Live data from Hacker News

Google engineers want to make ad-blocking (near) impossible

stackdiary.com

341–350 of 486 posts

Re: Google engineers want to make ad-blocking (near) impossible

#341
Firstly, Google's notion of a trust-privacy trade-off seems to be an oversimplified solution to a complex problem, which in effect could mean a bargain with the devil. Yes, the digital world needs more trust, but to gain that at the expense of privacy, strikes me as a hasty solution which smacks of Orwellian overtones. Would you trust a lock that promises to protect your home but allows the locksmith uncontrolled access?

The possibility that this is a thinly veiled attempt at introducing Digital Rights Management into web pages is a concern that should not be dismissed lightly. This may well be a sly effort to muzzle ad-blocking capabilities, thus reducing the web to a cacophonous bazaar of incessant advertisements, a capitalist wet dream at the expense of user experience. I echo the critics who view this as a potential threat to the open web. Furthermore, the question of who controls the "attesters" is a serious concern that evokes dystopian scenarios of a digital oligarchy. In a world increasingly reliant on digital verification, the potential to manipulate trust scores essentially hands over the reins of the digital world to a select few. This, far from enhancing trust, could potentially further erode it.

The ambiguity surrounding browser modifications and extensions further fuels suspicions. In its guise of ensuring legitimacy, the proposal seems to conveniently overlook the diversity and customization that has been a hallmark of the digital world, creating an environment of dubious one-size-fits-all integrity.

Moreover, the vague explanation of the enforcement and establishment of baseline requirements does little to allay fears of vendor exclusion. What are these requirements and who indeed gets to decide them?

Re: Google engineers want to make ad-blocking (near) impossible

#342
post #150
post #50

The latest, tone-deaf response from a Google engineer: https://github.com/RupertBenWiser/Web-Environment-Integrity/...

This seems like a very reasonable reply to me; what's tone deaf or otherwise objectionable about it?

It's not a terrible reply, but it does miss the point.

It focuses heavily on privacy concerns and how those will be resolved - the vast majority of criticism I've seen hasn't been related to this at all, and those aren't especially hard problems to solve in the context of the existing spec.

It still largely ignores browser diversity & experience this will create for non-Chrome users. His argument is that blocking fingerprinting in future will mean anti-fraud will make the web unusable, and WEI will make it usable again. Given you accept the premise, still the conclusion is only true for browsers that can access WEI - which means the web will become unusable for browsers who can't (Linux, rooted Android, Firefox, etc etc).

For the ecosystem as a whole, it's better if everybody has a fair playing field. By definition, WEI structurally privileges certain clients. The more widespread that becomes the worse the effect on the wider ecosystem is. If WEI does not exist, and fingerprinting does not exist, providers will be forced to find ways to limit the impact of anti-fraud mechanisms. If 90%+ of browsers use attestation, that pressure decreases dramatically. Using Tor on the web today is a good example of the likely experience.

The mention of holdbacks here touches on this (though for full blocks, rather than wider impact) but ignores the existing strong pushback against holdbacks from others closely involved in the spec & discussion around this (https://github.com/RupertBenWiser/Web-Environment-Integrity/...) and ignores that the attestation they already shipped on Android for exactly the same use case does _not_ do this.

Fundamentally, the issue isn't about privacy during these checks, or whether defeating fraud without fingerprinting is valuable. Those are reasonable but obvious points. The issue is that client-focused validation for fraud is a flawed goal in itself (it's impossible - even with full & perfect attestation, you can set up a fully automated + WEI-approved machine by automating input peripherals directly) that risks enormous collateral damage, and we shouldn't encourage it in any sense. We definitely shouldn't standardize practices to make it easier.

At the end of the day, if you want to block fraud you have to do so server side (statistical analysis, rate limits, validated user accounts, requiring payments, some kind of proof of work, etc). This is a hard problem, absolutely, but it's unavoidable.

Re: Google engineers want to make ad-blocking (near) impossible

#343

Do you know what puzzles me most? How can software engineers work on something like this? Don't those paid engineers or involved ones have the balls or dignity to walk away? I'm just wondering how they would feel about this (if they feel anything at all). I mean, if I'd be in such a position and asked to push something like this I'd have walked away on the spot, no matter what you offer me. No one at Google is standi…

I'd go even further. If I was asked to run one of these projects I would subvert & sabotage the entire thing while pretending to be 150% on board. Why not get paid by the devil while fighting his plans? You don't even have to make it obvious that you are cratering it. There are so many shiny things in tech you could make it look entirely incidental. Part of me reserves hope that this is what some of the engineers ins…

Let's hope that indeed is the case... But as a first reaction I'd expect some friction or resistance to this from within Google. What would be their rationale for exposing their plans on Github and not going silently as (I've recently learned) Apple did?

Re: Google engineers want to make ad-blocking (near) impossible

#344
I wish people wouldn't say stupid things.

For example, elsewhere on this page someone is saying that Google is trying to do [x], where x is something that would kill one of the main apps on Samsung's phones. Of course Samsung would submit an antitrust complaint and win. Assuming Samsung wouldn't is stupid. I really wish people would put forward their arguments without such stupidity.

It reminds me of the Microsoft criticism of 10-20 years agom, when there was so much stupid criticism of Micosoft that it devalued the substantive, intelligent criticism. Lots of people assumed that the substantive criticism was just more ranting, and ignored it.

Re: Google engineers want to make ad-blocking (near) impossible

#345
post #307
post #205

Earlier quoted context omitted.

Brave is on the Play store (it's what I use on Mobile), as are several other browsing options with built in ad-blocking support. Chrome Mobile is very stripped down, but the idea that they disabled all extensions just to get at ad-blockers is completely unfounded.

"Brave is on the play store" is a very similar argument to "You do not have to use IE, you can install Netscape". And subject to the same logical holes.

Why? If it were a browser extension, you would still have to install that manually too. Are you mad that Google doesn't ship ad-blocking functionality by default in their standard build?

Re: Google engineers want to make ad-blocking (near) impossible

#346

Google can't be trusted with ads. I've seen 3 ads today pretending to be Macy's and Bed Bath & Beyond, that were actually from Hong Kong, as well as the fake Mr Beast ads are back on YouTube. I won't even get into the borderline porn Queen's Blade ads.

YouTube shows ads for investment advice scams.

I just don't know how this is possibly conceived as ok, or how they can possibly justify trying to block ad-blockers - I consider ad-blockers as a more important security barrier than a virus scanner - that's been the case for me going on a decade.

Re: Google engineers want to make ad-blocking (near) impossible

#347
post #16

It may not have the desired effect they seek. I already feel my reluctance growing towards opening my browser when it is not absolutely necessary. Are they sure that even more user hostility is what the modern internet misses?....

Let’s go full circle and go back to a new gopher based on content APIs.

You should have proposed the pigeon post as the only next alternative! : )

Re: Google engineers want to make ad-blocking (near) impossible

#348

I hate to say it, but if you used Chrome to read this, then you're part of the problem. Awful stuff like this wouldn't stand a chance if Google didn't have such a near-monopoly position. For the sake of the open internet, please switch to a different browser. IMO, Firefox is best*, but even something chromium based is probably fine. Just not Google Chrome. * On desktop - Firefox is a bit weaker on Android, with an ex…

Kiwi browser for android supports chrome extensions. The chrome web store is horrible to navigate on mobile though.

Re: Google engineers want to make ad-blocking (near) impossible

#349

> Websites funded by ads require proof that their users are human and not bots...Social websites need to differentiate between real user engagement and fake engagement...Users playing online games want assurance that other players are adhering to the game's rules. The whole ad based web industry is really desperate to authenticate humans from bots isn’t?

Nah, they want us to think they do. But bot clicks are clicks and can be charged. I read somewhere that 80-90% of facebook ad clicks were bots. That seems inline with the traffic I see on some commercial website I work on. Most traffic is from bots, crawlers, scanners and 'security researchers'.

Sometimes I pick up on actual fraud, like 'affiliate marketing' traffic 'boosters' that just result in someone clicking through a banner, making and order and not paying. 200 times in a day. Nobody cares, as long as the stats look good

Re: Google engineers want to make ad-blocking (near) impossible

#350

Do you know what puzzles me most? How can software engineers work on something like this? Don't those paid engineers or involved ones have the balls or dignity to walk away? I'm just wondering how they would feel about this (if they feel anything at all). I mean, if I'd be in such a position and asked to push something like this I'd have walked away on the spot, no matter what you offer me. No one at Google is standi…

Just look around in this thread you can find people defending Google. It is not hard to think an engineer would actually want to work on this themselves.
Post reply on HN