Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Incapacitating Google Tag Manager (2022)

backlit.neocities.org

Post reply on HN
Print view View original

101–110 of 160 posts

Re: Incapacitating Google Tag Manager (2022)

#101

Post by pmontra »

DavideNL wrote: post #86
1vuio0pswjnm7 wrote: post #45

Earlier quoted context omitted.

uMatrix is fully-functional on Nightly. Using Firefox Add-Ons on a "smartphone" sucks because one has to access every Add-On interface via an Extensions menu. In that sense _all_ Add-Ons are only semi-functional. I use multiple layers: uMatrix + NetGuard + Nebulo "DNS Rules", at the least. Thus I have at least three opportunities where I can block lookups for and requests to Google domains.

Doesn’t uBlock Origin in advanced mode do the exact same thing as uMatrix?

Maybe, but the UX is so terrible that I never figured out how to use uBO to replace uMatrix. I always use both: uBO for ads and DOM elements filtering and uMatrix for JavaScript, frames, cookies, anything in the columns of its UI.

Basically uMatrix is so donor to use that anybody can use it. The equivalent uBO section is so complicated that I feel I need to take a master degree in that subject.

Re: Incapacitating Google Tag Manager (2022)

#102

Post by tempodox »

> Meanwhile, Google Tag Manager is regularly popping up on Government sites. This means not only that governments can study you in more depth - but also that Google gets to follow you into much more private spaces.

The corruption of the system knows no bounds.

Re: Incapacitating Google Tag Manager (2022)

#103

Post by whatevertrevor »

future10se wrote: post #21
rurban wrote: post #3

Just add the domain to your /etc/hosts as 0.0.0.0 Doing that for years

As mentioned on the blog post: > Used as supplied, Google Tag Manager can be blocked by third-party content-blocker extensions. uBlock Origin blocks GTM by default, and some browsers with native content-blocking based on uBO - such as Brave - will block it too. > Some preds, however, full-on will not take no for an answer, and they use a workaround to circumvent these blocking mechanisms. What they do is transfer Goo…

Slightly related I've also been recently noticing some sites loading ads pseudo-dynamically from "content-loader" subdomains usually used to serve images. It's obnoxious because blocking that subdomain at the DNS level usually breaks the site.

My current strategy is to fully block the domain if that's the sort of tactic they're willing to use.

Re: Incapacitating Google Tag Manager (2022)

#104

Post by bravesoul2 »

simonw wrote: post #99
mlinsey wrote: post #44

Earlier quoted context omitted.

Google Tag Manager is a single place for you to drop in and manage all the tracking snippets you might want to add to your site. When I've worked on B2C sites that run a lot of paid advertising campaigns, the marketing team would frequently ask me to add this tracking pixel or another, usually when we were testing a new ad channel. Want to start running ads on Snapchat? Gotta ad the Snapchat tracker to your site to k…

The self-service thing is such a nightmare. There are two things that you almost certainly cannot trust your marketing team with: 1. Understanding the security implications of code they add via tag manager. How good are they at auditing the third parties that they introduce to make sure they have rock-solid security? Even worse, do they understand that they need to be very careful not to add JavaScript code that some…

Yep it's vibe coding before vibe coding existed. Paste in the script. No code review. No staging. No roll-out. Just straight in prod. And it can break stuff.

Re: Incapacitating Google Tag Manager (2022)

#105

Post by bravesoul2 »

simonsarris wrote: post #77
aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

The chief reason is that websites pay for advertising and want to know if the advertising is working and Google tag manager is the way to do that, for Google Ads. This is not unreasonable! People spend a lot of money on ads and would like to find out if and when they work. But people act like its an unspeakable nebulous crime but this is probably the most common case by miles.

Why should an advertiser have a right to know if their ads work, regardless of privacy considerations. EU brought out a freaking legal framework around this. I can't take seriously how you've over simplified it.

Re: Incapacitating Google Tag Manager (2022)

#106

Post by captn3m0 »

simonw wrote: post #99
mlinsey wrote: post #44

Earlier quoted context omitted.

Google Tag Manager is a single place for you to drop in and manage all the tracking snippets you might want to add to your site. When I've worked on B2C sites that run a lot of paid advertising campaigns, the marketing team would frequently ask me to add this tracking pixel or another, usually when we were testing a new ad channel. Want to start running ads on Snapchat? Gotta ad the Snapchat tracker to your site to k…

The self-service thing is such a nightmare. There are two things that you almost certainly cannot trust your marketing team with: 1. Understanding the security implications of code they add via tag manager. How good are they at auditing the third parties that they introduce to make sure they have rock-solid security? Even worse, do they understand that they need to be very careful not to add JavaScript code that some…

You effectively delegate code-review on a XSS path to your marketing team. I refused to do that anywhere users could be logged in.

Re: Incapacitating Google Tag Manager (2022)

#107

Post by bravesoul2 »

connicpu wrote: post #48
slow_typist wrote: post #36

Earlier quoted context omitted.

Well I can inject HTML tags (or elements) with native JavaScript. Or manage them. Why would I want a bloated third party piece of software doing that?

So that your sales and marketing team can add the third-party tracker for a new ad campaign service without bothering the engineering team.

They can also add features! Yes have fun!

Re: Incapacitating Google Tag Manager (2022)

#108

Post by sheiyei »

culi wrote: post #90
v5v3 wrote: post #82

I use: VPN so constantly changing ip. Tor browser for everyday browsing (has no script preinstalled). So onion provides double Vpn. Regularly closed down so history cleared. Safari in private mode and lockdown mode for when tor won't work (tor ip blocked/hd video that is too slow to stream on tor). Safari Isolation in private mode is excellent, you can use two tabs with, say emails, and neither will know other is log…

> Tor browser for everyday browsing Do you just... log back in to Hacker News every day? I downloaded the Mullvad browser (basically Tor without the onion protocol part) but having no way to save passwords ended up making it unusable for me

What platform do you use that doesn't allow for password managers? A browser's password manager is not the ideal for security, apparently (I would like to know how generally true this is, of course saving them on Google or Microsoft is as good as idea as it sounds)

Re: Incapacitating Google Tag Manager (2022)

#109

Post by JimDabell »

simonw wrote: post #99
mlinsey wrote: post #44

Earlier quoted context omitted.

Google Tag Manager is a single place for you to drop in and manage all the tracking snippets you might want to add to your site. When I've worked on B2C sites that run a lot of paid advertising campaigns, the marketing team would frequently ask me to add this tracking pixel or another, usually when we were testing a new ad channel. Want to start running ads on Snapchat? Gotta ad the Snapchat tracker to your site to k…

The self-service thing is such a nightmare. There are two things that you almost certainly cannot trust your marketing team with: 1. Understanding the security implications of code they add via tag manager. How good are they at auditing the third parties that they introduce to make sure they have rock-solid security? Even worse, do they understand that they need to be very careful not to add JavaScript code that some…

I agree with this and can add two more problems that are super common.

Firstly, people will add all sorts of things on a whim without telling anybody. So your privacy policy won’t capture any of this.

Secondly, nobody ever cleans up after themselves. So a year down the line, you’ll have a dozen different services, all doing the same thing, all added by different people, and half of them aren’t even being used by anybody because the people that added them forgot about them or left the company.

I don’t think I’ve ever seen GTM used responsibly.

Re: Incapacitating Google Tag Manager (2022)

#110

Post by JimDabell »

aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

It’s a little bit like dependency injection for websites, used by marketing teams.

The people responsible for maintaining a site don’t want to know about all the different analytics tools the marketing team wants to use, and don’t want to be involved whenever any changes need to be made. So they expose a mechanism where the marketing team can inject functionality onto the page. Then all the marketing tools tell the marketing team how to use GTM to inject their tool.

Post reply on HN