Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EasyList is in trouble and so are many ad blockers

adguard.com

Post reply on HN
Print view View original

131–140 of 439 posts

Re: EasyList is in trouble and so are many ad blockers

#131

Post by neilv »

Assuming it's not a kind of DoS attack, and since it sounds like they can detect the abusing clients (maybe by User-Agent)... some very desperate technical options involve serving an alternate small blocklist that does one of:

1. Try having it block subsequent requests for EasyList itself, just in case the frequent update requests are made with the prior blocklist in effect. (I accidentally did this before, in one of my own experimental blocklists, atop uBlock Origin.) Then the device vendor can fix their end.

2. If the blocklist language and client support it (I suspect they don't), you might safely replace or alter some Web pages, to add a message saying to disable EasyList in the client, or pressure the vendor, or similar. If this affects a lot of users, the meaning will also be spread in other languages to other users, even if not all of them understand any of the languages in the message. But be careful.

3. If you can't get a better message to the user, another option might be to block all requests, to prompt users to disable EasyList or vendor to fix the problem. But before doing this, you'll need to have verified that a combination of shoddy client/device software won't prevent users from using important functions of their devices for significant time. (Imagine this might be their only means of being connected online, and some shoddy client software pretty much prevents it from working, and the user is unable to access critical services.)

But before doing any of these desperate technical measures... First, I'd really try to reach people in the country who'll know what's going on, and who can reach and possibly pressure the vendor who's causing the problem. If tech industry people aren't able to help quick enough, reaching out to that government, directly or through your own country's diplomats/officials, might work. Communicating the risks of the desperate technical measures that you're trying to avoid (e.g., possibly breaking critical communications) could help people understand the urgency and importance of the situation.

Re: EasyList is in trouble and so are many ad blockers

#132

Post by PaywallBuster »

Jabbles wrote: post #128
PaywallBuster wrote: post #116

Cloudflare claims that R2 have free egress/bandwidth You could try that instead of the "CDN" service -- Alternatively, try the "cheap" CDN services like Bunny or Beluga, which have packages for high volume like 0.005c/gb Cloudflare is not really selling a CDN, but all the "smart" services on top of it. That's why you don't have as much control (like blocking IP/Geos without Enterprise), or run into issues for breakin…

> like 0.005c/gb You're off by a factor of 100. https://www.belugacdn.com/cdn-pricing/ $5000/PB = $5/TB = 500c/TB = 0.5c/GB

beluga

> You pay 1¢ (or less!) for every Gigabyte of data accelerated over our cloud network.

doesn't seem clear cut as they bundle it in a subscription packages, but at this volume you'd surely need their enterprise package (10Tb+), which you'd expect to get 0.01 or less

bunny

> First 500TB $0.005 /GB

> From 1PB-2PB $0.002 /GB

Re: EasyList is in trouble and so are many ad blockers

#133

Post by [deleted] »

d12bb wrote: post #113
stereo wrote: post #67

Earlier quoted context omitted.

They already have that part figured out. From the article: > When we encountered a similar problem last year, we found a simple solution: block the undesired traffic from these apps. Even so, we continue to serve about 100TB of “Access Denied” pages monthly!

The difference is that serving Access Denied Leads to the users of these malicious browsers just getting more ads over time, as the filter lists can’t be updated anymore. Serving a special list containing popular sites would result in the users almost instantly not being able anymore to access these popular sites, resulting in requests to the developers to fix their shitty browser or switching altogether.

[deleted]

Re: EasyList is in trouble and so are many ad blockers

#135

Post by codalan »

Joel_Mckay wrote: post #83

Rate-limit the GeoIP list for the affected areas to drop if more than 20% of active traffic. i.e. the service outages get co-located only with the problem users areas. Also, when doing auto-updates: always add a chaotic delay offset 1 to 180 minutes to distribute the traffic loads. Even in an office with 16 hosts or more this is recommended practice to prevent cheap routers hitting limits. Another interesting trend,…

That would only work if they had an API; AFAICT, they're just hosting a file.

At this point, they might be better off coordinating with the other major adblocker providers and just outright move the file elsewhere. Breaking other people's garbage code is better than breaking yourself trying to fix it. Especially on a budget of $0.00.

If the defective code for the browsers are in public repos, it might also be more effective for someone to just fork the code, fix the issue (i.e. only download this file once a month, instead of every startup), and at least give the maintainers a chance to merge the fix back in.

Re: EasyList is in trouble and so are many ad blockers

#136

Post by lcnPylGDnU4H9OF »

tomschwiha wrote: post #61
tyingq wrote: post #33

Earlier quoted context omitted.

It's from this tos page: https://www.cloudflare.com/terms/ 2.8 Limitation on Serving Non-HTML Content ...Use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately... A huge text/plain artifact, requested often, would seem to fall into that category of "disproportionate percentage" compared to text/html served.

Cloudflare can decide whom they want to do business with. But a plain text file is in my opinion sort of HTML. At least it is not "non-html" content. A .pdf file would be non-HTML content. What else is important to note that the client is being abused and not the client abusing the service. That should be taken into consideration, when deciding if someone is breaking the ToS.

I'd agree that's weird. Seems like if it were simply renamed to .html with no content changes, then it would be okay.

> What else is important to note that the client is being abused and not the client abusing the service. That should be taken into consideration, when deciding if someone is breaking the ToS.

My understanding has this as moot. The issue from Cloudflare's perspective is only that the content is non-HTML and doesn't have anything to do with the rate of traffic (the abuse).

Re: EasyList is in trouble and so are many ad blockers

#137

Post by pseudosavant »

cogman10 wrote: post #102
pseudosavant wrote: post #56

It would seem like you could prevent hotlinking by adding 1-5 minutes of latency to every request to a list. Almost no dev would hotlink an asset that took that much longer to display, at least in critical/common paths. It would force consumers (devs/businesses) of the lists to provide a caching/mirroring solution of some kind for their users. But on the bankend, the request would be designed just for updating the li…

The issue with this approach is it's too late. It might work if you designed it from the start, but adding it now would only destroy your poor balancer with all the connections they have to maintain (waiting for the 5 minutes to expire). It was mentioned in this article that they are now serving up accessed denied, but the problem is one of just too many requests. At this point, it's likely easier to just kill the do…

This is certainly not a cure to the problem Easylist has right now. This is prevention. About how to design publicly consumable resources to naturally discourage hotlinking, before it is a problem.

Re: EasyList is in trouble and so are many ad blockers

#138

Post by codalan »

ziml77 wrote: post #85
laundermaf wrote: post #55

Earlier quoted context omitted.

This issue caused CF to irreversibly ban them though, so it's not "just a bandwidth issue" anymore. > Based on the URL that are being requested at Cloudflare, it violates our ToS as well. All the requests are txt file extension which isn't a web content > you cannot use Cloudflare to cache or proxy the request to these text files

Where did you get that they were irreversibly banned? Or banned at all for that matter?

They didn't get banned. They got an email from CF support saying that they cannot cache TXT files and that they'd need to disable the proxy.

This does not mean banned.

Re: EasyList is in trouble and so are many ad blockers

#140

Post by bluehatbrit »

Nextgrid wrote: post #125
bluehatbrit wrote: post #101

Earlier quoted context omitted.

Most requests will be in the background or in Cron jobs. Captcha wouldn't be possible in those situations as it would never be seen by anyone.

I’m not sure a captcha would help though. These aren’t intentional attack requests, they’re “legitimate” requests by a clueless developer’s app that happened to get popular. They just need to serve either an empty response or an intentionally broken rule to break the misbehaving browser and force its developers to fix it.

Yes there is of course that as well!
Post reply on HN