21–30 of 48 posts
What's funny is they have basically gone 180 degrees from their original design.
Originally they were meant as caching mechanisms.
Now they are cache-busting tracking mechanisms.
We now have trackers acting like first-party properties, but where do you draw the line between first-party and third-party? What I mean is, if I build my own in-house analytics app that does a lot of what Adobe's product does, should that be blocked too? I specifically mean for site analytics, like Experience Cloud or GA, not serving ads. Ad block is different IMO. If this is hosted on a first party subdomain you're…
In practical terms, based on what we have seen up to now, few websites will run their own analytics.
Thus, focusing on the third party services is effective against most tracking.
The "CNAME trick" might be viewed as a good thing because it is putting evolutionary pressure on users to utilise DNS to "block" ads instead of using popular graphical web browsers to do the work. These browsers are written by companies or organisations that derive substantial revenue from online advertising.
Earlier quoted context omitted.
NextDNS blocks those trackers, see: https://medium.com/nextdns/nextdns-added-cname-uncloaking-su...
That's like a tiny bandaid; in the next iteration they'll copy the A/AAAA records instead of CNAMEing them; that would make CNAME uncloaking useless _and_ save one DNS roundtrip reducing browser latency.
So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
Tor exit IPs trigger lots of CAPTCHAs and other abusive behavior. But if it's just that you want to prevent tracking, it's enough to run a VM that connects through a VPN service. Or a nested chain of them.
I mean, whoever can track the whatever about Mirimir, and I couldn't care less. Or any of the other personas that I use.
A few websites that are disguising third-party trackers: Fox News: https://trackingthetrackers.com/site/foxnews.com CNN: https://trackingthetrackers.com/site/cnn.com BBC: https://trackingthetrackers.com/site/bbc.co.uk WebMD: https://trackingthetrackers.com/site/webmd.com ESPN: https://trackingthetrackers.com/site/espn.com Ars Technica: https://trackingthetrackers.com/site/arstechnica.com Go.com (Disney): https://trac…
The requests to the trackers rely on JavaScript being enabled. What happens when JavaScript is disabled?
Further, we can easily list the subdomains that do appear in the page and, assuming they are being used to host content that we want, we can "whitelist" them in our zone file.
Better blocker is by https://ind.ie/ and the rules are online at https://better.fyi/
That said, it’s not comprehensive, so I run it alongside another blocker that uses more traditional rule sources (1Blocker). I find that a diversity of rule sources and sometimes simply building rules manually for individual sites is required. I do think this kind of lookup/service is very useful though in advancing the state of tracker blocking. Next we’ll probably have to do behavioural analysis until they move the trackers into site code or binary data flows of the rest of the site... there is a point at which you have to decide if it’s worth putting up with tracking to use a site or service... as much as I dislike it. If it’s integrated, at least it will be faster than third-party, I suppose.
We now have trackers acting like first-party properties, but where do you draw the line between first-party and third-party? What I mean is, if I build my own in-house analytics app that does a lot of what Adobe's product does, should that be blocked too? I specifically mean for site analytics, like Experience Cloud or GA, not serving ads. Ad block is different IMO. If this is hosted on a first party subdomain you're…
"So, in practical terms, what's the difference between this CNAME trick and building the same thing in-house to run your own analytics?" In practical terms, based on what we have seen up to now, few websites will run their own analytics. Thus, focusing on the third party services is effective against most tracking. The "CNAME trick" might be viewed as a good thing because it is putting evolutionary pressure on users…
How so? Browser and browser addons are perfectly capable of blocking these subdomains.
So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?
(In theory, a site might generate new subdomains and DNS responses for them on the fly, making this approach unworkable. In practice however, most sites have moved entirely to HTTPS, which means that unless you give your ad host a certificate for *.yourdomain.com, all the subdomains have to be known in advance and show up in certificate transparency logs, making them easy to block.)