10 ms·

There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works,

There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works, too. Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good measure and you kill DNS-based ad blockers too. Accessibility will be a challenge but if it sells that'll get "fixed". (I think this idea is evil, BTW, but somebody is going to do it.) Edit: As an aside this needs to go here, too. https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...

GenerocUsername 3y ago
This sounds like Flutter
- streakfix 3y ago
  Flutter on web is horrible if you do it that way. There is a native renderer that renders to dom and is much faster.
hughes 3y ago
Sounds a lot like Flash.
- DaiPlusPlus 3y ago
  except without the local-system security risks
  - EvanAnderson 3y ago
    And no plug-in to download because everybody's browser has a highly-performant Javascript engine.
    - imachine1980_ 3y ago
      i don't feel having like extra virtual dom over the virtual dom of react, will make things highly-performant, god we need this doesn't happen. i wish to see the 0,1 fps react crud app, that will come from this.
    - szundi 3y ago
      This is the plugin
  - SoftTalker 3y ago
    Says who?
    - DaiPlusPlus 3y ago
      As an SWE who used to work on Internet Explorer (yeah, laugh), I know I can't say that JS is somehow impervious to possible attacks and privilege-escalation out of the browser-imposed sandbox (which can and does happen), but when one compares even the basic nature of Flash's plugin/ActiveX control vs modern browser JS engines, the threat-model and browser-vendors' mitigation strategy, it means I have easily 100x more trust in in-browser JS as a far, far "safe"-er environment than Flash.
  - dirtyhippiefree 3y ago
    [flagged]
ta8645 3y ago
I was worried from the very start of the WASM tech, that it would lead to the end of the user-controlled client. You don't even really need an embedded browser, a motivated provider could create a completely proprietary protocol for rendering their pages.
- EvanAnderson 3y ago
  A browser is nice because the provider can continue to use their whole tech stack, hosting, dev tools, etc. Just wrap it in a proxy that only wants to talk to the "inner browser".
- deleted 3y ago
  [deleted]
- thriftwy 3y ago
  That you can do trivially even today. Just show your web site using in-browser VNC client.
  - hot_gril 3y ago
    That's the final form. Kinda like video game streaming.
- autoexec 3y ago
  Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A study from a previous year had said 50% of all websites using it were malicious so the trend line isn't looking great. I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breach!" I get that it's cool tech and the promise of writing software to run on many different platforms is exciting, but from a real world/user perspective it's insane.
  - armchairhacker 3y ago
insanitybit 3y ago
People could have been doing this with JS for a long time. This is hardly the first virtual machine in JS and it seems like overkill. The far more likely way we'll see push back against Ad Blockers is by simply detecting that an Ad did not play and then refusing to display content until it does.
- rzzzt 3y ago
  How about reversing the idea? Play the ad in the WASM browser and not pass it on to the outer instance.
  - lodovic 3y ago
    the outer instance is still needed for http requests, so it can still block ads
    - None4U 3y ago
      WebTransport + encryption
- struant 3y ago
  My browser: I totally played that ad to the user. Trust me bro.
kgwxd 3y ago
The internet advertising industry needs to move past insisting that user machines have to be involved in a business relationship they have nothing to do with and no legal, or ethical, obligation to uphold. All other forms of advertising work that way. The advertiser and host need to figure out how to keep each other honest without involving passers-by.
- cyanydeez 3y ago
  Thing is, internet adtech involves a rock paper scissors evolution. It's not just a advertisement and a viewer, it's also the bots. Adtech is where it's at now just cause it wants you to see it but because a industry of faking viewership built up around it. No other advertisement has really had to deal with how ads are bought on per viewer basis. All the targeting tech is equally a response to "personalization" as it is to "fraudulent botters" You can then understand that if ads reverted to the old static billboard or tv commercial state, there's probably be little incentive to harass the user.
  - lelanthran 3y ago
    I agree that it's an arms race, but I consider static advertisements (billboard/tv type) an improvement. I think that the only way to get to the endgame I want, which is "advertisers simply give up, the sites sell the ad-space directly, with no tracking necessary and no sharing of information between sites" is for everyone to click on more ads for things that they aren't interested in. Make it a browser plugin: the plugin works quietly in the background, and clicks on every single advertisement it sees, going as far as possible in the funnel, all the way to checkout, but without doing the final payment. Until the signal/noise ratio of adverts are 99.999% noise, we're still going to have this arms race.
adtac 3y ago
Certificate pinning is easy to work around if you know which bytes to change, so that's what adblocking will be
chatmasta 3y ago
This might be something you fear, maybe even legitimately, but it seems hyperbolic to assign an equivalence to your worst fear and the passion project of an individual who made this and probably does not have any of the nefarious intentions you default to attributing to anyone who could create something resembling it.
- dackerlunghack 3y ago
  [dead]
- edg5000 3y ago
  As a developer, JavaScript does not scale due it lacking static checkability and for some, performance. So we slap TypeScript on top, which mostly solves this problem. But starting a massive browser UI project today, I think Qt on WASM + WebGPU makes a lot of technical sense. That would have the added commercial benefit of making ad blocking harder. Although the binary could be cracked by a modified browser. The eternal cat and mouse game continues.
everfree 3y ago
That sounds somewhat similar to the Chrome team's Web Environment Integrity proposal. https://news.ycombinator.com/item?id=36778999 https://news.ycombinator.com/item?id=36778999
cyanydeez 3y ago
Godel would like a word with you. https://plato.stanford.edu/entries/goedel-incompleteness/sup1.html#:~:text=A%20key%20method%20in%20the,formal%20theory%20%5C(F%5C) https://plato.stanford.edu/entries/goedel-incompleteness/sup....
- streakfix 3y ago
  By that logic emulators and virtual machines shouldn't be possible.
  - krapp 3y ago
    Are you arguing that Gödel's incompleteness theorems are trivially proven false because VMs and emulators exist?
bhaney 3y ago
At that point I'm just going to have my ad blocker block the entire "inner browser." No website that would employ such a lovecraftian horror is worth visiting anyway.
- tshaddox 3y ago
  Presumably the worry is that the big ad companies would get approximately every website in the world to use this technique, which is already the only reason web advertising is such a big problem.
  - kurtoid 3y ago
    If it becomes ubiquitous enough, I'm assuming defeating it will become automatable
  - bhaney 3y ago
    > ad companies would get approximately every website in the world to use this technique I really doubt it, but if that did happen then I could simplify my filter list to just a single wildcard. Silver lining.
    - chii 3y ago
      and stop participating in online society? Are you going to stop buying from ecommerce sites, viewing youtube, and reading your gmail? I think it's an inevitable future tbh. The users have lost - they just dont know it yet. Google's WEI [1] is their first foray into this, and i dont doubt there will be future iterations they try to push through. The browser-in-browser is but one alternative idea. [1] https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
      - matheusmoreira 3y ago
        > and stop participating in online society? Sure. This site is one of very few sites I can bear to visit. I come here for the comments, I don't even open the links anymore, I just assume people will quote anything important. When I made my own website, I deliberately set out to avoid as many of these obnoxious dark patterns as humanly possible. The result was basically a marginally improved motherfucking website and I'm actually pretty happy with it. I think that's how websites should be. If the web is gonna turn into an opaque proprietary mess for the benefit of advertisers, it doesn't even deserve to exist. > Are you going to stop buying from ecommerce sites Absolutely. I already avoid it. > viewing youtube Absolutely. I already use yt-dlp, if that stops working I'm just gonna forget about it. > and reading your gmail? I rarely read it anyway.
__MatrixMan__ 3y ago
The next step in the arms race is to provide hosted ad blocking, where the action happens (however nested) in a headless server and an AI looks it over and relays only the stuff that looks like content into a cleaned up session for the user. It would eventually start looking like a CDN where the ad blocker caches the content so it doesn't have to bother contacting the underlying site so often. I would pay for such a service.
- autoexec 3y ago
  I wouldn't, because sending all of your browsing history to any third party is going to result in them mining and selling it, or exposing it to state actors or someone else for direct surveillance/malware injection. Eventually, AI will be something we can run locally on a typical desktop, or even a cell phone, and at that point we could locally host that kind of ad blocking, but trusting all of your traffic to some random company that promises to delete ads but not abuse their position seems naive given our situation today. It preserves the worst dangers of ads while adding even less control and transparency for the user.
  - danielheath 3y ago
    I’ve been interested in a desktop AI ad blocker for awhile, but it doesn’t solve the issue of malware being distributed via ad networks, or the performance impact of all that extra js and network traffic.
    - __MatrixMan__ 3y ago
      I think it does. Run the whole thing in a sandbox and have the AI exfiltrate the content (but not the ads) as a static DOM (no js). Once you know which DOMs go with which URL's you can gossip those peer-to-peer and not bother actually talking to the site at all (although one of us should hit the actual site every now and then, just in case the content changes). Isn't that more or less how cloudflare works?
  - snoman 3y ago
    I believe (but do not know) that ad networks already do some of that.
tshaddox 3y ago
> Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good measure and you kill DNS-based ad blockers too. I'm confused how the "inner browser" meaningfully helps you accomplish this. How is this any easier or more effective than just having a website that hosts its own advertising assets (or proxies them) and obfuscates/randomizes its DOM structure to make ads difficult to target with simplistic ad-blocking rules?
- ilyt 3y ago
  Well the idea is stupid and makes no sense but > How is this any easier or more effective than just having a website that hosts its own advertising assets advertisers REALLY don't want you to do that because it's far too easy to cheat.
  - lucasyvas 3y ago
    Well they can't have it both ways. They can either play wackamole with consumers or their customers.
  - lelanthran 3y ago
    > advertisers REALLY don't want you to do that because it's far too easy to cheat. I expect that they are already cheating as much as possible to convince their customers to continue paying for advertising that has a negligible effect on the bottom line. Adtech and PR firms would have you believe that it is impossible to sell a product or service online without first paying them $10k/m. It's also why google search is so awful - if they could get you the information you were looking for they are sidelining their customers, so their search has to, by design, be limited so that their customers are more prominent in the search results than non-customers. Note: I'm not saying that this is by design; they could get to this stable equilibrium simply by each isolated team within search, advertising, etc aggressively pursuing its own metrics.
- teruakohatu 3y ago
  > I'm confused how the "inner browser" meaningfully helps you accomplish this. Right not it is not hard to write an adblocker, just block network requests and DOM elements (regardless of whom hosts of proxies them). A browser in a browser would make blocking dom as hard as attaching a debugger and manipulating a price that has been hardened. Network requests may still be able to be blocked, but it is going to make ad blocking harder.
basch 3y ago
Pre-render the whole site to a server side canvas and then redraw it.
- I_Am_Nous 3y ago
  iFrame 2.0
  - doublerabbit 3y ago
    Not sure why the downvotes. iFrames does need a revolution. iFrame, yet how clunky, ghastly to work with; is what driving the web. Gmail, Facebook all use them in their apps. It's a feature that if deprecated would cause a broken World Wide Web; as if it isn't broken already... One could say.
    - I_Am_Nous 3y ago
      Reaching into my pessimistic, dark side - if we transition to most processing being done in the cloud, such that we eventually give up powerful devices for simpler cloud AI terminals in general, I could see the concept of the "client" side also living in the cloud, similar to cloud gaming. In that case, the internet would be more like cable where you just accept the commercials because you can also watch ninja turtles in between them.
- amlib 3y ago
  Flutter is one step from becoming that... I guess that's why google pushes it so much
  - basch 3y ago
    Flipboard's react-canvas https://github.com/Flipboard/react-canvas https://github.com/Flipboard/react-canvas
jjtheblunt 3y ago
It sounds really slow?
- alpaca128 3y ago
  That hasn't stopped any ad-focused web designer yet.
keepamovin 3y ago
Some people are already building this using BrowserBox as the embedded browser layer. Like a reverse proxy inside the browser, but with a server component. When i first heard about their idea I couldn’t really comprehend it, and actually I still find it hard to understand. But they think it will be big! https://dosyago.com/ https://dosyago.com/ https://github.com/BrowserBox/BrowserBox https://github.com/BrowserBox/BrowserBox
lucasyvas 3y ago
I think this evokes the static vs dynamic linking argument again though. If you consider your browser client code as your "source code" and the browser as a "dynamically linked library", then there are substantial pros and cons. Your proposal, while feasible, turns this into a static linking affair. This comes with many risks, like becoming complacent and not updating the "inner browser" due to browser incompatibilities and bugs. It creates a giant mess of dependency update hell if you aren't regularly updating the webview. At that point, you might as well ship a desktop app that does something similar and proxies ads through the first party server since it's probably less work. You are right that it would work. I just don't know if going to such lengths is required to achieve the same thing. A good counter is that a desktop app could be exploited to alter the behavior via reverse engineering. But a browser would show you the WASM as well, so I'm sure you could reverse engineer it and alter it with an extension like a traditional binary. Maybe I'm missing something though - I'll admit that I'm an advocate of WASM but don't keep super up to date on all advancements.
- chii 3y ago
  > ship a desktop app user doesn't want to download an app, since that has a lot of friction. Going to a url and waiting (even if the download time is the same) feels like there's less friction, and so this idea of shipping a blackbox is more desirable. The only problem really is the jankiness of any non-browser controls. The user expects a good right-click context menu, keyboard navigation, scrolling, etc, which all would have to be implemented if you're compiling a native app into WASM. But if the app itself is just HTML+javascript, then shipping a WASM browser, then using that browser as the app layer solves all of those UX jankiness (since the user should not really be able to tell it's a WASM browser). The idea is insidiouly bad for user freedom, but great for businesses like google (who wants to control the user space completely).
m1sta_ 3y ago
This is an unnecessarily complicated way to block adverts. Just proxy them through the site the user is visiting. Done.
matheusmoreira 3y ago
Hopefully that will be literally illegal due to accessibility concerns. Doesn't matter either way. Can't wait for AI-powered ad blocking. Just imagine it. AI parses content and filters out ads, brands, even subtle PR text from pages automatically. Not just textual content either. It also kills ads in audio, video, images. If I can imagine it, it must be possible. I'm sure someone much smarter than me will create this at some point. Perhaps this comment will inspire that person.
- akoboldfrying 3y ago
  If AI-powered ad blocking becomes ubiquitous, it will mean the end of high-quality free services like Google Search, Gmail, Google Maps, Google Translate and YouTube, for all of which I much prefer to pay with my attention rather than cold, hard cash. I have no doubt that current AI is capable of this (in fact I'm sure it would be trivial for GPT-3.5 and well within reach of even locally-run LLMs), the question is what fraction of users can be bothered -- and I don't see any reason why AI would lead to an increase there.
  - matheusmoreira 3y ago
    > it will mean the end of high-quality free services So be it. If those services can't survive without ads and surveillance capitalism, they don't deserve to exist.
    - akoboldfrying 3y ago
      I guess we disagree on whether advertising goods and services to people should be considered a crime.
      - SoftTalker 3y ago
        Advertising no. Tracking individuals and building profiles about them across the web, much less clear, probably yes.
WirelessGigabit 3y ago
I don't think wasm can do sockets. So for now we're safe from this dystopian future. For now.
Obscurity4340 3y ago
I need someone much smarter and more willing to engage on this issue to explain this remark or set it straight, pretty please and pretty-thank-you in advance
- mjburgess 3y ago
  Think of the browser as an operating system, and a web page as an app. If that app is another browser, custom built, it could be built to prevent adblockers. Inasmuch as any app, eg., a video player, can include DRM or otherwise lock things down. This is feasible, but its unclear how successful it would be -- it would just start an arms race to hack it.
giantrobot 3y ago
That used to be called Flash.
wodenokoto 3y ago
I don’t understand why ads aren’t just served from same origin as the rest of the content. Seems to work great for YouTube creators, while YouTube itself is fighting
kaba0 3y ago
It’s much easier to just ship a WASM blob that renders to canvas. You can throw in a bit of obfuscation (LLVM can do that). But even without WASM, there is the “tiktok strategy”, of pushing bytecode to a self-made interpreter, that frequently changes its semantics.
alreadyhere2 3y ago
It's happened already: https://earth.google.com https://earth.google.com is a Flutter app that's entirely drawn in a canvas. Its accessibility sucks. Things that you use to be able to copy and paste like names of places or phone numbers etc you no longer can. It's horrifying. Accessibility or translation extensions have nothing to look at. It's also the new flash since like flash it's just a bucket of pixels. Like when say VisionOS comes out and their browser has made tweaks to all the HTML form elements so they work well with finger gestures in the air but of course here this page is just a block of pixels so it will have the wrong interface for the device.
- Intralexical 3y ago
  Hell, even Google Docs suite is just one big Canvas these days, last I checked.
  - extra88 3y ago
    Yes, and it has to recreate a lot of what a browser does (given semantic code) to preserve keyboard-only operation and usability with a screen reader.
- eternityforest 3y ago
  I can't believe how many people seem to be excited about this whole WebAssembly Bring Your Own Everything stuff. Every time there's an article about some kind of "Here's a really simple core to build stuff from scratch" technology people seem to get really excited. I was hoping we'd be going the other way and building web tech into OSes!

GenerocUsername 3y ago

This sounds like Flutter

streakfix 3y ago
Flutter on web is horrible if you do it that way. There is a native renderer that renders to dom and is much faster.

hughes 3y ago

Sounds a lot like Flash.

DaiPlusPlus 3y ago
except without the local-system security risks
- EvanAnderson 3y ago
  And no plug-in to download because everybody's browser has a highly-performant Javascript engine.
  - imachine1980_ 3y ago
    i don't feel having like extra virtual dom over the virtual dom of react, will make things highly-performant, god we need this doesn't happen. i wish to see the 0,1 fps react crud app, that will come from this.
  - szundi 3y ago
    This is the plugin
- SoftTalker 3y ago
  Says who?
  - DaiPlusPlus 3y ago
    As an SWE who used to work on Internet Explorer (yeah, laugh), I know I can't say that JS is somehow impervious to possible attacks and privilege-escalation out of the browser-imposed sandbox (which can and does happen), but when one compares even the basic nature of Flash's plugin/ActiveX control vs modern browser JS engines, the threat-model and browser-vendors' mitigation strategy, it means I have easily 100x more trust in in-browser JS as a far, far "safe"-er environment than Flash.
- dirtyhippiefree 3y ago
  [flagged]

ta8645 3y ago

I was worried from the very start of the WASM tech, that it would lead to the end of the user-controlled client. You don't even really need an embedded browser, a motivated provider could create a completely proprietary protocol for rendering their pages.

EvanAnderson 3y ago
A browser is nice because the provider can continue to use their whole tech stack, hosting, dev tools, etc. Just wrap it in a proxy that only wants to talk to the "inner browser".
deleted 3y ago
[deleted]
thriftwy 3y ago
That you can do trivially even today. Just show your web site using in-browser VNC client.
- hot_gril 3y ago
  That's the final form. Kinda like video game streaming.
autoexec 3y ago
Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A study from a previous year had said 50% of all websites using it were malicious so the trend line isn't looking great. I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breach!" I get that it's cool tech and the promise of writing software to run on many different platforms is exciting, but from a real world/user perspective it's insane.
- armchairhacker 3y ago

insanitybit 3y ago

People could have been doing this with JS for a long time. This is hardly the first virtual machine in JS and it seems like overkill. The far more likely way we'll see push back against Ad Blockers is by simply detecting that an Ad did not play and then refusing to display content until it does.

rzzzt 3y ago
How about reversing the idea? Play the ad in the WASM browser and not pass it on to the outer instance.
- lodovic 3y ago
  the outer instance is still needed for http requests, so it can still block ads
  - None4U 3y ago
    WebTransport + encryption
struant 3y ago
My browser: I totally played that ad to the user. Trust me bro.

kgwxd 3y ago

The internet advertising industry needs to move past insisting that user machines have to be involved in a business relationship they have nothing to do with and no legal, or ethical, obligation to uphold. All other forms of advertising work that way. The advertiser and host need to figure out how to keep each other honest without involving passers-by.

cyanydeez 3y ago
Thing is, internet adtech involves a rock paper scissors evolution. It's not just a advertisement and a viewer, it's also the bots. Adtech is where it's at now just cause it wants you to see it but because a industry of faking viewership built up around it. No other advertisement has really had to deal with how ads are bought on per viewer basis. All the targeting tech is equally a response to "personalization" as it is to "fraudulent botters" You can then understand that if ads reverted to the old static billboard or tv commercial state, there's probably be little incentive to harass the user.
- lelanthran 3y ago
  I agree that it's an arms race, but I consider static advertisements (billboard/tv type) an improvement. I think that the only way to get to the endgame I want, which is "advertisers simply give up, the sites sell the ad-space directly, with no tracking necessary and no sharing of information between sites" is for everyone to click on more ads for things that they aren't interested in. Make it a browser plugin: the plugin works quietly in the background, and clicks on every single advertisement it sees, going as far as possible in the funnel, all the way to checkout, but without doing the final payment. Until the signal/noise ratio of adverts are 99.999% noise, we're still going to have this arms race.

adtac 3y ago

Certificate pinning is easy to work around if you know which bytes to change, so that's what adblocking will be

chatmasta 3y ago

This might be something you fear, maybe even legitimately, but it seems hyperbolic to assign an equivalence to your worst fear and the passion project of an individual who made this and probably does not have any of the nefarious intentions you default to attributing to anyone who could create something resembling it.

dackerlunghack 3y ago
[dead]
edg5000 3y ago
As a developer, JavaScript does not scale due it lacking static checkability and for some, performance. So we slap TypeScript on top, which mostly solves this problem. But starting a massive browser UI project today, I think Qt on WASM + WebGPU makes a lot of technical sense. That would have the added commercial benefit of making ad blocking harder. Although the binary could be cracked by a modified browser. The eternal cat and mouse game continues.

everfree 3y ago

That sounds somewhat similar to the Chrome team's Web Environment Integrity proposal. https://news.ycombinator.com/item?id=36778999 https://news.ycombinator.com/item?id=36778999

cyanydeez 3y ago

Godel would like a word with you. https://plato.stanford.edu/entries/goedel-incompleteness/sup1.html#:~:text=A%20key%20method%20in%20the,formal%20theory%20%5C(F%5C) https://plato.stanford.edu/entries/goedel-incompleteness/sup....

streakfix 3y ago
By that logic emulators and virtual machines shouldn't be possible.
- krapp 3y ago
  Are you arguing that Gödel's incompleteness theorems are trivially proven false because VMs and emulators exist?

bhaney 3y ago

At that point I'm just going to have my ad blocker block the entire "inner browser." No website that would employ such a lovecraftian horror is worth visiting anyway.

tshaddox 3y ago
Presumably the worry is that the big ad companies would get approximately every website in the world to use this technique, which is already the only reason web advertising is such a big problem.
- kurtoid 3y ago
  If it becomes ubiquitous enough, I'm assuming defeating it will become automatable
- bhaney 3y ago
  > ad companies would get approximately every website in the world to use this technique I really doubt it, but if that did happen then I could simplify my filter list to just a single wildcard. Silver lining.
  - chii 3y ago
    and stop participating in online society? Are you going to stop buying from ecommerce sites, viewing youtube, and reading your gmail? I think it's an inevitable future tbh. The users have lost - they just dont know it yet. Google's WEI [1] is their first foray into this, and i dont doubt there will be future iterations they try to push through. The browser-in-browser is but one alternative idea. [1] https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
    - matheusmoreira 3y ago
      > and stop participating in online society? Sure. This site is one of very few sites I can bear to visit. I come here for the comments, I don't even open the links anymore, I just assume people will quote anything important. When I made my own website, I deliberately set out to avoid as many of these obnoxious dark patterns as humanly possible. The result was basically a marginally improved motherfucking website and I'm actually pretty happy with it. I think that's how websites should be. If the web is gonna turn into an opaque proprietary mess for the benefit of advertisers, it doesn't even deserve to exist. > Are you going to stop buying from ecommerce sites Absolutely. I already avoid it. > viewing youtube Absolutely. I already use yt-dlp, if that stops working I'm just gonna forget about it. > and reading your gmail? I rarely read it anyway.

__MatrixMan__ 3y ago

The next step in the arms race is to provide hosted ad blocking, where the action happens (however nested) in a headless server and an AI looks it over and relays only the stuff that looks like content into a cleaned up session for the user. It would eventually start looking like a CDN where the ad blocker caches the content so it doesn't have to bother contacting the underlying site so often. I would pay for such a service.

autoexec 3y ago
I wouldn't, because sending all of your browsing history to any third party is going to result in them mining and selling it, or exposing it to state actors or someone else for direct surveillance/malware injection. Eventually, AI will be something we can run locally on a typical desktop, or even a cell phone, and at that point we could locally host that kind of ad blocking, but trusting all of your traffic to some random company that promises to delete ads but not abuse their position seems naive given our situation today. It preserves the worst dangers of ads while adding even less control and transparency for the user.
- danielheath 3y ago
  I’ve been interested in a desktop AI ad blocker for awhile, but it doesn’t solve the issue of malware being distributed via ad networks, or the performance impact of all that extra js and network traffic.
  - __MatrixMan__ 3y ago
    I think it does. Run the whole thing in a sandbox and have the AI exfiltrate the content (but not the ads) as a static DOM (no js). Once you know which DOMs go with which URL's you can gossip those peer-to-peer and not bother actually talking to the site at all (although one of us should hit the actual site every now and then, just in case the content changes). Isn't that more or less how cloudflare works?
- snoman 3y ago
  I believe (but do not know) that ad networks already do some of that.

tshaddox 3y ago

> Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good measure and you kill DNS-based ad blockers too. I'm confused how the "inner browser" meaningfully helps you accomplish this. How is this any easier or more effective than just having a website that hosts its own advertising assets (or proxies them) and obfuscates/randomizes its DOM structure to make ads difficult to target with simplistic ad-blocking rules?

ilyt 3y ago
Well the idea is stupid and makes no sense but > How is this any easier or more effective than just having a website that hosts its own advertising assets advertisers REALLY don't want you to do that because it's far too easy to cheat.
- lucasyvas 3y ago
  Well they can't have it both ways. They can either play wackamole with consumers or their customers.
- lelanthran 3y ago
  > advertisers REALLY don't want you to do that because it's far too easy to cheat. I expect that they are already cheating as much as possible to convince their customers to continue paying for advertising that has a negligible effect on the bottom line. Adtech and PR firms would have you believe that it is impossible to sell a product or service online without first paying them $10k/m. It's also why google search is so awful - if they could get you the information you were looking for they are sidelining their customers, so their search has to, by design, be limited so that their customers are more prominent in the search results than non-customers. Note: I'm not saying that this is by design; they could get to this stable equilibrium simply by each isolated team within search, advertising, etc aggressively pursuing its own metrics.
teruakohatu 3y ago
> I'm confused how the "inner browser" meaningfully helps you accomplish this. Right not it is not hard to write an adblocker, just block network requests and DOM elements (regardless of whom hosts of proxies them). A browser in a browser would make blocking dom as hard as attaching a debugger and manipulating a price that has been hardened. Network requests may still be able to be blocked, but it is going to make ad blocking harder.

basch 3y ago

Pre-render the whole site to a server side canvas and then redraw it.

I_Am_Nous 3y ago
iFrame 2.0
- doublerabbit 3y ago
  Not sure why the downvotes. iFrames does need a revolution. iFrame, yet how clunky, ghastly to work with; is what driving the web. Gmail, Facebook all use them in their apps. It's a feature that if deprecated would cause a broken World Wide Web; as if it isn't broken already... One could say.
  - I_Am_Nous 3y ago
    Reaching into my pessimistic, dark side - if we transition to most processing being done in the cloud, such that we eventually give up powerful devices for simpler cloud AI terminals in general, I could see the concept of the "client" side also living in the cloud, similar to cloud gaming. In that case, the internet would be more like cable where you just accept the commercials because you can also watch ninja turtles in between them.
amlib 3y ago
Flutter is one step from becoming that... I guess that's why google pushes it so much
- basch 3y ago
  Flipboard's react-canvas https://github.com/Flipboard/react-canvas https://github.com/Flipboard/react-canvas

jjtheblunt 3y ago

It sounds really slow?

alpaca128 3y ago
That hasn't stopped any ad-focused web designer yet.

keepamovin 3y ago

Some people are already building this using BrowserBox as the embedded browser layer. Like a reverse proxy inside the browser, but with a server component. When i first heard about their idea I couldn’t really comprehend it, and actually I still find it hard to understand. But they think it will be big! https://dosyago.com/ https://dosyago.com/ https://github.com/BrowserBox/BrowserBox https://github.com/BrowserBox/BrowserBox

lucasyvas 3y ago

I think this evokes the static vs dynamic linking argument again though. If you consider your browser client code as your "source code" and the browser as a "dynamically linked library", then there are substantial pros and cons. Your proposal, while feasible, turns this into a static linking affair. This comes with many risks, like becoming complacent and not updating the "inner browser" due to browser incompatibilities and bugs. It creates a giant mess of dependency update hell if you aren't regularly updating the webview. At that point, you might as well ship a desktop app that does something similar and proxies ads through the first party server since it's probably less work. You are right that it would work. I just don't know if going to such lengths is required to achieve the same thing. A good counter is that a desktop app could be exploited to alter the behavior via reverse engineering. But a browser would show you the WASM as well, so I'm sure you could reverse engineer it and alter it with an extension like a traditional binary. Maybe I'm missing something though - I'll admit that I'm an advocate of WASM but don't keep super up to date on all advancements.

chii 3y ago
> ship a desktop app user doesn't want to download an app, since that has a lot of friction. Going to a url and waiting (even if the download time is the same) feels like there's less friction, and so this idea of shipping a blackbox is more desirable. The only problem really is the jankiness of any non-browser controls. The user expects a good right-click context menu, keyboard navigation, scrolling, etc, which all would have to be implemented if you're compiling a native app into WASM. But if the app itself is just HTML+javascript, then shipping a WASM browser, then using that browser as the app layer solves all of those UX jankiness (since the user should not really be able to tell it's a WASM browser). The idea is insidiouly bad for user freedom, but great for businesses like google (who wants to control the user space completely).

m1sta_ 3y ago

This is an unnecessarily complicated way to block adverts. Just proxy them through the site the user is visiting. Done.

matheusmoreira 3y ago

Hopefully that will be literally illegal due to accessibility concerns. Doesn't matter either way. Can't wait for AI-powered ad blocking. Just imagine it. AI parses content and filters out ads, brands, even subtle PR text from pages automatically. Not just textual content either. It also kills ads in audio, video, images. If I can imagine it, it must be possible. I'm sure someone much smarter than me will create this at some point. Perhaps this comment will inspire that person.

akoboldfrying 3y ago
If AI-powered ad blocking becomes ubiquitous, it will mean the end of high-quality free services like Google Search, Gmail, Google Maps, Google Translate and YouTube, for all of which I much prefer to pay with my attention rather than cold, hard cash. I have no doubt that current AI is capable of this (in fact I'm sure it would be trivial for GPT-3.5 and well within reach of even locally-run LLMs), the question is what fraction of users can be bothered -- and I don't see any reason why AI would lead to an increase there.
- matheusmoreira 3y ago
  > it will mean the end of high-quality free services So be it. If those services can't survive without ads and surveillance capitalism, they don't deserve to exist.
  - akoboldfrying 3y ago
    I guess we disagree on whether advertising goods and services to people should be considered a crime.
    - SoftTalker 3y ago
      Advertising no. Tracking individuals and building profiles about them across the web, much less clear, probably yes.

WirelessGigabit 3y ago

I don't think wasm can do sockets. So for now we're safe from this dystopian future. For now.

Obscurity4340 3y ago

I need someone much smarter and more willing to engage on this issue to explain this remark or set it straight, pretty please and pretty-thank-you in advance

mjburgess 3y ago
Think of the browser as an operating system, and a web page as an app. If that app is another browser, custom built, it could be built to prevent adblockers. Inasmuch as any app, eg., a video player, can include DRM or otherwise lock things down. This is feasible, but its unclear how successful it would be -- it would just start an arms race to hack it.

giantrobot 3y ago

That used to be called Flash.

wodenokoto 3y ago

I don’t understand why ads aren’t just served from same origin as the rest of the content. Seems to work great for YouTube creators, while YouTube itself is fighting

kaba0 3y ago

It’s much easier to just ship a WASM blob that renders to canvas. You can throw in a bit of obfuscation (LLVM can do that). But even without WASM, there is the “tiktok strategy”, of pushing bytecode to a self-made interpreter, that frequently changes its semantics.

alreadyhere2 3y ago

It's happened already: https://earth.google.com https://earth.google.com is a Flutter app that's entirely drawn in a canvas. Its accessibility sucks. Things that you use to be able to copy and paste like names of places or phone numbers etc you no longer can. It's horrifying. Accessibility or translation extensions have nothing to look at. It's also the new flash since like flash it's just a bucket of pixels. Like when say VisionOS comes out and their browser has made tweaks to all the HTML form elements so they work well with finger gestures in the air but of course here this page is just a block of pixels so it will have the wrong interface for the device.

Intralexical 3y ago
Hell, even Google Docs suite is just one big Canvas these days, last I checked.
- extra88 3y ago
  Yes, and it has to recreate a lot of what a browser does (given semantic code) to preserve keyboard-only operation and usability with a screen reader.
eternityforest 3y ago
I can't believe how many people seem to be excited about this whole WebAssembly Bring Your Own Everything stuff. Every time there's an article about some kind of "Here's a really simple core to build stuff from scratch" technology people seem to get really excited. I was hoping we'd be going the other way and building web tech into OSes!