Hacker News new | past | comments | ask | show | jobs | submit login

Without the suggestion to install an adblocker, this is not credible advice.





A media outlet which depends on ad revenue as a primary income source is unlikely to suggest this.

Ditching these deeply invasive products remains a good idea, independent on any decision to use ad blockers or not.

The Meta/Yandex incident in particular is straight-up malware and everyone should remove their apps.


Getting privacy advice from an adtech funded outlet sounds like reading democracy advice from the Chinese ruling party or vegetarianism advice from lions to be honest.

It might be correct-and-incomplete but they just have no credibility on the topic.


WaPo is dependent on subscription revenue, not ads. They limit the number of articles non subscribers can read.

They're also owned by one of the richest men in the world...


Maybe, but they they refused to offer an ad-free subscription tier last time I asked. NYT and Chicago Sun Times also refused.

Of course it's dependent on ads, what are you talking about, nothing prevents showing ads to subscribers to the tune of 180 mil/year

https://cbsaustin.com/news/nation-world/washington-post-lost...


WaPo is dependent on subscription revenue, which is more than 2/3rd of their revenue.

Advertising revenue is less than a 1/3rd of their revenue, and dropping fast. Ad revenue from more than 50 million visitors is less than subscription revenue from 2.5 million subscribers.

If WaPo was dependent on ads, they would have taken steps to increase accessibility to articles, but they didn't and haven't. Instead, they're restricting more and more content to subscribers, because ultimately subscribers are the ones that keep the lights on.


In no world is a third of revenue a "small fraction", especially with such big losses, so you won't be able to argue out of this simple fact that it's dependent on ads.

> and dropping fast,

Just like the number of subscribers and subscription revenue?


Many HN commenters work for "adtech funded outlets". Do they have any credibility on the issue of privacy.

Depends on their stance on the issue but individuals don’t necessarily share the views of their employers.

WaPo is by no means worst here. But their omission of Adblock in this article means they can’t be credible.


"But their omission of Adblock in this article means they can't be credible."

But adblockers do not fully solve the problem that the article is focused on. Namely, the use, e.g., by Meta and Yandex, of websockets in closed source mobile apps to listen on a loopback address for requests by mobile browsers, e.g., for tracking pixels.

There are approaches to prevent such tracking that do not necessarily require adblockers running in browsers. If the article mentioned Adblock but omitted other approaches, then does that mean the publisher is not credible.


Ad blockers can and do also block connections that aren't strictly "ads" themselves.

Telemetry for example.

But the point of the comment was that there are other methods besides ad blockers running in browsers. There are often alternative methods that "tech journalists" rarely if ever mention.

Sometimes, these methods are arguably better. For example, some methods can limit _all_ connections, whether the connections are initiated from (a) browsers, (b) other applications or (c) pre-installed corporate operating systems.


Is it true that, individually, Washington Post "tech" journalists might be credibie but their employers would not be credible.

Individually they might, but I wouldn't take advice from their employers.

You’re not wrong, but there was a time many of olds remember when editorial content and commercial concerns were firewalled. It used to be outrageous, and usually wrong, to suggest an editorial position was contingent upon a business benefit for the media outlet.

I miss those days.


It was always naive to believe that business interests do not influence the content.

You can't firewall a journalist's understanding that their job depends on certain things.


> which depends on ad revenue

They're more tightly bound than that. They're dependent on Google Display Ads. Which really makes their whole diatribe that much more pathetic.

Any media company that decided to traffic the ads themselves, from their own servers, and inline with their own content, would effectively be immune from ad blocking.

> Ditching these deeply invasive products remains a good idea

While still allowing random third party javascript to run unchecked on a parent website.


> While still allowing random third party javascript to run unchecked on a parent website.

Lol, why are you commenting as if somehow allowing it to run negates the other good ideas in some way? Obviously some is better than none, and all is better than some, but each step takes more effort.


lol, because ads pay for the content you're reading. it pays salaries.

what I _don't_ want is to be _tracked_. show me ads all day if you want.


They'd like to show you personalised ads, for more effective manipulation, which implies tracking.

I have bad news for you about how ads work. Also, you didn’t really answer my question, you just dodged it.

I’m not asking what you think makes for a successful ad campaign, I’m asking why you’re letting perfect be the enemy of good


It’s odd that orgs like NYT don’t run their own ad services. I’m sure they have a dedicated department for ad sales for physical copies. They’re large enough that companies would work directly with them. And they would have at least some editorial control on what is displayed on their site.

I've worked for a few companies that had ad placements. I wasn't too deep into that side of things, and it was a long time ago, but as I recall, at reddit there was an in house ad auction platform. If there wasn't any ads sold for the period, we'd either show in house ads (think the old reddit merch store, pics of animals, a pic of one of the reddit staff with a paper tube on his forehead to resemble a narwhal, etc) or ads from a network like AdSense. Once upon a time this actually caused issues because there was malware being served from one of those and networks

The NYT does have a direct-sold ads business and first-party data platform for targeting them: https://open.nytimes.com/to-serve-better-ads-we-built-our-ow...

Targeted ads based on extensive data harvesting are just soo much more juicy though.

That used to be how print newspapers worked.

Hosting the ads on the same server as the content is done in some cases, but doesn’t result in any immunity. If the ads are sufficiently annoying, it only leads to a merry little game with the adblocker annoyance list community, where they figure out new regexen to block the content, deploying daily. Bypass the blocks too effectively, and the adblocker will accidentally start blocking website content. Users will assume the website itself is broken, and visit less.

Self-hosting ads is not really a winning game unless your ads are non-animated, non-modal static text and images.


> A media outlet which depends on ad revenue as a primary income source is unlikely to suggest this.

That's a problem for the media outlet to solve. Ad-supported tech "news" can never be trustworthy.


The advice is fine, just incomplete.

It is better than nothing and definitely for the more "normies" advice. Let's start there and then we can get them onto adblock and other stuff.

Btw, the ArsTechnica article they link offers more advice[0]

[0] https://arstechnica.com/security/2025/06/meta-and-yandex-are...


The FBI recommends using an adblocker: https://news.ycombinator.com/item?id=41483581

They will not bite the hand that feeds them.

But I am glad they are pushing people toward other browsers because that is the biggest step. Once you have taken that step, installing the most popular extensions is trivial.

Guess what the highest rated extensions are?


Does the ad blocker prevent leaks of your information?

I know it blocks a use of your information against you (targeted ads). And any external source is a potential leak (e.g. the kinds of things that CORS is supposed to reduce).

But does an ad blocker specifically leak more, or just reduce the incentive to collect that information?


A full-featured ad blocker (uBlock Origin original, not the neutered Lite version that runs on Chrome now) will intercept requests at the network level and prevent your browser from requesting the advertisers' JavaScript code. Your browser not only won't show the ads, it won't run the code that was supposed to show them or even send a request to the advertisers' servers.

This blocks most existing tracking methods. The only thing you're not protected from is first-party tracking by the site you're actually visiting, which is impossible to fully protect against.


>prevent your browser from requesting the advertisers' JavaScript code. Your browser not only won't show the ads, it won't run the code that was supposed to show them or even send a request to the advertisers' servers.

Incidentally, just blocking JavaScript with NoScript kills quite a lot of ads (obviously, not first-party ones if you've white-listed their JavaScript for site functionality; but I try to avoid that when there isn't real demonstrated value) without any need for an explicit ad blocker.


NoScript is indeed very effective at blocking tracking, but it also breaks a lot of websites.

If that is an acceptable compromise, you could also try ditching the Internet altogether, as that not only blocks all online tracking, it also blocks a lot of fraud, misinformation and all kinds of harmful content.


Except for non-negotiables (eg: bill paying, government websites, etc.) a website that fully breaks when blocking js is just a worthless site which is not worth my time.

Anubis (https://anubis.techaro.lol) requires Javascript and is required to view some otherwise static websites now because AI scrapers are ruining the internet for small websites.


AI scrapers are a weak excuse for slapping on malware on your website.

That’s always my problem with NoScript being suggested. For some people who consume stuff off RSS feeds or static sites and Wikipedia that probably works. But for literally anything more than that you can’t do that.

It's not about living like a caveman. You can enable 1st party JS without JS from 20 ad/tracking hosts.

> But for literally anything more than that you can’t do that.

You literally (actually literally) can.


> NoScript is indeed very effective at blocking tracking, but it also breaks a lot of websites.

Sure, images may no be present without JS lazy-loading them. Accidentaly, NoScript also fixes a lot of websites. Publishers are often paywalling posts via JS and initial HTML is served with full articles.


> A full-featured ad blocker (uBlock Origin original, not the neutered Lite version that runs on Chrome now) will intercept requests at the network level and prevent your browser from requesting the advertisers' JavaScript code.

You're trying to imply that ublock lite doesn't do that. It does, including javascript files. The full uBlock does more things to prevent tracking that lite cannot do. But "intercept requests at the network level" isn't one of those things.


1st-party would likely be prevented by disabling cookies? Obviously they could fingerprint every visitor on every request, but most just set an ID cookie and check it on subsequent pages I think, since that's good enough for tracking most people (who aren't actively trying not to be tracked). Of course, that breaks things that need a session (like a cart), but depending on what you want from a site, it could be fine.

Those things help, yes. I say that it's impossible to fully block first party tracking because you must interact with the server in order to accomplish anything and those interactions can be tracked. But a third party can be cut entirely out of the loop.

There are ways to maintain a session without a cookie, but cookie is very convenient so that is mostly what is used.

I think there was a Defcon where they showed that some ad networks let the advertiser themselves provide the image/video. By targeting only people who first visited a given website, they know who you are. And by adding selectors on the ad, they extract your characteristics, including location.

It looks very stretched, but the real magic happens when this data is sold in bulk. It allows recouping who is where. Your target person may or may not be in each dataset, their location isn’t known like clockwork, but that allows determining where they work, where they sleep and who they’re with. One ad is useless as a datapoint, but recouping shows reliable patterns. And remember most people on iPhone still don’t have an adblocker.


they don't load up the ads at all so they can't know your information in the first place at least from the ads themselves. if the website is sharing information directly there's nothing you can do outside of some kind of vpn and never logging on to any services.

Yes they block tracking

They suggest Brave browser, which has an adblocker built in and on by default.

That may not be viable for many non-technical users, which is their audience. On HN, it would be an error to omit ad blockers; the Washington Post has a different audience. I expect that most would find installing and learning a new browser to be too much effort and too hard to understand.

This is provably wrong since Google has been pushing Chrome installs for over a decade.

Good point.

It’s still good advice

I would bet money that the techie they asked to put the list together included "use an adblocker." And then the higher-up who approves articles like this said "shit! wait... no, no, no, delete that one!!" These corporations are deeply deceptive.



Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: