Hacker News Reader

Comment by varenc | Hacker News Reader

Armed with this information I discovered the endpoint codepen hits when it detects that the ad-serving script is blocked!

    https://codepen.io/cpe/puppies-and-kittens?id=<id>

It looked so innocuous it took me a sec to notice. You can definitely tell it's named in a way to avoid blocking rules. I appreciate the little humor too.

Codepen plays nice and just uses this for logging purposes. But when other sites take more aggressive anti-ad-block measures your ad-blocker can still defeat them by silently redirecting some analytics/ad-serving JavaScipt to an internal no-op resource. That way the error handler isn't called but the JS doesn't actually run. Or the JS is replaced with a no-op equivalent. See uBlock's resource library here: https://github.com/gorhill/uBlock/wiki/Resources-Library

(I imagine a site like codepen, with its technical audience, sees a lot more users with ad blockers.)

View on HN

I once felt mildly guilty about JS and ad blocking so I tried running unblocked at work since the performance degradation of all the crap was less noticeable on a fast link. That lasted a few months until I got redirected to a porn site from what was likely a hacked Wordpress system. If I'm going to be assailed by unvetted code that does unauthorized things with my property, I'm going to block everything wholesale without any lingering guilt.

If you're a business and you want to serve ads do it with plain text and images. If you need to track me do it with your server logs. You don't deserve anything else.

> serve ads do it with plain text and images... You don't deserve anything else

Lots of ads are text and images, but they're all placed client-side using scripts, because* nobody buys ads entirely untargeted (they're ineffective). If you're a business and want a purely server-side ad system to monetize your site with, you're going to be looking for a long time. What you're saying basically amounts to "ad-supported business models online should not exist." Which is an opinion you're entitled to, but if this is your stance I'd encourage you to at least try to, for a week, block all ad-supported sites, rather than the ads, to see what the logical conclusion to your policy would be.

*Note: Even without that reason, server-side would be unpopular with both publishers and ad networks because of the need to offer dozens of flavors of server-side SDKs that the publisher would have to integrate deeply into their SS code, rather than using the lingua franca of client-side JS.

Radio, television, and print ads are "server side". Somehow they still manage to work. We don't have to lose all of our agency just because the jerks in marketing have no ethical standards and most people aren't aware enough to stop their excesses.

I kind of agree with you, but on the other hand you either also paid for it – either directly as in newspapers or indirectly via taxes as for some public TV with limited ads – or they were plastered with ads from top to bottom.

So there is perhaps a bit of a balance to be struck. When Google Ads first started way back in the day they were simple fast text ads with content relative to the page you were reading. Since then ... a lot has changed, but I don't think the basic principle of it is necessarily wrong, just the implementation.

You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff.

> You can redirect people to porn sites without JS too by the way; via a HTTP header or a meta tag. If they can inject JS they can probably also inject one of those. Don't think you can really blame JS as such for that kind of stuff.

How? Genuinely interested to know how this attack happens without a click from the user.

Using HTTP status 301/302 or HTML meta tag http-equiv="refresh".

See https://en.wikipedia.org/wiki/HTTP_302 and https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...

That only happens on first load, how is that equivalent to Javascript?

For me it's more about interruption. The most annoying ads I've noticed lately are Substack. I've never liked them and never will but occasionally there are posts I want to read on there (no thanks to them). When I'm in the middle of reading I get a pop-up. I'll take 10 video ads over one of those.

You’re not wrong about the interruption. I’d add bars that are position:fixed and thus narrow my viewport — though about 2/3 of those are the stupid “sticky page headers” that the publisher put there on purpose, so, it’s a different thing.

> nobody buys ads entirely untargeted (they're ineffective)

I liked this argument from idlewords:

https://idlewords.com/talks/what_happens_next_will_amaze_you...

"""Advertisers end up right back where they started,still not knowing which half of their advertising budget is being wasted. Except in the process they've destroyed our privacy."""

That is not true. Attribution is the process that allows you to attribute conversions to ads that you have shown.

>The losers are small publishers and small advertisers

This is not true. In fact small publishers and advertisers are the ones that benefit the most from targeted advertising since it means they will have to spend less to get a customer. If it becomes too expensive for a business to get customers they will go out of business.

You can have targeted ads without tracking. For example, put ads for cooking utensils on recipe websites.

I work for what’s ostensibly an advertising company, so I have made the choice to not put an adblocker on my work machine, which is pretty decent and wired into a very fast connection. The ads load pretty fast but I’ve learned to be careful about which tabs I leave open in the background.

> I appreciate the little humor too.

Somebody going out of their way to name a file erroneously with the intent bypassing a security and privacy control I’ve gone out of my way to deploy is not what I’d call humour, it’s disgusting.

They're only logging if the script failed to load. They just want accurate metrics on how many people are blocking the ad serving script. Personally, I want them to know I'm blocking their ads since it sends a signal to them about what I care about. It's not clear to me that all ad-block users are categorically also objecting to 1st party analytics of any sort. Most ad block rule lists don't even try to block 1st party analytics. And as I said in my comment, this only works because logging is all they're doing. If they tried to use this technique to block ad-block users it would quickly be circumvented.

I understand you might not even want to signal this to them. That's why I shared the endpoint it's hitting. I want people that really don't want even this type of logging to be able to easily add a block rule. I admit in retrospect a less hidden and more obviously named endpoint would have been more polite. Personally, I really think it's a stretch to call it 'disgusting'.

I would imagine that in the future ad-blocker will need to actually run the javascript, but in a separate temporary context. In Firefox terms a tab that runs in two containers at once. A shadow context for the ad-machine and content nuggets gouged out for the actual user to view.

Reply on news.ycombinator.com