Show HN: Detecting adblock, without JavaScript, by abusing HTTP 103 responses

Original Article ↗ Hacker News Discussion ↗

A proof-of-concept shows how websites can detect ad blockers without JavaScript by abusing HTTP 103 Early Hints, prompting concerns about yet another escalation in the arms race between advertisers and users. Commenters debate how effective or deployable this technique really is—given performance costs, browser differences, and existing easier JS-based methods—while also exploring broader issues like DRM, Web Integrity proposals, and the ethics of sabotaging ad blocking. Many argue that increasingly aggressive anti-adblock tactics degrade user experience and privacy, and suggest alternatives such as subscriptions, privacy-respecting ads, or even compute-based payment models, though each has significant trade-offs.

Technique: Detecting Adblock via HTTP 103 Early Hints

  • Commenters find the HTTP 103 mechanism technically clever and learn about Early Hints for the first time.
  • Key insight: resources hinted before the main HTML let servers infer whether a browser/adblocker fetched them, then tailor subsequent HTML.
  • Some note similar tricks are possible with Link HTTP headers or by partially streaming the HTML and pausing to observe subresource loading, without JavaScript.

Feasibility, Reliability, and Browser Behavior

  • Skeptics argue this is likely too brittle for large-scale use:
    • Corporate proxies and older stacks may mishandle 103 responses.
    • Many sites don’t stream HTML or are horizontally scaled, making the required stateful coordination expensive.
  • Others note Chrome’s design (always loading Early Hints, hiding them from extensions) makes this mostly a Firefox-specific issue today.
  • A mitigation suggestion: browsers could always load Early Hints but discard or delay them, or block 103 entirely, though that may hurt performance.

Arms Race: Adblockers, DRM, and Anti-User Features

  • Several foresee continued escalation:
    • Stronger anti-adblock measures, possibly using DRM-style techniques (e.g., Widevine-like protection for web pages, Web Environment Integrity proposals).
    • Countermeasures like browser/OS-level or even HDMI-level ad removal overlays.
  • Some note current adblockers can’t easily block DRM-embedded ads; others counter that DRM has been and can be subverted, though hardware-level protections complicate this.

User Experience, Ethics, and Economics of Ads

  • Many users say they block ads primarily due to annoyance, intrusiveness, tracking, and malware risk, not bandwidth savings.
  • Some argue sabotaging adblocking is unethical and should even be illegal; others insist sites have the right to refuse service to adblock users.
  • There’s debate whether forcing ads drives users away or is necessary for sustainability; evidence is seen as unclear.
  • Alternatives discussed:
    • Pay-with-compute (e.g., controlled cryptomining) is attractive to some but criticized as bad for battery devices and likely far less lucrative than targeted ads.
    • Paid, ad-free models exist but are often expensive, still include ads or tracking, or are impractical for infrequently visited sites.

Security/Disclosure and Meta Points

  • Some think this technique should have been privately reported to browser and adblock developers first; others frame it as a typical “white-hat vs black-hat” disclosure dilemma.
  • Multiple comments emphasize that users, publishers, advertisers, and platforms all share responsibility for today’s hostile ad ecosystem.