Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cname cloaking, a disguise of third-party trackers

medium.com

Post reply on HN
Print view View original

161–170 of 202 posts

Re: Cname cloaking, a disguise of third-party trackers

#161

Post by rndgermandude »

jefftk wrote: post #102
dessant wrote: post #98

Earlier quoted context omitted.

You're contributing to tech that erodes people's privacy, even when they actively fight against it. Don't delude yourself with net positives. The harm your employer causes still affects people, regadless of the useful things you may work on at Google, or the donations you give.

> when they actively fight against it While this is definitely true for some adtech vendors, none of the work I do is in that category, and to my knowledge none of the work at my employer is either. (Still speaking only for myself)

I glanced over the article you linked on your homepage, and you said you worked for google.

Google is and was actively fighting privacy laws[1] (e.g. seeking exemptions allowing them to even track people who consciously opt out of data collection), had a CEO that made no secret about his anti-privacy stance[2], was repeatedly fined[3], also also for violating the privacy of children[4], etc. etc.

How do you reconcile this with your assertion that google and yourself are good players?

[1] https://www.latimes.com/business/story/2019-09-04/google-and...

[2] https://www.eff.org/de/deeplinks/2009/12/google-ceo-eric-sch...

[3] https://www.nytimes.com/2019/01/21/technology/google-europe-...

[4] https://www.nytimes.com/2019/09/04/technology/google-youtube...

Re: Cname cloaking, a disguise of third-party trackers

#162

Post by alkonaut »

chii wrote: post #110
alkonaut wrote: post #90

Earlier quoted context omitted.

The answer I keep returning to: if shady ads is what keeps your business running, stop running your business. Switch off the lights and the servers and go home.

easy for you to say when you're not financially involved in said company.

Exactly yes. I don’t care if 80% of content online would disappear, or the thousands of jobs making that content, or the billions invested in it. It seems irrelevant in comparison.

Re: Cname cloaking, a disguise of third-party trackers

#163

Post by belorn »

Online advertisement are constantly using the same exploits that malware and can be seen as part of the progression ladder when walking from being zero-day to universally patched.

A while back ago malware started to use a scheme similar to fast flux, but rather than changing the IP address they used a chain of cnames to hide the malware network. In order to combat this researchers developed detection tools to find algorithmic generated domain names and flag them as suspicious at the resolver layer. I would expect to see the same mitigation method to travel into ad-blocking.

Re: Cname cloaking, a disguise of third-party trackers

#164

Post by alkonaut »

acdha wrote: post #116
alkonaut wrote: post #90

Earlier quoted context omitted.

The answer I keep returning to: if shady ads is what keeps your business running, stop running your business. Switch off the lights and the servers and go home.

That’s too simplistic a take: they aren’t running shady ads and unlike many sites they allow you to you subscribe and not see ads at all. Unfortunately, large chunks of the public — especially tech site visitors — have been conditioned to think of content as free, and the adtech bubble hasn’t pooped yet so we can’t reverse that trend.

What people are willing to pay for content is I think almost zero.

If we get rid of these privacy invading ads and micropayments/subscriptions don’t take off in a big way (I don’t think they will) then one or two things must happen

1) advertising money remains even though ads are dumber (less narrowly targeted, more fraud etc)

2) there is a lot less money to go around so there must simply be less content.

I think the answer is somewhere in between. I don’t think it’s a pessimistic view that maybe 75% of sites not only risks disappearing but perhaps should. The abundance of “free” content is what makes people unwilling to pay for quality.

Re: Cname cloaking, a disguise of third-party trackers

#165

Post by gorhill »

muppetman wrote: post #11
iforgotpassword wrote: post #8

Earlier quoted context omitted.

At home I'm using it in addition to ad blocking in the browser, for apps and other things that might slip through. Currently it's just dnsmasq with a huge blacklist, and I guess it doesn't support checking the whole CNAME chain against that list, which would be really cool.

It doesn't need to have every cname in it. The cname resolves to the actual "bad" domain, which should be in your list already. That's why DNS blocking can still combat this method easily, while it's much harder at the browser level. uBlock Origin for Firefox beta has a "run all non-local domains back through and check for cname redirection" feature, which can also block the cname trick, but it will increase DNS late…

> [uBO] will increase DNS latency because it has to check each external domain again for the "true" domain.

The browser API used by uBO returns the last CNAME in the chain. I consider the DNS lookup itself to be an non-issue overhead-wise in uBO because:

- The browser would need to do it anyways

- DNS lookup results are cached at both the browser and uBO level

Re: Cname cloaking, a disguise of third-party trackers

#167

Post by pas »

earthboundkid wrote: post #129
jefftk wrote: post #42

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking o…

Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.

The GDPR does that. It doesn't matter if you have the data in your own DB, you can't utilize it for purposes you haven't secured informed consent for.

Re: Cname cloaking, a disguise of third-party trackers

#168

Post by aberforth123 »

jefftk wrote: post #78
QUFB wrote: post #76

Earlier quoted context omitted.

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads

Nice write-up. What is your opinion on the following: Ads make people buy stuff they don't need.

So if we would stop with ads everywhere, we can save the planet.

Re: Cname cloaking, a disguise of third-party trackers

#169

Post by Macha »

mmastrac wrote: post #120
hk__2 wrote: post #85

Earlier quoted context omitted.

Wow it goes even further: https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO... > Instart Logic will detect when the developer console opens, and cleanup everything then to hide what it does. I had to trick IL's script into thinking the dev console was not open to take the pic above.

How does it do this?

Page resize events in one dimension by the size range commonly used by devtools, measure reduction in JS perf are two ways that come to mind

Re: Cname cloaking, a disguise of third-party trackers

#170

Post by air7 »

Something is missing here: HTTPS links and SSL. Either website.com hands over its certificate to dnsdelegation.io (which is unlikely and definitely not a 2 min trust-less process) or dnsdelegation.io has the ability to generate any certificate like a certificate authority which is really terrible (and also unlikely).
Post reply on HN