Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Tag Manager, the new anti-adblock weapon (2020)

chromium.woolyss.com

Post reply on HN
Print view View original

71–80 of 902 posts

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#71

Post by ohyeshedid »

Godel_unicode wrote: post #51
bink wrote: post #26

Earlier quoted context omitted.

The current version doesn't but there's not really a reason to believe it can't be updated. I think the author overstates the complexity of documenting these proxies and URLs for sites that run them.

You're going to lose this cat-and-mouse game, it's the same one that gets played with malware C2 domains (except it's worse because both the proxy operator and the actual domain operator are colluding). Add in the zero-cost nature of subdomains as opposed to needing to pay for new DGA root domains and the fact that they can run the whole thing behind e.g. cloudflare to prevent IP blocking? Forget about it.

> You're going to lose this cat-and-mouse game...

History is full of sentiments like that, from power structures that were never able to stop subversion. The game itself is perpetual, so there's always another turn coming.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#72

Post by gigel82 »

tootie wrote: post #55
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

"Endgame" is the way all web analytics was done 20 years ago.

The server-side "analytics" of 20 years ago was for aggregate reports on popular pages, number of users, their browsers and OSs and maybe their geo-location; solely for the use of the site owners to optimize and whatnot.

This abomination Google is proposing is unblockable cross-site tracking of people's activities. That site owners get to see some of that data too is insignificant, their value comes from being able to track people across the web. I'd bet Google would even offer this proxy service "for free" depending on how much data they can hoover from the site.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#73

Post by whalesalad »

chrisseaton wrote: post #67
whalesalad wrote: post #65

Earlier quoted context omitted.

Just block Google tag manager itself. Gets two birds stoned at the same time.

How would you do that? Isn't it the server that talks to Google Tag Manager, not the browser?

Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible.

Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally need to turn it off or whitelist domains (like Google tag manager) for client work, but normally I have it blocked.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#74

Post by ghostpepper »

brundolf wrote: post #58
thenanyu wrote: post #10

As someone who has spent a lot of time on both sides of this, I think this is a great outcome, personally. The most annoying part of ad-tech for me, as a user, was the fact that I was running all sorts of random javascript, any bit of which could blow up performance on my browser. As someone who used to lead an e-commerce operation, I hated running all of this crap in my users' browsers because I knew it would get bl…

I have mixed feelings about it, even just as a user. There are two reasons people block tracking scripts: 1) privacy, and 2) to stem the deluge of crap that marketing departments dump onto the page, harming performance (both load-time and otherwise) [1]. This basically gives everyone the benefit of #2, even if they don't or can't use an ad blocker. That's pretty cool, in isolation. But of course it also makes it much…

Don't forget about ad-served malware

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#75

Post by chrisseaton »

whalesalad wrote: post #73
chrisseaton wrote: post #67

Earlier quoted context omitted.

How would you do that? Isn't it the server that talks to Google Tag Manager, not the browser?

Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible. Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally nee…

> Google tag manager in my experience is a script executed by the browser.

Isn't the whole point of this new change that it runs server-side, using a proxy that you install on the website so it uses the same domain?

> Regardless, I use a DNS based ad blocker

But it's the same domain name isn't it?

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#76

Post by tasha0663 »

toastal wrote: post #59
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

While impractical, I liked the article's suggestion of blocking the proxies. I'm curious what reaction this would have. Ad blocking users get no content and move to alternatives and stop being users, or would the sites cave and realize having users interacting is more important than all of the data collected.

It's a fine suggestion. If it breaks the site, then I'd call that a broken website and move on. Maybe next time someone points me there, they'll have fixed their critical issue for users who block tracking proxies.

I'm okay with not being in the target audience of sites that really want to do this. I've got enough other things to do at less hostile places that my FOMO isn't triggered in the least.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#77

Post by heavyset_go »

hilbert42 wrote: post #47
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

> By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running.

Years ago I was on the "people who block JavaScript are crazy" bandwagon, until just loading a single news article online meant waiting for a dozen ads and autoplaying videos to load. I spent more time waiting for things to finish loading than I spent browsing the actual sites, which killed my battery life. I'd get a couple of hours of battery life with JS on, and with it off, I could work all day on a single charge. It was nice.

Ever since then, I've been using NoScript without a problem. I've spent all of maybe 5 minutes, cumulative over the course of several years, clicking a single button to add domains to the whitelist. If whitelisting isn't something you want to do, you can use NoScript's blacklist mode, too.

> I'm now so spoilt by the advantages of the non-JS world that I don't think I could ever return. I'm always acutely reminded of the fact whenever I use someone else's machine.

I relate with this 100%.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#78

Post by jart »

gumby wrote: post #41

I am fascinated that the popular press has described this as Google adding privacy (which is how google describes it of course) where really it’s a massive escalation of their spying network.

Well it sounds like they're plugging the RCE hole in how ads operate which is even better. That's the real elephant in the room which no one seems to be talking about. With all these zero click exploits I don't want an entire industry to exist that's dedicated to people bidding to run code on my computer. If all that bloat is running somewhere else in the cloud and this tag manager is filtering the information they access so that it's actually just boring marketing analytics then I'd imagine it does a lot to help improve the sovereignty of personal spaces.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#79

Post by ajdude »

hilbert42 wrote: post #47
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

This. I use the no script addon by default, and it’s amazing how many different domains sites try to bring in. Then I hit Twitter, imgurl, quora, etc and I am left with nothing but a blank page with plain text telling me that I need JavaScript to view the site. It makes me wonder what kind of tracking they are pushing.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#80

Post by Saris »

chrisseaton wrote: post #67
whalesalad wrote: post #65

Earlier quoted context omitted.

Just block Google tag manager itself. Gets two birds stoned at the same time.

How would you do that? Isn't it the server that talks to Google Tag Manager, not the browser?

Just block the GTM js from loading, it'll stop it easily.
Post reply on HN