Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

151–160 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#151

Post by bostik »

going_to_800 wrote: post #58

I worked in ad space 7 years ago. Companies that provide content need to get paid for the content one way or another, either paying a fee or ads, nobody can argue with this. There needs to be an organization that imposes ad guidelines(like only specific formats, not being intrusive, etc) for both websites and ad companies. They should verify the ads/websites based on user reports and if they find something, to kick t…

> All companies that follow those guidelines...

If we want to push for guidelines on acceptable ads, how about starting with these?

https://bostik.iki.fi/aivoituksia/random/no-stalking.html

(Yes, I have brought these up recently elsewhere.)

Re: Cname cloaking, a disguise of third-party trackers

#152

Post by nl »

jhhh wrote: post #119
jefftk wrote: post #78

Earlier quoted context omitted.

I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads

Unpersonalized ads can still serve the same democratic funding model you're identifying as the main positive reason for online advertising's existence. You present a false choice between obnoxious (visibility intrusive) ads versus these odious information gathering schemes. Since the latter make more money and people hate obnoxious ads we must choose personalization. Thankfully we're now fully aligned with how Google…

As a consumer I vastly prefer targeted ads. I don't like badly targetted ads much though.

(I don't work in adtech, but I have sold technology to adtech companies.)

Re: Cname cloaking, a disguise of third-party trackers

#155

Post by vsto »

xyzal wrote: post #149

Please correct me if I am wrong, but would not such a tracking be circumvented by enabling first party isolation in the browser? As far as I know, Firefox has such feature implemented: https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...

I was also wondering about the that. Sadly, it is still not enabled by default in the latest Firefox release (version 70).

Furthermore would the Firefox Multi-Account Containers https://addons.mozilla.org/en-US/firefox/addon/multi-account... with container per site prevent such tracking (has to be done manually ATM) ?

Re: Cname cloaking, a disguise of third-party trackers

#156

Post by tambre »

skunkpocalypse wrote: post #137
strenholme wrote: post #96

The way to counter this is to know the IP a given CNAME resolves to, and to block “rogue” (read: tracking) IPs. As an open-source DNS implementer, I know this has already been done, since my DNS server (MaraDNS’s Deadwood recursive resolver) has the ability to refuse to resolve DNS names with bad IPs via ip_blacklist. The reason I implemented this is to block NXDOMAIN redirects (when using an ISP’s DNS server and mis…

> block “rogue” (read: tracking) IPs. With IPv6 that's as impractical as blocking "rogue" FQDNs.

Why? Just block ranges.

Re: Cname cloaking, a disguise of third-party trackers

#157

Post by going_to_800 »

tsimionescu wrote: post #63
going_to_800 wrote: post #58

I worked in ad space 7 years ago. Companies that provide content need to get paid for the content one way or another, either paying a fee or ads, nobody can argue with this. There needs to be an organization that imposes ad guidelines(like only specific formats, not being intrusive, etc) for both websites and ad companies. They should verify the ads/websites based on user reports and if they find something, to kick t…

There are other alternatives. Alternative monetization schemes, such as those offered by Patreon or Twitch or Kickstarter can be found. Also, ads can be placed teh same way they were in newspapers - the ad company would submit ads to the content creator, who would manually chose which ads to include, and where.

It's not that easy as you may think. Also, small companies won't benefit from that, nobody will submit an ad to websites with lower traffic. Besides this, there's the issue with the tracking server and so on.

Re: Cname cloaking, a disguise of third-party trackers

#158

Post by 0xdeadb00f »

zelly wrote: post #65
zelly wrote: post #54

I knew something like this would come up. I always wondered why ad/tracking companies never proxied through the first-party domain (or in a more extreme case, the first-party server itself) to skirt adblock. Suppose you load example.com/article. Ad Agency serves ad/tracking assets from example.com/article/Zqj7MOm.js. When you reload, it serves from example.com/article/llc9h76.js. How do you block it? You can't. Getti…

I can think of a couple mitigations against this future: - Disable JavaScript - Render SPAs off-site (or in some sandbox with a different network interface) and return the static HTML and CSS Good enough to read news articles

> "Please enable JavaScript to view this content"

Re: Cname cloaking, a disguise of third-party trackers

#160

Post by Semaphor »

privateSFacct wrote: post #133
aledalgrande wrote: post #101

Earlier quoted context omitted.

Is this form of aggressive identification without consent not going against the GDPR?

When I browse European sites I'm always having to click through permissions - I imagine most folks are on autopilot by now in terms of saying "yes" especially in Europe - how can you even browse the web if you don't click yes one everything in Europe? What's the data on folks actually saying no to these popups / clickthrough alerts? I used to skim the relatively few permission / yes agreements (ie, this will auto sig…

The Europe site is compliant. They allow you to refuse nonessential cookies. Most sites are not. I'm pretty sure eventually those cases will be handled.
Post reply on HN