Slashdot Mirror
Chrome Will Whack Website Bait-and-Switch Tactics (cnet.com)
Starting next year, Google's Chrome browser will stamp out some shenanigans that send you to a website you didn't expect. From a report: You probably don't like it when you navigate to a particular web page and then your browser unexpectedly jumps to another page -- an action called a redirect and something the website publisher didn't even want to happen. With Chrome 64, in testing now and due to ship early next year, Chrome will block that kind of bait and switch, Google said. "We've found that this redirect often comes from third-party content embedded in the page, and the page author didn't intend the redirect to happen at all," Google product manager Ryan Schoen said in a blog post. Chrome 64 will block the redirect action and instead show an information bar telling you what happened. That's not all. Chrome 65, due a few weeks later, will squelch another unwelcome action that can happen when you click a link and the website opens in a new tab while switching the existing tab to a page you didn't request.
how about instead fix your fucking ads that are rife with this shit so it isn't necessary to have this kind of feature or better yet auto block ad providers.
Why can't we just remove the ability of JavaScript to open new windows/tabs. Is doesnt seem like this feature is use all that much except for popping up ads.
The millennial that doesn't like most of the stuff designed for millennials.
Maybe google could quit giving top rank in it's search engine to sites that do this. I don't care if someone wants to make a site like this, I care that when I search for a useful site I get one of these instead.
This is how websites know when you leave. It takes more cpu power to figure out from logs when you left, with no clue where to or via what link, than if they use an "exit server." I read Fark every day. All their links are to Fark Redirects. I am happy to let them know which links I followed to leave their site. No cpu eating javascript needed on my side; nice, clean standard html tells them what links are worthy of my attention.
Bait and switch as described in the upcoming "fix" where the new tab or window has what you want while the original goes elsewhere DOES suck, I welcome blocking it, but plain redirects are a worthwhile part of the spec. Leave it alone & fix the ads instead.
On the one hand you take life too seriously, and on the other, you do not take playful existence seriously enough. Seth
When I first saw the headline, I read 'Chrome' but thought 'Google' and my thought was "Oh great, Google is going to start penalizing sites where you do a Google search but the page does not contain the text that was shown in the Google result."
As for the issue actually being discussed, I've never even seen that happen.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Nope.
This is (presumably) going to prevent non-transparant redirects, eg ones invoked by window.top.location without user interaction. You know, the kind that the website doesn't get more than a few seconds to be seen before being sent off to shitty phishing ads.
in the headline. Color me surprised.
What about https://pi-hole.net/ ?
I'd rather have one device block everything via host names than having to configure every single device I own, some of them without that ability (ex: iPhone).
#DeleteFacebook
The Ghostery add-on has been doing this for a long time.
In fact redirects happen most often for me in Google search results.
Click on an ad and Google re-routs the resulting links so that they get credit for their ad.
I'd guess that Chrome will NOT block that kind of bait and switch.
But Ghostery pops up a little window that says:
"Ghostery prevented a redirect from ...
www.google.com to www.googleadservices.com,
which is part of Google Adsense. "
...omphaloskepsis often...
Chrome 65, due a few weeks later, will squelch another unwelcome action that can happen when you click a link and the website opens in a new tab while switching the existing tab to a page you didn't request.
Somebody's been viewing porn.
Nope, no sig
How well does Pi-hole work when you are browsing through a public Wi-Fi hotspot or over cellular Internet? How well would it work for someone whose home ISP blocks connections to devices on his LAN from the Internet? A local DNS blacklist doesn't require running a server
Unless one of the following is the case:
A. The model of Android device that you own has no root exploit.
B. You depend on applications that incidentally detect whether a particular Android device is rooted and refuse to run if it is, "for your security."
C. It's a bring-your-own-device (BYOD) situation, where the network administrator lacks "sufficient rights" over visitors' devices.
D. An adtech server rotates among millions of wildcard subdomains. (Unlike DGAs used by malware, wildcard subdomains incur no extra cost to register a domain.)
There are adblockers for iOS that don't need jailbreaking, just as there are adblockers for Android that don't need root. They work by setting up an on-device VPN and routing all traffic through that.
...or at least there were at one time. I had one on my wife's iPad 2. A quick search just now for them, though, indicates that Apple is weeding them out of the App Store in favor of something called a "Safari Content Blocker," which isn't likely to be systemwide. (I've not kept up with iOS and the devices it runs on much since switching my phone over to Android. I have an iPad 3 that I keep around as a PDF reader, but it no longer receives updates.)
In any case, I'm about to take you up on that Pi-Hole idea as soon as the parts for it arrive. You can't install an adblocker on a Roku, so the block needs to go somewhere outside the device.
20 January 2017: the End of an Error.
Firefox has done that for as long as I can remember (Options->Advanced->Warn me when pages redirect).
But then I stopped updating FF when they started fucking it up, so maybe that's gone now.
Can't find the option now, and I've never set it, but FF .. whatever the latest version is right now.. 56.0.2.. it warned me the other day about a re-direct. Default behavior.
The "Civilized World" jumped the shark ca. 1973.
You're DUMB if you don't use a rooted "dumbphone"
Selling your unrootable device probably won't provide enough revenue to buy a rootable one.
the network administrator lacks "sufficient rights" over visitors' devices
That's NOT a TRUE administrator then
I detect a "no true Scotsman" fallacy here. So for purposes of this comment, I'll define "true administrator" to mean "administrator of all devices connected to a particular IP LAN", and "guest network" as a LAN operated by someone other than a true administrator.
Hosts is fine for a true administrator. But not everyone has the luxury of being a true administrator; some people have a reason to operate a guest network. For these, a DNS filter component can run on the gateway appliance that already manages the guest network. And many of these can take list files generated using your app.
IF I was the controller of the IP stack itself? I'd do a 'wildcard' @ considerably LESS expense in hosts
On this, I wholeheartedly agree. Have you considered writing a patch for the resolvers in the Linux and FreeBSD kernels?
What about a redirect within a web site? If "page.html" moves to "Bozo-The-Clown.html" on the same web site, and "page.html" gets edited to redirect you, should there be any blocking?
I come here for the love
How about Chrome implement an absolute popup block, or at least a notification before opening one.
Even to this day, with the "block popups" option ticked, there are sites that do a trick to launch additional windows.
It seems that most scummy ad links are http. So just blocking links to ads that are not https would solve this real quick.
Can't we add this APK guy to our hosts file or something?
I am not really here right now.
...what is a desired redirect and what not? Redirects are a common practice and ideally inform the user that they will be redirected. Often times this is not done, for example, when using an identity provider. The users hits the targeted page, lacks authentication, gets redirected to the identity provider, once authenticated a redirect is made to the originally requested site with authentication and claims stuffed inside a cookie. For the user this looks like a seamless transition although two redirects are involved.
A few months ago, Slashdot had ads that were intermittently doing this. Web site operators need to ditch ad companies that do this stuff.
How about a Chome plug-in that detects sites that do this, and begins an automatic DDOS against the site? Everyone installing the plug-in would become a participant.