How about stop letting remote sites execute arbitrary Javascript on your pages?
Why is Stack Overflow trying to start audio?
181–190 of 416 posts
Re: Why is Stack Overflow trying to start audio?
#182Earlier quoted context omitted.
Arbitrary code execution isnt really that trivial.
Arbitrary javascript execution is generally meaningless. Very rarely you'll get a zero-day or something, or maybe a site will use too much battery when focused.
But if that page is Stack Overflow, with millions of views, you are collectively wasting tons of power. Granted, you don't pay those bills.
Re: Why is Stack Overflow trying to start audio?
#183Has there been any serious thought / discussion about how the cat and mouse chase of the ads vs ad blockers is going to end? It would be interesting to see where we are in ten years.
I think ad blocking is a misnomer. What people are trying to do when blocking ads is prevent marketing people from spying on them. And the performance and resource consumption that comes from that. Personal opinion: Laws are needed to make what advertisers are doing illegal. Advertisers are spying on people to the extent where if the government did it they'd need a warrant.
The sense of being spied on wasn't really what drove me to use an ad blocker. It was the fact that once or twice I got what appeared to be malicious code trying to take over my browser, go to pages I didn't want to go to, and prevent me from leaving, in order to promote some scam. I'm not in fact (even if it's naive) particularly scared of legitimate businesses or the CIA or whatever monitoring me.
Re: Why is Stack Overflow trying to start audio?
#184Earlier quoted context omitted.
Your options, as I see them. 1. Text based ads only (no third party js) 2. HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify ) 3. Look for a js sandbox -- this _will_ break arbitrary js, will not be supported in all browsers, and will require dev work on your side: * Google Caja https://github.com/google/caja * MentalJS https://github.com/hackvertor/MentalJS other options are avai…
> HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify ) Or use iframe.sandbox, which was designed for it. https://www.w3schools.com/tags/att_iframe_sandbox.asp
Using an iframe sandbox has some issues:
1. scrollbars and positioning can cause problems with iframes that an inline div doesn't have, especially if there are multiple small iframes on the page.
2. As soon as you allow script in the sandbox iframe, then you are susceptible to these types of fingerprinting attacks. The fact that you have origin isolation doesn't really block what the ad was doing. This is because iframe sandbox was never designed to block fingerprinting attacks, it was design to create a separate origin that gave the dev broad control over features like 'allow js' 'allow access to origin', etc.
Re: Why is Stack Overflow trying to start audio?
#185Earlier quoted context omitted.
I think ad blocking is a misnomer. What people are trying to do when blocking ads is prevent marketing people from spying on them. And the performance and resource consumption that comes from that. Personal opinion: Laws are needed to make what advertisers are doing illegal. Advertisers are spying on people to the extent where if the government did it they'd need a warrant.
I disagree. The tech crowd is using adblockers to prevent spying and resource consumption. But majority of people running adblockers just don't want to see ads.
Anecdotally, that's the case for me. I've been blocking ads since ~2000 because I don't like ads. It's only more recently that I've really stepped up efforts by not allowing third party scripts, using temporary/multi-account containers, using Decentraleyes, stripping identifiers from query strings, etc.
Re: Why is Stack Overflow trying to start audio?
#186Earlier quoted context omitted.
They don't have to worry because they control the browser too, and so those tricks will continue to work for the foreseeable future.
Which is why one of several things should happen. The first option is that there be legal requirements to adhere to public standards if you are a content distributor. And that any standards compliant client side software be allowed to use the service. In some areas we're in a world where your telephone carrier sells you your telephone, e.g. twitter, apple's imessage, etc. Other options would be that if you are a cont…
What kind of legal requirement can thwart a multinational corporation? The UN cannot enforce any laws, the only supra-national entity with this power is the EU (see GDPR).
It's easier to just use Firefox with uBlock Origin, Cookie AutoDelete, etc etc.
Re: Why is Stack Overflow trying to start audio?
#187And this is why, even with the best intentions of site operators, my browser will continue to use the best ad-block tools I can get, and my networks will be protected by tools like PiHole.
This seems melodramatic for something as trivial as an audio request.
Did you click the link..? It's fingerprinting, not just trying to legitimately play audio.
Re: Why is Stack Overflow trying to start audio?
#188Earlier quoted context omitted.
I'm hoping in 10 years the world will have figured out that allowing arbitrary Turing-complete code to automatically run on one's personal machine is a terrifically terrible idea, and that the World Wide Web will instead orient itself around something that doesn't make security and privacy extraordinarily difficult to achieve (whether that's still HTML/CSS or something entirely new). At the very least, though, eventu…
> Turing-complete code You can't build apps without turing complete code. We would be back to downloading and executing applications/programs.
The more I think about your statement, the more I don't know what you are trying to say. Do you think there is a fundamental difference between software that is precompiled all at once and software that is interpreted or compiled on the fly?
Re: Why is Stack Overflow trying to start audio?
#189Earlier quoted context omitted.
Adsense is just going to start providing content for you to inline into your site. Kind of like how https://old.reddit.com/r/gaming/ is just a sequence of ads being flawlessly delivered to an ad-averse demographic that eats the ads up.
I find it outright puzzling that CDN edge servers have not morphed into ad splicers yet, that business seems so obvious to me. The closest to a "guessplanation" I can come up with for is not happening is that there might be trust issues (overreporting/underreporting impressions) in the triangle of publisher, ad-network and CDN/ad-splicer. But I'm not convinced at all that this would outweigh the anti add-blocker adva…
Until now, while most people don't use ad-blockers and browsers have accepted third-party cookies, there's an advantage to loading a resource from another domain, since an ID created and stored by doubleclick.net on site A could be read by doubleclick.net on site B, allowing for cross-domain tracking. As third-party cookies increasingly get blocked, I think we'll see that more and more.
Re: Why is Stack Overflow trying to start audio?
#190Earlier quoted context omitted.
But you know, we wouldn't stop serving ads until we work it out... no no imagine the loss in revenues.
Let's be adults here. This is SO, and I imagine you've used and enjoyed the use of their services just like the rest of us. Support them by letting passive ads sit on the edges of the page, and appreciate that they are actually trying to solve this issue.
They could “solve” the issue by not having third party ads. Of all the sites on the internet, StackOverflow has the demographics that any advertiser would crave. How large of an inside ads sales force would you need to target higher than average income earners?
How large reputable sites trust third party ad servers is a mystery to me.
Besides, native ads that could be served from StackOverFlows own servers would be harder to block.