Hacker News Reader

You'd be advised to read their book, by Nissenbaum and Brunton that describes the theory behind privacy through obfuscation. It argues that by clicking all the ads, all useful information is lost in the noise. Simply put, the signal-to-noise ratio is so heavily biased to noise that the signal is lost. https://www.amazon.com/Obfuscation-Users-Guide-Privacy-Prote...

Neither of these people are technologists with any experience in the ad industry or data science. They're lawyers and artists. Why would I trust that they know what they're talking about in this domain?

Why not evaluate their arguments on the merits rather than relying on authority (or lack thereof)? And it's not like this is a particularly technical subject anyway.

Absolutely, and I've outlined cases where I have technical disagreements with them in my original post and elsewhere in this thread. I was merely responding to the accusation that I should blindly listen to them because they wrote a book.

How is it not technical?

You have to understand statistics, ad networks, etc. plus all the stuff that can be used to identify you online, cookies, e-tags, browser storage, browser property sniffing, etc. plus how all that works in regard to domains and sub-domains, what's accessible cross-domains, etc.

The parent is alluding to that while all that ad clicking might obfuscate your reception to ads, it might have the downside of making it extremely easy to distinctly recognise your browsing habits and let every ad network uniquely identify you and link it to other data they have on you.

By allowing their ads (and thus their software) on the web page in the first place, you've already provided all of that data to them. The click doesn't really provide any further, useful data.

Ad Nauseum's explanation page addresses this question. They're supposed to be triggering sandboxed requests that never return to your browser, and so aren't a threat.

It was my first concern too, and I still wouldn't be comfortable to run it, but it's not as though the security question was unaddressed.

(I do object to the possibility of getting your favorite sites blacklisted by ad networks for low-intent clickthroughs or botting.)

> I do object to the possibility of getting your favorite sites blacklisted by ad networks for low-intent clickthroughs or botting.

Haven't installed the extension for these two reasons.

Also, while I strongly believe that the tech industry re: surveillance, data-mining and data-sharing is completely out of control and deserving of a tool like this... I'm not ready to cross this line and become this kind of activist for change. There's a war going on and our online rights to privacy have been completely stripped away - with things getting so much worse.

As a result, I do understand others using this extension and hope that this tool (among others, especially long-needed legislation which the government opposes) changes things for the better. Whitelisting/Blacklisting could help solve the fav sites issue but it defeats the purpose of this extension when there is so much at stake.

> btw if you're using this plugin on Firefox, enjoy the exploits that your browser downloads and runs in the background by clicking every ad! :-D

It doesn't download or run anything. Just clicks links without even rendering the response, pretty small attack surface there I'd say.

Also pretty easy to detect/block. Just add a redirect that redirects on page draw after the click. Only record clicks that successfully redirect.

Yeah, it might make for slightly weird flow when clicking ads, but you could totally do it.

So instead of doing that and being respectful and competitive Google decided to ban the extension.

"Respectful" is a really bizarre expectation since this plugin by its nature does not respect Google's or other ad networks. I don't know why Google would demonstrate respect to a plugin designed to damage their ad network.

Because other browser vendors would accept such a plugin as they're not ad networks. This seems to me very much like a case of Google being too big, having their hands in both the ad market and the browser market and abusing that position.

Respect may not have been the right word, but I was going for "not a blatant abuse of power".

I'm not very sympathetic to click fraud. Almost no one would think it acceptable if a site owner were using a click farm to artificially inflate the ad click through rate, but somehow a browser extension doing the same is okay? I have no problem with ad blocking but actively poisoning the network is a different thing entirely.

If Google decided to block users of AdNauseum and similar plugins from using Google web products, you'd probably say it's blatant abuse of power and I'd say it sounds reasonable, exactly as it's reasonable for sites to block users running ad blockers.

I'd say it's perfectly acceptable for site owners to perform "click fraud" too.

It's their computer after all, they can use it however they want. If click fraud is what they want to do, go for it. It's up to the ad networks to counter that on their end - on their own computers - in a fair and reasonable way.

Just as browser extension runners have every right to have their computer do what they want it to - if that's click ads, so be it.

Ultimately, I own my computer, it should do what I tell it to.

As others have pointed out, Google could have easily detected this extension and ignored its clicks, just as they do with regular click fraud in most cases. Instead they chose a path which makes Chrome violate user choice. That I have a problem with.

> Almost no one would think it acceptable if a site owner were using a click farm to artificially inflate the ad click through rate, but somehow a browser extension doing the same is okay?

Yes. Context and intent matter.

"Almost nobody would think it acceptable to drive recklessly on their commute home, but somehow ambulance drivers get to run red lights and exceed the speed limit?"

I know you're making an analogy but comparing AdNauseum to ambulance drivers is a bit of a stretch. One of these is saving lives. The other has no purpose except to inflict damage on ad networks. Aside from damaging ad networks, it also actively harms site owners by increasing the risk of them getting blocked from the ad networks that fund their work.

I don't see a lot of merit in AdNauseum. It feels to me like a petty "fuck you" response from people who don't like ads.

The purpose isn't to inflict damage on ad networks, it's to make you more difficult to track by burying your signal in a bunch of noise.

Let's take another, more similar analogy: some secure messaging programs are designed to resist network analysis, which invariably involves sending some kind of "noise" to clients whom you are not actively communicating with, to mask your actual communication. Depending on your point of view, you could frame that as an "attack on your ISP" - after all, aren't you sending unnecessary junk traffic? This is the same thing, except for the web instead of messaging.

In general though, not picking on you in particular: I really see a lot of nerdfolk who don't understand that intent and context do matter. I see it particularly often in legal contexts where people think they've figured out one weird trick to escape the law. Like, I don't know, people who think that they can claim they forgot the password to an encrypted system they use on a daily basis, and the judge is just a computer who will say "oh no I am defeated, beep boop", instead of a human being who will think about whether that's reasonable and throw them in jail for contempt.

It would be wildly unreasonable to think that AdNausium is a click-farming scheme, or a DDOS attempt, or anything of the like. Context does matter.

Also, if some of your clients actually using your primary "features" (clicking your ads after they load a page) is a problem for you, it's hardly their fault. By all means feel free to discontinue serving them ads if you don't like it.

Your ISP example doesn't work because it's not about the "junk traffic". Sending "junk" to your ISP wastes a little bit of bandwidth but doesn't meaningfully damage their business model (might make them money depending on the pricing model). The goal of this plugin is literally to destroy most of the value that ad networks provide (namely targeted advertising). This doesn't simply remove a user from advertising networks dataset (like an ad blocker) but poisons the dataset. This harms ad networks and everyone who relies on them to fund their work.

Blocking users who run AdNauseum does seem entirely appropriate to me. Blocking the plugin from Chrome also seems appropriate to me.

This was not the case when I looked at the code years ago. I would not trust any statements to the contrary without reviewing it again for changes.

A "click" is a download. In order for the ad network to register your click, you are necessarily sending a request and receiving a response. Whether the browser ends up rendering that response, I don't know, but it's certainly possible, especially because ads generally involve redirects which may also be instrumented and may involve JS instrumentation, making spoofing clicks difficult without following redirects and rendering the resulting page.

I think the idea is that the ad networks then don't have any idea what you are actually interested in. The problem from Google's side is that it is pay per click for the advertiser so advertisers are paying for these fake clicks.

It can also cause Google to ban sites from Adsense.

Google will ban a site from hosting Adsense ads if Google believes that the site's operators are generating fake clicks. The way they detect this is a trade secret, but many sites have gotten arbitrarily banned after users seemingly clicked ads artificially in a misguided attempt to help the site.

This extension will no doubt be used by a certain subset of users. Those same users may use some sites in a disproportionate number, that could result in people's favorite sites getting banned and losing the ad revenue that keeps the lights on.

I don't actually think this extension is "bad" or "wrong" just might have unintended side effects.

Google harms website operators based on the actions of third-parties. Third-parties are to blame.

Is re-stating what I said above really constructive? Yes, that's what might happen. You may not like it, but that's the reality of the situation.

I think blaming third parties in this scenario is silly and Google should be broken up.

"It can also cause Google to ban sites from Adsense."

If you object to ads, is that a bad thing?

Yes. I'm happy using the site with Adblock. I would be unhappy if they shut down because all of their revenue was lost. I'm aware of the implied hypocrisy but I'm content because I'm unwilling to continue using the product with ads. Under the current system I am able to have my cake and eat it too.

> is bound to get you so many tracking cookies

I just installed the extension on Chrome and it seems to block the cookies on those requests. There's also a setting in their settings panel that mentions blocking cookies (checked by default).

Even without explicit cookies, many ad networks use cookieless fingerprinting (e.g., https://amiunique.org/) to uniquely identify you or, at minimum, your IP address. You give up a considerable amount of your own privacy and browsing habits by using this plugin.

And why would this plugin help cookieless fingerprinting? This is just another baseless statement.

The explicit purpose of this plugin is to make the signal disappear within the noise. Explain what "considerable amount of one's own privacy and browsing habits" this plugin exposes, or stop spreading FUD because you are ideologically opposed to it.

> enjoy the exploits that your browser downloads and runs in the background by clicking every ad! :-D

this just comes off as FUD, do you have a code example of this?

Ad Networks are well known to be common targets for malware distributing shit bags.

Absolutely but that doesn't automatically mean the firefox plugin is vulnerable to such malware.

The plugin makes your browser "click" the links, no?

It's running in your browser, it's as vulnerable as if you clicked on every single ad you see, no?

Not if the plugin is able to run the request in some sort of sandboxed environment.

Doesn't AdNauseam provide extra revenue for the websites you browse? (at least temporarily, with fixed PPC rates)