YouTube's Adblock detection might break the law in the EU
youtube.com
youtube.com
Can users still use ad blockers?
The proposal does not regulate the use of ad blockers. Users have the freedom to install software on their devices that disables the display of advertisement. At the same time, the Commission is aware that 'free' content on the internet is often funded by advertisement revenue. Therefore, the proposal allows website providers to check if the end-user's device is able to receive their content, including advertisement, without obtaining the end-user's consent. If a website provider notes that not all content can be received by the end-user, it is up to the website provider to respond appropriately, for example by asking end-users if they use an ad-blocker and would be willing to switch it off for the respective website.
[0]: https://twitter.com/alexanderhanff/status/722861362607747072
There is no tracking involved, if you believe the js you got back is spyware you can refrain from running it and you can't watch the vid. Should every website ask for your consent to serve you javascript now?
Wouldn't that depend on when YouTube starts the "three video" counter? A blanket ban on ad blockers may not violate the law, but their implementation may.
They can choose not to provide the service unless you pay.
They can also choose not to provide the service to unregistered users and give out free daily watches as a part of their marketing campaign. Then you enter a simple contract by opening an account and agreeing to their terms.
Terms which can include data collection, but it has to be possible to opt-out from it without losing access to the service.
I'm not familiar with tbh because the idea of working on ad software and SEO seem like the most boring possibly ethically dubious jobs.
If the page need to load some SPA app, draw the canvas (accessing GPU), or WebUSB, etc, then ask for permission would be a good idea. Just like how accessing ones' camera and mic requires permission. It will force web developers to do less stuff in JS for just display. And if an app type of application is needed, then ask for permission.
Ideally, yes.
If a website doesn’t support your usecase, that’s on you, there is no ADA requirement for JS-free websites
Privacy shouldn't only be afforded to the more technical users.
Yes! I would have much preferred the EU to make PSAs explaining how to disable cookies in browsers rather than inflicting popups on billions of users.
Yes. If you create regulations with the assumption that they will be followed exactly how you want them to be rather than considering how entities who don't share your goals will react, you are doing a bad job.
The GDPR disallows tracking without consent, but more in the spirit of “don’t track” than “get consent”. It also specifies that conditions should be clear, and that not granting consent (or withdrawing it) should be as simple as granting it. It even specifies that sites that request private information from kids should be clearer, because they need to understand what they’re accepting even if their guardians will provide the consent.
They're an entirely rational and predictable reaction to it. If you're trying to regulate bad actors, it should be utterly unsurprising when they game the easily gameable rules.
The GDPR disallows tracking without consent, but more in the spirit of “don’t track” than “get consent”.
Then it should actually ban tracking, without the loophole of "you can track as long as you get the user to click a button, also you can't offer them anything in exchange for doing so". That's just asking for all the dark patterns we've gotten.
The problem isn't that. The problem is that people are being convinced that malicious compliance is somehow the EU's fault. This is clearly the bad actors being bad; the thing that's being gamed isn't GDPR, but publicity around it. As in, the EU should probably invest some money in naming and shaming actors complying in bad faith (if at all).
-----
Turns out that youtube also has:
1) the dominant browser;
2) the same interests as, multiple partnerships with, and very little actual competition with the company that runs the next biggest browser in a walled garden, and
3) been completely funding the development of the browser that continually press releases as if youtube's aims are pure evil and that they are the only opposition.
Every time you see a popup to approve cookies, it is explicitly so a company can beg you to allow them to track you for free money.
I don't think umatrix is actively maintained any more
https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...
...oh, I see, I have to first go into the settings to declare myself an able-minded human. That's quite the UX failure, hiding functionality behind an unrelated toggle at an entirely different place.
Having finally found the correct mystical incantation, I can answer your question. At first glance, that UI is incredibly confusing. Why are there two columns to the right of every domain? What's the difference between making the left column red and the right grey, versus making the right column red and the left grey? What is the significance of the +'s and -'s in the various cells? That help page doesn't explain any of it.
What's really missing: uMatrix lets me see how many resources of what type were loaded from what domain. That's very helpful when finding out what needs to be unblocked: if a site doesn't work, I progessively whitelist third-party resources until basic functionality is restored. I then remove everything from the writelist that's unused. It doesn't seem like that information is available.
Also: with UBO it doesn't seem possible to enable javascript for just one third-party host, or enable everything except javascript? If I whitelist a host in the UI, it automatically enables static resources (img, css), dynamic resources (js), cross-site data (xhr) and frames. I'm not going to write manual rules every time I want to allow everything except javascript.
This is just from a cursory examination, so maybe the functionality is there, it's just unfamiliarity with the new interface. But from what I'm seeing, neither the UI itself nor the help page make a compelling reason to make the switch.
>uMatrix lets me see how many resources of what type were loaded from that domain.
uBlock Origin > Logger (its an icon)
> enable javascript for just one third-party host
Red button (with more enabled) disables a specific resource in a nested-list UI very similar to uMatrix AFAIR.
Red button (with more enabled) disables a specific resource
I don't see it. Red button disables a specific domain for as far as I can see. It doesn't disable just one type of resource from that domain.
in a nested-list UI very similar to uMatrix
It seems this is the problem: uMatrix is most emphatically not a nested-list UI: it is an authorization matrix UI. It seems that UBO does try to incorporate some of uMatrix' features back into it, but in the basis it's still a one-dimensional blocklist. That's just not good enough for how I browse the web in safety.
Why are there two two columns to the right of every domain?
The left column is for global rules (independent of the currently-visited domain), the right column is for rules specific to the currently-loaded domain. This is strictly inferior to uMatrix, which allows me to set rules for every part of the dns name (e.g. I can easilty switch between settings rules for news.ycombinator.com, ycombinator.com and even for all .com sites). So what's missing: source domain control for the rule(s) I'm currently configuring.
What's more, in uMatrix I could set a hard block on a toplevel domain (say, google.com) and then add a whitelist for a subdomain (say, mail.google.com) which would override the higher-level block. Since UBO only uses block (red)/ignore (grey), this kind of setup is not possible. So what's missing: an explicit allow/ignore/block toggle like in uMatrix.
What is the significance of the +'s and -'s in the various cells?
These are blocked and allowed resources, so there's some level of feedback there. But it seems that CSS resources are not included in those statistics at all, and images do cause a + to be displayed in the domain-specific row but not in the generic "images" row whereas third-party javascript gets a + in the domain-specific row and in the generic "3rd-party scripts row". So what's missing: I want resource type indicators rather than generic "+"
I'll repeat what I wrote as a response to the sibling comment because it seems to be a fundamental UI issue: the UI of UBO still seems geared towards a one-dimensional blocklist and is missing all the controls for two-dimensional control of [domains]x[resource types]. And after years of safely browsing the modern web with uMatrix, I can't imagine going without that control.
-- edit:
To explain a bit more my thought proces behind how I browse the web: I maintain effectively four trust levels in the browser, which are:
(0. not a browser trust level: pihole-style dns rpz blocking)
1. no trust: all outgoing connections to the domain are blocked.
2. static content: html/css/img is allowed to be loaded from the domain.
3. dynamic content: allow javascript and cross-site requests
4. embeddings: mostly used for payment processors, these tend to get very anxious if some things don't work as expected.
My default (uMatrix) settings put the primary domain at level 2 and all third-party sites at level 1. Surprisingly, this still works fine for a lot of sites, at least the sites that I find worth reading. I guess I'm enough of an academic to prefer reading over "consuming" content.
The first trust increase, if needed, is to selectively bump third-party domains belonging to the same first party to trust level 2. This is mostly because CDNs use a different hostname (such as theguardian.com using guim.co.uk for their content, bbc.co.uk using bbci.co.uk). These rules are configured once as I encounter them, then saved so I won't need to worry about it again.
Then there's webshops I frequent, which are by default at trust level 3. But even there, only the first-party domain is at trust level 3, and the payment provider for the site it whitelisted at level 4. But other third-parties are still at level 1 or 2. Even for these sites, I prefer to keep the trust low and only elevate said trust when I'm actually making a purchase.
So, with respect to uBlock Origin: I don't see how it would allow me to switch easily between trust level 2 and 3 for each third-party domain. And as described here, I use trust switching a lot -- it's become an ingrained part of my browsing habit. In uMatrix, the same is actually very easy, I only have a resource-level Deny on javascript and a resource-level Deny on iframe embeddings. Setting a specific domain to Allow will only bump it to trust level 2 because the resource-level Deny's are still in place; to put a domain at level 3 I must explicitly authorize javascript, and similarly for iframes.
For example, I did not consent to this y18.svg file that this website has served to me. This is a non-consensual violation of my computational autonomy. Just to put a logo up? Horrific.
Google is SO data driven, and many people's objectives are going to be impacted by the reduced watch time.
They're going to have to (or already have) modify the objectives of many, many employees
Maybe you didn't try to play videos when they didn't update their fix yet.
If I go incognito I can.
FreeTube for now, I guess.
I never watched much of any creator-based content, just used it to browse for music, most of which was uploaded by someone other than the artist and, usually if I like it, I'll go and buy it directly from the artist/label. Someone's gotta pay for that hosting, though, right?
Sure, I'll tell my ad blocker to allow YT ads through, that's a compromise I'm fine with. But Google decided, arbitrarily, that that compromise isn't good enough and the mere presence of an inactive adblocker is enough for them to tell me to fuck off.
If that's how they're gonna be, then it's not gonna bother me at all to use Invidious.
Privacy advocate challenges YouTube's ad blocking detection scripts under EU law
Also because the ability for the end user to have complete control over the content the server sends them has been baked into the web since the beginning. You can send your content for free and hope that I choose to view your ads (which I probably wont,) or you can put your content behind a paywall, and hope it's worth paying for (it probably isn't.)
What you can't do is send your content for free and just expect me to view your ads, as if the internet were old media like radio or television, where even then, you could skip ads with DVR or just change the channel.
It's not our problem corporations thought the web was going to be a gravy train where the rules didn't matter, and they poisoned the well and ruined everything in the process. To hell with all of them, let them burn. We'll go back to sharing videos on torrent or something.
Not showing ads is leaving money on the table, and streaming services are like any other company, they will need continuous return on investment no matter what. They will eventually get that return by showing ads[1], shareholders will demand it.
Look at Hulu, Netflix and YouTube. They all show ads now. Netflix previously didn't show ads and now does. Hell, I can't watch a 20-minute YouTube video without watching several minutes of ads.
These services' actual clients are the entities that have million/billion dollar advertising budgets, and not individual customers who pay a paltry monthly fee. Even if services start with no/minimal ads to get their foot in the door, they will eventually have to take their advertising partners' money, and those partners will want to show ads.
[1] https://digiday.com/future-of-tv/ad-supported-streaming-serv...
I guess now, Youtube expects a response back, and occasionally, the request/response is faked. So, when uBlock adjusts the request/response and says "This user watched the ads", Youtube knows the request/response was fake and there were no ads to begin with, notifying that user is using an adblocker.
[1] https://github.com/uBlockOrigin/uAssets/commit/fb33bb3c1fa99...
That's exactly what they are doing, well I don't know about only "change up the names" but they update the script multiple times per day and uBlock Origin devs are trying to catch up.
Also things like Newpipe and embedding can be used to bypass the block as well.
I find all of this weird because it seems all so lacking in fundamentals. I'd expect indeed checking whether the content was actually downloaded. That'd be much harder to work around.
In turn that should result in an ad blocker that downloads content but doesn't show it, completing the circle.
I think properly doing it would require a specialized web browser, capable of keeping two separate models, one which it pretends to render, and one which is actually renders.
Google is trying to make this suck for the maintainers, explicitly so they stop maintaining the ad blocker.
if it gets to that point I wouldn't mind the adblocker even automatically clicking the ad some percentage of the time, just to punish Google
I don't want to punish everyone, only those attempting to coerce me into disabling the ad-blocker
*Actually doesn't
No one has the right to YouTube (or free media for that matter).
The door is that way.
Anyway. Sure, no one has right to YouTube, but they can't have their cake and eat it too. I think the EU trend is pretty clear: no tracking to make money off our citizens. If you want to sell them a service, go ahead and just name your price. Actually compete instead of giving away stuff for free to undermine competition and then getting the money back by peddling the eyeballs in the back alleys.
This is self-evident and we have Terms of Service for exactly this reason. What I think we're debating is what's reasonable reach for Terms of Service to have? Can we violate it by muting ads? Why not? Why is that different in principle than an Adblocker?