Google Tag Manager, the new anti-adblock weapon (2020) • Hacker News Board

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#191

Post by Arnavion » Mon, Feb 21, 2022, 5:28 AM UTC

gaius_baltar wrote: post #163

propogandist wrote: post #130

Earlier quoted context omitted.

use uMatrix or uBlock and block individual domains https://github.com/gorhill/uMatrix

Proud uMatrix user here. Sadly, just noticed that the repo is now archived and I don't know if it will be maintained. Could not find any fork either. I'll miss this extension.

You have the features of uMatrix with uBlock Origin's static rules. You just have to write them by hand instead of the convenient table UI.

https://news.ycombinator.com/item?id=26284124

The only thing that uBO doesn't support is controlling cookie access, so I still use uM for that.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#192

Post by misterbwong » Mon, Feb 21, 2022, 5:31 AM UTC

gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

Called it [1]. It's a cat-and-mouse game and, unfortunately, advertising is just _that_ lucrative. Privacy-minded browsing will help those that care (for now...), but that's an unsustainable option with the current monetization channels available.

If a content publisher cannot monetize you, they will think nothing of blocking you. There will be some public backlash against companies that do so and there will be some sites who will lose money because of it, but the rest of the publishers will simply follow the money while the industry shifts towards more intrusive tactics.

There needs to be a monetization channel that is 1) good for both users AND publishers and 2) pays just as much as current methods. Unfortunately none of the current systems support that.

[1] https://news.ycombinator.com/item?id=9975955

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#193

Post by Semaphor » Mon, Feb 21, 2022, 5:32 AM UTC

heavyset_go wrote: post #77

hilbert42 wrote: post #47

Earlier quoted context omitted.

"I don't have the time or energy to block JavaScript and/or manually inspect each domain's requests to figure out if they use server-side tracking or not." By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. On occasions when I need JS (only about 3-5% of sites)…

> By default, I don't run JavaScript. I don't see blocking JS as a problem - in fact, it's a blessing as the web is blinding fast without it - and also most of the ads just simply disappear if JS is not running. Years ago I was on the "people who block JavaScript are crazy" bandwagon, until just loading a single news article online meant waiting for a dozen ads and autoplaying videos to load. I spent more time waitin…

> until just loading a single news article online meant waiting for a dozen ads and autoplaying videos to load.

That sounds like you not only didn’t block JS, you also didn’t block ads. Which is a very different argument. I only block 3rd-party JS by default (and that already requires a lot of whitelisting for almost every site that has any interaction) and I don’t have those issues because I also block ads.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#194

Post by culi » Mon, Feb 21, 2022, 5:34 AM UTC

ignoramous wrote: post #160

gigel82 wrote: post #25

God damn... this is it, this is the end-game. There's no way to fight this unless you customize and maintain blocking scripts for each individual website. Yes, websites could always have done this, but the REST (CDN-bypassing) requests' cost and the manual maintenance for the telemetry endpoints and storage was an impediment that Google just gives them a drop-in solution for :( I think Google is happy to eat some of…

I co-develop an open source firewall for Android, which most of our users use for ad-blocking purposes. The community has known about server-side collection for quite sometime now. You could run Google Analytics on any of the serverless environments since a year or two ago (I noted this on news.yc a year back [0][1]). Tag Manager server-side is Google throwing its own solution in to the mix. DNS based content blockin…

I really don't know much about this space, but do you think server-side tagging could be more or less susceptible to user resistance attacks like what Adnausium[0] does? Can we spam them into futility?

[0] https://adnauseam.io/

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#195

Post by onion2k » Mon, Feb 21, 2022, 5:35 AM UTC

thenanyu wrote: post #10

As someone who has spent a lot of time on both sides of this, I think this is a great outcome, personally. The most annoying part of ad-tech for me, as a user, was the fact that I was running all sorts of random javascript, any bit of which could blow up performance on my browser. As someone who used to lead an e-commerce operation, I hated running all of this crap in my users' browsers because I knew it would get bl…

All that random crap will still run in your browser though.

The important thing here is that Google are asking users to proxy scripts from a Google server via a subdomain of their site. That's relatively trivial to do as far as the code and config goes, and not costly for the user or for Google. The advantage to the site and Google is that those scripts now look like first party files; Google are using a first part subdomain to subvert the Same Origin Policy via a proxy.

Every other tracking and ad service will set up the same thing. The reason it hasn't happened in the past is because it was hard to configure. Google are giving every other service the gift of explaining how to do it to users. Going to a website that had 50 tracking bugs from 50 domains will now have 50 tracking bugs from 50 Same Origin Policy allowed subdomains, all unique to that site, and all different so blockers will have a much harder time working out what to block.

The code that runs in the browser doesn't change. The only difference is where it appears to originate from.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#196

Post by garren » Mon, Feb 21, 2022, 5:35 AM UTC

bink wrote: post #26

jtbayly wrote: post #7

Earlier quoted context omitted.

The article claims ublock origin won’t work on sites that implement this.

The current version doesn't but there's not really a reason to believe it can't be updated. I think the author overstates the complexity of documenting these proxies and URLs for sites that run them.

Google’s recommending that people set a A record in their own domain for the server, and change the name of the script. Given this, documenting such proxies and URLs and maintaining that documentation doesn’t seem practical.

On the other hand, I wonder if you could just block all IP addresses associated with google, or those associated with their cloud/app engine? I suppose that could be handled at the firewall maybe? Are there ASNs google uses specifically for their app engine and cloud computing resources? Others have mentioned that a lot of government agencies rely on google app engine, but it’d be nice to kill all traffic to/from anything google.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#197

Post by bgdam » Mon, Feb 21, 2022, 5:36 AM UTC

philliphaydon wrote: post #190

So if the script comes from the owners site instead of Google. And all the rest requests are proxied via the owners site. Would this not result in people forking a browser that looks at http requests before they are packaged and issued to remove tracking data or block the request?

And how do you differentiate between a request that is sending over tracking data and a request that is sending over data required to fetch the page you requested?

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#198

Post by culi » Mon, Feb 21, 2022, 5:36 AM UTC

gernb wrote: post #81

Teever wrote: post #30

Earlier quoted context omitted.

Isn't it so strange that if you or I were to do these kinds of things to an individual it would be considered creepy cyber stalking but when companies do it they are rewarded?

Do what? Record who came in and out of your house?

More like the street in front of your house including people in their cars

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#199

Post by Semaphor » Mon, Feb 21, 2022, 5:42 AM UTC

Arnavion wrote: post #191

gaius_baltar wrote: post #163

Earlier quoted context omitted.

Proud uMatrix user here. Sadly, just noticed that the repo is now archived and I don't know if it will be maintained. Could not find any fork either. I'll miss this extension.

You have the features of uMatrix with uBlock Origin's static rules. You just have to write them by hand instead of the convenient table UI. https://news.ycombinator.com/item?id=26284124 The only thing that uBO doesn't support is controlling cookie access, so I still use uM for that.

> You just have to write them by hand instead of the convenient table UI.

That’s a pretty big "just", though. Very few sites work without fiddling with rules, having to do manual text entry every time would push me towards not using it.

The UI of uMatrix is generally far superior to the mobile-friendly, simplified one of uBo.

Re: Google Tag Manager, the new anti-adblock weapon (2020)

#200

Post by dsr_ » Mon, Feb 21, 2022, 5:45 AM UTC

eru wrote: post #173

dsr_ wrote: post #116

Earlier quoted context omitted.

There's no way to fight this unless ... you pass legislation against it or comparable technologies, preferably at a policy level.

You can fight against it by refusing to use these websites? If you can't do this, perhaps because a big _majority_ of users don't care enough to support this kind of ecosystem shift, what makes you think a majority of voters would support this? (And if not, why would you want to force your view on them?) It's like legislating that people should only listen to Good Music and eat Healthy Food, as defined by some people…

I rather think it's more like legislating that you can't sell people food adulterated with poisons, and you have to label the ingredients accurately. Oh, and it's like saying that you can't sell lead paint, even though it is a very pretty white.