
How Google Chrome’s ad blocker works - d2wa
https://www.ctrl.blog/entry/chrome-adblocker
======
mabbo
I think there's good intentions by Google here. That said, let's talk about
the worst-case scenario, the thing that Google could actually do that is
entirely anti-competitive.

Step 1: Google finds a large number of competitors who are doing pretty well
playing by their rules. Google finds some trait they all have in common.
Google then modifies their own ads to not have that trait.

Step 2: Google declares the given trait "not meeting the Better Ads standard",
"clarifies" the standard (or their implementation of it), and blocks all their
competitors ads. Their own ads of course are still meeting the new set of
rules, as they knew the change was coming. If the Coalition for Better Ads
disagrees or won't be bullied by the Goliath of advertising, Google will go
form their own version of it claiming to be more strict, "for the sake of the
users".

Step 3: After a few weeks or months, the competition will modify their ads and
eventually everything will be back to normal. That's when Google goes back to
step 1.

The final Step 4 is the opposite. Find a trait that none or few competitors
have in their ads but would potentially increase click-through rates. Modify
the rules to say that doing this thing is okay, and oh hey Google ads are
doing that thing as of right now.

Why all of this? Because Amazon is growing in the advertising business and is
ruthless. "Your margin is my opportunity". So Google needs an arsenal of dirty
tricks up their sleeve.

Do I really believe this is the plan? No. I think Google are legit trying to
meet a user need that exists. But I also know they're a publicly traded
company with growing competition in a fierce industry. It's not what they plan
to do that worries me, but what they can do when up against the wall.

~~~
drngdds
I feel like there's a simpler explanation that's still not 'good intentions':

1\. Lots of people are using adblockers to block all ads, including Google's,
and they don't like that.

2\. People mostly install adblockers to block really annoying ads.*

3\. By building in an adblocker that blocks annoying ads, people will stop
installing full adblockers that also block Google's ads.

*There are real issues with non-annoying ads, like tracking, but I don't think most people know or care very much about that.

~~~
eli
If people no longer feel the need to install a stronger ad blocker why is that
bad?

~~~
rdiddly
They're doing it, not to block ads, but to make sure ads reach you. So the
question gets philosophical in a hurry. What is the "goodness" of an otherwise
generous act done for self-serving reasons?

Is it good or bad to write a check to an orphanage for the publicity?

Is it good or bad to save someone's life because they owe you money?

Is it good or bad to block certain ads to make sure other ads still reach you?

~~~
BoiledCabbage
> Is it good or bad to block certain ads to make sure other ads still reach
> you?

If there is a growing product that works better, and fully blocks ads and your
goal is only to quickly take over the market and do a worse job then I say
'no' that's not being altruistic...

If they put up a big banner saying "only works half as well at blocking ads as
the competition" then maybe it's a little better.

------
gorhill
> Google appears to be shipping the entirety of EasyList and EasyPrivacy;
> which includes blocking rules for Google’s own AdSense and DoubleClick
> advertisement platforms as well as Google Analytics, and other Google
> services.

This is confusing. EasyList is not bound to the "Better Ads Standards", its
purpose is to block all ads, regardless of their perceived intrusiveness.

Also, I failed to understand why would EasyPrivacy be used: its purpose is
outside that of "Better Ads Standards".

The article further claims:

> Google’s ad blocking capabilities will be on par with the best tools
> available from day one.

How is this even possible if the web sites targeted are only those which are
not compliant "Better Ads Standards"?

The blockers making use of EasyList do not care about "Better Ads Standards",
so the result can't possibly be "on par with the best tools available"[1]

I would like to know how the author of the article got the information about
EasyList and EasyPrivacy, I find it difficult to believe these would be used
by Chrome's integrated blocker given its claimed purpose.

* * *

UPDATE: After looking around a bit, I understand better now how this works. As
per ghacks.net[2], excerpt (my emphasis):

> Google Chrome will download rules from EasyList and EasyPrivacy at regular
> intervals and _apply them to sites that failed reviews_ automatically.

So EasyList/EasyPrivacy are used on sites which fail to comply with "Better
Ads Standards".

In retrospect I suffered reading comprehension, the sentence in the article
was clear enough:

> These lists are used to limit what resources are loaded on websites
> identified by Safe Browsing as being non-compliant with the Better Ad
> Standards.

* * *

[1] Add to this that EasyList is just a complementary list on top of more
advanced blocking features found on blockers such as uBlock Origin or Adguard.

[2] [https://www.ghacks.net/2018/02/02/details-about-googles-
ad-b...](https://www.ghacks.net/2018/02/02/details-about-googles-ad-blocking-
integration-in-chrome/)

~~~
lucb1e
> apply them to sites that failed reviews automatically

Wait, sites that failed automatic reviews or sites that somehow
"automatically" failed reviews (sounds like, because of 'some reason' they
aren't eligible so they default-fail). Because the latter would, of course,
play right into Google's hand.

~~~
andrewaylett
Automatically applied to sites that failed whatever review Google chooses to
do.

------
danbruc
As long as your are not serving _visually_ intrusive ads you can still track
the shit out of users [1] under the Better Ads Standards [1]. If you are
annoyed by flashing ads this is an improvement, if you are concerned about
your privacy this does not really help at all. Sure, Chrome will seemingly
also block trackers as some kind of side effect when blocking visually
intrusive ads but just make your ads pass the visual standards and you are
back in tracking business.

[1] Unless I failed to find the relevant rules.

[2]
[https://www.betterads.org/standards/](https://www.betterads.org/standards/)

------
manigandham
This is 100% about reinforcing Google's ad monopoly (along with the AMP
initiative).

Google owns DoubleClick which is the biggest adserver on the planet and the #1
source of all the bad intrusive ads in the first place. This could've been
easily solved years ago.

~~~
deckard1
Yep. And you can see this in a lot of what Google does.

Most people think Google's push for HTTPS, both in Chrome and SEO rankings, is
somehow related to privacy.

It's not. It's about net neutrality and it's about third parties being able to
switch out Google's ads for their own, on-the-fly, using a middleman.

I interviewed with a stealth-level startup a few years back. They were
developing a product, similar to a WiFi router, that would be installed on
premise and sit there, filtering out Google/Facebook/etc. ads and replacing
them with ads that the owner of the box wanted. You can imagine this box being
installed in Starbucks, airports, libraries, and everywhere else. Cutting into
a massive chunk of Google's ad revenue.

The Time Warners, AT&Ts, and Verizons of the world would also be doing this,
for HTTP traffic.

We are getting the benefits of privacy. But it's not because Google has good
intentions.

~~~
pritambaral
> I interviewed with a stealth-level startup a few years back. They were
> developing a product, similar to a WiFi router, that would be installed on
> premise and sit there, filtering out Google/Facebook/etc. ads and replacing
> them with ads that the owner of the box wanted. You can imagine this box
> being installed in Starbucks, airports, libraries, and everywhere else.

Funny, I was a similar boat once. They weren't a startup, yet. Good for them,
because in both meetings I had to tell them their business idea was impossible
unless they broke prime factorization. I was surprised I had to meet them the
second time.

Oh, and their business idea was a little more intrusive than merely replacing
ads. They wanted to be able to read people's emails and Facebook data and
serve targeted advertising based on that.

~~~
mrguyorama
The intrusive reading of emails is exactly what gmail does, isn't it?

~~~
kretor
Gmail doesn't do this anymore: [https://blog.google/products/gmail/g-suite-
gains-traction-in...](https://blog.google/products/gmail/g-suite-gains-
traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-
align/)

------
rocqua
How will this not lead to google strangling their competitors. Are we really
going to have to just trust them to use this fairly? Will we really expect
google to interpret the Better Ads Standard without any bias, treating their
own ads equally to other ads?

Maybe they will be good, but I for one am not comfortable with this. Imagine
what happens when chrome decides Facebook ads deserve to be blocked.

~~~
rmrfrmrf
According to the article, this is more about google's competitors strangling
_them_ (by being so intrusive that customers consider full ad blockers to be
necessary).

~~~
bostik
Credit where it's due - they're right. Full ad blockers _are_ necessary.

~~~
dhimes
And I don't expect this to change that, frankly. They say nothing about
blocking the trackers, and that's what needs to be blocked.

------
TravelTechGuy
Google telling us what "better ads" are is like a drug dealer lecturing you
about crack quality control. They could have solved it years ago, but made
tons of $ by letting the ad space become the wild west of nagware, malware,
and tracking bonanza.

If they were to provide a real adblocker, allowing people to opt-in to ads on
sites they like, while blocking everything else, I'd have considered it, on
the basis that any technology running in-browser must be more fast/efficient
than an extension. But this initiative is just them trying to get people to
drop their adblocker and get tracked again.

All things being equal, I think I'll keep my uBlock extension - at least until
Google kicks it out of their web store. I believe that would be the next
logical step for them :(

~~~
jordigh
To me, "better ads" sounds like "humane torture" or "acceptable manipulation".

The principle of ads is repugnant to me. There's no way to make it better. I
don't need to be psychologically manipulated to buy things I don't need.
There's no way to make that manipulation ok. What Google considers acceptable,
I consider subtle and even more manipulative, trying to sneak it in where most
people won't object to the intrusion.

~~~
neolefty
Any thoughts on how web search should be funded, in an ideal world, if ads are
inherently repugnant?

~~~
jasonkostempski
Web search shouldn't be centralized or closed source, it should be made of the
same stuff Linux is. Whatever Linux does to keep existing, there should be a
community driven web search project that mimics it.

~~~
neolefty
How could openness coexist with adversarial SOE? Genuine question -- I think
it's possible, but how?

For example, "Optimizers" currently have to guess at what Google is doing, but
if the system was open source, they would know exactly.

For another example, modern cryptography actually _benefits_ from openness. Is
there a similar possibility for Search?

~~~
jasonkostempski
I have no clue really but I'd like to see what the results would be like if
the presence of anything that makes a site money would count negatively
towards it's ranking. Any eCommerce site unless the search is something like
"where to buy...". Completely disqualify any site with ad network and tracking
scripts. I'd also like to see "text/plain" given the highest ranking. There's
not much incentive to game the system if you can't make money off it.

------
kodablah
Which is it, the super secret consortium that won't even let you download the
full list of bad sites, or Easy List/Privacy? Why don't they just use EasyList
and report offenders there instead of this new consortium? The answer to that
rhetorical question will let you know why I'll remain on uBO. They didn't need
to build this in, but they did and gave the current ad-blocking community the
finger instead of support.

~~~
mastax
>Which is it, the super secret consortium that won't even let you download the
full list of bad sites, or Easy List/Privacy? Why don't they just use EasyList
and report offenders there instead of this new consortium?

The lists serve different purposes. EasyList is a lit of ad-serving URLs to
block. The uh, consortium list is a black/white list of which sites don't
follow the standards. The standards are not about bad ads, but about sites
that use ads in bad ways. The standards can't be automatically enforced since
software can't reliably determine if an ad is a popunder or otherwise
intrusive due to placement. Sites would quickly use CSS/JS hacks to work
around the classifier.

~~~
kodablah
EasyList is also a list of ad-serving sites to block and a list of elements to
hide. Can you help me understand why the blacklist can't be just placed in a
normal ad blocking list like EasyList? If it's by site anyways, I'm not sure
the actual difference for the blocker itself. It's not like the EasyList
standards can be automatically enforced by software either.

I think "serve different purposes" could be rephrased to "serve different
overseers". I can't find a reason for the tech difference.

~~~
falcolas
They don't want to block ads on sites, unless the site is on the other list.

That is, if site foo.com and bar.com both serve ads, but foo.com is on the
"blacklist", the ad blocking will be enabled on foo.com. However, ad blocking
will remain disabled on bar.com.

It's not Google's intention to block all ads on all sites - only ads on "bad"
sites. If they can reduce the number of adblock installs by reducing the
overall number of invasive ads, they can keep their own ad business from
folding.

~~~
kodablah
Ah, I see now, EasyList is selectively applied after first determining whether
the site "deserves" it. That's an evil use of the hard work of EasyList
maintainers IMO. I wonder if I can find a way to make Chrome think every site
is "bad". If not, uBO still for me.

~~~
username223
Yeah, this seems like it already is, or will soon become, solidly evil. If
Google decides to flag your site, all of a sudden you don't get ad revenue
from anyone. An AdWords sales-drone can then contact you to explain how you
can remove yourself from Google's "naughty" list, e.g. by giving them more
inventory, or giving their competitors less.

------
chaz6
I wouldn't trust a burglar to install my security system. I won't trust Google
to block ads.

~~~
jacquesm
You can trust a burglar to install a security system that will keep _other_
burglars out, but you can be 100% sure that you will not be able to keep the
installer out, in fact you are just about giving them an incentive to rob you
blind at the first opportunity. Google will do an amazing job at blocking
competitor ads.

~~~
lern_too_spel
Then why did the competitors, including the top competitors in terms of
revenue, sign up to be part of the consortium?

I see this as a shot at piracy sites, if anything. Since they cannot join
reputable ad networks, they join disreputable ones that don't even try to
police their ads or publishers and show shady and misleading ads. Those will
all be blocked now, choking the piracy sites of revenue.

The primary beneficiaries are content producers. The secondary beneficiaries
are Internet companies that are hit by botnets.

~~~
jacques_chester
> _Then why did the competitors, including the top competitors in terms of
> revenue, sign up to be part of the consortium?_

They don't have a choice. Either they join the cartel or they watch their ads
vanish entirely[0] from the most popular browser.

I don't think this is an either/or thing. Google is doing something with
positive externalities. But it also so happens to align 100% with their
commercial interests.

[0] edit: "entirely" is hyperbole. But even a low percentage is worth giving
in for.

~~~
lern_too_spel
> Either they join the cartel or they watch their ads vanish entirely[0] from
> the most popular browser.

Why do you think they didn't want to join? They get the same benefits as
Google and the Internet at large. I'm having a hard time following your logic
for why this is Google attacking its competitors if its competitors are
unaffected by the change.

------
carlosrg
This is a good thing. Advertising is one of the most effective ways companies
have to let people know about their products - I'd say they're essential in
free market economies. But having ads is one thing and completely disrupting
the user experience is another. Finding a balance is a better approach than
blocking all ads.

~~~
SllX
Two things about ads.

They don't seek to inform you so much as they seek to inform you that
something exists whilst manipulating your emotions to get a particular
reaction out of you and millions of other people. This is particularly blatant
in AV ads.

The other thing, mainly regarding software ads, is they don't seek to inform
you so much as manipulate you whilst tracking your every move to guarantee
that the ad was effective. This is particularly blatant with the Google and
Facebook ad networks, but pretty much almost any 2-bit ad company you've heard
of on the web at least tries to do something similar.

So in the end, advertising has at least two major problems with trying to
either 1. manipulate you directly through your emotions or 2. manipulating
your computer bandwidth and CPU time to violate your privacy and oftentimes,
security.

Regarding #1, there are always going to be people that think they're smart
enough, intelligent enough, or logical enough that they will never fall prey
to this vector of advertising, and almost universally they are wrong. I don't
doubt some few exceptions exist, I just don't think I've ever actually _met_
someone who is an exception, nor am I under any illusions that I am. Your best
defense is to cut ads out of your life to greatest extent possible. You'll
probably never cut bus ads out of your life, if you at all enjoy city living,
but you don't have to let advertisers into your home either.

How do you find out about things after that point? If you are at all social,
read any kinds of news sites, invest any money into markets, have any kind of
skin in some kind of game, or engage in any kind of recreational activities,
you'll have other channels of information. Generally the signal will be of a
much higher quality than if you were personally bombarded with advertisements
intentionally seeking to cut out a large slice of your overall attention
bandwidth every single day.

~~~
ams6110
Even before ad-blockers, I have never intentionally clicked on an internet ad,
whether in search results or on a website. These days, I block ads with
extreme prejudice so I never even see most ads.

But I don't hate the concept of advertising. I don't deny being influenced by
ads, or even sometimes finding them informative. I just reject being tracked
and targeted.

~~~
tyler_larson
I have adblock on my primary chrome profile, but occasionally browse using a
profile where it is disabled because [reasons]. My experience has been
generally pleasant if you discount the low-quality ads that would be blocked
under this new scheme.

Instead, I get ads for interesting new components on DigiKey or Mouser, or the
similar, and I find myself clicking on ads several times a week because I'm
genuinely interested in what I see -- it's like a news feed for unusual
devices.

Imagine if your Twitter feed was served several tweets at a time embedded in
other sites you regularly visit. You could argue it's a distraction, but but
it's far from unpleasant. "Personalized ads" work a lot the same way for me.

------
MereInterest
Google's incentives here are still antithetical to my own, so I'm going to
stick with uBlock. For example, on Google search, ads masquerade as legitimate
search results. These used to be highlighted in light yellow, clearly marking
them as different from organic search results. Now, they only have the word
"Ad" in light grey text. This notice is on the right, intentionally where it
will be overlooked when reading through the titles of each result.

I can't imagine that Google would start blocking their own ad network, let
alone their own ads. Therefore, I'm sticking with an ad blocker that I
control.

~~~
nothrabannosir
_> These used to be highlighted in light yellow, clearly marking them as
different from organic search results._

The specific shade of yellow was indiscernible from background white on a
cheap laptop at almost any angle. I wish I'd taken a photo when I noticed. I
knew people who had never even noticed the yellow, at all, let alone
understood it was ads.

I know, Never Attribute To Malice and all that, but hot damn, that must have
been a _massive_ multi million dollar move of "ignorance".

~~~
quesera
Google is the company that user-tested 41 shades of blue¹.

Malice or not, that yellow was surely intentional, and working as intended.

[1] [http://stopdesign.com/archive/2009/03/20/goodbye-
google.html](http://stopdesign.com/archive/2009/03/20/goodbye-google.html)

------
arielm
To have an ad network control so much of web traffic and then decide which ads
to block is just absurd.

If the chrome team and google’s ad teams were not controlled by the same unit
that primarily makes money from ads it would have been ok, but given that they
do, what incentive will they have to block their own ads and how much more
powerful is it making their own network?

Sadly, chrome is still the easiest browser to use, especially as a developer

~~~
Andrex
In your opinion, would spinning off Chrome into its own company under Alphabet
be a possible solution?

~~~
hyperdimension
Not OP, but that seems strange to me. Chrome is a product, not really a
business. I can't see any way for them to make money, besides maybe enterprise
deployments.

~~~
wmf
If Firefox makes $500M per year from search referrals, Chrome could make over
$1B. Chrome would be very profitable as an independent company.

------
trackingpixel
Full disclosure: I work in ad-tech.

1\. Why do you guys downvote civil, informative posts that just happen to be
philosophically different than yours? Seems anti-knowledge, and a net negative
to HN.

2\. What do you think pays for the internet? This is the first time I've ever
engaged in a discussion, but I've been lurking for a year or two, and at least
half of the links shared in the comments are ad-supported. Probably more.
Sharing information is going to be more difficult when the money dries up and
everything is behind a paywall.

3\. People are annoyed that they see the same ad over and over again, but
"tracking" is a cardinal sin. How is this supposed to work?

~~~
ericheymer
The notion that advertisements pay for websites is entirely fabricated. Recent
research shows massive amounts of fraud with the involvement of the ad
industry which eats through the money flowing through the ecosystem. See
[https://www.buzzfeed.com/craigsilverman/ad-industry-
insiders...](https://www.buzzfeed.com/craigsilverman/ad-industry-insiders-are-
connected-to-a-fraud-scheme-that?utm_term=.cqVM0x3aYJ#.pnzYnK19rE) and
[https://blog.confiant.com/uncovering-2017s-largest-
malvertis...](https://blog.confiant.com/uncovering-2017s-largest-malvertising-
operation-b84cd38d6b85).

~~~
wweee
I don't see how the two links you posted supports the assertion that the
"notion that advertisements pay for websites is entirely fabricated."

First link is about fraud against advertisers, selling them fake ad
impressions. Second link is about a sophisticated scheme to deliver malware to
the end users using the ad ecosystem.

How does that dispute the fact that people who have websites can profit from
putting ads on them?

------
kyrra
If you want to go read the source yourself, I believe this is the
implementation:

[https://cs.chromium.org/chromium/src/extensions/browser/api/...](https://cs.chromium.org/chromium/src/extensions/browser/api/declarative_net_request/)

And the code reviews cover the feature are tagged with DNR: [https://chromium-
review.googlesource.com/?polygerrit=0#/q/Dn...](https://chromium-
review.googlesource.com/?polygerrit=0#/q/Dnr)

Edit: this may just be the net blocking code.

~~~
kbwt
Now I'm half tempted to serve up ads from a path in the form '/a{n}b/\d+' with
sufficiently large n to bring the O(mn) std::string::find subpattern matcher
to a crawl when it encounters my harmless 'src="/a{m}"' iframes. Preferably n
> 32K/2 to blow through L1 cache.

~~~
kodablah
Which code are you looking at? I see it uses
[https://cs.chromium.org/chromium/src/components/url_pattern_...](https://cs.chromium.org/chromium/src/components/url_pattern_index/url_pattern_index.h).

Also, from what I gather from their docs, this is only for the ad-block-filter
formatted lists. For their own super-secret-better-ads list, they use safe
browsing lists which use a hash-some-then-phone-home approach IIRC [0]. I
mean, even Mozilla that uses the safe browsing lists says at [1] that the
internal documentation [2] is only available under NDA.

0 - [https://developers.google.com/safe-browsing/v4/local-
databas...](https://developers.google.com/safe-browsing/v4/local-databases)

1 -
[https://wiki.mozilla.org/Security/Safe_Browsing](https://wiki.mozilla.org/Security/Safe_Browsing)

2 -
[https://mana.mozilla.org/wiki/display/FIREFOX/Safe+Browsing](https://mana.mozilla.org/wiki/display/FIREFOX/Safe+Browsing)

~~~
kbwt
This is the call stack I'm looking at:

#0
[https://cs.chromium.org/chromium/src/components/url_pattern_...](https://cs.chromium.org/chromium/src/components/url_pattern_index/url_pattern.cc?l=93)

#1
[https://cs.chromium.org/chromium/src/components/url_pattern_...](https://cs.chromium.org/chromium/src/components/url_pattern_index/url_pattern.cc?l=227)

#2
[https://cs.chromium.org/chromium/src/components/url_pattern_...](https://cs.chromium.org/chromium/src/components/url_pattern_index/url_pattern_index.cc?l=595)

#3
[https://cs.chromium.org/chromium/src/components/url_pattern_...](https://cs.chromium.org/chromium/src/components/url_pattern_index/url_pattern_index.cc?l=653)

~~~
kodablah
Ah, I didn't dig, but I'd contend that URL length limits would apply and the
worst you could do is slow down a client's browser in the same way you could
just by multiplying the number of attempted requests to a blockable URL.

------
staunch
Big Brother Google has a new definition of "ad blocker" with the novel feature
of _not_ blocking ads.

[https://en.wikipedia.org/wiki/Doublespeak](https://en.wikipedia.org/wiki/Doublespeak)

------
ultim8k
Seems like they are using their dominance in browser market in order to kill
the competition in ads market.

~~~
pknerd
that seems the case.

------
d2wa
Here are test pages that can be used to trigger the adblocker via Safe
Browsing.

[http://testsafebrowsing.appspot.com/s/subresource_filter_des...](http://testsafebrowsing.appspot.com/s/subresource_filter_desktop.html)
[http://testsafebrowsing.appspot.com/s/subresource_filter_mob...](http://testsafebrowsing.appspot.com/s/subresource_filter_mobile.html)

------
ams6110
Slightly tangential, but:

> ... Google Safe Browsing service. Chrome checks every website you visit
> against a list of malicious websites that it periodically downloads from
> Safe Browsing.

So I have always disabled Safe Browsing because I assumed it was sending all
my browsing activity to Google in real time to be checked. But this sounds
like it's checking locally from a downloaded list. Anyone know if that's
correct?

~~~
kodablah
It's half and half from what I'm reading. It checks a local list for the
sha-256 hash or partial hash. Then, if found, it phones home with the partial
hash it found.

If you don't want to read [0], I think the Golang parser/lookup at [1] is a
reasonable interpretation of what they're doing, but not sure. You can see
there that the hashes generated are of different-host-combinations +
different-URL-path-combinations. They do the partial hash check in a DB
(local, downloaded periodically). If there's a partial hash in the DB, they
phone home w/ that partial hash for the full hashes and check if it matches.

So Google gets the partial hash of a URL it had told you could be bad. They
return the full hashes for that partial hash. We can hope (and see) that the
partial hashes do not match a broad set (and they are host possibility + URL
path combo possibility). Surely Google has something that maps the hashes to
actual URL patterns, but like the other commenter said, the partial hash you
send is only sent when it matches a local DB already.

0 -
[https://cs.chromium.org/chromium/src/components/safe_browsin...](https://cs.chromium.org/chromium/src/components/safe_browsing/)

1 -
[https://github.com/google/safebrowsing/](https://github.com/google/safebrowsing/)

~~~
magicalist
> _Surely Google has something that maps the hashes to actual URL patterns,
> but like the other commenter said, the partial hash you send is only sent
> when it matches a local DB already._

It sends the first 4 bytes of a 32 byte SHA-256 hash of the URL. There isn't a
reasonable map back for that.

------
RyanShook
I think Google is setting itself up for antitrust action. Isn’t this
essentially what Microsoft did on the desktop by blocking competitors and
priorritizing their own products?

~~~
mtgx
Google may have pushed for this, but the standards were agreed upon by the ad
industry:

[https://marketingland.com/industry-groups-self-regulatory-
pr...](https://marketingland.com/industry-groups-self-regulatory-program-
coalition-for-better-ads-226109)

~~~
jacquesm
The standards should be set by independent consumer watchdogs or the competent
(one would hope) authorities, depending on the industry to self regulate has
not worked in over 25 years, I see no reason why it would magically start to
work now.

~~~
mastax
The ad industry had no means or incentive to self regulate. That has changed.

The incentive is ad blockers. The means is "Coalition for Better Ads."

Can't trust them to fight against tracking. Can't trust them to eliminate
malvertising. Can't trust them to unblock your website in a timely manner or
give good feedback about what is wrong with it. Can expect them to keep
obnoxious use of advertising down to stop the whole industry from collapsing.

------
firebender6
This is still not going to help with websites that force you to disable
adblockers to access their content. It's especially annoying when after
disabling the site looks like a cluster of ads with information hidden in
between. It's an abusive relationship.

~~~
paulie_a
That is fine... personally those sites go on my mental block list to avoid in
the future.

------
mnm1
I hope Mozilla will do the same, only with a proper ad blocker. It's the only
thing that makes sense given the two organizations' goals and purposes. Either
that or they're loving their sponsorship money too much and there's no
difference in goal or purpose between the two organizations. Can't wait to see
if they stand up for users or lie down for money.

~~~
Sylos
If webpage owners don't make money off of a browser, they'll stop
testing/building their webpage against that browser or even block access from
it, leading to broken webpages in that broken, which is not at all in the
interest of users.

~~~
mnm1
Plenty of browsers are not supported/tested on, yet they work just fine
because they implement web standards.

~~~
Sylos
Yeah, they work fine 90% of the time. But no web browser implements all
webstandards and even less so implements them without bugs.

Google is also adding more and more proprietary APIs to their browser, which
Mozilla will not be able to implement (Chromecast, Google Earth, Hangouts) or
is adding pseudo-webstandards, which have been publicly specified, but they
did not push it through the standardization process to reach an agreement with
other browser vendors (e.g. WebSQL, File Storage API).

You're also saying "plenty of browsers". There's hardly any browsers that
don't use Trident/EdgeHTML, Gecko or KHTML/WebKit/Blink. If they use one of
those, then there's the major browsers IE/Edge, Firefox or Safari/Chrome that
webpage owners will test/build against and as a result also cause it to work
on that fork, meaning that yeah, those forks can easily implement an ad
blocker without much to fear.

But that's not the case, if you are such a major browser yourself. Then
webpage owners will notice and will not have any reason to optimize against
your browser engine anyways.

------
cornholio
> Google’s implementation is a bit different from how most extension as
> blocking is enforced at an earlier stage in the rendering processes than
> extensions have access to.

Nice to hear adblocking performance is set to have a huge boost as soon as
extension authors figure out how to hijack the filter to return a BETTER_ADS
violation for all sites.

------
nibnalin
I’m all for ad-blocking and the existence of ad blockers.

But I really don’t like the idea of corporations making decisions about what
ads we get to see. It’s a slippery slope to go down. The existence of an
entity which may even be “blamed” by content creators for taking their
money(not exactly, but to some extent) for not meeting a standard they
virtually have very little control over is almost un-democratic. And I won’t
be surprised if there are some “oops, these guys meet all criterias but are
still getting blocked” unintentionally(or even intentionally) by Google.

I don’t use Chrome very often, but I’d recommend everyone to disable this
feature when it ships(and use ublock/other open source blockers if one has
to).

------
influx
The owners of DoubleClick are going to protect you from obnoxious ads! That’s
So Googly!

~~~
Splines
"Focus on the customer and all else will follow"

oops

------
supertiger
It's never good to have someone as both a player and a referee in the same
game.

------
Corrado
I use an Ad blocker and I kinda regret it sometimes. Most of the time the
blocker keeps me from seeing annoying, repetitive ads for things I have zero
interest in learning about (trucks, loans, cash back, etc.)

However, I have realized that by blocking all Ads I am missing out on some
cultural things, events that I want to know about. Movie information
(Avengers, Hellboy, etc.) is one thing that I don't get informed of anymore. I
didn't even see the latest Spiderman Homecoming movie in theaters because I
had no idea it was even out until it was too late. I'm sure there are other
things that I'm missing out on, but it's hard to know what you don't know.

Anyway, I think Ads are not evil or bad but they do need to be targeted
better. If the Ad companies can figure out how to tell me about things I care
about, or will possibly care about in the near future, then I'm OK with being
exposed to them. If anyone should be able to do this it would be Google (they
know everything about me). So I turned of uBlock Origin and started using
Chrome's built-in blocker. So far it's been terrible; I'm seeing all kinds of
Ads for things I just don't care about. I think I'm going back to my blocker.
:/

~~~
Feniks
I know what you're talking about and feel the same.

If you block marketing you are blocking a part of society. It reminds me of a
Christian friend who never watches television.

------
Animats
Can you easily modify Chrome to use a more restrictive list that blocks all
known ads?

Is there any reason you would ever want to see anything from DoubleClick?

------
mtgx
Do these standards and this Chrome ad-blocker also solve the issue of
advertisers putting crypto-mining scripts into their ads?

~~~
dawnerd
Or the minute+ unskippable ads on youtube?

------
pascalxus
I'm so glad Google is starting to put the customer first again. I hope the
media gives credit where it's due, instead of this non-stop negative
sensationalistic media we've been getting.

I for one, hope there's some kind of blocking for embedded videos. I haven't
had luck with the existing solutions out there.

~~~
takeda
As someone here said, don't trust a burglar to install a security system.

Google is doing this to make sure their ads will be displayed. If chrome has
built in ad blocking many people won't feel the need to install ad blockers
that block all ads.

Another point mentioned is that this could be used in the future to hamper
business of their competitors. It is very unlikely that this is why it was
created, but don't forget that Google is a publicly traded company, if they
will be pressed against a wall they will use anything available, and this
could cause a serious damage against their competitors.

------
oldpond
Google. Advertising company. If I ever have to watch advertising on the
internet, I'm turning it off.

------
534b44a
I long for the day Google asks you to disable your adblocker (uBlock, ABP,
etc.) to be able to search.

~~~
regexnerd
You are part of the problem. People should not have to give up their privacy
and expose their devices to the evil of the advert companies just to get
online. Ads are almost the number one vector for malware. Ad servers are
rarely, if ever, equipped with decent security and are frequently compromised.

Ads are a poor method for making money and the system is horribly gamed at
every opportunity. Anything worth having is worth paying for. Google and their
ilk have ruined the Internet and the general online landscape by dint of
offering "free" services that are not really free; people pay for them dearly
with lack of privacy and security and the return of a "free" service is not
worth what is given.

I have happily paid for Fastmail since 2002. They are security conscience,
responsive, and give a damn about their customers. I will use no one else.
They are very transparent with their issues and enjoy providing their use base
with information regarding their running of the company. Good luck with Google
or Microsoft giving even paying customers this level of service and
transparency.

Google have become too powerful. Way too powerful. They have their awful ads,
beacons, and trackers on most websites and people just blissfully go along
with it. I use zero Google services and block all of their tracking with a Pi-
hole and other software tools. Ditto allowing no Android devices on my
network. Getting into bed with Google in any way, shape, or form is literally
giving away your privacy for a few trinkets that are worth nothing. If it's
worth having, it's worth paying for. It's all an electronic leash...

~~~
dang
> You are part of the problem

On HN, please make your points without stooping to personal swipes.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

------
imroot
This feels like it's "DoubleClick For Publishers or Bust."

Admittedly, I've only been on the DevOps side of content marketing -- and even
at that, only on the cloud infrastructure side of it -- but, I think that just
about everyone knew that while writing your own content and then selling your
own ad inventory was ideal, if you couldn't sell your own ad inventory, DFP
was the second best play for the income.

To me, this screams, "Even if you have other ads, if they're not DFP-
compliant, we won't show them if they are from our browser."

I may be completely wrong...but, who knows.

~~~
TekMol

        if you couldn't sell your own ad inventory,
        DFP was the second best play for the income
    

If you don't sell your ad inventory, then how is DFP different from Adsense?

------
krisives
When I interviewed at Facebook almost every person I talked to said "if Google
blocks ads by default Facebook will sue them" so I expect to see a lawsuit
eventually

~~~
mcintyre1994
Out of interest how long ago was this? Asking because: "Mobile advertising
revenue is reported and according to Facebook, it represented approximately 88
percent of advertising revenue for Q3 2017 up from 84 percent in Q3 2016."
[https://zephoria.com/top-15-valuable-facebook-
statistics/](https://zephoria.com/top-15-valuable-facebook-statistics/)

Facebook seem to have done an incredibly good job of reducing their exposure
to the browser. That comes at the cost of exposure to Android, but it feels
like Google are going to find blocking Facebook ads in the Facebook app way
harder than in their website.

That's all a little bit irrelevant though because Facebook are members of the
'coalition for better ads' anyway.

~~~
krisives
December 2017

------
Ajedi32
It'll be interesting to see how sites respond to this. Will they eliminate
intrusive ads[1] from their sites entirely? Or start trying to force users to
disable their ad blockers before using the site?

I have a feeling this is going to lead to an increase in both of those
behaviors.

[1]:
[https://www.betterads.org/standards/](https://www.betterads.org/standards/)

------
guhan_ganesh
There are no annoying ads. All ads are annoying.

------
budu3
I don't think that browser should be in the business of blocking Ads. That's
the job of 3rd party tools and extensions. A browsers job is to display a
webpage as is not to alter it. At most it should scream if a man in the middle
altered my page anything more is crossing the line.

~~~
bitmapbrother
Should a browser also not be in the business of alerting a user that they're
about to visit a site serving malware and using zero day exploits or is that
also the job for 3rd party tools and extensions?

~~~
budu3
Alerting is fine. Altering the page is not.

~~~
SquareWheel
Browsers alter the page when they block popups.

------
21
When Microsoft enabled DoNotTrack by default in IE, there was a huge outrage
along the lines "how do they dare assume by default that I don't want to be
tracked on the net?"

Where is the outrage now "how do they dare assume that I don't want to see
annoying ads by default?"

------
fwdpropaganda
Here's how my ad blocker works:

\- Install uMatrix (firefox/chrome add-on)

\- Manually whitelist javascript

Get uMatrix folks.

~~~
mderazon
Don't get how it's different from ublock or what's the benefits of umatrix

~~~
fwdpropaganda
Does ublock allow to block all javascript and cookies by default, and manually
whitelist javascript or cookies domain by domain?

~~~
ams6110
In "advanced user" mode it can do this. You can even say things like "yes
allow from foo.com but only when I'm visiting bar.com"

I did this for a while but it all got to be too much trouble honestly. Now I
just run uBlock in default configuration and also have an /etc/hosts file, and
browser set to clear all history and cookies when closed.

------
aplorbust
"However, users can't add their own websites to the blocklist."

~~~
dbbk
It doesn't prevent you from installing an Ad Blocker extension to block sites
yourself, as you do today.

------
yashksagar
Google is not happy with third-party blockers blocking all their ads (e.g.
YouTube ads), so they want their own blocker that can show more "Google-
friendly" ads. It's all about the moolah...

------
cujo
Doesn't seem fishy at all that an ad company would develop a product that
blocks ads. Nope. Couldn't possibly be used to further it's own business. No
sir, no how.

------
craigmi
youtube ads are worse than anything they're blocking

------
jmkni
Will this work on the mobile versions of Chrome as well (Android, iOS, etc)?

For iOS in particular, there doesn't seem to be any officially supported way
to block ads.

~~~
aaronbrager
Safari Content Blockers are the officially supported way. Eg BlockBear,
Crystal, etc.

------
damoiser
It sounds for me like a begin of monopoly: google ads put in silence all other
ads competitors thanks a largely used in-house browser

------
eh78ssxv2f
I am confused. Are they doing (i) EasyList + EasyPrivacy OR (ii) List derived
using better ads standard?

I would imagine (i) to be much longer than (ii).

------
samfisher83
It sounds like Google is using it's Monopoly position to control the ad space.
Microsft used these tatics to get like 90+% marketshare before the government
stepped in.chrome is open source it shouldn't be too hard to modify the code
so it block Google ads too. I publish a browser which is a modified version of
chrome which block ads. The issue is a lot of sites now detect this and tell
you to disable it. They seem to use the script on the page itself so it's
harder to block.

~~~
jacksmith21006
Did you read the article?

~~~
samfisher83
Can you point to the point where it says that instead of just attacking me?

This is what I saw.

Google have announced that their Google Chrome web browser will block every ad
on websites that are not compliant with the Better Ads Standards by default.
Google admits that they’re taking action against the types of web
advertisements that annoy people the most in an order to halt the rise in ad
blockers that block all forms of advertisements on all websites.

------
hedora
How easy is it to disable the whitelist and notifications in chromium? It
seems like an obvious, user friendly, change.

------
gressquel
Kudos to the blog for not having silly facebook sharing button. Thanks for
protecting my privacy / reading log

------
gigatexal
Going to stick with Firefox and keep blocking all tracking and ads. Thank you
very much.

------
Markoff
I am fine with this, at least less work for of ad blocker

shame I don't use chrome

------
Santosh83
It's a bit surreal that an advertising based company's browser will now block
annoying ads by default while the privacy focused Mozilla corporation's
browser is still not implementing _any kind of_ built-in ad blocking.

~~~
jacquesm
You should not see this as a Google vs Mozilla thing but as a Google vs
adblockers and Google vs its competing advertising networks issue. Then it
makes much more sense.

~~~
Santosh83
Well, I have Mozilla's back personally since I've always used _only_ Firefox
ever since version 1 and never used Chrome except for trying it out for a test
drive from time to time, but the millions of Firefox users worldwide will now
have one more reason to jump ship to Chrome and that's something Firefox can't
afford at this point. Built-in ad blocking is just too good to pass up.
Firefox needs to implement their own version soon, IMO.

~~~
jacquesm
That I agree with, but installing an ad blocker is fairly painless in firefox.

------
sleepybrett
Why am I trusting an advertising company with an ad blocker?

------
ape4
if (domain != 'adsense') { blockAd(); }

~~~
marktangotango
My thought as well, google/alphabet has a real PR problem here.

~~~
vgeek
They won't discriminate against all 3rd parties at first, it would be too
obvious. They will quietly grow the list of blocked 3rd parties, with the
intention of gradually shifting all spend to AdSense/DoubleClick platforms.

~~~
anonymousab
Given how many bad sites and bad ads there are out there, I think the list
would quickly grow even if Google had the best of intentions.

------
SeriousM
It's a nice writeup but to be honest, I'm so happy that I have my pi-hole
setup so I don't care anymore :). For Android is an OSS app called dns66
(f-droid) which has the same functionality.

~~~
Zizizizz
Couldn't you set up a VPN to that raspberry pi and use that to block ads on
your phone too? I use Adaway but I don't have a pi hole

------
kevmo
Just use Brave, everyone. I think everyone here knows there's no way Google's
sandbox doesn't morph into quicksand.

[https://brave.com](https://brave.com)

~~~
regexnerd
Brave is ad friendly, something that doesn't sit well with me. I want it all
blocked. No ads, beacons, trackers, bad JavaScript. It's my browser, I call
the shots as to what is allowed through. Ad companies have proven themselves
to be evil and untrustworthy. They are now one of the main vectors of malware.
I owe it to myself and my family to block everything like ads, beacons, and
tracking my our network. I'm not interested in helping other people make
money, generate crypto currency, whatever... My computers, my rules. Ads are a
bad way to make money anyway and I've been blocking them since 1998. No way
would I use Brave or any other software that actually encourages the advert
companies to continue down their dark path.

------
rplnt
No option for script blocking?

------
LeoNatan25
Will those idiots block YouTube as well for serving malware that mines on
users’ machines?

------
galori
On mobile I’ve been using incignito mode exclusively. This prevents a lot of
tracking, and bonus is it avoids many paywalls. I’m liking it so far - might
try to do the same on desktop.

------
known
To sneak in Google ads?

------
Analemma_
So, who wants to bet on the size of the inevitable EU fine for anticompetitive
activity? Another €1.2 billion?

------
xstartup
It seems a lot of people here work for shady ad networks whose bonus will be
cut this year. It's not only "Google", it's Coalition for Better Ads. There
top competitors' are all part of it.

It's still a lot better for my elderly folks who can't seem to figure out how
to install ublock.

~~~
ocdtrekkie
Google loves to claim something is administered by a "coalition" or
"alliance". But that isn't how it works internally.

Remember the "Open Handset Alliance"? The industry group of companies which
used Android? Well, Google threatened to remove Acer from it if Acer dared to
release a phone without Google Apps on it. This was never a mutual
organization, it was a Google-run organization.

"Alliances" and "coalitions" are the tools which Google uses to tame the
companies they've more or less taken control of.

~~~
xstartup
Adtech industry can't be compared with Handset market. You can start your ad
network today with minimum capital. There are lots of smaller players in this
game who are setting over each other to gain some competitive advantage by
pushing nastiest ad around. These smaller players can make their own coalition
and go to courts if it's that bad for their business and no court will not
allow you to run shady ads, so these guys will never go to court!

------
asah
I for one welcome this - uBlock is great but it's slow and creates bugs with
__many __legit applications. My first tech support question these days is,
"are you running an adblocker?"

~~~
aluhut
Yeah mine too, followed by me installing one.

------
nukeop
Google as an advertising company has been putting its pieces into place for
years now. Now is the final step of their plan of total takeover of the WWW.

Once you have the dominant browser and you're the largest ad provider on the
internet, you can start actively destroying competition by declaring their ads
"intrusive", and simply "bad", and blocking them. Since you have control over
web standards and most of the browsers in the world, you hold everyone else by
their balls. They either play by your rules, or they don't get to play at all.
You can stifle all competition, completely, forever. Anything you do at this
stage only tightens your grip on the internet.

