Hacker News Reader

Hacker News

Comment by teruakohatu | Hacker News Reader

Parent Full thread

teruakohatu

The next step is simply proxying the tracker through the original website.

/img/logo.png?uuid=..&res=1920&os=MacOS&osv=11.2

and when heuristics catch up with that ...

/img/logo.png?757569643D2E2E267265733D31393230266F733D4D61634F53266F

View on HN

In the limit, they can always send visitor statistics directly to whoever is paying, without involving your browser. This can be done entirely on the server side.

But these changes are still good for privacy. These direct-proxy endgame methods will hopefully make it harder for ad companies to detect ad-fraud, making the ads less economical to begin with.

The game isn't between the host wanting to push ads and the client wanting to block ads. It's a 3-way conflict between the client wanting to see the fewest ads, the advertiser wanting their ads to be seen by the most clients, and the site host wanting the most ads to be seen by each client. And neither side trusts either of the others. If the entire transaction was only carried out between the site and the client then the advertisers would have to believe that the reports being delivered to them by the site owner are accurate. And they know from experience not to believe it. So they insist on having clients tracked themselves or by a third-party (fourth-party?) which is where all the complicated connections, alternate domains, and bloated Javascript come from.

You could do the same thing with a separate subdomain like this—the CNAME strategy is just using DNS to point to your provider so you never have to serve analytics requests yourself. If you self-host analytics, CNAME blocking was never intended to nor will prevent that.

OK, we can still run some user script or have a browser setting, which removes the ?757569643D2E2E267265733D31393230266F733D4D61634F53266F part for things like images. What would be the level after that?

The endgame is that the browser is only a thin client (think VNC) and the actual website is rendered server-side.

I think for ads this might actually be an improvement (compared to no blocking). A big reason why ads continue to stink is because they always seem to be much more poorly optimized than the actual site. I'm probably being too optimistic though, they'll probably just move the slowdown to the server rather than on the client...

Then nightly releases or AB versions of pages that change the image file name, it's place in the Dom, the structure of the t tracking links, so user scripts are difficult to maintain. Or the tracking company could just develop a browser and convince 90 of internet users to use it, infiltrate the web standards committee to gain control of web features, release new features that are not standard but get widely adopted, make many websites check for user agents of browser to ensure they are using the tracking companies browser, so most other viable browsers fail, then implement their own tracking in the that browser that cannot be blocked by user Javascript, and release a whole new OS that has browsers without extensions, or the basic ability to manage the flow of your information .....

But wait, that is today! fakes shocked expression

You just have unique names for images - isn't that already used for email pixels?

ie, se09d.png

Also used sometimes for standard cache invalidation efforts so common for both nontracking purposes too.

Worst case sites will just install a middleware layer to proxy all their requests and traffic back to ad tech machine I'd imagine or install some middleware on their stack.

https://en.wikipedia.org/wiki/Steganography

Think along these lines: website.com/blog/f5/babBys-first-bl0g-post-2f.html

Can you (or a computer program) answer definitively whether there's a tracking ID in that URL?

DNS is cheap, host proxying is less so

Not exactly. If the site is already using a CDN it shouldn't be too hard to add a custom route or something. Even better is if the ad company is also a CDN. That doesn't seem too hard to do, just rent a few VPSes around the world and you should be set.

still more than just pointing to an IP address

Reply on news.ycombinator.com