Tag: ad

美國聯邦政府 CIO 以資安理由建議安裝 ad block 軟體

Hacker News Daily 上看到的，美國聯邦政府的 CIO Clare Martorana 行文建議行政管理和預算局 (Office of Management and Budget) 安裝 ad block 軟體以確保資訊安全：「The NSA and CIA Use Ad Blockers Because Online Advertising Is So Dangerous」。行文的文件在「Wyden Letter to OMB on Ad-Blocking」這邊可以看到，另外在 Hacker News 上的討論「The NSA and CIA use ad blockers (vice.com)」也可以翻。

有很多惡意軟體 (像是 malware) 會透過合法的 ad network 散布，然後竊取資料，甚至是透過麥克風監聽環境音：

I write to urge the Office of Management and Budget (OMB) to protect federal networks from foreign spies and criminals who misuse online advertising for hacking and surveillance, by setting clear new rules for agencies in its forthcoming “zero trust” cybersecurity policy.

I have pushed successive administrations to respond more appropriately to surveillance threats, including from foreign governments and criminals exploiting online advertisingto hack federal systems. This includes seemingly innocuous online advertisements, which can be used to deliver ‘malware to phones and computers—often without requiring users to click anything. This ‘malware can steal, modify or wipe sensitive government data, or record conversations by remotely enabling a computers built-in microphone.

記得我是從 Firefox 還叫做 Phoenix 的時代就在用 ad blocker 了... 建議大家一定要裝啊，以現在來說應該都是裝 uBlock Origin，在有支援 extension 的瀏覽器都有商店可以直接安裝。

GitHub 宣佈在 github.io 上抵制 FLoC

GitHub 的公告簡單明瞭，也不用你操作，直接在 github.io 上抵制 FLoC：「GitHub Pages: Permissions-Policy: interest-cohort=() Header added to all pages sites」，在「[Feature request] Set HTTP header to opt out of FLoC in GitHub Pages」這邊有些討論，另外在 Hacker News 上的討論也可以看一下：「GitHub blocks FLoC across all of GitHub Pages (github.blog)」。

不過不確定為什麼 custom domain 的就不加上去，可能微軟內部的法務團隊討論出來的結果？

All GitHub Pages sites served from the github.io domain will now have a Permissions-Policy: interest-cohort=() header set.

Pages sites using a custom domain will not be impacted.

WordPress 對 FLoC 的對抗計畫

Google 打算在 Google Chrome 裡面強推的 FLoC 最近有很多消息，但因為沒看完 spec 就一直丟著了... 可以先參考 iThome 的「繼Brave瀏覽器之後，DuckDuckGo、Vivaldi也要封鎖Google FLoC廣告投放技術」，雖然裡面提的很淺。

目前檯面上除了廣告產業以外，所有看到的人與組織都反對 FLoC。

從 EFF 的「Google’s FLoC Is a Terrible Idea」，之後 DuckDuckGo 也發表了「Use the DuckDuckGo Extension to Block FLoC, Google’s New Tracking Method in Chrome」，再來是 Brave 的「Why Brave Disables FLoC」與 Vivaldi 的「No, Google! Vivaldi users will not get FLoC’ed.」。

最新的進展是 WordPress 決定把 FLoC 當作 security concern 來看，打算直接推出 security hotfix 更新，預設關閉 FLoC：「Proposal: Treat FLoC as a security concern」，在 Hacker News 上也有討論：「Proposal: Treat FLoC as a security concern (make.wordpress.org)」。

主要的原因是正常的 WordPress 版本會在今年七月才出，會跟不上 FLoC 的進度：

Currently, 5.8. is only scheduled for July 2021. FLoC will likely be rolling out this month.

我自己也因為 FLoC 而又再次跳到 Brave，還遇到 imgur Uploader 套件不見 (可以參考「What Happen to the imgur uploader extension?」)，以及有些套件無法運作的問題...

T-Mobile US 打算要賣使用者的瀏覽記錄了

全美第二大的 T-Mobile US 打算要賣使用者的瀏覽記錄了，除非你登入進去選擇退出：「T-Mobile to Step Up Ad Targeting of Cellphone Customers」，Hacker News 上的討論則可以看「T-Mobile to share customers' data with advertisers unless they opt out (thehill.com)」這邊。

The No. 2 U.S. carrier by subscribers said in a recent privacy-policy update that unless they opt out it will share customers’ web and mobile-app data with advertisers starting April 26.

這次的改變包括了 2020 年併購 Sprint 的使用者：

T-Mobile’s new policy will also cover Sprint customers acquired through the carriers’ 2020 merger. Sprint had previously shared similar data only from customers who opted into its third-party ad program.

所以連在美國都有 DNS over HTTPS (或是 DNS over TLS) 與 ESNI 需求了...

原來 Disqus 已經被網路廣告公司買走了...

在「Disqus, the dark commenting system」這邊才看到 Disqus 被網路廣告公司買的消息：

Disqus was acquired by an advertising company called Zeta Global in 2017. Obviously, advertising companies do everything to increase their revenue (Ex: the Big G).

引用的報導則是在「Zeta Global acquires commenting service Disqus」這邊可以看到，大約在三年前發生的事情...

基本上已經變成廣告追蹤平台了：

I analyzed the network requests log. Disqus makes HTTP requests to 11 different third-party domains through the browser. All of these websites are trackers/pixels (Even some were detected as malware by my security guard).

而且就算是付費會員也一樣，還是會追蹤：

When you provide a free product, money should come from somewhere. Disqus uses advertising for that. Now, I subscribed to a paid plan trial of Disqus to see if things change or not. No! Even in the paid plans, the same pixels are loaded on the client-side. Looks like there's no way to opt-out from tracking.

後面的推薦可以看看就好，自己架應該還是比較好的選擇... 用「open source comment system」搜有些東西可以參考。

透過 /etc/hosts 擋廣告與追蹤的軟體

在 Hacker News Daily 上看到 Maza ad blocking，這是一個擋廣告與追蹤的軟體，原理就是在 DNS 上檔掉某些網域。

運作方式跟 Pi-hole 接近，其中 Pi-hole 是提供一個 DNS server 擋，這套軟體則是透過 /etc/hosts 來擋。

目前只支援 macOS 與 Linux，不過這樣看起來使用的族群有點怪，因為在 desktop 上有更多手段可以擋，透過 DNS 類的擋法主要還是拿來對手機上無法無天的 app...

不過先關注一下好了，之後也許會在某些場合下用到？

Google 用 x-client-data 追蹤使用者的問題

前陣子 Chromium 團隊在研究要移除 User-Agent 字串的事情 (參考「User-Agent 的淘汰提案」)，結果 kiwibrowser 就直接炸下去，Google 很久前就會針對自家網站送出 x-client-data 這個 HTTP header，裡面足以辨識使用者瀏覽器的單一性：「Partial freezing of the User-Agent string#467」。

在 Google 的白皮書裡面是說用在 server 的試驗：

We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation.

The variations active for a given installation are determined by a seed number which is randomly selected on first run. If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy). If you would like to reset your variations seed, run Chrome with the command line flag “--reset-variation-state”. Experiments may be further limited by country (determined by your IP address), operating system, Chrome version and other parameters.

但因為這個預設值開啟的關係，就算關掉後也足以把使用者再分類到另外一個區塊，仍然具有高度辨識性，不是你 Google 說無法辨識就算數。

另外如果看 source code 裡的說明：

    // Note the criteria for attaching client experiment headers:
    // 1. We only transmit to Google owned domains which can evaluate
    // experiments.
    //    1a. These include hosts which have a standard postfix such as:
    //         *.doubleclick.net or *.googlesyndication.com or
    //         exactly www.googleadservices.com or
    //         international TLD domains *.google. or *.youtube..
    // 2. Only transmit for non-Incognito profiles.
    // 3. For the X-Client-Data header, only include non-empty variation IDs.

可以看到 *.doubleclick.net、*.googlesyndication.com 與 www.googleadservices.com 全部都是廣告相關，另外 Google 自家搜尋引擎是直接提供廣告 (不透過前面提到的網域)，YouTube 也是一樣的情況，所以完全可以猜測 x-client-data 這個資料就是用在廣告相關的系統上。

The Register 在「Is Chrome really secretly stalking you across Google sites using per-install ID numbers? We reveal the truth」這邊用粗體的 Update 提到了 GDPR 的問題，不確定是不是開始有單位在調查了：

Updated Google is potentially facing a massive privacy and GDPR row over Chrome sending per-installation ID numbers to the mothership.

在這個問題沒修正之前，只能暫時用操作 HTTP header 的 extension 移掉這個欄位。

Google 的搜尋廣告改版造成的混淆

Google 的搜尋廣告最近改版了，在 The Verge 的「Google’s ads just look like search results now」這邊可以看到報導以及 screenshot：

可以看到廣告的標示變成 favicon 了，使得使用者更容易誤會是搜尋內容。而這也使得廣告的點閱比例大幅提昇，像是「Google’s latest search results change further blurs what’s an ad」這邊提到的：

For all four clients (a local health care company, two business-to-business companies and an e-commerce company), the desktop click-through rates increased and ranged from 4% to 10.5%. All clients had slight declines in the click-through rates on mobile devices.

The Verge 後續也分析了這個改變帶來的反思：「How much longer will we trust Google’s search results?」。

我的建議是 uBlock Origin 當作基本工具 (在各瀏覽器上應該都有支援)，另外進階一些可以用 DuckDuckGo 看看，但不保證搜尋品質會讓你滿意...

Android 上的 Firefox 可以安裝 uBlock Origin 了

Update：我寫的這篇標題與內容是錯的，請參考 comment 提到的說明。

在桌機上擋廣告的神器 uBlock Origin 總算是要被移植到 Android 的 Firefox 上了：「uBlock Origin available soon in new Firefox for Android Nightly」。

In the next few weeks, uBlock Origin will be the first add-on to become available in the new Firefox for Android. It is currently available on Firefox Preview Nightly and will soon be available on Firefox for Android Nightly.

手機上的廣告一直都是個頭痛的問題啊，多了一個神器可以用總是好事...

uBlock Origin 的開發版 (Dev) 被 Chrome Web Store 拒絕的事件...

uBlock Origin 是一個在瀏覽器上擋廣告的軟體，以前在推廣的時候都只提到可以過濾掉網站上的廣告，大家興趣其實都不太高 (還會有「留口飯讓別人吃」之類的 XDDD)，但最近跟同事推廣的時候改用「可以擋 YouTube 的影音廣告喔」，大家接受度意外的爆高，不過這有點扯遠了，回到原來的主題上...

先介紹一下 uBlock Origin 的開發模式，除了一般的 stable 版本外 (「uBlock Origin」這組)，另外會有另外一個 dev 版本上傳到 Chrome Web Store (CWS) 上 (「uBlock Origin development build」這組)，這樣讓使用者比較容易安裝與測試，這個方式也可以在 Tampermonkey 上看到。

這次主要維護者 Raymond Hill (gorhill) 在 1.22.5rc1 版上傳到 CWS 上後收到被拒絕上架的通知：「Dev build 1.22.5rc1 "REJECTED" from Chrome Web Store」。

拒絕的原因是 CWS 要求要有套件必須符合「目的單一性」，也就是不能把目的不同的東西強迫使用者綁在一起使用：

Your item did not comply with the following section of our policy: An extension should have a single purpose that is clear to users. Do not create an extension that requires users to accept bundles of unrelated functionality, such as an email notifier and a news headline aggregator. If two pieces of functionality are clearly separate, they should be put into two different extensions, and users should have the ability to install and uninstall them separately. For example, an extension that provides a broad array of functionalities on the New Tab Page/ Start-up Page but also changes the default search are better delivered as separate extensions, so that users can select the services they want. For more information on the new Chrome extensions quality policy, please refer to the FAQ: https://developer.chrome.com/extensions/single_purpose

後續的 1.22.5rc2 也被拒絕，然後他回信詢問了 CWS 官方，得到的仍然是罐頭回應，然後他就決定丟著 (而這個作法還蠻聰明的)，接著這件事情就被丟著變成 PR 事件上了一些媒體，然後昨天就突然解了...

Google 最近的動作愈來愈多了，一方面在嘗試避免觸動反托拉斯法的情況，儘可能打壓這些擋廣告的套件...