You are asking how to prove a negative. That's extremely difficult at the best of times.

Prove that it's not malicious? Even with unobfuscated code, that can be difficult. (Ever heard of the Underhanded C Contest?)

> I created my own anti-adblock system Your code is malicious. So you can't prove to users that it's not malicious.

You can't send your code to someone's browser and expect them to remain ignorant of how it works. No matter how obfuscated. Their system, their hardware, their browser, their libraries, their debuggers, their rules. The more your code gets used, the more incentive there will be to break it. And all it takes is one person motivated enough to solve your puzzle.

@R..GitHubSTOPHELPINGICE The context of the question is clear: malicious beyond the expected behaviour of the code. Your complaint is about the expected behavior of the code and your answer and your comments and close reason are thus off-topic. Stop posting all this in comments and complain in meta,

I don't see how you're going to get people to trust it. Obfuscation makes no difference here; your code is inherently doing something untrustworthy and the countermeasures won't be trying to figure out how your code works but in how to unwire it. Unless your code is totally integrated with the site (that is, non modular and changing the site requires messing with the anti-adblock; thus not a saleable product) it will be defeated without ever unobfuscating it.

Please, don't obfuscate your code. It's useless (here's your code in clear showing that you did nothing new) and only endangers your users. When asked, my advice is always the same: "If it's obfuscated, it's malicious". You did not prove me wrong, as people need adblockers to browse the internet today.

Ultimately, I feel like this runs into the issue of Reflections on Trusting Trust, where technically, even unobfuscated code can't prove it doesn't have a malicious runtime codebase, and you're going to have to recognize the trust is between you and the other persons involved.

@MargaretBloom I understand that many websites abuse ads, and as such this is the reason why so many adblockers are on the rise (I myself use one on some such sites) but my personal opinion is that sites that responsibly utilise online advertising shouldn't be punished for this, because eventually, that'll lead to all your glorious free content becoming locked behind a paywall. If people need to use adblockers, many site admins need to find a way to make running the site sustainable. You don't have to agree with me.

@pigeonburger Indeed I don't :) Users can whitelist websites (I do). This keeps them safe from bad sites and rewards good ones.

@pigeonburger Sites had their chance to responsibly use advertising. Instead they gave us sites like Forbes serving us malicious ads, and ads with audio that loudly autoplays when you open the page. Not to mention sites serving a handful of popups and popunders.

Users won’t care, most of them could not check it if not obfuscated, and most ad blockers sell their users out and are still successful. If your adbloxker works good and the browser vendors will allow it in the future, people will use it despite the obfuscation. At least if you invest a few hundred grands in marketing.

@Llama It's unreasonable to say all sites "had their chance" just because some websites are irresponsible with ads but I get where you're coming from

The way I see it is this: we don't know the sites we can trust from the ones we can't nowadays. This is because even big sites (e.g. Forbes) showed that they (or at least, their ad network, but by using that network also them) can't be trusted. We don't really need yet another tool in the escalating arms race between adblockers and advertisers. We need a paradigm shift away from using ads. If you can work that one out, I reckon you'll become a very rich pigeon.

@Llama Well unless you like paywalls or would prefer to donate to a site admin to show support, there aren't many other options or incentives to keep sites running for free I'm afraid. (particularly smaller ones)

That's what I mean. There isn't a good solution now. Someone needs to make one that isn't any of the current options.

@Llama It's a nice fantasy.

Isnt the wohle discussion simply because OP used "user" instead of "customer"? Clearly in the eyes of their customers preventing ad-blocks is not malicious, otherwise they would not consider it at all. From their point of view malicious could be anything from corrupting their systems during build (somehow) to running some crypto miners in the background which might reflect badly on the customer. Clearly the programs intended purpose is not malicious to the customer.

All of this reminds me of a very old radio-gag I heard back when caller-id detection started to become a thing in household phones. It was in a form of an infomercial where they advertised an anti-caller-id-detector with which you could call someone anonymously even if they had a caller-id detector, BUT if you called to purchase it in the next 10 minutes you would also get an anti-anti-caller-id-detector wich allowed you to detect the caller-id even if they had the anti-caller-id-detector...

The whole malvertising situation is due to several layers of abstraction where each one can't know what the other is doing. Site -> Ad network -> Ad. Sites don't take responsibility for scams/malware from the ad networks, ad networks don't take responsibility for poor quality ads. It's not really surprising that each one just shrugs and says "it makes me money, I can't do anything about it". Adblockers are users shrugging and saying "I don't like this situation, just get rid of all of them".

It isn't necessarily what people want to hear but I think a lot of this could've been fixed if site owners just settled with embedding ads into their site and hosting the ads locally. It's already happening anyway, this is really common on Youtube. It's kinda old at this point but an obsession with automation is how we got here, selling targeted ads at the last microsecond to the highest bidder and all the anti-bot stuff.

If companies were willing to shelve the massive ad network/tracking/etc. system this whole "Sites can't possibly audit every ad / it's the ad network's fault / it's the company who bought the ad's fault" excuse that results in blatantly scammy fake "download" buttons on every file sharing site that no human admin would be able to look at and honestly say is fine. Of course this automated system leads to abuse, it actively encourages it and protects it. Of course we'll block it.

@Llama I agree, there's different workflows, 1) I'm just google searching something and find one article from one newspaper from 10 years ago that covered it, that I want to read without subscribing to every newspaper on Earth (no current compensation model), 2) I like some newspaper's content and I want to read it periodically (subscription), 3) curated/focused journal where you'd pay for access to proceedings (paywall/academic institutions).

@pigeonburger I have to admit, I block all adverts. If there was a site that used an ad-blocker avoidance tool, I would block list that entire site, even if it provided a product or service I desired. In fact adverts are the main reason I avoid buying things - they are the most annoying thing on any form of media for me.

I cannot trust them, so they do not get to exist in my etwork

@RoryAlsop Well it sounds like I didn't lose anything anyway then :) Overall it's worked for my sites, and I've been able to get a new CPU and a few TB of storage for my server with my ad revenue. I use Adsense, which will tend to ban you if you irresponsibly spam ads all over the place, I have no urge to do that either.

I have a very specific approach to products/services I want. I will search for them, online and through forums and interest groups. So they get earnings from me. But I will not spend money on anything i see advertised. Pretty certain I'm not the only one that adverts have a negative impact on revenue

Because until I want something, I don't want to see any adverts for it. When I do have a need I will find out all I need to know. Anything that breaks that process does not work for me, and the security implications are just the deal breaker

@RoryAlsop I didn't want to get too far off track but ads can do more than just sell a product, they can 1) train people to want a product, 2) associate a name with a product/increase brand recognition, etc. Remember that you can pay for "sponsored results" in Google and Google factors in the popularity of something in its decision of how to order searches, so you could say that even if you never saw an ad in your life, somebody else's reaction to an ad affects you.

@jrh yes, those are other reasons I dislike advertising. We should not be training people to want a product

@RoryAlsop yes, I agree. I'd consider that unethical.