Hacker News Reader

> This CNAME method is also a huge security issue, but I'm not gonna go into that.

I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.

That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?

Yep, that combined with an orphaned DNS record

How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)

Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Yeah, uBlock Origin recently added a new permission request just to allow that.

From my understanding, it only works in Firefox and not Chrome though as an FYI.

Correct. Chrome doesn't have such mechanism and if I'm not mistaken, they've already shot down the idea of adding this API.

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Right

Thanks! I hadn't heard of this method. One question though: What will prevent the ad providers from asking their customers to add an A/AAAA record to one of their IPs? That'll be much harder to combat for an adblocker especially because those IPs will usually be shared with actual content services.

Of course this'll add overhead to the visited website manager because the IPs will probably change regularly as they're pointing to cloud services. But I'm sure they'll manage to automate this.

I bet this will be the next step in this cat & mouse game.

I think it would be only marginally harder to combat, since now you just need a list of IPs to block. Someone would have to maintain the (likely ever changing) list of IPs used, but that's not so different from what's happening now.

> Someone would have to maintain the (likely ever changing) list of IPs used

What if the ad-network is domain-fronting via a CDN? Either ways, can't block IPs since http-domain <-> IP isn't supposed to be a one-to-one mapping, each belong to different layers of the TCP/IP stak.

> This CNAME method is also a huge security issue, but I'm not gonna go into that.

A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?

For the website - https://news.ycombinator.com/item?id=23137309

cdn.goodsite.com -> tracker.badsite.com

cdn used to mean - serve the same static content all over the world and speed things up.

cdn now means - serve up different content to every single person and track them.

take a look at stack overflow and it's cdn.

Just because bad guys use a CDN doesn't mean CDNs are bad