Hacker News Reader

Comment by rahuldottech | Hacker News Reader

uBlock Origin is one of (if not the) best browser extensions. I want to support websites, I really do. And I don't mind non-intrusive ads either.

But all the tracking and privacy invasion that comes along with that? No thank you.

View on HN

Just a few days ago I visited a site that was begging me to turn off my adblock. I naively tried it and... the site became literally unusable. Things like the download button were hijacked to a random ad site. The text of the site was replaced by an ad that wanted me to fill in a survey.

It makes me wonder how people without an adblocker can even browse the web.

I would like a thing separate from an adblocker, that doesn't block ads per se, but instead disables most of the APIs that the tab can use to interact with the browser, e.g. opening new windows, modifying history, disabling right-click, navigating to a different domain from a whole-page click handler, etc. Javascript could still run, but it'd pretty much be limited to just modifying the loaded document's DOM.

Better yet, make it so that, when I "turn off" my adblocker, it's turning on this restricted-browser-API sandbox instead. Then, if the page still doesn't work, I could turn on a "compatibility mode" that would load the page with full API permissions.

Does this point of view have or need a name? Something which conveys both the mental model and the possibility?

At first thought it might be something like "sandbox javascript to the DOM".

Relatedly, I don't know if there is a common name for the part of a tabbed browser which implements policy and defaults above the level of individual tabs. In some sense it is a kind of shell and sandboxer (?). Do we need a more shell-agnostic approach??

> disabling right-click

You forgot "messing with clipboard to add `See more at {URL}`" when you ctrl+C stuff.

Listen, if a webpage deserves attention, I'll make attribution manually, but if you try to force it via clipboard, I'll make sure to remove it, again, manually

I would add some CSS limitations as well. All sticky headers scroll out of the way as soon as you scroll down. No obnoxious full screen stickies, especially those appearing after a timeout or detecting that my mouse goes up. Proper contrast, font size and line width. So basically extended reader mode.

To implement this, you would have to prevent JavaScript from reading how far down you’ve scrolled or which element your mouse is hovering over, or else JavaScript could repeatedly insert absolutely-positioned elements over the part of the page you’re looking at.

Yeah. I only started using an ad blocker about 3 years ago, despite knowing blockers existed for much longer. Before then I was able to tolerate ads. But the situation with them have gotten worse over time.

I tried running without an adblocker at work a few years ago. That lasted about six months until the day I got redirected to a porn site by some innocuous looking page.

You mean you weren't tormented by the swat-the-audible-buzzing-fly Flash ads in the days of MySpace and the like? That was the absolute catalyst for me.

Also, browser exploits. Blocking ads make sense as a decent antivirus strategy.

I have never had any virus despite not running antivirus, occasional visits to the seedy underbelly of the web, and often having ad block disabled or not even installed. Nor do I remember anyone I know being infected without being tricked into installing something.

When was the last time a browser vulnerability was actively exploited at any significant scale?

So I can't shake the feeling this is really more of a post-hoc rationalisation for people not entirely comfortable to screw over creators in the rather selfish pursuit of personal comfort.

A couple of years ago, a fairly well known Norwegian news outlet's ad network was hacked, and visitors were served malicious code. If the user had Java installed the code would use a 0-day exploit to _silently and without any user intervention_ install a trojan which would activate when the user later visited the online bank of by far the most common bank here in Norway.

It would then redirect money by modifying the target bank account when the user paid bills or whatnot. The web page looked entirely as it should, it would just modify the request before it got sent.

Now, the user had to have Java installed you might say, so not a big deal. Well, big deal, because the same bank, the most popular one, _required_ Java for signing in to their online bank.

Fortunately the breach was noticed fairly quickly and the harm was limited. But after that I decided no more ads.

Do you happen to have the link for a report for that incident?

This is the exploit that was used:

http://www.deependresearch.org/2012/08/java-7-0-day-vulnerab...

Trying to find the original article I read, the bookmark I had no longer works :(

Said bank has since moved away from Java to a JavaScript solution for their two-factor login.

But yeah, the main problem with ads is that the ones displaying ads have no idea what they're sending to their users.

If you run no AV, how would you know if you were infected?

If the disease doesn't have any symptoms, why care at all?

It's not uncommon for compromised computers to be used as nodes in DDOS-for-hire networks, (though compromised IoT devices seem to be in vogue at the moment) proxies for ne'er-do-wells, sending spam, and other activities that might not be apparent to the user of the computer in the slightest, but still have effects that reach out to the world at large.

Look up Typhoid Mary, please.

do you vaccinate yourself or your children?

There is a list of examples on the wikipedia article for the subject https://en.m.wikipedia.org/wiki/Malvertising

I take it upon myself to install uBlock Origin in every computer I get my hands on. After letting the owner know, of course, but I practically force it on them. And I don't feel any shame in doing this.

one of the reasons i pay for youtube premium.

i absolutely hate youtube ads, but at the same time, i want people these content creators that i watch to get some money from my view.

so for the ones i think are "worth", i use patreon. for the others, youtube premium.

To this day I have not found am AdBlocker that is blacklist only by default and has just one simple button "Block ads on this site" (but not on others)

It can be done using uBlock but it's cumbersome and I always forget which buttons to press.

Is be willing to let ads enabled on most sites but I'd like to block the worst offenders (video autoplay, overlays etc.)

I wonder if this would be effective? If a site is obnoxious enough to warrant explicit blacklisting it's probably obnoxious enough to give you a PLEASE DISABLE YOUR ADBLOCKER.

Not all of them but some might, sure.

I'm using this method today but it's annoying and I always forget which "squares" to tick in uBlock.

I hate almost all ads, but if it's not intrusive, it's just not worth the effort to add a blocking rule for it. In 2019, I think the only "ad" I blocked was "Hot network questions" on SO, because it had very negative impact on my productivity.

I read a "news" article today on some site that uBlock Origin blocked 94 items on.

That's a new record. Thank you to the all the developers who have contributed their time to that project.

Reply on news.ycombinator.com