Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

ericdraken.com

Post reply on HN
Print view View original

21–30 of 659 posts

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#21

Post by rs_rs_rs_rs_rs »

greyface- wrote: post #17
userbinator wrote: post #12

I've been MITM'ing my traffic to, among other things, strip ads and rewrite pages with things like custom CSS, ever since I discovered The Proxomitron over 2 decades ago. It does tend to get me profiled as a "bot" by CloudFlare and such, but there are not-so-trivial ways around that too. It also shows why things like remote attestation are hazardous for user freedom.

> It does tend to get me profiled as a "bot" by CloudFlare Since Cloudflare employees are known to lurk here, I'd like to know: is this considered a false positive, or working as intended?

Not a CF employee but I am pretty sure it's working as intended as they built and use this:

https://github.com/cloudflare/mitmengine

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#22

Post by newaccount74 »

sgammon wrote: post #6

that's not really a "flaw" in protobuf; the protobuf is Working As Intended by decoding the field in a different place when you modify it. i am not sure how one could possibly characterize that as a "flaw," since protobuf is a field-numeric length-prefixed protocol in the first place. it makes a (reasonable) assumption that bytes won't be messed with over the wire, leaving integrity to the reader, so even if this _wa…

Yeah, that's some weird editorializing on behalf of the author. The "flaw" is mentioned only in the headline, the text just explains how the format works. It's not a flaw, just working as designed.

There's also this bit:

> Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files

Yeah, it's computationally expensive if you use unoptimized Python code to do it. If you write your code in C (or another compiled language) then scanning 1.8MB of protobuf code should be trivial, with or without the proto source files.

I'm pretty sure that making Protobuf files hard to decode without sources is not a design goal. If it was, they did a pretty lousy job.

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#23

Post by te_chris »

taspeotis wrote: post #5

The real tragedy: > In fact, the YouTube app is zippier because fewer connections are made to ad URLs in the first place. I swear on LG TV that webOS runs at a smooth 60 FPS when it's not connected to Wi-Fi and slows down as soon as it phones home for whatever telemetry and ads LG intend to serve me...

I’ve never connected my c2 to the internet and it’s great.

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#24

Post by speedgoose »

On a side note, I noticed a rare tracking consent banner. You may want to update it to track users and respect GDPR correctly. It should be possible to refuse as easily as accepting to be tracked, with the same button size and colour, for example. The tracking should start after consent is given. Also, GDPR isn’t so much about accepting cookies but giving consent to be tracked. So many websites get it wrong, and the likelihood that you will have issues is very close to zero, but since it looks like you implemented your banner yourself, you may be interested.

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#25

Post by denkmoon »

phito wrote: post #8

Very nice writeup. I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's. I have some IoT devices that do not expose a local API and only exposes the data through the cloud, and would like to capture the device to cloud traffic... I guess the only way to do that would be to dump the flash memory, replace the CA and reupload the dump to the device?

> I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's

The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved.

Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#26

Post by 1B05H1N »

userbinator wrote: post #12

I've been MITM'ing my traffic to, among other things, strip ads and rewrite pages with things like custom CSS, ever since I discovered The Proxomitron over 2 decades ago. It does tend to get me profiled as a "bot" by CloudFlare and such, but there are not-so-trivial ways around that too. It also shows why things like remote attestation are hazardous for user freedom.

You should be okay as long as you solve the challenge(s).

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#27

Post by internet101010 »

taspeotis wrote: post #5

The real tragedy: > In fact, the YouTube app is zippier because fewer connections are made to ad URLs in the first place. I swear on LG TV that webOS runs at a smooth 60 FPS when it's not connected to Wi-Fi and slows down as soon as it phones home for whatever telemetry and ads LG intend to serve me...

Connecting smart TVs to the internet is always a net negative.

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#28

Post by ajkblue »

This reminds me of a now-dockerized Privaxy, which is a UBlock-origin blocklist compatible MITM proxy. It’s crazy to see how many ads and tracking scripts are on smart products, especially my TV where so far in my testing it’s over 40% unnecessary traffic. Its been pretty fun to try and strip out ads on my smart-tv apps.

https://github.com/deetungsten/webui-privaxy is the dockerized fork of https://github.com/Barre/privaxy

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#29

Post by omnicognate »

The only alternatives to a service like youtube showing people ads are for its users to pay for it, for it to be funded through donations, for it to be run by the government and paid for through taxation or for it not to exist. I prefer the first or second approaches and Youtube is unusual among social media sites in actually giving me the first option. So I happily pay for premium and while I'd rather that were the only option (I think ad supported content is an inherently socially corrosive model) I dislike the attitude of those who reject ads but also refuse to pay.

(Some people are unable to afford it but that's an entirely separate social problem, and it would be unusual for somebody with the skills demonstrated in the article to be struggling to earn a living wage.)

What I would be interested in this protobuf inspection approach for would be implementing some decent parental controls. I would very much like to be able to enable/disable individual youtube channels. Currently all I can do is switch the whole site on and off. I have all the necessary infrastructure already, so I might give it a try.

Re: Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

#30

Post by phito »

denkmoon wrote: post #25
phito wrote: post #8

Very nice writeup. I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's. I have some IoT devices that do not expose a local API and only exposes the data through the cloud, and would like to capture the device to cloud traffic... I guess the only way to do that would be to dump the flash memory, replace the CA and reupload the dump to the device?

> I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved. Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.

I know that's the point, and I hate it. :)
Post reply on HN