News for hackers. Stuff that matters.
Re:Shadow: New browser engine made almost entirely in JavaSc... by tshaddox on Friday October 27, 2023 @06:54PM (#38045039)
> Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good measure and you kill DNS-based ad blockers too.

I'm confused how the "inner browser" meaningfully helps you accomplish this. How is this any easier or more effective than just having a website that hosts its own advertising assets (or proxies them) and obfuscates/randomizes its DOM structure to make ads difficult to target with simplistic ad-blocking rules?

Re:Shadow: New browser engine made almost entirely in JavaSc... by ilyt on Friday October 27, 2023 @07:00PM (#38045093)
Well the idea is stupid and makes no sense but

> How is this any easier or more effective than just having a website that hosts its own advertising assets

advertisers REALLY don't want you to do that because it's far too easy to cheat.

Re:Shadow: New browser engine made almost entirely in JavaSc... by lucasyvas on Friday October 27, 2023 @09:28PM (#38046175)
Well they can't have it both ways. They can either play wackamole with consumers or their customers.
Re:Shadow: New browser engine made almost entirely in JavaSc... by lelanthran on Saturday October 28, 2023 @05:13AM (#38048355)
> advertisers REALLY don't want you to do that because it's far too easy to cheat.

I expect that they are already cheating as much as possible to convince their customers to continue paying for advertising that has a negligible effect on the bottom line.

Adtech and PR firms would have you believe that it is impossible to sell a product or service online without first paying them $10k/m. It's also why google search is so awful - if they could get you the information you were looking for they are sidelining their customers, so their search has to, by design, be limited so that their customers are more prominent in the search results than non-customers.

Note: I'm not saying that this is by design; they could get to this stable equilibrium simply by each isolated team within search, advertising, etc aggressively pursuing its own metrics.

Re:Shadow: New browser engine made almost entirely in JavaSc... by teruakohatu on Friday October 27, 2023 @08:55PM (#38045910)
> I'm confused how the "inner browser" meaningfully helps you accomplish this.

Right not it is not hard to write an adblocker, just block network requests and DOM elements (regardless of whom hosts of proxies them).

A browser in a browser would make blocking dom as hard as attaching a debugger and manipulating a price that has been hardened.

Network requests may still be able to be blocked, but it is going to make ad blocking harder.

Re:Shadow: New browser engine made almost entirely in JavaSc... by cplusplusfellow on Friday October 27, 2023 @11:26PM (#38046837)
Would be amazing for advertisers but no users would visit the site.
Re:Shadow: New browser engine made almost entirely in JavaSc... by Intralexical on Saturday October 28, 2023 @11:26AM (#38050529)
I can't wait until this Browser-on-JS/WASM-on-Canvas loads an IFrame from a site that also has its own Browser-on-JS/WASM-on-Canvas.

Hell, the inner IFrame is probably going to get around IFrame recursion and domain rules too.

We're going to eventually end up with IFrame fork bombs, and IFrame topologies that cannot be meaningfully mapped to Euclidean space (amongst all the other privacy, user control, etc. concerns, of course).

Re:Shadow: New browser engine made almost entirely in JavaSc... by jimbobimbo on Saturday October 28, 2023 @12:15AM (#38047084)
Render the inner browser on canvas. Good luck with blocking anything, it's just a picture.
Re:Shadow: New browser engine made almost entirely in JavaSc... by iforgotpassword on Saturday October 28, 2023 @06:12AM (#38048589)
You still can't bypass the outer browser's network stack, so any request based ad blocking is still possible.
Re:Shadow: New browser engine made almost entirely in JavaSc... by EvanAnderson on Saturday October 28, 2023 @05:00PM (#38053317)
The inner browser is doing websockets w/ certificate pinning to its server. It's network access is totally opaque.
Re:Shadow: New browser engine made almost entirely in JavaSc... by Cyphase on Monday October 30, 2023 @05:33AM (#38067297)
The cryptographic keys are in memory, at least.
Re:Shadow: New browser engine made almost entirely in JavaSc... by scotty79 on Saturday October 28, 2023 @01:17AM (#38047363)
Obfuscation and randomisation can only get this far. Virtual browser would as opaque as raw binary producing animated image.