Hacker News Reader

Comment by simias | Hacker News Reader

I'm not sure I understand that, why go through the trouble of setting up random domains to bypass filters if you then load https://coinhive.com/lib/coinhive.min.js directly? Any filter will probably already block that URL if no other.

Now if they started serving the JS from random domains and URLs that would mean trouble because you couldn't just use the URL-based filter approach most adblockers use. I'm surprised this doesn't appear to be more common. If it gains steam we might have to use a whitelist approach for trusted 3rd party javascript sources. Not necessarily a bad thing IMO, although that might stifle innovation a bit on the web.

View on HN

This isn't about adblock. this is cloaking. If someone is employing filters/adblock, their code won't reach the victim. If someone isn't, they can reach out to coinhive directly.

They just need to hide coinhive from the ad platform, which is what they use the random domain for. When the ad platform fetches the ad code from the domain to inspect it, the random domain serves harmless code. When the user fetches the ad code, they get the miner.

The solution is for ad platforms to disallow external resources and custom JavaScript, and for publishers to be held responsible when their sites serve malware (whether directly or because they used an ad platform that sold the space to another ad platform that sold the space to another ad platform that sold the space to a bad guy who was able to serve a custom script because each of the platforms along the chain let everyone include arbitrary scripts).

>Now if they started serving the JS from random domains and URLs

you don't even need random domains. random urls from the same domain would work fine.

> random urls from the same domain would work fine.

What stops someone from blocking the domain? I think a combination of random domain + url would make it rather hard to detect these things.

same domain as in first-party domain. afaik all script blockers block third party scripts if you block scripts for the first party domain.

You can selectively block inline, 1st-party and 3rd-party scripts with uBlock Origin ("uBO").[0]

Moreover, the Firefox/webext version allows you to remove specific inline script tags before the document is parsed by the browser.[1]

uMatrix can selectively block web workers, which are typically used by coin miners.[2] I have long been thinking of bringing that ability to uBO, but I want to do it right UI-wise.

* * *

[0] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

[1] https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#...

[2] https://github.com/gorhill/uMatrix/releases/tag/1.2.0

> uMatrix can selectively block web workers

Maybe we should get rid of web workers at browser level until we figure out this mess. Web workers are seldom used and could be enabled manually per site.

Service Workers are a subset of web workers and are heavily used.

> are heavily used

Whom by?

If you're using Chrome, check out chrome://serviceworker-internals/. It'll show all the websites you've visited which have registered service workers. Mine has 25 entries, including Twitter, Amazon, Google, Google Drive, Let's Encrypt, etc.

Empty for me. Sites still work, so I guess they are not essential afterall :)

Service workers are essential for good mobile first, offline experiences. Check out https://developers.google.com/web/progressive-web-apps/ for more details.

I'm sorry. As a user, to me "offline mobile first experience" sounds like a synonym for "this website takes more than 30 seconds to load and drags my phone down to its knees and the author was just too lazy to write a native app". I don't mean that as an insult, but as a user that is precisely what that sounds like to me. Nothing about web apps I have access to acts to change my mind in this respect. They're all incredibly slow to load, especially over anything less than LTE. For extra credit, they usually take up so much RAM that Chrome RAM usage ends up kicking out all background applications out of RAM on my phone.

Does downloading and installing a native app take less than the time to load a webpage on your phone? In my experience, web pages in general load much faster than native apps.

I download apps when I have a good connection. I load websites when I need them. The latter is not always on a good connection

Reply on news.ycombinator.com