News for hackers. Stuff that matters.
Re:Changing Our Approach to Anti-Tracking by ihuman on Thursday August 30, 2018 @11:45AM (#17877630)
Too bad they've now been replaced popups that occur in the same window as the website you're viewing. Is there a name for this new type of popup?
Re:Changing Our Approach to Anti-Tracking by stormbrew on Thursday August 30, 2018 @11:50AM (#17877671)
The real scourge at the time was actually pop-unders, which you would never figure out where they came from and saw them potentially hours after visiting the site that produced them.

It's honestly an improvement that sites have to obscure their own content (and thus spite their nose to save their face) and nothing else in order to give you intrusive ads. You'll always know what websites don't put value on their own content that way.

Re:Changing Our Approach to Anti-Tracking by rasz on Thursday August 30, 2018 @01:13PM (#17878526)
What do you mean was? popunders are all the rage recently and work great under Chrome.

[Reverse Engineering new PopUnder for Chrome 63 on Windows] https://www.youtube.com/watch?v=VcFQeimLH1c

https://www.reddit.com/r/LiveOverflow/comments/84ertx/new_po...

Re:Changing Our Approach to Anti-Tracking by stormbrew on Thursday August 30, 2018 @06:07PM (#17881239)
Eh, it's kind of different when they're literally exploiting something in new versions of browsers that are actively updated and are going to get fixed.

Back then it was just supported behaviour and the dominant browser went several years without a major update. Like night and day.

Re:Changing Our Approach to Anti-Tracking by Dylan16807 on Thursday August 30, 2018 @01:38PM (#17878800)
Heck, popups still work in Chrome if they clickjack. There's no way to entirely disable popups on a site.
Re:Changing Our Approach to Anti-Tracking by tomxor on Thursday August 30, 2018 @03:14PM (#17879817)
Chrome provides many content settings that tend to toggle between "disabled, ask, allow". It should be possible to provide an option for spawning windows even when originating from a user event (although there isn't one currently).
Re:Changing Our Approach to Anti-Tracking by brennebeck on Saturday September 01, 2018 @10:56PM (#17895264)
Are you saying to have a permission that would ‘disallow, ask, or allow’ me opening new tabs? Because that’s exactly what it sounds like to me.
Re:Changing Our Approach to Anti-Tracking by garmaine on Thursday August 30, 2018 @03:13PM (#17879805)
The browser could just not make any new window as a result of a click in the content area.
Re:Changing Our Approach to Anti-Tracking by askmike on Friday August 31, 2018 @12:31AM (#17882968)
Browsers implement the HTML spec, which allows for this behavior.
Re:Changing Our Approach to Anti-Tracking by adrianN on Friday August 31, 2018 @01:29AM (#17883180)
Browsers have been known to implement the spec only partially.
Re:Changing Our Approach to Anti-Tracking by garmaine on Friday August 31, 2018 @01:34AM (#17883194)
They’re not required to.
Re:Changing Our Approach to Anti-Tracking by feross on Saturday September 01, 2018 @05:28PM (#17893958)
Indeed. Have you seen my site https://theannoyingsite.com/ ?
Re:Changing Our Approach to Anti-Tracking by hollerith on Thursday August 30, 2018 @04:14PM (#17880313)
Your https://www.youtube.com/watch?v=VcFQeimLH1c is a 4.5-hour video, the first 5 minutes of which shows a completely static video track with an audio track of a guy talking slowly.
Re:Changing Our Approach to Anti-Tracking by rasz on Thursday August 30, 2018 @08:42PM (#17882074)
welcome to reverse engineering
Re:Changing Our Approach to Anti-Tracking by tomxor on Thursday August 30, 2018 @03:09PM (#17879771)
The funny thing with these under a tiling window manager, is they turn into pop-sideways-es :D (unless you are in a stacking mode), makes it a bit easier to kill them immediately and also makes it more obvious where they came from. Haven't come across these in a while now though.
Re:Changing Our Approach to Anti-Tracking by mcdevilkiller on Friday August 31, 2018 @08:21AM (#17884890)
i3wm?
Re:Changing Our Approach to Anti-Tracking by tomxor on Saturday September 01, 2018 @02:57AM (#17890641)
yes :)
Re:Changing Our Approach to Anti-Tracking by dblohm7 on Thursday August 30, 2018 @12:08PM (#17877827)
We're working on blocking those too. Feel free to install this addon to help submit data on these:

https://addons.mozilla.org/en-US/firefox/addon/in-page-pop-u...

Re:Changing Our Approach to Anti-Tracking by natch on Thursday August 30, 2018 @01:22PM (#17878619)
Let me turn off Javascript more easily. And back on again easily. I usually need it gone for like 5 seconds, and then I need it back on, each of which is one key and one click in Safari and an entire journey to the moon and back in Firefox.
Re:Changing Our Approach to Anti-Tracking by HSO on Thursday August 30, 2018 @04:45PM (#17880588)
Enable the developer menu in Safari and assign a keyboard shortcut to the JS item. Done :-)
Re:Changing Our Approach to Anti-Tracking by natch on Friday August 31, 2018 @11:52PM (#17890103)
The Develop menu in Safari helps enable keyboard shortcuts that can be used in Firefox? Please say more.
Re:Changing Our Approach to Anti-Tracking by NegativeLatency on Thursday August 30, 2018 @02:01PM (#17879048)
It would be cool if I could enable js on a per site basis
Re:Changing Our Approach to Anti-Tracking by Drdrdrq on Thursday August 30, 2018 @03:20PM (#17879862)
One word: uMatrix. NoScript lacks control on per-site basis, but is still ok.
Re:Changing Our Approach to Anti-Tracking by paulryanrogers on Thursday August 30, 2018 @03:37PM (#17880010)
IIRC, Noscript had per-domain JS controls before Umatrix existed.
Re:Changing Our Approach to Anti-Tracking by squarefoot on Thursday August 30, 2018 @03:58PM (#17880185)
But lacked fine grained control, at least the last time I used it. With uMatrix I can tell the browser to disable something (cookies/script/frames/media etc.) here but keep it enabled else/everywhere and the other way around. It gives the finest possible control but of course requires some time to whitelist the good stuff on new pages. A minor annoyance compared to the control it offers.
Re:Changing Our Approach to Anti-Tracking by matheusmoreira on Friday August 31, 2018 @10:30AM (#17885859)
I wish it allowed for even finer control, though. What if it could prevent one specific function from running? Or replace tracking functions with no-op ones? Or hook into HTTP APIs in order to let you audit, modify or interrupt communications?
Re:Changing Our Approach to Anti-Tracking by Drdrdrq on Saturday September 01, 2018 @12:42AM (#17890250)
I guess you could use GreaseMonkey for that, though I can't imagine how you could keep track of everything. Might be useful for smallish modifications though.
Re:Changing Our Approach to Anti-Tracking by staticassertion on Thursday August 30, 2018 @07:58PM (#17881869)
Yeah, noscript is pretty powerful.

The biggest difference between the two, in my experience, is UX. uMatrix is the best UX for a content blocker I've ever seen - very intuitive and simple.

Re:Changing Our Approach to Anti-Tracking by KozmoNau7 on Thursday August 30, 2018 @02:48PM (#17879570)
Unlock Origin in advanced mode can do it, so can Noscript.
Re:Changing Our Approach to Anti-Tracking by BrandonMarc on Thursday August 30, 2018 @04:43PM (#17880560)
NoScript add-on is fantastic.
Re:Changing Our Approach to Anti-Tracking by auslander on Friday August 31, 2018 @04:50AM (#17883984)
> enable js on a per site basis

uBlock Origin, check I'm advanced, block whatever you want per site, click save button

Re:Changing Our Approach to Anti-Tracking by irrational on Thursday August 30, 2018 @02:11PM (#17879153)
You can with NoScript.
Re:Changing Our Approach to Anti-Tracking by westmeal on Thursday August 30, 2018 @06:42PM (#17881446)
Vouching for uMatrix here it's super useful
Re:Changing Our Approach to Anti-Tracking by 4ad on Thursday August 30, 2018 @09:22PM (#17882233)
> each of which is one key and one click in Safari

Safari user here. Which key and which click is that?

Re:Changing Our Approach to Anti-Tracking by natch on Friday August 31, 2018 @04:48AM (#17883973)
Key combo Cmd-,

(That’s command comma. Which I described as one key, cheating slightly, but hey they are so close to each other.)

Preferences panel comes up.

If you leave it on the security tab, the checkbox comes up. Uncheck it and now the site is usable without JS.

Another click on background or Esc to dismiss the dialog if you want to, but for some things that’s not even needed (therefore I claimed that low click count... ymmv).

Re:Changing Our Approach to Anti-Tracking by some_account on Thursday August 30, 2018 @02:15PM (#17879200)
There are plugins for almost anything in Firefox. Did you try any of them for this purpose, like this one for example :

https://addons.mozilla.org/en-US/firefox/addon/disable-javas...

Re:Changing Our Approach to Anti-Tracking by woodrowbarlow on Thursday August 30, 2018 @02:50PM (#17879594)
the problem with using a plugin for something like this is that as soon as the plugin becomes popular enough, a third party purchases it from the original developer and adds a bunch of telemetry. stylish is a recent high-profile example, but it happens to small, benign-looking extensions even more often.

the problem has gotten so bad that i no longer use the plugin "store". i only install plugins that are open source, and only by building the source myself... meaning i miss out on automatic updates (but at least i know my plugin isn't spyware!).

it sucks.

Re:Changing Our Approach to Anti-Tracking by nsomaru on Friday August 31, 2018 @03:56AM (#17883752)
It is also difficult to see which extensions have been granted what permissions. Right now I’m sticking with known extensions but maybe I should be compiling my own
Re:Changing Our Approach to Anti-Tracking by birdman3131 on Thursday August 30, 2018 @03:04PM (#17879717)
There used to be plugins for almost anything. Then most of the powerful ones were kneecapped because of some bad actors. The new system is a joke.
Re:Changing Our Approach to Anti-Tracking by some_account on Thursday August 30, 2018 @03:45PM (#17880077)
I don't know, I kind of like it. I was writing a simple webextension within hours. Good tutorials etc.

New api functions are coming all the time as well. Its not yet as powerful as the old system but is there any reason to believe it will never be?

Re:Changing Our Approach to Anti-Tracking by tialaramex on Thursday August 30, 2018 @08:40PM (#17882067)
Literally yes, it will never be that powerful, and that's intentional. The old way was so powerful, able to do anything, because well, it basically just ran your addon in the core browser's execution context. Way too scary to give add-ons that much power.

However I genuinely do want stuff that isn't yet implemented. For example I want add-ons to get access to Firefox's copy of the Public Suffix List, which is what you usually wanted when your add-on actually just treats TLDs as special. I just this evening sent a PR to PassFF, a popular password manager to do something crude as a stop gap while we wait to access the PSL via Web Extensions.

Re:Changing Our Approach to Anti-Tracking by jetrink on Thursday August 30, 2018 @12:10PM (#17877843)
This would be an amazing feature! Good luck in your efforts.
Re:Changing Our Approach to Anti-Tracking by blacksmith_tb on Thursday August 30, 2018 @12:40PM (#17878133)
That sounds great, but it seems like a Hard Problem, given that lots of sites/apps use modals for necessary things like logins and shopping carts. I suppose one approach would be to inject some kind of 'close and stay closed' control into any elements that cover the page (nice for paywall gray screens, too...)
Re:Changing Our Approach to Anti-Tracking by scaryclam on Friday August 31, 2018 @04:24AM (#17883865)
I'm not sure it's all that hard. It's never been a great idea to make core user flows reliant on modals (by all means use them, but make sure you either practice progressive enhancement or have a fallback). Sites doing so are at risk of failing their users. That said, I'd love for a solution akin to popup blocking: block the popunder but alert the user that it happened and allow them to show certain ones.
Re:Changing Our Approach to Anti-Tracking by aethertap on Thursday August 30, 2018 @12:59PM (#17878333)
I use 'nuke anything' for the gray screens. Click the stuff you never want to see again and it's gone forever.
Re:Changing Our Approach to Anti-Tracking by glitchdout on Thursday August 30, 2018 @11:55AM (#17877720)
Re:Changing Our Approach to Anti-Tracking by zamalek on Thursday August 30, 2018 @01:31PM (#17878733)
I use "popover" because modals can serve a real purpose (logins etc.).
Re:Changing Our Approach to Anti-Tracking by ohitsdom on Thursday August 30, 2018 @03:37PM (#17880017)
A minor aside- "Popover" doesn't quite work if you're regularly using Bootstrap because that means a specific thing.

https://getbootstrap.com/docs/4.1/components/popovers/

Re:Changing Our Approach to Anti-Tracking by gregknicholson on Thursday August 30, 2018 @05:09PM (#17880800)
Gnome has a similar widget, also called a “popover”; most menus use them.
Re:Changing Our Approach to Anti-Tracking by overcast on Thursday August 30, 2018 @04:23PM (#17880396)
Logins are not a real purpose for modals. Just go to the login page, and redirect back to where you were. I'll give you confirmation yes/no modals, but that's about it.
Re:Changing Our Approach to Anti-Tracking by JBiserkov on Thursday August 30, 2018 @01:02PM (#17878365)
Thank you for this! The comments are amazing!
Re:Changing Our Approach to Anti-Tracking by ashleyn on Thursday August 30, 2018 @12:08PM (#17877828)
Nothing makes me want to sign up for your newsletter less than having it interrupt what I'm reading.
Re:Changing Our Approach to Anti-Tracking by Ntrails on Thursday August 30, 2018 @12:16PM (#17877893)
I particularly hate every idiot who decided that scrolling up meant I was done and wanted your garbage top bar to obscure half the screen (including, no doubt, the stuff I was trying to read).
Re:Changing Our Approach to Anti-Tracking by pshc on Thursday August 30, 2018 @03:21PM (#17879870)
It’s also distracting even if doesn’t obscure what I am looking at. Sudden unexpected movement in my peripheral vision! It’s one of the worst web design trends. The iOS Safari bar is done right, at least.
Re:Changing Our Approach to Anti-Tracking by thaumasiotes on Thursday August 30, 2018 @01:20PM (#17878591)
Pffft, what are the odds that scrolling up will leave the text you were trying to read at the top of the screen?
Re:Changing Our Approach to Anti-Tracking by Ntrails on Thursday August 30, 2018 @01:44PM (#17878863)
I WILL CUT YOU

In all seriousness, it's partly that I have dumb habits. I highlight text as I read it (and that causes all sorts of idiot pop ups to share the quote on social media etc) and micro scroll up and down even when not actually trying to actively change the field of view.

I can't even justify why I do it. But I do. It's just how I read longform text on computers. On the plus side "reader view" can be a lifesaver

Re:Changing Our Approach to Anti-Tracking by jancsika on Thursday August 30, 2018 @10:08PM (#17882376)
I WILL JUSTIFY IT...

I use the top of the browser's viewport as a transient "bookmark." That is, I read for awhile and then scroll until what I have read scrolls out of view. Now the line of text at the top of the viewport is the first line of what I have left to read.

Scrolling in most browsers is quantized to a value much greater than the line height of the text I'm reading. This means I must occasionally scroll past the part I've read and then retreat to reveal half a line or so of what I already read.

Unfortunately, all the algos that trigger new shit on a change of scroll direction disrupt my own manual adjustment algorithm. Even on a news site, a directional change in scrolling triggers some douchebag horizontal menubar that animates itself into view and obscures the next line of text I want to read. I have to scroll back down to make the douchebag menu disappear. When it disappears it reveals... a line of text which I already read!

So now my bookmarking technique is ruined because the disappearing douchebag menu is guaranteed to reveal at least a line and a half of text I already read.

I don't like this behavior because it disrupts my completely rational and reasonable behavior as a user of the browser. I am the one in charge, and if a web page tries to challenge me on that I swear to god I will copy the damn text and paste it into a contentEditable about:blank.

Then they can only sit there and dream about all the places I'm scrolling.

Re:Changing Our Approach to Anti-Tracking by TeMPOraL on Friday August 31, 2018 @05:09AM (#17884063)
> I can't even justify why I do it.

You're helping your eyes stay on point when reading, just like some people reading a physical book/printout will use their finger or a pen for that purpose. It's perfectly normal. Your habits are not dumb. What those sites are doing with floating headers and bullshit on-select popups that's dumb.

Re:Changing Our Approach to Anti-Tracking by w0land on Thursday August 30, 2018 @03:38PM (#17880022)
You're (and me) are not alone at this habit. Nice to know I'm not alone :-)
Re:Changing Our Approach to Anti-Tracking by Sabinus on Thursday August 30, 2018 @09:45PM (#17882308)
Good to know I'm not the only one with spastic Web browsing habits.
Re:Changing Our Approach to Anti-Tracking by yarosv on Thursday August 30, 2018 @06:15PM (#17881287)
I do it all the time too. Hate when something happens. I've seen sites that also start loading next article if I click on the right side of the text column...
Re:Changing Our Approach to Anti-Tracking by hollerith on Thursday August 30, 2018 @04:11PM (#17880289)
Pretty good because I'm in the habit of scrolling down approximately a windowful (using the Page Down key) then when that scrolls a little too far (because I have low vision and consequently have the text size set unusually large, which many web sites don't handle correctly) using the up arrow key to find my place again.
Re:Changing Our Approach to Anti-Tracking by scaryclam on Friday August 31, 2018 @04:30AM (#17883889)
This is something I habitually add to my browser bookmark toolbar: https://alisdair.mcdiarmid.org/kill-sticky-headers/
Re:Changing Our Approach to Anti-Tracking by folkrav on Thursday August 30, 2018 @02:17PM (#17879234)
The thing is, they keep doing it cause it works. Go figure...
Re:Changing Our Approach to Anti-Tracking by mikekchar on Friday August 31, 2018 @07:37AM (#17884665)
Where I work, the marketing department is always putting horrible newsletter popups on the web page, etc. I used to say, "That's going to detract from people signing up, not encourage it!". But they've got the data and they've shown it to me. As you say, it works.

I wondered why for a while, because as soon as I see those shenanigans, I'm gone. But then I realised: I'm not the target market for the websites we have at work (a full service travel tour company). Most of our clients are booking travel for a group of 30 people from their company 6 months or a year in advance. They are coming to our website because they want the damn newsletter. Took me a long time to understand that.

Re:Changing Our Approach to Anti-Tracking by popoversalad on Thursday August 30, 2018 @04:11PM (#17880292)
Do you have any citations for that? I see people either signing up because they don't realize they have a choice because the button to say "No" is intentionally smaller and obscured, but then they mark the newsletters as spam, or simply throw them out. I also see lots of people adding fake addresses like "[email protected]" just to get past them. Has anyone verified that they actually do some real amount of good for the business putting them up beyond the simple metric of "we got tons of signups for our newsletter after doing it!"?
Re:Changing Our Approach to Anti-Tracking by JoshMnem on Thursday August 30, 2018 @05:30PM (#17880964)
You can reduce the problem by turning off CSS animation and blocking elements with Stylus[1][2]. Also turn off all CSS and JS by default and enable resources on a site-by-site basis with umatrix[3][4]. If a page isn't readable, you can turn on Firefox reader mode to format it with one click. The system works well for me.

I put this in my global Stylus rules:

    /* Remove CSS animation on all websites */
    *, *:before, *:after {
        transition-property: none !important;
        transform: none !important;
        animation: none !important;
    }
[1] https://addons.mozilla.org/en-US/firefox/addon/styl-us/

[2] https://chrome.google.com/webstore/detail/stylus/clngdbkpkpe...

[3] https://addons.mozilla.org/en-US/firefox/addon/umatrix/

[4] https://chrome.google.com/webstore/detail/umatrix/ogfcmafjal...

Re:Changing Our Approach to Anti-Tracking by lostmsu on Tuesday September 11, 2018 @02:35PM (#17962180)
How do you turn CSS off with uMatrix? Is it doable separate from scripts?
Re:Changing Our Approach to Anti-Tracking by detaro on Tuesday September 11, 2018 @02:39PM (#17962203)
Re:Changing Our Approach to Anti-Tracking by madeofpalk on Thursday August 30, 2018 @06:22PM (#17881324)
> Also turn off all CSS and JS by default

Arguably, that creates a more user-hostile internet browsing experience compared to just allowing for those in-page modal pop ups. At least with those they're few and far between and you can just close the tab and forget about the site.

Re:Changing Our Approach to Anti-Tracking by JoshMnem on Thursday August 30, 2018 @09:51PM (#17882327)
I don't think "hostile" is the correct word, since it improves my browsing experience. It does more than stop modals -- it prevents 90% of the design, advertising, and tracking garbage on the Web, and I can now read websites the way I want.
Re:Changing Our Approach to Anti-Tracking by manigandham on Thursday August 30, 2018 @02:15PM (#17879209)
The adtech terms are:

Popups/Overlays = cover your current website.

Pop-unders = open new tab with your current site, while redirecting the old tab to an ad, thereby surprising you when you close your current site.

Bounce/Exit intent = the above formats but triggered when you leave the site or close the tab.

Interstitials = the above formats but triggered when you navigate between pages, common in image galleries.

Re:Changing Our Approach to Anti-Tracking by pwg on Thursday August 30, 2018 @12:15PM (#17877879)
If one browses with NoScript in default-deny mode, then many of those "popups over the content in the window" simply do not occur.

As well, when they do occur, going into Dev-Tools and deleting the <div> (or whichever element it happens to be) that is the actual popup is often sufficient to remove the popup and make the content view-able again.

Re:Changing Our Approach to Anti-Tracking by ianlevesque on Thursday August 30, 2018 @12:17PM (#17877900)
I just leave. To each their own though.
Re:Changing Our Approach to Anti-Tracking by mderazon on Thursday August 30, 2018 @01:46PM (#17878885)
The ones that track your mouse and sense you're about to close the tab and then show you the pop-up are the most sleazy
Re:Changing Our Approach to Anti-Tracking by michaelmrose on Thursday August 30, 2018 @01:04PM (#17878380)
Ublock origin has a little icon that looks like an eyedropper. You can use it to pick an element you don't want to see anymore on a website. It works on mobile too.
Re:Changing Our Approach to Anti-Tracking by squarefoot on Thursday August 30, 2018 @04:12PM (#17880301)
Also reachable using the mouse: right click on the page, select from the menu the "Block element" option near the Ublock Origin icon, then pick the element to block and "Create" the rule in the lower right window that opens as soon as one picks the element. It also supports wildcards, useful to block similar elements or elements used in numbered pages, so that one * will nuke all of them.
Re:Changing Our Approach to Anti-Tracking by MagnumOpus on Thursday August 30, 2018 @11:54AM (#17877711)
Interstitial ads?
Re:Changing Our Approach to Anti-Tracking by Terretta on Thursday August 30, 2018 @01:02PM (#17878366)
You shouldn’t be voted down. This is the ad industry term.

https://en.m.wikipedia.org/wiki/Interstitial_webpage

Now we have interstials behave like SPAs, so siblings are calling this modal, but that’s more about a dialog box you can’t click outside of until dismissed.

Interstitial is the entire content until you get past it, like Forbes when you have a content blocker on.

Re:Changing Our Approach to Anti-Tracking by lmkg on Thursday August 30, 2018 @11:51AM (#17877680)
The word is "modal." Modal view, modal window, modal pop-up. Sometimes implemented by iframes, sometimes just with divs.
Re:Changing Our Approach to Anti-Tracking by christefano on Thursday August 30, 2018 @08:07PM (#17881919)
> Is there a name for this new type of popup?

I've heard that these are called pop-ins.

1. https://www.webfx.com/blog/marketing/non-intrusive-pop-ups/

2. https://www.laptopmag.com/articles/stop-pop-ups-chrome#comme...

Re:Changing Our Approach to Anti-Tracking by tempodox on Thursday August 30, 2018 @11:51AM (#17877676)
Overlay?
Re:Changing Our Approach to Anti-Tracking by takeda on Thursday August 30, 2018 @12:02PM (#17877776)
They are bad, but because they are in the same window usually there's not as many of them as it was with popups.
Re:Changing Our Approach to Anti-Tracking by FactolSarin on Thursday August 30, 2018 @11:52AM (#17877684)
I don't think so. Maybe "modal ad"?
Re:Changing Our Approach to Anti-Tracking by jdironman on Friday August 31, 2018 @09:04AM (#17885185)
I call them pop-ins.