8 ms·

Tracking Blocked Scripts

49 points by Amorymeltzer 3y ago

varenc 3y ago
Armed with this information I discovered the endpoint codepen hits when it detects that the ad-serving script is blocked! https://codepen.io/cpe/puppies-and-kittens?id=<id> It looked so innocuous it took me a sec to notice. You can definitely tell it's named in a way to avoid blocking rules. I appreciate the little humor too. Codepen plays nice and just uses this for logging purposes. But when other sites take more aggressive anti-ad-block measures your ad-blocker can still defeat them by silently redirecting some analytics/ad-serving JavaScipt to an internal no-op resource. That way the error handler isn't called but the JS doesn't actually run. Or the JS is replaced with a no-op equivalent. See uBlock's resource library here: https://github.com/gorhill/uBlock/wiki/Resources-Library https://github.com/gorhill/uBlock/wiki/Resources-Library (I imagine a site like codepen, with its technical audience, sees a lot more users with ad blockers.)
- kevin_thibedeau 3y ago
  I once felt mildly guilty about JS and ad blocking so I tried running unblocked at work since the performance degradation of all the crap was less noticeable on a fast link. That lasted a few months until I got redirected to a porn site from what was likely a hacked Wordpress system. If I'm going to be assailed by unvetted code that does unauthorized things with my property, I'm going to block everything wholesale without any lingering guilt. If you're a business and you want to serve ads do it with plain text and images. If you need to track me do it with your server logs. You don't deserve anything else.
  - xp84 3y ago
    > serve ads do it with plain text and images... You don't deserve anything else Lots of ads are text and images, but they're all placed client-side using scripts, because* nobody buys ads entirely untargeted (they're ineffective). If you're a business and want a purely server-side ad system to monetize your site with, you're going to be looking for a long time. What you're saying basically amounts to "ad-supported business models online should not exist." Which is an opinion you're entitled to, but if this is your stance I'd encourage you to at least try to, for a week, block all ad-supported sites, rather than the ads, to see what the logical conclusion to your policy would be. *Note: Even without that reason, server-side would be unpopular with both publishers and ad networks because of the need to offer dozens of flavors of server-side SDKs that the publisher would have to integrate deeply into their SS code, rather than using the lingua franca of client-side JS.
    - kevin_thibedeau 3y ago
      Radio, television, and print ads are "server side". Somehow they still manage to work. We don't have to lose all of our agency just because the jerks in marketing have no ethical standards and most people aren't aware enough to stop their excesses.
      - arp242 3y ago
        I kind of agree with you, but on the other hand you either also paid for it – either directly as in newspapers or indirectly via taxes as for some public TV with limited ads – or they were plastered with ads from top to bottom. So there is perhaps a bit of a balance to be struck. When Google Ads first started way back in the day they were simple fast text ads with content relative to the page you were reading. Since then ... a lot has changed, but I don't think the basic principle of it is necessarily wrong, just the implementation. You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff.
        brigandish 3y ago
        > You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff. How? Genuinely interested to know how this attack happens without a click from the user.
        wildpeaks 3y ago
        Using HTTP status 301/302 or HTML meta tag http-equiv="refresh". See https://en.wikipedia.org/wiki/HTTP_302 https://en.wikipedia.org/wiki/HTTP_302 and https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...
        3y ago
  - saagarjha 3y ago
    I work for what’s ostensibly an advertising company, so I have made the choice to not put an adblocker on my work machine, which is pretty decent and wired into a very fast connection. The ads load pretty fast but I’ve learned to be careful about which tabs I leave open in the background.
- hawski 3y ago
  I would imagine that in the future ad-blocker will need to actually run the javascript, but in a separate temporary context. In Firefox terms a tab that runs in two containers at once. A shadow context for the ad-machine and content nuggets gouged out for the actual user to view.
- hsbauauvhabzb 3y ago
  > I appreciate the little humor too. Somebody going out of their way to name a file erroneously with the intent bypassing a security and privacy control I’ve gone out of my way to deploy is not what I’d call humour, it’s disgusting.
  - varenc 3y ago
    They're only logging if the script failed to load. They just want accurate metrics on how many people are blocking the ad serving script. Personally, I want them to know I'm blocking their ads since it sends a signal to them about what I care about. It's not clear to me that all ad-block users are categorically also objecting to 1st party analytics of any sort. Most ad block rule lists don't even try to block 1st party analytics. And as I said in my comment, this only works because logging is all they're doing. If they tried to use this technique to block ad-block users it would quickly be circumvented. I understand you might not even want to signal this to them. That's why I shared the endpoint it's hitting. I want people that really don't want even this type of logging to be able to easily add a block rule. I admit in retrospect a less hidden and more obviously named endpoint would have been more polite. Personally, I really think it's a stretch to call it 'disgusting'.
jccalhoun 3y ago
Amusingly, when javascripts are blocked on his site it is a black background with white text which is easier for me to read than the color scheme with javascripts allowed
- jez 3y ago
  You're seeing the dark theme for the site. (I see the same thing when I click the checkbox in the top right corner of the page as when I disable JS.) Perhaps it's using JavaScript to detect that your browser is reporting that you prefer light-mode sites? Admittedly, the site could probably use CSS to make this decision as well, but I figured I'd mention it.
nr2x 3y ago
“Hey the user clearly doesn’t want this. But I’m a web developer in 2023 and the user is my enemy! How can we do something the user explicitly does not want us to do?”
- xp84 3y ago
  Are you saying first-party analytics of any kind are evil? Users have the right to not use the site, which is the only way users are going to leave no traces. I think you have the right to track the usage of your product. And if you are ad-supported and not a sole proprietorship, you have an obligation to your business to at least know whether your monetization strategy is failing due to your users' ad-blocking preferences. The "% who block ads" figure is vitally important in deciding, for instance, whether to offer an ad-free paid tier.
  - 2h 3y ago
    Ad blocking is the anti virus of this generation. If someone is using ad blocking, especially with custom rules, they are saying, loud and clear, they DON'T WANT most JavaScript running. web developers should just respect that and move on, not try everything the browser allows in order to ram it down their throats. Theres really no excuse for it. with browsers essentially acting as operating systems these days, you're basically trying to justify malware.
    - paulryanrogers 3y ago
      Respect user's taking without giving anything in return? IMO if users block ads then I imagine the websites are well within their rights to deny service or ask for other forms of payment.
      - alex_lav 3y ago
        > Respect user's taking without giving anything in return? Don't make something appear to be free, and then try and swindle someone down the road. Ask for money or don't. Painting a user going to an unsecured site as "taking without giving" is disingenuous. If the website is open to all, it is free, and there is no expectation of payment. > IMO if users block ads then I imagine the websites are well within their rights to deny service or ask for other forms of payment. If a site expects to be paid, make it a paid site. Block me from entering. If not, it's free, and don't put ads on it. If you want to appear free but try to force me to receive content I didn't request, I will block it. Simple as.
zagrebian 3y ago
So 28% have ad blockers (or similar blockers).
LegitShady 3y ago
the internet is more or less unusable without script and ad blockers. sorry not sorry.
Semaphor 3y ago
What’s the difference between this, and doing an XHR request to the same script with try {} catch {}? That is what we are currently doing. I guess it’s one request fewer if you need the script anyway, is there any other difference?
out-of-ideas 3y ago
hmm - i think the author is confusing all scripts from not being loaded as explicitly blocked. there are other reasons the script may not be loaded and categorizing them as 'blocked' is not an accurate label. first example would be to curl the main page; and that is certainly NOT blocking the script

49 points by Amorymeltzer 3y ago

Armed with this information I discovered the endpoint codepen hits when it detects that the ad-serving script is blocked! https://codepen.io/cpe/puppies-and-kittens?id=<id> It looked so innocuous it took me a sec to notice. You can definitely tell it's named in a way to avoid blocking rules. I appreciate the little humor too. Codepen plays nice and just uses this for logging purposes. But when other sites take more aggressive anti-ad-block measures your ad-blocker can still defeat them by silently redirecting some analytics/ad-serving JavaScipt to an internal no-op resource. That way the error handler isn't called but the JS doesn't actually run. Or the JS is replaced with a no-op equivalent. See uBlock's resource library here: https://github.com/gorhill/uBlock/wiki/Resources-Library https://github.com/gorhill/uBlock/wiki/Resources-Library (I imagine a site like codepen, with its technical audience, sees a lot more users with ad blockers.)

kevin_thibedeau 3y ago
I once felt mildly guilty about JS and ad blocking so I tried running unblocked at work since the performance degradation of all the crap was less noticeable on a fast link. That lasted a few months until I got redirected to a porn site from what was likely a hacked Wordpress system. If I'm going to be assailed by unvetted code that does unauthorized things with my property, I'm going to block everything wholesale without any lingering guilt. If you're a business and you want to serve ads do it with plain text and images. If you need to track me do it with your server logs. You don't deserve anything else.
- xp84 3y ago
  > serve ads do it with plain text and images... You don't deserve anything else Lots of ads are text and images, but they're all placed client-side using scripts, because* nobody buys ads entirely untargeted (they're ineffective). If you're a business and want a purely server-side ad system to monetize your site with, you're going to be looking for a long time. What you're saying basically amounts to "ad-supported business models online should not exist." Which is an opinion you're entitled to, but if this is your stance I'd encourage you to at least try to, for a week, block all ad-supported sites, rather than the ads, to see what the logical conclusion to your policy would be. *Note: Even without that reason, server-side would be unpopular with both publishers and ad networks because of the need to offer dozens of flavors of server-side SDKs that the publisher would have to integrate deeply into their SS code, rather than using the lingua franca of client-side JS.
  - kevin_thibedeau 3y ago
    Radio, television, and print ads are "server side". Somehow they still manage to work. We don't have to lose all of our agency just because the jerks in marketing have no ethical standards and most people aren't aware enough to stop their excesses.
    - arp242 3y ago
      I kind of agree with you, but on the other hand you either also paid for it – either directly as in newspapers or indirectly via taxes as for some public TV with limited ads – or they were plastered with ads from top to bottom. So there is perhaps a bit of a balance to be struck. When Google Ads first started way back in the day they were simple fast text ads with content relative to the page you were reading. Since then ... a lot has changed, but I don't think the basic principle of it is necessarily wrong, just the implementation. You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff.
      - brigandish 3y ago
        > You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff. How? Genuinely interested to know how this attack happens without a click from the user.
        wildpeaks 3y ago
        Using HTTP status 301/302 or HTML meta tag http-equiv="refresh". See https://en.wikipedia.org/wiki/HTTP_302 https://en.wikipedia.org/wiki/HTTP_302 and https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...
        3y ago
- saagarjha 3y ago
  I work for what’s ostensibly an advertising company, so I have made the choice to not put an adblocker on my work machine, which is pretty decent and wired into a very fast connection. The ads load pretty fast but I’ve learned to be careful about which tabs I leave open in the background.
hawski 3y ago
I would imagine that in the future ad-blocker will need to actually run the javascript, but in a separate temporary context. In Firefox terms a tab that runs in two containers at once. A shadow context for the ad-machine and content nuggets gouged out for the actual user to view.
hsbauauvhabzb 3y ago
> I appreciate the little humor too. Somebody going out of their way to name a file erroneously with the intent bypassing a security and privacy control I’ve gone out of my way to deploy is not what I’d call humour, it’s disgusting.
- varenc 3y ago
  They're only logging if the script failed to load. They just want accurate metrics on how many people are blocking the ad serving script. Personally, I want them to know I'm blocking their ads since it sends a signal to them about what I care about. It's not clear to me that all ad-block users are categorically also objecting to 1st party analytics of any sort. Most ad block rule lists don't even try to block 1st party analytics. And as I said in my comment, this only works because logging is all they're doing. If they tried to use this technique to block ad-block users it would quickly be circumvented. I understand you might not even want to signal this to them. That's why I shared the endpoint it's hitting. I want people that really don't want even this type of logging to be able to easily add a block rule. I admit in retrospect a less hidden and more obviously named endpoint would have been more polite. Personally, I really think it's a stretch to call it 'disgusting'.

jccalhoun 3y ago

Amusingly, when javascripts are blocked on his site it is a black background with white text which is easier for me to read than the color scheme with javascripts allowed

jez 3y ago
You're seeing the dark theme for the site. (I see the same thing when I click the checkbox in the top right corner of the page as when I disable JS.) Perhaps it's using JavaScript to detect that your browser is reporting that you prefer light-mode sites? Admittedly, the site could probably use CSS to make this decision as well, but I figured I'd mention it.

nr2x 3y ago

“Hey the user clearly doesn’t want this. But I’m a web developer in 2023 and the user is my enemy! How can we do something the user explicitly does not want us to do?”

xp84 3y ago
Are you saying first-party analytics of any kind are evil? Users have the right to not use the site, which is the only way users are going to leave no traces. I think you have the right to track the usage of your product. And if you are ad-supported and not a sole proprietorship, you have an obligation to your business to at least know whether your monetization strategy is failing due to your users' ad-blocking preferences. The "% who block ads" figure is vitally important in deciding, for instance, whether to offer an ad-free paid tier.
- 2h 3y ago
  Ad blocking is the anti virus of this generation. If someone is using ad blocking, especially with custom rules, they are saying, loud and clear, they DON'T WANT most JavaScript running. web developers should just respect that and move on, not try everything the browser allows in order to ram it down their throats. Theres really no excuse for it. with browsers essentially acting as operating systems these days, you're basically trying to justify malware.
  - paulryanrogers 3y ago
    Respect user's taking without giving anything in return? IMO if users block ads then I imagine the websites are well within their rights to deny service or ask for other forms of payment.
    - alex_lav 3y ago
      > Respect user's taking without giving anything in return? Don't make something appear to be free, and then try and swindle someone down the road. Ask for money or don't. Painting a user going to an unsecured site as "taking without giving" is disingenuous. If the website is open to all, it is free, and there is no expectation of payment. > IMO if users block ads then I imagine the websites are well within their rights to deny service or ask for other forms of payment. If a site expects to be paid, make it a paid site. Block me from entering. If not, it's free, and don't put ads on it. If you want to appear free but try to force me to receive content I didn't request, I will block it. Simple as.

zagrebian 3y ago

So 28% have ad blockers (or similar blockers).

LegitShady 3y ago

the internet is more or less unusable without script and ad blockers. sorry not sorry.

Semaphor 3y ago

What’s the difference between this, and doing an XHR request to the same script with try {} catch {}? That is what we are currently doing. I guess it’s one request fewer if you need the script anyway, is there any other difference?

out-of-ideas 3y ago

hmm - i think the author is confusing all scripts from not being loaded as explicitly blocked. there are other reasons the script may not be loaded and categorizing them as 'blocked' is not an accurate label. first example would be to curl the main page; and that is certainly NOT blocking the script