5 ms·

How would you do that? Isn't it the server that talks to Google Tag Manager, not the browser?

whalesalad 5y ago
Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible. Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally need to turn it off or whitelist domains (like Google tag manager) for client work, but normally I have it blocked.
- chrisseaton 5y ago
  > Google tag manager in my experience is a script executed by the browser. Isn't the whole point of this new change that it runs server-side, using a proxy that you install on the website so it uses the same domain? > Regardless, I use a DNS based ad blocker But it's the same domain name isn't it?
  - lmkg 5y ago
    A Server-Side GTM container compliments a client-side container, it does not fully replace it. Some processing happens on the server, but event data must still be sent to the server-side container first. For now, the "standard" deployment of a server-side is that it receives hits directly from the browser, orchestrated by a traditional client-side container. So the client-side script is still there, just less bloated. The server-side container has built-in facilities for serving up the client-side container script. Meaning that domain-name blocking will not prevent this. DNS-based also has some issues: Server-Side Containers run in App Engine, blocking them basically means blocking anything running on GCP.
    - pixeldetracking 5y ago
      and you can host the container: https://developers.google.com/tag-platform/tag-manager/server-side/manual-setup-guide https://developers.google.com/tag-platform/tag-manager/serve...
  - x0x0 5y ago
    Current GTM, configured (via the server UI) to inject tracker X: gtm javascript loads, pulls down the config, injects tracker X javascript into the browser new gtm: gtm javascript loads, pulls down config, streams events to google servers to fan out to tracker X as configured So blocking gtm.js off tagmanager.google.com / www.googletagmanager.com / the various other domains still blocks all gtm injected tags. The tl;dr is they're become much closer to segment -- which does the data fanout internally to segment. But they should still be straightforward to block.
    - volderette 5y ago
      This is not how GTM server side works. There is not a single call to Google domains from the client, when GTM server side is set up to its fullest. The config (gtm.js) will be loaded from my subdomain and not googletagmanager.com. Also gtm.js can be renamed.
      - xigoi 5y ago
        Couldn't you still recognize the script by its content?
        ComodoHacker 5y ago
        Not with dynamic obfuscation.
        shafyy 5y ago
        Exactly, this is already done for tracking scripts, since it's commong to use proxies to load tracking scripts.
        freedomben 5y ago
        No because the script contents can change from site to site. Maintaining an index for every site would get you closer, but individual sites can trivially tweak things to break fingerprinting as often as they want. Even on every request.
      - x0x0 5y ago
- seandoe 5y ago
  You missed the same domain part. How are you going to block a request when you don't know the url?
  - shafyy 5y ago
    You check the loaded script itself to see if it matches an expected pattern.
    - seandoe 5y ago
      Does there need to be a loaded script with a certain fingerprint? What if they are just passing data from the browser to some random endpoint? I'm not sure, just thoughts.
      - shafyy 5y ago
        There needs to be a script because the tracking still happens client-side and there will be some logic involved. The only way to avoid being blocked by the browser is to track server-side.
- romeoblade 5y ago
  You missed the part where they recommend changing the script's name as well, add in changing a few variable/function names in the script and even matching the hash of the script itself would be useless. On top of them recommending using a sub domain with an A/AAAA record so its first party.
  - Ajedi32 5y ago
    Worst-case you parse the script and block it if the AST is too similar. There are a million ways to detect and block this sort of thing when you control the client. Yes, it's harder than just blackholing a whole domain, but it's hardly impossible.
  - pixeldetracking 5y ago
    yes, french article is updated, but this english translation is quite old here it is: https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/ https://www.simoahava.com/analytics/custom-gtm-loader-server...
- HWR_14 5y ago
  The point is that DNS ad blocking is being worked around with this new system, because it looks like part of the site you're on. Also, that google is encouraging modifying the JS to prevent automated tools from blocking the javascript.
Saris 5y ago
Just block the GTM js from loading, it'll stop it easily.
- seandoe 5y ago
  The big change they are suggesting is that the gtm code is no longer accessed via a predictable Google domain, rather it is requested through a subdomain of the parent site.
  - pixeldetracking 5y ago
    yes, custom names for loader: https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/ https://www.simoahava.com/analytics/custom-gtm-loader-server... and even hosted on your own infra: https://developers.google.com/tag-platform/tag-manager/server-side/manual-setup-guide https://developers.google.com/tag-platform/tag-manager/serve...
  - Saris 5y ago
    uBlock already blocks stuff like Plausible analytics based on what's in the code, even if it runs on the parent site. Would this be any different?
- HWR_14 5y ago
  Block the code that they suggest changing the name, domain, and function signatures of? How?
  - inlined 5y ago
    If the loops, if statements, and block scopes are similar then the graph can be fuzzily identified. They’ve had anti-plagiarism software for years.
    - Deukhoofd 5y ago
      Annoyingly that would still require downloading them, which I'd definitely prefer not to. It's bloat that serves me no purpose.
propogandist 5y ago
use uMatrix or uBlock and block individual domains https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
- gaius_baltar 5y ago
  Proud uMatrix user here. Sadly, just noticed that the repo is now archived and I don't know if it will be maintained. Could not find any fork either. I'll miss this extension.
  - GekkePrutser 5y ago
    I liked this a lot but I don't see how someone without a computer science degree will use it successfully.. I think this is why Raymond gave up on it.. I think for the masses his time is better spent on uBlock Origin.
    - propogandist 5y ago
      It requires some effort to get oriented, but the granularity of control is fantastic. There is no competition. Although the dev gave up on it, he's open to someone picking it up (if there are any brave souls on HN) https://old.reddit.com/r/uBlockOrigin/comments/i240ds/request_for_a_stable_umatrix_release_for_cname/g048wyk/ https://old.reddit.com/r/uBlockOrigin/comments/i240ds/reques...
  - Arnavion 5y ago
    You have the features of uMatrix with uBlock Origin's static rules. You just have to write them by hand instead of the convenient table UI. https://news.ycombinator.com/item?id=26284124 https://news.ycombinator.com/item?id=26284124 The only thing that uBO doesn't support is controlling cookie access, so I still use uM for that.
    - Semaphor 5y ago
      > You just have to write them by hand instead of the convenient table UI. That’s a pretty big "just", though. Very few sites work without fiddling with rules, having to do manual text entry every time would push me towards not using it. The UI of uMatrix is generally far superior to the mobile-friendly, simplified one of uBo.

Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible. Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally need to turn it off or whitelist domains (like Google tag manager) for client work, but normally I have it blocked.

chrisseaton 5y ago
> Google tag manager in my experience is a script executed by the browser. Isn't the whole point of this new change that it runs server-side, using a proxy that you install on the website so it uses the same domain? > Regardless, I use a DNS based ad blocker But it's the same domain name isn't it?
- lmkg 5y ago
  A Server-Side GTM container compliments a client-side container, it does not fully replace it. Some processing happens on the server, but event data must still be sent to the server-side container first. For now, the "standard" deployment of a server-side is that it receives hits directly from the browser, orchestrated by a traditional client-side container. So the client-side script is still there, just less bloated. The server-side container has built-in facilities for serving up the client-side container script. Meaning that domain-name blocking will not prevent this. DNS-based also has some issues: Server-Side Containers run in App Engine, blocking them basically means blocking anything running on GCP.
  - pixeldetracking 5y ago
    and you can host the container: https://developers.google.com/tag-platform/tag-manager/server-side/manual-setup-guide https://developers.google.com/tag-platform/tag-manager/serve...
- x0x0 5y ago
  Current GTM, configured (via the server UI) to inject tracker X: gtm javascript loads, pulls down the config, injects tracker X javascript into the browser new gtm: gtm javascript loads, pulls down config, streams events to google servers to fan out to tracker X as configured So blocking gtm.js off tagmanager.google.com / www.googletagmanager.com / the various other domains still blocks all gtm injected tags. The tl;dr is they're become much closer to segment -- which does the data fanout internally to segment. But they should still be straightforward to block.
  - volderette 5y ago
    This is not how GTM server side works. There is not a single call to Google domains from the client, when GTM server side is set up to its fullest. The config (gtm.js) will be loaded from my subdomain and not googletagmanager.com. Also gtm.js can be renamed.
    - xigoi 5y ago
      Couldn't you still recognize the script by its content?
      - ComodoHacker 5y ago
        Not with dynamic obfuscation.
      - shafyy 5y ago
        Exactly, this is already done for tracking scripts, since it's commong to use proxies to load tracking scripts.
      - freedomben 5y ago
        No because the script contents can change from site to site. Maintaining an index for every site would get you closer, but individual sites can trivially tweak things to break fingerprinting as often as they want. Even on every request.
    - x0x0 5y ago
seandoe 5y ago
You missed the same domain part. How are you going to block a request when you don't know the url?
- shafyy 5y ago
  You check the loaded script itself to see if it matches an expected pattern.
  - seandoe 5y ago
    Does there need to be a loaded script with a certain fingerprint? What if they are just passing data from the browser to some random endpoint? I'm not sure, just thoughts.
    - shafyy 5y ago
      There needs to be a script because the tracking still happens client-side and there will be some logic involved. The only way to avoid being blocked by the browser is to track server-side.
romeoblade 5y ago
You missed the part where they recommend changing the script's name as well, add in changing a few variable/function names in the script and even matching the hash of the script itself would be useless. On top of them recommending using a sub domain with an A/AAAA record so its first party.
- Ajedi32 5y ago
  Worst-case you parse the script and block it if the AST is too similar. There are a million ways to detect and block this sort of thing when you control the client. Yes, it's harder than just blackholing a whole domain, but it's hardly impossible.
- pixeldetracking 5y ago
  yes, french article is updated, but this english translation is quite old here it is: https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/ https://www.simoahava.com/analytics/custom-gtm-loader-server...
HWR_14 5y ago
The point is that DNS ad blocking is being worked around with this new system, because it looks like part of the site you're on. Also, that google is encouraging modifying the JS to prevent automated tools from blocking the javascript.

Saris 5y ago

Just block the GTM js from loading, it'll stop it easily.

seandoe 5y ago
The big change they are suggesting is that the gtm code is no longer accessed via a predictable Google domain, rather it is requested through a subdomain of the parent site.
- pixeldetracking 5y ago
  yes, custom names for loader: https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/ https://www.simoahava.com/analytics/custom-gtm-loader-server... and even hosted on your own infra: https://developers.google.com/tag-platform/tag-manager/server-side/manual-setup-guide https://developers.google.com/tag-platform/tag-manager/serve...
- Saris 5y ago
  uBlock already blocks stuff like Plausible analytics based on what's in the code, even if it runs on the parent site. Would this be any different?
HWR_14 5y ago
Block the code that they suggest changing the name, domain, and function signatures of? How?
- inlined 5y ago
  If the loops, if statements, and block scopes are similar then the graph can be fuzzily identified. They’ve had anti-plagiarism software for years.
  - Deukhoofd 5y ago
    Annoyingly that would still require downloading them, which I'd definitely prefer not to. It's bloat that serves me no purpose.

propogandist 5y ago

use uMatrix or uBlock and block individual domains https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix

gaius_baltar 5y ago
Proud uMatrix user here. Sadly, just noticed that the repo is now archived and I don't know if it will be maintained. Could not find any fork either. I'll miss this extension.
- GekkePrutser 5y ago
  I liked this a lot but I don't see how someone without a computer science degree will use it successfully.. I think this is why Raymond gave up on it.. I think for the masses his time is better spent on uBlock Origin.
  - propogandist 5y ago
    It requires some effort to get oriented, but the granularity of control is fantastic. There is no competition. Although the dev gave up on it, he's open to someone picking it up (if there are any brave souls on HN) https://old.reddit.com/r/uBlockOrigin/comments/i240ds/request_for_a_stable_umatrix_release_for_cname/g048wyk/ https://old.reddit.com/r/uBlockOrigin/comments/i240ds/reques...
- Arnavion 5y ago
  You have the features of uMatrix with uBlock Origin's static rules. You just have to write them by hand instead of the convenient table UI. https://news.ycombinator.com/item?id=26284124 https://news.ycombinator.com/item?id=26284124 The only thing that uBO doesn't support is controlling cookie access, so I still use uM for that.
  - Semaphor 5y ago
    > You just have to write them by hand instead of the convenient table UI. That’s a pretty big "just", though. Very few sites work without fiddling with rules, having to do manual text entry every time would push me towards not using it. The UI of uMatrix is generally far superior to the mobile-friendly, simplified one of uBo.