Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

171–180 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#171

Earlier quoted context omitted.

There are other alternatives. Alternative monetization schemes, such as those offered by Patreon or Twitch or Kickstarter can be found. Also, ads can be placed teh same way they were in newspapers - the ad company would submit ads to the content creator, who would manually chose which ads to include, and where.

It's not that easy as you may think. Also, small companies won't benefit from that, nobody will submit an ad to websites with lower traffic. Besides this, there's the issue with the tracking server and so on.

I didn't say it was easy. But perhaps it is important enough that it should even be regulated.

Re: Cname cloaking, a disguise of third-party trackers

#172
post #116

Earlier quoted context omitted.

That’s too simplistic a take: they aren’t running shady ads and unlike many sites they allow you to you subscribe and not see ads at all. Unfortunately, large chunks of the public — especially tech site visitors — have been conditioned to think of content as free, and the adtech bubble hasn’t pooped yet so we can’t reverse that trend.

What people are willing to pay for content is I think almost zero. If we get rid of these privacy invading ads and micropayments/subscriptions don’t take off in a big way (I don’t think they will) then one or two things must happen 1) advertising money remains even though ads are dumber (less narrowly targeted, more fraud etc) 2) there is a lot less money to go around so there must simply be less content. I think the…

I definitely think you’re right on the conclusion: a lot of content sites are going to need to dramatically scale back their size or simply fold. It feels a lot like when VCs pile money into an area and it takes longer for viable business models to win out, only with a much longer run time since the advertising market is so much larger.

Re: Cname cloaking, a disguise of third-party trackers

#173
post #170

Something is missing here: HTTPS links and SSL. Either website.com hands over its certificate to dnsdelegation.io (which is unlikely and definitely not a 2 min trust-less process) or dnsdelegation.io has the ability to generate any certificate like a certificate authority which is really terrible (and also unlikely).

DV certificate (cheapest, most common one) does require only proof of control over the domain.

So dnsdelegation.io can just request certificate for the domain you've delegated via cname from any CA.

Re: Cname cloaking, a disguise of third-party trackers

#174
post #78

Earlier quoted context omitted.

I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads

Nice write-up. What is your opinion on the following: Ads make people buy stuff they don't need. So if we would stop with ads everywhere, we can save the planet.

I don't think "ads make people buy stuff they don't need" is a large part of what's going on. One way to think about this would be, what would the world be like if we didn't allow advertising? Not just internet ads, but magazine ads, affiliate links, sponsored posts, product placement, everything. And assume that enforcement is perfect ;)

Here's my speculation about how this would change people's purchasing:

* Products would be a lot stickier. A lot of advertising is about trying to move people between competitors, or keep them from moving. Sometimes it's an explicit "here's a way we're better" (ex: company advertises that they don't charge unpopular fee X), other times it's a more general "you should think positively of our company" (ex: we agree with you on political issue Y).

* Relatedly, it would be much harder to get many new products started. Say a startup makes a new credit card that keeps your purchase history private: right now a straightforward marketing approach would be (a) show that other credit cards are doing something their target audience doesn't like, (b) build on their sense that this isn't ok, and (c) present the new card as a solution. Without ads they would likely still see uptake among people who were aware of the problem and actively looking for a solution, but mostly people would just stick with the well-known companies.

* Reviewers would be much more trustworthy. There's a long history of reviewers getting 'captured' by the industry they review, ex: https://www.fastcompany.com/3065928/sleepopolis-casper-blogg...

* Purchases of things people hadn't tried before would decrease, both things that people were in retrospect happy to have bought and things they were not. One of the roles of advertising is to let people know about things that, if they knew about them they would want to buy. But "buy stuff they don't need" isn't a great gloss for this, since after buying the products people often like them a lot.

This is just my guesses; I work on the technical side of ads and don't have a great view into their social role, and even if I was in a role like that it would still be very hard to predict how the world would be different with such a large change. Where does your picture differ from mine?"

(For 'saving the planet' I think a carbon tax would make a lot more sense.)

Re: Cname cloaking, a disguise of third-party trackers

#175
post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.

Oh, that is coming to non-web as well, there are already billboards with cameras. Although for now, one 'test' in the Netherlands was declared illegal (for now) due to privacy concerns.

Re: Cname cloaking, a disguise of third-party trackers

#176
post #119

Earlier quoted context omitted.

Unpersonalized ads can still serve the same democratic funding model you're identifying as the main positive reason for online advertising's existence. You present a false choice between obnoxious (visibility intrusive) ads versus these odious information gathering schemes. Since the latter make more money and people hate obnoxious ads we must choose personalization. Thankfully we're now fully aligned with how Google…

As a developer in publishing, I would support that bill in a heartbeat. Tracking means you can target a niche market without paying for niche content. It’s terrible for publishers and consumers. It’s good for ad people.

> Tracking means you can target a niche market without paying for niche content. It’s terrible for publishers and consumers.

This only seems partly right to me. Let's say someone wants to sell fishing equipment. The traditional way of doing this is to buy ads on fishing sites. So now my fishing equipment purchases make there be more writing about fishing; yay!

Then one of the fishing websites decides to put a tracking pixel on their site to drop "fishing website visitor" cookies. They make a deal with a third party provider and get paid a small amount per visitor. Then fishing retailers have a new choice: instead of buying ads on fishing sites they can instead buy ads on any site for users who have one of the "fishing website visitor" cookies. If there were a monopoly fishing site, then this would increase their earnings: while the ad space on their site isn't as valuable, they will set the pixel price high enough that they come out ahead. It's not a monopoly, though, so the price of the pixel gets driven down through competition, and money that would go to fishing sites instead goes to the publishers that people who spend money on fishing equipment visit.

In this case I see how it's worse for fishing sites, but not how it's bad for consumers: their willingness to buy fishing equipment translates into support for all the sites they visit, and not just the fishing sites.

But there are also many niches that don't have economic tie-ins, or have ones that are far weaker than "writing about fishing" and "buying fishing equipment". In a world with targeted advertising, these niches do better, because of overlap between audiences. A "let's have better housing policy" blog can show ads for fishing equipment, vacations, HVAC supplies, or whatever else visitors have shown interest in on other sites.

Additionally, targeted advertising increases the total amount of funding available for online content, because people with niche interests are available to be advertised to in more places. Seeing ten fishing ads once a week when you visit a fishing site vs seeing twenty fishing ads spread over the course of the week, etc.

So, yes, niche publishers in lucrative niches would make more money if we only had context-based advertising, but I don't think niche publishers overall, publishers overall, or consumers would be better off.

(Disclosure: still speaking only for myself)

Re: Cname cloaking, a disguise of third-party trackers

#177
post #170

Something is missing here: HTTPS links and SSL. Either website.com hands over its certificate to dnsdelegation.io (which is unlikely and definitely not a 2 min trust-less process) or dnsdelegation.io has the ability to generate any certificate like a certificate authority which is really terrible (and also unlikely).

They are (ab)using let’s encrypt.

Re: Cname cloaking, a disguise of third-party trackers

#178
post #51
post #46

Earlier quoted context omitted.

Do you think ad companies will really trust reverse-proxied ad traffic? Seems like a tremendous opportunity for fraud. Right now with user agents hitting ad servers directly, there's much less opportunity for content publishers to fake impressions and clicks.

They already do - Instart Logic is one of the reverse proxies dedicated to serving ads first-party. For tracking and invasive device tracking (WebGL, plugin enumeration, Canvas, audiocontext, WebRTC, WebSocket-based portscanning of your LAN CIDR acquired from WebRTC, ...) there's Shape and Distil that both do inline reverse proxying.

Though, WebRTC tracking is becoming severely limited with the current mDNS initiative that hides all the local IP addresses and other measures to hide available devices.

Re: Cname cloaking, a disguise of third-party trackers

#179
post #114

Earlier quoted context omitted.

This may be tremendously ignorant but... What is to stop ad tech companies creating a cryptographically secured reverse proxy device[1] that clients can install in their network between the web server and requests from the internet? The ad tech company only has to trust that their device is secure and the company that sells their website doesn't have to give up control of their domain or anything else. They would hav…

This would have to be a reverse proxy on the AdTech's infrastructure itself to make sure no rewriting is being done after-the-fact, as you can't trust your AdTech customer (the person that owns example.com) to not run a reverse proxy in front of that .

Thanks for making me realise the most obvious thing, that it doesn't stop click fraud if it is on the ADTech customers network as they can connect to the device and pretend to be any device on the internet.

Re: Cname cloaking, a disguise of third-party trackers

#180
> It also only takes 2 minutes to change dg3fkn.website.com to 3j4vdl.website.com (Hell, you can probably automate this). We mentioned above how much work it takes to gather all subdomains being used as a front for CNAME Cloaking. Now imagine they change every week, every day, or every hour. It’s just impossible to keep track.

That's fear mongering. The ad company can't pester their clients to make changes to the DNS on a regular basis. I'd say that anything beyond initial setup would be unaccepted to most clients. And clients won't give control of their DNS to ad company, so automation is also not really possible.

Also, because this setup is substantially more friction than a simple 3rd party tracking "just copy-paste this code", I'd guess it will only be used by high profile clients.

This all means that while annoying, it shouldn't be too hard to find and add these subdomains to the ever-updating ad url blacklists.

Post reply on HN