Live data from Hacker News

uBlock Origin CNAME uncloaking now supports filtering by IP address

github.com

11–20 of 133 posts

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#11
post #9

Is chrome going to block uBO im never up to date on the latest. I do know theyre allowing 3rd party cookies now... so maybe theres a chance

Honestly, it probably is going to depend on whether the US continues to have an administration that's willing to take blatant monopolists to court.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#12

uBlock Origin is what makes Firefox even greater and definitely one big reason I use Firefox over Chrome etc. It make the Internet browsable.

I moved many years ago to this combo, and never saw a single reason to switch away. Same for android phone, the only usable mobile web experience I've seen. Those few sites over a decade that had some display issues had issues also under chrome.

Plus I personally consider ads a cancer of modern society. White and not so white lies, manipulation... nothing respectable regardless (or because ) of tremendous money circulating in it.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#13

As an example of what CNAME cloaking is, let's say that a SAAS provider A wants to provide you, company Q, with fancy ad tracking software. In the olden days, they'd tell you to embed a script at e.g. https://A-ads-tracking.example into your website at address https://q-company.example To block those ads, blocklists that uBlock Origin use have rules then that say "block requests being made to the domain name A-ads-tr…

Thank you for the breakdown!

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#14
post #3

Earlier quoted context omitted.

Yes. Ads and analytics providers have started doing this to get around third-party cookie protections.

I always find this development curious. About a decade ago I worked in this space. When someone brought up ad blockers I just said "put the analytics on our main domain. No one is going to block the entire website". The answer I got was "no one would ever do that because of the implications of serving advertising from your main domain". Yet, here we are.

They use a third party domain just because that way they can track the user actions with cookies, for example Google can track your navigation across multiple websites, and thus propose to you more relevant ads. Also using a different domain was simpler and cheaper, since you don't have to host the AD content and metadata, just include the JS from the AD provider somewhere in your HTML.

Now that thanks to EU laws and browser imposing restrictions about third-party cookies it's more difficult, the whole "serve ads from other domain" may not be that relevant anyway.

If you use a random wildcard subdomain... just serve them from the main website, what is the difference? On the other side with a proxy just route the AD requests to another server if it needs to be, of course you have to find a way to distinguish which requests are for AD and which are not, something you can do with some sort of signature in the filename, so that only the server can know which requests shall be handled locally and which one forwarded to the AD provider server.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#15

CNAME cloaking? Does this mean an ad site may use a randomly generated subdomain pointing to a wildcard record?

That's part of it.

Normally when you visit contentsite.com which serves ads from adsite.com. Adblocker rules can just block adsite.com and the ads won't be shown. CNAME cloaking would have the main site have a subdomain like adsite.contentsite.com point to adsite.com, now the adblockers have the impossible task of blocking millions of subdomains that seemingly belong to legit sites, this also allows the legit sites to keep changing the subdomain since the adblocker will have no idea which subdomains serve legit content vs ads. As a bonus since the content is being served from the same domain, they can bypass certain cookie browser policies and track users even better.

This update allows you to set rules so that you can filter by resolved ip.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#16
post #3

CNAME cloaking? Does this mean an ad site may use a randomly generated subdomain pointing to a wildcard record?

Yes. Ads and analytics providers have started doing this to get around third-party cookie protections.

There is a part of me that, at a high level, appreciates the back and forth between the user and the ad industry. On a personal level, I am slowly getting to the point, where I am less.. uhh.. understanding.

That said, the average person's conception of what acceptable needs to change. I did briefly think that they need suffer through more ad-infestation first, but I realized that the answer is more in line with what my wife seemed to have gone through. The low exposure to ads made her less willing to deal with them. This might be the way forward.

It is hard for a person used to existing ecosystem to even imagine, there could be something better.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#17
post #3

Earlier quoted context omitted.

Yes. Ads and analytics providers have started doing this to get around third-party cookie protections.

I always find this development curious. About a decade ago I worked in this space. When someone brought up ad blockers I just said "put the analytics on our main domain. No one is going to block the entire website". The answer I got was "no one would ever do that because of the implications of serving advertising from your main domain". Yet, here we are.

News payers used to all serve their own ads including in house sales and design. Frankly with how key advertising is I don't understand why anyone would out source it.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#18
post #9

Is chrome going to block uBO im never up to date on the latest. I do know theyre allowing 3rd party cookies now... so maybe theres a chance

They’re doing a slow phase-out over a long time to try to avert a wave of bad publicity that threatens their browser monopoly, but that timeline has already started as of June.

https://developer.chrome.com/docs/extensions/develop/migrate...

https://www.bleepingcomputer.com/news/google/google-chrome-w...

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#19
post #15

CNAME cloaking? Does this mean an ad site may use a randomly generated subdomain pointing to a wildcard record?

That's part of it. Normally when you visit contentsite.com which serves ads from adsite.com. Adblocker rules can just block adsite.com and the ads won't be shown. CNAME cloaking would have the main site have a subdomain like adsite.contentsite.com point to adsite.com, now the adblockers have the impossible task of blocking millions of subdomains that seemingly belong to legit sites, this also allows the legit sites t…

this reminds me of domainfronting, who was a super smart way to get around of ads and other sites blockers, not sure if it's all 'fixed' now.

Re: uBlock Origin CNAME uncloaking now supports filtering by IP address

#20
post #6
post #3

Earlier quoted context omitted.

Yes. Ads and analytics providers have started doing this to get around third-party cookie protections.

This is such an intrusion of privacy. I wish I could just disable cookies entirely but the usability of many webpages just goes down. I should not be punished for not wanting 3rd party trackers.

Before I get too alarmed someone would have to tell me how an adsite.com cookie is being sent to adsite.example.com. This workaround seems to let adsite.com profile me as well as example.com already can, but it loses the ability to correlate my activity across example2.com and example.com with a single cookie.

(I guess ad providers have gotten good enough to not need cookies? Like they know my browser window size, installed fonts, GPU vendor and model, IP address, geolocation, header order, etc. so they don't even need cookies anymore to track my activity across the web? I suppose it was only a matter of time.)

Post reply on HN