UBlock Origin Blocks Huffington Post. What's Going On?

[CharmCityCrab]

I want to state just at the onset I am fully aware that this is:

1. Not a browser specific issue

-and-

2. Not necessarily even an issue with UBlock Origin, which may be functioning as intended based on the input it's getting from some of the filter lists I use and whatever it's finding on the site in question.


The two points above are why this is being posted in general discussion instead of in a troubleshooting forum or an issue tracker for a browser or for UBO.

However, it's bothering me, as I visit the site in question often, so I thought I'd post and see if anyone has any insight into what's up here. I can't get Huffington Post's main page (huffingtonpost dot com) to load. Here's a screen capture of what displays instead:



I'm sure it would load just fine if I disabled UBO for the site or dropped the specific filter lists mentioned in the error message. That isn't my point. The thing is, every news site I visit, including the Huffington Post, has always loaded fine with UBO and the filter lists in question. So, it stands to reason something is up with the website or a recent update of the filter lists. Anyone have any insight?

What would a website even have to be doing to have it's entire front page be blocked like that and not just have whatever advertisements or content are loading from the third party site referenced in screen capture fail to load while the rest of the website does load? Are Huffington Post's main domains being redirected to this advertising dot com site? Are they literally putting all of their content on advertising dot com now so people can't block the ads without blocking the site? Is this some kind of attack against the site? Anyone seem any threads about this elsewhere? I can't find anything on my preferred search engine about it.

Right now I am declining to disable filtering because I'm not sure what's going on. Just as a casual user, it looks like someone might be redirecting the real domain to a malware site, and I don't feel like endangering my PC or my phone until I understand exactly what I am getting into. It seems like it's more than that there are just some ads that may be tracking people.

[Kingpin]

What would a website even have to be doing to have it's entire front page be blocked like that and not just have whatever advertisements or content are loading from the third party site referenced in screen capture fail to load while the rest of the website does load? Are Huffington Post's main domains being redirected to this advertising dot com site? Are they literally putting all of their content on advertising dot com now so people can't block the ads without blocking the site? Is this some kind of attack against the site? Anyone seem any threads about this elsewhere? I can't find anything on my preferred search engine about it.

That is exactly what seems to have happened. It's redirecting all requests to https://guce.advertising.com/ (and that site doesn't seem to work either).

[Nigaikaze]

Intriguing. If I type in huffingtonpost dot com in my URL bar, it properly redirects me to https://www.huffpost.com and I can access the site just fine. No guce.advertising.com redirect here.

[doofy]

Bottom left of your screen cap is a url. This one:

https://github.com/gorhill/uBlock/wiki/Strict-blocking

Maybe have a read?
As to why it has suddenly started to happen - most likely a filter(s) update.

[Nigaikaze]

HuffPost and Advertising.com are both owned by AOL/Verizon, so there is a corporate relationship between the sites.

[Night Wing]

Intriguing. If I type in huffingtonpost dot com in my URL bar, it properly redirects me to https://www.huffpost.com and I can access the site just fine. No guce.advertising.com redirect here.

I can use the same address as you did to get to the Huffington Post using 64 bit linux Pale Moon 28.5.0 running in 64 bit linux Mint 19.1 (Tessa) Xfce.

[Kingpin]

Intriguing. If I type in huffingtonpost dot com in my URL bar, it properly redirects me to https://www.huffpost.com and I can access the site just fine. No guce.advertising.com redirect here.

Oh, I used the UK version since that's what I had saved in browsing history (huffingtonpost.co.uk). Your version doesn't seem to have the ad domain redirect, yes.

[Nigaikaze]

Oh, I used the UK version since that's what I had saved in browsing history (huffingtonpost.co.uk).

Aha! When I try to go to the huffingtonpost.co.uk site, I get a note that "HuffPost is now part of Oath" and it's asking for consent to access my device (presumably for setting cookies) and use my data. This has to do with EU privacy requirements. Odd thing is my redirect URL is consent.yahoo.com instead of guce.advertising.com. It could be that the guce.advertising.com redirect you and CharmCityCrab are getting is a different server (based on geolocation, mayhaps?) that serves the same basic purpose.

I've also seen a number of Google search results of people complaining about guce.advertising.com redirects popping up in relation to AOL, Verizon and Yahoo webmail logins, also mentioning that it's an Oath thing.

[Kingpin]

Oh, I used the UK version since that's what I had saved in browsing history (huffingtonpost.co.uk).

Aha! When I try to go to the huffingtonpost.co.uk site, I get a note that "HuffPost is now part of Oath" and it's asking for consent to access my device (presumably for setting cookies) and use my data. This has to do with EU privacy requirements. Odd thing is my redirect URL is consent.yahoo.com instead of guce.advertising.com. It could be that the guce.advertising.com redirect you and CharmCityCrab are getting is a different server (based on geolocation, mayhaps?) that serves the same basic purpose.

I've also seen a number of Google search results of people complaining about guce.advertising.com redirects popping up in relation to AOL, Verizon and Yahoo webmail logins, also mentioning that it's an Oath thing.

That's probably it. I'm behind a US-based VPN so that could explain the lack of EU stuff.

[Nigaikaze]

Okay, I figured it out by watching uBlock Origin's logger when I tried to load http://huffingtonpost.co.uk.

Code: Select all

1. http://huffingtonpost.co.uk redirects to https://huffingtonpost.co.uk
2. https://huffingtonpost.co.uk redirects to https://guce.huffingtonpost.co.uk
3. https://guce.huffingtonpost.co.uk redirects to https://guce.advertising.com
4. https://guce.advertising.com redirects to https://consent.yahoo.com

Y'all's uBO filters are throwing up a wall at step #3. I'm guessing if you disable uBO (or the respective filters) long enough to hit the OK button on the consent request, it'll set a cookie saying you've consented and then you can (probably) reenable it without any further ill effects.

EDIT: Or just whitelist guce.advertising.com in uBO. That should work, too.

[Kingpin]

Okay, I figured it out by watching uBlock Origin's logger when I tried to load http://huffingtonpost.co.uk.

Code: Select all

1. http://huffingtonpost.co.uk redirects to https://huffingtonpost.co.uk
2. https://huffingtonpost.co.uk redirects to https://guce.huffingtonpost.co.uk
3. https://guce.huffingtonpost.co.uk redirects to https://guce.advertising.com
4. https://guce.advertising.com redirects to https://consent.yahoo.com

Y'all's uBO filters are throwing up a wall at step #3. I'm guessing if you disable uBO (or the respective filters) long enough to hit the OK button on the consent request, it'll set a cookie saying you've consented and then you can (probably) reenable it without any further ill effects.

EDIT: Or just whitelist guce.advertising.com in uBO. That should work, too.

I'm not even using uBO though. And unmodified links browser doesn't get me to the yahoo site either. I think they screwed something up server-side.

[CharmCityCrab]

Thanks everyone.

It looks like this has spread to Engadget, too. That's another site owned by Verizon. So far, Yahoo, which like HuffPost and Engadget is also owned by Verizon, appears to be unaffected. The Verizon Wireless homepage is also unaffected.

Someone noted earlier in the thread that the advertising domain being blocked here is, like HuffPost, owned by Verizon, so it may be something they are gradually rolling out across their family of sites that you either allow and visit their sites, or don't allow and don't visit their sites- it's more likely that than an outside attacker given that they own both domains. They own enough of the Internet that if they roll it out near-universally across their sites, eventually the content blockers will likely consider countermeasures, one would think- or hope, anyway.

For now it appears as though one either disallows it (as is the default on my several of my filter lists) and skips visiting the site, or allows it and visits. The only exception to this is that I note it loads fine on Firefox FOR ANDROID, so it's possible that a site-specific useragent override telling it that one is using a mobile browser to visit might be a potential workaround if one doesn't mind browsing their mobile site on desktop- at least until they institute a mobile version of this, too. I might look into the UA thing.

It's also possible this is being done in error by Verizon/HuffPost/Engadget, of course. I miss the days when you you use to be able to write to admin @ whateverdomainyouwant dot whatever and get an answer back from a human.

I don't think it's the allow/disallow cookie prompt, because that would be specific to the UK/EU HuffPost site(s), and this problem also affects the American version of HuffPost.

[CharmCityCrab]

it's possible that a site-specific useragent override telling it that one is using a mobile browser to visit might be a potential workaround if one doesn't mind browsing their mobile site on desktop- at least until they institute a mobile version of this, too.

Just to update: This method did not work for me when I tried it with a popular UA switching extension through the extension's UI. I only set it Android compatibility for the primary domains, though, and gave it a quick try. It's possible that a more comprehensive or non-extension based approach could still work.