Hacker News Reader

Comment by SchizoDuckie | Hacker News Reader

And I will be blocking you in my hosts file in 0.02 seconds. And then never do business with the company that uses your tech ever again.

Bring it.

View on HN

Hosts files are a relatively obsolete way of blocking ads — it seems to be only because ad companies insist on serving ads and JS from their own domains. If a content site was sufficiently motivated enough, they'd serve ads exactly as content and include javascript within the content page itself to ensure they load.

Thankfully, I haven't seen anyone go "thermonuclear" on ad blockers yet except for executive-level decisions and lamentations — but as a technological-level problem it's theoretically straightforward to subvert given the rudimentary nature of ad blockers.

I've seen one person go thermonuclear trying to prevent ad blocking, and it seriously sucks. Randomly generated content classes and IDs, shifting DOM elements around to avoid them being targeted that way, and later on just completely removing all the divs from the area and manually painting large advertisements with primitives. Made scraping substantially more difficult, but of course not impossible.

One site that still has me beat dynamically loads all of the content and code through a websocket, and various bits are so heavily obfuscated that they look like brainfuck. Finding tools to tamper with SSL websockets is a challenge enough in its own right (Chrome has nicer tools now though).

For the first one, you mean noscript.net? View source on that to see how they try to push their horrid super registry cleaner pro crap.

Interesting. Link to that second site?

are you doing it for the sheer fun of beating the ad-blocker-blocker, or do you need the information off the site?

One is screen scraping, one is attempting to find out how a product actually works. Neither goal has a monetary incentive so it is likely that people have got there before me.

Ad companies want to serve from their domains because they can then correlate traffic across sites and in theory serve up more targeted ads. If every content site served ads directly, that gets more complicated.

And isn't HTTP/2 telling people to stream content from a single server instead of opening multiple connections? I can see HTTP/2 accelerators speeding up traffic by multiplexing requests to the application, CDN, affiliates, etc into a single connection.

It will only multiplex requests to a single host— the layer at which it operates means it will need to connect to both contentprovider.com and ad.networks.com over distinct TCP connections.

Right. The accelerator accepts the connection from the client as a proxy but connects to the myriad backends. The downstream side only sees one multiplexed stream with the responses from the multiple servers.

I'm just guessing about how they work, but my guess is that they track the HTTP requests that should come from an article, if all the ads load correctly. If a critical percentage of requests never come through, they report back to the customer, who changes the article's text to encourage you to remove the AdBlock software. Your HOSTS file would look exactly like an ad-blocker to this software, and would get similar treatment.

Ultimately I think the problem is that most publications aren't worth reading anymore, and so "never do business with the company that uses your tech ever again" may be an appropriate solution.

So just change your IP or use a VPN.

How does that change the request pattern for a web page? You still have to request the page and the page's resources regardless of your IP or whether you use a VPN.

The scheme described is presumably blacklisting by IP. (It could also be cookies, but that's even easier to get around).

Unless the server actually doesn't send the content until the ads are loaded; but that would slow down page loading for everyone (and still easily bypassed by sending requests and dropping the incoming packets).

Blacklisting the server by IP and then changing your client IP are completely orthogonal. I can't imagine how changing a client IP or a client using a VPN has any bearing on how a site decides whether that client had downloaded their ads.

Again: how is the server deciding when to block content? If that's done by IP, then by changing your IP you can view the articles again.

Are you suggesting changing the client IP address between every request for every asset in a web page? Technically doable, but unbearably impractical. The new TCP handshakes, the new TLS negotiations ...

This is basically what TOR does. You can certainly do it, but as anyone who has browsed the web through TOR could tell you, the experience is significantly degraded. It's a lot slower, and many larger sites will ban you because you trigger their scraper/DDOS protections.

On Tor your exit IP address does not change for every request you make. Your address does indeed change periodically, but not constantly. The reason Tor is slow is because you're passing through many routers on smaller pipes (people's home DSL, for example) and sharing that with others using those routers.

No, I'm suggesting changing IP every time you get blocked.

If there was a large need for it there would be extensions that do it automatically (and with IPv6, you would have no shortage of addresses, which makes it easier to obtain new ones).

"The publisher could tell users that ads pay for content, and encourage them to either enable ads, subscribe to a site to enjoy the content for free, or view a certain number of ads to unblock stories."

They will allow users to pay a subscription price instead of seeing ads if you prefer that. Are you just against companies that make money? If everyone uses an ad blocker and pays no money to the sites, most sites just won't exist.

> most sites just won't exist.

I'm actually pretty OK with this. I doubt it will happen, though. There must be a better way.

For example (and this is just an example from my own life), right now, the only thing I can do is block everything, there is no way for me to communicate my actual preferences to site owners. I used to white list sites I really enjoyed to give them some revenue, but with every ad network creepily tracking me, I don't do that any more. No matter how much I trust the site and respect the site, I can't trust their ad network.

What if you could approve ads, but block tracking? I'll allow you to insert some content into my pages that advertises to me, but I won't let you execute JavaScript to do it. The ad is less valuable, but it is better than nothing. If I allow tracking, I see fewer ads (but get tracked), if I just allow ads, I see more ads, but don't get tracked.

There are surely other, better ideas as well.

> What if you could approve ads, but block tracking? I'll allow you to insert some content into my pages that advertises to me, but I won't let you execute JavaScript to do it.

The original tracking 'technology'. JavaScript free.

Sure, but that doesn't provide any more information than any other server log.

google contributor is one attempt: https://www.google.com/contributor/welcome/

I don't know about this startup, but others simply serve the files from the domain, where the content lives. If you block that, you won't be able to see the content, which is what the publishers want.

And then people will use remote means to scrape and aggregate the content, if a human can see it, a computer can see it and remove it from the corpus.

In reality, the simplest answer is to just not view the content.

If advertisers want to have a technical arms race against their users, all they do is piss us off. That is a stupid, stupid approach to business.

On Windows, Microsoft Security Essentials warns when a hosts file change is detected. Fortunately it's a simple click to decline any further action. Related, I've witnessed AdBlock Plus spontaneously removed from Firefox, I assume due to anti-virus software, but possibly also due to MSE.

If advertising is not an agreeable business model to you, you should have already stopped doing business with companies that use it, not waited until you lost an arms race.

Hosts file. I'm sure they haven't considered that workaround yet!

Reply on news.ycombinator.com