Hacker News Reader

Comment by bt3 | Hacker News Reader

I think what I found particularly beautiful about this was the first ~330k characters of ad-related CSS injected into the header presumably through Github hosting or otherwise. I had to scroll about 85% of the way down the page before I hit the <h1> tag!

View on HN

You might have malware injecting content into your pages.

This document actually makes a fairly good "is my browser doing anything funny?" test document.

You may want to check your computer and browser for malware. Possibly also your ISP but as someone else pointed out that'd be hard to pull off on https.

Noticed the same thing and found that it was caused by Ghostery.

Makes the marketing claim that much more amusing.

> …to speed up page loads, eliminate clutter…

To be fair, hiding elements may mean not fetching any resources needed for their content, which can be faster despite having to parse a bunch of additional CSS first to determine which ones to hide --- especially if the former involves the execution of JavaScript.

Loading one snippet from an extension (i.e. the cache) is vastly faster than loading dozens of scripts and styles over the network.

In my case it was Opera's built-in ad blocker.

What does this mean about Opera's ad blocker? (I also see a ton of junk up top when Opera's block ads is enabled, but I don't know what to make of this.)

It means that it's more of an ad-hider than a blocker, adding more CSS to hide the relevant elements instead of stripping them out completely (which something like a MITM proxy could easily do.)

Yep this was it.

Thanks to all for your concerns of my potentially malware-infected PC, alas, it was just an ad-blocker.

Vanilla Chrome will also inject code if you have a * style rule.

either you're kidding... very good... or your ISP is doing that... but wait that's not possible for https content is it? I don't know, nothing's implausible in this world anymore.

FWIW I don’t see anything extraneous, neither in the source code nor on the page. Browser extensions can inject content, of course; that might be what’s happening here.

It's more likely that he has a browser extension that is doing this. I have DarkReader installed, and I similarly saw a bunch of style tags at the beginning of the page related to DarkReader (which applies some CSS rules to make everything "dark mode"). To the GP, you probably want to double-check your browser extensions (unless you were actually kidding).

Yes, HTTPS can be man in the middled by your ISP.

Only if they have you trust their certificate root, or you constantly click through the certificate warnings.

This seems mostly not true. Can you elaborate how?

I have the same, but it's just Opera's ad blocking. Check what extensions you have installed

I got cVim related stuff in the header :-)

Reply on news.ycombinator.com