Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf
ericdraken.com
ericdraken.com
> Exploit a Protobuf Flaw to Easily Remove All Ads by Changing One Byte
He's intentionally corrupting the tag on one field of the protobuf. The "flaw" is apparently that Protobuf ignores tag numbers it doesn't recognize. But that's not a flaw, it's a core design feature of Protobuf, designed to allow extensibility.
> Notice how the Protobuf response payload is 1.87 MiB? As I said, Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files, but a quick linear scan takes no effort at all.
1.87MB is not that big, and presumably these messages only come through occasionally, not in a constant stream, so I'm a bit perplexed about the purported performance barrier here.
The text seems to be claiming that Protobuf encoding is designed to be expensive to decode, but it's actually the opposite, Protobuf is intended to be efficient to decode.
He says you need the source proto (schema) files to make it efficient, but this isn't really true, you can decode directly into UnknownFieldSet easily enough.
Or better, he could have written his own fake .proto schema that covers just the one field he is aiming to remove. This would have been much less error-prone than the string-scanning approach which could accidentally match other data where the same byte sequence happened to appear by coincidence.
> While computationally expensive, decoding, editing, and re-encoding without the original schema leads to a modified encoding. This is likely because we cannot detect if ZigZag encoding is being used, or if a number is an int32, int64, sint32/64, varint, etc., plus the order of object fields is normally non-deterministic. Here is some Protobuf trivia on the matter:
I think he's misunderstanding here. The point is that the Protobuf encoder is allowed to encode fields in any order, hence decoding and immediately re-encoding a message can lead to different bytes. But, the receiver is supposed to treat the message the same regardless. It's unlikely that the YouTube app is going to notice if the field order changes.
(I used to work on Protobufs, a long time ago.)
“1.87MB is not that big“
I have lived in rural communities most of my life and unless I’m on my own Wi-Fi, this actually is a big file to download. Maybe they have a workaround for mobile? Mostly I just want to add that rural Wi-Fi still struggles with Web 2.0 architecture. More often we’re operating on 2-4G speeds.
Although if you’re in any kind of metro area with a population that supports better infrastructure, 1.87MB has mostly become a small file size. Except maybe at 6pm when everyone on your cable trunk is streaming content. :)
You’re right about 2MB being a large payload in some network configurations, but I think it isn’t that big in Youtube’s context.
My ISP when I talk to them about their speed issues "Well, 7mbps is all you need to stream Hulu", which is.. a terrible response. Want to do something else while streaming? What if _two_ people want to stream? What if I want to stream a video while my partner is playing a game online?
Ads are simply a _HUGE WASTE_ of my bandwidth, so I filter as much as I can.
Yet for some reason I will not place 9 unneccessary bricks in my car, nor tolerate them if I discovered them already there.
Is the "some reason" irrational?
4G speeds are completely fine for watching video - I do this often in very rural locations using a Verizon hotspot (4G only). Sure, less than that is problematic for video, but 1.87MB is still small over 3G.
1.87MB is definitely not small over a bad 2G link that you’re sharing with other people.
It's humorous if you ask them if they have a wire and wired device to test they frequently act as if you asking them if they have a vacuum tube or a teletype. Meanwhile they frequently struggle with wifi configuration problems with devices that are 3 feet from one another.
It’s not rare. Ubiquiti is very popular for setting up point to point links getting a single internet connection shared amongst a bunch of rural homes.
Shameless plug: I wrote a project to generate source proto files from binaries called protodump [1] - it regenerates all the message/field definitions (including the original names). It would just require pulling the binary off the AppleTV box
As for this specific context, presumably at least the bulk of the fields are shared between YouTube clients across architectures and platforms - it might be easier to just run the dump against binaries extracted from the YouTube apk than getting the specific Apple TV YouTube app binary. (For iPhone, you can just make a full iTunes backup but for Apple TV I imagine you’re going to need to do some forensic binary spelunking.)
https://github.com/protocolbuffers/protobuf/blob/main/src/go...
This takes advantage of the fact that such descriptors are commonly compiled into programs that use protobuf. The descriptors are usually embedded as constant byte arrays. That said, not all protobuf implementations embed the descriptors and those that do often have an option to inhibit such embedding (at the expense of losing some dynamic introspection features).
What and understatement. For those unaware, Kenton made protobufs to what they are today.
Protobuf was my first dip into what are IDLs; it seemed like a magical idea at the time (having discovered protobuf ater writing my own rudimentary IDL first, protobuf was amazing).
You can write a simple protobuf decoder in a couple hundred lines of code if you don't want to pull in the full protoc dependency: https://github.com/kubernetes/test-infra/blob/master/guberna... https://github.com/kubernetes/test-infra/blob/master/guberna...
How do you solve it? Is it just heuristically checking where if the varlength byte sequence itself contains tags, it's likely to be a message?
In this case, getting a reply straight off the source.
Googling this, development ended in 2004? An informed summary of the current state of play would be interesting, since a lot of different "continuations" of it seem to be around. Also, is it Windows-only? (I've been casually looking for a simple proxy that would enable injection of local links into remote content.)
Can’t Wine help with this?
What works are browser based ad-blockers and app patchers like ReVanced. As my savings have gone up, I've relied more and more on just paying for ad-free services like YouTube Premium, Hulu, Netfix, and Max for the cases those 2 can't handle.
I use a layered approach. I’ve been using Pi-hole for 8-10 years, don’t remember, with about 1-2M in the block list.
In addition, I use uBlock as well as pfsense with pfBlocker-NG for blocking countries and other features.
They all work well together. Sometimes I have to bypass them, when I momentarily use the ISP’s Wi-Fi router directly.
It’s been working fine.
Since Cloudflare employees are known to lurk here, I'd like to know: is this considered a false positive, or working as intended?
Greetings from a country whose (almost) entire IP space is blacklisted by Cloudflare!
Sounds like something that would be "trivial" to defeat, by means of "emulating" other TLS implementations more closely?
what else do you MITM for?
Once the requests leave the computer and travel onto the internet destined for another computer, then of course "MITM" makes sense as a concept. We all want to prevent that.
The computer owner controls the proxy and it's the proxy, not the untrusted application, like a "modern" web browser for example, that handles authentication of the remote peer. Compiling and fully controlling a "modern" browser is a PITA. Almost no one does it, even software developers. Instead people beg for an advertising company or their partner to make changes to a browser. That does not seem to work. Sometimes when people complain it stops the company from making undesired changes. But only temporarily.
Whereas compiling a proxy is easy and the user can fully control it.
Having used many different applications that implement support for TLS, I actually trust the proxy's implementation more than most applications. It's arguably easier to audit one program, the proxy, than it is to check every application to make sure the developer didn't make a mistake when adding TLS support. I recall socat as one example. That mistake went undetected for a long time. Elinks was another. At the time, it was dropped from OpenBSD ports as a result.
[1] https://reshade.me/forum/troubleshooting/8746-reshade-v-5-8-...
https://github.com/deetungsten/webui-privaxy is the dockerized fork of https://github.com/Barre/privaxy
If there are known exploits for the TV (a bunch are now running old and unpatched Android), the answer is easy enough (root it and do what you want - though that opens different and maybe easier options for ad stripping), but I’ve heard of it on Apple TV where jailbreaking isn’t so easy. Perhaps MDM deployments?
Looks like it uses the method in this article https://developer.apple.com/library/archive/qa/qa1948/_index... but i have not (yet) tried it
I have it working for a few TV Everywhere compatible apps, but some are proving to be more difficult than others. I may have to do some other TLS inspection with mitmproxy and figure out what needs to be removed with the custom uBlock filter syntax option.
WireGuard doesn’t actually use AES, as far as I know.
In general, it seems like the author somewhat overestimates the CPU requirements for TLS encryption (or equivalently underestimates modern single-board computers):
> The CPU requirements to decrypt and re-encrypt HTTPS traffic greatly exceed those available to Raspberry Pis.
I'd be really surprised if MITMing TLS on an RPi 4 was actually infeasible, even when using RSA cryptography purely in software.
There are Android phones still in use with weaker CPUs than that of the RPi 4, and these use TLS too.
The CPU requirements for TLS are extremely dependent on the desired bandwidth. At even higher bandwidth, offloading onto accelerators becomes important to be able to do it at all. The cost of handshakes is also nontrivial, and can limit the number of connections per second. For a single device, rarely a big deal. For an entire network of devices, it can be a bigger problem.
That's a lower, not an upper bound.
An RPi 4 can encrypt/decrypt AES-256-GCM at more than 300 Mbit/s, according to my rough measurements. That's per core, of which it has four.
RSA can be much more expensive, but that's besides the point – the author was claiming that AES-NI makes a meaningful difference here, which I'd really doubt even in the case of TLS. (As mentioned above, it can't help at all for Wireguard.)
But the bottleneck is usually in terminating and establishing SSL connections?
Which only matters for multiple concurrent connections... a single download would still be a sequential task on a single core at 300Mb/s, which I would find to be an unacceptable bottleneck on my gigabit connection.
In reality, it would probably only be 300Mb/s for up to 2 connections, since it needs to both decrypt and reencrypt, which could be parallelized onto 2 cores, otherwise 150Mbps for 4 connections if each connection was handled only on a single core.
Either way, it would not be possible to MitM 1Gbps of traffic on a Raspberry Pi 4, with the numbers you provided, only 600Mbps total, and only across multiple connections. It would be an extremely noticeable bottleneck.
Upload congestion, together with massive Bufferbloat powered by horrendously configured CPEs, is what makes home internet connections feel slow most of the time.
I don't agree, but for argument's sake, where do you draw the line? What is acceptable? 10Mbps? Each person would have a different answer.
62 messages per second means that you have 16ms to do 5 things: decrypt the TLS, parse the protobuf message, filter the message, encode the protobuf message, encrypt the TLS traffic. If you take more than 16ms, you cannot achieve 1Gbps.
We've already established[0] that you can't even hit 1Gbps with just the TLS traffic. The protobuf messages might be fast to parse... but they will still slow things down even further.
I guess the only way to do that would be to dump the flash memory, replace the CA and reupload the dump to the device?
A good write up here for ways to try to intercept IoT devices without any hardware/firmware job: https://robertheaton.com/2019/11/21/how-to-man-in-the-middle...
The only relevant thing to repeat here might be this
> if you can’t get access to your IOT device’s hardware in order to add a new root CA to it, your journey mostly ends here. Don’t lose hope though. Leave your setup running for a while and see if anything strange happens. When I attempted the above process on my baby’s crib, the device refused to trust Burp’s certificate and so refused to complete a TLS handshake with my laptop. But after a minute or two of repeated failures, the crib started sending out some of its system status data over plain, unencrypted HTTP!
The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved.
Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.
For iot security reasons, namely trying to stop persistence of exploits, secure boot features on arm processors will become widely used. Think of it like TPM chips. This will make it much harder to “own your” device.
Instead, why don’t we attack the advertisers? YT/Google only appear to track “clicks”, but does it actually track purchases as well?
In theory, if there are enough fake (bots) and real users clicking through ads but not buying anything. Then that should burn through the advertising budgets. Over time the marketing departments should see that clicks are at an all time high on X platform but conversions are a small percentage of those “clicks” or impressions. Thus pulling out from the platform all together.
> New Goal: Let’s trick YouTube into believing I am a 70-year-old male living in Italy.
Once I somehow convinced ad targeting I was in the market for $500 machine washable silk pajamas for my mistress.
Best ads ever, though I wonder what they were paying per impression.
After switching to Apple TV, we mostly get incorrectly geo-targeted local ads. It’s better on average, I guess.
i am not sure how one could possibly characterize that as a "flaw," since protobuf is a field-numeric length-prefixed protocol in the first place. it makes a (reasonable) assumption that bytes won't be messed with over the wire, leaving integrity to the reader, so even if this _was_ a flaw, it would be a flaw in the YouTube app for iOS, not in protobuf...
since it isn't a flaw, it isn't an "exploit," unless you are referring to the fact that youtube's protobuf exchange on their iOS app isn't checking hashes for returned payloads.
i suspect after this post they will
There's also this bit:
> Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files
Yeah, it's computationally expensive if you use unoptimized Python code to do it. If you write your code in C (or another compiled language) then scanning 1.8MB of protobuf code should be trivial, with or without the proto source files.
I'm pretty sure that making Protobuf files hard to decode without sources is not a design goal. If it was, they did a pretty lousy job.
Required fields were a feature of Proto2. In proto3 syntax (latest), the required field concept was dropped because it caused issues with protocol evolution and was easy to misuse.
In essence, because of the backward and forward compatibility guarantees supported by protobuf, a "required" field must be required for the entire lifecycle of the protocol.
For these reasons and others, protobuf takes a stance where unrecognized fields are not necessarily errors. If it took a strict stance and failed in this condition, the presence of new fields in an "evolved" protocol would be an error which would break forward compatibility; old clients would not be able to communicate with new servers, and vice versa.
Protobuf guarantees that new fields will not break forward or backward compatibility.
This is why parsing unknown fields in protobuf is a feature, working as intended, not a flaw. In some language SDKs for protobuf I believe you can customize this behavior but it really isn't a good idea.
This is also why the app authors might want to consider a hash instead. Tampering with the payload would break the hash, and without the schema, the author would not necessarily know where the hash was situated in the payload to fix it, or even that one is present at all. The complexity of recalculating the hash (assuming they find it) vastly multiplies the attacker's burden at little cost to the application; adding a few rounds and a salt, for instance, would make this kind of attack significantly harder to pull off.
It's not perfect security, but it would certainly be better.
Haven’t found the most elegant way. Probably the path of least resistance is getting a separate router and connect the devices AppleTV, firestick, etc to that. But then you’re going to be constantly swapping networks if you wanted to use a different app with location.
But even that feels weird because you’re paying monthly for a smart dns service just to appear in a different geolocation. There has to be a better way.
You get native player and no ads.
In my spare time I got to the point in the article of trying to figure out which URLs are ads and blocking those with a pihole in section 4.11 and failing miserably. Cool to see some techniques I would never consider, and they work!
From personal experience, we programmers/hackers sometimes like to make things more complicated than they need to be just for the fun of it (and learning experience too!).
it's a bit like inspecting source on a banking website, altering the balance html, then expecting the displayed value to reflect actual account funds
Makes it kind of hard to digest, impressive as the material is
Completely unaffiliated, just a happy user.
https://github.com/yattee/yattee
and using either
https://github.com/iv-org/invidious https://github.com/TeamPiped/Piped
as backend is a nice alternative.
Both those links are to alternative YT frontends, though?
Is there no risk running an MITM proxy, even if self hosted, that can see all your financial and other important private communication?
I know a couple mentioned here are open source, but are they guaranteed to be safe? How do I know which one (s) are good to use and can be trusted.
I want to rub it based on this thread, but have the above concern.
Does that make it guaranteed to be safe? Not really. I'd personally trust our TLS stack over most IoT TLS implementations, but Chrome/Firefox/Safari will do a better job at e.g. revocation checking. That being said, I'd argue that this is unlikely to be the weakest link in your threat model.
MITMProxy is a pretty well known and trusted open source project, but I wrote my own proxy to keep Apollo alive.
“ This unboxing and setup has been fun, but I’d like to block all the bad traffic on my network. I’ve been using a workhorse of a DNS-level adblocker called Pi-Hole on a… yes, Pi, but it would be nice if I can reclaim that wee bit of hardware for something else and use a comparable add-on module in pfSense. Let’s explore that now.”
So basically that was only doing DNS level blocking. This article is about traffic decryption and manipulation.
It is “protobuf” with a T, not “profobuf”. I know the typo is in the headline on the original article, but it is bad to spread it, and it looks bad on the front page here.
If you don't mind that users can see what you're leaking to the server from their device, or sending to their device, then please don't use certificate pinning, or at least make it an option...
Not sure which side you're on here
Those that know what they are doing (i.e. tinkering with the app to find out what makes it work or to modify it), and those that have no idea what any of this means and that get instructed by scammers on the internet (e.g. phone support scams) to do so.
I’m all for privacy but that is regulated via other means — the law.
(Some people are unable to afford it but that's an entirely separate social problem, and it would be unusual for somebody with the skills demonstrated in the article to be struggling to earn a living wage.)
What I would be interested in this protobuf inspection approach for would be implementing some decent parental controls. I would very much like to be able to enable/disable individual youtube channels. Currently all I can do is switch the whole site on and off. I have all the necessary infrastructure already, so I might give it a try.
But the most important issue is that as long as malware can spread through ads (https://en.m.wikipedia.org/wiki/Malvertising), everyone should be blocking all ads.
Or should we just continue consuming people's services and effort while blocking what's sometimes their only revenue stream?
I'd rather not use a service if it has ads and I can't remove them, instead of block them and make everyone else's experience worse.
In fact, not blocking internet advertising is a security risk.
If they get their house in order my opinion may change, but there's currently no business reason for them to change their existing lax systems; no pressure or threat from regulation to hold them liable for what they allow on their advertising networks.
How is this any different from changing the channel, leaving the room, or just hitting the mute button and closing your eyes in the scenario of "regular" TV when adverts or any other content you don't want to see appears? Compelled consumption should be illegal.
If you created a painless, super easy way to remove all ads, i'm sure that TV channels will also find it hard to sell to advertisers, and thus, their revenue would decrease.
I watch TV on my tablet now, streamed from a Raspberry PI with a TV Hat. Again, I activate the popup player, start browsing, maybe checking HN or whatever. I put the volume off. Maybe I start doing something else. The advantage of a tablet is that I can bring it with me wherever I go in my house. The TV, not so much. I rarely switched on my TV in the past two years.
I always found it bizarre that other people did not do the same
We had that almost 3 decades ago:
https://www.orlandosentinel.com/1995/09/20/with-this-vcr-com...
Now before you dismiss this as childish and/ or obnoxious: please consider the point. We cannot gloss over _what_ we "have" to watch and not just that it's an ad.
It is true that things have to be paid for and I am 100% for this. But if you want me to basically degrade myself in order for me to get to watch your content, then wtf?
Of course on cabled channels, they get part of the fee of your package.
There is no "compelessed consumption", there is available package "this for free with ads", or "this for a fee", you're free to chose the one you want or neither.
I'm certain your company whichever it is would have an issue if I wanted to use its services but then run away when it came time to pay the bill.
And I dislike YouTube's hostile ad escalation in recent years. One ad - fine, two ads - hmmm, three ads - what the hell. Unskippable ads. Inappropriate ads. Loud-ass eardrum ripping ads. Ads even on Premium.
They've tried? It seems like it would be pretty easy to detect ad sequences in larger channels.
I really dislike the attitude of defending megacorps and worrying about their bottom lines, especially anti customer ones like Google.
Things cost money. Every monetizing strategy involves users paying for it or the company making money from the users indirectly. OP mentions both of these. So tell me, what's a monetizing strategy other than these that works?
People consumed videos online at a very limited scale before YouTube, and those videos were usually hosted by few, generous individuals. Even if every user in the world decides to contribute 50% of their device storage for a decentralized streaming platform, I doubt it would even fit a small part of all videos in YouTube's catalog right now.
I really dislike the attitude of hating megacorps without really proposing any viable alternatives.
Consider a freemium model without the threat of adxtortion, obviously this would require youtube to offer a significant value add and/or premium content besides trying to be a monopoly and gatekeeping eyes. Make it purely subscription based (e.g. Netflix before ads). Ask creators to pay for the blue checkmark. Make it a loss leader. Plenty of adult streaming sites manages to do just fine without youtube style invasive ads. I'm sure much smarter people can name countless other ways as well, it also does not need to be a 1-1 alternative either.
This. PeerTube can provide similar benefits without centralization.
I remember I had this discussion after a school political debate in the 90s, with (adult) actual politicians. Textbooks at the time were not publicly funded, and naturally the textbook companies jacked up prices for their captive audience forced to buy their books.
This one party had the "brilliant" idea of ad-funded textbooks. I asked, if the textbook companies currently take $50 for the book, if it was instead funded by say McDonalds ads, how many extra burgers would each student have to buy that year? They didn't have any good answer to that.
See here (picture gallery): https://johannes.freudendahl.net/2019/01/werbung-in-romanen/
The introduction goes like: "Only Kirk kept helping himself, because he was convinced he would need strength for the upcoming events." and then below the black bars the actual ad: "The reader should do same bla e.g. soup bla takes just 5 minutes etc"
Just some anecdote.
It's the same as blocking YouTube ads; Google still pays the creator as if you had watched the ads, so your video playback is being subsidized by Google's ad business profits.
When you choose not to block ads, you aren't "supporting creators", you are supporting Google shareholders.
Google's shareholders might, for a while, for the sake of "control". But either way, it's not sustainable. The anti-adblockers are right about that part. They're just wrong that watching ads without spending a ton of money on the products help matters.
The only part of Youtube that I find valuable is the content. Not the UI, not the comments, algorithm. Free content hosting is nice, but it's not the only platform hosting videos for free.
If I wanted to pay for a streaming service, it'd be Nebula (https://nebula.tv/), because I know it benefits creators.
But I'm never turning off the adblocker, thank you.
Huh? Ad revenue and Premium subscription also ends up as direct payouts for YouTube creators, what are you talking about? Why the need for this BS?
You're only looking at this from your own point of view. The content producers are looking for monetization options, and youtube is the only game. Nebula might be sufficient for some small amount of content producers, but it's unlikely to hit mainstream, and not enough people want to pay.
It's unfortunate, but ads are the only game in town on the internet atm.
I follow a wide variety of channels, but there are maybe a dozen to 20 that I would consider essential. Maybe 3-4 are on Nebula.
I think for a lot of viewers and creators, YouTube is simply inevitable at this point.
I'm using NewPipe (https://newpipe.net) on Android TV which provides an ad-free YouTube experience just like the Android phone version of NewPipe. Piped would also work on an Android TV browser like TV Bro (https://github.com/truefedex/tv-bro).
The legitimacy of ad blocking is well-established. People have been using DVRs, VHS players, and tape recorders to capture and consume ad-free broadcasts for decades.
but if I must take an alternative position: the last time I used youtube without premium (which happens sometimes because its not so smooth to log in if its a temporary session); the number and length of the ads was absurd, multiple levels of unskippable ads, minutes long, with volume that is much higher than the content itself. Awful experience and I can see why people who don’t have the free money want to lower it a little.
Thats of course not including sponsored content which contains an ad inside the video itself- even YT premium users get those.
Still doesn't protect you from in-video sponsorships (skullshare, OstVPN, etc.), product placements, etc. Some creators especially do these because it protects them from platform demonetization risk.
Same shit with paying for cabletv & movie theatre tickets. If anything, people that pay are their most valuable targets for ads.
Even a newspaper that I sub to runs ads and a zillion trackers against me. Ugh.
I get where you're coming from, but the platform could more to protect paying members from this. E.g. creators with over $x revenue must tag promos so the platform ships them for paying users
I listen to news and podcast-esque things in the car going to work or school drop-off / pick-up, on the way to sport etc. I'd begrudgingly tolerate the ads if the app background-played but it doesn't without paying for premium. I'm somewhere on an "entitlement" scale here, but background-play being a premium feature really feels like it's stretching the friendship.
So... alternative front-end it is. Great experience and no ads to boot.
Do you know that the paid version has this exact feature? This is a limitation of the ad-supported version, because advertisers are paying to actually have people watch their ad.
Why are you defending a multi billion dollar company from something that the users aren’t obliged to do in the first place?
I already pay Google much more than I care to and am willing to in the form of my privacy and personal data because of the ubiquitious surveillance that Google performs on as many people as they possibly can.
If I could cut Google out of my life I would do it in an instant, but I can't because they won't allow it. In lieu of that I take whatever I can from them.
“To steal from a brother or sister is evil. To not steal from the institutions that are the pillars of the Pig Empire is equally immoral.” -- Abbie Hoffman
Also, YouTube is a video streaming monopoly, if it didn't exist there would be a significant chance of new streaming platforms to succeed, but given that it captured the marked such chance is unlikely to exist, monopoly that they achieved hosting videos free of ads (or very light on these) and now that they have the control want to force people to pay or watch a ridiculous amount of ads.
But now they have ads.
People using their excess Internet connectivity, they already pay for for other reasons, to share content with others.
It works for socially disadvantaged, too.
What about fair advertising? The main problem here nobody dares to talk about because dealing with it would undermine the very essence of capitalism: unlimited growth, is that there is no way to have fair advertising exactly as there's no way to have a fair use of any resources. Once you allow anything to be used for profit, it will be abused from the strongest players at the expense of the others until the last drop. It would be extremely easy to put well defined limits on how much advertising can be shown, and make the Internet a better place, but no way, it's anti capitalistic and therefore a no-no. Ad blockers weren't born the same day advertising came to the Internet, and many years passed until someone realized we needed them; that was the day surfing became such a horrid experience thanks to unlimited, pervasive and ever growing advertising.
edit: and, by the way, I still have to see some company going bankrupt because of ad blockers.
That didn't last long...
I learn so much from the people who spend hours and hours making videos every month that I am more than happy to pay a measly $13 or whatever it is every month to YouTube.
They're an ad company. They pay the creators per impression even if you block the ads. Blocking ads harms Google, not the content producers.
Am I not telling them with my wallet to develop other ad-free solutions that I will pay them and the content creators money for?
> They pay the creators per impression even if you block the ads. Blocking ads harms Google, not the content producers.
Blocking ads and refusing to pay any money into the YT ecosystem decreases the revenue per viewer which will eventually reduce the amount of money YT pays to creators and/or increase the price they charge to YT premium subscribers.
Spotify suggestions and playlists weren't a seller feature for me for years. Maybe I'm missing out on a few podcasts.
Youtube is one of the best things on the internet. The shame is that it's centralized with a single point of failure.
The upsides of youtube are enormous - people learn a lot there. It's not just nerds learning about stuff, but everyone. How do I fix this thing on my car, etc? People show and tell about all kinds of topics. This is making people more knowledgeable and capable on a citizen level(!)
The written word champions here will have to realize that for some, videos are a superior medium for transmitting know-how.
30 second un-skippable advert to see a 7 year old 45 second clip? I press "back" and watch neither.
Thinking of supporting creators: I looked at Nebula a while back as an alternative; I think there was some UX issue back then, but they've likely improved it and I should look again.
Plus paying for youtube premium does not remove the sponsor ads inside videos.
Also I feel like the algorithm has gotten worse and worse? I personally don't like to support that.
It's not only more effective, but also doesn't support Google (main player in the ad industry)
I wouldn't support them that way. They shaft creators in every way possible.
You should be subscribing to Patreons and their video subscriptions. YouTube Premium is NOT the way.
Keep your hand in the adblocking world because it's morally right.
People can do two things.
> Disclaimer: I want to support content creators, so to be fair, after a few months of blocking YouTube ads, I am now paying for YouTube Premium; Just because I can break something, doesn’t mean I need to.
Did you even open the article?
We deserve butter! https://butter.sonnet.io/
Also you have more control over where the money goes with Patreon, and they’re far better corporate citizens than google.
>https://xn--rr6sn-uxa0n-t8gz-vg6i.googlevideo.com/initplayba... &orc=1&oeis=1&c=IOS&oss=1&oda=1&oad=5500&ovd=5500&oaad=11000&oavd=11000 &ocs=700&oputc=1&oses=1&ofpcc=1&osbr=1&osnz=1&msp=1&odeak=1&odepv=1 &osfc=1&id=58cc678216d6aaca&ip=121.35.98.26&initcwndbps=2125000 &mt=1640373902
This is one of the many things that make it _exactly_ like malware. Ads are delivered the same way malicious code or artifacts would be delivered to your device.
Weird-ass random subdomains, obfuscated query params -- no legitimate service that works for the user's benefit should behave like this.
But it's googlevideo.com. I know this is Google/YouTube's domain so the rest doesn't matter.
But it's a google ad, how could it link to a scam that looks exactly like my bank's website?
The fact of the matter is these techniques are well established black hat ways of preventing the user from discovering what you're doing on their device.
Those days are gone as the distinction between ads and malware becomes a technicality.
> In fact, the YouTube app is zippier because fewer connections are made to ad URLs in the first place.
I swear on LG TV that webOS runs at a smooth 60 FPS when it's not connected to Wi-Fi and slows down as soon as it phones home for whatever telemetry and ads LG intend to serve me...
In my experience, there was a noticable performance improvement as well. Bootup times alone are probably 2x-3x faster.
[1] https://www.reddit.com/r/LGOLED/comments/1571djx/guide_how_t...
The solution: I set up a query param that would disable google tag manager. All of the crazy tracking and telemetry stuff we didn't control was the biggest issue.
I am not sure who is to blame, but I guess there is no way we can get the simple web we loved back.
I commented about it a while back here: https://news.ycombinator.com/item?id=34374725
Failing all engineering effort, they could have use a beefer CPU...
I’ll just block ads, alphabet is doing fine anyway.
It's maddening how people just refuse to understand the GDPR. This is likely partly due to intentional misinformation campaigns from the spyware (i.e. advertisement) industry. And then the cargo cult takes care of the rest.
The general gist of GDPR is that if you're not doing some shady shit that your visitors wouldn't want you to do, you don't need a consent. As you said, it has nothing to do with cookies.
And yes, Google Analytics etc are shady shit that your visitors wouldn't want you to do.
Also most of the nags you see all the time are illegal for any sane intepretation of the law. But the regulators just don't care to enforce the law at all. So if you want to do shady shit, just do it without adding to the insult with having to bother with your illegal nag.
If you watch and enjoy YouTube in any capacity you should be ensuring that the creators get paid otherwise you’re robbing yourself of content.