Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Friday July 22 2016, @11:49PM   Printer-friendly
from the is-'malware-protection'-OK? dept.

China will ban all software and hardware that blocks Internet advertisements:

In a document published by China's Commerce Bureau [in Chinese], the People's Republic of China laid out the framework for a new Internet policy advertising law that will take effect September 1. This new Internet policy contains some radical changes to China's existing Internet guidelines, such as a blanket ban on ad-blocking. The new policy also pushes significantly stricter advertising guidelines, however, which could make it more beneficial to both users and companies.

Under China's new Internet Policy article XVI, all software and hardware that intercepts, filters, covers, fast-forwards or in any way prevents an advertisement from being viewed is prohibited. The policy explicitly points out that ad-block capability in email clients is also prohibited, as is network-level hardware that that may contain ad-block features. In our reading of the document, it would appear China is doing this to encourage what it would consider fair economic development of the Internet.

The new advertising laws do make some attempts to protect individual users from certain types of advertisements. For example, advertisements for prescription drugs and tobacco products are banned, and any products designed for pharmaceutical purposes must be reviewed by China's advertising agency before they can be put online. Advertisements are also required to be clearly marked, and they cannot be disguised as other content in an attempt to trick users into clicking them. Pop-up ads will be restricted to clearly display their location, and they must contain a clearly marked close button so as not to trick users.

This is good news for anybody seeking to hack Chinese Internet users.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by JNCF on Saturday July 23 2016, @12:51AM

    by JNCF (4317) on Saturday July 23 2016, @12:51AM (#378864) Journal

    Think about the current Red Queen's race between ad blockers and the ad makers that are trying to evade them, but with any detection of ad blocking resulting in criminal charges. It's a nightmare. A basic example of detection would be if the element that an ad image was nested in was periodically having its width checked to see if it was as large as you would expect with a loaded ad, and if it's not that large it phones home to report that the ad was prevented from showing up. You can come up with a simple work around to that, but when you're constantly having to play catch-up with ad companies and it only takes one successful detection of ad blocking software to get a conviction, ad blocking might become a crazy option for most citizens to pursue even if the ad blockers are usually ahead in the race.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by jcross on Sunday July 24 2016, @09:16PM

    by jcross (4009) on Sunday July 24 2016, @09:16PM (#379512)

    The comment below explains why this might not matter, but it's interesting to think about solutions. One is to have a "shadow browser" that renders to an offscreen buffer or a mock renderer, from which data is extracted for the page view being presented to the user. For a simple-ish implementation, imagine you have a minimized browser being controlled via Selenium or similar from a maximized browser that has access to the other browser's response data or potentially its DOM. Of course you're still going to pay the bandwidth cost of downloading all that junk, but at least you wouldn't have to look at it.

    • (Score: 2) by JNCF on Sunday July 24 2016, @11:05PM

      by JNCF (4317) on Sunday July 24 2016, @11:05PM (#379546) Journal

      There are just so many tricky things you can do with the DOM. If somebody makes an ad that blocks the user from accessing parts of the screen, has multiple ways of confirming whether or not the ad is still playing, and considers interaction with parts of the interface that should be blocked while the ad is still known to have not closed itself properly to be a sign of ad blocking, then you have to find and fool every mechanism they've made for determining whether the ad is up... and hope they don't make more while you're not looking (they will).

      Oh, that ad element still has a width of X? Then how did you click the submit button, citizen? You weren't using an illegal user agent, were you? (I assume Lynx will be banned, since it "blocks" most ads.)

      The ad doesn't have a width of X, even though less than 45 seconds have passed since the page loaded? To the gulags!

      Again, these are really simplistic examples. Convuluted ones would be harder to find and circumvent.

      • (Score: 2) by jcross on Monday July 25 2016, @12:43AM

        by jcross (4009) on Monday July 25 2016, @12:43AM (#379595)

        How can this be distinguished from clicking the link and leaving the browser unattended from that point? I can see how it gets sticky with page interaction, but real user data is noisy, and the simulated circumstances wouldn't be that rare for non-modified browsers.

        • (Score: 2) by JNCF on Monday July 25 2016, @02:59AM

          by JNCF (4317) on Monday July 25 2016, @02:59AM (#379633) Journal

          How can this be distinguished from clicking the link and leaving the browser unattended from that point?

          I'm not sure which one of us is misunderstanding the other. I was suggesting a situation in which an ad is blocking access to a button when the page loads, and the ad becomes hidden after a certain period of time. I'm not sure what point you're suggesting we leave the browser unattended from. Are you saying we delay the user interaction until after we think that no other elements should be blocking the button, perhaps?

          I can see how it gets sticky with page interaction, but real user data is noisy, and the simulated circumstances wouldn't be that rare for non-modified browsers.

          With a lot of modern websites, I agree that there are strange cases where the button would be visible from the beginning anyway. But if you really cared, you could deliver your markup with non-working buttons and only make them trigger the functions you want after the page has already completed first render and the positions of certain elements can be checked, so you know that your ads are where they should be.

          • (Score: 2) by jcross on Monday July 25 2016, @01:49PM

            by jcross (4009) on Monday July 25 2016, @01:49PM (#379800)

            Ah, I think I see what you're getting at. If the site detects that you've clicked the button behind the ad before the ad should have disappeared, it looks like something fishy must be going on. This type of mechanism could be tricked by artificially advancing the system clock available to the JS code, but of course you can't fool the server if not enough time has elapsed between page load and form submit or whatever. Even more problematic would be an ad that forces you to take an action before seeing the page because no clock tricks would work on that. So, I agree the site could be made arbitrarily difficult to fool, but on the other hand many of these measures would have a cost for law-abiding users who are not trying to block ads.

            To clarify, I was thinking specifically about news sites which in my experience are the most egregious users of intrusive ads (or were before I started using an ad blocker). What I imagine would happen in my "shadow browser" scenario is that the page would come up blocked by an ad, with the content loaded behind it. In the visible browser, I could read the content while the ad rolls on the shadow browser. By the time I get around to clicking a button, the ad is gone and it just looks like I'm impatient or a fast reader. Now obviously the site could defeat this by not loading the content until the ad completes, but then the user might have to wait between the ad and the content, and google will definitely not like it.

            Actually that's probably the main factor that will make this setup hard to defeat. Google can and will punish you for putting content on your site that the user can't see, because it looks like a deceptive SEO technique. If the content is only loaded via JS, the bot will probably not see it at all which will kill the page's search relevancy. I think they also don't like it when you deliver different content to their bot than you do to a real user. Any ad-supported site must depend on eyeballs, and they can't afford to piss off the primary source of them. In that respect Google is like Walmart: bordering on evil in many cases, but also using their power to police and improve the market. I'm thinking specifically here about Walmart's campaign to reduce product packaging, which seems to have worked.

            • (Score: 3, Informative) by JNCF on Monday July 25 2016, @02:36PM

              by JNCF (4317) on Monday July 25 2016, @02:36PM (#379828) Journal

              So, I agree the site could be made arbitrarily difficult to fool, but on the other hand many of these measures would have a cost for law-abiding users who are not trying to block ads.

              But given how intrusive ads already are, and how much they slow down the page by doing sketchy shit in the background to track users, does this really seem like a huge barrier?

              Google can and will punish you for putting content on your site that the user can't see, because it looks like a deceptive SEO technique. If the content is only loaded via JS, the bot will probably not see it at all which will kill the page's search relevancy.

              This isn't the case anymore. You can deliver empty markup and have your JavaScript throw some text in after first render, and Google will still index it. It's bad form, but you can do it and Google will play ball. Here's a 2015 article talking about it. [searchengineland.com]

            • (Score: 3, Informative) by JNCF on Monday July 25 2016, @02:55PM

              by JNCF (4317) on Monday July 25 2016, @02:55PM (#379838) Journal

              Also, Google at least allows the New York Times to let their bots past ads without fussing. [ghacks.net] Note that some people recommend not following the linked articles advice, because some sites will ban your IP if you claim to be a googlebot but your IP doesn't belong to Google.

              • (Score: 2) by jcross on Monday July 25 2016, @09:28PM

                by jcross (4009) on Monday July 25 2016, @09:28PM (#380059)

                Well shit, I guess we're really screwed then. There's basically nothing stopping the web from becoming almost 100% executable and not a collection of documents at all.

            • (Score: 3, Informative) by urza9814 on Monday July 25 2016, @06:54PM

              by urza9814 (3954) on Monday July 25 2016, @06:54PM (#379976) Journal

              Actually that's probably the main factor that will make this setup hard to defeat. Google can and will punish you for putting content on your site that the user can't see, because it looks like a deceptive SEO technique.

              Last time I checked, Google wasn't particularly popular in China. So if the Google rankings of the popular Chinese sites start tanking, I expect that would mostly hurt Google. I'm sure Baidu will make sure they're playing ball with the advertisers as necessary.

      • (Score: 2) by Capt. Obvious on Monday July 25 2016, @03:25PM

        by Capt. Obvious (6089) on Monday July 25 2016, @03:25PM (#379848)

        I often, when leaving ads on on a site I like, have to manually remove elements from the DOM to click buttons/read content. Maybe if I left JS on, they would go away. But there's a big difference between "I will let you show me an ad" and "I will run your code"

        It never occured to me that because of that, they were registering me as an ad blocker. Oh well, I guess if I'll be counted like that, I may as well block the ad.