15 ms·
Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses
- guitarlimeo 3y agoThis makes sense, but I guess adblockers could just start loading the data and not show it to the user?
- cornedor 3y agoCan this also be solved by completely blocking early hints?
- eli 3y agoOr just not ad blocking early hints, as Chrome seems to do.
- happymellon 3y agoWasn't this basically what AdBlock Plus did back in the day? Load a page and replace everything that matched with an empty div when rendering.
- josephcsible 3y agoFor people on metered Internet connections, that gives up a lot of the benefit of having an ad blocker at all.
- hunter2_ 3y agoCould run the ad blocker as a MITM proxy on an unmetered fast connection (e.g. residential), and it serves the lightweight modified version over your metered slow connection (e.g. mobile).
- yjftsjthsd-h 3y agoPart of the goal of content blocking is to reduce network traffic, so that's not an ideal outcome.
- treyd 3y agoIt would still achieve the primary goal.
- lelanthran 3y ago> Part of the goal of content blocking is to reduce network traffic, so that's not an ideal outcome. Not in the short term, no. But, maybe in the long term ... Remember that the user is not the customer. The customer is the person buying the ad space from google/facebook/etc. If the customer receives no value for their money, and they can easily determine that, why would they continue purchasing ads? If every browser downloaded and clicked every single ad in an invisible background and sandboxed process, ads become close to worthless to the customer. So, sure, in the short term there'd be extra processing and network usage, but that would quickly taper off as customers stopped buying ads because every single ad they put out gets a 100% click-rate. After a while the extra utilisation would be close to zero, as it would only be the occasional customer trying their luck at advertising, and failing immediately. It's the same with spam email: the solution isn't to block, and keep lists and reputation, the solution is to reply to every single spam email![1] Even the most well-run spamming/scamming organisation can't very well reply to millions of emails rxed per hour. [1] Caveat: need to ensure that the sending email did indeed legitimately send the email, otherwise a few clowns would simply send spam with someone else's email as a prank.
- ukoki 3y agoAs an adblock user, reduction of network traffic is of very minor benefit to me. I block ads because I find them annoying.
- HWR_14 3y agoYou would still get the resources loading. So both the extra usage of a metered/limited bandwidth and the tracking.
- lifthrasiir 3y agoPrefetching is a low-priority operation in general, so you can't rely on the fact that prefetching happens earlier than the page loading (the diagram is quite misleading in this aspect). Therefore one alternative might be to start loading prefetched but blocked resources but arbitrarily delay it until the page loading finishes, at which time blocked connections get closed.
- kevmo314 3y agoTIL about HTTP 103, that's pretty neat. It seems pretty easy to mitigate this by always loading the early hints though, as in Firefox should adopt Chrome's approach as described in the README.
- hedora 3y agoSounds like it might make sense to drop this early hints feature (whatever it is). I wonder how much longer it will be before the next major escalation happens with ad blockers. I can imagine mainstream browsers that fetch unmodified pages and click ads in the background (do subvert pay per click ad business models and make it harder to compute targeting metrics), but then display an ad/tracking-free version in a separate rendering pipeline.
- guitarlimeo 3y agoAs far as I know, current ad blockers can't block ads from Widevine (DRM protected) streams, so I guess it's only a matter of time until Chromium team comes up with Widevine for webpages and then it's game over for normal consumers.
- allendoerfer 3y agoDon't be evil.
- bawolff 3y agoWhile i know its evil, i always wished widevine was an option for creating captchas. Most captcha solutions are defeated by services like 2captcha.net and generally aren't the most privacy respecting.
- Semaphor 3y agoMost captcha solutions are also hard for me, but easy for computers to solve. So I really hope their use doesn’t get expanded even further…
- kedean 3y ago"Select every tile with motorcycles", shows an image of a single motorcycle parked on the street. Does the sliver of a tire that shows up in the bottom right tile count, or not? This is never clear, and I end up usually getting it wrong until they show me one that's unambiguous.
- thenewnewguy 3y agoProbably too unreliable to use in real life - for example, I suspect many crappy corporate proxies will block HTTP 103 responses as some unknown danger.
- eli 3y agoUnfortunately nobody cares enough about Firefox users to bother in the first place.
- josephcsible 3y agoUnfortunately, it can be used opportunistically, as the readme says: > Browsers that do not fully support early hints can be easily detected by adding a harmless dummy resource to preload that will not be blocked by adblockers.
- lakomen 3y agoJust once and for all understand, people who do not want to see ads and you force ads on them, will not come to your site. All you're doing is making the user experience worse and decreasing your site's worth. And people will remember who was so rude to them. I've been there. Don't do it.
- CoastalCoder 3y agoI'd like this sentiment to be true, but do we have good empirical evidence for/against it?
- golergka 3y agoIf your website is monetized through ads, why would you want these people to visit it in the first place?
- tensor 3y agoThey will share your website with others, post links to it on social media, etc. Websites are all about driving traffic to it. Also, "these people" are also often willing to pay for good content if it's priced right. Substack is a good example of this, even if some of the prices are still too high.
- golergka 3y ago> Also, "these people" are also often willing to pay for good content if it's priced right. Are you sure? One of the main sites people use adblocking is Youtube — instead of just paying for Youtube premium.
- soco 3y agoWe're all complaining and blaming the big corporations for the pitiful state the internet got to be now but seems we are all contributing our little to bring it even lower. Because corporations pay, I know, but we are the ones pulling the trigger.
- flohofwoe 3y agoThe internet was just fine before it was turned into an ad delivery platform.
- helpmefindpurp 3y agoIf you do not like the ads, just stop visiting sites that show ads...
- bcye 3y agoIf there is competition offering ad-free services, this would be an option. But for large parts, there isn't.
- MattGaiser 3y agoYou can buy ad free services for a lot of them. Few pay.
- belthesar 3y agoI really and truly do wish this wasn't true, but it is. Part of this is because we've built an expectation that the only thing one needs to pay for to use services connected on the Internet is access, and once access is paid for, the problem is solved. But that's not the case. Products cost money, and we've established a pattern of free to play to freemium for much of the most popular services. This could change, but it would take the major players to flip the script, and they've invested so much into ad systems that they'd be hard pressed to abandon it.
- 3y ago
- deleted 3y ago[deleted]
- josephcsible 3y agoIs this already being exploited by any sites in the wild? If not, then I kind of wish that it would have been privately reported to Mozilla and the major ad blocker developers to give them time to patch it.
- mdasen 3y agoI definitely see your perspective here, but it also seems like something that isn't likely to be used. There's already good JS ways of detecting ad blockers that don't require nearly as much work. To take advantage of this, you'd need to alter your web application so that it'd do a two-stage rendering. Most web apps don't even stream their content (rather they wait until the whole content is ready, whether HTML or JS, and then send the whole thing). Your app needs to first send the HTTP 103 with the stuff to pre-fetch. Then it has to wait while holding the state and content it wants to push to the user. The longer you're holding that stuff in RAM, the fewer requests you can handle per second. Let's say you can handle 100 simultaneous requests and usually a request takes 10ms. Now you've handled that request and you're holding the response for 500ms to see if they hit the no-adblock-detector before sending the rest of the content. All of your Safari/iPhone users hate your website because every page load takes half a second. Awesome, you've pissed off the richest demographic browsing your website. You're paying more for server resources because you're holding onto state longer instead of getting the response to the user and freeing up that RAM so the requests per second you can handle drops. Ok, maybe you look at user agent and only use this technique for Firefox since that's the only browser it's effective with. In the demo, the DeferredInvoker basically generates a random string and associates it with a request (Map<string, request-response-thing>). Then when a request comes in for the no-adblock-detector, it looks up which request-response-thing is associated with the random string and sends the response to the user. If it doesn't receive a request for a string within a timeout, it'll send the response as adblock-detected. Of course, this only works for a single server since it's an in-memory map. How do we get it to work in a multi-server environment? Ok, we store "ABCDEF123" in a data store and hold the response until we see the request for "ABCDEF123" on the no-adblock-detector. Do we use listen/notify in PostgreSQL? I mean, at some point we're adding a lot of overhead for these requests. I have to store on my server "ABCDEF123" goes with request/response X and then I have to listen to the database to see if another server has received a request for "ABCDEF123" and that other server needs to do a database write. These can't be database writes that can be batched or deferred because the user is literally seeing the page wait to load on this database write. It's not impossible to exploit, but it requires real engineering for any company that has horizontally scaled anything to multiple web servers. You can't just drop it in easily. And while we might hate ads and there are concerning things about ads with respect to privacy and many other things, it isn't a security vulnerability. It's certainly interesting, but I can't see a company putting resources into this.
- deadbabe 3y agoSMS is the next big frontier for ads, every few messages with someone you can see a little ad about something related to your conversations. Or if a conversation has gone stale and someone hasn’t replied in several days, inject an ad to wake it back up.
- TylerE 3y agoSMS is dead. The US is basically an abberation in still using it. Rest of the world has moved on to whatsapp/imessage/whatever.
- kedean 3y agoThose are all closed-loop messaging systems. If anything whatsapp/imessage/whatever are more vulnerable to what was suggested because they aren't open/standardized protocols.
- skrtskrt 3y agoSMS is an insecure protocol from the ground up it was never designed for the mass communications it is now used for. It is open, sure but it needs a new open standard to completely replace it, which will take decades because its used for machine-to-machine communication in US telecom infrastructure and the sheer amount of physical equipment that would need upgraded is insane.
- GuB-42 3y agoSMS is still used in France. It is free, reliable and every phone supports it, making it the default. I think there are historical reasons. There was a time where most plans had free SMS but expensive internet, and even today the cheapest plans have free SMS and very limited data (ex: 50MB/month for the free.fr 2€/month plan). Countries that didn't have good SMS infrastructure and advantageous plans are the most likely to have switched to private, internet-based messengers. I don't know if it is still the case now with 4G/5G and the phasing out of earlier standards, but SMS had the advantage of going through congested networks better than anything else, including phone calls, MMS and internet data. Probably because it is an ouf-of-band signaling protocol.
- Hetzfogz 3y ago[dead]
- ceving 3y agoIt should be illegal to sabotage adblocking.
- CaptainFever 3y agoWhat? No. You have a right to block ads as they appear on your device, but websites have a right to refuse you service if they find out.
- shmde 3y agoIf I say whats on my mind after seeing this I will be banned from HN.
- jedberg 3y agoMy first question was "Why would someone do this and release it?" but it looks like they answered that question at the end of the README. :(
- freedomben 3y agoClassic security philosphical conundrum. Do you let the black hats figure it out on their own and weaponize it, or do you have a white hat figure it out and release it so it's common knowledge to the world?
- Tabular-Iceberg 3y agoIf ad blockers go by URLs, why don’t advertisers simply serve ads from the same domain with a path masquerading as content?
- gkbrk 3y agoThey don't trust the websites not to tamper with stuff.
- Tabular-Iceberg 3y agoThat makes sense, they wouldn’t be able to reliably collect metrics.
- extraduder_ire 3y agoYoutube (and IIRC adobe) ads work like that. Either from the same domain, or a subdomain. ublock origin has a "DNS unmasking" feature in firefox that defeats this. I think there's a less effective workaround used for other browsers.
- wrigglingworm 3y agoI wouldn't even mind ads if most sites weren't malicious with how they serve them. Do not make a new window pop up, do not try to download anything to my computer without my explicit instruction, do not make me click an x to view the content, do not interrupt the content to serve an ad. Why can't they just have a nice little ad on the left and/or right side of the page that doesn't interrupt my intake of their content? Heck, even on the top is fine.
- fennecbutt 3y agoWell also many sites are now just absolutely covered with ads. Like it went from one on a page to now banner above, banner left and right, pop up video that has to be closed, two to three interstitial ads in the main content, like 2 dozen shitty taboola or similar "articles" popped on the end. Ugh.
- a_vanderbilt 3y agoGreed. Those kinds of ads pay more. Interrupting the content means they can sell the spot as something people will actually see because they are forced to.
- sircastor 3y agoMore like desperation. The only real source of money online is ads sales. Nobody is making bank from putting ads on their site. They might be making enough for hosting. Though I guess it could be described as greed on the part of the advertisers?
- RockRobotRock 3y agoYeah, it's greed. Greed by advertising networks, greed by the companies placing the ads, greed by the reader wanting unlimited content for free.
- a_vanderbilt 3y agoThis is the most correct response, and the only one which acknowledges the role of the reader.
- ahmedfromtunis 3y agoI really wish the pay-with-compute model stuck. Lending webpages some CPU-cycles (probably to mine crypto) in a controlled and safe way would be a win-win(-win) situation. Websites won't have to submit to their advertising overlords and still be able to incrementally monetize their content. Users won't have to deal with the downgraded experience — while sacrificing compute cycles anyway to download and display the awful ads. Even advertisers would win, as they won't have to deal with content farms trying to fake impressions and clicks.
- crtasm 3y agoDoesn't really work out for anyone running on battery.
- ahmedfromtunis 3y agoIf done right, this might actually be more energy efficient than having to download and render all those unoptimized ads.
- Arnavion 3y agoThe way it works right now is already efficient. The adblock-enabled browser doesn't spend energy on rendering ads. If the website then blocks the user from the content then the user leaves.
- crtasm 3y agoI'd be interested to see a calculation on how much value could be extracted from the same amount of CPU cycles mining crypto - my gut feeling is it would be orders of magnitude smaller.
- LikesPwsh 3y agoYou'd need someone willing to actually buy the cryptocurrency generated from nothing on the other side of that transaction.
- 2cynykyl 3y ago
- skrtskrt 3y agoAnyone know what happened to ethicalads.io? Website has been offline for over a month, but founders/engineers seem to be active on LinkedIn & GitHub still
- ericholscher 3y agoWebsite is very much online. Can you share a curl or screenshot of what you see?
- esbranson 3y ago> Chrome does not allow adblockers to interact with resources loaded using early hints, nor does it display resources loaded using early hints in the developer console. I wonder if Brave has these same limitations? Not sure where its Shields JS fits into the architecture.
- zzo38computer 3y agoMozilla says the following about HTTP 103 Early Hints: > Note: For compatibility reasons it is recommended to only send HTTP 103 Early Hints responses over HTTP/2 or later, unless the client is known to handle informational responses correctly. > Most browsers limit support to HTTP/2 or later for this reason.
- gxonatano 3y agoI think what is needed is rather an adblock detector detector, or something which can trick the detectors into thinking there's no adblock.
- darepublic 3y agoThe freedom fighters will find a way to avoid these ads, just you watch
- hn_acker 3y agoHaha. The copyright license is a parody of the MIT license [1]: > Copyright (c) 2024 Mechazawa > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software with specific restrictions, provided that the user intends to use the Software explicitly FOR the purposes of evil or advancing evil, including but not limited to: > Genocide, Wanton Destruction, Fraud, Nuclear/Biological/Chemical Terrorism, Harassment, Prejudice, Slavery, Disfigurement, Brainwashing, Ponzi Schemes and/or the Destruction of Earth itself, > with this, including without limitation the rights to copy, modify, merge, publish, distribute, sublicense, sell and/or run copies Software or any executable binaries built from the source code. HN converts single newlines into spaces. The license text on Github [1] has apparently intentionally obstructive newlines within the "paragraphs". [1] https://github.com/Mechazawa/103-early-anti-adblock/blob/master/LICENSE.txt https://github.com/Mechazawa/103-early-anti-adblock/blob/mas...
- 4gotunameagain 3y agohaha, that would've been so incredibly funny... if I was still 15 years old :) maybe I'm growing old and grumpy, but at a state of affairs where active genocides are going on, I just find that immature and callous. By "that", maybe I mean Dutch attempts to humour ;)
- terrycody 3y agoCan someone make this into a Wordpress plugin?
- failedartifact 3y agoNit: The use of asci diagrams cause formatting problems when viewing on mobile.
- jalapenos 3y agoMy strategy for managing ads is adblock + a mouse with a thumb button configured to CTRL + F4. If adblock doesn't catch it, my thumb twitch reflex when a popup appears will.
- SushiHippie 3y agoWhy CTRL+F4, isn't CTRL+W easier to reach?
- harrygeez 3y agodoes anyone know to make a diagram using text like that in the README?
- unstatusthequo 3y agoAre people still relying on only browser plugins to de-trash their browsing experience? DNS is your friend. Block the asshats at their media delivery source. DNS Filter, NextDNS, PiHole...