6 ms·

AdFlush (F1 Score: 0.98) seems to do better than some other adblockers: AdGraph (F1 score: 0.93), WebGraph (F1 score: 0.90), and WTAgraph (F1 score: 0.84), but

by nomilk 2y ago

AdFlush (F1 Score: 0.98) seems to do better than some other adblockers: AdGraph (F1 score: 0.93), WebGraph (F1 score: 0.90), and WTAgraph (F1 score: 0.84), but it begs the question: why not compare to the most popular adblockers: uBlock Origin, Adblock Plus etc. I think the authors want to compare apples with apples, so they only compare their algorithm to other adblockers that use algorithms, as opposed to those which use crowdsourced lists. The paper somewhat acknowledges this: > However, manual maintenance of these filter lists requires significant human effort Seems like one of those tasks where crowdsourcing scales so nicely (only one person has to report an ad for it to go into a crowdsourced list that blocks it for millions of others) that it makes an algorithmic approach unnecessary.

1oooqooq 2y ago
practical solutions don't get you published
- ko27 2y ago
  "Practical solutions" also leave you vulnerable to cat and mouse games against sites that block or bypass adblockers (even with ublock origin). The end game is to have heuristic/AI adblocking which would directly hook into browser rendering so that it becomes undetectable. Obviously leading browsers do not support this for extensions, but forking Chromium wouldn't be so hard.
  - 1oooqooq 2y ago
    "doing thing X work and everyone uses it, so bad actors invest time against things X. While thing Y isn't used by anyone so bad actors aren't spending time to work around it, q.e.d. we prove thing Y is better". i don't really buy your argument
    - ko27 2y ago
      The argument is that Y is more robust.
RamRodification 2y ago
> only one person has to report an ad for it to go into a crowdsourced list that blocks it for millions of others Is it that easy? Sounds very abusable
- rvnx 2y ago
  Yes, and some list maintainers accept money to add or remove you from the list (officially, or officiously through a secondary maintainer, depending on the list), but otherwise it's no different than getting a domain marked as malware or phishing (with a few paid editors on Phishtank or VirusTotal). It's easier to get a domain added than removed. and for the "corruption"/"rackeetering" part, it's a "win-win" for the adblockers and the list maintainers. Adblockers also often pay browsers to be integrated by default (AdGuard, Adblock Plus, etc), and then they negociate with publishers to whitelist some domains (not necessarily the most obvious, can just be analytics). "We offer your domain to be unblocked on xx millions of devices by default, this will create you a uplift of revenue of +yy%"
  - JAlexoid 2y ago
    Humans are really the primary attack vectors for any security system.
  - bityard 2y ago
    Which lists do this? Do any of them ship with uBlock Origin?
- kmlx 2y ago
  yes, one of my clients was hit by this and i was tasked with solving the situation. i had to create a ticket in a repo explaining why blocking a whole domain instead of a single subdomain was actually pretty bad. they approved it and reverted the change. finding where exactly i had to open the ticket and what to write was a “down the rabbit hole” experience.
  - pbhjpbhj 2y ago
    Domains are cheap, don't serve content on an ad domain maybe? Sounds like perhaps your task was to ensure a company's ads got through an adblocker?
Cthulhu_ 2y ago
The filter based adblockers are at risk though, with Google's new extension thingy that - at least a few years ago, I haven't heard from it since - limited the amount of rules. If there's a non-rule based system that is 98% effective then that would circumvent the arbitrary rule limits that Google set.
- AlexandrB 2y ago
  My understanding is that under manifest v3[1] only a list of rules is allowed. An algorithmic ad blocker wouldn't be able to work at all. [1] https://arstechnica.com/gadgets/2023/11/google-chrome-will-limit-ad-blockers-starting-june-2024/ https://arstechnica.com/gadgets/2023/11/google-chrome-will-l...
  - GioM 2y ago
    This is true. Extensions currently (manifest v2) are able to evaluate net requests dynamically, and are able to modify requests according to a dynamic ruleset that the extension can retrieve from some filter list published on the internet. Under manifest v3, extensions are not able to dynamically inspect requests, instead, they may only apply rules to net requests. Even worse, there is a limitation of only 5000 rules per extension!! [1] Even WORSE worse, under Chrome's manifest v3 rules, the extension cannot load any external code! Meaning that blocklists must be packaged with the extension. [2] Now, one might consider the reading of that link to no affect block lists, it's not a "library" and it's not "code" so long as it's just a list of textual rules.... however, google considers the following to be a violation: "Building an interpreter to run complex commands fetched from a remote source, even if those commands are fetched as data". [3] Sneaky sneaky. An extension update (and hence new app store submission) is required to update filter lists. In other words, dynamic net requests are banned, and remotely-updated blocklists are banned as well. [1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/declarativeNetRequest/MAX_NUMBER_OF_DYNAMIC_AND_SESSION_RULES https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... [2] https://developer.chrome.com/docs/extensions/develop/migrate/improve-security#remove-remote-code https://developer.chrome.com/docs/extensions/develop/migrate... [3] https://developer.chrome.com/docs/webstore/program-policies/mv3-requirements https://developer.chrome.com/docs/webstore/program-policies/...
_al_ 2y ago
there is an entire section in the paper sub-titled: Comparison with uBlock Origin..

by nomilk 2y ago

1oooqooq 2y ago

practical solutions don't get you published

ko27 2y ago
"Practical solutions" also leave you vulnerable to cat and mouse games against sites that block or bypass adblockers (even with ublock origin). The end game is to have heuristic/AI adblocking which would directly hook into browser rendering so that it becomes undetectable. Obviously leading browsers do not support this for extensions, but forking Chromium wouldn't be so hard.
- 1oooqooq 2y ago
  "doing thing X work and everyone uses it, so bad actors invest time against things X. While thing Y isn't used by anyone so bad actors aren't spending time to work around it, q.e.d. we prove thing Y is better". i don't really buy your argument
  - ko27 2y ago
    The argument is that Y is more robust.

RamRodification 2y ago

> only one person has to report an ad for it to go into a crowdsourced list that blocks it for millions of others Is it that easy? Sounds very abusable

rvnx 2y ago
Yes, and some list maintainers accept money to add or remove you from the list (officially, or officiously through a secondary maintainer, depending on the list), but otherwise it's no different than getting a domain marked as malware or phishing (with a few paid editors on Phishtank or VirusTotal). It's easier to get a domain added than removed. and for the "corruption"/"rackeetering" part, it's a "win-win" for the adblockers and the list maintainers. Adblockers also often pay browsers to be integrated by default (AdGuard, Adblock Plus, etc), and then they negociate with publishers to whitelist some domains (not necessarily the most obvious, can just be analytics). "We offer your domain to be unblocked on xx millions of devices by default, this will create you a uplift of revenue of +yy%"
- JAlexoid 2y ago
  Humans are really the primary attack vectors for any security system.
- bityard 2y ago
  Which lists do this? Do any of them ship with uBlock Origin?
kmlx 2y ago
yes, one of my clients was hit by this and i was tasked with solving the situation. i had to create a ticket in a repo explaining why blocking a whole domain instead of a single subdomain was actually pretty bad. they approved it and reverted the change. finding where exactly i had to open the ticket and what to write was a “down the rabbit hole” experience.
- pbhjpbhj 2y ago
  Domains are cheap, don't serve content on an ad domain maybe? Sounds like perhaps your task was to ensure a company's ads got through an adblocker?

Cthulhu_ 2y ago

The filter based adblockers are at risk though, with Google's new extension thingy that - at least a few years ago, I haven't heard from it since - limited the amount of rules. If there's a non-rule based system that is 98% effective then that would circumvent the arbitrary rule limits that Google set.

AlexandrB 2y ago
My understanding is that under manifest v3[1] only a list of rules is allowed. An algorithmic ad blocker wouldn't be able to work at all. [1] https://arstechnica.com/gadgets/2023/11/google-chrome-will-limit-ad-blockers-starting-june-2024/ https://arstechnica.com/gadgets/2023/11/google-chrome-will-l...
- GioM 2y ago
  This is true. Extensions currently (manifest v2) are able to evaluate net requests dynamically, and are able to modify requests according to a dynamic ruleset that the extension can retrieve from some filter list published on the internet. Under manifest v3, extensions are not able to dynamically inspect requests, instead, they may only apply rules to net requests. Even worse, there is a limitation of only 5000 rules per extension!! [1] Even WORSE worse, under Chrome's manifest v3 rules, the extension cannot load any external code! Meaning that blocklists must be packaged with the extension. [2] Now, one might consider the reading of that link to no affect block lists, it's not a "library" and it's not "code" so long as it's just a list of textual rules.... however, google considers the following to be a violation: "Building an interpreter to run complex commands fetched from a remote source, even if those commands are fetched as data". [3] Sneaky sneaky. An extension update (and hence new app store submission) is required to update filter lists. In other words, dynamic net requests are banned, and remotely-updated blocklists are banned as well. [1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/declarativeNetRequest/MAX_NUMBER_OF_DYNAMIC_AND_SESSION_RULES https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... [2] https://developer.chrome.com/docs/extensions/develop/migrate/improve-security#remove-remote-code https://developer.chrome.com/docs/extensions/develop/migrate... [3] https://developer.chrome.com/docs/webstore/program-policies/mv3-requirements https://developer.chrome.com/docs/webstore/program-policies/...

_al_ 2y ago

there is an entire section in the paper sub-titled: Comparison with uBlock Origin..