Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Tag Manager, the new anti-adblock weapon (2020)

chromium.woolyss.com

Post reply on HN
Print view View original

131–140 of 902 posts

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#131

Post by Syonyk »

ajdude wrote: post #79
hilbert42 wrote: post #47

Earlier quoted context omitted.

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

This. I use the no script addon by default, and it’s amazing how many different domains sites try to bring in. Then I hit Twitter, imgurl, quora, etc and I am left with nothing but a blank page with plain text telling me that I need JavaScript to view the site. It makes me wonder what kind of tracking they are pushing.

All of them. If you allow everything and have Ghostery running in "don't block anything but tell me what's there" mode, it's horrifying just how many things get loaded.

You can play with page load sizes in the debugger console with stuff blocked and without too - about half the downloaded material on any major news website is stuff that Ghostery will block. It's quite terrifying.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#132

Post by fay59 »

losteric wrote: post #8

Citing adblock feels like clickbait. Google Tag Manager can't run ads so I don't follow the comparison. Marketing analytics could always side-step anti-adblocking tools through server-side tracking.

Saying that Adblock users want it 100% to block ads and 0% to protect their privacy is a misleadingly narrow analysis, even this use isn’t completely effective.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#133

Post by ulrikrasmussen »

ghoomketu wrote: post #23

Pretty sure a big ban hammer is coming for Google with all such shenanigans, especially in trigger happy places like Europe and India who don't like their citizens tracked and are happy to create legislative bans. So you may win the cat and mouse adblock game but what are you gonna do when countries start making it illegal to use GA? (1) (1) https://www.forbes.com/sites/emmawoollacott/2022/02/10/frenc... ?

I can't wait for this to happen. Personally I think we just need to ban all targeted advertising based on viewer profiles, even session data such as IP and geo-location. This in turn should severely limit or destroy business models based on optimizing for engagement, as non-paying users are no longer profitable. It's going to cost a lot of people in ad-tech their jobs, but there is no shortage of demand for IT work, so surely they'll find something else to do.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#134

Post by matt_heimer »

losteric wrote: post #8

Citing adblock feels like clickbait. Google Tag Manager can't run ads so I don't follow the comparison. Marketing analytics could always side-step anti-adblocking tools through server-side tracking.

Adblockers block ads and tracking, if the new gtag manager makes easier to defeat the tracking protections of an ad blocker then it seems accurate.

I think the key thing here is that ad/tracking blockers often rely on domains or requests being 3rd party. In the past it was more work to hide the 3rd party trackers as 1st party, this makes it easy so its more likely to happen now.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#135

Post by dredmorbius »

rnotaro wrote: post #97
gzer0 wrote: post #88

Increasingly, the only solution I see to this is Apple's Private Relay [1]. "When Private Relay is in use, the user’s device opens up a connection to the first internet relay (also known as the “ingress proxy”). As the user browses, their original IP address is visible to the first internet relay and to the network they are connected to. However, the website names requested by the user are encrypted and cannot be see…

I don't really have a great knowledge of the Tor Network but is that not really similar to a Tor Relay?

Tor relays are identifiable.

And are blocked or rate-limited by many websites.

That said, if a majority of interesting Web traffic transited Tor, that behaviour would likely change.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#136

Post by paulryanrogers »

heavyset_go wrote: post #77
hilbert42 wrote: post #47

Earlier quoted context omitted.

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

> By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. Years ago I was on the "people who block JavaScript are crazy" bandwagon, until just loading a single news article online meant waiting for a dozen ads and autoplaying videos to load. I spent more time waitin…

Tried NoScript for years and it was a pain. Too many of the sites I use need so many domains full of JS. So I think this will vary widely depending on the person and their preferred/needed sites.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#137

Post by x0x0 »

chrisseaton wrote: post #75
whalesalad wrote: post #73

Earlier quoted context omitted.

Google tag manager in my experience is a script executed by the browser. Then it installs itself in the page and performs the inner payload of user script insertions. It’s a Trojan horse, really. You can block Google tag manager’s embed scripts. I wasn’t aware of a backend integration but it’s certainly possible. Regardless, I use a DNS based ad blocker (pihole) and it takes care of all this stuff. I occasionally nee…

> Google tag manager in my experience is a script executed by the browser. Isn't the whole point of this new change that it runs server-side, using a proxy that you install on the website so it uses the same domain? > Regardless, I use a DNS based ad blocker But it's the same domain name isn't it?

Current GTM, configured (via the server UI) to inject tracker X:

gtm javascript loads, pulls down the config, injects tracker X javascript into the browser

new gtm:

gtm javascript loads, pulls down config, streams events to google servers to fan out to tracker X as configured

So blocking gtm.js off tagmanager.google.com / www.googletagmanager.com / the various other domains still blocks all gtm injected tags.

The tl;dr is they're become much closer to segment -- which does the data fanout internally to segment. But they should still be straightforward to block.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#138

Post by technion »

terrycody wrote: post #119
technion wrote: post #60

Note that the Google announcement in question was August 2020. This didn't seem to make any significant changes to the ad-block space when it rolled out, and pretty much every site is still running the Javascript frontend.

Sorry I can't understand the article, but does server side Google tag manager already out?

Yes it's been out for quite some time.

It's also requires running a proxy as a GCP application, so people running GTM largely because it's free/cheap aren't going to go along with this.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#139

Post by notriddle »

anxrn wrote: post #56
gigel82 wrote: post #48

Earlier quoted context omitted.

Highly doubtful the method would continue to be called "gtag"; any js bundling / minification would replace that with a randomly generated string, and it's just as easy to randomize the server-side api endpoint url, making this virtually impossible to block (maybe a pattern analysis on the data being transmitted, but that can also be encrypted with random algorithms and keys, beyond recognition).

Yes, it can surely be obfuscated, but ultimately there will be a client-side function with near-identical functionality prevalent all over the web. It's harder, but seems possible to build an extension to identify this function.

This is literally the same game virus scanners played against mutation engines. Ultimately, the halting problem won.

There are two places this can end:

* Redesign the runtime environment so it doesn’t matter if you download trackers. The execution environment doesn’t offer the I/O facilities that it requires to actually produce harm. This is what Apple Private Relay and Tor Browser try to give you. By analogy, this is why Web Apps became so popular in the first place — web publishers who do not intentionally collude are protected from each other by the SOP, so opening a web page should be less risky than running an EXE. It’s “just”[1] extending the existing sandbox to prevent differing origins from being able to collude.

* Instead of blocking bad scripts, allow only known-good ones. To match the convenience of current-day ad blocking, it needs to be a collaboratively-produced list. In other words, a gatekeeper. By analogy, this is why installing “unrecognized” applications on Windows and macOS is behind a scare screen, and why doing it on iOS is prevented entirely.

The former seems less dystopian, but much more difficult.

[1]: this is actually very difficult

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#140

Post by matt_heimer »

rootusrootus wrote: post #128
terrycody wrote: post #119

Earlier quoted context omitted.

Sorry I can't understand the article, but does server side Google tag manager already out?

If I am reading it right, the article is saying about 1/3 of all web sites on the Internet already use GTM.

Using Google Tag Manager doesn't mean you are using the server-side tagging. You have to configure it in your account. It is something you have to pay for. If you read the instructions on https://developers.google.com/tag-platform/tag-manager/serve... you have to have GCP billing setup to pay for the App Engine instance running the server-side tagging proxy.
Post reply on HN