February 27, 2011

Salon sends all of your clicks to Chartbeat

I'm an idle clicker. I'm always making sure the windows I'm looking at is the frontmost one, or just clicking to the side because something else stole focus and now the page won't scroll with my mousewheel.

Today while reading Salon I noticed that a little hourglass (or spinner, etc.) would show up when I clicked on any whitespace on the page. Given that popunder ads are at epidemic proportions these days, I wonder if this is related, a bug in AdBlock, or what. I bust out Wireshark and lo and behold, I see the following:

GET /ping?h=salon.com&p=[page being clicked on]&u=vanlgrt044uytfp6&d=salon.com&g=1614&n=0&c=4.75&x=3200&y=6963&w=855&j=30&R=1&W=0&I=0&t=f5gb7u5f6c7246dy&_ HTTP/1.1
Host: ping.chartbeat.net
Connection: keep-alive
Referer: [page being clicked on]
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

This bugs me. I know why they're doing it, but believe me, Salon is not shy about implementing user-hostile advertising and I have been annoyed of late by their persistent modal (page-blocking) ads. Reasonable minds differ, but I have decided that Salon is persona-non-grata when it comes to their advertising ethics. They're being lazy, they could do better, and I will feed them as little usable data as I can control beyond a basic pageread from now on.

Salon puts the codepull in after their Google Analytics junk:

var _sf_startpt=(new Date()).getTime();
var _sf_async_config={uid:1614,domain:document.location.host};
window._sf_endpt=(new Date()).getTime();
var e = document.createElement('script');
e.setAttribute('language', 'javascript');
e.setAttribute('type', 'text/javascript');
e.setAttribute('src',
(("https:" == document.location.protocol) ? "https://a248.e.akamai.net/chartbeat.download.akamai.com/102508/" : "http://static.chartbeat.com/") +
"js/chartbeat.js");
document.head.appendChild(e);
This means that you can get by with by putting the following in your hosts file:
127.0.0.1 static.chartbeat.com chartbeat.download.akamai.com
That's
/etc/hosts
on OSX and unixlikes, and on Windows (typically)
c:\windows\system32\drivers\etc\hosts
Unfortunately, hosts files appear to be the only way of dealing with this currently. They hide the codepull for this feature in the HEAD tag like you would with Google Analytic code, so you have to use your hosts file due to code included on a page this way not showing up in AdBlock's "open blockable items..." feature.