4 ms·

Armed with this information I discovered the endpoint codepen hits when it detects that the ad-serving script is blocked! https://codepen.io/cpe/puppies-an

by varenc 3y ago

Armed with this information I discovered the endpoint codepen hits when it detects that the ad-serving script is blocked! https://codepen.io/cpe/puppies-and-kittens?id=<id> It looked so innocuous it took me a sec to notice. You can definitely tell it's named in a way to avoid blocking rules. I appreciate the little humor too. Codepen plays nice and just uses this for logging purposes. But when other sites take more aggressive anti-ad-block measures your ad-blocker can still defeat them by silently redirecting some analytics/ad-serving JavaScipt to an internal no-op resource. That way the error handler isn't called but the JS doesn't actually run. Or the JS is replaced with a no-op equivalent. See uBlock's resource library here: https://github.com/gorhill/uBlock/wiki/Resources-Library https://github.com/gorhill/uBlock/wiki/Resources-Library (I imagine a site like codepen, with its technical audience, sees a lot more users with ad blockers.)

kevin_thibedeau 3y ago
I once felt mildly guilty about JS and ad blocking so I tried running unblocked at work since the performance degradation of all the crap was less noticeable on a fast link. That lasted a few months until I got redirected to a porn site from what was likely a hacked Wordpress system. If I'm going to be assailed by unvetted code that does unauthorized things with my property, I'm going to block everything wholesale without any lingering guilt. If you're a business and you want to serve ads do it with plain text and images. If you need to track me do it with your server logs. You don't deserve anything else.
- xp84 3y ago
  > serve ads do it with plain text and images... You don't deserve anything else Lots of ads are text and images, but they're all placed client-side using scripts, because* nobody buys ads entirely untargeted (they're ineffective). If you're a business and want a purely server-side ad system to monetize your site with, you're going to be looking for a long time. What you're saying basically amounts to "ad-supported business models online should not exist." Which is an opinion you're entitled to, but if this is your stance I'd encourage you to at least try to, for a week, block all ad-supported sites, rather than the ads, to see what the logical conclusion to your policy would be. *Note: Even without that reason, server-side would be unpopular with both publishers and ad networks because of the need to offer dozens of flavors of server-side SDKs that the publisher would have to integrate deeply into their SS code, rather than using the lingua franca of client-side JS.
  - kevin_thibedeau 3y ago
    Radio, television, and print ads are "server side". Somehow they still manage to work. We don't have to lose all of our agency just because the jerks in marketing have no ethical standards and most people aren't aware enough to stop their excesses.
    - arp242 3y ago
      I kind of agree with you, but on the other hand you either also paid for it – either directly as in newspapers or indirectly via taxes as for some public TV with limited ads – or they were plastered with ads from top to bottom. So there is perhaps a bit of a balance to be struck. When Google Ads first started way back in the day they were simple fast text ads with content relative to the page you were reading. Since then ... a lot has changed, but I don't think the basic principle of it is necessarily wrong, just the implementation. You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff.
      - brigandish 3y ago
        > You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff. How? Genuinely interested to know how this attack happens without a click from the user.
        wildpeaks 3y ago
        Using HTTP status 301/302 or HTML meta tag http-equiv="refresh". See https://en.wikipedia.org/wiki/HTTP_302 https://en.wikipedia.org/wiki/HTTP_302 and https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...
        3y ago
- saagarjha 3y ago
  I work for what’s ostensibly an advertising company, so I have made the choice to not put an adblocker on my work machine, which is pretty decent and wired into a very fast connection. The ads load pretty fast but I’ve learned to be careful about which tabs I leave open in the background.
hawski 3y ago
I would imagine that in the future ad-blocker will need to actually run the javascript, but in a separate temporary context. In Firefox terms a tab that runs in two containers at once. A shadow context for the ad-machine and content nuggets gouged out for the actual user to view.
hsbauauvhabzb 3y ago
> I appreciate the little humor too. Somebody going out of their way to name a file erroneously with the intent bypassing a security and privacy control I’ve gone out of my way to deploy is not what I’d call humour, it’s disgusting.
- varenc 3y ago
  They're only logging if the script failed to load. They just want accurate metrics on how many people are blocking the ad serving script. Personally, I want them to know I'm blocking their ads since it sends a signal to them about what I care about. It's not clear to me that all ad-block users are categorically also objecting to 1st party analytics of any sort. Most ad block rule lists don't even try to block 1st party analytics. And as I said in my comment, this only works because logging is all they're doing. If they tried to use this technique to block ad-block users it would quickly be circumvented. I understand you might not even want to signal this to them. That's why I shared the endpoint it's hitting. I want people that really don't want even this type of logging to be able to easily add a block rule. I admit in retrospect a less hidden and more obviously named endpoint would have been more polite. Personally, I really think it's a stretch to call it 'disgusting'.

by varenc 3y ago

kevin_thibedeau 3y ago

I once felt mildly guilty about JS and ad blocking so I tried running unblocked at work since the performance degradation of all the crap was less noticeable on a fast link. That lasted a few months until I got redirected to a porn site from what was likely a hacked Wordpress system. If I'm going to be assailed by unvetted code that does unauthorized things with my property, I'm going to block everything wholesale without any lingering guilt. If you're a business and you want to serve ads do it with plain text and images. If you need to track me do it with your server logs. You don't deserve anything else.

xp84 3y ago
> serve ads do it with plain text and images... You don't deserve anything else Lots of ads are text and images, but they're all placed client-side using scripts, because* nobody buys ads entirely untargeted (they're ineffective). If you're a business and want a purely server-side ad system to monetize your site with, you're going to be looking for a long time. What you're saying basically amounts to "ad-supported business models online should not exist." Which is an opinion you're entitled to, but if this is your stance I'd encourage you to at least try to, for a week, block all ad-supported sites, rather than the ads, to see what the logical conclusion to your policy would be. *Note: Even without that reason, server-side would be unpopular with both publishers and ad networks because of the need to offer dozens of flavors of server-side SDKs that the publisher would have to integrate deeply into their SS code, rather than using the lingua franca of client-side JS.
- kevin_thibedeau 3y ago
  Radio, television, and print ads are "server side". Somehow they still manage to work. We don't have to lose all of our agency just because the jerks in marketing have no ethical standards and most people aren't aware enough to stop their excesses.
  - arp242 3y ago
    I kind of agree with you, but on the other hand you either also paid for it – either directly as in newspapers or indirectly via taxes as for some public TV with limited ads – or they were plastered with ads from top to bottom. So there is perhaps a bit of a balance to be struck. When Google Ads first started way back in the day they were simple fast text ads with content relative to the page you were reading. Since then ... a lot has changed, but I don't think the basic principle of it is necessarily wrong, just the implementation. You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff.
    - brigandish 3y ago
      > You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff. How? Genuinely interested to know how this attack happens without a click from the user.
      - wildpeaks 3y ago
        Using HTTP status 301/302 or HTML meta tag http-equiv="refresh". See https://en.wikipedia.org/wiki/HTTP_302 https://en.wikipedia.org/wiki/HTTP_302 and https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...
        3y ago
saagarjha 3y ago
I work for what’s ostensibly an advertising company, so I have made the choice to not put an adblocker on my work machine, which is pretty decent and wired into a very fast connection. The ads load pretty fast but I’ve learned to be careful about which tabs I leave open in the background.

hawski 3y ago

I would imagine that in the future ad-blocker will need to actually run the javascript, but in a separate temporary context. In Firefox terms a tab that runs in two containers at once. A shadow context for the ad-machine and content nuggets gouged out for the actual user to view.

hsbauauvhabzb 3y ago

> I appreciate the little humor too. Somebody going out of their way to name a file erroneously with the intent bypassing a security and privacy control I’ve gone out of my way to deploy is not what I’d call humour, it’s disgusting.

varenc 3y ago
They're only logging if the script failed to load. They just want accurate metrics on how many people are blocking the ad serving script. Personally, I want them to know I'm blocking their ads since it sends a signal to them about what I care about. It's not clear to me that all ad-block users are categorically also objecting to 1st party analytics of any sort. Most ad block rule lists don't even try to block 1st party analytics. And as I said in my comment, this only works because logging is all they're doing. If they tried to use this technique to block ad-block users it would quickly be circumvented. I understand you might not even want to signal this to them. That's why I shared the endpoint it's hitting. I want people that really don't want even this type of logging to be able to easily add a block rule. I admit in retrospect a less hidden and more obviously named endpoint would have been more polite. Personally, I really think it's a stretch to call it 'disgusting'.