Hacker News Reader

Hacker News

Comment by forca | Hacker News Reader

Full thread

forca

I realize this won't be popular, but I really have no feelings for ad networks.

- They allow shoddy security on their servers

- They track users against their will

- Info on me is sold w/o my knowledge or consent

- Ads are a poor business model since they can be blocked

- There is no moral imperative for me to view ads since I've paid to access the Interwebs

I block all ads, tracking cookies, beacons, all of it... I whitelist my bank and my email provider. Everyone else gets nothing from me. I lie about my browser agent, I disallow scripts, CSS history, I disallow HTTP/S referrer, DOM storage, I use a European proxy where I need to. This all works great for me, as I have the right to move around the Internet as a customer, not a product.

I think if anything, this extension makes ad companies sit up and take notice. I won't be installing it, as I don't need it, but kudos to the authors for throwing the cat in among the pigeons. Ad revenue from most of these sites is based on tracking people and this is something I am against 100%.

View on HN

> There is no moral imperative for me to view ads since I've paid to access the Interwebs

I dislike the ad model but this is dangerously wrong: you pay your ISP for transit – unless you're subscribing to a specific site, nobody else gets a dime from you to pay for their costs. Unless subscriptions or micropayments catch on, that means that sites are either going to rely on ads or will be limited to organizations with significant other revenue streams – neither of which is a particularly healthy prospect.

How does the survival of web sites that depend on ads create a moral imperative though?

These sites are instructing my browser to download content from ad networks using the ISP bandwidth that I paid for. I'm fully in my right to tell my browser not to download that content.

A gazillion of websites that are run by collectives, communities, hobbyists and like-minded people are a big counterpoint to this. The internet got big on them, not commercial interests.

I agree that the point you're replying to is ridiculous, but I still think there's no moral imperative. An equivalent moral case is broadcast TV ads. You aren't obligated to stay in the room and pay attention; going to the kitchen, using Tivo, and flipping channels are all morally ok.

Part of the reason that subscriptions and micropayments haven't caught on is that people put up with ads. If ads stop working as a business model, I doubt we'll be looking at a bleak future of watching Love Boat reruns and rereading old Family Circle articles. We will find some other way of funding good content.

Indeed, when I look at the way the quality of television has improved over the last couple of decades, I think it's a reasonable argument that blocking ads would be the moral imperative. As anybody who has worked in ad-supported industries knows, consumers aren't the customers, they're the product. Rather than being served, viewers and readers are being served up to advertisers. The system has a conflict of interest at the heart of it. It's reasonable to refuse to support corrupt systems.

OTOH, the alternative to ad-supported content is paying directly for the content you want to read, which is even worse from a privacy POV because publishers will know exactly who you are instead of only knowing which "demographic" you belong to.

Unless payment goes through some kind of anonymization service.

Paying directly changes the relationship significantly - a business is generally going to pay attention to their customers that produce their revenue than the "free" accounts that are the merely the product being sold to advertisers.

The Onion was right[1]. In the rush to sell out their "users" to to whomever is willing to pay, a lot of people seem to have come to believe that advertising is the only way to the internet can work.

The internet enabled many new ways of publishing due it removing most of the per-transaction costs. I suspect we haven't even seen most of these methods. While "Kickstarter" style funding and Wikipedia's "public television style" requests for donations, while interesting experiments, are only the first generation of what is enabled by the internet.

Unfortunately, untested and unproven (by somebody else) ideas do imply some amount of risk, which scares a lot of people back into the traditional method where the advertisers get to paint over everything.

edit: forgot URL

[1] https://www.youtube.com/watch?v=w8c_m6U1f9o

Every neighborhood store I shop in knows who I am, and that's fine. Ditto every single online store. The problem with publishers knowing who I am is only problematic if they are also selling me out to advertisers. The easy fix for this is for them not to take advertising. Places like Consumer Reports and Cooks Illustrated do just fine that way.

"There is no moral imperative for me to view ads since I've paid to access the Interwebs"

When I go to McDonald's, I don't pay for my Big Mac. I already put gas in my car!

Not even close with the analogy. Unless the content is behind a paywall, it's "free". Want to make money? Charge access. If your content is THAT compelling, people will line up and hand you money. Using a backhanded revenue machine like ads that track me and violate my "anonymity" is beyond the pale. So, yes. If I arrive on your site and there is no paywall, I will gladly view said content without allowing ads. If there is a paywall and your CONTENT, not ads, is good, I will gladly pay. There are sites I do pay for. Willingly. Because there is nothing better. I still block ads on these sites.

No, it's a pretty good analogy.

You're paying for the transport of the bits, you haven't paid for the content of those bits.

The content seems to be good - you chose to use it after all. You could boycott ad-supported content but you chose not to.

(I agree with the rest of what you say btw).

If I get a free burger with onions in it and I don't like onions, I won't eat the onions.

You really want to live in a world where every single site is behind a paywall? because that is what you are advocating.

I glady pay for Internet access, cable TV, the cinema, magazines, other content I view. The problem I have is with tracking. Ads should never do anything save show an ad. There should be no attempt to learn about me or track me or sell my data. Magazines I buy don't track me. I ignore ads in the cinema by whiling away that time on my mobile, I FF thru DVRd programs at home. I've paid already. I'm not viewing your dreck.

Bullshit. There are hundreds of extensions that block third-party cookies and any form of tracking; what we are talking about here is hurting any content creator who wants to monetize their content without creating a paywall and therefore dealing with customers, chargebacks, credit card fraud, marketing, ads (the irony).

No one is advocating anything except not tracking users. I already block ads like most people here. They are a vector for malware, they track users, they sell that data.

Make money by charging for content. I miss the old days when people had to pay for stuff with tangible money, not with their anonymity. I would gladly pay to access content I found useful, just no tracking. Be content with the money and move on. No need to profile me, sell my profile to make more money. I pay to use several sites. I also block ads on these site, because the third parties don't respect privacy.

I repeat myself: Its extremely naive to believe everyone who needs access to the content in the internet has a credit card to pay for every bit of it that they need.

You are absolutely correct, this is a very important issue that tends to be overlooked in the debate because of the anti-ad zealots.

> No one is advocating anything except not tracking users.

Did you read the submission before commenting? Because that piece of software clicks all ads, which has potential to harm ad-funded sites.

Just use an ad-blocker if you want to avoid tracking.

I don't use the software in question. I only use AdBlock Plus and some creative OS-side tweaks under Linux to accomplish what I need. I don't need to use the software to go after ad companies.

First, not all ads attempt to track you or sell your data.

Second, it sounds like you would be well served by an ad blocker. Is there some reason why that's not enough and you have to actively try to destroy ad-supported sites?

So you don't mind ads as long as they are completely random ads that you may not care about. But if they try to get some info about you to show ads that you might actually be interested in, then you are pissed? What!? What do you think they are doing with this information? All they are doing is catering ads to your preferences.

You raise an interesting point - that there is a tension between respecting the privacy of a user and making ads most useful to them.

That said, I don't think the rest of your post is well supported. Surely they are using the info to try and target ads, but what prevents them from using it in other ways (including selling it to other people who want to use it in other ways) if they think it can make them more money? Probably, most of these companies aren't going to knowingly sell it to anyone who will use it illegally because they could be culpable... but there are probably things I don't want done to me that don't involve actual illegality. An example off the top of my head might be feeding embarrassing info to a tabloid. And even that stays out of the realm of "what if things really went bad?"

But my preference is _really_ to see no ads.

What you cite as "my preference" is really "what the advertising backend has deduced I'm most likely to buy" - that's certainly better for the advertising company, very likely better for whoever's receiving revenue from showing the ads (averaged over all users because yes, targeted ads do work better), but it's not actually _better_ for me. From my point of view as someone who didn't actually want to spend any money, it's worse, because I'm now more likely to spend the money.

Working in technology, you probably make a lot of money. Could be wrong. $5 a month probably means more to the general population.

Personally, I feel far less privacy when making online payments and giving out my credit card or trusting some middle provider than I do when visiting a site that has ads which I can disable.

> every single site is behind a paywall

Not every single site. Some people are fine serving their content for free: because they do it as a hobby, because they are financed by donations, ...

You are free to ignore or block their ads. Sites may complain about blocking, but (almost?) none prevent it. But the sites are also free to put ads on their sites, why wouldn't they be, and how do you feel that this is "beyond the pale"? The people who run those sites are just trying to make a living in the same way that most popular media has tried to make a living for the past century.

But actively trying to disrupt how they make a living goes beyond that. Imagine a museum that has a donation box but where you can go in for free if you want. You don't have to donate, but gumming up the slot so no one else can donate either goes beyond being not thinking the museum is worth paying for (although, for some reason, you're in it) to not thinking it should be in business at all.

By arguing that instead of taking donations they should just charge admission, you're just rationalizing bad behavior.

It's more like a donation box that automatically takes money out of your pocket unless you are vigilant, with most patrons not noticing that it took their money. The analogy sort of fails because it's not a zero sum gain. You could actually argue that targeted ads are a benefit to users.

Its extremely naive to believe everyone who needs access to the content in the internet has a credit card to pay for every bit of it that they need.

This kind of behavior will only push the movement even more far away from mainstream popularity, slowly becoming a new form of extremism.

When I go to McDonald's I don't have to pay for wear and tear on the roads because I already put gas in my car!

Wait, that is actually how it works. In US typically you pay more for the gas because it has rolled into its cost the cost of maintenance for the roads.

It is a flawed analogy line to begin with. But even here you can see how there are cases where this happens.

It would probably be more accurate to say that you get a free McDonald's if they can send one of their clowns home with you and he can watch you eat it and records everything. Here the author just block the clown from following him. And presumably would prefer to actually pay for a McDonald's sandwich.

(I personally would pay a negative sum for it, but that is just me).

I don't pretend to know what will come next, only that the UX and beauty of anything I do on a phone or a browser is severely diminished by the presence of ads. I will go to great lengths to make them go away.

For these reasons and more, it strikes me as likely that advertising as a business model has a limited shelf life. It will exist only so long as there is no better alternative and not one moment longer.

Strongly agree. Ads (and even ads placed by primary distributors and authors) hijacked the internet without permission from browsers/surfers and routinely have additional negative consequences. The reader doesn't need permission to defend themselves.

Do ads in a newspaper "hijack the real world"?

Ads in a newspaper aren't vectors[0] for malware that can potentially ruin someone's finances or business.

[0] http://www.invincea.com/2014/10/micro-targeting-malvertising...

Ex-Advertising layout designer here for Hearst. Ads in a newspaper are typically laid out in a pyramid fashion to specifically avoid breaking up news articles into more difficult to read formats. 'Flow' is important when laying out every page. Ads on the web adhere to no such flow and often inhibit the experience of reading. Newspapers want their ads to be as unobtrusive as possible while still being seen. Advertisers on the web tend to scattershot ads and want to be seen at all costs without consideration for the viewer. I can easily skip the flow of ads in a newspaper only looking at those that interest me if I choose, I have no such options on the web and so block them all to be less distracted and able to easily digest content.

It seems like your complaint is about the poor design of news sites (which I generally agree with) more than it is a philosophical objection to advertising.

(There are some print publications with quite terrible ads too. Not everyone has the standards or resources of Hearst.)

These design principles were taught to me while I attended university and are not solely employed by Hearst. Publications that flagrantly disregard lessons learned from the past are horrible and obtuse to read. My point is that publications backed by experienced teams tend to adhere to these lessons, very few web publications could claim the same. Since advertising on the web is much younger, and lacking similar historical perspective, we have an intrusive system for advertising delivery. Advertising in a properly formed publication means the ad layout is determined by an experienced individual and attempts to strike a balance between obtrusiveness and visibility . It seems marketing divisions determine ad placement on the web more than it does in print media and visibility is held to be more important than being less obtrusive, the balance is way off.

No but billboards do. http://bi.gazeta.pl/im/8/7897/z7897718Q,Polski-Outdoor.jpg

Anyway, I'm not using adblock for the last few years because internet isn't that bad (at least the sites I visit). Before adblock it was awful and I think it was adblock that made it go away. Thanks to users ability to respond we have balance.

So this is good that such extensions exist.

And some cites have outlawed billboards in some areas: as they are blight.

    >Ads (and even ads placed by primary distributors and authors) hijacked the internet without permission from browsers/surfers

Isn't actively visiting a site you know to be ad supported implying permission?

Permission for what?

To see a single text ad? To see a series of gifs? To have an autoplay video start? To accumulate tracking cookies? To accumulate permanent flash storage? Permission to do some reverse lookup and call your phone? Permission to capture later browsing and re-write links in a i-Frame?

I am not currently using an adblocker/clicker (broke too many things). By a similar argument if the site doesn't want to serve content to those not reading they ads they can selectively choose not serve it. Isn't something being placed in public implying some permission? I really don't understand why so many people are unsympathetic to attempting to defend oneself.

    >Isn't something being placed in public implying some permission?

It seems to me like it's a two way street. The site is implying permission to consume the content by placing it out there, we imply permission to have ads served at us by going to the sites knowing the ads are there.

If the site is serving up malware why patronize it to begin with? There is a distinction between an ad and malware.

The sites don't always know the ad servers have been compromised. A person visits a site, allows ads/3rd-party cookies, is surfing with admin rights, the ad servers gladly push their drive-by malware and ta-da... infected user. It's that simple...

Blocking ads, disallowing cookies (whitelisting), blocking the general ad industry is the only safe way. It's like sex: use protection.

Lets extrapolate this to the real world and see if implied permission works.

You actively walk into a bar. For what ever reason, you can't pay your bill so the bar owner break your leg as a lesson. Alternative, the bar owner will sell you into slavery so you can pay your bill.

Should we imply that you gave permission for all this by walking into the bar? What if there is a 400 pages long contract, which by entering, you silently agreed to by staying in the bar?

Implied permission created from non-action are a horrible concept that only exist on-line.

Your analogy doesn't make any sense. There are no implications since the already in place rules of commerce would preclude any ambiguity.

I'll throw you and your analogy a bone though. You walk into a bar, bars are smokey, you don't want to smell like smoke, but you want a cocktail more than you don't want to smell like smoke. You've implied that you're okay with smelling like smoke as long as you get your martini.

The rules of commerce exist outset the net, I fully agree on that. If we applied similar rules on the net, the implied permission will go away in favor of a common set of rules.

And that is what the EU is trying to do for private data. When it is illegal to track users, then users can't silently give permission by visiting the website. The whole question about implied permission goes away when rules of commerce specify what is and isn't allowed.

> There is no moral imperative for me to view ads since I've paid to access the Interwebs

I am not sure I agree with the implication, but I agree with the conclusion, for a different reason.

If I send an HTTP request to a server, and that server replies with content, this does not imply that the creators or publishers of that content have the right to dictate how I should enjoy that content on my own machine, or that I have any moral imperative to follow their wishes. I may be using an ad-blocker, I may be blocking images, I may be using lynx, I may be just saving it to view it offline later. It's my choice. If you do not agree, do not provide your content for free to anyone who asks.

There may be a moral imperative to support the creators and publishers of content you enjoy. This does not imply that it must be done via the convoluted route of viewing the content in a certain way so that a certain third party believes that a human mind has registered a certain message and pays the publisher for this.

While the spirit of this extension is good, it will ultimately harm the websites you frequent and like the most. Eventually those sites will get blacklisted from their ad networks due to what will be perceived as "fake clicks" (something ad networks are very, very sensitive to in order to guard against rouge site-owners clicking their own ads or having their buddies click). This extension will click the ads every time you visit the page, which is not a normal pattern, to say the least.

An ad network cannot tell the difference between a real click and a fake click based on the HTTP request itself. They have to rely on probability models to guess whether clicks are real or fake. The mere existence of an extension like this should prompt them to reconsider their options.

If you think about the ad model for print and broadcast media, they don't bother trying to track eyeballs. They know it's impossible. You pay for your ad to appear a certain number of times, and hope people pay attention to it. You can't know whether a specific newspaper gets read by a dozen people in a hotel lobby or lands on a driveway in the morning, to be trashed, unread, at night. If an ad runs on television, the advertiser doesn't know if it's being watched by the whole family, or just the dog.

That's why ratings services, like Nielsen, exist. People get paid to have their habits monitored, and those samples are extrapolated.

Ad networks can, if they so choose, blacklist sites based on a perception of "fake" clicks. Those sites are not necessarily responsible for fake clicks, and they certainly can't do anything to stop them. You would not, therefore be harming the site operators. You would be harming the ad networks that pretend that they know more about their own service than is possible.

Destroying the viability of pay-per-click is (arguably) something that would be an improvement in the world of HTTP publishing.

> An ad network cannot tell the difference between a real click and a fake click based on the HTTP request itself.

No they can't, however they can tell what is a real user and what is not. Real users don't click every single ad presented to them on every single page. Real users don't click ads as soon as a page loads. Real users don't click on all ads at the same or near-the-same time. (If this worked, without getting flagged/blacklisted, site operators would have built bots long ago to click their own ads as there is a lot of money to be made that way)

You absolutely will harm site operators. Ad networks do indeed blacklist sites that get high volume of perceived "fake clicks", whether they are fake or not. You will only harm the sites you like the most and frequent the most.

This is a very naive view of how ad networks operate, and a very naive approach to "solving this problem" (likely built by someone who has not worked with ad networks, nor has operated an ad-driven site, ie. someone with little to no experience in the domain they are trying to solve a perceived problem).

You really can't tell the difference between a real person who decides to click one ad per page view and a script that does the same thing. Whatever criteria you use to differentiate between fake and real can be reverse engineered and fed back into the robot to look more human.

Never mind about cyborgs, or script-enhanced humans, which are what users of this add-on will become. You can't even tell if a script was launched by a human or by another script.

It's the Iocaine Powder of ad-serving. The only way to win is to be immune to the effects of playing.

In this case, only ad-serving networks that do not change their visible behavior in response to clicks can win: no site-bans in response to visitor behavior, and no click-through bonuses or payments per impression. And that is the sort of ad network I find most tolerable.

Pay the site operator based upon sound judgement as to what the value of ads on those pages are worth, and toss the site traffic analysis in the trash. You need to have an actual human determining how popular a site is likely to be, because an automated script is never going to be able to differentiate between human and another automated script that knows--or can guess at--the first script's algorithms. Do it correctly, and you won't need to compensate for temporary spikes from HN, or Slashdot, or SomethingAwful, or a Chan, or an SEO firm, or anyone else. The ad campaign pays out according to the agreement, and if the site becomes permanently more popular, the operator and the salesperson renegotiate the rate afterward.

That involves actual ad sales employees with some familiarity with the subject matter. If you purely fight bots versus bots, the programmer with the most knowledge of the other guy's program wins. And in this case, that advantages the attacker more.

You seem to fundamentally not understand how ad networks work.

Do you know the difference between in-band and out-of-band signaling?

The ad networks are using an automated Turing Test based on statistical models to differentiate between "real" and "fake" requests. Until someone commits real dollars to make a purchase, there is no out-of-band verification of the requester's humanness. When you click the ad, your tamper-proof mouse does not take a tiny blood sample to verify that you are a real person, and communicate that via magical ansible to the ad network servers. Until the check clears on a purchase, the only data the ad networks have come through the HTTP requests, as in-band signals.

In-band signals can always be faked. Ask anyone who has ever blown a modified whistle from a cereal box into a phone handset, or modified a Radio Shack tone-dialer to produce the old payphones' "quarter inserted" tone.

So any script writer that either knows or can guess at the algorithms used to automatically sort "fake" from "real" can produce automated behavior that fools the automated sorter. What's more, those models are brittle. If the real behaviors of real humans change, such as by ad-blocking or running other response-modifying scripts, the models become decreasingly accurate classifiers.

A script that blindly clicks all blocked ads on a page is the tip of the iceberg. You can substitute the "click everything" strategy for a "click like a woman pregnant for the first time" strategy, or a "click like a male gamer, aged 17-25" strategy.

If web traffic ever has a significant number of browsers impersonating the browsing behaviors of other types of people with the help of scripts, ad networks can't trust any of their traffic to know "real" from "fake". That is an intractable problem for them.

You have to be able to verify a statistically significant portion of traffic as real humans before your models will work. And that is what Nielsen does with its consumer tracker devices.

Agreed.

People forget, we half-stumbled into this ad supported content idea. The only thing keeping it that way is inertia. I think we've finally started to feel the limits -- it means being tracked 24-7.

Enough already. We can do better than this.

Are you doing anything about it? I mean, personally, I listen to about a half dozen podcasts, but haven't signed up for any of their monthly "donations" (most have re-occurring payments from paypal or amazon to help support the network/show). I do occasionally click through one of their product endorsements based on their review (often tagged with amazon affiliate links), so that is a small part.

I'd be interested in a "Kickstarter for articles" sort of site. Interesting article pitches presented to an audience, those that are most useful, interesting or unique are funded and writers get paid slightly more directly for their work.

The difficulty would be determining whether to cut off certain types of content from the site, and where the line gets drawn on extreme material.

A bit like ProPublica?

http://www.propublica.org

Very like that, or at least working towards the same outcome, thank you. I will certainly try to make a donation over the next few days.

Out of curiousity, if you were to go to one of your favorite sites that is currently ad supported, and the site admin presented a popup that states "We've detected you're using an ad blocker, we respectfully request not visiting our site." Would you respect the request or ignore it?

I wouldn't respect it. Because they publish a free content, and are taking advantage of many other Internet services, which provides them with free marketing - search engines, aggregators, social sites, etc. I can download their content and then display any subset I want - that is how WWW works. If they want to prevent me doing that, they should implement a pay-wall.

I believe that you and anyone else should not have moral reservations to visit any site with an adblocker even if they request you not to do that.

>free marketing - search engines, aggregators, social sites

But, judging from this quote you don't know what you are talking about. Search engines and social network traffic is anything but free in any category that has significant competition.

"Free marketing", doesn't make the creation of the content effortless. If you found an interesting article via Google or Twitter, (ostensibly) "free" marketing channels, does that mean the article magically popped into existence or did the journalist/content creator still have to put in time and effort to create it.

In the long run, ad blockers should evolve to become undetectable by websites. I don't see any way to reliably stop that from happening, without making the internet more Orwellian.

That said, I agree that if a website respectfully asks visitors with ad blockers to leave, then leaving is the nice thing to do.

I actually have a subscription in my AdBlock Plus that also kills these "requests". It's called Adblock Warning Removal List.

When you visit a restaurant in a country where tipping is the norm, do you leave a tip?

It's not the same thing, because leaving a tip doesn't cause any privacy or security issues. If all ads were just static images, no scripts/tracking, I wouldn't mind them.

well, there is a closer parallel than you'd think.

Every McDonald's you eat at, has the ability to track your purchases, likes, etc. You are, after all, swiping your card with your name, etc.

Not if I pay cash!

Can you clarify, does that mean AdBlock Plus kills the http "request" as in your request to go the site is aborted (boo, no content), or the request that you not visit is automatically ignored (yay, free content)?

... since I've paid to access the Interwebs

You're paying for data transport, you're not paying for the content.

but the content is free - just ad supported.

They can construct an "ad-wall" in the same way they construct a "pay-wall" and are free to do so. Otherwise they are offering free content.

Yes, I am not paying for the content, but the content creator also doesn't pay for the right to present his website publicly. It only pays for the webserver space and bandwidth. (I am following your logic).

World Wide Web works in a way, that I can create a http request, and then do what I want with it, for example I can only take the text and throw away anything else. I paid for the data transport, as you said, and then I don't have any other obligations after downloading those data.

I hope you don't make your user agent an obvious lie because that lets you stand out from the crowd by having a unique one.

As for your other points, I am almost as paranoid as you.

This is pretty close to ad fraud.

However, I agree with you that display ad networks suck. I'm also not sold on the idea that the web should be free. The happy medium is to have users pay for content, making it so advertisers don't need to track users to verify that they're real humans, and improving the web for everyone except poor people.

One way that this could be done is to use bitcoin for tiny micropayments, billed frictionlessly. Rough for legal reasons among others, but ideas like this are sensible if only for human verification reasons.

If you want the web to largely free content, to pay for that you must accept privacy-destroying ad networks to bear that cost. We've created a situation where the choice is to free ride on other people, or to surrender privacy.

If you want the web to be largely teasers for paid content, then you can have significantly more privacy also. Instead of the articles being articles, you will get articles that are actually big ads for paid content (already the case for a huge number of popular search results).

Spreading tools like these kills free content like snaps fingers loudly that. I'm indifferent. Users might not be.

Frictionless billing is harder than it sounds, because it opens the door to frictionless fraud. If I can automatically bill you for a thousanth of a dollar I can automatically do that hundreds of thousands of times. If it's with bitcoin I can obfuscate the destination of the money.

Agreed. Question is whether it's harder or easier than restricting traffic fraud, and if you can comply with know your customer laws and still protect privacy.

> I'm also not sold on the idea that the web should be free.

I see it exactly the opposite way. The web IS free, it works that way (unless someone erect a paywall, which I find perfectly acceptable), and no entity is entitled that the web should "provide" it a profitable business avenue. If someone successfully exploited the web and created a business relying on ads, that's fine, but he don't have an implicit right for that. Internet users are not obliged to display data he provides through http the way the creator expects.

As in, should most web content be free if more and more people are declining to have display advertising render properly in their browser? It can't be at scale and consistently without a revenue engine of some kind.

>If someone successfully exploited the web and created a business relying on ads, that's fine, but he don't have an implicit right for that. Internet users are not obliged to display data he provides through http the way the creator expects.

No, they're not. As this trend continues, the assumption that underwrites a lot of free content will stop being nearly as true. When the assumption stops being accurate, that business model fails, and more free 'content' winds up being ads gussied up as content. This is not exactly what the visionaries of the web had in mind, but them's the breaks.

In print, there are free publications handed out on street corners and in boxes. They tend to have low ad rates because the distribution is unverifiable. On cable, ad rates are still super-high, because the distribution is verifiable, and the cable networks have all the data they need about you on your cable bill + viewership surveys to aggregate for sale to advertisers.

I guess, they feel pretty secure, because there are many devices with no or limited ad-block capabilities like phones and tablets.

(Or are there addons for my ios Safari that work without jailbracking the device?)

As a workaround, you can use custom firmware (like DD-WRT) on your home router with a custom hosts file to block all ads. It takes some work and is only good for when you are home and connected to WiFi, but after you set it up it's great because all devices on your LAN are protected.

Unfortunately, I am traveling most of the time and depend on mobile internet access or (the usual shitty) hotel APs. But thanks for this advice.

I wonder what the viability of setting up a subscription service proxy that mobile users (and others) could point their mobile phones to that strips out all the dreck? I know there are VPS offerings that do this. Webhosting companies do offer unlimited bandwidth, so theoretically, bandwidth is not a problem.

That is a good question. I would not use such a service because of the trust problems with secure communication.

Mmmmh, but I could use a proxy on my own server, through which I route my VPN traffic anyway. Of course, such a proxy product must be light-weight and easy to use. It should be a proxy that I can trust - OSS or self-written. It should enrich a page with a button which sends me to a block configuration for that domain - like that one you would get from a adblock plugin.... git init... ;)

My solution is to vpn into home, and have a bunch of firewall rules setup to prevent any ad network traffic getting past the firewall.

Outside of the extra battery life hit, its extremely effective.

When you say you disallow CSS history, how are you accomplishing this? Is it a side effect of disallowing scripts?

Sites love to view user history. It helps them build up a profile to sell to marketers. You want to deny sites access to this info if you can, In FF, you can do this by toggling to "false" layout.css.visited_links_enabled under about:config

Is there a similar option for the referrer?

And while I'm at it, is there a way to prevent a website from rewriting a url when I click on it? sites like Google and DuckDuckGo show the actual url in the href, but when you click it (or right click and copy it) it becomes something like http://example.com/something?url=encoded_real_url and I detest that.

Blocking the referrer in Firefox is easy, just go to about:config and search for the string 'network.http.sendRefererHeader' then modify it from the default 2 to a 0 (zero).

For the search links, I use this Add-on and it works perfectly: https://addons.mozilla.org/en-US/firefox/addon/google-search...

I see the extension also works with duckduckgo. Thank you very much.

This breaks some sites. None I use. I've read it is a problem for last.fm users because of some social chat thing they use I forget the name of. Anyway. I do this too, kind of. I use either refcontrol or smart referrer. I let sites have referrer on their domain but no 3rd parties by default and can add an exception if I want. You can test this at http://ip-check.info regardless if you're using Tor or not.

I haven't found the time to do it my self yet but will if someone doesn't beat me to porting Window Name Eraser to firefox from chrome. window.name is great for the site your visiting to use on their site. They have absolutely no business using it crossdomain, period. Not even if they own the other domain. There are legitimate ways to do that but they are too lazy, dumb, or opposed to using encryption.

I will allow a fucking cookie if I want to login or allow them to store or gather anything! No supercookies, no flash cookies, no evercookies. I use cookie monster, cookie culler, cookie self-destruct, and Cookie Controller that applies my regular cookie rules/disposition to DOM storage cookies as well.

Browsers, all of them, should behave and act the way they do after I make them go all green on ip-check.info.

In addition to that they have no fucking business knowing what the monitor resolution is. They ONLY need the canvas/inner window of the browser to render their damn site right. I will pull down videos and watch them offline without flash phoning home or to anyone else to give them anything to fingerprint my devices with.

They aren't entitled to this information and I'm against them having it. If I were like Carrie or the Twilight Zone kid who sends people into the Corn field and does other "fun" stuff they would have very good reason to be worried. >=/

I would prefer not to as I find this useful. What I'm really trying to determine is whether this setting alone is responsible for leaking history metadata.

I'm using Firefox with NoScript and I have Firefox set to clear everything except saved passwords when I close it (which I do frequently). I'm hopeful that is good enough because it looks like JavaScript is needed for the leak to occur, right?

The site has been down for years but you can find it on The Internet Archive. wtikay.com whattheinternetknowsaboutyou.com

There are some other sites that use the same or slightly different tactics to throw everything against the wall and see what sticks. They read your history right out or your cache using timing or logic to know if you've already visited the sites in question they want to query for. They also read the color values of the links to know if you've visited that link before. This was a known issue that someone brought up 10+ years, no 15+ years ago before we had Firefox and they were working on the not production ready Gecko codebase and still just trying to pass early CSS acid tests. Gecko builds early on had this issue and it was raised and to this day no one has fixed it.

No, I'm not a coder/developer as yet and it is over my head and I don't have the time to research it to devise a solution and send a patch upstream. If I could I have serious doubts it would be mainlined. I have the impression that many in the mozilla organization are for improving security and privacy but that some of them are MORE than happy to sacrifice our privacy for money or simply don't take things as seriously as others.

I found a bug report in bugzilla using google that I can no longer turn up regarding silent basic authentication for tracking: http://user:trackingcookieaspassword@example.com/possiblymor... This is proven and observable at http://ip-check.info. In this bug report someone I believe who works with them submitted a test xpi authtest.xpi to negate/nullify/disable this exploit between sites and only allow it on the same visited domain.

The bug report can no longer be found and all current versions of firefox are still susceptible.

> There is no moral imperative for me to view ads since I've paid to access the Interwebs

That's an extremely juvenile way to view your browsing rights and behavior.

Buy, I sure wonder what made you think that wouldn't be popular here.

Reply on news.ycombinator.com