Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

41–50 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#41

Post by leeoniya »

cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

sticking OPNSense on one of these [1] was probably the best LAN decision i've made, besides a Synology backup NAS.

it acts as a pihole and a lot more (firewall, device vlan isolation, vpn termination, etc). i have these hosts files [2] loaded into its DNSmasq config.

[1] https://www.amazon.com/dp/B072ZTCNLK

[2] https://github.com/StevenBlack/hosts

Re: Cname cloaking, a disguise of third-party trackers

#42

Post by jefftk »

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS.

(Disclosure: I work in ads; speaking only for myself)

Re: Cname cloaking, a disguise of third-party trackers

#44

Post by progval »

9dl wrote: post #4

Sooooo I suppose we are going back to the roots White lists in hosts file with ips and good sites

You can also use uMatrix or NoScript to disable all JS/XHR (or even CSS and images) from third-party domains by default; and whitelist those you need.

Re: Cname cloaking, a disguise of third-party trackers

#46

Post by bsysop »

jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

Do you think ad companies will really trust reverse-proxied ad traffic? Seems like a tremendous opportunity for fraud. Right now with user agents hitting ad servers directly, there's much less opportunity for content publishers to fake impressions and clicks.

Re: Cname cloaking, a disguise of third-party trackers

#47

Post by nashashmi »

kerpele wrote: post #18
homero wrote: post #16

Earlier quoted context omitted.

That also means most of their audience blocks ads. What are they to do?

if their audience blocks ads this isn’t going to help, it’ll only make people mad. I know I’m upset.

Browse those sites with js blocked. If not js blocked, then third-party cookies blocked. If not that, then ublock to block all cookies and allow only specific cookies.

This is my recipe for browsing the web. Blocking specific cookies. Blocking all third-party cookies. A1llowing specific third-party cookies. Still, in recent months, I have noticed some have started getting smarter. So I block js there.

But every browser is different with ease of use. Love brave browser capabilities. Like Chrome ease. Hate Firefox features. So using extensions to fill in those gaps.

Re: Cname cloaking, a disguise of third-party trackers

#49

Post by poitrus »

cheald wrote: post #12

Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking and DNS query encryption out to Cloudflare for the whole network, and it's really not all th…

Check this article, pi-hole can’t block this yet: https://medium.com/nextdns/nextdns-added-cname-uncloaking-su...

Re: Cname cloaking, a disguise of third-party trackers

#50

Post by poitrus »

jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

They might yes, but it is orders of magnitude harder to setup and maintain than this, and as a website owner, you have to put even more trust in your ad serving solution than today.
Post reply on HN