
How Facebook Avoids Ad Blockers - ganderzz
https://www.dylanpaulus.com/2019-11-24-how-fb-avoids-adblockers/
======
gorgoiler
Relatedly, uBlock Origin’s picker has really improved my quality of life on
Facebook.

I love Facebook, it’s my only remaining connection to some people, and it’s
revived many friendships I thought I’d lost.

However, as one gets on in life, _People You May Know_ can be extremely
emotionally impactful. It is a little part of the web UI that brings back the
dead, ex partners I still miss, exes who have moved on, and toxic people I had
tried to move on from.

It’s really put me through the wringer and being able to block that part of
the UI forever is something I’m very glad Facebook, in the role I have gladly
given it as being an overseer of my (mostly good) emotions, _does not_ and
_shouldn’t ever_ stop me from doing. I hope they realize this.

~~~
jokoon
> I love Facebook

Interesting, what do you think about the backlash against facebook? I guess
there could be arguments in favor of facebook, after all.

~~~
johnward
Facebook is my only real connection to interact with people. I work remote and
spend all of my free time with my family but I don't have any real-life
friends. So facebook fills a little bit of a void where I can feel like I have
a few "friends". I do understand some of the backlash of them sucking up all
the world's data and selling it to advertisers.

------
jameshilliard
It's actually pretty simple to block with a recursive filtering algorithm like
this:

[https://github.com/gorhill/uBlock/compare/master...jameshill...](https://github.com/gorhill/uBlock/compare/master...jameshilliard:has-
visible-text)

or

[https://github.com/tiratatp/facebook_adblock/blob/master/src...](https://github.com/tiratatp/facebook_adblock/blob/master/src/main.js)

which was roughly based off of my rejected uBlock implementation.

Funny enough I haven't even used facebook in years for the most part, I wrote
one of those just to try and make them lose money as I believe I'm doing a
public service by slowing their expansion/world domination plans.

~~~
steve19
Can you explain what the rules to block that actually look like from a user
perspective? Or does it require custom js?

~~~
jameshilliard
Well with the uBlock filter I wrote it looked something like this at the time.

    
    
      facebook.com,facebookcorewwwi.onion##div[id^="hyperfeed_story_id_"]:has(div[id^="feed_sub_title_"]:has-visible-text(Sponsored))

------
iamkroot
I continue to be surprised at how few people have heard of fbpurity[1], a
fantastic browser extension that blocks all Facebook ads and lets you filter
out specific types of content (links, memories, etc.). It's _dramatically_
improved my Facebook experience; I now see exactly the type of content that I
want to see (updates on friend's lives) and nothing more.

[1] [https://www.fbpurity.com/](https://www.fbpurity.com/)

~~~
thatswrong0
I mean one look at the website kind of tells you why.

The extension could be a lot less intrusive as well - just compare it to
uBlock Origin for example. There doesn't need to be an onboarding message. I
don't need to see "F.B. Purity hid:" prominently in the middle of my feed -
just put that at the bottom right of the screen in gray text or in the
extension. Etc.

I'm probably going to uninstall it because it makes FB even uglier.

~~~
wtmt
You could check out Social Fixer. [1] It's been around for several years, is
free and offers many features. The creator/maintainer of Social Fixer was also
interviewed in Ars Technica.

[1]: [https://socialfixer.com/index.html](https://socialfixer.com/index.html)

~~~
aembleton
Unfortunately it's not supported on mobile Firefox.

------
gorpovitch
I have a much better experience of Facebook since a few weeks by adding
#stream_pagelet{ display: None } in Stylus for the homepage.

No news feed. No passive content consumption. Still got pages, events, groups,
messages etc. Can still use the website in an active/socializing way (looking
for specific things, seeing relevant friends' notifications and invitations)
but without being caught by the feed each time I come to check my
notifications. Think I'll do the same with pretty much every social network.
Content feeds are the worst.

------
crakenzak
Interesting article. I don't blame Facebook for doing whatever they can to
properly show ads tho, they provide a "free" service and in exchange serve
ads. It's not free to support a company their size and its expected they do
everything they can to monetize the site properly.

What do you guys think?

~~~
notafraudster
"do everything they can to monetize"

Except, evidently, allow users to pay money to not be subjected to ads.

~~~
a13n
Wouldn't work. Users who are willing to pay to make ads go away are the most
valuable audience for advertisers because they have money to spend. Therefore
FB would have to charge a TON of money to make up for their billions in lost
ads revenue, and nobody would pay that amount anyway.

~~~
SmellyGeekBoy
Seems to have worked out fine for YouTube (Premium subscriber here).

~~~
_Understated_
Perhaps but I'd put money on them still data-mining the shit out of you...

So you're paying to remove ads but tracking and monetisation is still
happening.

------
fruffy
I always wonder about the person that is responsible for designing these kind
of schemes. What is their daily job like? What are they thinking about their
work? It might even be fun because you are essentially competing against ad-
blockers in cleverness.

~~~
paggle
It’s like being a poker player, but you probably get paid more.

~~~
Nextgrid
At least poker doesn't have a negative effect on society, given you're only
playing against people who opt-in by playing the game.

This in comparison is fighting against people who just want a bit of peace and
less sewage being dumped in their Facebook timeline.

~~~
qxnqd
Facebook has a negative effect on society according to whom? How does a tool
that allows you to connect to other people have a "negative effect on
society"?

~~~
GeneralMaximus
People get lynched and killed every day in my country (India) because of hate-
speech on Facebook, not to mention all the fake news being spread via
WhatsApp.

If Facebook were to disappear tomorrow, it would be a net positive for the
world.

------
wayneftw
What happens when screen readers can't identify things properly? Can Facebook
be sued for not providing proper accessibility, given that their site is
deemed to be essential by many?

If screen readers can identify something as an advertisement, then so should
ad blockers be able to. If not... then aren't we depriving the blind and the
sight challenged from valuable advertising equality?

~~~
jaywalk
I think you're kind of misunderstanding how screen readers work. You're
clearly seeing the "Sponsored" text on the screen, and so is the screen
reader. It's not that the text isn't _there_ , it's just that it's put there
in a way that is nearly impossible to target with CSS-based ad blocking.
That's all.

~~~
aguyfromnb
> _It 's not that the text isn't there, it's just that it's put there in a way
> that is nearly impossible to target with CSS-based ad blocking._

I'm confused too, then.

If the screen-reader can see the word "sponsored" easily, why can't any other
code? What is the difference between how a screen reader finds "sponsored" vs
an ad-blocker?

~~~
jaywalk
A screen reader is looking at the text as it is rendered. Note that I said
__CSS-based __ad blocking, which is really what the blog post was about. A
more advanced ad blocker could certainly find the "Sponsored" text and hide
the ad.

------
stiray
How I am avoiding Facebook. Took their ASN, scraped ripe
([https://stat.ripe.net/widget/routing-
history#w.resource=AS32...](https://stat.ripe.net/widget/routing-
history#w.resource=AS32934&w.starttime=2017-01-15T00%3A00%3A00&w.endtime=2017-06-23T00%3A00%3A00&show=Maxmized))
and dynamically updating firewall rules to block them for my whole network.
And I am so sorry google is having cloud "hosting" (AS15562) as I would love
to do the same for them.

------
blauditore

      span[data-content="S"]
        + span[data-content="p"]
        + span[data-content="o"]
        + span[data-content="n"]
        + span[data-content="s"]
        + span[data-content="o"]
        + span[data-content="r"]
        + span[data-content="e"]
        + span[data-content="d"] {
        display: none;
      }
    

This only hides the "d", right? You generally can't hide a higher-level
element based on drill-down selectors, so pure CSS wouldn't be enough. But of
course, finding the appropriate parent by scripting would be trivial from
here.

Apart of that, why can't one just accumulate all visible text by filtering out
all `display: none` elements? Of course, this could be attacked again by e.g.
shrinking the "noise" characters to width 0.

~~~
byuu
Yeah, I always have to write userscripts to get access to
getElementsBy(TagName,Id,etc) and then call .parentNode().parentNode()... to
reach the ancestor I want to remove.

Of course the downside of userscripts compared to uBlock rules is that they
take time to run, so you end up seeing the ads briefly before they are erased,
which is annoying. So then I run the scripts prior to page-load to insert CSS
rules to hide all elements that _might_ be ads, let the page load, filter it,
and then override the older CSS rules. It's quite a hassle, really.

What I'm saying is, :parent selectors in CSS would be greatly appreciated.

------
charliesome
How does this impact assistive technologies? Are Facebook users using screen
readers left unaware of what's an ad and what's not?

~~~
digitalengineer
Interesting question! FaceBook Alt Text feature is an after thought at best,
so I imagine they never thought about it.

------
babuskov
I actually don't mind Facebook ads. If I'm on Facebook already, there's no
additional javascript loading and hogging my browser with dozens of megabytes
of tracking scripts. From performance point of view, browsing FB is a better
experience than your average web site these days.

~~~
SmellyGeekBoy
To be fair the ads tend to be better than the mountain of shit that my elderly
relatives share on there. Then again I very, very rarely visit the site in the
first place.

------
jedberg
What really makes me sad is that some presumably quite talented engineer spent
time thinking this up and coding it.

~~~
tomd3v
Can you explain what is wrong with engineers working on problems like these?

As I see this, it allows businesses to connect with more people, therefore
being more profitable, therefore making economy grow in general.

I just don't understand this hate towards developers who work for companies
like FB and Google and whose job is focusing on increasing ad engagement. In
my opinion, they definitely provide a hugely positive effect on economy
(unless you think capitalism / consumerism is evil / wrong or whatever, which
is another topic).

~~~
michaelt
When I visit
[https://www.facebook.com/careers/](https://www.facebook.com/careers/) the
first things it says are "Do the Most Meaningful Work of Your Career, [...] We
design products and deliver services that bring the world closer together -
one connection at a time [...] We encourage our people to be bold and solve
the problems they care most about. [...] Together, we help others build
stronger communities"

Does working on anti-ad-blocking seem like that to you?

To me, if I was promised "the most meaningful work of my career" then I was
assigned to anti-ad-blocking I wouldn't feel my Facebook career was delivering
on that promise.

~~~
rndgermandude
Yeah, that sounds a bit like being promised a research job in curing cancer,
but then being put on a team that researches how to weaponize ebola for that
customer in North Korea...

------
turc1656
I don't use Facebook, but I imagine the easiest way of blocking the ads is
like most other websites - to block the connection to the ad-server(s), no?
That's how uMatrix operates and, in my opinion, that works exceptionally well.
It blocks known domains that are ad-servers and that alone blocks damn near
everything because of the way ads are served on nearly every single website.

In fact it works so well that pretty much the only time I've noticed ads has
been when I look at uMatrix and I see there aren't direct user connections to
the ad servers. For those pages, it looks like the site itself is acting as a
middle man and pulling the ads and inserting into the HTML via scripting. But
that's a lot more work for developers to do, as well as more bandwidth and
overhead. I don't know if those sites are able to tailor ads to individual
users when they do this - they would need some sort of identification to pass
to the ad server so the ads on those sites _might_ be generic, not sure.

But that's my observation, FWIW.

------
psykus
Don't they host their own ads? Something I wish more websites would do instead
of letting ad networks stomp all over the page with whatever
Javascript/Flash/viruses they want.

~~~
commoner
It's not surprising that Facebook serves its own ads, considering that it's
one of the top 2 digital ad networks by revenue in the US. Google does the
same for its sites.

Facebook and Google have a duopoly on the online ad market, with a combined
60.9% market share. Amazon is #3 with just 7.6%.

[https://www.emarketer.com/content/facebook-google-duopoly-
wo...](https://www.emarketer.com/content/facebook-google-duopoly-won-t-crack-
this-year)

------
jesperlang
The main news feed is such a toxic space anyway so I just blocked it in
general with this uBlock filter:

www.facebook.com##div[id^="feed_stream_"] > div

------
Cougher
Commenting about some of the comments . . .

Yes, ads are what keeps facebook and other websites running, but there's a
blurred line that crosses from offering content for users to offering users as
product. To attract readers, they provide content that has value. Then they do
everything in their power to distract you from what you came for. When the
distraction is too overpowering and irritating many people will complain and
leave. It doesn't necessarily mean that we don't understand the money model;
it's that we obviously are not going on the internet to see ads that take
primacy over our online experience.

The line may be blurred, but facebook users are not facebook's customers; they
are the product. Facebook offers this product to the businesses that pay for
access. Inasmuch as facebook focuses on an engaging user experience, it's only
to ensure that they maintain their product so businesses keep buying it. It's
interesting how this product maintenance has evolved: like news or reality
shows or contest shows, the aim is to introduce tension, and in the case of
news topics, anger, which oddly keeps people coming back for more. The aim of
providing an engaging user experience has morphed into providing an addictive
user experience. And like most addictions, what started out as an enjoyable
pleasure transforms into something that controls and destroys us to varying
degrees.

~~~
dhimes
I don't mind ads. I revolt against tracking.

------
veselin
Yes. This is horrible behavior from Facebook. I had a similar problem finding
a working extension that blocks fbclk id. Well, I found one, but I am not sure
I would want to share it, because the facebook engineering team may go after
it as well.

This also renders nil the argument about "don't use the product if you don't
like their (ad) practices". Tracking across websites without consent is
illegal in most of Europe, yet they do it extensively.

~~~
edf13
Devils Advocate... why is it horrible behaviour from Facebook? It's their
product which needs to be paid for by Ads and they need to prevent Ad Blockers
from stopping these from being served. So in their defence - any technical
work around is fair on their part.

~~~
veselin
Nobody forbids them to put ads. However, there are laws (not even talking
moral here). If you explicitly download a tracking blocking extension, you
want to opt out of tracking, which is required by law that they provide.

What I am saying is that not only they track you, but they explicitly break
the top extensions that fix this. From this point of view, I have no regret
for any of their ads being blocked.

------
shmerl
Sounds like if CSS could allow matching by patterns, it could still block it
out? I.e. something regex / wildcard like? Though performance probably would
suffer.

More advanced ad blocker can probably use some AI, that could be trained with
user's hints about what is an ad. Or it can use some OCR for that purpose. If
you can recognize that it's labeled "Sponsored", so can ad blocker
potentially.

~~~
oferzelig
It's tricky even for Javascript.

~~~
jameshilliard
Not really, you just need a recursive filtering algorithm such as this:

[https://github.com/tiratatp/facebook_adblock/blob/master/src...](https://github.com/tiratatp/facebook_adblock/blob/master/src/main.js)

------
goatinaboat
To me this is very simple, if someone installs an ad or tracking blocker then
they are explicitly withdrawing consent, there is absolutely no ambiguity
about it. Doing it anyway or de-anonymising them or anything else is
impossible to do without equally explicitly knowing that you are violating
consent. And every Facebook employee must know it.

~~~
clarkenheim
You gave consent to see ads when you signed up. Why would the presence of an
ad blocker withdraw that consent?

~~~
goatinaboat
Because GDPR states that consent can be withdrawn at any time, and that
provision of services can not be tied to consent. That’s the law here in
Wales.

~~~
madisfun
GDPR requires consent for the processing of the personal data. Displaying an
ad per se is not regulated by GDPR, and does not require consent. Though
personalization of this advertisement requires processing of the PII, and thus
it is supposed to be regulated.

Facebook UI is full of dark patterns, but it is possible to withdraw consent
through settings: www.facebook.com/ads/preferences/

------
aaron695
I assume this problem is the same reason why accessibility programs suck?

Given the billions that could be saved by making programs that interpret web
sites rather than programmers learning and writing for accessibility I'd hope
it's because it's impossibly hard, not because no one will create it.

I'd also help with testing......

------
joestr
Question for anyone in the know: Is this allowed, from an accessibility point
of view? I'm just wondering how someone with a screen reader would know it's
an ad? (Or are screenreaders more advanced than I think, and would actually be
able to read out 'sponsored')?

~~~
mehrdadn
AFAIK it's not about the screenreader, but about the browser. The browser
knows these aren't visible, so I don't expect it would have any reason to
report them to the accessibility interface (IAccessible et al.).

------
hirako2000
I've put down the steps to kill all the junk out. “Customize your Facebook
Experience” by Hirako2000
[https://link.medium.com/6q6LZgGV61](https://link.medium.com/6q6LZgGV61)

------
elierotenberg
It reminds me of a lightning talk I gave at ReactConf some time ago :)

Basically forward-shuffling the component tree to produce HTML that will be
really hard to match using CSS Selectors usually found in adblockers and other
DOM-targeting scripts.

Code: [https://github.com/elierotenberg/react-
armor](https://github.com/elierotenberg/react-armor)

Video:
[https://www.youtube.com/watch?v=n63XXHY4A7I](https://www.youtube.com/watch?v=n63XXHY4A7I)

------
jakub_g
For more crazy adblocker avoidance solutions found in the wild, check this
presentation from JSConfEU 2019 from an ABP employee:

[https://2019.jsconf.eu/shwetank-dixit/block-unblock-block-
ho...](https://2019.jsconf.eu/shwetank-dixit/block-unblock-block-how-ad-
blockers-are-being-circumvented-and-how-they-are-fighting-back.html)

[https://www.youtube.com/watch?v=Vk9bPDaZELQ](https://www.youtube.com/watch?v=Vk9bPDaZELQ)

------
maury91
I wrote a similar article some time ago with a look at how to detect them and
remove them from the DOM. It was mostly for didactic reasons.

[https://medium.com/hackernoon/how-i-get-rid-of-the-new-
spons...](https://medium.com/hackernoon/how-i-get-rid-of-the-new-sponsored-
facebook-posts-138d013f4bbe)

but my approach was to use Javascript instead of CSS

------
kalado
Not only the ads. I once recreate the feed for a university project. Just take
a look at the sources. Every element is completely obscured, every class and
id is just long random strings.

------
rustybolt
Nice breakdown. If I open facebook I can see the 'sponsored' as plain text
right there in the developer tools... It might make a difference that I'm
using chrome in Dutch?

------
tiku
Why can't AI solve this problem for us. It should be fairly simple now to make
a bot "read" words just like us instead of using CSS/HTML/JS to block ads.

------
craigds
I wrote a greasemonkey script that runs every 250ms and blocks these. It might
be hard with CSS but it's (almost) trivial with a spot of JS

------
jk27277
[https://socialfixer.com](https://socialfixer.com)

But is not as good anymore as it used to be

------
a_imho
How the narrative that content blockers are a non threat has fallen.

------
yccheok
Don't let Facebook get away with this!

------
vector_spaces
I have seen a similar technique used to build paywalls for research papers
that display obfuscated "previews" of the article you clicked on beneath the
"pay for access" banner

------
asow92
just stop using facebook. no more ads.

------
mesarvagya
Or you can use Pi-hole and remove any and all ads :)

~~~
dest
Uh, no. Pi-hole is a DNS-based ad blocker, while the ads we are talking about
are served by first party.

~~~
Jamwinner
Just block all of facebook and their CDNs. Problem solved.

Sure, that also kills facebook access, so two birds with one stone!

------
1propionyl
I'm surprised I haven't seen a single comment say what ought to be the
obvious: the easiest way to never see Facebook ads is to just not use
Facebook.

I should hope I'm preaching to the choir, I'm sure, but... quitting really
isn't as hard as you tell yourself it is.

It's not as essential as you think it is.

~~~
tomashubelbauer
I'd like to add that it is not necessary to leave Facebook to not use
Facebook. I have a FB account and I'll never close it, because I like having
my username on all online services I might use if once. That being said I only
have it logged in at a home desktop, not my phone, not any work machine. I use
it for like two minutes weekly, one to check a few specialty groups I'm a
lurker in and two to co-admin a page with a group of my friends where I once
helped promote a post because the UX of doing so is too shitty for normal
people wanting to bother navigating it. Facebook has had no effect on my
mental health and it has a marginal benefit of being a kinda up to date
contact book, even if it is getting worse at that. But that's it. You can have
a Facebook account and only use it when it benefits you and not Facebook.

Edit: Oh and I use it in a Firefox Facebook container so I'm not at all
worried about it tracking me online.

~~~
s_dev
>Oh and I use it in a Firefox Facebook container so I'm not at all worried
about it tracking me online.

You think that once you log in to FB in a container -- Facebook can't track
you? Those container details are now appendage to your online fingerprint as
far as Facebook are concerned.

Containers only work if you don't actually log in to such services. The only
sure way for FB to not track you is to not use FB at all -- even then it
requires other steps too as they'll be building a shadow profile on you.

~~~
tomashubelbauer
You're of course correct, they can still see that I'm a container user because
they can only even see me accessing Facebook directly, but fail to see any
activity from other pages loading the like buttons and their other tracking
crap. So that's a data point to them. Another is that I've disabled the "app
platform" or whatever they call it in my profile settings before, so I didn't
see their online tentacles to being with and keeping them contained is just to
keep them honest (the "do not use app platform" toggle is similar to "do not
track" in this regard). But they can't do much with the profile they build on
me: they know I'm a container using, ad-blocking, Facebook-barely-using, well-
off (I participate in a group about an expensive hobby) dude who they failed
to generate a single click off in their entire lifetime. That's not-being-
tracked enough for me. Getting protection from tracking beyond that is not IMO
scalably solvable using techological means and crosses over to the regulatory
realm.

------
cowbird
A year ago, I was on Facebook constantly. At one point, I realized that I
could do better things with the time wasted there so I installed News Feed
Eradicator (I learned about it in a podcast. I think a Peter Attia podcast,
but I could be wrong). Anyway, now Facebook is alien to me. I still have it on
my laptop, and if I need to search something of for someone,I can use
Facebook. But I don't have access to scrolling. I don't have a wall anymore.
lol. I don't have the app on my phone though. I feel super.

------
sub7
Someone should write this: an blocker that uploads a screenshot of the page,
use OCR to find 'Sponsored' and send back coordinates of the box that can then
be painted over client side.

Obviously OCR is one of many strategies and as long you kept the code for
these adblock strategies open source, it would work on all visual ads.

Train an AI with a billion screenshots of pages with ads marked out. It should
be able to handle 90+% of ads easy.

------
zupreme
Current tech available is already well beyond this, but simply needs to be
properly applied.

Facebook Ads look like ads, by design. Shift gears to IMAGE RECOGNITION and
success will follow.

------
paggle
I cannot understand the people who believe it’s their absolute right to use an
ad blocker (a position I agree with) but then don’t believe it’s the site’s
absolute right to decide whether or not they will serve you content.

~~~
LukeWalsh
There seems to be a blackjack analogy here. Don’t let the boss catch on!

