Hacker News Reader

Comment by Vaslo | Hacker News Reader

Is there a way to hide adblocking from the site so they don’t even know you’re using it?

Not with current technology because all ad blocking does is blocking hosts. So a site can tell if parts of the code have loaded/executed or not. In order to go completely stealth you'd have to let the page load everything and then just don't show it. But that's way more complicated and besides a bit pointless because part of the reason for ad blocking is to make sites load faster by removing all that bloatware. That, or we move ad blocking out of the browser and into the OS where sites have absolutely no access whatsoever.

>Not with current technology because all ad blocking does is blocking hosts

That's funny as first adblockers on Firefox used to just hide divs. Browser was still downloading flash object and images, but was not displaying them

>That, or we move ad blocking out of the browser and into the OS where sites have absolutely no access whatsoever.

Interesting concept. Asking as a layman: is this possible? Is the browser sandboxed enough away from the OS that this is a difficult problem? Is that why we haven’t seen solutions that implement this approach?

Possible yes, probable not so much. Building extensions is simpler than building desktop apps. For one you need only JavaScript. While if you move in the OS you'd have to support different versions of systems (you have Windows, OSX, Android, IOS, Linux) and it is much more cumbersome than in the browser.

>That, or we move ad blocking out of the browser and into the OS where sites have absolutely no access whatsoever.

that's probably overkill. all you need to do is move the adblocking part further back into the rendering pipeline (ie. outside of the DOM) so that javascript can't detect it.

What does "move ad blocking out of the browser and into the OS" even mean?

As long as you have websites built by JavaScript, trying to do perfect adblocking is solving the halting problem. Can't do that, but we should start fixing the most obvious, glaring abuses (JS need not be able to tell if something actually loaded, no 3rd party host resource, certainly no 3rd party scripts. If I'm putting foo.com in as the address, my browser should only be talking with foo.com)

You can't turn off third party JS. What if I have an Intranet that's loading an external API. It could be anything from a chat session to analytics. You do that and you break the web.

Well, it's feasible if you fork the web instead. If a significant number of people want draconian measures to be taken, and they converge on a search engine that can exclude the non-compliant, then the new standards have a chance of catching on.

Suppose I say I just want to eliminate javascript entirely - that's not feasible to enforce, but if I could just search the non-javascript pages out there, then a new way of doing things can be bootstrapped.

Uhm, external analytics is exactly what we're trying to break here. And if you need an external API, have whoever is serving the Intranet page load that - that's how it's been forever. Websites loading data through JS from 20+ endpoints on a single page is very much a recent disease.

I run all of my browsers (including mobile) with all 3rd party scripts blocked by default. Most sites that you care to casually consume will work without issue. Anything that uses a payment provider or google to login needs 2 greylist rules (which are mind-numbingly simple to click on once).

I can set it up for people that don't understand what they are doing (and I have) and they will not notice anything in almost every case.

As such, I conclude that this generalisation is grossly overstated and you probably haven't tried it to see if what you are saying is correct.

I don't see how moving to an even higher level of abstraction would help. At the OS level you can basically only block hosts (unless you're inspecting packages but that seems excessive).

Doing what uBlock origin does by loading dummy versions of common tracking scripts is a lot more effective.

The reason I use an ad blocker is not to see intrusive ads. I've whitelisted a site and told Safari to immediate go in reader view mode for the site. It's a decent compromise.

Run a browser without adblock in virtual or headless setup with JS on (so that they can e.g. measure size of loaded images) with custom extension that will in read-only way (all code has to be in anonymous function so that it doesn't leak global variables, no changes to dom, no timers or intervals) extract articles and send them somehow out of this virtual so that you can read them. Extracting code would have to be tailor made for each site. IMHO doable. Alternative is copy paste article title to the Google and find news outlet that doesn't block the adblock.

The scripts these user detect that you've blocked the ad load. So, there are now adblock lists that block the block detectors. So, there are not adblock detector block detectors. It's an arms race.

Not if your browser extension is blocking the remote Javascript code that's used for displaying the ads.

And even if you did manage to reverse-engineer an extension to send a "ads loaded" token to the site, their ad network would update their code a week later. That's why folks call it an arms race.

as long as the user controls what its cpu execute, they have an edge :) It's a losing race for publishers on desktop.

yes, but it will have to operate outside the DOM. currently adblock killer/detection scripts relies on the fact that resources/scripts fail to load (both can be detected), or an element isn't showing (the nag message is hidden under the place where the ad should be). if your browser is dutifully rendering the ads as intended, but blocks it out in the frame buffer, there's nothing the site can do. no such adblocker exists as of yet.

Which means you loose a lot if the benefits of an ad blocker, and thus makes it worthwhile to instead invest in the arms race: You have to watch a black screen for the duration of video ads, ads that pop up overlaying content still get in your way, you loose the bandwidth/memory/CPU capacity for loading and rendering them.

Loose == !Tight

Lose == !Win

right, thanks!

They’d just make an Adblock detector detector detector

There's an ad block detector called "FuckAdblock", so the tool to circumvent it is called "FuckFuckAdblock". There's probably a fuck^3adblock

I assume it's theoretically possible to ghost render and and execute tracking scripts in a sandbox? Just need some browser support ...

They'd probably run a suite of microbenchmarks in the sandbox and use that performance profile to fingerprint you. That might be an improvement over the status quo, but I think the basic rule is that if you let tracking scripts phone home, you lose.

You could setup something at the network level, which zaps requests before they even make it to your computer. Pi-hole [1] works well. Still using it in conjunction with browser-based ad blockers though, but it works for all devices on your network, even smart TVs and Rokus.

[1] https://pi-hole.net

https://pi-hole.net

Reply on news.ycombinator.com