Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Tag Manager, the new anti-adblock weapon (2020)

chromium.woolyss.com

Post reply on HN
Print view View original

111–120 of 902 posts

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#111

Post by kevin_thibedeau »

hilbert42 wrote: post #47
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

Firefox has never been slow for me over the last 15 years because NoScript makes it light years better than Chrome. Conversely, I routinely have the Android assistant lock up on me from JS bloat despite the supposed performance enhancement of AMP pages.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#112

Post by Ajedi32 »

romeoblade wrote: post #106
whalesalad wrote: post #73

Earlier quoted context omitted.

Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible. Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally nee…

You missed the part where they recommend changing the script's name as well, add in changing a few variable/function names in the script and even matching the hash of the script itself would be useless. On top of them recommending using a sub domain with an A/AAAA record so its first party.

Worst-case you parse the script and block it if the AST is too similar.

There are a million ways to detect and block this sort of thing when you control the client. Yes, it's harder than just blackholing a whole domain, but it's hardly impossible.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#113

Post by lewantmontreal »

tgsovlerkhgsel wrote: post #50
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

Aren't browsers shifting to a per-domain cookie jar? While you can never prevent one specific site from tracking you, this still doesn't (directly) allow your activity on Site A to be linked to activity on Site B, does it? Of course, fingerprinting combined with IP addresses will ultimately allow something that comes very close to it, so the current state (a few hundred trackers per website, all ending up harmlessly…

This is what I’m interested in. Article itself did not mention cross site tracking.

Every website having their own tracking subdomain makes third party cookies not work cross site even without browser changes.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#114

Post by forgotmypw17 »

hilbert42 wrote: post #47
gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

There's another, indirect benefit to blocking JavaScript.

Over time I have noticed a strong correlation between sites which don't work right without JS and low-quality content which I regret having spent time reading.

Most of the time I encounter one of these sites I now just close the tab and move on with a clear conscience.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#115

Post by chillacy »

anxrn wrote: post #56
gigel82 wrote: post #48

Earlier quoted context omitted.

Highly doubtful the method would continue to be called "gtag"; any js bundling / minification would replace that with a randomly generated string, and it's just as easy to randomize the server-side api endpoint url, making this virtually impossible to block (maybe a pattern analysis on the data being transmitted, but that can also be encrypted with random algorithms and keys, beyond recognition).

Yes, it can surely be obfuscated, but ultimately there will be a client-side function with near-identical functionality prevalent all over the web. It's harder, but seems possible to build an extension to identify this function.

Taken to its logical conclusion, this process reminds me of anti-virus software: finding code signatures and flagging sketchy code.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#116

Post by dsr_ »

gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

There's no way to fight this unless ... you pass legislation against it or comparable technologies, preferably at a policy level.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#118

Post by danhilltech »

olliej wrote: post #98
danhilltech wrote: post #27

Server-side tracking has been around for a while (indeed this article is dated Nov 15, 2020; and of course, you could argue simply parsing your Apache/nginx logs to get visitor stats has existed forever). The article I think conflates several different pieces. There's probably a few actual use cases marketers may care about for tagging/tracking/analytics: 1. Simplest: I want to know how many people use my site/app, h…

1) can be done trivially with first party cookies. 2) you can already tell what device someone is using. If you mean “I want to know if the same person is on different devices” get them to login, don’t try in effectively spy while also providing google etc with the ability to actually spy 3)you cannot know how to target ads on a per user basis unless you are spying on your users. You have no justification that suppor…

Yea, I think we're saying the same thing. Ultimately both the best choice (for privacy, performance etc.) and the one that's most likely (given adblockers and and ever increasing push for privacy from browsers and OSs) is to stop trying to find a way around adblockers, and simply invest in the technologies that work - http, cookies, sessions, logins, and os on.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#119

Post by terrycody »

technion wrote: post #60

Note that the Google announcement in question was August 2020. This didn't seem to make any significant changes to the ad-block space when it rolled out, and pretty much every site is still running the Javascript frontend.

Sorry I can't understand the article, but does server side Google tag manager already out?

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#120

Post by akkartik »

Nursie wrote: post #84
akkartik wrote: post #69

Earlier quoted context omitted.

Elaborate? I have dnt turned on and am using incognito tabs? Still not good enough?

“DNT” is a bad joke, always was, just so you know. It just adds a header to your requests asking nicely not to be tracked. If anything it probably acts as a datapoint on fingerprinting and actually helps to track you.

It provides a modicum of social and legal enforcement. A website with any sort of brand risks legal and PR costs if they violate DNT. I'm happy for them to take that risk.

Though I see now that the whole thing has fallen through since around 2019: https://en.wikipedia.org/wiki/Do_Not_Track. Oh well.

Going back to my original comment, if there's a better way to read say the NYTimes without being tracked by the NYTimes, I'd like to hear it.

Post reply on HN