AdNauseam: uBlock Origin fork silently clicking ads on behalf of users
github.com
github.com
AdNauseam – clicking ads so you don't have to - https://news.ycombinator.com/item?id=34886300 - Feb 2023 (69 comments)
AdNauseam – clicking ads so you don't have to - https://news.ycombinator.com/item?id=25043165 - Nov 2020 (11 comments)
AdNauseam: Browser extension to fight back against tracking by ad networks - https://news.ycombinator.com/item?id=20048216 - May 2019 (63 comments)
AdNauseam – clicking ads so you don't have to - https://news.ycombinator.com/item?id=19278936 - March 2019 (164 comments)
Pale Moon blocks AdNauseam extension - https://news.ycombinator.com/item?id=15112524 - Aug 2017 (246 comments)
AdNauseam – Clicking Ads So You Don't Have To - https://news.ycombinator.com/item?id=15109251 - Aug 2017 (174 comments)
AdNauseam Banned from the Google Web Store - https://news.ycombinator.com/item?id=13327228 - Jan 2017 (329 comments)
AdNauseam: Fight Back Against Advertising Networks and Privacy Abuse - https://news.ycombinator.com/item?id=13222733 - Dec 2016 (276 comments)
AdNauseam Browser Extension: Clicking Ads So You Don't Have To - https://news.ycombinator.com/item?id=10611594 - Nov 2015 (72 comments)
Ad blocker that clicks on the ads - https://news.ycombinator.com/item?id=8515398 - Oct 2014 (238 comments)
Not making certain HTTP requests seems to be protected right now. However, click fraud, with which this might be conflated, seems to be a very different matter.
Imagine this being used to justify hamfisted legal restrictions on how everyone's browsers may behave. Or used as a reason or pretext to effectively force even more invasive user identity requirements or device attestation. (Which, history suggests, will then be abused for more nefarious and societally dangerous purposes.)
I think those are both coming. All the major forces are aligned against users: governments, content holders, advertisers, police, and authoritarians everywhere. It's inevitable unless we take the power back.
You send a detailed list of what's being offered, and expected. I return a request for exactly what I'd like to get ... and nothing else ... along with my list of what I'm willing to send in return.
If you don't like my list, deny my request. If you deliberately send me something I didn't checkmark, or change your stated expectations, I'll refuse any more of your traffic.
But I meant it in a much more general sense, for most of what happens on the net .... built-in. A LOT of sites want me to enable services that I don't want to deal with. I don't want google-analytics, or apis, or syndication. A LOT of sites want me to subscribe with a long list of personal information. Not happening. A LOT of sites want me to watch advertising; I quit cable-TV long ago.
I could just auto-'nope' to all of those right up front and they could just - reply 'nope' and go away. All recorded once and for all, never knock on that door again.
uBlockO helps with some of that, but things shouldn't be that complicated, it wastes my time, it wastes a huge amount of bandwidth ... and data center energy needs. Enshittification.
Wouldn't have to be all-or-nothing; there could be maybes. By 'BBS-simple' I mean an up-front human-to-human negotiation style. I download something, if the sysop is looking for something and I have it to share, they'll get it, guaranteed, nothing else. Micropayments for their time? Wish we could do that.
If I click a link on a specific topic, and with that query I auto-communicate 1) what I don't want (images say, or a subscription pop-up, or an unwanted 3MB list of all their other features, services, plans, site history) and 2) what they're looking for) ... they could just say 'no go', or we could bargain. The machines can keep track.
On one hand, distributing and marketing a tool that is explicitly designed to harm trackers can be seen- ie lobbied- as fraud.
On the other, this isn't a targeted campaign of misclicking, this is essentially random noise on a user by user basis.
At scale though, this fucks with a whole lotta peoples paychecks.
Obligatory IANAL.
The majority of ads are bought this way, so your click does not harm the advertisers whose ad would otherwise have been blocked. This could impact the relative value of the publisher’s website, but the industry in general is not overly inhibited by ad-blocking, so I don’t think this extension would have much impact in any sense.
If you put yourself in a place where someone can take everything from you than it's a real risk that they might.
This is true, but it's a lot harder to piss of a registrar than someone like google that has its fingers in all sorts of pies. Your registrar doesn't necessarily care if you're running and ad blocker or if Google thinks your account should be suspendeded because they don't like your app in the play store.
And which ones are those? Once I've selected the right provider, how do I reliably implement my backups?
> If you put yourself in a place where someone can take everything from you than it's a real risk that they might.
I'll just go ahead and stop using every major software product created in the last decade.
Despite my sarcasm you're not wrong, I agree completely with what you're saying. But to follow your advice is not easy, especially for the average user. IMO it's a problem with the way software is made, and while many of us are vaguely aware of the problem, there's been little progress towards solving it.
The reason progress isn't made is _because_ the casual experience is so good. Gmail works very well, at least the average (read: compliant) user. Therefore, the system is designed so that it works well for said average user, and so they do not have any incentive to pay for a more "difficult" to use product, which enhances an aspect that they don't care (or know to care) about. That is, until they get hit by an issue (after all, you're average until you're not). But since their numbers are still overwhelmingly small, there's also no political arena for which this can become legislated to make it work.
The average user doesn't even use an adblocker, so they won't need to worry about Google blocking their account for suspected clickfraud or whatever.
Is that more than someone might think of? Maybe, but it's not that far fetched if it's something you want to do.
What's hard to get a normal person to do is distrust Google or Facebook et. al.
Edit to point out that normal people who are marginalized by society actually know about this stuff and already do things like this, like having pre-warmed backup accounts on social media platforms avoiding most major banking platforms or diversifying payments platforms to limit impact and hosting their own websites.
There are a lot of simple things you can do to become less dependent and people who tent to find themselves in those places can seek these things out.
> If you put yourself in a place where someone can take everything from you than it's a real risk that they might.
You're exactly right, but absolutely wrong. We've had this conversation about creep for a few decades but it still happened. It is technically possible to live in the modern world without the internet and a cell phone, but it is not a realistic expectation. In fact, removing even one of the tech giants from your life results in a considerable disruption of your life[0].
You're right that people need to make individual choices, but you are missing the fact that a collection of people making choices is called a society. Those decisions have been made by our less tech literate friends and family. The ones we've failed to educate, using our expertise to inform those that are not in the domain. To fail to learn to effectively communicate and warn of the real dangers of what is happening. The truth is that no matter what decisions we make, we are still subject to the decisions of our society. Saying "you should have made better choices" is simply victim blaming. Unless you have been a hermit for the last 30 years and plan to continue this route -- clearly you're not since you're reading this -- then your individual choices were simply not enough. There is a larger game at play and you are still subject to society if you wish to participate. And let's be real, not participating comes with dire consequences and a complete abandonment of much of what it means to be human. So that's not a realistic choice or expectation. We need to think deeper, as its the only way we can solve this problem. It's easy to be dismissive and come to simple conclusions that make a nice pretty bow, but our world is incredibly complex and nothing is as simple as it appears. Anything you think is simple is simply something you do not understand sufficiently.
It is not too late, it never will be. But it is like planting a tree: the best time was 20 years ago but the second best is now. The effects compound, in both directions. So I'll repeat what I've been trying to for most of my life, we need to make meaningful action and stop this spying. The will only control more of our lives if we continue this route and a "high tech-low life" future isn't an unlikely outcome. It's far more likely than seeing AGI, and AGI could only accelerate such a trajectory (it similarly could liberate us, which is why I research it. But there is real danger and we must not hide that fact)
[0] https://gizmodo.com/i-cut-the-big-five-tech-giants-from-my-l...
> Background noise in general disappears this week because YouTube, Apple Music, and our Echo are all banned—as are Netflix, Spotify, and Hulu, because they rely on AWS and the Google Cloud to get their content to users.
Now, if you eliminate AWS, Azure and Google Cloud from your life, you could turn on the Airplane mode as well as the public cloud powers up a large part of today's web, either directly or as a dependency. But there is a ton of difference between using Google's services and visiting a website powered by GCP.
We may be best served by proactively rethinking all of our computing habits to make sure they more closely align with AdSense’s goals for uh… our benefit.
His argument for began with essentially what you said, this is going to happen whether we like it or not, so let’s get ahead of it and create a system that leaves the power in the end-user’s hands.
That’s not going to happen in the current structure where Google basically owns advertising because of Chrome’s market share. Google will control things.
Surreptitiously hijacking people's expensive PCs and network connections that they pay the bills for to download ads that they don't want to see... not theft.
Funny how all this works.
I also don't even really think this would fly in DC. Advertisers are certainly indulged because they provide an endless mountain of surveillance information to spook organizations, and can also be used to try to influence elections. But most politicians are people too, and with acts like this you'd be passing laws to piss on yourself, your family, and your friends as much as the rest of society.... for the sake of advertisers. I think that would face substantial opposition from DC itself, let alone the small but growing chunk of libertarian or social minded politicians. This isn't like the MPAA or whatever, where your average politicians might think you're talking about rafting if you speak about torrenting.
[1] - https://www.pewresearch.org/internet/2019/11/15/americans-an...
Something along these lines: We're not asking to get these clickable ads, so if they're sent to us, we might as well just have a script click them.
It's doubtful if this is really click fraud, since we're in no contract relationship to the ad platform, unlike the one who uses the platform. Click fraud could be defined as commercially interested parties generating false clicks for profit, either the ad platform or the competition creating these clicks to charge for clicks which never happened or the clients for whichever reason.
But from my point of view I'd rather not do any of this as a tracker blocker, you never know if then a capable lawyer meets a bad judge and suddenly uBlock Origin will be (absurdly) ruled as an illegal piece of software.
Use Firefox or any of the now countless privacy respecting browsers.
I'm not sure if AdNauseam can be adapted for autonomous use on a Raspberry Pi, it's unlikely it would replace uBO for me, however an ad-clicking machine running on a Pi is appealing.
>AdNauseam 'clicks' Ads by issuing an HTTP request to the URL to which they lead. In current versions the is done via an XMLHttpRequest (or AJAX request) issued in a background process. This lightweight request signals a 'click' on the server responsible for the Ad, but does so without opening any additional windows or pages on your computer. Further it allows AdNauseam to safely receive and discard the resulting response data, rather than executing it in the browser, thus preventing a range of potential security problems (ransomware, rogue Javascript or Flash code, XSS-attacks, etc.) caused by malfunctioning or malicious Ads. Although it is completely safe, AdNauseam's clicking behaviour can be de-activated in the settings panel.
Isn't this easily detectable? XHRs are easily detectable through various headers, so it's trivial to filter out the fake traffic from this with a few lines of code. I'd expect any ad network worth their salt to implement this. Failing that, thanks to ad fraud there's a whole industry of bot/ad fraud detection firms using browser fingerprinting and behavioral analysis to detect fake ad clicks. I have no doubt that an extension that's "clicking" on every ad using XHR is going to get detected and filtered. I'm very skeptical using this extension will ever achieve its policy goals of fighting against adtech or whatever. You might as well attach a "DNT: 1" header to all your requests.
Are they though? The most common one (X-Requested-With) isn't inherent to XHR, it's added by js libraries by convention.
If they actually opened the page as a tab and rendered it, it would be pretty convincing. However, they specifically decided only to send one XHR request, which is easy to detect because a bunch of behaviors associated with normal browsing (eg. loading css fonts, javascript) doesn't get executed.
Bluntly, it doesn't matter what you or I think -- what matters is what politicians, police, prosecutors and judges think.
I don't see anything on the main github page that says the extension is intended to cause harm to the advertisers or the website, but IME governments have often not cared.
And when 1M people in a country install the extension, are they acting independently or as a group? One person protesting may be legal, 1M organizing may not be protected.
Apple already has shipped something similar. https://httptoolkit.com/blog/apple-private-access-tokens-att...
"hihi, my browser clicks ads in the background, I'm fighting Big Tech so hard rn"
Google implements WEI on chrome and normal users who just want to block ads can't use their extensions anymore.
"Google Bad! I want to block my ads and cause you financial loss too"
"NO" - Google
So, mission accomplished?
Folks think most marketing departments are these sophisticated analytics driven masterminds, when it's really number go up == throw more money at it.
That being said realistically this is too niche for nearly enough people to run it to make any significant difference on the scale of the networks themselves, it'll just obfuscate your tracking a little.
There was also an interesting Freakonomics episode on whether ads work at all. The incentives for advertising aren’t exactly rational. What’s good for a company isn’t always good for an individual working in the ads department of that company. Plus, the money is often there whether it works or not, and advertising departments will always insist that they do.
Which will lower bids for ads.
But it would be easy for Google, FB, etc to filter out this traffic.
Which I guess is the goal of the plugin.
At what place would this incentivize captchas? It can't be when you click on the ad, because users would just close the window.
But then the ads just go so resource intense that I came around and finally installed an ad blocker.
This however still feels one step too far. The ad blocker protects me from the resource utilization of ads. But if you're already blocking the ads, then the tracking shouldn't work anyway.
How do you justify using their resources unnecessarily? Doesn't something like this make you no better than the advertiser?
For some people (not me) ads are inherently bad, so it's okay to abuse advertiser.
Just like for some people, copyright are inherently bad, so piracy is not just a way to save several bucks, but a moral duty.
It's as effective as saying "People also do bad things for ideological reasons", simply stating as fact that violating copyright is bad ignoring any of the nuance that was provided.
Of course it does. It violates their rights.
> This is basically stochastic terrorisim on a small scale.
"Stochastic terrorism" is a nonsense concept anyway.
I tried saying "my enormous wealth" a few times, but I'm still not enormously wealthy. Do you have any tips for how I can learn to make things true just by referring to them?
To be more serious: "stochastic terrorism" is nonsensical because it attributes to a person some act that is not his responsibility. It doesn't matter how large your audience is or what you suspect they might do with the information: saying "this hospital performs masectomies on teenage girls" will never be a terrorist act, even if some audience member allegedly called in a bomb threat later. In no way, shape, or form is that act attributable to him. If you say something, and someone reacts by doing something, that is not your fault, and never will be.
I'm not sure what your definition of terrorism is. It sounds like it's defined as stealing resources from someone else?
The definition of terrorism is not very defined, but I would think it generally means to cause fear in the general public for political gains. Maybe the general public can be replaced by an ad network theft induces fear, but then I think we're on vague territory.
I think for me the main point is just that harm can be justified for good and bad reasons, so we have to discuss how it's harmful and why it's justified or vice versa, rather than just saying it's harmful therefore bad.
In general I'm for "harming" businesses that I believe are actively harming society. I would be more on the side of trying to target their incentives rather than any individual person though. Sanctions, penalties and tax disincentives supposedly do this.
But doesn't that fail if the blocking is anything short of perfect?
You could also just choose to not shop at WalMart.
If it bothers you so much, run an adblocker. That should be more than enough to get your point across.
I'm perfectly fine with a blog author carrying a banner on their domain advertising for a service that paid for thier blog post. What I'm NOT fine with is a blog post carrying an ad served by a tracking company that wants to know who I am, what my interests are, and how to get me to buy more things I dont need. If a blog presents such ad, they deserve to be fired upon.... by tools like Ad nauseum IMO. It is only fair.
Cutting out 200+ objects, some with significant overhead, on a lower powered device or low bandwidth or long ping time like overseas can completely change a browsing experience from intolerable to completely acceptable.
Clicking ads would defeat the whole point and require all resources to be loaded.
However some day if politicians take enough money from the powers that be and make laws requiring all ads to load, this would be a good alternative to have. (However then they'd ban automated clicking)
It's difficult to imagine how to end this negative (externality) spiral. A legal ban on online ads could reduce drastically, but that is throwing the poor baby out with the bathwater. I wonder if something like phantom clicking ads could tip the economic scale for advertisers such that it is no longer cost effective for them to blast ads at people.
There is a serious game theoretic optimization going on in this trillion-dollar field (and I worked in this field before) and a novel tech or paradigm can change the game completely.
Things have really gone full circle now. If I visit a site (happens rarely) that has a clean design and puts all the ads into a plain column down one side of the page, I'm pretty sure I'm more likely to look at those ads than I am on the typical crappy site where I need to swat away ads like blowflies off a horse turd just to begin to see the underlying content.
Brilliant.
Although, I will note that giving advertisers disinformation resulting from adnauseam loads is probably a much more significant effect than the cost of serving additional bytes.
Also, I would not install this if you have Adsense connected to your Google account :)
I love it.
But if you have an adblocker and tracking protection like in uBlock Origin and Firefox, it feels it then does not make any sense. You would just send alot of data to trackers, even if its just garbage, and it would just waste your broad band. It clicks on things that would be blocked with an adblocker.
My question is, make AdNauseam any sense when you block ads and trackers (use uBO and Firefox (Strict Enhanced Tracking Protection)? Or is it just useful if you want to have ads, but not want to be profiled by trackers?
Consider this scheme:
- A marketplace for fraud clicks advertised as a way to ditch competitors
- Anyone can pay a fee and point to a certain ad that must be fraud-clicked
- Users with an extension will be directed to this ad in background, lust like Adnauseum does
- They will receive a fraction of the fee
This scheme could bring in missing economic incentives for the users.
Ad-supported media existed before the Internet. They would target based on content rather than reader.
That would be fine.
Any websites that prefer it could still be free then, but the costs to host them would have to be paid by their owner (like most personal or business websites today), not sponsored by ads.
Not if it was made illegal to show ads on paid services.
Passing such legislation would be rather redundant at that point, wouldn't it?
Especially in the year 2023 where technology and internet access is so crucial to survival, I’d prefer for a low-income family to not have to choose between a meal and renewing their monthly email subscription.
Yes things cost money. Why should the poor be subsidised in viewing a website when they arent buying the expensive products being advertised on it?
That's probably less than you pay more for your phone for more traffic and power to display ads.
More interestingly, where does all the money for ads (this for Google and the service showing ads) come from? It's paid by all consumers already.
No, I'm speaking from the position of someone who believes we should use fewer (or even no) services, be it Gmail, or Figma or Spotify free tier, or whatever.
There's always FOSS software. There's also freemium (no ads, just reduced functionality to lure someone to the premium full-featured version), and of course freeware.
Ad-supported also has a cost: the ad-induced consumerist spending is one of the biggest expenses people make (disproportionaly so for poorer people). And there's also the jacking up of product costs to cover an ad budget. Plus the social cost in multitude of ways (from the advertisers having influence over the service provider, to personal data being harvested and sold).
And I'm not entirely opposed to advertising; TV and radio have been ad supported for generations, but we've now added surveillance which is unacceptable. (The ads themselves are also more intrusive, but that's my secondary concern.)
hit the nail on the head with that typo
- micro transactions
- Abonnements
I suspect that at least some of those websites shouldn't exist to begin with. I don't see why any improved economic model needs to consider them.
Fingerprinting and click fraud detection says NO!
Seriously, are we in 2000s where ad platforms couldn't detect malicious patterns and fake clicks and I could join a ad click group on facebook to make 100s of dollars?
Even in a case of everyone using an adblock, do you think they're not going to serve ads through first party domains making it very difficult to block? There are already ad companies who do this through their CDNs. why are the supposed users of "Hacker News" site oblivious to these things?
Because some people on this site aren't hackers and aren't even technical. They're from old media and are looking for "useful people" to help take down Google and Facebook.
Think Rupert Murdock browsing here globbing onto any anti-tech thread with the understanding of a typical 80yo.
They seem to compare themselves to TrackMeNot, which Googles random things in the background to try to mess up Google's profile of you — but I always thought that sounded crazy, because what if it looks up stuff that gets you put on a list, or stuff that's outright illegal? I tried looking at the TrackMeNot paper but it 404's.
Another question I have about AdNauseam: people seem to think that if we succeed in abolishing tracking, the web will still be free, just with non-tracking ads. I don't buy that, because ads aren't very profitable as it is. We might end up with wide swaths of the web just paywalled (or worse? If we get to that point, there'll be lots of "innovations" I'm sure). Why don't people demonstrate what a better model would look like, and whether it would work at scale, if they really dislike the current state of the web?
[1] https://github.com/vtoubiana/TrackMeNot/blob/master/dhs_keyw...
[2] https://www.forbes.com/sites/reuvencohen/2012/05/26/departme...
I came here with the revised title assuming malicious intent from the fork. I now know thats not how it works. So my title rename is just a suggestion to further clarify the intent. hth