12 ms·

Forbes asked readers to turn off adblockers then immediately served them malware

365 points by temp 11y ago

paulpauper 11y ago
Forbes is like a for-profit Wikipedia. Impossible to not see a Forbes result after when you do a google search. I think I saw a Forbes result when looking up some obscure string theory query. They are everywhere now. Like a kudzu. Their gateway pages are annoying, and I'm surprised they don't run afoul of Google's SEO guidelines.
- hobs 11y ago
  I pretty much never see forbes links unless I am on HN, and usually go "Oh how quaint." I most cases I would assume that you have a google search history that is influencing these results and thinks you like forbes, hah.
  - leephillips 11y ago
    I have the same experience - I seldom encounter Forbes in search results. I wish I could say the same about w3schools, or whatever it's called.
- Luyt 11y ago
  Indeed: they serve Google different pages than ordinary visitors. When I set my user agent string to "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html http://www.google.com/bot.html) " suddenly forbes.com doesn't object to my adblocker anymore.
0x0 11y ago
No comments from Forbes on this?
- J_Darnley 11y ago
  They're probably hoping it will blow over. They might wait for the Internet's focus to move onto the next scandal and then quietly put out a statement shifting the blame.
dafrankenstein2 11y ago
have faced this recently. didnt turn off adblocker bcoz i've seen 11(as far i can remember) ads blocked by my adblocker
m0nty 11y ago
I can do without Forbes. The problem with saying "switch off adblocker or no article" is that so many people are using adblockers, that those websites face an inevitable decline in influence if they continue that way. Because, despite what they say, it's not just about the money: it's the ability to influence the debate, whatever it might be. To have your editorials taken seriously and widely quoted. To make people listen. They're losing that ability, together with readers and revenue.
- maxerickson 11y ago
  Forbes started having rando bloggers post articles to part of their website a couple years ago. I guess they wouldn't have done that if they thought they were taken particularly seriously. One possibility is that they decided to get what they could out of the name while it was still worth anything.
  - m0nty 11y ago
    So they've jumped the shark anyway? Kind of hard for me to judge, because all I ever get is a blank gray page when I try to look at their articles.
  - paulpauper 11y ago
    Give that their articles are everywhere when you go a google search, I'm sure they are making wheelbarrows full of money, even if the 'brand' suffers a bit. Print magazines written by professionals have been in decline for while now. User-generated content of mediocre quality is where it is now. That is the business model that makes the most money
  - ghaff 11y ago
    Back in the Malcolm Forbes days, Forbes was one of the big three US business magazines--the others being Fortune and Business Week--and it was quite good. It was my favorite of the three and I subscribed to it for a number of years. It started declining at some point after Malcolm's death and for the past few years in particular the online site has really sold its soul for clicks. Some of its bloggers are decent but a lot of them have massive conflicts of interest of one sort or another and/or are more interested in being provocative than being thoughtful or correct. And BrandVoice really blurs the lines between advertising and editorial.
SmokyBorbon 11y ago
First time I've seen the word "hackenfreude".
blisterpeanuts 11y ago
Maybe people will ultimately resort to scrapers to get to the content. Scrape it into your favorite text viewer. Of course the layout will keep changing, so it will become a contest to keep updating the scraper scripts, with websites dedicated to keeping the latest scripts available. Or is that what Adblock does already?
- cooper12 11y ago
  Scraping is mostly useful if you're trying to get at some structured data or something. (Though you might be thinking of "readability" modes which work by assigning scores to what it thinks is content) For sites like these I figure that using noscript or a headless browser like w3m can suffice. My layperson understanding is that Adblock works at the network level by blocking requests to addresses on its blacklist.
  - blisterpeanuts 11y ago
    Unfortunately, text browsers like Lynx and Links have been locked out of many sites. When I go to forbes.com using links, it lets me click on the "30 under 30" article, but then I get a mostly blank screen and can go no further. Life on the web must be tough for the sight-impaired, as well. Too bad it's gone in this direction.
    - cooper12 11y ago
      Wow, you weren't kidding. All I get under w3m is: > 30 under 30 2016 > true where I'm hoping "true" isn't the result of some test by a lazy dev. Spoofing my user agent to firefox actually gives me a completely blank page... It is a indeed a sad state.
    - ksml 11y ago
      This is probably a consequence of relying on AJAX to load content, and not of using a text-based browser. If I visit Forbes in Firefox with noscript enabled, I also get a mostly blank screen.
jjm 11y ago
I used to be an avid Forbes reader but then came the ad insanity. One thing is for sure, __I will not give up on my ad blocker__ even if it means not visiting and reading the sites whose content I enjoyed or even canceling my subscriptions. This is a free market, a new entrant will emerge for me in no time.
aczerepinski 11y ago
Loading forbes.com and scrolling to the bottom of the page requires nearly 500 http requests. Anybody willing to share what it's like to work on a project like that? I assume that they employ skilled web developers who are aware of best practices, but aren't empowered to improve things?
- lost_my_pwd 11y ago
  Wow, I thought you were being a bit hyperbolic but then I checked... even with uBlock and Ghostery enabled, their homepage is 331 requests for a total of 10.3MB.
  - BlackFly 11y ago
    I feel this makes forbes.com a fantastic website for calibrating how well the ghostery blocking is working. I have a whole bunch of new tracker networks blocked now.
- Grishnakh 11y ago
  It doesn't require 500 http requests if you run NoScript... Of course, then for pages like that it usually doesn't show any text at all and you have to figure out manually which domain to enable for the stupid page to work. Best to avoid Forbes altogether if you can.
- morgante 11y ago
  > Anybody willing to share what it's like to work on a project like that? I used to work at Business Insider and we definitely had similar problems. It basically boils down to marketing & advertising being more important to publishers than technology or user experience. It's organizationally difficult to resist every marketer who wants to add "just one line of JavaScript" for their pet project. Then there's the fact that you're beholden to ad networks and can't do much more than whack-a-mole when they serve junky ads. Probably once a day we'd notice a bad ad and have to block it from being served. At one point, we got management buy-in for me to work on performance issues. We managed to improve performance by ~90%, but the bulk of the project was just exhaustively listing every script on the page and axing those which didn't have a good justification. Amazingly, for a majority of the scripts, nobody even knew why there were there still (they were often added to please an old advertiser who wanted a specific measurement). It's hard to place blame. Developers don't have the political clout to prevent the bloat and are often under-resourced as it is. Marketers want to gather metrics, but with the small development teams at most media companies it's easier to rely on third-party vendors over performant in-house solutions. Management recognizes the problems, but without marketing and advertising there's no business model. Personally, I think ad networks are the ones who should be taking the lead here: they're big enough that they can afford to block bad advertisers without endangering their profitability. They should be investing much more in automated solutions to detect and block bad/heavy ads. Unfortunately, there's not really an economic incentive for them to do so: users blame publishers for slow pages, not networks. And ad blocking is much more detrimental to publishers than the networks.
mark_lee 11y ago
fuck adblockers, I know what they're thinking.
- cbd1984 11y ago
  Nice to see Wendy Sullivan still getting work: http://www.metafilter.com/112362/Thats-no-booth-babe http://www.metafilter.com/112362/Thats-no-booth-babe http://www.sfweekly.com/sanfrancisco/sex-columnist-violet-blue-tries-to-restrain-online-foes/Content?oid=2168929 http://www.sfweekly.com/sanfrancisco/sex-columnist-violet-bl...
aaronchall 11y ago
I tweeted at them on Christmas day that I'm not going to be turning of my ad-blocker: https://twitter.com/aaronchall/status/679334126374297600 https://twitter.com/aaronchall/status/679334126374297600 It's my computer, I'm not going to load crap I don't want to load on it. If they want to block other content for it, I don't have to visit their site.
jimrandomh 11y ago
This problem is present, to varying but nonzero degrees, in all of the advertising networks. And they're doing a miserable job of fighting it. I recently saw malware advertised through AdSense, and decided to try to report it. There was no mechanism for doing so, and I checked everywhere.
volaski 11y ago
Forbes comes in first place bar none if you compute (shadiness/brand visibility). They do all kinds of shady stuff like clickbait titles, shadiest of the shadiest ad formats, that meaningless interstitial ad, and probably whole lot more I'm not even aware of. Whenever I somehow land on one of their pages (I NEVER visit them voluntarily, it's mostly via some clickbait title I click without thinking), I always think "Just die off already if you can't figure out how to make money without alienating people who have believed in you. You're being a disgrace to what Forbes used to be and people who worked hard to build up that reputation"
davb 11y ago
This is rich, being reported by Engadget. I've reached out to them numerous times to let them know their ad networks try to redirect Chrome (Android) users to Play Store apps. It doesn't happen all the time, and it doesn't happen on desktop browsers. But it's frustrating and cheap. They didn't respond.
themartorana 11y ago
Being that I make money from serving ads, I come at this a bit differently. In a lot of markets, it's one of the most passive ways to make money, but to be sure, the creepiness factor has been advertisers' hubris-induced-downfall. In any case, I haven't seen anyone here mention the ad networks themselves. Every once and a while we would get a complaint about a bad ad - it wouldn't dismiss, etc. Over time, we whittled down our network list to ad networks that strictly test and vet the ads they serve, no matter how much time that takes. The networks blaming a "rogue advertiser" means they're not even passing ads on their network through automated malware detection software, and so they have responsibility here. Creepiness factor aside, the explosion of networks is a problem, because so very few are actually providing more than a basic service. We really should be holding networks responsible for their ads. We did, and we haven't had a complaint for a very long time. Edit: this doesn't absolve Forbes, especially if they did nothing to correct the problem. Edit 2: by "we should hold the networks responsible" I mean "we the publishers" - and as that "we" we still have a responsibility to our users/consumers. See Edit 1.
- BlackFly 11y ago
  The problem isn't advertisements per se, the problem is advertisement networks that track users and sell their profiles. The only thing I have installed that counts as an ad blocker is Ghostery. I still get served advertisements at conscientious websites like duckduckgo.com or any other place that doesn't rely 100% on tracking networks. Imagine if simply because you walked into Target, they hired a private investigator to follow you around and determine your personal habits, hobbies and other stores you visited. Imagine if they then used that information to attempt to lure you into the store, or sold that information to Best Buy so they could lure you into the store. I think most people would have a problem with such behavior. Making a more realistic physical analogy would be slipping an RFID token into your wallet without you noticing and only tracking you in stores that use the corresponding RFID reader. In my opinion, tracking networks go the extra mile beyond a creepiness factor. My visit to your website isn't tacit approval for you to peruse my browsing of other websites. I shouldn't need to opt out of this behavior by installing Ghostery in the first place.
  - 11y ago
exodust 11y ago
I won't be turning off my ad blocker, but why can't ad blockers disguise themselves? Surely there's a way to trick their site into believing I have a normal adblock-free browser. Even a per-site whitelist kind of thing, whereby popular sites with adblock detection can be dealt with via addon scripts - say for uBlock.
- andrenotgiant 11y ago
  It's just the nature of adblocking. The adblocker prevents certain JS from loading. Sites can easily check which JS has loaded.
  - fwn 11y ago
    I think - if i didn't misunderstood it - the uBlock Origin author came up with something like a resource library for exactly that reason. Sadly I can't find a explainatory page on it right now; a possible resource file is located at: https://github.com/gorhill/uBlock/blob/master/assets/ublock/resources.txt https://github.com/gorhill/uBlock/blob/master/assets/ublock/...
  - facetube 11y ago
    Ad blockers could pretty easily fetch resources and just throw them away to work around this, or insert workalike shims if it's happening client-side.
    - dylz 11y ago
      You'd still have to execute the JS - how do you expect an adblocker to emulate an abusive tracker like http://cdn4.forter.com/script.js?sn=3326ea178bfb http://cdn4.forter.com/script.js?sn=3326ea178bfb (bonus: check out the way it abuses fake sourcemaps to try and hide from devtools, and additionally log with identifying information via a network request if you are trying to debug their scripts)
- TeMPOraL 11y ago
  In general sense, because of the halting problem. JavaScript is Turing-complete. Ad blockers work by ensuring that some parts of the site are selectively not loaded or not executed. Ad blocker detectors can check whether some code was executed. Halting problem prevents ad blockers from being able to counter all such checks in the general case. So it's not even worth starting that arms race.
dlsx 11y ago
Hello, they are STEALING content. Good for forbes. About time people realize the web is not free.
johnhenry 11y ago
Perhaps we're coming to an understanding that third-party advertising isn't such a great revenue model for the web because it requires users to abandon security. It's becoming increasingly clear that what we get for free by allowing these ads simply isn't worth giving up our security.
- oneeyedpigeon 11y ago
  You might have meant this, but the problem isn't strictly third-party advertising, it's advertising delivered by a third party. Nothing wrong [1] with company a paying for company b to host an image and deliver it along with its content, just as offline advertising works. [1] Well, less wrong ...
  - johnhenry 11y ago
    Yes "advertising delivered by a third party" is a more accurate description.
userbinator 11y ago
This reminds me of a time when a site asked me to enable JavaScript for "a better experience". I had been defaulting to JS off for a long time due to how effectively it stopped ads and other annoyances, and see these messages a lot, but this time I was momentarily curious for some reason; I did, only to be immediately assaulted with a bunch of ads, some crap following the pointer/scrolling, slide-overs, and other distracting annoyances that I would not at all call "a better experience". Fortunately I didn't get malware, but since then I've been much more cautious. I know many are rather fond of sayings like "JS off will break most sites", but I challenge you to experience the web with it off by default and turn it on only for the few sites that absolutely need it; depending on what your most visited sites are, you may actually enjoy it. I find that the majority of sites are perfectly readable without JS. On the other hand, I wonder if there are sites which use JS to hide the content and display a "turn off JavaScript to view this article", or "install adblocker to view this article"...
- gaius 11y ago
  Javascript, like Flash, doesn't do anything for the user, only for the developer or sponsor. Never did.
  - csours 11y ago
    Ok, I'll bite; How would you do Google Maps without JavaScript. (or DDG Maps if you prefer) Edit: Why downvotes?
    - userbinator 11y ago
      The interface would be slightly different but there's no reason why an interactive map viewer couldn't be done in pure HTML and CSS without JS, and then JS added for more enhancements like AJAX loading. In fact... it's been done eight years ago: http://www.appelsiini.net/2008/google-maps-without-javascript http://www.appelsiini.net/2008/google-maps-without-javascrip... http://www.appelsiini.net/2008/google-maps-without-javascript-part-2 http://www.appelsiini.net/2008/google-maps-without-javascrip... Look at where the map images are coming from, copy the link, and play around with the URL parameters. Yes, this still works. I also distinctly remember playing some HTML adventure games with similar pan/zoom/click interfaces before the millenium, and they didn't require JS either (nor took quite as long as the apps of today to load, on hardware that was probably an order of magnitude or more less powerful.)
amluto 11y ago
Why are ad buyers permitted to provide ads that contain script in the first place? What was wrong with images?
- lagadu 11y ago
  Not aggressive enough. Gotta force the user to click and/or interact with your shitty ad!
ck2 11y ago
Correct me if I am wrong but no advertiser pays for just showing ads on a website anymore. They pay you for clicks. If someone is blocking ads, they certainly are not going to click just because you ask them to allow them to be shown or find a way to force them being shown.
- mpeg 11y ago
  It's not entirely true, while CPC and CPA* ads have been getting more popular over time, CPM is still the best way to go for many other purposes. Not everyone cares about getting people to click through to a landing page, lots of advertising is just about increasing the value of your brand, and if you want to reach as many people as possible you might not care whether they engage or not. * Cost per click, action or mille
kefka 11y ago
By default, I use comprehensive ad blockers on my client machines. I also suggest and assist installing them as well on anyone's machine without cost (normally billable). A great deal of problems are solved full stop by doing that simple step. And it also sends the message of , "Not interested". I go to a website to read content, not to be swayed on what shit to buy immediately or later. Oh, and punishment for allowing ads are "broken or slow machine clogged with malware". I'll pass.
Animats 11y ago
Forbes has come a long way down since the days of Malcolm Forbes, Sr. He did many exposes of bad business practices. Forbes is now owned by Integrated Whale Media Investments of Hong Kong. If you're not that familiar with how ad serving works today, watch this IAB video.[1] Note how the online auction process works. After information about the user (location, demographics, income level, previous purchases, what user has looked at) has been obtained from a data provider, that info is submitted to an ad exchange. Advertisers then have an opportunity to bid for placing an ad in that space, and have 10ms to bid. But sometimes, no advertiser bids in that round. The ad space is now "remnant space" - ad space where all the big advertisers declined to buy. Remnant space is very cheap, maybe 5% of premium space. The first ad exchange goes out to a second lower-tier ad exchange, where the cycle repeats, at a lower price point. That's where junky ads and malware get inserted. Remnant-space sellers include Rubicon, PubMatic, and AdMeld (now owned by Google). Many publishers are reluctant to set a minimum price and leave ad space unsold. Rather than fill unsold space with some non-ad content, or a house ad (Forbes running an ad for some other Forbes publication), they sell the space to one of those bottom-feeder services. This hurts their reputation and readership, and probably isn't worth the small revenue it generates. Forbes covered the issue of ad exchange trust in 2014.[2] Their ad people need to read their own magazine. [1] https://www.youtube.com/watch?v=-Glgi9RRuJs https://www.youtube.com/watch?v=-Glgi9RRuJs [2] http://www.forbes.com/sites/roberthof/2014/12/10/can-you-trust-your-ad-exchange-new-index-may-provide-the-answer/ http://www.forbes.com/sites/roberthof/2014/12/10/can-you-tru...
- manigandham 11y ago
  For some clarification (as I've worked in the ad industry for years) 1) Advertisers (actually their ad agencies) use software called a DSP to connect to ad exchanges and bid on each impression. They have 100-250ms depending on the exchange's rules. 2) This kind of Real-Time Bidding (RTB) is used for both premium space and unsold/remnant inventory. The separate "rounds" is going away and there's a rapid movement to do a unified auction for each impression with all possible ad buyers (premium to cheap) in a single auction. 3) Lots of publishers do actually set a price floor but this is far more complicated than binary yes/no for a floor. There's a lot of math/science put into the online ad auction and yield management space. 4) Many networks don't use RTB and are safe from this. 5) This malware issue isn't because of adtech (the tech part) but rather the incentives and lack of regulation and enforcement. Lots of politics and mistrust has required tons of javascript tags just to render a simple banner, and as we all know, js can do just about anything so it immediately gives a bad advertiser power to do whatever they want. This is something being worked on with some newer formats. There's also no consequences of "getting caught". Most ad networks and bad advertisers are not big corporations but little companies in other countries that can just change names and come back in a few days to do it all over again.
echochar 11y ago
In an "Ask HN:" someone is calling for a ban on Forbes. Forbes has indeed reached a new plateau in stupidity. Anyone using a text-only browser has seen that Forbes' most recent design transfers all the content but prevents the page from even displaying in even the most accomodating browser. The word that comes to my mind for their approach to web development is "boneheaded". Quick and dirty script to view Forbes articles, with no ads: curl http://www.forbes.com/sites/... \ |sed ' 1i\ <html> s/\\n/\ /g; s/\\r//g; s/\\"/\"/g; $a\ </html> /./{2,/try {/d; /} catch/,$d;} ' > 1.html Then view 1.html in your browser. Why did I call their web design "boneheaded"? They include two full copies of the article. And this is before all the ads and God knows what are injected into the page.

365 points by temp 11y ago

Forbes is like a for-profit Wikipedia. Impossible to not see a Forbes result after when you do a google search. I think I saw a Forbes result when looking up some obscure string theory query. They are everywhere now. Like a kudzu. Their gateway pages are annoying, and I'm surprised they don't run afoul of Google's SEO guidelines.

hobs 11y ago
I pretty much never see forbes links unless I am on HN, and usually go "Oh how quaint." I most cases I would assume that you have a google search history that is influencing these results and thinks you like forbes, hah.
- leephillips 11y ago
  I have the same experience - I seldom encounter Forbes in search results. I wish I could say the same about w3schools, or whatever it's called.
Luyt 11y ago
Indeed: they serve Google different pages than ordinary visitors. When I set my user agent string to "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html http://www.google.com/bot.html) " suddenly forbes.com doesn't object to my adblocker anymore.

0x0 11y ago

No comments from Forbes on this?

J_Darnley 11y ago
They're probably hoping it will blow over. They might wait for the Internet's focus to move onto the next scandal and then quietly put out a statement shifting the blame.

dafrankenstein2 11y ago

have faced this recently. didnt turn off adblocker bcoz i've seen 11(as far i can remember) ads blocked by my adblocker

m0nty 11y ago

I can do without Forbes. The problem with saying "switch off adblocker or no article" is that so many people are using adblockers, that those websites face an inevitable decline in influence if they continue that way. Because, despite what they say, it's not just about the money: it's the ability to influence the debate, whatever it might be. To have your editorials taken seriously and widely quoted. To make people listen. They're losing that ability, together with readers and revenue.

maxerickson 11y ago
Forbes started having rando bloggers post articles to part of their website a couple years ago. I guess they wouldn't have done that if they thought they were taken particularly seriously. One possibility is that they decided to get what they could out of the name while it was still worth anything.
- m0nty 11y ago
  So they've jumped the shark anyway? Kind of hard for me to judge, because all I ever get is a blank gray page when I try to look at their articles.
- paulpauper 11y ago
  Give that their articles are everywhere when you go a google search, I'm sure they are making wheelbarrows full of money, even if the 'brand' suffers a bit. Print magazines written by professionals have been in decline for while now. User-generated content of mediocre quality is where it is now. That is the business model that makes the most money
- ghaff 11y ago
  Back in the Malcolm Forbes days, Forbes was one of the big three US business magazines--the others being Fortune and Business Week--and it was quite good. It was my favorite of the three and I subscribed to it for a number of years. It started declining at some point after Malcolm's death and for the past few years in particular the online site has really sold its soul for clicks. Some of its bloggers are decent but a lot of them have massive conflicts of interest of one sort or another and/or are more interested in being provocative than being thoughtful or correct. And BrandVoice really blurs the lines between advertising and editorial.

SmokyBorbon 11y ago

First time I've seen the word "hackenfreude".

blisterpeanuts 11y ago

Maybe people will ultimately resort to scrapers to get to the content. Scrape it into your favorite text viewer. Of course the layout will keep changing, so it will become a contest to keep updating the scraper scripts, with websites dedicated to keeping the latest scripts available. Or is that what Adblock does already?

cooper12 11y ago
Scraping is mostly useful if you're trying to get at some structured data or something. (Though you might be thinking of "readability" modes which work by assigning scores to what it thinks is content) For sites like these I figure that using noscript or a headless browser like w3m can suffice. My layperson understanding is that Adblock works at the network level by blocking requests to addresses on its blacklist.
- blisterpeanuts 11y ago
  Unfortunately, text browsers like Lynx and Links have been locked out of many sites. When I go to forbes.com using links, it lets me click on the "30 under 30" article, but then I get a mostly blank screen and can go no further. Life on the web must be tough for the sight-impaired, as well. Too bad it's gone in this direction.
  - cooper12 11y ago
    Wow, you weren't kidding. All I get under w3m is: > 30 under 30 2016 > true where I'm hoping "true" isn't the result of some test by a lazy dev. Spoofing my user agent to firefox actually gives me a completely blank page... It is a indeed a sad state.
  - ksml 11y ago
    This is probably a consequence of relying on AJAX to load content, and not of using a text-based browser. If I visit Forbes in Firefox with noscript enabled, I also get a mostly blank screen.

jjm 11y ago

I used to be an avid Forbes reader but then came the ad insanity. One thing is for sure, __I will not give up on my ad blocker__ even if it means not visiting and reading the sites whose content I enjoyed or even canceling my subscriptions. This is a free market, a new entrant will emerge for me in no time.

aczerepinski 11y ago

Loading forbes.com and scrolling to the bottom of the page requires nearly 500 http requests. Anybody willing to share what it's like to work on a project like that? I assume that they employ skilled web developers who are aware of best practices, but aren't empowered to improve things?

lost_my_pwd 11y ago
Wow, I thought you were being a bit hyperbolic but then I checked... even with uBlock and Ghostery enabled, their homepage is 331 requests for a total of 10.3MB.
- BlackFly 11y ago
  I feel this makes forbes.com a fantastic website for calibrating how well the ghostery blocking is working. I have a whole bunch of new tracker networks blocked now.
Grishnakh 11y ago
It doesn't require 500 http requests if you run NoScript... Of course, then for pages like that it usually doesn't show any text at all and you have to figure out manually which domain to enable for the stupid page to work. Best to avoid Forbes altogether if you can.
morgante 11y ago
> Anybody willing to share what it's like to work on a project like that? I used to work at Business Insider and we definitely had similar problems. It basically boils down to marketing & advertising being more important to publishers than technology or user experience. It's organizationally difficult to resist every marketer who wants to add "just one line of JavaScript" for their pet project. Then there's the fact that you're beholden to ad networks and can't do much more than whack-a-mole when they serve junky ads. Probably once a day we'd notice a bad ad and have to block it from being served. At one point, we got management buy-in for me to work on performance issues. We managed to improve performance by ~90%, but the bulk of the project was just exhaustively listing every script on the page and axing those which didn't have a good justification. Amazingly, for a majority of the scripts, nobody even knew why there were there still (they were often added to please an old advertiser who wanted a specific measurement). It's hard to place blame. Developers don't have the political clout to prevent the bloat and are often under-resourced as it is. Marketers want to gather metrics, but with the small development teams at most media companies it's easier to rely on third-party vendors over performant in-house solutions. Management recognizes the problems, but without marketing and advertising there's no business model. Personally, I think ad networks are the ones who should be taking the lead here: they're big enough that they can afford to block bad advertisers without endangering their profitability. They should be investing much more in automated solutions to detect and block bad/heavy ads. Unfortunately, there's not really an economic incentive for them to do so: users blame publishers for slow pages, not networks. And ad blocking is much more detrimental to publishers than the networks.

mark_lee 11y ago

fuck adblockers, I know what they're thinking.

cbd1984 11y ago
Nice to see Wendy Sullivan still getting work: http://www.metafilter.com/112362/Thats-no-booth-babe http://www.metafilter.com/112362/Thats-no-booth-babe http://www.sfweekly.com/sanfrancisco/sex-columnist-violet-blue-tries-to-restrain-online-foes/Content?oid=2168929 http://www.sfweekly.com/sanfrancisco/sex-columnist-violet-bl...

aaronchall 11y ago

I tweeted at them on Christmas day that I'm not going to be turning of my ad-blocker: https://twitter.com/aaronchall/status/679334126374297600 https://twitter.com/aaronchall/status/679334126374297600 It's my computer, I'm not going to load crap I don't want to load on it. If they want to block other content for it, I don't have to visit their site.

jimrandomh 11y ago

This problem is present, to varying but nonzero degrees, in all of the advertising networks. And they're doing a miserable job of fighting it. I recently saw malware advertised through AdSense, and decided to try to report it. There was no mechanism for doing so, and I checked everywhere.

volaski 11y ago

Forbes comes in first place bar none if you compute (shadiness/brand visibility). They do all kinds of shady stuff like clickbait titles, shadiest of the shadiest ad formats, that meaningless interstitial ad, and probably whole lot more I'm not even aware of. Whenever I somehow land on one of their pages (I NEVER visit them voluntarily, it's mostly via some clickbait title I click without thinking), I always think "Just die off already if you can't figure out how to make money without alienating people who have believed in you. You're being a disgrace to what Forbes used to be and people who worked hard to build up that reputation"

davb 11y ago

This is rich, being reported by Engadget. I've reached out to them numerous times to let them know their ad networks try to redirect Chrome (Android) users to Play Store apps. It doesn't happen all the time, and it doesn't happen on desktop browsers. But it's frustrating and cheap. They didn't respond.

themartorana 11y ago

Being that I make money from serving ads, I come at this a bit differently. In a lot of markets, it's one of the most passive ways to make money, but to be sure, the creepiness factor has been advertisers' hubris-induced-downfall. In any case, I haven't seen anyone here mention the ad networks themselves. Every once and a while we would get a complaint about a bad ad - it wouldn't dismiss, etc. Over time, we whittled down our network list to ad networks that strictly test and vet the ads they serve, no matter how much time that takes. The networks blaming a "rogue advertiser" means they're not even passing ads on their network through automated malware detection software, and so they have responsibility here. Creepiness factor aside, the explosion of networks is a problem, because so very few are actually providing more than a basic service. We really should be holding networks responsible for their ads. We did, and we haven't had a complaint for a very long time. Edit: this doesn't absolve Forbes, especially if they did nothing to correct the problem. Edit 2: by "we should hold the networks responsible" I mean "we the publishers" - and as that "we" we still have a responsibility to our users/consumers. See Edit 1.

BlackFly 11y ago
The problem isn't advertisements per se, the problem is advertisement networks that track users and sell their profiles. The only thing I have installed that counts as an ad blocker is Ghostery. I still get served advertisements at conscientious websites like duckduckgo.com or any other place that doesn't rely 100% on tracking networks. Imagine if simply because you walked into Target, they hired a private investigator to follow you around and determine your personal habits, hobbies and other stores you visited. Imagine if they then used that information to attempt to lure you into the store, or sold that information to Best Buy so they could lure you into the store. I think most people would have a problem with such behavior. Making a more realistic physical analogy would be slipping an RFID token into your wallet without you noticing and only tracking you in stores that use the corresponding RFID reader. In my opinion, tracking networks go the extra mile beyond a creepiness factor. My visit to your website isn't tacit approval for you to peruse my browsing of other websites. I shouldn't need to opt out of this behavior by installing Ghostery in the first place.
- 11y ago

exodust 11y ago

I won't be turning off my ad blocker, but why can't ad blockers disguise themselves? Surely there's a way to trick their site into believing I have a normal adblock-free browser. Even a per-site whitelist kind of thing, whereby popular sites with adblock detection can be dealt with via addon scripts - say for uBlock.

andrenotgiant 11y ago
It's just the nature of adblocking. The adblocker prevents certain JS from loading. Sites can easily check which JS has loaded.
- fwn 11y ago
  I think - if i didn't misunderstood it - the uBlock Origin author came up with something like a resource library for exactly that reason. Sadly I can't find a explainatory page on it right now; a possible resource file is located at: https://github.com/gorhill/uBlock/blob/master/assets/ublock/resources.txt https://github.com/gorhill/uBlock/blob/master/assets/ublock/...
- facetube 11y ago
  Ad blockers could pretty easily fetch resources and just throw them away to work around this, or insert workalike shims if it's happening client-side.
  - dylz 11y ago
    You'd still have to execute the JS - how do you expect an adblocker to emulate an abusive tracker like http://cdn4.forter.com/script.js?sn=3326ea178bfb http://cdn4.forter.com/script.js?sn=3326ea178bfb (bonus: check out the way it abuses fake sourcemaps to try and hide from devtools, and additionally log with identifying information via a network request if you are trying to debug their scripts)
TeMPOraL 11y ago
In general sense, because of the halting problem. JavaScript is Turing-complete. Ad blockers work by ensuring that some parts of the site are selectively not loaded or not executed. Ad blocker detectors can check whether some code was executed. Halting problem prevents ad blockers from being able to counter all such checks in the general case. So it's not even worth starting that arms race.

dlsx 11y ago

Hello, they are STEALING content. Good for forbes. About time people realize the web is not free.

johnhenry 11y ago

Perhaps we're coming to an understanding that third-party advertising isn't such a great revenue model for the web because it requires users to abandon security. It's becoming increasingly clear that what we get for free by allowing these ads simply isn't worth giving up our security.

oneeyedpigeon 11y ago
You might have meant this, but the problem isn't strictly third-party advertising, it's advertising delivered by a third party. Nothing wrong [1] with company a paying for company b to host an image and deliver it along with its content, just as offline advertising works. [1] Well, less wrong ...
- johnhenry 11y ago
  Yes "advertising delivered by a third party" is a more accurate description.

userbinator 11y ago

This reminds me of a time when a site asked me to enable JavaScript for "a better experience". I had been defaulting to JS off for a long time due to how effectively it stopped ads and other annoyances, and see these messages a lot, but this time I was momentarily curious for some reason; I did, only to be immediately assaulted with a bunch of ads, some crap following the pointer/scrolling, slide-overs, and other distracting annoyances that I would not at all call "a better experience". Fortunately I didn't get malware, but since then I've been much more cautious. I know many are rather fond of sayings like "JS off will break most sites", but I challenge you to experience the web with it off by default and turn it on only for the few sites that absolutely need it; depending on what your most visited sites are, you may actually enjoy it. I find that the majority of sites are perfectly readable without JS. On the other hand, I wonder if there are sites which use JS to hide the content and display a "turn off JavaScript to view this article", or "install adblocker to view this article"...

gaius 11y ago
Javascript, like Flash, doesn't do anything for the user, only for the developer or sponsor. Never did.
- csours 11y ago
  Ok, I'll bite; How would you do Google Maps without JavaScript. (or DDG Maps if you prefer) Edit: Why downvotes?
  - userbinator 11y ago
    The interface would be slightly different but there's no reason why an interactive map viewer couldn't be done in pure HTML and CSS without JS, and then JS added for more enhancements like AJAX loading. In fact... it's been done eight years ago: http://www.appelsiini.net/2008/google-maps-without-javascript http://www.appelsiini.net/2008/google-maps-without-javascrip... http://www.appelsiini.net/2008/google-maps-without-javascript-part-2 http://www.appelsiini.net/2008/google-maps-without-javascrip... Look at where the map images are coming from, copy the link, and play around with the URL parameters. Yes, this still works. I also distinctly remember playing some HTML adventure games with similar pan/zoom/click interfaces before the millenium, and they didn't require JS either (nor took quite as long as the apps of today to load, on hardware that was probably an order of magnitude or more less powerful.)

amluto 11y ago

Why are ad buyers permitted to provide ads that contain script in the first place? What was wrong with images?

lagadu 11y ago
Not aggressive enough. Gotta force the user to click and/or interact with your shitty ad!

ck2 11y ago

Correct me if I am wrong but no advertiser pays for just showing ads on a website anymore. They pay you for clicks. If someone is blocking ads, they certainly are not going to click just because you ask them to allow them to be shown or find a way to force them being shown.

mpeg 11y ago
It's not entirely true, while CPC and CPA* ads have been getting more popular over time, CPM is still the best way to go for many other purposes. Not everyone cares about getting people to click through to a landing page, lots of advertising is just about increasing the value of your brand, and if you want to reach as many people as possible you might not care whether they engage or not. * Cost per click, action or mille

kefka 11y ago

By default, I use comprehensive ad blockers on my client machines. I also suggest and assist installing them as well on anyone's machine without cost (normally billable). A great deal of problems are solved full stop by doing that simple step. And it also sends the message of , "Not interested". I go to a website to read content, not to be swayed on what shit to buy immediately or later. Oh, and punishment for allowing ads are "broken or slow machine clogged with malware". I'll pass.

Animats 11y ago

Forbes has come a long way down since the days of Malcolm Forbes, Sr. He did many exposes of bad business practices. Forbes is now owned by Integrated Whale Media Investments of Hong Kong. If you're not that familiar with how ad serving works today, watch this IAB video.[1] Note how the online auction process works. After information about the user (location, demographics, income level, previous purchases, what user has looked at) has been obtained from a data provider, that info is submitted to an ad exchange. Advertisers then have an opportunity to bid for placing an ad in that space, and have 10ms to bid. But sometimes, no advertiser bids in that round. The ad space is now "remnant space" - ad space where all the big advertisers declined to buy. Remnant space is very cheap, maybe 5% of premium space. The first ad exchange goes out to a second lower-tier ad exchange, where the cycle repeats, at a lower price point. That's where junky ads and malware get inserted. Remnant-space sellers include Rubicon, PubMatic, and AdMeld (now owned by Google). Many publishers are reluctant to set a minimum price and leave ad space unsold. Rather than fill unsold space with some non-ad content, or a house ad (Forbes running an ad for some other Forbes publication), they sell the space to one of those bottom-feeder services. This hurts their reputation and readership, and probably isn't worth the small revenue it generates. Forbes covered the issue of ad exchange trust in 2014.[2] Their ad people need to read their own magazine. [1] https://www.youtube.com/watch?v=-Glgi9RRuJs https://www.youtube.com/watch?v=-Glgi9RRuJs [2] http://www.forbes.com/sites/roberthof/2014/12/10/can-you-trust-your-ad-exchange-new-index-may-provide-the-answer/ http://www.forbes.com/sites/roberthof/2014/12/10/can-you-tru...

manigandham 11y ago
For some clarification (as I've worked in the ad industry for years) 1) Advertisers (actually their ad agencies) use software called a DSP to connect to ad exchanges and bid on each impression. They have 100-250ms depending on the exchange's rules. 2) This kind of Real-Time Bidding (RTB) is used for both premium space and unsold/remnant inventory. The separate "rounds" is going away and there's a rapid movement to do a unified auction for each impression with all possible ad buyers (premium to cheap) in a single auction. 3) Lots of publishers do actually set a price floor but this is far more complicated than binary yes/no for a floor. There's a lot of math/science put into the online ad auction and yield management space. 4) Many networks don't use RTB and are safe from this. 5) This malware issue isn't because of adtech (the tech part) but rather the incentives and lack of regulation and enforcement. Lots of politics and mistrust has required tons of javascript tags just to render a simple banner, and as we all know, js can do just about anything so it immediately gives a bad advertiser power to do whatever they want. This is something being worked on with some newer formats. There's also no consequences of "getting caught". Most ad networks and bad advertisers are not big corporations but little companies in other countries that can just change names and come back in a few days to do it all over again.

echochar 11y ago

In an "Ask HN:" someone is calling for a ban on Forbes. Forbes has indeed reached a new plateau in stupidity. Anyone using a text-only browser has seen that Forbes' most recent design transfers all the content but prevents the page from even displaying in even the most accomodating browser. The word that comes to my mind for their approach to web development is "boneheaded". Quick and dirty script to view Forbes articles, with no ads: curl http://www.forbes.com/sites/... \ |sed ' 1i\ <html> s/\\n/\ /g; s/\\r//g; s/\\"/\"/g; $a\ </html> /./{2,/try {/d; /} catch/,$d;} ' > 1.html Then view 1.html in your browser. Why did I call their web design "boneheaded"? They include two full copies of the article. And this is before all the ads and God knows what are injected into the page.