Thursday, July 31, 2014

AdBlock and Privacy

Wladimir Palant over at Adblock Plus fired an unexpectedly personal shot across our bow yesterday, which included statements like this:

The AdBlock project only pretends to care about user’s privacy. From their actions, it is very obvious that privacy considerations don’t play any role when decisions are being made.

I don’t have any blanket statements to make about the Adblock Plus team’s integrity because I haven’t met them. I have met Till Faida, CEO of Eyeo, the company that owns Adblock Plus. I found him charming and insightful. But even if I thought he was a jerk, I wouldn’t presume to know his or his team’s mind.

We agree with Wladimir that we should add a privacy policy (we’re on it), and that there was a bug in our code (fixed). Beyond that, Wladimir takes our attempts to do right by our users with a small team, and paints an incorrect picture.

So that’s the TL;DR version. If you’re interested in the details, here’s Palant:

The AdBlock project started out as an open project. They used Google Code hosting to make sure people can see their source code and contribute. However, that code repository was abandoned in August 2013. The new project description points people to source code packages that they can download. So you can still see the source code but extracting individual changes requires significant effort.

AdBlock is still an open source, GPLv3 project, with our code publicly available at code.getadblock.com. We moved away from Google Project Hosting because we rarely received patches from the wild, while our millions of less technical users were badly served by a noisy bug tracker doing double duty as a support portal. We moved to Tender for support and a private Github repo to write code. I think this was the right move to best serve our users with a small team. Our code is meant to be readable and is well commented, but I see Wladimir’s point that this move makes it inconvenient to follow individual code changes.

To conclude: AdBlock covertly moved from an open development model towards hiding changes from its users. Users were neither informed about that decision nor the reasons behind it. The source code archives are only left around to keep pretending that AdBlock is still an open source project, these are hard to find and the project owners are clearly hoping that nobody will be able to extract the individual changes from them. What are they hiding?

This is where Palant goes a little off the rails.

It’s no secret that we’ve been surveying our users about new ideas we’ve got, and yes, one possibility would be a partnership with Disconnect. There’s no conspiracy. In fact, this is an actual line of code from the AdBlock source:

path: ‘/partnership_analytics.json?’,

Not exactly subtle! And again: right there in the AdBlock source for anyone to see.

Besides that, the folks over at Disconnect are all about privacy. Their  anti-tracking extension is used by more than a million people each week, and has been the darling of top tier news outlets doing stories on internet privacy since they launched.

We’re quite happy to be mentioned in the same sentence with them.

AdBlock won’t just send a unique user ID to its server now, it will also transmit user’s setting determining whether Google Search ads are allowed.

User IDs are randomly generated and aren’t retained across different machines, browsers, or reinstallations. The ID is not associated with your personal information (which we don’t want). We use it to get an anonymous, very rough idea of what our user base looks like. How many French users do we have? How long does it take for a majority of users to update to the latest version? How often do users turn on our “I like Google ads” feature? Etc.

All ads are still blocked by default. And so far, AdBlock is still funded entirely by donations. We survey our users so we can learn whether they’d like and approve of other ways we might fund AdBlock. If you have an idea, please feel free to tell us!

Another interesting addition: the unique user ID mentioned above will be sent to getadblock.com every time an AdBlock user visits that website. Or if an AdBlock user visits getadblock.com.malicious.com. Or any other website that has getadblock.comsomewhere in the host name. If I were owning a website relying on ad revenue, I would have inserted a hidden frame into every page and used that bug to track AdBlock users — maybe some websites already had the same idea? And how does the changelog describe these changes? “Beta test for survey” – yes, sure.”

This is so the AdBlock homepage knows if AdBlock is installed, as part of our fight against credit card fraud. It’s true there’s little documentation for that particular function, as the point is to not give the fraudsters ideas. The “getadblock.subdomain.com” bug is valid and has been fixed.

AdBlock 2.6.21-2.6.27: The Disconnect.me functionality is being heavily worked on, it looks like Disconnect developers are changing it themselves. Trial and paid memberships are being implemented, whitelisting of Disconnect search ads tweaked. According to the changelog, all these releases are “Beta tests for survey.”

We surveyed a tiny group of users and asked them if they’d like using Disconnect’s functionality in AdBlock and how they’d like it funded. This of course requires adding the code to let the surveyed users try the feature.

Again, we do this to make sure that any new way we might fund AdBlock has our users’ approval. This is important to us.

The “AdBlock custom filters” (AdBlock-specific filter list that is installed by default and listed as recommended) add a set of filters to whitelist Mixpanel tracking on the AdBlock website.

MixPanel is a tool similar to Google Analytics that we implemented to help us profile credit card fraudsters (see above) and improve the post-installation page.

To conclude: If a project suddenly decides to work behind closed doors, something bad is usually going on. In AdBlock’s case, they started monetizing their users by partnering with Disconnect.me, and they didn’t want anybody to notice. When people noticed and started asking questions, they tried to downplay the impact of this change.

I feel like Palant’s making some effort to be fair in much of his post, but it’s allegations like this that make it clear why it was deemed unsuitable for the official corporate blog.

The phrases “monetizing their users” and “they didn’t want anybody to notice” conjure up a mental picture of AdBlock’s users all being secretly turned into dollar signs. In fact, what we’re doing is straight up asking our users where we should take AdBlock next. So far we only fund AdBlock through donations, and asking our users about other ways to fund our work is unrelated to our move off of Google Project Hosting.

To conclude: The AdBlock project only pretends to care about user’s privacy. From their actions, it is very obvious that privacy considerations don’t play any role when decisions are being made.

I’ve never met Wladimir Palant. I do know he’s an extremely knowledgable developer. And based on the last two paragraphs of his post, he can also be a very thoughtful guy. There’s some good, constructive philosophizing about privacy and user IDs in there, and the resulting Hacker News thread generated lots of interesting commentary.

And you know what? We do need a privacy policy. Did you know AdBlock didn’t even have a home page until the middle of last year? That’s right, the most popular extension for Chrome and Safari didn’t even have a home page — or any full-time developers for that matter, besides Michael — until 2013. But that’s still more than enough to time to have published something more formal than a few FAQs on the subject of privacy. So we’re going to get on that.

Tuesday, April 3, 2012

CatBlock lives on

So. I expected CatBlock to be a short-lived April Fools' joke. I put about four solid weeks of development work into it, but the code was pretty messy and I planned to delete it from AdBlock on April 4.

But you all loved it so much, and left so many desperate comments on the blog post asking for CatBlock to live on, that I posted an update:

Update:

Wow, um, there's a lot more demand than I expected for CatBlock to not disappear. So how about this: vote with your dollars. I will make a standalone version of CatBlock and email you when it's ready if you will support AdBlock with a monthly payment. CatBlock doesn't have to die!

I spent most of April working on this, and it's now ready! You choose the monthly price to pay for a subscription to CatBlock, I send it to you, and you once again have kittehs all over your internets.

Things I've added in the subscription version:
  1. Users can add their cats to CatBlock for all users to see!
  2. You can replace the default cats with any Flickr photoset
  3. or, replace them with any topic you want from Flickr. Dogs? Ponies? Sandwiches?
Thanks for liking my April Fools' joke :) - Michael

Sunday, April 1, 2012

Inturdusing CatBlock


Ohai AdBlock yoozurs.  Dis Mikulz cat speking

Dis Mikul.  He maekz AdBlock

He leevd dis coding laptop open.  Mayyyybeh... I typ on it

Im in ur AdBlock.  Maekin it CatBlock

AdBlock hadz stoopid logo.  I maek it betr

AdBlock hadz typos.  I maek it betr

AdBlock just block adz.  Dat is BORINGNESS

I sho u cats insted k?  Iz much betr

Whew k all dun.  Iz hard wurkz

I can has money nao?  Dat how it workz?

A note from Michael:

My cat was so proud of her achievement that I didn't have the heart to undo her work immediately. I'll leave CatBlock in place for a few days, during which you can enable or disable it on the AdBlock toolbar button → Options page. Dancing photo credits here.

By the way: I quit my job to work on AdBlock for Chrome and Safari full time (when the cat hasn't locked me out of the laptop). Every cat you see in CatBlock is an ad that I've been silently blocking for you. So I agree with her that you should pay some money to help me keep AdBlock going! I promise I'll send you a thank you note (or more, depending on how much you pay.)

And also, you should share this using the buttons below, and follow me. 98% of Chrome & Safari users don't have AdBlock installed, so you'll be a hero for spreading the word!

Update:

Wow, um, there's a lot more demand than I expected for CatBlock to not disappear. So how about this: vote with your dollars. I've made a standalone version of CatBlock, and will send it to you if you will support AdBlock with a monthly payment. Long live CatBlock!

Friday, April 1, 2011

AdBlock Freedom

Well, even if AdBlock Freedom isn't quite ready for prime time, AdBlock for Chrome and Safari works wonders for millions of users on the web -- with which we'll just have to console ourselves.

Help make AdBlock Freedom a reality!
All jokes aside, AdBlock is my full-time job, so if you make a donation it'll go toward improving AdBlock and paying my bills -- and maybe in 2051 I'll have a working AdBlock Freedom prototype for you to test :) If you do donate, be sure to include a note telling me what you think of AdBlock Freedom!

Meanwhile, as further consolation, I made some real-time graphs for you of users visiting the AdBlock Freedom page:

Visits per minute

Visits by country

Total visits:

Want to watch your friends apply to be beta testers?
I've also rigged this post's comments to show what users type in when applying to be beta testers [minus any private info] :)

Tell your friends about AdBlock Freedom and watch them sign up! Share on: