing this for a while now. eg. https://web.archive.org/web/20181220022532/https://www.reddit.com/r/stopadvertising/comments/87d1sq/psa_reddit_has_enhanced_their_tracking_they_now/ https://web.archive.org/web/20181220022532/https://www.reddi... from a few years ago