[ ijbswa-Actionsfile feedback-1878028 ] Sometimes blocked, sometimes not

Actionsfile feedback item #1878028, was opened at 2008-01-23 03:35
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=1878028&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: filter: ad-incorrectly-blocked
Group: current actionsfile
>Status: Closed
>Resolution: Works For Me
Priority: 5
Private: No
Submitted By: Ton Machielsen (toontje)
Assigned to: Nobody/Anonymous (nobody)
Summary: Sometimes blocked, sometimes not

Initial Comment:
Check the Google Syndication Ad at the bottom of the left side of this page: http://spanje.blog.nl/nieuws/2008/01/23/benidorm-wil-van-burgerlijk-imago-af 
Keep reloading the page and you will see that 40% of the time the ad will be blocked, 60% of the time it will not.

How to change the filter to have the ad always blocked?

Thanks,

Ton.

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2012-12-14 09:21

Message:
I can't reproduce this either. Please provide the requested log excerpt if
this is still an issue.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2008-06-07 02:54

Message:
Logged In: NO 

anonymous user: sx2008 [@] web.de

I've found out that there is only a problem when using a PROXY SERVER (e.g
microsoft proxy server).
browser <-> privoxy <-> proxy server <-> internet
Without a proxy server everthing works like expected.


----------------------------------------------------------------------

Comment By: Lee (ler762)
Date: 2008-05-03 13:57

Message:
Logged In: YES 
user_id=1924122
Originator: NO

> I've done some network sniffing with wireshark(ethereal) and found out
> that some
> HTTP GET requests are not recognized by privoxy.

I tried visiting http://www.swissdelphicenter.ch/de/index.php multiple
times using Firefox & it always claims the size of the show_ads.js in cache
is 1 byte.

I also had wireshark going the whole time & didn't see this behavior:

> There is a GET request to a gif-image and directly after the binary
image
> data follows a GET request
> to pagead2.googlesyndication.com/...

What's Privoxy say when you visit
http://config.privoxy.org/show-url-info?url=pagead2.googlesyndication.com


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2008-04-28 10:36

Message:
Logged In: NO 

anonymous user: sx2008 [@] web.de

>> How could java script playing tricks on privoxy ?
>> show_ads.js is like a virus; i've deleted it many times, but it always
>> comes back :-(

> Well... just because you have a cache entry doesn't mean the file got
past Privoxy.
> If Privoxy says it's blocked you've probably got a 1 byte file in your
cache.
In my brwoser cache (IE 6) there is definitly a working java script, which
should have been blocked.
I've done some network sniffing with wireshark(ethereal) and found out that
some
HTTP GET requests are not recognized by privoxy.
There is a GET request to a gif-image and directly after the binary image
data follows a GET request
to pagead2.googlesyndication.com/...
There is no carriage return or linefeed after the servers response !
This request is NOT recognized and blocked by privoxy 3.0.8.
IMHO privocy has a problem (bug) with multiple HTTP requests in one TCP/IP
stream.


----------------------------------------------------------------------

Comment By: Lee (ler762)
Date: 2008-04-22 22:02

Message:
Logged In: YES 
user_id=1924122
Originator: NO

> Step 1) block all Google ads site in provoxy
> Step 2) delete the browser cache
> Step 3) visit http://www.swissdelphicenter.ch/de/index.php more than
once

OK, I did all that

> Very interesting: in the browser cache is
> http://pagead2.googlesyndication.com/pagead/show_ads.js but provoxy has
> blocked this URL.
>
> I have seen in the log window than privoxy has blocked this URL!

Yup - same here:
Apr 23 00:38:20.493 Privoxy Request: crunch! (Blocked)
pagead2.googlesyndication.com/pagead/show_ads.js

> How could java script playing tricks on privoxy ?
> show_ads.js is like a virus; i've deleted it many times, but it always
> comes back :-(

Well... just because you have a cache entry doesn't mean the file got past
Privoxy.

If Privoxy says it's blocked you've probably got a 1 byte file in your
cache.
I dunno what browser you're using, but with Firefox you can put
"about:cache?device=disk"
and then search for pagead2.  If the data size is 1 byte you're probably
OK, but you can
click on the key & FF will show you the header info for that cache entry. 
Mine says:
Client:		HTTP
request-method:	GET
response-head:	HTTP/1.1 403 Request blocked by Privoxy

It seems well & truly blocked to me :)


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2008-04-18 08:23

Message:
Logged In: NO 

Step 1) block all Google ads site in provoxy
Step 2) delete the browser cache
Step 3) visit http://www.swissdelphicenter.ch/de/index.php more than once

Very interesting: in the browser cache is
http://pagead2.googlesyndication.com/pagead/show_ads.js but provoxy has
blocked this URL.
I have seen in the log window than privoxy has blocked this URL!
How could java script playing tricks on privoxy ?
show_ads.js is like a virus; i've deleted it many times, but it always
comes back :-(

----------------------------------------------------------------------

Comment By: Lee (ler762)
Date: 2008-01-24 06:03

Message:
Logged In: YES 
user_id=1924122
Originator: NO

Your log file shows this image not being blocked:
pagead2.googlesyndication.com/pagead/abglogo/abg-nl-100c-000000.png

so you probably need something in your user.action file like
{ +block-as-image }
pagead*.googlesyndication./.*\.(gif|jpe?g|png)


Or you could just block everything like I do:
{ +block }
.google-analytics.
.googleadservices.
.googlesyndication.

But then you might need to block javascript as an empty document...
Sorry, but I don't remember if that's necessary or no :(

I've got lots of blockers for .js links, dunno how many you'll want/need:
{+block +handle-as-empty-document -handle-as-image}
/.*Tacoda.*\.js
/google/ads/.*\.js

/(.*/)?__utm\.js			# google urchin tracker from some Firefox plugin page
/(.*/)?ad\.php
/.*ad_url				# http://whyfirefoxisblocked.com/peel/peel.js
/(.*/)?ad_(top|bottom)\.php		# newgrounds
/(.*/)?adblock.js
#   LR Yes, I am blocking ads, no need for them to tell me that.
#   LR see: http://www.adblock.org/article_adblock_detection_demo.html
/(.*/)?adclick\.php
/(.*/)?adjs\.php
/(.*/)?adlog\.php
/(.*/)?adx\.js
/(.*/)?googleads\.js
/(.*/)?hbx\.js			# investor.cisco.com/WebsideStory/hbx.js
/(.*/)?insight_xe\.js		#
http://www.ciscopress.com/articles/article.asp?p=421514&seqNum=4&rl=1
/(.*/)?ipro_if\.js		#
http://www.ciscopress.com/articles/article.asp?p=421514&seqNum=4&rl=1
/(.*/)?js/ad_wrapper		# ad wrapper scripts
/(.*/)?logger/log.php		# http://www.bookmarklets.com/
/(.*/)?logger/logme.php\?	# http://www.bookmarklets.com/
/(.*/)?.*realmedia\.com/
/(.*/)?show_ads\.htm		#
http://www.softpanorama.org/Net/Application_layer/ssh.shtml
/(.*/)?show_ads\.js
/(.*/)?urchin\.js		# google analytics
/(.*/)?webtrends\.js
/(.*/)?wtid\.js			# webtrends.com

Have fun!
Lee


----------------------------------------------------------------------

Comment By: Hal Burgiss (hal9)
Date: 2008-01-24 03:50

Message:
Logged In: YES 
user_id=322640
Originator: NO

There are several images there not being crunced. Is this an image ad,
flash or text ad? Another thing you can do is right click on the image, and
find its source that way.

----------------------------------------------------------------------

Comment By: Ton Machielsen (toontje)
Date: 2008-01-23 04:03

Message:
Logged In: YES 
user_id=512504
Originator: YES

Setting the debuglevel to 1 gives me this:

Jan 23 13:01:34.578 Privoxy(000000fc) Connect: accepted connection from
127.0.0.1
Jan 23 13:01:34.578 Privoxy(000004e8) Request:
pagead2.googlesyndication.com/pagead/show_ads.js crunch! (Blocked)
Jan 23 13:01:34.593 Privoxy(0000092c) Request:
spanje.blog.nl/templates/spanje/images/menu_1.gif
Jan 23 13:01:34.593 Privoxy(0000092c) Request:
spanje.blog.nl/templates/spanje/images/menu_1.gif
Jan 23 13:01:36.187 Privoxy(000003d0) Request:
farm3.static.flickr.com/2265/2199737233_b21e2258c2_m.jpg
Jan 23 13:01:36.187 Privoxy(00000e5c) Request:
c33.statcounter.com/t.php?sc_project=2981333&resolution=1400&h=1050&camefrom=&u=http%3A//spanje.blog.nl/nieuws/2008/01/23/benidorm-wil-van-burgerlijk-imago-af&t=Benidorm%20wil%20van%20burgerlijk%20imago%20af%20%7C%20Spanje.blog.nl&java=1&security=cc0888f4&sc_random=0.2700530524797026
crunch! (Blocked)
Jan 23 13:01:36.187 Privoxy(00000e64) Request:
spanje.blog.nl/templates/spanje/images/icon_question.gif
Jan 23 13:01:36.187 Privoxy(00000f5c) Request:
www.blog.nl/imgs/previous.gif
Jan 23 13:01:36.187 Privoxy(00000f78) Request:
spanje.blog.nl/templates/spanje/images/box_fon.gif
Jan 23 13:01:37.265 Privoxy(00000fa4) Request:
spanje.blog.nl/templates/spanje/images/star.gif
Jan 23 13:01:37.593 Privoxy(00000950) Request:
pagead2.googlesyndication.com/pagead/abglogo/abg-nl-100c-000000.png

I cannot see the Google Syndication anywhere in the log. 
Sorry for being n00b, i just started working with Privoxy and i really want
to give it a good go.

Ton.

----------------------------------------------------------------------

Comment By: Hal Burgiss (hal9)
Date: 2008-01-23 03:41

Message:
Logged In: YES 
user_id=322640
Originator: NO

Many ads are dynamically inserted, and can come from many different
external sources. First do we have a filter rule, or a block rule? A
default config would be a block rule. If using > 3.0.6, make sure logging
is enabled, then check your logs. Blocked ads will have a "crunch" added to
the log entry. The ones that get by won't. You can then read the docs for
creating your own block rules (in user.action), or you can report them
here.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=1878028&group_id=11118

------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d