3 ms·

textfiles.com says: "TEXTFILES.COM has been online for nearly 25 years with no ads or clickthroughs." I'd argue that that is a most likely objectively false st

by matrss 2y ago

textfiles.com says: "TEXTFILES.COM has been online for nearly 25 years with no ads or clickthroughs." I'd argue that that is a most likely objectively false statement and that the domain owner is in no position to authoritatively answer the question if it has ever served ads in that time. As it is served without TLS any party involved in the transportation of the data can mess with its content and e.g. insert ads. There are a number of reports of ISPs having done exactly that in the past, and some might still do it today. Therefore it is very likely that textfiles.com as shown in someones browser has indeed had ads at some point in time, even if the one controlling the domain didn't insert them. Textfiles also contains donation links for PayPal and Venmo. That is an attractive target to replace with something else. And that is precisely the point: without TLS you do not have any authority over what anyone sees when visiting your website. If you don't care about that then fine, my comment about mangling all http traffic was a bit of a hyperbole. But don't be surprised when it happens anyway and donations meant for you go to someone else instead.

eesmith 2y ago
There is a big difference between "served ads" and "ads inserted downstream." If you browse through your smart TV, and the smart TV overlays an ad over the browser window, or to the side, is that the same as saying the original server is serving those ads? I hope you agree it is not. If you use a web browser from a phone vendor who has a special Chromium build which inserts ads client-side in the browser, do you say that the server is serving those ads? Do you know that absolutely no browser vendors, including for low-cost phones, do this? If your ISP requires you configure your browser to use their proxy service, and that proxy service can insert ads, do you say that the server is serving those ads? Are you absolutely sure no ISPs have this requirement? If you use a service where you can email it a URL and it emails you the PDF of the web site, with some advertising at the bottom of each page, do you say the original server is really the one serving those ads? If you read my web site though archive.org, and archive.org has its "please donate to us" ad, do you really say that my site is serving those ads? Is there any web site which you can guarantee it's impossible for any possible user, no matter the hardware or connection, to see ads which did not come from the original server as long as the server has TLS? I find that impossible to believe. I therefore conclude that your interpretation is meaningless. > "as shown in someones browser" Which is different than being served by the server, as I believe I have sufficiently demonstrated. > But don't be surprised when it happens anyway Jason Scott, who runs that site, will not be surprised.
- matrss 2y ago
  > If you browse through your smart TV, and the smart TV overlays an ad over the browser window, or to the side, is that the same as saying the original server is serving those ads? I hope you agree it is not. I agree it is not. That is why I didn't say that the original server served ads, but that the _domain_ served ads. Without TLS you don't have authority over what your domain serves, with TLS you do (well, in the absence of rogue CAs, against which we have a somewhat good system in place). > If you use a web browser from a phone vendor who has a special Chromium build which inserts ads client-side in the browser, do you say that the server is serving those ads? Do you know that absolutely no browser vendors, including for low-cost phones, do this? This is simply a compromised device. > If your ISP requires you configure your browser to use their proxy service, and that proxy service can insert ads, do you say that the server is serving those ads? Are you absolutely sure no ISPs have this requirement? This is an ISP giving you instructions to compromise your device. > If you use a service where you can email it a URL and it emails you the PDF of the web site, with some advertising at the bottom of each page, do you say the original server is really the one serving those ads? No, in this case I am clearly no longer looking at the website, but asking a third-party to convey it to me with whatever changes it makes to it. > If you read my web site though archive.org, and archive.org has its "please donate to us" ad, do you really say that my site is serving those ads? No, archive.org is then serving an ad on their own domain, while simultaneously showing an archived version of your website, the correctness of which I have to trust archive.org for. > Is there any web site which you can guarantee it's impossible for any possible user, no matter the hardware or connection, to see ads which did not come from the original server as long as the server has TLS? I find that impossible to believe. Fair point. I should have said that I additionally expect the client device to be uncompromised, otherwise all odds are off anyway as your examples show. The implicit scenario I was talking about includes an end-user using an uncompromised device and putting your domain into their browsers URL bar or making a direct http connection to your domain in some other way.
  - eesmith 2y ago
    While both those domains have a specific goal of letting people browse the web as it if were the 1990s, including using 1990s-era web browsers. They want the historical integrity, which includes the lack of data integrity that you want.
textfiles 2y ago
This argument is stupid.
- matrss 2y ago
  Why?

by matrss 2y ago

eesmith 2y ago

There is a big difference between "served ads" and "ads inserted downstream." If you browse through your smart TV, and the smart TV overlays an ad over the browser window, or to the side, is that the same as saying the original server is serving those ads? I hope you agree it is not. If you use a web browser from a phone vendor who has a special Chromium build which inserts ads client-side in the browser, do you say that the server is serving those ads? Do you know that absolutely no browser vendors, including for low-cost phones, do this? If your ISP requires you configure your browser to use their proxy service, and that proxy service can insert ads, do you say that the server is serving those ads? Are you absolutely sure no ISPs have this requirement? If you use a service where you can email it a URL and it emails you the PDF of the web site, with some advertising at the bottom of each page, do you say the original server is really the one serving those ads? If you read my web site though archive.org, and archive.org has its "please donate to us" ad, do you really say that my site is serving those ads? Is there any web site which you can guarantee it's impossible for any possible user, no matter the hardware or connection, to see ads which did not come from the original server as long as the server has TLS? I find that impossible to believe. I therefore conclude that your interpretation is meaningless. > "as shown in someones browser" Which is different than being served by the server, as I believe I have sufficiently demonstrated. > But don't be surprised when it happens anyway Jason Scott, who runs that site, will not be surprised.

matrss 2y ago
> If you browse through your smart TV, and the smart TV overlays an ad over the browser window, or to the side, is that the same as saying the original server is serving those ads? I hope you agree it is not. I agree it is not. That is why I didn't say that the original server served ads, but that the _domain_ served ads. Without TLS you don't have authority over what your domain serves, with TLS you do (well, in the absence of rogue CAs, against which we have a somewhat good system in place). > If you use a web browser from a phone vendor who has a special Chromium build which inserts ads client-side in the browser, do you say that the server is serving those ads? Do you know that absolutely no browser vendors, including for low-cost phones, do this? This is simply a compromised device. > If your ISP requires you configure your browser to use their proxy service, and that proxy service can insert ads, do you say that the server is serving those ads? Are you absolutely sure no ISPs have this requirement? This is an ISP giving you instructions to compromise your device. > If you use a service where you can email it a URL and it emails you the PDF of the web site, with some advertising at the bottom of each page, do you say the original server is really the one serving those ads? No, in this case I am clearly no longer looking at the website, but asking a third-party to convey it to me with whatever changes it makes to it. > If you read my web site though archive.org, and archive.org has its "please donate to us" ad, do you really say that my site is serving those ads? No, archive.org is then serving an ad on their own domain, while simultaneously showing an archived version of your website, the correctness of which I have to trust archive.org for. > Is there any web site which you can guarantee it's impossible for any possible user, no matter the hardware or connection, to see ads which did not come from the original server as long as the server has TLS? I find that impossible to believe. Fair point. I should have said that I additionally expect the client device to be uncompromised, otherwise all odds are off anyway as your examples show. The implicit scenario I was talking about includes an end-user using an uncompromised device and putting your domain into their browsers URL bar or making a direct http connection to your domain in some other way.
- eesmith 2y ago
  While both those domains have a specific goal of letting people browse the web as it if were the 1990s, including using 1990s-era web browsers. They want the historical integrity, which includes the lack of data integrity that you want.

textfiles 2y ago

This argument is stupid.

matrss 2y ago
Why?