Hacker News Reader

Comment by northwest65 | Hacker News Reader

How about an opt in botnet extension for your browser that focuses it's energy on sites with this sort of dark pattern behaviour. i.e. You install the extension, when you come across a site like this you vote it for getting punishment, once the site gets enough vote the botnet occasionally focusses it's energy on the site in question when the participants browser is otherwise sitting idle. The punishment could potentially be anything (follow subscribe links, consuming traffic in the background, a simple DoS), but ideally something that reduces the offending servers ability to do what it's supposed to.

View on HN

Instead, how about we make a combination browser extension/hosted service which renders the page server-side, extracts the content, and serves it clean.

Users can leave bounties on sites and once the bounties pile up high enough somebody will come along, sanitize it for everybody, and collect the bounty. Sorry about your ad revenue, next time don't piss off the masses.

The bounties will be public, so site maintainers can see if they're on the list and address the issues. If the community decides that the redesign addresses the problem, the bounty goes back to its issuers.

Legality aside(on both sides), you assume a media site will take an increase in ‘impressions’ on their site as negative on its own. A lot of these places just care about making it look like there’s eyeballs looking at their stuff so they can sell that ad space at a premium, not whether there actually is. Ie. The places that put these auto play videos.

Do advertisers actually believe these impressions metrics are valuable? It's strange that they put value in these metrics that everyone hates while completely shunning other forms of content like porn. I'm not suggesting that advertisers start showing their ads next to porn but rather questioning why they are showing their ads next to news websites based on what are essentially fake metrics.

Even if you assume the server operator is benevolent, that would be trivial to fork (and no one should run a closed-source version of that in the first place) bu someone just forking the extension and using it to trivially DDoS sites for other purposes. Or just break out that part of the code and use it in other malicious client code.

Consider also the sybil vector; I could just use a proxy network to vote millions of times for a site I'd like to see targeted. Or how do you ensure that 1 human = 1 vote? Throw in some PoW? No.

I'm not for building easily available tools for remotely and unilaterally coordinating DDoS attacks.

Because why? Just don't visit these sites if they annoy you. I don't burn down jazz bars just because I don't like jazz.

I'm inclined to agree that committing felonies to avoid patronizing or supporting businesses is a little extreme.

What if you are trying to go to jazz bars but they inexplicably play an extremely loud high pitched tone over the jazz music?

I would go to jazz bars that didn't do that. Still wouldn't burn them down.

No need to burn it down. Just buy a bunch of gift cards for the bar and hand them out to people recently released from jail for drunk & disorderly conduct. If the bar is trying to optimize for maximum traffic at the expense of all other quality metrics, surely they won't mind.

This analogy is getting stretched a bit thin, but: you leave.

Why, are you paying for said jazz bar in your taxes ala the BBC news site?

My taxes fund the DEA and I don't like them, but that doesn't mean the way to oppose them is to firebomb their offices.

I like this idea a LOT. However, the potential for abuse is, forgive me, too damn high. The extension owner can extort sites to not be attacked or attacked less. (a la AdBlock Plus, ghostery(?), etc).

How about if it merely followed links at a rate not high enough to impact the server itself, but enough to poison the analytics well as much as possible, and rather than opt sites in, it just randomly disrupts the 10,000 largest sites.

you're describing https://adnauseam.io/

That sounds like the Blue Frog model from 10-15 years ago where IIRC each spam email would trigger one “please opt me out” request from everyone on the user base. Then the spammers started trying to DDOS them back.

https://en.wikipedia.org/wiki/Blue_Frog

This is a bit like the Blue Frog anti-spam project from years ago

https://en.m.wikipedia.org/wiki/Blue_Frog

That extension would be banned in minutes because that's illegal.

How exactly do you ban a browser extension? How do you consider legitimate traffic illegal?

>How exactly do you ban a browser extension?

browser vendors can blacklist it.

>How do you consider legitimate traffic illegal?

It's fairly obvious that sending traffic for the sake of generating traffic isn't "legitimate" by any means. Your excuse is flimsier as websites that sell ddos services as "stress testing" services.

> browser vendors can blacklist it.

How would they do that? They can remove them from their list of extensions, but I can just download it from elsewhere and add it manually, right?

If you hadn't noticed, extensions have to be signed by the browser vendor, so that you can run them.

A few people who re-compile their Firefox or Chromium to get rid of that requirement will not make a great DDoS botnet.

Well, I have not noticed, because last time I wrote a Chrome extension, I just had the .js files in a directory and I could easily add it to Chrome with developer mode on. I imagine it would be possible with this extension as well.

Things may have changed since then, I have not checked.

Right, similar option to load add-on temporarily is in Firefox. The add-on will not persist across restarts, though.

Installing AdNausiam into Chrome is remarkably difficult. You need developer mode on, repackage the addon manually and then dismiss the dev mode popup every time you start the browser.

In other browsers you need your addons to be signed. Firefox implemented this because of the terrible malware that got installed with adware installers. With administrator access, they kept changing every setting Firefox added to get the addon to load, so they made the entire loading system dependent on signatures. Luckily, adware developers aren't smart enough to load code into the signed binaries to work around this limitation.

You could do it, but it's more of a hassle than you'd expect.

>when you come across a site like this you vote it for getting punishment...botnet...

Or just share the site's reputation with other extension users.

that is vigilante justice and it will end about as well as Reddit trying to catch the Boston bomber.

What actually to do when you find someone's website annoying: Don't go there, it's not your site. Same thing I do when I don't like a bar, I leave, I don't start clogging the drain with toilet paper

Tempting as this is, it's a colossally bad idea: just as one point, how long do you think it would take for the usual operators of botnets (spammers, those attempting DDoS for other purposes, etc) to target the C&C for this botnet? Why go to the trouble of building a botnet when someone else has already done it for you!

Why not just use a browser that doesn't do things you don't like?

Care to implement the W3C or WATWG browser spec over the next week?

How many independent browser engine variants are viable today? Three?

Ramping the difficulty of that problem has specifically limited choice and options.

One class of devices (iOS) mandates a single browser engine (Webkit / Safari). Android has a slight pretense of greater openness, but bundles Chrome into most apps.

https://drewdevault.com/2020/03/18/Reckless-limitless-scope....

Why stop there? Maybe websites you don’t like should have a crowdsourced assassin come to kill the relevant developers.

I've heard rentahitman.com is great. For example: https://www.rollingstone.com/culture/culture-features/rent-a...

Ad blocking grows from the barrel of a gun?

Yeah, so I’ve been a host of things a few times, and got the hate mail, bomb threats and various lawsuits that were aimed at other people but landed with me.

The bomb threats and car bomb threats did get me talking to the sheriff about concealed carry permit, but I backed away.

The poor woman that answered the phone for a shared office space quit.

At Weebly, people bought DDOS but didn’t realize that every site had the backing of our entire infrastructure.

Although you joke, I’ve seen slightly less extreme propositions that were only half-jokes.

Selective pressure for programmer ethics. May take a more than a few generations to cut through all this cash.

Instead of the botnet just make the extension block the site with an explanation. Doesn't uBlock Origin do this?

I think the default filter lists don't seek to block video content like this, but you can definitely accomplish this with custom filters. I have filters set up to block these videos on cnn.

Ad nauseam browser plugin

That's an awful idea. Illegal, immoral, and would be abused.

The replies to this are so funny :D "It's illegal! Immoral! Assassination! Theft! Murder! Felony! To the gallows!"

Yeah, no.

So it's legal, moral, and acceptable that software and websites are made, by you folk reading this here website no less, to consume orders of magnitude more resources than they need to, just so that web companies---you folk, remember---can make some stats go up and turn them into money. It's okay to make the web less accessible to poor people, disabled people, people in places with bad internet connection, perfectly functional devices which have only become unusable because of this whole bullshit &c, it's okay to mine shitcoins in people's browsers, to sell their life for profits, it's okay to literally get into their private life and play loud videos in there if they don't know how to make that stop, but it's immoral, illegal, unacceptable to retaliate? Immoral and triggering for you lot for folk to just jokingly entertain such idea?

This whole business is basically turning wasted money and energy into dollars, not really different than blockchain bullshit essentially.

Imagine the resources wasted to produce and consume this nonsense went to making computers user friendly, programmable and accessible. Like, why should my browser occupy ~6G of memory for ~50 pages which could all be just pure HTML and a couple PDFs? Why should I need 6G of memory when 1 or 2GB must do? Why tf a computer with 1GHz or 666MHz CPU can't handle the web, ie a bunch of text documents? This whole bubble is creating immense amount of waste, and it's nonsensical to just limit your thinking to "oh, some annoying websites, just run uBlock". IMHO comes from the same place with "if car-dominated cities bother you and you feel unsafe, just get a car, or better, an SUV". What about fixing the city? What about climate and pollution?.

It is sad that most of the web is like this, but no, there's nothing illegal, immoral, or unacceptable about people offering to you (for free) shitty services which are a hassle (cost you resources) to use. You're free to not use them if you don't like them.

Your argument is like saying if a barbershop always has 2 hour wait times and has crappy music playing on an excessively loud radio, it's ok to retaliate against them.

If every barbershop is like this, that's sad and should be fixed, but it still doesn't make it ok to retaliate against them.

This is literally the same nonsense your average HNer type says in reply to anything, so I won't bother explaining you shit, but if markets worked to fix things the world wouldn't have turned into shit after neo-liberalism.

So yeah if my barbershop is playing loud music I ask them to turn it down please, and if barber queues are too long, maybe it's time for barbers to be nationalised because the private sector is failing to keep up, no?

That's basically the same thing as what I said. It's not an excuse to go start shooting barbers etc.

Please don't take HN threads further into flamewar, regardless of how bad someone's idea is or you feel it is. This comment is a noticeable step downward into hell.

Also, please don't post supercilious putdowns of the rest of the community. You have no idea who you're talking to here (none of us does). That sort of rhetoric is not only flamebait, it's reliably a marker of extremely low comment quality. We want thoughtful, curious conversation here, not users acting like they're better than others.

Edit: you did it even worse here too - https://news.ycombinator.com/item?id=29456018, and worse yet at https://news.ycombinator.com/item?id=28688315. Would you please review the site guidelines and stick to them? They explicitly ask you not to post like this, and we ban accounts that keep doing it.

https://news.ycombinator.com/newsguidelines.html

Ban.

Reply on news.ycombinator.com