9 ms·
Incapacitating Google Tag Manager (2022)
- gleenn 1y agoI'm all for blocking surveillance but how tiring is it to block JavaScript as suggested and then watch the majority of the internet not work?
- pluc 1y agoIt really isn't. I've been blocking all JavaScript for years now, selectively allowing what is essential for sites to run or using a private session to allow more/investigate/discover. Most sites work fine without their 30 JS sources, just allowing what is hosted on their own domain. It takes a little effort, but it's a fair price to pay to have a sane Internet. The thing is - with everything - it's never easy to have strong principles. If it were, everyone would do it.
- roywiggins 1y agoIt's certainly not that bad if you have uMatrix to do it with, but I haven't found a reasonable way to do it on mobile. uMatrix does work on Firefox Mobile but the UI is only semi functional.
- baobun 1y agoNoScript + uBO is all right.
- pluc 1y agoYup that's what I use as well. With whatever the name of the extension that makes allowing cookies a whitelist thing too, and PrivacyBadger/Decentraleyes. Also, deleting everything when Firefox closes. It's a little annoying to re-login to everything every day, but again, they are banking on this inconvenience to fuck you over and I refuse to let them win. It becomes part of the routine easily enough.
- bornfreddy 1y agoNot quite the same (I love uMatrix UI), but advanced mode in uBO is similar. It lacks filtering by data type (css, js, images, fonts,...) per domain, but it does resolve domains to their primary domain, revealing where they are hosted. A huge kudos to gorhill for both of these!
- 1vuio0pswjnm7 1y agouMatrix is fully-functional on Nightly. Using Firefox Add-Ons on a "smartphone" sucks because one has to access every Add-On interface via an Extensions menu. In that sense _all_ Add-Ons are only semi-functional. I use multiple layers: uMatrix + NetGuard + Nebulo "DNS Rules", at the least. Thus I have at least three opportunities where I can block lookups for and requests to Google domains.
- DavideNL 1y agoDoesn’t uBlock Origin in advanced mode do the exact same thing as uMatrix?
- 1vuio0pswjnm7 1y agohttps://github.com/gorhill/uMatrix/wiki/Changes-from-HTTP-Switchboard https://github.com/gorhill/uMatrix/wiki/Changes-from-HTTP-Sw... https://github.com/gorhill/uBlock/wiki/Advanced-settings https://github.com/gorhill/uBlock/wiki/Advanced-settings Having tried both, IMHO they do not do exactly the same thing. One is pattern-based, the other is host-based. As such, one can use them together, simultaneously.
- deleted 1y ago[deleted]
- pmontra 1y agoMaybe, but the UX is so terrible that I never figured out how to use uBO to replace uMatrix. I always use both: uBO for ads and DOM elements filtering and uMatrix for JavaScript, frames, cookies, anything in the columns of its UI. Basically uMatrix is so donor to use that anybody can use it. The equivalent uBO section is so complicated that I feel I need to take a master degree in that subject.
- zelphirkalt 1y agoYou would be surprised how many people are completely overwhelmed by the choices uMatrix offers. Lots of people out there, that don't even know what a website can consist of, let alone what it means to block this or that, or have the awareness that they did block something, or the patience to properly unblock the minimum amount of shit necessary to use the website. For many people any effort at all makes them surrender to the global spyware.
- dylan604 1y agoThat’s my default as well. Self hosted/1st party scripts can load, but 3rd party scripts are blocked. The vast majority of sites work this way. If a site doesn’t work because they must have a 3rd party script to work, I tend to just close the tab. I really don’t feel like it has caused me to miss anything. There’s usually 8 other sites with the same data in a slightly less hostile site
- palata 1y agoDo you selectively enable JavaScript for the whole site, or is there a way with uBO to only enable subparts of it?
- culi 1y agoNoScript seems like the go-to addon https://noscript.net/ https://noscript.net/ It has pretty advanced features but also basic ones that allow you to block scripts by source
- sureglymop 1y agoIt's easier than I thought. I just use uBlock Origin with everything blocked by default and then allow selectively.
- Rapzid 1y agoAbout as tiring as hearing about it all the time. Thank god it's a fringe topic these days but this article snuck it in. Probably the constant use of the word "surveillance" was an early tell haha.
- heavyset_go 1y agoWhitelisting JS has worked on my end for a while. I won't browse the Internet on my phone without it, everything loads instantly and any site that actually matters was whitelisted years ago.
- anothernewdude 1y agoThe sites that don't work are usually the worst websites around - you end up not missing much. And if it's a store or whatever, you can unblock all js when you actually want to buy.
- kevin_thibedeau 1y agoStackOverflow switched over from spying with ajax.google.com to GTM in the past year or so. All for some pointless out of date jQuery code they could self-host. I wonder how much they're being paid to let Google collect user stats from their site.
- goopypoop 1y agoPeople who want you to run their scripts aren't really your friends
- 1vuio0pswjnm7 1y agoImpossible to know because when I disable Javascript "the majority of the internet" works fine. As does a majority of the web. I read HN and every site submitted to HN using TCP clients and a text-only browser, that has no Javascript engine, to convert HTML to text. The keyword is "read". Javascript is not necessary for requesting or reading documents. Web developers may use it but that doesn't mean it is necessary for sending HTTP requests or reading HTML or JSON. If the web user is trying to do something else other than requesting and reading, then perhaps it might not "work".
- zelphirkalt 1y ago[dead]
- qualeed 1y agoEchoing others, I've used NoScript for years and at this point it is practically unnoticeable. Many sites work without (some, like random news & blogs, work better). When a site doesn't work, I make a choice between temporarily or permanently allowing it depending on how often I visit the site. It takes maybe 5 seconds and I typically only need to spend that 5 seconds once. As a reward, I enjoy a much better web experience.
- michaelt 1y agoIt depends. If you're spending 99% of your time on your favourite websites that you've already tuned the blocking on? Barely a problem. On the other hand if your job involves going to lots of different vendors' websites - you'll find it pretty burdensome, because you might end up fiddling with the per-site settings 15+ times per day.
- dylan604 1y agoIf I’m at work using a work provided computer, I don’t bother with the blocking. They are not tracking me as I do not do anything as me. I’m just some corporate stooge employee that has no similarity to me personally. My personal devices block everything I can get away with
- rurban 1y agoJust add the domain to your /etc/hosts as 0.0.0.0 Doing that for years
- 1oooqooq 1y agohttps://someonewhocares.org/hosts/zero/ https://someonewhocares.org/hosts/zero/
- iknownothow 1y agoI just did a wget of the site and noticed the following line at the end. > <script async src="https://www.googletagmanager.com/gtag/js?xxxxxxx"></script> https://www.googletagmanager.com/gtag/js?xxxxxxx"></script> I am going to use this for sure, but it is a little ironic.
- reddalo 1y agoI feel like that document is seriously outdated. This GitHub repo seems way more up-to-date: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- lazyeye 1y agoTry pihole (self-hosted) or nextdns if you want something that stays up to date.
- jpgreens 1y agoWhat if we could resolve every domain to 0.0.0.0 by default at the start. When visiting a website manually through the browser's URL bar it would automatically be whitelisted. Clicking links would also whitelist the domain of the link only. Sure you'd have to occasionally allow some 3rd party domains as well. Guess it would be cumbersome at first but after a while it would be pretty stable and wouldn't require much extra attention.
- 1oooqooq 1y agothat's exactly what uBlockOrigin does in advanced mode. enjoy.
- drcongo 1y agoGoogle Tag Manager and the whole consent management platform certification business is nothing more than a shakedown. It's racketeering.
- fvgvkujdfbllo 1y ago> surveillanceware I thought the term was spyware. Surveillanceware almost sounds like something necessary to prevent bad stuff. Is this corporate rebranding to make spyware software sound less bad?
- Eggs-n-Jakey 1y agoI don't know, the memetics of Surveillanceware or spyware mostly leads me to the belief that everything is weaponized to drain your money thru ads/marketing instead of the direct approach of stealing my money.
- Animats 1y agoBlocking Google Tag Manager script injection seems to have few side effects. Blocking third party cookies also seems to have few side effects. Turning off Javascript breaks too much.
- alganet 1y agoUse a whitelist-based extension such as NoScript: https://noscript.net https://noscript.net You can then enable just enough JS to make sites work, slowly building a list of just what is necessary. It can also block fonts, webgl, prefetch, ping and all those other supercookie-enabling techniques. The same with traditional cookies. I use Cookie AutoDelete to remove _all_ cookies as soon as I close the tab. I can then whitelist the ones I notice impact on authentication. Also, you should disable JavaScript JIT, so the scripts that eventually load are less effective at exploiting potential vulnerabilities that could expose your data.
- aerzen 1y agoAm I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.
- fguerraz 1y agoMaybe you’re being misled by the cryptic name. It’s got nothing to do with managing tags, it’s a behaviour tracker and fingerprint machine.
- 9dev 1y agoI mean technically you can use it to manage HTML tags to inject into a site.
- snowwrestler 1y agoThis is in fact what it is primarily used for.
- slow_typist 1y agoWell I can inject HTML tags (or elements) with native JavaScript. Or manage them. Why would I want a bloated third party piece of software doing that?
- SquareWheel 1y agoSince you're asking, you could use it to tie together triggers and actions to embed code in specific situations (eg. based on the URL or page state). It has automatic versioning. There's a preview feature for testing code changes before deploying, and a permission system for sharing view/edit access with others.
- connicpu 1y agoSo that your sales and marketing team can add the third-party tracker for a new ad campaign service without bothering the engineering team.
- BurnerBotje 1y agoI have an idea that another way of preventing being tracked is just massively spamming trash in the data layer object, pushing thousands of dollars worth of purchase events and such, pushing randomly generated user details and other such events. Perhaps by doing this your real data will be hard to filter out. A side effect is also that data becomes unreliable overall, helping less privacy aware people in the process.
- chamomeal 1y agoNow there’s a fun idea!! I wonder how difficult it would be to spoof events. Edit: looks like this might exist already: https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/
- genewitch 1y agoSince installing it on firefox on this computer (18 months ago or so) Ad Nauseam has clicked ~$38,000 worth of ads, that i never saw. Between this and "track me not" i've been fighting back against ads and connecting my "profile" with any habits since 2016 or so. I should also note i have pihole and my own DNS server upstream, so that's thiry-eight grand in ad clicks that got through blacklists. https://www.trackmenot.io/faq https://www.trackmenot.io/faq
- cj 1y ago[Preface: I hate ads, I love uBlock origin, I use pihole, I'm a proponent of ad blockers] I manage a Google Ads account with a $500,000 budget. That budget is spent on a mix of display ads, google search, and youtube ads. If I knew that 10% of our budget was wasted on bot clicks, there's nothing I can do as an advertiser. We can't stop advertising... we want to grow our business and advertising is how you get your name out there. We also can't stop using Google Ads - where else would we go? $38,000 in clicks boosts Google's revenue by $38k (Google ain't complaining). The only entity you're hurting are the advertisers using Google. Advertisers might see their campaigns performing less well, but that's not going to stop them from advertising. If anything, they'll increase budgets to counteract the fake bot clicks. I really don't understand what Ad Nauseam is trying to achieve. It honestly seems like it benefits Google more than it hurts them. It directly hurts advertisers, but not enough that it would stop anyone from advertising. Google has a system for refunding advertisers for invalid clicks. The $500k account that I manage gets refunded about $50/month in invalid clicks. I'm guessing if bot clicks started making a real dent in advertiser performance, Google would counter that by improving their bot detection so they can refund advertisers in higher volumes. If there's ever an advertiser-led boycott of Google Ads, Google would almost certainly respond by refunding advertisers for bot clicks at much higher rates.
- adamiscool8 1y agoI don't think this article makes a good case for why you should. >The more of us who incapacitate Google's analytics products and their support mechanism, the better. Not just for the good of each individual person implementing the blocks - but in a wider sense, because if enough people block Google Analytics 4, it will go the same way as Universal Google Analytics. These products rely on gaining access to the majority of Web users. If too many people block them, they become useless and have to be withdrawn. OK - but then also in the wider sense, if site owners can't easily assess the performance of their site relative to user behavior to make improvements, now the overall UX of the web declines. Should we go back to static pages and mining Urchin extracts, and guessing what people care about?
- add-sub-mul-div 1y agoIf the analytics brought us to this, of what use are the analytics?
- card_zero 1y agoBut I like it better when they have to guess. If it's something we care about enough, we'll let them know.
- bredren 1y agoBelt and suspenders approach is to attach analytics to the most important events on the server side and combine with the session. If the frontend automatic js is blocked, it doesn’t matter.
- slow_typist 1y agoEffective and accessible UX design is a solved problem. It’s a matter of education of front end developers, not of A/B testing your users to death.
- throw123xz 1y agoAnalytics can have good uses, but these days it's mostly used to improve things for the operator (more sales, conversions, etc) and what's best for the website isn't always the best for the user. And so I block all that.
- monista 1y agoIf you block Google Tag Manager, you probably also want to block Yandex Metrics and Cloudflare Insights.
- reddalo 1y agoI think it's hard to block Cloudflare Insights because most of the data is collected server-side.
- ozgrakkurt 1y agoYou can use something like this maybe https://adnauseam.io/ https://adnauseam.io/
- aleppopepper 1y agoThat's hilarious. Do you really Google should be privacy respecting?
- ayaros 1y agoIs there a good way to collect basic analytics if you have a site you're hosting on GitHub pages? In such cases I'd rather not rely on Google Analytics if I don't have to.
- A7med 1y agotoo long to read
- lerp-io 1y agough... if you think the internet should be a "static webpage" i got bad news for you bud
- Timwi 1y agoThe term is a little ambiguous. They're not referring to a website that is served from static files that never change (which would exclude forums like Hacker News). They're referring to websites that still work if you disable JavaScript, so Hacker News would still be included.
- schiffern 1y ago>Use uBlock Origin with JavaScript disabled, as described above, but also with ALL third-party content hard-blocked. To achieve the latter, you need to add the rule ||.^$third-party to the My Filters pane. This is a worse way to implement uBO's "Hard Mode" (except with JS blocked), which has the advantage that you can easily whitelist sites individually and set a hotkey to switch to lesser blocking modes. https://github.com/gorhill/uBlock/wiki/Blocking-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...
- v5v3 1y agoI use: VPN so constantly changing ip. Tor browser for everyday browsing (has no script preinstalled). So onion provides double Vpn. Regularly closed down so history cleared. Safari in private mode and lockdown mode for when tor won't work (tor ip blocked/hd video that is too slow to stream on tor). Safari Isolation in private mode is excellent, you can use two tabs with, say emails, and neither will know other is logged in. Safari non private for sites I want available and in sync across devices. Firefox in permanent private mode with ublock origin for when safari lockdown mode causes issues. (Bizarely Firefox containers doesn't work in private so no isolation across tabs). Chromium for logged into Google stuff. Chrome for web development. Plus opt out for everything possible inc targeted ads. I rarely see ads of anything I would want to buy, and VPN blocks most of it at its DNS. Beyond that, anything else would be too much effort for me. The advertising companies I'm sure know I am not susceptible to impulse buy on ads, I research and seek vfm so not really their target.
- culi 1y ago> Tor browser for everyday browsing Do you just... log back in to Hacker News every day? I downloaded the Mullvad browser (basically Tor without the onion protocol part) but having no way to save passwords ended up making it unusable for me
- sheiyei 1y agoWhat platform do you use that doesn't allow for password managers? A browser's password manager is not the ideal for security, apparently (I would like to know how generally true this is, of course saving them on Google or Microsoft is as good as idea as it sounds)
- v5v3 1y agoAs said, use a password manager. Also regularly export your passwords from your password manager, either to another password manager or encrypt and store.So if the password manager has issues it won't leave you stuck.
- hinkley 1y agoWe had a disgusting number of tags on some of our customer pages and a few dozen of them start to have effects on page load, especially if you were still on HTTP 1.1.
- paradox460 1y agoYears ago, I worked on a site where we constantly had requests from the non technical side of the company to make the site load faster. We were perplexed in engineering. The site loaded and was ready for us in less than a fraction of a second. Eventually we realized that every dev ran ubo, and tried loading the site without it. It took about 5 seconds. Marketing and other parts of the company had loaded so much crap into GTM that it just bogged everything down
- jeroenhd 1y agoThis is why I generally keep a mostly-clean browser around for development (only including some dev extensions). I've wasted half an hour when I had a stray uBO filter go off on a component I was working on once (wasn't even an ad) and that taught me a valuable lesson. If you're testing a website, you've got to test it like your customers use it. I shake my head at the incompetence of web designers every time I encounter a website filled with scroll bars because the devs on macOS haven't bothered testing any other device.
- tempodox 1y ago> Meanwhile, Google Tag Manager is regularly popping up on Government sites. This means not only that governments can study you in more depth - but also that Google gets to follow you into much more private spaces. The corruption of the system knows no bounds.
- padjo 1y agoHow refreshing, a website that doesn’t punch me in the face with a cookie banner. Is that because they’re legit not tracking me or are they just noncompliant?
- user070223 1y agoUblock origin author - Gorhill - 2022 response: https://news.ycombinator.com/item?id=30415234 https://news.ycombinator.com/item?id=30415234 Ublock origin wiki referencing a method to block, unsure how effective it is(seems to be based on the first link): https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#header https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#... "*$1p,strict3p,script,header=via:1.1 google" Perhaps some filter in your list already utilizing this but I'm unable to verify
- unit149 1y ago[dead]
- colinprince 1y agodidn't first party sets get dropped in 2022? https://lists.w3.org/Archives/Public/public-privacycg/2022Jun/0003.html https://lists.w3.org/Archives/Public/public-privacycg/2022Ju...
- egorfine 1y agoI develop software for over 30 years now. GTM is in my top #3 list of the worst software to ever exist. And I mean it. GTM is incredibly hostile to everyone around it: to the victims, to marketing people, to software engineers.