Hacker News new | ask | show | jobs
by mrspeaker 2306 days ago
Great article! It's funny to finally see ad blockers go "mainstream".

My dystopian-future fear is that that Web Assembly will be the end of ad blocking (and the end of a web of connected web sites). Big sites will eventually convert to essentially "a web browser inside a web browser" so they have total control over the content and how it's displayed.

Then ad blocking (and other customization) will be limited to "the analog hole" - trying to image detect or OCR things.

I hope I'm wrong, but I've also been asked countless times over the years to "stop people copy/pasting our text" and "stop people seeing our code" and "stop people downloading our images"... the browser-in-a-browser feels inevitable!

25 comments

> Big sites will eventually convert to essentially "a web browser inside a web browser" so they have total control over the content and how it's displayed.

This has already happened: Just look at how many websites pester you to download their mobile app or even block content unless you access from the app. From a user functionality perspective the vast majority of apps do nothing a browser can't do. But the killer feature for apps is how much easier it is for the developer to get your location data, contact list, and importantly show you unskippable, auto-playing, 90s-era-popup-level-annoying ads

You use a firewall on the device to block requests to the ad server. Most apps will keep working fine. Then all it takes is an OS that lets you revoke permissions on sensitive data without the app knowing.
Ad networks can easily work around this, either by requiring publishers to proxy their requests or by having lots of domain names and proxies, which can be dirt cheap. You can't block requests as fast as ad networks can add domains and ips.

Sometimes I wonder what keeps ad networks from becoming more aggressive. Wonder what keeps them from breaking the content and force users to disable ad blocking. Because I know it can be done.

It's probably because publishers don't want to piss users off. Or maybe it's because on mobile most clicks come from Facebook or Twitter or other apps using web views that don't do ad blocking.

Google hosts YouTube and the ads for YouTube on the same domain with obfuscated paths, so that won't work. About all you can do if you want to use the app is pay for premium or use something like Vanced which unlocks the premium features without paying.

The main reason content blocking works is because anyone can introspect webpages and the source is available for modification. When things become byte-compiled it gets exponentially harder, if not impossible.

Works less well on mobile, which is what most people use these days.
Many websites indeed pester us to download their mobile app but I have yet to find one that forces me to? Do they actually exist?
Reddit forces you to download the app now. You can scroll like 2-4 pages worth of content and then it'll pop up asking you to open in app.

On every page you navigate to from within the website you'll first get a pop up asking to choose between browser and reddit app.

I'm using old.reddit.com and wasn't aware they started doing this. Reddit is turning into a dumpster fire, it's bad enough I have to use the old UI so that it doesn't burn a hole in the cpu.
Forget the CPU usage, I only use the old UI because it's better/ I find it more usable.

Or maybe I'm just getting old :D

It's both.

The new UI is terrible and barely useable. But Gen-Z is used to barely useable UX. (looking at you, Snapchat)

I wont disagree there, it's not useable. I wonder what possessed them into believing any of this was a good idea.
the new UI is so uncomfortable to use, I don't like how bloated websites are becoming, but usually I can cope with it. Reddit's is just bad. It's buggy, it's inconsistent, and its resource-intensive.
> I'm using old.reddit.com

Heyo that's awesome! I feel ten years younger.

It's worth noting that Reddit has a vibrant community of excellent third party apps, none of which display Reddit ads.
Which means Reddit is almost certainly going to break all of them, eventually.
> On every page you navigate to from within the website you'll first get a pop up asking to choose between browser and reddit app.

There's a user setting for this, somewhere. I found it once. It's default on but once you un-check it you no longer see the app nags. It's great. And terrible they hid it like that.

--edit-- Or there was, damned if I can find it now.

Reddit outside of old.reddit.com is a dumpster fire. I specially dislike those JS loading icons on mobile, it's just so slow...
You can turn off the prompting for the app in the top-right menu. You don't even need to log in for that.
If I’m ever on YouTube or Reddit I always set request desktop site to always in Safari on iOS.
Yelp! Try clicking "read more" on any review in a mobile browser and see what happens.
You can get around that by selecting "View desktop site" on your mobile browser.
So don't use yelp
This would be a more attractive option if it didn't amount to 'cede yet another part of the Internet to Google'.
Reminds me of when Microsoft took over. Many of their competitors destroyed themselves in the 80s and 90s.
Instagram. Can't read messages unless you use the app.

Snapchat is of course app only.

That was true for a while but they added this feature some time ago.

https://www.instagram.com/direct/inbox/

I tried to use imgur on mobile to upload a random image today but couldn't[FireFox]

Using FF on my desktop worked fine.

That is the ultimate end of every free image hosting service.
Being able to work on Firefox but not their own app?
I think they're referring to the Imgur mobile website, which no longer allows uploads, requiring you to download the Imgur app.
Quora
> Just look at how many websites pester you to download their mobile app or even block content unless you access from the app.

Users should respond by creating an open source replacement for the official app. Surely there's a way to fool the server into thinking it's talking to the official app.

The problem here is that these companies can abuse the DMCA to get the app outlawed and pulled from the major app stores. In fact, Apple already doesn't allow you to publish any app that interacts with any reasonably big third-party service or device without the explicit approval of the service (that's how alternative YouTube clients disappeared on iOS), even for devices such as smart light bulbs that are explicitly designed to be controlled via the local network without any authentication: https://community.lifx.com/t/app-store-rejection-permission-...
Apple devices aren't free computer systems. Apple owns the devices, not the users. They gave up their freedom when they bought a computer that doesn't give them the keys to the system. They have little choice other than to accept whatever conditions the big corporations impose on them.

Thankfully, iOS does not represent all systems out there. Android systems allow installation of apps from any source and PCs traditionally have no limitations on which programs can be executed by the user. Better alternatives to these abusive "official" apps should be a selling point for these free systems. A perfect example of adversarial interoperability:

https://www.eff.org/deeplinks/2019/06/adversarial-interopera...

Crypto is too good, unless you have a jail broken phone
Android + Magisk + AdAway
I use BlockAda, It functions like a VPN which can be annoying if you use a VPN a lot but otherwise it is a simple on off switch for people who aren't very savvy with their phones.
It's Blokada. It's Polish for "blockade".
Or use Firefox Preview and uBlock Origin.
Yeah but that doesn’t block in-app ads
Honest question, but which apps are both required (don't work in-browser) and don't serve ads from their own network (Youtube, Facebook)?
Add DNS66 from the fdroid store and you are set
I mean, won't there always be alternatives to this bullshit?
Don't paint webassembly as something terrible. Webassembly does not add anything substantial to what's already in web. You could compile C code to JavaScript before. Webassembly does not provide new API unavailable from JavaScript. Webassembly is just an optimization. Some code will work faster and consume less memory, that's all. You could write website which paints itself on canvas with JavaScript years ago. The fact that nobody goes this route means that there are inherent problems with this approach. For example that website will be completely inaccessible for Google.
The threat of WebAssembly is that it may encourage more sites to require users to allow client-side code execution to work. For those of us who aren't trusting enough to allow this, it means that the web gets smaller even faster than it already is.
It seems like if you replace WebAssembly with JavaScript in this comment it makes just as much sense. What is different about WebAssembly?
WebAssembly expands on the ability to do client-side stuff and makes it more accessible, so my fear is that it will make it more common.

That's pretty much the entire difference. It's a difference of degree more than of kind. As I said, Javascript is making much of the web inaccessible to me, and WebAssembly, if it becomes popular, will only accelerate this loss.

I wonder how feasible a rendering proxy would be. It would run the JS in a simulated browser environment and return the HTML.

Interactivity would be tricky, but static HTML is better than a blank page.

Edit: Found something very similar, but it targets legacy browsers using clickable image maps rather than privacy/security.

https://github.com/tenox7/wrp

WebAssembly adds new functionality to the browser runtime environment that isn't available to regular JavaScript. It was originally 1:1 with asm.js/JS but that stopped being true relatively quick.
It's faster. That's literally it. There aren't any new I/O facilities.
A few examples of things it adds that are not widely available in JS (if at all, or requiring awkward hacks/hints in JS), off the top of my head:

int64

uint32

popcnt

copysign

reinterpret_cast equivalent (the js hack for this is abysmal)

pthreads

SIMD

AOT compilation

To be fair, it's been a while since I was last one of the authors of the webassembly spec, so I could be missing some things.

WebAssembly allows allocation of memory and exposes a huge threat surface. We can't even protect the current APIs and these are being exploited by sovereign nations to oppress people like the Uyghurs. How about we focus on making the sandboxes stronger instead of building out things like WebGL and WebAssembly.
A lot of the future of ad blocking will depend upon why people are blocking ads. Some of us have nothing againsts ads in principle, but do not like the practices of the advertising industry. This includes things like tracking people across websites, intrusive advertising, excessive bandwidth usage, deceptive advertising, and so on. Blocking the "analog hole" would be irrelevant in most of those cases.
If ads were expensive to buy we'd see a lot fewer of them and would not need to be intrusive, they'd be be just as useful as intended, to inform people. The problem with the modern economy is that everything that works is eventually pushed over the fence and it stops working. The boom busting cycle keeps on repeating
They'd probably still engage in spying, though, which is 95% of what makes ads objectionable to me.
My problem with ads on mobile are that they are very obtrusive.
I second this. I also hate how links behave nowadays. I used to right click and open in a new tab or save the link but in many cases it no longer works and is quite annoying.

If ads were more expensive to purchase we'd see a lot fewer of them and they would not be as intrusive. But this ain't so and we need adblockers.

They (the advertising industry) come back with a stronger system that is harder to ad block and we retaliate with something else. What baffles me is that they don't see that we are resisting, they produce something that nobody really wants. The whole advertising industry is something questionable.

It's probably a prisoners dilemma for those in the industry as an individual. Because everything operates on the short term, there is no moderator of long term goals. If something gives you 5% better hits today, you have to do it, no matter if it's going to kill you two weeks from now. Or your competitors will and you'll see a drop in sales.
Web Assembly will be the end of the HTML/HTTP based web: QUIC, direct JS based render in browser, no more view source.

HTTP/HTML will become the next gopher, and this makes me incredibly sad

Don't forget DNS-over-HTTPS w/ certificate pinning to prevent DNS-based request filtering, too.
This is why we cannot allow Chrome to gain dominance over the web. We all know Google would love to do this.
Why WebAssembly? Just bake ad code into a SPA and that's it. Random elements with random names at random positions in the DOM, positioned using styles. Quite low-tech. If implemented properly, it cannot be blocked. At all. Except blocking all scripts of course, which means the SPA will stop working.

And then I'll just stop visiting. (:

Nobody wants to host ad content / pay for the bandwidth themselves though. I think URL blacklisting will continue to work.
> Nobody wants to host ad content / pay for the bandwidth themselves though.

Actually the issue is that the companies paying you to run the ads don't want you to host it yourself.

* They're paying for impressions, and they don't trust you to report those honestly.

* Real time bidding means the ad to be displayed often hasn't been determined until a few milliseconds before the page loads in your browser.

* They can't (as easily and reliably) collect demographic and behavioral data (ie spy on you) if you don't contact their servers directly.

True! More (and more important) reasons why URL blacklisting will continue to work in the WASMy browser-in-browser age.
No, they just want to squeeze out every penny they can not thinking of the users they end up losing in the process. Personal experience time!

I ran a pretty popular wiki for Dungeons and Dragons homebrew on what used to be called Wikia. At some point they decided they available needed to have some terrible new skin that was stuffed with ads and unbelievable ugly. We pushed back but they were adamant about forcing it, so I took all the content and all the users and self hosted it for almost a decade afterward. The Wikia site was completely dead. Sucks for them but their choice.

I paid $10/mo or $10/mo for the site depending on the year, and never ran ads. At one point I got an offer from a company in the same hobbyist space to buy it from me. At that point I was extremely sick of being my own sysadmin and worrying about security vulns so I accepted it. Now some time later they're trying to pull the "stuff it full of ads in the worst places!" routine. Users are getting pissed and starting to ask me about taking all the content...and users...and going off to a server adminned by me again.

If I do this, it will be completely devastating for the site and tank their traffic. Do they care or realize? Guess we'll see.

>> My dystopian-future fear is that that Web Assembly will be the end of ad blocking

The answer to that is to disable Web Assembly, much like a lot of people disable JS. The whole idea of running other peoples code on your machine is the problem, and it baffles me that browser companies are still trying to enable more and more of this. I don't want your code running on my computer.

That's great, until all the major corporate sites you actually use stop serving any content in HTML.

This future seems inevitable. The only sites you'll be able to actually use without some custom web assembly renderer will be those which don't serve ads at all now - wikis, open source projects, non profits, corporate web sites, etc. Any site funded by ad revenue will effectively remove itself from the web and into its own web assembly app instead.

We might even see the rebirth of something like AOL, a meta app that will be a portal to render content for others who want to use the platform. It might even just be an upcoming version of amp, or a new feature offered by Facebook or cloudflare...

It's funny because all the major corporate sites could already have stopped serving HTML and just gone completely with Flash, Silverlight or Java, and yet the doomsday scenario never happened. Hell, Android apps are basically the closed "meta apps" you're talking about, and have been around for years, and yet corporate, ad-driven sites still use HTML.

I don't see why Webassembly should the inevitable slippery slope to the entire web becoming some kind of closed source binary-only dystopia, other than it being loosely associated with Javascript, which half of HN hates and fears to a degree bordering on mania. The FUD really needs to end already.

>and just gone completely with Flash, Silverlight or Java

Not sure what you mean by that. There were plenty of sites not usable at times because of their use of java or flash.

The thesis is that the existence of Webassembly, alone, means that all ad-supported sites will inevitably be rewritten entirely as WASM blobs in order to prevent the use of ad blockers. The typical doomsday scenario also includes the conversion of rest of the web to WASM, with support for HTML being entirely deprecated in all browsers, so that corporate interests can lock down, centralize and control the web entirely.

I'm claiming that thesis is incorrect because prior methods existed and still exist to encode websites as embedded binary applications, yet ad-driven sites still primarily use HTML, and the HTML driven web still exists.

How usable sites using java and flash were isn't relevant. Either all ad-driven sites seek to maximize their control over the end user by any available means at all cost, or they don't. As they evidently don't, the slippery slope of WASM leading to the end of the free web seems unlikely.

> The thesis is that the existence of Webassembly, alone, means that all ad-supported sites will inevitably be rewritten entirely as WASM blobs in order to prevent the use of ad blockers. The typical doomsday scenario also includes the conversion of rest of the web to WASM, with support for HTML being entirely deprecated in all browsers, so that corporate interests can lock down, centralize and control the web entirely.

The thesis is that WASM will be the form of HTML's destruction, not that it is the only tool capable of it.

A confluence of trend lines lead it to be "in the right place at the right time." We've already come to accept that much of the web requires javascript, if it works in Google Chrome then that's fine, and video content requires DRM blobs.

The public is ready for this, and ad-supported content providers are floundering even though the fed keeps printing money.

With how much money is spent on bogus technical solutions in the ad space with marginal or no recognizable benefit, the time is right for innovation, and WASM is arriving just in time. Just like with AMP, I'm sure WASM-AMP will be sold for its amazing performance characteristics, because the modern web is so full of trash how could it not be at least better than the status quo?

WASM isn't some uniquely horrific development, it's just the next evolution in the downward trajectory.

> Big sites will eventually convert to essentially "a web browser inside a web browser" so they have total control over the content and how it's displayed.

For the time being, you can thank the threat of an accessibility lawsuit for slowing this future down. Building a custom renderer might not be as challenging as supporting the myriad accessibility needs of disable users.

Yes, but doing so, they will lose the ability to be indexed, searched, archived and linked to. Like during the flash era.

Which in turn will start a new trend of website that are "open".

It's a cycle.

> they will lose the ability to be indexed, searched, archived and linked to

Sounds like an API that will be implemented.

If it's not standard, it will be useless. If it is, the browser will eventually put it in the users hand.
Crawler bots are already doing site rendering and OCR. This isn't that big of a step for them.
TIL. Wow. I guess I missed the web is not HTML anymore.
Plenty of sites already give Google something different from what they show everyone else, right?
No, that's actually a great way to make Google penalize your site. It's explicitly against their Webmaster Guidelines: https://support.google.com/webmasters/answer/66355
Tell that to linkedin, pinterest, and dozens of news sites.
Linkedin used to trick people into thinking you have to pay to see someones profile when you can see it just fine by logging out. That is not against Googles policy. Not sure if they still do that, but I used the logout trick a lot a few years ago.
Google does document a way to mark paywalled content and have it indexed without it being considered cloaking: https://developers.google.com/search/docs/data-types/paywall...
Big properties do that and Google doesn't care.
You sure about that? How big qualifies as big in your eyes? Medium implemented homepage cloaking in November of 2019 and within a month they lost 40% of their overall search visibility:

https://www.onely.com/blog/medium-lost-half-visibility/

Pinterest? Google is somehow able to crawl images on their site, but I certainly can't view these images without creating an account and logging in. Their site ranks highly enough that I gave up on google image search last year.

Additionally, off the top of my head Bloomberg and NYT both won't allow me to view more than a few articles but let the Google crawler index their articles.

I thought that was an offense that would get one either severely de-ranked or delisted from search outright?
What do paywalled sites do, then? They don't seem to have a problem ranking just fine.
They show the abstract or the same bit of the headline and maybe a paragraph you see when hitting the page. Googlebot doesn't get the full text.
I've definitely seen article text on Google that was not presented to me when I clicked the link, and not because the article was updated or something, but because I was blocked from seeing the article.
Actually, Web Components and Shadow DOM bother me more than Web Assembly. You cannot "pierce" into a shadow DOM from the outside and this creates an impenetrable barrier for content blockers. We've already seen examples of whole web pages transformed into a shadow-dom web component.
The more of pages introducing the solution you describe the more chance ad blockers / browsers will pick up the new challenge ;)
Firefox has openOrClosedShadowRoot available to extensions that allows them to bypass closed shadow dom.
> You cannot "pierce" into a shadow DOM from the outside

Why not? You can inject any script into a meta header on document start from an extension or do the same in an intercepting proxy.

Shadow DOM is created dynamically using "attachShadow". You can try overriding Element.prototype.attachShadow, but this is easy to detect.
Well, currently adblocking is already full of such easy to detect overrides, and extension APIs already have plenty of limitations on what they can touch and replace allowing websites to easily bypass most of the overrides, but they do work at the moment and websites don't bother.
I think ads will be the reason Web Assembly takes off in a massive way, actually. Much harder to block ads if the site ships its own renderer and manages to hide or obscure its traffic. Then you're in to serious application-cracking territory if you want to block ads & tracking.
Web Assembly is just a runtime, like obfuscated JS it is sandboxed and still needs to access some standard APIs to at least conform to CORS. I don't see a problem to let plugins/browsers control `window.fetch` or whatever connection method the WASM code is going to use.
Not going to work against a CDN delivering all content through a websocket.
IMO Cloudflare's a huge threat to Google for exactly this reason.
I have disabled wasm in firefox and I don't intend to enable it ever. If someone wants to force "activex" on me again to use a site I won't use the site :)
It's absolutely going to happen. WASM isn't required for this future-- it just helps optimize it. There is a ton of money out there for the company who makes a performant and compatible browser-in-a-browser w/ proper accessibility. Somebody will eventually take the "deal with the devil" to develop it.

An obligatory link to an important talk: https://www.destroyallsoftware.com/talks/the-birth-and-death...

The problem with this sort of browser-within-a-browser black-hole, is that it will break screen readers and accessibility.

The way to fight this is to work together with accessibility advocacy agencies, like the ADA.

It doesn't bother me if ad-blocking moves towards OCR and computer vision. These things need to be created anyways because as blockers don't always filter everything I want anyways.

Personally, I would prefer to browse the web in reader mode. While we're at it we could do the have the same for PDFs.

I'd like to see (and might even work on), and overlay filter to plug that analog hole. This would probably be entirely outside of the web browser (perhaps as a custom VNC client) and would simply grey out ads and other obnoxious content. It wouldn't stop any downloading, but it might be smart enough to X out of those stupid pop-up ads automatically.

Easier said than done, of course.

For the record, I've no problem with "fair" advertising, the kind that used to appear in newspapers and magazines in the 1970s, for example. (Well, aside from its use as a virus vector.) But modern day web ads are simply abusive in too many cases.

That seems far more likely to me than I would like to admit. I can even see a rational that doesn't start that way, but with a homegrown solution in Webassembly it would be fast enough that you could write your own font and text layout algorithms that are better than what the browser does -- so your newspaper could do a proper justified text with great kerned headlines that would also look the same way in all browsers.

Then, naturally, there is no dev time set aside for copy and paste, because there is no business justification.

Those Web Assembly sites will still have memory accessible by the end user, ads will still be blocked.

They would need to server side render pages like a streaming game client would.

What about a dystopian future where sites only work via SGX-like secure compute environments that remotely attest the execution environment to the server?
That's effectively a future without the web at all.
How would the blocker know which parts of the memory to block?
The same way trainers, aimbots, and other hacks know which addresses are critical for exploiting game mechanics, by doing analysis of decompiled code and also searching running memory for known patterns and then patching them hot.
Don't websites compile on every page load, giving them the opportunity to obfuscate?

That's a bit different than a video game that was compiled only once.

The good outcome would be that after analog hole is plugged on the web, we can start plugging it IRL (if AR gear and/or spray paint drones mature by the time). Imagine physical space with no ads!

So, bring it on?

> Big sites will eventually convert to essentially "a web browser inside a web browser" so they have total control over the content and how it's displayed

Google's AMP technology aims to do this, although they will claim to have more altruistic motivations

Site needs to be compatible with screen readers otherwise you risk a lawsuit over ADA.
It's always a game of cat-and-mouse. No new technology will enable displaying ads that the ad-blocking crowd can't get ahold of eventually.
Perhaps some more web features should become opt-in via nagbars (e.g. canvas and wasm)
> Then ad blocking (and other customization) will be limited to "the analog hole" - trying to image detect or OCR things.

That doesn't seem too hard to pull off. You're not trying to find objects in an image, you're trying to find near-exact matches in a digitally rendered page.

People will just stop visiting such webpages where it's impossible to separate the chaff from the wheat, simple as that.
people already don't do this

for example: people who don't have adblockers (like everyone in my family except me)

1 out of 3 WWW users has an adblocker.

I won't visit websites with [a lot of] ads if my adblocker stops working. I'll simply stop using these websites. Just like before Netflix, I quit watching cable TV.

Thinking about it, I might as well go to Tor. Surely someone will copy/paste the plaintext content to some hidden service over there, just so the rest of us don't have to bother with ads. I might even be one of the contributors. If there is demand, there will be supply. And nobody is going to bother to "catch these copyright infringers" because nobody gets hurt, in contrast to someone selling illegal firearms or dangerous drugs.

I think I can only half-agree.

People who don't have adblockers are willing to put up with a heck of a lot. Agreed.

But if someone is not technically sophisticated enough to use an adblocker, they're also probably not technically sophisticated enough to find the actual content on a page and just give up.

I see this fairly frequently; someone with limited computer literacy goes to a website from Google, doesn't see anything relevant immediately (because of bad UI or really bad ads), and goes back to Google. Often the site even had relevant content when I look later, they just couldn't see it because they aren't as good at parsing website content.

There are so many websites with equivalent information, if you click on one and it's just garbage at first glance I think hitting "back" is more likely than "read and click on every ad and give them your SSN before downloading their virus scanning software".

Of course, but if they are not bothered by those ads that's fine too IMHO. And if the majority is fine with this (which I doubt, otherwise ad-blockers wouldn't be so massively successful), than I have to accept that too and go somewhere else.
> people already don't do this

Maybe not most, for now. But there certainly exist people who do this. I do, for one.