Live data from Hacker News

Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

github.com

111–120 of 207 posts

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#111
post #61

Earlier quoted context omitted.

As far as I know, current ad blockers can't block ads from Widevine (DRM protected) streams, so I guess it's only a matter of time until Chromium team comes up with Widevine for webpages and then it's game over for normal consumers.

Didn't they more or less try this with the Web Environment Integrity API? Luckily, people caught on quickly and caused enough backlash for them to abandon it - this time. I'm not sure how things will work out the next time though.

At least we got some of my all-time favorite GitHub issues tho

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#112

This makes sense, but I guess adblockers could just start loading the data and not show it to the user?

Part of the goal of content blocking is to reduce network traffic, so that's not an ideal outcome.

> Part of the goal of content blocking is to reduce network traffic, so that's not an ideal outcome.

Not in the short term, no. But, maybe in the long term ...

Remember that the user is not the customer. The customer is the person buying the ad space from google/facebook/etc. If the customer receives no value for their money, and they can easily determine that, why would they continue purchasing ads?

If every browser downloaded and clicked every single ad in an invisible background and sandboxed process, ads become close to worthless to the customer.

So, sure, in the short term there'd be extra processing and network usage, but that would quickly taper off as customers stopped buying ads because every single ad they put out gets a 100% click-rate. After a while the extra utilisation would be close to zero, as it would only be the occasional customer trying their luck at advertising, and failing immediately.

It's the same with spam email: the solution isn't to block, and keep lists and reputation, the solution is to reply to every single spam email![1] Even the most well-run spamming/scamming organisation can't very well reply to millions of emails rxed per hour.

[1] Caveat: need to ensure that the sending email did indeed legitimately send the email, otherwise a few clowns would simply send spam with someone else's email as a prank.

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#113

Anyone know what happened to ethicalads.io? Website has been offline for over a month, but founders/engineers seem to be active on LinkedIn & GitHub still

Website is very much online. Can you share a curl or screenshot of what you see?

hmm

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#114

Earlier quoted context omitted.

Are you also okay with sites running crypto miners while they're open without having received your prior consent as a way to monetize? How about if they install a service worker in case you close the tab before doing sufficient mining to pay what they think is fair? Personally, I run malware blockers by default, so I don't know which sites are trying to send it to me to avoid visiting them. I couldn't tell you whethe…

What has that got to do with anything? "I don't mind driving the speed limit" "BUT ARE YOU ALSO OKAY WITH MURDER???"

Because they both involve non-consensually using your computer for something you didn't want it to do as a form of "payment" you didn't agree to? In fact my point is I didn't see why you would ever consider crypto mining to be murder in this analogy. Crypto mining only uses your computer to do some pure computations and send the other party the result. It does not exfiltrate your private information or stalk you. It does not facilitate scams. It is obviously vastly more ethical than drive-by adware, which uses your computing resources and does those other bad things, but for some reason you don't find people defending crypto miners very often, while you do find them defending ads (I suppose because they participate in adware/spyware delivery somehow, so they're not interested in examining their own actions).

How can you justify it being okay to send drive-by adware and spyware with a requested web page, but you believe it's not okay to use computation as a form of payment without consent?

Personally, I've only ever worked for companies that make money by having our customers pay us for the product or service that I work on, so I've never had to worry about that conflict of interest.

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#115

I wouldn't even mind ads if most sites weren't malicious with how they serve them. Do not make a new window pop up, do not try to download anything to my computer without my explicit instruction, do not make me click an x to view the content, do not interrupt the content to serve an ad. Why can't they just have a nice little ad on the left and/or right side of the page that doesn't interrupt my intake of their conten…

[deleted]

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#116
Mozilla says the following about HTTP 103 Early Hints:

> Note: For compatibility reasons it is recommended to only send HTTP 103 Early Hints responses over HTTP/2 or later, unless the client is known to handle informational responses correctly.

> Most browsers limit support to HTTP/2 or later for this reason.

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#117
post #29

Earlier quoted context omitted.

If you do not like the ads, just stop visiting sites that show ads...

If there is competition offering ad-free services, this would be an option. But for large parts, there isn't.

If food was free, no one would pay for it. But it isn't free.

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#118
post #98

Earlier quoted context omitted.

You can buy ad free services for a lot of them. Few pay.

Price thing: no one can afford to pay "a latte per month" for every site they visit. Trust thing: the site is likely to still spy on you even if you're a paid subscriber. Even if they drop ads they'll send your data to google or some other analytics provider, at the least. They'll "accidentaly reset" your email preferences. Plus other shenanigans *. Infrequency thing: I won't subscribe to $SOME_SITE just because it's…

I managed to subscribe at a really good annual rate vs. list through some online aggregator, where they pre-warn me of renewal and rate changes to let me cancel if I want. I don’t remember what it was without searching my email, so not shilling for them in any way, but there are methods.

That said, yeah-no one can reasonably afford the constant “I just want to read this one linked article twice a year on your local community news” turning into “subscribe for $120 a year after $1 for your first month”, and we really need some middle ground.

Unfortunately, people have an aversion-a hard aversion-to anything that’s not “zero” or “fixed”. I discovered it with Kagi, for example-despite whatever number of searches you find yourself actually running, having only “x per month” means you have to think about it, until you’re just like “pay the unlimited price and put the cost of thinking about it on them”.

Maybe with news the best way would be some kind of micro transaction, but all attempts so far have failed…

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#119

I really wish the pay-with-compute model stuck. Lending webpages some CPU-cycles (probably to mine crypto) in a controlled and safe way would be a win-win(-win) situation. Websites won't have to submit to their advertising overlords and still be able to incrementally monetize their content. Users won't have to deal with the downgraded experience — while sacrificing compute cycles anyway to download and display the aw…

You'd need someone willing to actually buy the cryptocurrency generated from nothing on the other side of that transaction.

Re: Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

#120

I really wish the pay-with-compute model stuck. Lending webpages some CPU-cycles (probably to mine crypto) in a controlled and safe way would be a win-win(-win) situation. Websites won't have to submit to their advertising overlords and still be able to incrementally monetize their content. Users won't have to deal with the downgraded experience — while sacrificing compute cycles anyway to download and display the aw…

This! I'm actually amazed how rarely it gets brought up, even among my techsavy friends. It literally seems like a perfect win-win for everyone...except ad companies. Queue conspiracy theory: they were clearly the ones that coined the term cryptojacking and spawned a ton of articles about in the press when this idea first surfaced.
Post reply on HN