17 ms·

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes,

• deleted 5y ago
  [deleted]
• ec109685 5y ago
  Apple’s Private Relay blocks this type of cross site tracking. Given this tracking is all server side, third party cookies across sites aren’t possible using this mechanism, and private relay cycles through your IP addresses frequently and uses common IPs across multiple users. Regarding your other point, unless Google execs want to be thrown in jail / sued, they can’t use things like first party cookies for their benefit since that is against their terms of service.
  • irrational 5y ago
    I wonder why Safari is required? I’d be interested in paying for this if it worked with Firefox.
    • GekkePrutser 5y ago
      Yeah that would be a useful service that Mozilla could offer and I'd actually pay for. I don't like their VPN as it's too basic in terms of privacy protection and it's much more versatile to just sign up with Mullvad myself because then I can use it on other stuff than just the browser.
  • novok 5y ago
    How is private relay different from a vpn? A lot of fingerprinting scripts also can track you despite vpn.
    • deleted 5y ago
      [deleted]
    • top_sigrid 5y ago
      Private Relay uses ingress and egress relays. The ingress proxy does know your IP but not which sites you are visiting and what you are doing. The egress proxy is only connected to the ingress, sees what you visit but does not know who you are. Both proxies are run by different parties. With a VPN you would have to trust one provider, who sees all of your traffic.
      • mkmk3 5y ago
        Then is Private Relay equivalent to a two layer tor setup?
        • Engineering-MD 5y ago
          From my understanding yes, but with the caveat of being organised by a single entity (apple)
• quicklime 5y ago
  > Maybe using an archive.is-like service that renders the static page (as an image at the extreme) A lot of companies are starting to use "browser isolation" which is essentially what you're saying. A proxy runs between the client and the server, but it does more than just direct TLS streams - it actually builds the DOM and executes the JS. The resulting web page is sent to the actual client browser, which might send back things like mouse and touch events to the proxy, which will then update the page. I think most companies are using this as a malware protection thing, but it does hide the actual client IP address and fingerprint, and I imagine it would make tracking very difficult. https://en.wikipedia.org/wiki/Browser_isolation https://en.wikipedia.org/wiki/Browser_isolation
  • kibibu 5y ago
    Opera Mobile has been doing this for years and years
    • Quai 5y ago
      The Opera product you are thinking of is Opera Mini. Opera Mobile is a browser running mostly on your device (except for "turbo" which optimized media trough a proxy setup, but did not, afaik, execute any of the javascript). Opera Mini can be looked at as a browser running in the cloud, sending OBML (Opera Binary Markup Language, if I remember correctly) causing the (very thin) client to draw things on the mobile screen, like text, images, etc without having to transfer, parse, execute, flow and paint every thing on the device.
      • Fnoord 5y ago
        Yeah, they released countless of rebrands and versions and what not. The equivalent on desktop would be Browsh (e.g. with terminal + Mosh), but it runs Firefox under the hood. Opera Mini is just akin to a remote browser with the result being send to the client (as a compressed picture like in RDP/VNC, or a proprietary markup language like OBML).
  • GekkePrutser 5y ago
    Browser isolation isn't quite that. It's just running a browser that is heavily sandboxed from internal files and networks, or running on another machine so any exploits don't hit your machine. It's very much like running a browser through Citrix (in particular the remote flavour which is the most common as far as I've seen). But of course any data in the browser itself is still within reach for the malicious code... Which only solves half the problem. Unless you rigidly separate internal browsing from external sites. But it doesn't run all the JavaScript and then send you a screenshot or anything. The resulting page is still interactive. Remote browser isolation has the ability to change the landscape of personal computing enormously by the way. Right now we equip all our laptops with at least 16GB (32 for customer care) because some web apps like Salesforce Lightning are such memory hogs. Considering the importance of the browser in modern computing this model world basically make the PC more like a terminal and require much less resources. Of course this has already been going on with web based apps and streaming of things like games but this could be the final nail in the coffin of the PC as we know it. Not sure I'm happy with that...
• hilbert42 5y ago
  "I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites) it's just a matter of toggling it on and refreshing the page. I've been working this way for at least 15 years - that's when I first realized JS was ruining my web experience. I'm now so spoilt by the advantages of the non-JS world that I don't think I could ever return. I'm always acutely reminded of the fact whenever I use someone else's machine.
  • heavyset_go 5y ago
    > By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. Years ago I was on the "people who block JavaScript are crazy" bandwagon, until just loading a single news article online meant waiting for a dozen ads and autoplaying videos to load. I spent more time waiting for things to finish loading than I spent browsing the actual sites, which killed my battery life. I'd get a couple of hours of battery life with JS on, and with it off, I could work all day on a single charge. It was nice. Ever since then, I've been using NoScript without a problem. I've spent all of maybe 5 minutes, cumulative over the course of several years, clicking a single button to add domains to the whitelist. If whitelisting isn't something you want to do, you can use NoScript's blacklist mode, too. > I'm now so spoilt by the advantages of the non-JS world that I don't think I could ever return. I'm always acutely reminded of the fact whenever I use someone else's machine. I relate with this 100%.
    • paulryanrogers 5y ago
      Tried NoScript for years and it was a pain. Too many of the sites I use need so many domains full of JS. So I think this will vary widely depending on the person and their preferred/needed sites.
• tgsovlerkhgsel 5y ago
  Aren't browsers shifting to a per-domain cookie jar? While you can never prevent one specific site from tracking you, this still doesn't (directly) allow your activity on Site A to be linked to activity on Site B, does it? Of course, fingerprinting combined with IP addresses will ultimately allow something that comes very close to it, so the current state (a few hundred trackers per website, all ending up harmlessly incrementing the adblocker's counter) is better for privacy for power-users, but I'm not sure if this is the big "game over".
  • lewantmontreal 5y ago
    This is what I’m interested in. Article itself did not mention cross site tracking. Every website having their own tracking subdomain makes third party cookies not work cross site even without browser changes.
    • GekkePrutser 5y ago
      They can still cross-track based on IP or any other fingerprint worthy information. I expect this is exactly what they're doing. Doing this all on a central service makes this process much easier unfortunately...
    • pixeldetracking 5y ago
      yes, they would need to get another identifier, and that's what is done with players like Facebook. Sorry another of my articles in french: https://pixeldetracking.com/fr/les-signaux-resilients-de-facebook-ou-comment-la-surveillance-sadapte https://pixeldetracking.com/fr/les-signaux-resilients-de-fac..., but Facebook is making it easy to integrate their "Conversion API (CAPI)" with GTM Server-Side tagging
      • tgsovlerkhgsel 5y ago
        But that should only help e.g. a web store to track you from the ad you clicked, which seems reasonable. It should not allow e.g. Facebook to link your activity on a news site to your Facecbook cookie, because while you're on cnn.com, your browser is using the cnn.com-specific cookie jar for everything, including the like button?
• tootie 5y ago
  "Endgame" is the way all web analytics was done 20 years ago.
  • gigel82 5y ago
    The server-side "analytics" of 20 years ago was for aggregate reports on popular pages, number of users, their browsers and OSs and maybe their geo-location; solely for the use of the site owners to optimize and whatnot. This abomination Google is proposing is unblockable cross-site tracking of people's activities. That site owners get to see some of that data too is insignificant, their value comes from being able to track people across the web. I'd bet Google would even offer this proxy service "for free" depending on how much data they can hoover from the site.
    • beagle3 5y ago
      How does google correlate identifiers between different users?
      • gigel82 5y ago
        Browser fingerprinting and IP address plus any unique identifiers if you happened to log in on that website.
• toastal 5y ago
  While impractical, I liked the article's suggestion of blocking the proxies. I'm curious what reaction this would have. Ad blocking users get no content and move to alternatives and stop being users, or would the sites cave and realize having users interacting is more important than all of the data collected.
  • tasha0663 5y ago
    It's a fine suggestion. If it breaks the site, then I'd call that a broken website and move on. Maybe next time someone points me there, they'll have fixed their critical issue for users who block tracking proxies. I'm okay with not being in the target audience of sites that really want to do this. I've got enough other things to do at less hostile places that my FOMO isn't triggered in the least.
    • gigel82 5y ago
      How do you identify tracking proxies though? When everything is going through the same domain you don't even know if data is being sent to Google, it's all a server-side black box.
      • aembleton 5y ago
        By using Cname uncloaking that uBlockOrigin can do on Firefox. It should see that the real domain is Google Tag Manager.
        • thejohnconway 5y ago
          I think the article mentions that Google recommends against using Cname for this, and using A records instead.
          • tasha0663 5y ago
            > Google recommends against using Cname for this So use Cname? :D
• whalesalad 5y ago
  Just block Google tag manager itself. Gets two birds stoned at the same time.
  • chrisseaton 5y ago
    How would you do that? Isn't it the server that talks to Google Tag Manager, not the browser?
    • whalesalad 5y ago
      Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible. Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally need to turn it off or whitelist domains (like Google tag manager) for client work, but normally I have it blocked.
      • chrisseaton 5y ago
        > Google tag manager in my experience is a script executed by the browser. Isn't the whole point of this new change that it runs server-side, using a proxy that you install on the website so it uses the same domain? > Regardless, I use a DNS based ad blocker But it's the same domain name isn't it?
        • lmkg 5y ago
          A Server-Side GTM container compliments a client-side container, it does not fully replace it. Some processing happens on the server, but event data must still be sent to the server-side container first. For now, the "standard" deployment of a server-side is that it receives hits directly from the browser, orchestrated by a traditional client-side container. So the client-side script is still there, just less bloated. The server-side container has built-in facilities for serving up the client-side container script. Meaning that domain-name blocking will not prevent this. DNS-based also has some issues: Server-Side Containers run in App Engine, blocking them basically means blocking anything running on GCP.
• booleandilemma 5y ago
  Simpler protocols (Gemini, Gopher...), outright refusing to use what the modern web has become. I only use HN and a few select sites. You don't need an ad-blocker if there are no ads in the first place.
  • ReactiveJelly 5y ago
    Using Gemini as an allowlist doesn't seem any better than allowlisting known-good domains for HTTPS sites
  • EE84M3i 5y ago
    HN is a link aggregator for HTTP(s) links. How do you read them?
    • aenis 5y ago
      Not sure about the parent poster, but I am here mostly for the comments, and rarely visit the linked content.
      • ComodoHacker 5y ago
        Doesn't exactly this behavior create echo chambers and lead to polarization?
        • PhantomGremlin 5y ago
          I usually do read the linked content but I agree with GP poster that comments are often more informative. Yes there is sometimes an echo chamber here, but it's only for limited topics. It very much has a Silicon Valley feel to it, but @dang and I have gone around on this and he assures us that the readership and comments have broad geographic representation.[1] It's a worldwide echo chamber. :) Fortunately the echo chamber doesn't exist for most submissions. Most of the discussion on HN is on non-polarizing topics. [1] https://news.ycombinator.com/item?id=26869902 https://news.ycombinator.com/item?id=26869902
• bhauer 5y ago
  I think in the short-term the strategy is this from the article: > Or ... block all the IP addresses of Google App Engine, at the risk of blocking many applications. having nothing to do with tracking. Anyone hosting legitimate apps in the Google ecosystsm is indirectly complicit in this and at least for my personal network, I have no concern with blocking Google App Engine holistically. Additionally, I think it's important to hurt Google as much as possible for escalating in this way. Widespread blocking of GAE may seem extreme but it's also arguably warranted.
  • reaperducer 5y ago
    I have no concern with blocking Google App Engine holistically Unfortunately, it seems that more and more government web sites rely on Google services to function. And there's no replacement for those.
    • paulryanrogers 5y ago
      How can it be legal for a government to make increasingly core services depend on these amoral, for profit monsters?
      • l33t2328 5y ago
        I’m not sure if this is a serious question, but what would this imaginary law say? The government can only do business with companies who aren’t in it for the money?
        • HWR_14 5y ago
          The US government isn't shy about adding rules for its contractors. It should be trivial for them to demand (or provide) dedicated IPs for their sites. Then they won't get caught up in the IP address blocking of GCP.
          • efitz 5y ago
            The big tech companies have all built out lobbying capabilities; such a law would end up helping big tech and harming small companies because the big companies would be involved in authoring the law and would be contributing to the sponsors and committee chairs and members to get their favorable language included. And it would all be legal and business as usual.
• dsr_ 5y ago
  There's no way to fight this unless ... you pass legislation against it or comparable technologies, preferably at a policy level.
  • eru 5y ago
    You can fight against it by refusing to use these websites? If you can't do this, perhaps because a big _majority_ of users don't care enough to support this kind of ecosystem shift, what makes you think a majority of voters would support this? (And if not, why would you want to force your view on them?) It's like legislating that people should only listen to Good Music and eat Healthy Food, as defined by some people who know better than the unwashed masses?
    • dsr_ 5y ago
      I rather think it's more like legislating that you can't sell people food adulterated with poisons, and you have to label the ingredients accurately. Oh, and it's like saying that you can't sell lead paint, even though it is a very pretty white.
      • eru 5y ago
        Even without that legislation, most people would already care about avoiding poisoned food. So a law specifically forbidding poisons is in line with what the majority already cares about. (Slightly related: see eg some Chinese people making good money from buying baby formula overseas and shipping it back home in their luggage. China has legislation against poison, but people don't trust the enforcement enough.)
        • kergonath 5y ago
          > Even without that legislation, most people would already care about avoiding poisoned food. There is lots of evidence that people would still use harmful substances when it’s nice and cheap. Then other people would be exposed to it just because it is impossible to know the chemical composition of everything around you. Lots of people care about avoiding things like toxic chemicals and harmful bacteria, the trouble is that they cannot see them. > So a law specifically forbidding poisons is in line with what the majority already cares about. So why not do it, then, if it is the right thing and people want it? In the real world, people are not perfectly informed, and fraudsters are willing to lie. So law and enforcement are absolutely necessary to end harmful practices. See lead paint, but also leaded petrol, asbestos, antibiotics in farm animals, and insecticide chemicals spread willy nilly across the countryside. These things not just disappear on their own because some people don’t like it. Even on the topic at hand, to be honest. People know that ads and tracking are bad and annoying, even if they do not see clearly the extent of the damage. Some of us know how to avoid most of them. And yet, they keep making more and more money, and are far from disappearing. It is difficult to take your point seriously.
• downrightmike 5y ago
  The greatest minds of a few generations really should think about not being evil.
• ignoramous 5y ago
  I co-develop an open source firewall for Android, which most of our users use for ad-blocking purposes. The community has known about server-side collection for quite sometime now. You could run Google Analytics on any of the serverless environments since a year or two ago (I noted this on news.yc a year back [0][1]). Tag Manager server-side is Google throwing its own solution in to the mix. DNS based content blocking was always DoA, there simply are too many chinks in the armour besides CNAME or HTTPS/SVCB or SRV or ALIAS record cloaking [2]. The worst I've seen reported to me by users is a tracker generating domains names on-the-fly (domain generation algorithms) and A/AAAA records pointing to different IP addresses each time [3]. That said, a firewall can still mitigate this offensive, while network security with just DNS was always going to be what it was: A stop-gap. This isn't the end-game: I fully expect that IP address blocklists would crop up in no time, and will be painfully maintained by folks pouring their life in to it. TFA points that Google's reverse-cloaking presumably with IP addresses, but the worse would be if multiple domains shared IP addresses (like in a CDN), reverse-cloaked with Server Name Identification. Even firewalls would have to blanket block IPs... and what if those IPs are shared with other Google front-ends like the AMP project / YouTube / Mail / Docs? The firewalls would also have trouble with something like Ao1 [4]: If multiple websites were behind multiple IPs, or in the extreme, a single IP. The firewall is bust, but that's good, now we simply de-Google / de-Cloudflare ourselves, and be luddites like they want us to be. [0] https://news.ycombinator.com/item?id=26003654 https://news.ycombinator.com/item?id=26003654 [1] https://news.ycombinator.com/item?id=25169029 https://news.ycombinator.com/item?id=25169029 [2] https://news.ycombinator.com/item?id=26298339 https://news.ycombinator.com/item?id=26298339 [3] Ex: https://www.reddit.com/r/uBlockOrigin/comments/srza8x/changing_domain_name_every_hour_same_ip_address/ https://www.reddit.com/r/uBlockOrigin/comments/srza8x/changi... [4] https://nitter.net/rethinkdns/status/1448738898998292495 https://nitter.net/rethinkdns/status/1448738898998292495
  • culi 5y ago
    I really don't know much about this space, but do you think server-side tagging could be more or less susceptible to user resistance attacks like what Adnausium[0] does? Can we spam them into futility? [0] https://adnauseam.io/ https://adnauseam.io/
• altairprime 5y ago
  How much would you pay per month for custom-per-site tracking blocking as described here?
  • GekkePrutser 5y ago
    5-10 bucks. Any higher and I'll be looking at other options like not using the web so much.
  • miere 5y ago
    up to $6.9 - which would be (roughly) $10 local bucks on my country.
  • scim-knox-twox 5y ago
    Nothing. No one should pay for not being tracked.
    • altairprime 5y ago
      In principle I agree, and I support having the GDPR in effect globally, so that these server-side data sharing solutions are illegal without opt-in consent. Unfortunately there’s a reality gap between “GDPR everywhere” and the United States and other countries, and that gap was being filled previously by anti-tracking lists maintained essentially for free out of the goodwill of people’s hearts. Now that Google is - and has been - using server-side proxies, those tracking lists won’t scale without human caretaking. Any human versus the entire web would burn out in a day. So the choice is either to pay humans to enforce our anti-tracking beliefs against scummy corps, or to donate to politicians that believe in GDPR so they can try to make it illegal, or to refuse to pay anything and accept the status quo of being tracked. We’ve reached the end game of the “pay nothing until it’s fixed, then continue paying nothing” ethos: Google has outplayed us, and website owners can afford to pay to track us. I don’t like this, and neither do you. I think it’s time to pay money to fight back, and you do not think it's appropriate to pay money to fight back. If you or anyone have a good idea on how zero-cost effort can somehow solve the tracking problem, share that with others in a useful reply to the post somewhere. You don’t have to convince me that such ideas exist: you have to convince others who share your “at no cost to me” beliefs to invest their time and energy in your zero-cost idea. And, whatever else I’m uncertain, I guarantee they’re not going to see such a reply down here in this thread that started with a pricing question.
• misterbwong 5y ago
  Called it [1]. It's a cat-and-mouse game and, unfortunately, advertising is just _that_ lucrative. Privacy-minded browsing will help those that care (for now...), but that's an unsustainable option with the current monetization channels available. If a content publisher cannot monetize you, they will think nothing of blocking you. There will be some public backlash against companies that do so and there will be some sites who will lose money because of it, but the rest of the publishers will simply follow the money while the industry shifts towards more intrusive tactics. There needs to be a monetization channel that is 1) good for both users AND publishers and 2) pays just as much as current methods. Unfortunately none of the current systems support that. [1] https://news.ycombinator.com/item?id=9975955 https://news.ycombinator.com/item?id=9975955
  • drusepth 5y ago
    >There needs to be a monetization channel that is 1) good for both users AND publishers and 2) pays just as much as current methods. I agree, but what party would you like that money to originate from? Ads work well right now for consumer-to-consumer (e.g. I create a blog and you view it) because there's a rich, third-party that money can flow from (a company running ads --> money to me) without having to charge you, the end-user who is more than likely significantly less well-off than a corporation. To buck that pattern, you need the money to come from somewhere else. Subscriptions and direct payments are an obvious choice (see: the boom of SaaS over the past few years) but people are already complaining that they have so many subscriptions they lose track of them all, and spend too much money on what used to be a "free" internet. So, I don't think there's a solution where the money comes from the end-user. However, any time you add in a third party for the money to flow from, they're going to want something in return. And unless you want that cash flowing from the site owner to that third party (...why would you?), they're gonna need to offer something else. I don't see any solution other than "a third party pays for something users and/or the site can create for free". Is the answer to just find something free other than analytics/usage, or are there other approaches to monetize a site while still making it "free" to access?
    • misterbwong 5y ago
• Helmut10001 5y ago
  IP blocking still seems a thing, even with this new feature - the ads need to be served from _somewhere_. I am using pfblocker-ng on pfsense, which uses giant IP blocklists to filter out all connections to spam and ad-servers. I haven't seen ads in 5 years and there is no need for client-side solutions (e.g. adblocker). The places where ads appear are just whitespace.
  • josephcsible 5y ago
    The idea is that this will be served from the same IP address that the site that you're trying to visit is.
    • Helmut10001 5y ago
      Thanks for the explanation - I understood this partly from the article and it is pretty worrying for the future.
    • pixeldetracking 5y ago
      yes, i updated the french article but not this translation (no idea who did the translation btw), Google has a guide to host the container on your own infra: https://developers.google.com/tag-platform/tag-manager/server-side/manual-setup-guide https://developers.google.com/tag-platform/tag-manager/serve...
• teekert 5y ago
  “ I honestly don't know if there's any solution to this at all.” How about the law? Like GDPR? My data is mine.
  • teekert 5y ago
    I mean, technically there is nothing stopping me from following anybody around, documenting their actions, taking pictures. It's easy... But we have laws that prevent this because we decided together that we do not like this.
• inlined 5y ago
  I think the solution will be for ad blockers to invest in neural nets to detect the graph of the code flow for known variants of the script. The software that detects plagiarism will be a good start.
  • xigoi 5y ago
    That sounds like it's going to be slower than not using an ad blocker at all.
    • aembleton 5y ago
      Not if the signatures are uploaded and shared.
    • brobinson 5y ago
      Hashmap lookups are O(1)
• mtsr 5y ago
  I don’t think the solution here is a technical one. This should just be solved by legislation. Google Analytics has been recently ruled illegal in multiple European countries. And either this already is illegal under the same laws or it should be made so.
  • mhoad 5y ago
    I suspect this might end up as a slightly trickier scenario because when you get down to the details it’s hard at a technical level to make a distinction between a server log file and a tool like analytics which takes those same bits of data and mostly just organises and displays it in an intuitive way with charts and a nice UI.
    • mtsr 5y ago
      The ruling against google analytics in France is quite simple: google analytics as used by an unnamed website was not compliant with GDPR, because it exports user data to a country that has privacy laws that are not up to GDPR standards, which is not allowed. This is on the unnamed website and they or compelled to stop this illegal export of user data by either only exporting anonymized statistics or stopping use of google analytics entirely. Of course this isn’t yet a perfect banning of GA and Google might be able to work around it, but it’s something. And in fact, anonymized statistics would probably be OK (depending on the details of course).
      • mhoad 5y ago
        But this actually highlights exactly what I mean. What if I simply stood up a plain old Apache server to host my website but that happened to be hosted in the US. No analytics, just a few HTML files and that’s it. I’m still in this scenario sending PII of EU citizens in the form of IP addresses to the US which are just written to /var/log/apache It seems obviously different and yet as that ruling seems to imply it wouldn’t be unless I’m missing something here between first and third party capture or something?
        • 5y ago
• silentsea90 5y ago
  I get privacy concerns and hate for ads, but what about "free" internet? Paywalls are a massive annoyance to me personally, and if ads were legislatively blocked, would I have to pay for each website I visit that previously relied on ads for $? Perhaps we could be making micro-transactions for each website visited via crypto (?)
  • philihp 5y ago
    So something like https://yalls.org https://yalls.org?
  • latexr 5y ago
    Solutions for sending micro transactions to websites you visit have existed for over a decade[1], no cryptocurrencies or blockchains required. [1]: https://en.wikipedia.org/wiki/Flattr https://en.wikipedia.org/wiki/Flattr
• ssl232 5y ago
  If it takes maintaining blocking scripts for individual websites, I'm pretty sure services will spring up to crowd source it.
• cookiengineer 5y ago
  > Maybe using an archive.is-like service that renders the static page (as an image at the extreme), or a Tor-like service and randomizes one's IP address and browser fingerprint. I'm building a peer-to-peer network of Web Browsers [1] that doesn't trust anything by default, and only allows to render types of content incrementally; while disabling JS completely. Most of the time, you can find out what the content is with heuristics. The crappy occasional web apps that don't work without JS can be rendered temporarily in an isolated sandbox in /tmp anyways. I think that the only way to get ahead of the adblocking game is to instead of maintaining blocklists, we need to move to a system that has allowlists for content. The user has to be able to decide whether they're expecting a website serving a video, or whether the expectation is to get text content, image content, audio content etc. News websites are the prime example of how "wrong" ads can get. Autoplayed videos, dozens of popups, flashing advertisements and I haven't even had time to read a single paragraph of the article. And to get ahead of the "if fanboy gets hit by the bus" problem... we need to crowdsource this kind of meta information in a decentralized and distributed manner. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth
• cbvlkjerna 5y ago
  It's based on JS. There's your solution. I disabled JS in the browser for nearly 2 decades and I can still use most of the web (HN included). You are blind to the solution because you don't want to take responsibility for your own browsing. You and people like you won't change, will whine about how nothing can be done while not being prepared to understand the problem is yourself and that's where the solution lies as well. When google screws you over, remember you chose that (maybe by omission rather than commission, but you chose).
• PhantomGremlin 5y ago
  Maybe using an archive.is-like service No that has turned to shit (for me anyway). Used to be fine, now presents a captcha when JS off. Okay so I switch from Firefox to Safari (where I leave JS on) and it still presents a captcha. I'd rather use the original site with JS than solve captchas. That has been my consistent recent experience for a multitude of those. or a Tor-like service I've never used Tor, but aren't there a lot of complaints of repetitive captchas when using it? randomizes one's IP address and browser fingerprint I haven't followed this closely, but didn't Apple make claims that they would soon have an opt-in service that did something like this?
  • latexr 5y ago
    > didn't Apple make claims that they would soon have an opt-in service that did something like this? iCloud Private Relay[1]. It’s in beta. [1]: https://support.apple.com/en-us/HT212614 https://support.apple.com/en-us/HT212614
• onion2k 5y ago
  The article is from 2020, and I don't think I've ever seen a site using this approach yet. It is an egregious attempt to circumvent the Same Origin security policy in browsers that developers and privacy advocates should rightly be angry at, but it doesn't seem to have caught on. That's something to be thankful for.
  • pixeldetracking 5y ago
    your are optimistic, most analytics guys I know are working with clients to transition to GTM server-side tagging
  • 1shooner 5y ago
    >I don't think I've ever seen a site using this approach yet. What have you been looking for? It seems like this would be hard to observe.
• noduerme 5y ago
  >> God damn... this is it, this is the end-game I don't understand. I tried to read the article but it doesn't make sense to me. What is the end-game? Can you explain? Not everyone uses google analytics, and even if we do it would only be on the front pages... (hooking into any API has always had the potential to expose session data if you pass it, so what's new here??)
• mixedbit 5y ago
  There is a hope this can be blocked with adblockers inspecting payload of requests and blocking based on some generic properties that could be always present in Google Tag Manager requests to proxies. Unless this mechanism has some dedicated Chrome-level support that would disallow inspecting or blocking these requests.
  • xyzal 5y ago
    I think modifying some fingerprintable apis to give faked/altered results could be enough, given the global fingerprint is a product of all partial fingerprints. Some extensions already implement that, eg. https://github.com/kkapsner/CanvasBlocker/ https://github.com/kkapsner/CanvasBlocker/
• KoftaBob 5y ago
  Wouldn't a script blocker like NoScript or uMatrix take care of this?
• marcosdumay 5y ago
  Nope. The end-game is adding the data collection into the backend frameworks so the user does not have to execute javascript at all. But this is pretty close to it. I hope Google and anybody collaborating with them get severely punished.
• krsdcbl 5y ago
  I think there was never the possibility to "out-tech" tracking solutions in the first place. You simply cannot plug every hole imaginable that will be discovered, and still serve your service on a network. The only remedy is strict legislation and judicial recourse against companies that do try to cheese it. Just like you cannot possibly implement real world security and surveillance that makes it completely impossible to commit theft, but you can implement strong enough legal deterrance to make it a really unviable risk/reward scenario for individuals and corporations alike
• hwers 5y ago
  "Blocking scripts for each individual website" probably isn't too bad of a burden though. There's enough people who are annoyed by this and few enough sites that you actually visit (how often do you actually visit a brand new website, or one that hasn't been visited by thousands already?) that maintained (donation supported) chrome extensions for this will pop up eventually.
• pacifika 5y ago
  Couldn't a adblocker block the largest javascript blob loaded by the page? Most likely it's gtm. Also with a bit of machine learning it could recognise the patterns in the js blob, no?
• ji23ii23jjj3 5y ago
• jcfrei 5y ago
  It was clear this was going to happen for more than a decade now. I'm surprised it took them so long to really push for this. I'm just reiterating what I said back then: There's no point in wasting any time and resources into a stupid technical cat and mouse game to fix this. The only sensible way to deal with this stuff is through legislation.
• cavisne 5y ago
  You still pay for the app engine requests. This whole product is just a hash script that configures the proxy for you.