Are ad blockers doomed or have we already won? A history lesson
adguard.com
adguard.com
Websites can be so ridiculously short sighted and just want to squeeze out every penny they can not thinking of the users they end up losing in the process. And they do lose users And fast. Personal experience time!
I ran a pretty popular wiki for Dungeons and Dragons homebrew on what used to be called Wikia. At some point they decided they available needed to have some terrible new skin that was stuffed with ads and unbelievable ugly. We pushed back but they were adamant about forcing it, so I took all the content and all the users and self hosted it for almost a decade afterward. The Wikia site was completely dead. Sucks for them but their choice.
I paid $10/mo or $20/mo for the site depending on the year, and never ran ads. At one point I got an offer from a company in the same hobbyist space to buy it from me. At that point I was extremely sick of being my own sysadmin and worrying about security vulns so I accepted it. Now some time later they're trying to pull the "stuff it full of ads in the worst places!" routine. Users are getting pissed and starting to ask me about taking all the content...and users...and going off to a server adminned by me again.
If I do this, it will be completely devastating for the site and tank their traffic. Do they care or realize? Guess we'll see.
All of this could be avoided if they just made the ads less shitty. Not showing up in the middle of navigation bars. Not being bigger than the surrounding content, so it completely stretches it and ruin's the site layout. Not having a completely clashing background color to the site. All extremely simple stuff.
Slightly unrelated, but I heard a good quote the other day: "If you torture the data long enough, it will confess."
Wait. I mean, it was my idea. Why aren't you thanking me? Donate to my Patreon please.
But it's actually pretty hard to find something where A/B testing would be appropriate, outside of measuring effectiveness of ads of course, since they are naturally short term and consequence-free.
The content was all licensed to the wiki under CC-BY-SA. So even if I could have legally sold the content, which I couldn't have because I didn't own it, I and my users could fork it however we want.
In the end solved my attack of the guilts by becoming a subscriber. However, I had no sympathy for them no getting money form ads. That was totally self inflicted. The ad blocker, the thing they were blaming, wasn't the problem. Without the ad blocker I would not be visiting their site at all.
At least beforehand the best they could do is to get pseudonymous network & browser data (if they managed to get past my countermeasures like uBlock and nasty IP ranges blocked at the network level), where as once I pay they now have confirmed billing details they can do whatever they want with. If they don't respect my privacy before I pay then I have no reason to trust they'll suddenly respect it after I pay. Most likely they'll just attempt to have their cake and eat it, aka take my money and still stalk me.
Does the new owner, under their own power, set about adding ads to their site? Do they install a 3rd party ad tool that does the dirty business? Or does some smooth talker show up and tell them they'll take care of everything for a modest cut of the profits and that person makes a hash of everything?
Because it really does feel to me like there's a certain detachment from the userbase. If the owners are the actors instead of just complicit, maybe they're 'doing us a favor' by showing us how they really feel.
Could you imagine visiting a web site only to have it tell you to disable your virus blocker to view the web page? Yet, web sites make the same requests of your "ad blocker" even though the end result is the same. They want you to disable your security protections and risk infection to view a web page.[1]
Sadly, I believe we've already lost this battle and are worse off for it.
1. https://www.networkworld.com/article/3021113/forbes-malware-...
this is how I feel about all advertisements
I don't understand this. How are malicious ads the primary way to compromise a computer?
It is no longer the before time.
In the now time, ads frequently contain not just text or images, but javascript as well. And already having code execution by virtue of javacript, it is a lot easier to escalate the privileges of that code execution from the limited environment of the browser to installing code on the computer running that browser. Want to deploy your bot? Buy an ad that includes your malicious javascript payload. Now, anyone who goes to a site and views your ad will execute your javascript for free in addition to your offer to sign them up for credit score monitoring.
It just seems like a huge security hole and is not in the interest of ad networks for multiple reasons.
They might have JS in ads, but isn't that from the ad network's infrastructure.
https://arstechnica.com/information-technology/2016/03/big-n...
“Sorry we didn’t realise that there was malicious content in that ad, we’ll do better in the future, and we’ll also work on taking less than four days to remove malicious content.”
In the meantime the reason ads are being bought is the ability to deploy customer enrichment experiences (the new name for malware) which will help customers better discover your product (by redirecting their browser, or rewriting links).
Ad networks are supposed to vet ads to make sure they are safe, but they're bad at it and the system is not set up to make it easy (ads are dynamically generated by whoever's buying them as the page loads).
Many ads are not computer viruses, but almost all of them are malicious.
My dystopian-future fear is that that Web Assembly will be the end of ad blocking (and the end of a web of connected web sites). Big sites will eventually convert to essentially "a web browser inside a web browser" so they have total control over the content and how it's displayed.
Then ad blocking (and other customization) will be limited to "the analog hole" - trying to image detect or OCR things.
I hope I'm wrong, but I've also been asked countless times over the years to "stop people copy/pasting our text" and "stop people seeing our code" and "stop people downloading our images"... the browser-in-a-browser feels inevitable!
Which in turn will start a new trend of website that are "open".
It's a cycle.
Additionally, off the top of my head Bloomberg and NYT both won't allow me to view more than a few articles but let the Google crawler index their articles.
Sounds like an API that will be implemented.
Why not? You can inject any script into a meta header on document start from an extension or do the same in an intercepting proxy.
That doesn't seem too hard to pull off. You're not trying to find objects in an image, you're trying to find near-exact matches in a digitally rendered page.
for example: people who don't have adblockers (like everyone in my family except me)
I won't visit websites with [a lot of] ads if my adblocker stops working. I'll simply stop using these websites. Just like before Netflix, I quit watching cable TV.
Thinking about it, I might as well go to Tor. Surely someone will copy/paste the plaintext content to some hidden service over there, just so the rest of us don't have to bother with ads. I might even be one of the contributors. If there is demand, there will be supply. And nobody is going to bother to "catch these copyright infringers" because nobody gets hurt, in contrast to someone selling illegal firearms or dangerous drugs.
Maybe not most, for now. But there certainly exist people who do this. I do, for one.
People who don't have adblockers are willing to put up with a heck of a lot. Agreed.
But if someone is not technically sophisticated enough to use an adblocker, they're also probably not technically sophisticated enough to find the actual content on a page and just give up.
I see this fairly frequently; someone with limited computer literacy goes to a website from Google, doesn't see anything relevant immediately (because of bad UI or really bad ads), and goes back to Google. Often the site even had relevant content when I look later, they just couldn't see it because they aren't as good at parsing website content.
There are so many websites with equivalent information, if you click on one and it's just garbage at first glance I think hitting "back" is more likely than "read and click on every ad and give them your SSN before downloading their virus scanning software".
HTTP/HTML will become the next gopher, and this makes me incredibly sad
They would need to server side render pages like a streaming game client would.
That's a bit different than a video game that was compiled only once.
This has already happened: Just look at how many websites pester you to download their mobile app or even block content unless you access from the app. From a user functionality perspective the vast majority of apps do nothing a browser can't do. But the killer feature for apps is how much easier it is for the developer to get your location data, contact list, and importantly show you unskippable, auto-playing, 90s-era-popup-level-annoying ads
Using FF on my desktop worked fine.
On every page you navigate to from within the website you'll first get a pop up asking to choose between browser and reddit app.
Or maybe I'm just getting old :D
The new UI is terrible and barely useable. But Gen-Z is used to barely useable UX. (looking at you, Snapchat)
Heyo that's awesome! I feel ten years younger.
There's a user setting for this, somewhere. I found it once. It's default on but once you un-check it you no longer see the app nags. It's great. And terrible they hid it like that.
--edit-- Or there was, damned if I can find it now.
Snapchat is of course app only.
Sometimes I wonder what keeps ad networks from becoming more aggressive. Wonder what keeps them from breaking the content and force users to disable ad blocking. Because I know it can be done.
It's probably because publishers don't want to piss users off. Or maybe it's because on mobile most clicks come from Facebook or Twitter or other apps using web views that don't do ad blocking.
The main reason content blocking works is because anyone can introspect webpages and the source is available for modification. When things become byte-compiled it gets exponentially harder, if not impossible.
Users should respond by creating an open source replacement for the official app. Surely there's a way to fool the server into thinking it's talking to the official app.
Thankfully, iOS does not represent all systems out there. Android systems allow installation of apps from any source and PCs traditionally have no limitations on which programs can be executed by the user. Better alternatives to these abusive "official" apps should be a selling point for these free systems. A perfect example of adversarial interoperability:
https://www.eff.org/deeplinks/2019/06/adversarial-interopera...
That's pretty much the entire difference. It's a difference of degree more than of kind. As I said, Javascript is making much of the web inaccessible to me, and WebAssembly, if it becomes popular, will only accelerate this loss.
Interactivity would be tricky, but static HTML is better than a blank page.
Edit: Found something very similar, but it targets legacy browsers using clickable image maps rather than privacy/security.
int64
uint32
popcnt
copysign
reinterpret_cast equivalent (the js hack for this is abysmal)
pthreads
SIMD
AOT compilation
To be fair, it's been a while since I was last one of the authors of the webassembly spec, so I could be missing some things.
Personally, I would prefer to browse the web in reader mode. While we're at it we could do the have the same for PDFs.
And then I'll just stop visiting. (:
I ran a pretty popular wiki for Dungeons and Dragons homebrew on what used to be called Wikia. At some point they decided they available needed to have some terrible new skin that was stuffed with ads and unbelievable ugly. We pushed back but they were adamant about forcing it, so I took all the content and all the users and self hosted it for almost a decade afterward. The Wikia site was completely dead. Sucks for them but their choice.
I paid $10/mo or $10/mo for the site depending on the year, and never ran ads. At one point I got an offer from a company in the same hobbyist space to buy it from me. At that point I was extremely sick of being my own sysadmin and worrying about security vulns so I accepted it. Now some time later they're trying to pull the "stuff it full of ads in the worst places!" routine. Users are getting pissed and starting to ask me about taking all the content...and users...and going off to a server adminned by me again.
If I do this, it will be completely devastating for the site and tank their traffic. Do they care or realize? Guess we'll see.
Actually the issue is that the companies paying you to run the ads don't want you to host it yourself.
* They're paying for impressions, and they don't trust you to report those honestly.
* Real time bidding means the ad to be displayed often hasn't been determined until a few milliseconds before the page loads in your browser.
* They can't (as easily and reliably) collect demographic and behavioral data (ie spy on you) if you don't contact their servers directly.
The way to fight this is to work together with accessibility advocacy agencies, like the ADA.
An obligatory link to an important talk: https://www.destroyallsoftware.com/talks/the-birth-and-death...
For the time being, you can thank the threat of an accessibility lawsuit for slowing this future down. Building a custom renderer might not be as challenging as supporting the myriad accessibility needs of disable users.
If ads were more expensive to purchase we'd see a lot fewer of them and they would not be as intrusive. But this ain't so and we need adblockers.
They (the advertising industry) come back with a stronger system that is harder to ad block and we retaliate with something else. What baffles me is that they don't see that we are resisting, they produce something that nobody really wants. The whole advertising industry is something questionable.
Easier said than done, of course.
For the record, I've no problem with "fair" advertising, the kind that used to appear in newspapers and magazines in the 1970s, for example. (Well, aside from its use as a virus vector.) But modern day web ads are simply abusive in too many cases.
The answer to that is to disable Web Assembly, much like a lot of people disable JS. The whole idea of running other peoples code on your machine is the problem, and it baffles me that browser companies are still trying to enable more and more of this. I don't want your code running on my computer.
This future seems inevitable. The only sites you'll be able to actually use without some custom web assembly renderer will be those which don't serve ads at all now - wikis, open source projects, non profits, corporate web sites, etc. Any site funded by ad revenue will effectively remove itself from the web and into its own web assembly app instead.
We might even see the rebirth of something like AOL, a meta app that will be a portal to render content for others who want to use the platform. It might even just be an upcoming version of amp, or a new feature offered by Facebook or cloudflare...
I don't see why Webassembly should the inevitable slippery slope to the entire web becoming some kind of closed source binary-only dystopia, other than it being loosely associated with Javascript, which half of HN hates and fears to a degree bordering on mania. The FUD really needs to end already.
Not sure what you mean by that. There were plenty of sites not usable at times because of their use of java or flash.
I'm claiming that thesis is incorrect because prior methods existed and still exist to encode websites as embedded binary applications, yet ad-driven sites still primarily use HTML, and the HTML driven web still exists.
How usable sites using java and flash were isn't relevant. Either all ad-driven sites seek to maximize their control over the end user by any available means at all cost, or they don't. As they evidently don't, the slippery slope of WASM leading to the end of the free web seems unlikely.
The thesis is that WASM will be the form of HTML's destruction, not that it is the only tool capable of it.
A confluence of trend lines lead it to be "in the right place at the right time." We've already come to accept that much of the web requires javascript, if it works in Google Chrome then that's fine, and video content requires DRM blobs.
The public is ready for this, and ad-supported content providers are floundering even though the fed keeps printing money.
With how much money is spent on bogus technical solutions in the ad space with marginal or no recognizable benefit, the time is right for innovation, and WASM is arriving just in time. Just like with AMP, I'm sure WASM-AMP will be sold for its amazing performance characteristics, because the modern web is so full of trash how could it not be at least better than the status quo?
WASM isn't some uniquely horrific development, it's just the next evolution in the downward trajectory.
Google's AMP technology aims to do this, although they will claim to have more altruistic motivations
Then, naturally, there is no dev time set aside for copy and paste, because there is no business justification.
So, bring it on?
> The very beginning of ad blocking is the 90s, just when the ads appeared. In 1993, GNN, the very first web advertising service, was launched. Then in 1994, the first-ever banner was sold. In the blink of an eye, the online ad industry was worth billions of dollars. Double Click emerged, Yahoo started to sell ads. And that's when the very first ad blocker was created.
GNN (Global Network Navigator) was not an advertising service. It was the first commercial online magazine. O’Reilly & Associates, the publisher of GNN, wanted to see if a website like GNN could be supported through commercial sponsorship. GNN’s ads were informational — much more like whitepapers than a display ads. (Wired’s HotWired site, which launched at almost exactly the same time as GNN in the fall of 1993, invented the banner ad, which of course is what most adblocking tech has targeted. Cookies for tracking didn’t come along until later.)
Source: I worked on GNN as technical director, and in fact my first job there, in the summer of 1993 about a month before we launched, was to assemble the first ‘ad’ — a set of articles about intellectual property law, sponsored by the now-defunct Bay area law firm Heller Ehrman.
Isn't that the same thing? With a couple of exceptions, magazines are advertising services first and foremost, in as much as the overwhelming majority of their revenue comes from ads.
But I’ll tell you that the the existence of GNN itself, in 1993, was certainly not for the purpose of serving ads. Heck, as I explained, online advertising didn’t even exist at that time (besides a few misguided attempts on Usenet), so there was only conjecture that it might work at all, and lots of room to experiment.
Also, there was really no other economic revenue model accessible to us, other than sponsored content, as there were no online payment systems on the WWW of that era. Heck, there weren’t really any active websites at all — almost all sites (including GNN) were what we’d today call static sites. (As I mentioned, cookies came later, so there was also zero targeting of ads besides basic demographics of Internet users at the time.)
My cynicism comes not from being ignorant of traditional newspapers but from having been very close to them. My experience is that people (in any industry really) may be decent, noble, and above any such influence on any conscious level, and yet they will nevertheless show an almost magical tendency to act in alignment with their economic interests, even when they seem to have reached their position on wholly unrelated grounds.
upd: done
But even I know that uBlock was bought out and introduced 'acceptable ads', and that uBlock Origin became the community fork which maintains the spirit of the original uBlock.
That deserves more than a footnote, imho.
This was the first attempt at finding a compromise with advertisers, hated by a huge part of users and advertisers at the same time. But it was launched by Adblock Plus in 2011, long before uBlock was developed.
uBlock is the original version of uBlock origin. Both were started by gorhill4 (sp?). Gorhill got sick of the constant support burden of people coming into his repo and reporting unblocked ads, which he then had to redirect to the filter list repos.
He handed the entire project off to some teenager with little programming experience. Said teenager did little but make a new website and request donations, core work basically halted.
Afterwards, gorhill got sick of seeing his old project be abandoned and get a bad reputation, and forked it as uBlock origin.
Thus, uBlock origin is not a community fork.
Personally, seeing ads in public spaces feels just like in totalitarian countries you would see large portraits of the supreme leader or government propaganda. Somehow this is legitimized because they're private corporations. Not in my book.
More power to ad blocker authors, and a particular shoutout to:
* Raymond Hill of uBlock Origin fame: https://github.com/gorhill/uBlock/
* The EFF, for blocking trackers and other 3rd party nasties with Privacy Badger: https://www.eff.org/privacybadger
It's mostly just not worth the effort any more unless you have an ad blocker in some form.
I am honestly baffled sometimes how this all works... In my 30+ years of internet usage in one form or another I have rarely, rarely, rarely ever clicked on a freakin ad. Yes, I've generally had them blocked for the most part. But when they aren't blocked, I see what the content is and why would I even want to click on one!
Color me confused who is keeping the web running by clicking on ads.
I don't work in marketing but even if I personally hate ads, they unfortunately work really well especially in combination with facebook/googles profile on everyone and the fact that they seem to learn who clicks a certain ad after a few days and only display it to that group.
I've seen many non-tech people search for a certain brand or product, and despite it being the first non-sponsored search result, they will instead click on the sponsored result/ad ad the top even though it's the same product.
The above causes the metrics and conversion rate to look great, so the waste of oxygen that is the marketing department can justify their salary and budget, the ad providers and all the ecosystem around it also gets paid, but at the end of the day that ad wasn't actually providing any value because the user already had the brand in mind and only clicked the ad by mistake.
I suppose it's fun to think that billions yearly are being thrown into the bonfire, but that's just not the reality
Even before social media and the intrusion of internet use in our lives, people were buying enough crap off of QVC to keep that show on the air (and still are).
If I were typical, advertising would collapse almost overnight.
The lesson I take from that is that we're just not the people advertisers are aiming at.
I think the reason the advertisements have become so good at targeting her is because she likes looking up clothing on Pinterest.
We send each other concert ads over Insta far too often for it not to be effective.
Either way, though, neither of our experiences tell the whole story. The truth is in the metrics and I used to be in the ad tech industry. The metrics are solid. Especially on the guys who own the platform: Google w/ search and Facebook which just attracts users like nothing else on its properties.
Though I personally can't tell how effective it is, since I also run Bypass-Paywalls and uMatrix, so I don't know how much credit to give to those extensions.
I understand not all advertising agencies are responsible for this behavior but when these types of attacks can occur on mainstream websites such as Forbes[1], I frankly cannot trust any ad network to not infect my computer.
[0]:https://en.wikipedia.org/wiki/Malvertising [1]:https://www.engadget.com/2016/01/08/you-say-advertising-i-sa...
Yet the Washington Post blocks me as using an ad-blocker, possibly because I'm using Linux, possibly because of no autoplay. But altogether, it seems like anit-adblock efforts are going to start having more and more collateral damage.
They propose a perceptual ad-blocking scheme where ads are always rendered in a DOM, but elements only displayed to the if they are not "ad like". This is makes it much easier to evade ad-block detectors, since your browser appears as if it does not have an ad-blocker! https://www.cs.princeton.edu/~arvindn/publications/ad-blocki...
Mobile will of course fare far worse unless you root your device, for ios and android. Can't wait for the inevitable day where the unskippable 10 min youtube ad pauses if I look away from the screen...
---
A Personal Computer for Children of All Ages
Alan C. Kay
Xerox Palo Alto Research Center, 1972
https://www.mprove.de/visionreality/media/kay72.html
>A combination of this "carry anywhere" device and a global information utility such as the ARPA network or two-way cable TV, will bring the libraries and schools (not to mention stores and billboards) or the world to the home. One can imagine one of the first programs an owner will write is a filter to eliminate advertising!
Then images and javascript were eventually allowed and it was all downhill from there. Now it's a race to the bottom of how many hundreds of external objects and tracking that can be added to a page as well as malware since so many badly behaving ads slip right through any attempt at automated bans.
This is already a concern in the DNS world, with Response Policy Zones (RPZ) on one hand for DNS-based control (https://dnsrpz.info/) and DNS Over HTTP(S) (a.k.a. DoH) on the other.
Also - don't get your apps on Google or Apple's app stores! Use APKMirror, APK pure, etc. Some of these even have app-store-like apps to use instead of Google's, that don't need a Google account.
Also, there's at least one app "store" app specializing in FOSS purely: https://f-droid.org/en/
It changed the landscape on Android in my opinion: it was the first browser that was as good as Chrome (fast, same look & feel -- being a fork of Chromium -- plus regularly updated and having strong, credible technical team behind it) but also having ad blocking built-in and other additional privacy measures. Soon Opera added ad blocking as well, and other browsers (except Chrome) followed.
Opera was and actually continues to be a pioneering browser with many "firsts" over the years. I was an avid user of it for a decade but I am saddened that it has become surrounded in controversy with a shady Chinese owner and predatory loans and stopped using it two years ago.
https://www.engadget.com/2020/01/19/opera-accused-of-predato...
parent: I've not seen this problem. I only use chrome on mac. maybe on windows/linux it's doing something differently. as each new tab is a new process, it smells like a goofball file system permissions issue to me. does it still happen if you create a new profile?
it works as you'd expect both with google sync on, off, paused, and never-been-setup for me.
hard to imagine that this isn't some bug of installation for you. there's no way this would be tolerable behavior and if it were because of chrome per se, there'd be lots of uproar so you'd find your answer right away.
I often wonder if people realize that they’re being that person.
What do you estimate the cost is annually for all of the wasted bandwith (especially mobile data) on predatory marketing?
Go back to contextual static-image ads, folks.
2. Open network panel
3. Google Analytics
4. Close tabs
It's disgusting how so many so-called privacy advocates can't even get this right even when talking about privacy.
typo. He means "Safari on iOS". Safari on desktop had normal extension-based ad blocking since day 1. Then the content blocking API came to iOS then later the same API in macOS.
> • No debugging tools
perhaps in 2015 -- I wouldn't know -- but today it's certainly debuggable with the help of a macOS host. Much like remote gdb.
> The maximum number of rules limitation is a huge problem,
not a problem at all. rules limitation is per filter but each adblocker can install multiple filters. I suppose the rules limitation is for latency reasons, in case of a poorly designed blocker.
> It was disproportionately hard to maintain a completely different filter list for Safari alone.
Completely false. filters are regex's. It's trivial to use the same source list with whatever filter technology.
I guess because this article is content marketing, and not academic research, these errors (and omissions) are ok. But I do wish, that given the title, the author had bothered to mention that Bing inserts ads that are not blockable via simple URL filters. adblock+ currently doesn't handle them and I believe they are not handle-able at all via the Safari content filter API. By extension => ad blockers are doomed. So yeah, he's not going to say that because he's selling an ad blocker ...
2. The maximum number of rules IS a problem and it is there only because the current implementation consumes to much memory and slow to compile a content blocker. WebKit devs may allow us to pull request an alternative implementation (there’s an ongoing discussion on bwo), and if there are no performance issues, the limit will be increased.
3. Regarding maintaining a filter list, traditional blockers do not use regexes unless it is really really necessary. What’s written in this post is by people who maintain filter lists for over 10 years.
> uBlock Origin was ported for Safari in 2016, and was updated regulary (mostly changes from the main project) until 2018 when development completley stopped. Since then Apple has begun phasing out Safari extensions as extensions, and has instead been implenting a new extensions framework which is extremley limited in adblocking functions, only allowing "content blockers", which are just links bundled as an app which Safari enforces. From Safari 12 / macOS Mojave, old legacy Safari extensions were still allowed, but came with warnings saying that they will slow down your browsing (they infact won't, or at least not noticably). ... Though it is still curently possible to install uBlock Origin by downloading the extension from Github (edit: must follow these instructions, it will not be starting from Safari 13 / macOS Catalina, when the legacy entension API will be fully deprecated.