It's going to be hard for facebook because they're such a big target.

I think where ad-blockers will start to have problems is with the millions of lesser known sites. Once these publishers swap over to proxying ad-content through their own domains and using a handful of simple evasion tactics (random file name for the self hosted JS file that pulls in the ad, site specific pseudo-random DOM element names for the ad spaces, not using an obvious sub-domain to load proxied ad content from); stopping ads getting through is going to require a lot more effort than blacklisting a few ad-server domains.

A question: once site owners proxy ads through their own domains, will they become liable when they serve malware?

Right now the usual defense seems to be "we just buy 'em", but that's going to be a lot less convincing once Forbes.com is actively serving malware from their own site.

No idea, I'm not a lawyer. Assuming liability is a real problem presumably this is fixed by ad networks improving their vetting and offering some sort of insurance to publishers in the event malware sneaks through.

Alternatively, as mentioned in another comment, proxying might mean simply installing a managed ad-server within the publisher's infrastructure. So from an end-user PoV it looks like it's coming from the publisher's server but in reality it's still being served from a third party managed box.

Until the adserver serves malicious ads (which has happened dozens of times on high profile sites in the past year or so), and then the website is sued.

Yeah but if the adserver is a black box that's managed by the ad network I would have thought the website could pass the liability on to them (and state this in their ToS somewhere)

Proxying ads would be a big security risk though since it means they would run within the same sandbox as the rest of the page, which might be why it hasn't often been done yet.

Security is a problem but my guess is publishers will care about profit first and worry about security later.

Other than proxying I can't see how advertisers and publishers solve the ad-block problem without completely rethinking how ads are bought,sold,tracked and delivered.

Proxying seems to be one of the lowest-friction ways for them to continue business as usual, security be damned.

It would also mean that when sites end up buying malware-laden ads, they'd be serving them off their own domain. I'm not sure what consequences that would have (legally or with search engines and browsers) but I'll bet it's not pretty.

It'd also be a big risk in that it'd be easier to cheat the ads as they'd all come from the same connecting IP. I doubt advertisers would appreciate that much.

Indeed, proxying is basically pointless. At that point, it would be better for the site and for the advertisers (and users who don't block ads) for the site to simply self-report. At least then they avoid the extra overhead and load times (which might, btw, be detectable by ad blockers).

Alternatively, advertisers could host a server on the site's domain. A subdomain or specific path would be easily blocked, but a random path wouldn't be, e.g. http://www.example.com/626164776F6C66/ with identifier generated randomly. Plenty of existing content already looks this way.

Yeah, this is how I envisage it. Publisher gets a docker image (or whatever) from the ad-network and hosts it internally on their network. Then you just need to map a random path from nginx/haproxy. Client IP can be passed through too.

I can't see that working out well, it'd just be way too easy to cheat, you could fake any IP you wanted, pretend to be connecting from the regular consumer ISPs and generate fake hits, fake clicks and otherwise easily steal from the ad network. This will never happen, it's a non-starter. They have enough problems with fake clickers already. There's no way to pass it using a reverse proxy, docker image, whatever, where the hosting website doesn't have ultimate control over the data they provide to the ad network.

Basically if this happens I'm switching my career to stealing from ad networks for fun and profit.

True it would be an issue for CPC/CPM campaigns but less so for CPA.

Not sure what the solution would be for CPC/CPM - off the top of my head maybe a random CNAME that pointed to an ad-server controlled IP so they could cross-audit client IPs via a JS drop in file? Presumably ad-blockers would easily pick that up though.

If I include and run a script from example.com, doesn't that already happen? How else would using a CDN for, say, jQuery work?

They can just not send you the actual content until you've downloaded the advertising content of the page.

And in HTTP/2.0 they'll just switch to pushing the ads out to you.

In either case they can't guarantee it'll get on the screen, but they assuredly can make sure you download the damned ads.

Long term browsers will become more and more closed, DRMed, protected and such so that people have much less control over how stuff is displayed on screen.

And as that happens they'll lose users who have become accustomed to the conveniences of ad blocking and open web pages.

I'm also pessimistic about where it's going. As if the segregation on the web isn't bad enough already. We might end up with two kind of webs- one independent and open, another capitalized and closed. Just the fact that indieweb.org needs to exist tells us what's waiting.

Tim Berners Lee would cry if we end up with 2 webs.

> Once these publishers swap over to proxying ad-content through their own domains

Do you know anyone who is doing this already?

They will, once the "free money" of normal shitty ads stops working. Then, once the amount of work required to serve proxied ad-content through their own domains is more than the benefit of the "free money" of shitty ads, the force of human nature means that most publishers will move to that model. Personally, I think this will become a machine learning battlefield in the next handful of years.

> Personally, I think this will become a machine learning battlefield in the next handful of years.

Everyone will get their own personal AI stalker bot from the birth. I have such high hopes for humanity. When we at it maybe also replace politicians with AI, I'm sure they will do a better job than we mortals.

Luckily, we have the power of AI to help us! :-)

uBlock can already do this (I use it for hiding the Twitter "while you were away" nonsense), although I suspect that the next step is Facebook scrambling DOM classes and ids with no discernable pattern.

> scrambling DOM classes and ids with no discernable pattern

That's why I have been beefing up the DOM filtering code in the latest versions -- there are already sites doing this.

There is a lot of untapped potential with the new operators, I am waiting for opportunities to put them to test, and fine-tune them if needed.

Thanks for your wonderful work.

> That's why I have been beefing up the DOM filtering code

Isn't it all done through CSS selectors? Could you share more?

How about leveraging other heuristics such as HTTP headers (response cookies for starters) or timing information?

Just realized that you're the author of uBlock..

If you can't filter on classes or id's, what else? Dom element ordering? Image size properties? Structure of ad text?

Thank you for your service.

Something like react-armor can make cryptographically unpredictable class name, tree structure and tag name obfuscation. But it won't be enough if the ad itself is not written with the same toolkit.

https://github.com/elierotenberg/react-armor

https://youtu.be/n63XXHY4A7I

The next step then is for uBlock to use a machine learning algorithm to analyze the rendered page and hide anything that resembles an ad.

I wouldn't hate this, even if it's imperfect - the most common false positives would be brand-pushing content I don't want even if it's not actually paid advertising.

You wouldn't need machine learning, just allow the image to be seen by a hundred users and see how many mark it as an ad.

Well, that's how you build a training set.

But you still have to identify features and use an algorithm that basically goes "users identify images with features A, B, and C as ads, and they identify images with features X, Y, and Z as not ads, so put positive weights on A, B, and C and negative weights on X, Y, and Z, and block anything with a negative enough score".

Then we can possibly block them by matching structural elements?

Yeah, or visual, anything with this CSS attributes applied (so even if they randomize names it can still be blocked) to it or something. Maybe even the element at this rendered location, which would pretty much guaranteed kill them unless they wanted to change ad locations randomly. In any case this is a pretty trivial problem.

is that why Google scrambles everything?

No, that's for bandwidth savings I reckon.

"while you were away" nonsense? A feature that shows you popular tweets from only people you follow. How is that nonsense?

There are people that would like Twitter to just be a straight-up, chronological feed of tweets from people that you follow.

I'd love it if the infinite scrolling shit went away and I could look at tweets by last hour, last 12 hours, last 24 hours, etc, and then paginate by day after that.

He doesn't want to see it and there's no option to hide it. FB is also full of attention catching crap like that, it's all engineered.

You act like engineering things that most people like is a bad thing.

You're not going to please everyone. Even people who will like it a month down the line will hate it when you first roll out the change. And we should you have to support (|feature|!) different websites?

> You act like engineering things that most people like is a bad thing.

Like or is being exploited based on genetical brain responses to like because of the result of the "quest for new information" ?

This behaviour is psychologically engineered to trigger more dopamine fueled hits and with it fueling site engagement.

Everything you like is based on brain responses. Fueling engagement with your product is only necessarily harmful if your product is harmful.

I hope you don't like music, movies, amusement park rides, love, etc., because I have some bad news for you.

Because thats my twitter feed. Really I don't follow more people than i can keep up with, so I want to read _all_ their tweets.

Which is apparently a usage pattern nobody at twitter gets.

I'm not sure why you're being downvoted. This seems like a legitimate question.

I'm being down-voted because I'm arguing for a feature that all-knowing "hackers" on here feel is hampering their user experience. Because they know what's best for every product they use. And everyone uses that product in the exact way they do so the product should be catered to only them.

Which is interesting, because that removes about half the defense for using ad-blockers (third party ads are a security problem) when discussing the implications of consuming content while purposefully avoiding paying the cost (in space and attention) for that content. At least for the people that bother to accept content producers should get even the smallest consideration in constrol over how they allow their content to be consumed.