6 ms·

Why don't sites just serve up the ads from their own domain?

mschuster91 11y ago
Because with own domains sites lose the ability of tracking. A central entity can track users across all websites where the entity has a tracking beacon, and target ads to a specific customer as a result. Tracking makes advertisements much, much more expensive and thus profitable.
- tosseraccount 11y ago
  Can't their servers contact the mothership? And cache potential ads? I don't even mind the ads so much as the delay.
  - icebraining 11y ago
    Contacting the mothership doesn't help. The way it works is that an ad network loaded by site A sets a cookie with a new random ID. When you go to site B with the same ad network, since the ads are served from the same domain (the ad network's), it can read the cookie with the ID and link the two website visits. If ads came from the sites own domains, this wouldn't work.
    - tosseraccount 11y ago
      They know your domain, your IP address, your referer, your screen size, your OS, your browser version, your supported MIME types, your port number, your plugins, your ISP. That should be enough information for cooperating servers to target an ad.
      - icebraining 11y ago
        Often yes, but that breaks easily. Referers are often not sent nowadays. Screen size and OS are often similar. Browsers now auto-update, so the versions are increasingly the same, along with plugins, which are getting rarer. Port numbers vary by connection, so you can't match them. IP address don't work well for people behind NAT, which is particularly common for mobile connections, which often have carrier-grade NAT[1], and for workplace/university/school networks. Say you have two users on Macbook Airs using auto-updating Chrome (which has bundled Flash) in the same office or university, and both came in through Google. Is this an unlikely scenario? Not really. [1] https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT
      - jasode 11y ago
        >They know your domain, your IP address, [...] Yes, they can try to "fingerprint" your browser into a unique hash but that method is more reliable for desktops than mobile phones. Imagine a dozens of customers with identical iPhones sharing the wifi at Starbucks or the airport. (Everybody has the same ip address.) Sniffing for unique markers such as counting installed fonts and/or plugins isn't going to work on smartphones like it does on deskttops. Therefore, generating a cookie with an id is more reliable. Of course, people can negate that by configuring their phones to block cookies but it appears that most consumers don't do it (probably because it breaks other things such as banking, sports, etc websites.) Since advertising revenue from mobiles is growing faster than desktops, and in some cases exceeds it (Twitter mobile ads), it doesn't look like ad networks will favor fingerprinting over cookies. (That's not to say some sophisticated ad networks don't blend both techniques.)
        icebraining 11y ago
        Mobile Safari does block third-party cookies by default, which prevents ad networks from setting these tracking cookies.
pjc50 11y ago
Fraud. The dozens of domains and tons of javascript are all there as part of an effort to establish that the ad has been served to a human who might concievably be a customer for the product, and not a robot or some sort of third world ad-viewing farm.
- ino 11y ago
  That's true for click campaigns but what about view campaigns? Couldn't Samsung, now releasing their new phone, buy a website's entire ad space for a month or two, let's say techcrunch, and tell them to serve their new phone's ad themselves? Samsung is in for the eyeballs just like when they buy those huge outdoor ads, but even better, no intermediaries. The publisher would even optimize the HTML5 ads for loading and rendering speed, and have a selection of them so they could rotate them. I believe it could work well for physical items.
  - nitwit005 11y ago
    You're underestimating the general underhandedness of people. If I can sell all my website's ads once, why not try to sell them twice? Double my income. If Samsung's marketing people are in Korea, I'll show all Asian IP addresses their ad, and then show some other ad (or ads) to the rest of the world. Of course, Samsung may notice the low volume, so a better scheme is to also load their ad elsewhere, but placed on the page so it's not visible. If you look at the Javascript that gets served with the ads, there is generally a hunk of logic that tries to confirm the ad is genuinely visible, to try to deal with that last bit.
gyardley 11y ago
The biggest reason is that most publishers completely lack the ability to set up and manage an ad server. Next would probably be that the advertisers, fearing fraud, want the publishers to use a third-party ad server with reporting that they trust. Only after that comes concerns about behavioral targeting and tracking, and the absence of that affecting ad revenue. Finally, if they thought about it, they'd realize that ad blockers would just switch strategies and carry on blocking, so it hardly seems worth the effort.
- corin_ 11y ago
  65% your second point, 25% your third point, 8% your fourth point and 2% your first point. (First point maybe higher in terms of number of publishers but not in terms of number of advert impressions across the internet) (My %s are obviously non-scientific.)
0942v8653 11y ago
The lack of cross-site tracking makes the ads far less targeted, losing a good bit of the amount advertisers will pay for ads. Additionally, advertisers don't trust the logs of the site publishing the ads in the way they trust Google, further reducing the ad price. And adblockers already support hiding specific elements of the page, even if they don't involve making an HTTP request to a designated advertising domain. So people would stop using hosts files and start using proper browser extensions or HTTP proxies, and the ads would still be blocked (this could fix the iOS 9 content blocker problem, but not for long).
- ubernostrum 11y ago
  Ironically, Mozilla solved this in a privacy-respecting way, and the internet went apeshit over it and demanded its removal from the browser. That whole "sponsored tiles" thing was actually incredibly thoughtfully designed: * Third parties provide tiles to Mozilla, who gets to vet them, etc. * Tiles get put into bundles hosted by Mozilla and carrying metadata which can be used to target. * The browser periodically downloads bundles of tiles and client-side, the browser decides based on browsing history and bundle metadata which tiles to display. Nowhere in this process did advertisers or even Mozilla get to know the browsing history of the end user. Nowhere in this process did advertisers or Mozilla get to know which sites in the browser history caused the decision to display a particular tile. All storage of history and decision-making on what to show was done client-side-only. The more I think about it, the more I think something like that needs to be discussed as a real alternative to how things are done now.
  - dredmorbius 11y ago
    Interesting, and thanks for posting that here. This points to a deeper problem, one not trivially solved via technology, of credibility. There've been several instances of technical solutions to problems for which I had a great deal of initial skepticism, some warranted, some less so. I was aware of both wireless networking and VOIP in the late 1990s, though neither broke through to mainstream for some years. Trust in the integrity of the underlying protocols being a chief concern (not entirely unwarranted). Challenge-response email anti-spam systems have a similar problem -- your CR system may be entirely legit, but other peoples' might well be spam-harvesting engines or otherwise bogus. Sponsored tiles requires a great deal of buy-in before it can gain mainstream acceptance. If there's a good description of the whole thing, might make for a good HN submission.
swang 11y ago
gets advertisers to agree to let website self-host ads, with access to click rates, etc spins up new server setups ad service spend couple days fidgeting with open source ad software ads deploy to subdomain ads.domain.com people start blocking ads.domain.com, assuming ads.<>.com wasn't already in your blocklist redeploys ads into domain.com/DEFINITELY_NOT_ADS people start blocking that URL its basically a cat and mouse game. most people don't have time for that. if you have a small client base though you can probably get away with selling a promo on a per month basis.
- pixl97 11y ago
  >people start blocking that URL That part can be entirely generated on the fly. Even more so you could put important content in random generation parts to foil the people using blockers on occasion.
caoilte 11y ago
More likely to see ad companies (Google, Facebook) start serving sites.
michaelbuckbee 11y ago
From the blockers side, this doesn't really help as domain filtering is just the first step, then dom elements, url fragments and finally HTML identifiers (like being a standard ad image size). From the user privacy side it's also mixed as there are still large scale efforts to link up users across sites and devices.
- majewsky 11y ago
  Depends on the application. I'm using uMatrix and always allow all content (including JS) that's served from the same domain. The problem for me really is tracking and visual clutter, and I assume that a first-party ad will not track me across domains and likely integrate well within the page layout. I'm fully aware though that I'm not the mean audience for adblocking.
  - dredmorbius 11y ago
    uMatrix isn't an ad-blocker. It uses ... a matrix ... of domains/hosts and content types to determine what is or isn't allowed to be presented/fetched by a client. Dedicated ad-blockers, such as uBlock Origin, apply heuristics which are specifically tuned to advertising signals -- hosts, domains, and, as noted in parent to your post, various HTML and other entity clues to advertising content.
    - majewsky 11y ago
      Well, even if it technically isn't an adblocker, it's a darn good one in practice. And it sets up domain blocking by default, probably using the same lists as uBlock Origin.
      - dredmorbius 11y ago
        Yes, it's useful. No, it's not specific.

Because with own domains sites lose the ability of tracking. A central entity can track users across all websites where the entity has a tracking beacon, and target ads to a specific customer as a result. Tracking makes advertisements much, much more expensive and thus profitable.

tosseraccount 11y ago
Can't their servers contact the mothership? And cache potential ads? I don't even mind the ads so much as the delay.
- icebraining 11y ago
  Contacting the mothership doesn't help. The way it works is that an ad network loaded by site A sets a cookie with a new random ID. When you go to site B with the same ad network, since the ads are served from the same domain (the ad network's), it can read the cookie with the ID and link the two website visits. If ads came from the sites own domains, this wouldn't work.
  - tosseraccount 11y ago
    They know your domain, your IP address, your referer, your screen size, your OS, your browser version, your supported MIME types, your port number, your plugins, your ISP. That should be enough information for cooperating servers to target an ad.
    - icebraining 11y ago
      Often yes, but that breaks easily. Referers are often not sent nowadays. Screen size and OS are often similar. Browsers now auto-update, so the versions are increasingly the same, along with plugins, which are getting rarer. Port numbers vary by connection, so you can't match them. IP address don't work well for people behind NAT, which is particularly common for mobile connections, which often have carrier-grade NAT[1], and for workplace/university/school networks. Say you have two users on Macbook Airs using auto-updating Chrome (which has bundled Flash) in the same office or university, and both came in through Google. Is this an unlikely scenario? Not really. [1] https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT
    - jasode 11y ago
      >They know your domain, your IP address, [...] Yes, they can try to "fingerprint" your browser into a unique hash but that method is more reliable for desktops than mobile phones. Imagine a dozens of customers with identical iPhones sharing the wifi at Starbucks or the airport. (Everybody has the same ip address.) Sniffing for unique markers such as counting installed fonts and/or plugins isn't going to work on smartphones like it does on deskttops. Therefore, generating a cookie with an id is more reliable. Of course, people can negate that by configuring their phones to block cookies but it appears that most consumers don't do it (probably because it breaks other things such as banking, sports, etc websites.) Since advertising revenue from mobiles is growing faster than desktops, and in some cases exceeds it (Twitter mobile ads), it doesn't look like ad networks will favor fingerprinting over cookies. (That's not to say some sophisticated ad networks don't blend both techniques.)
      - icebraining 11y ago
        Mobile Safari does block third-party cookies by default, which prevents ad networks from setting these tracking cookies.

pjc50 11y ago

Fraud. The dozens of domains and tons of javascript are all there as part of an effort to establish that the ad has been served to a human who might concievably be a customer for the product, and not a robot or some sort of third world ad-viewing farm.

ino 11y ago
That's true for click campaigns but what about view campaigns? Couldn't Samsung, now releasing their new phone, buy a website's entire ad space for a month or two, let's say techcrunch, and tell them to serve their new phone's ad themselves? Samsung is in for the eyeballs just like when they buy those huge outdoor ads, but even better, no intermediaries. The publisher would even optimize the HTML5 ads for loading and rendering speed, and have a selection of them so they could rotate them. I believe it could work well for physical items.
- nitwit005 11y ago
  You're underestimating the general underhandedness of people. If I can sell all my website's ads once, why not try to sell them twice? Double my income. If Samsung's marketing people are in Korea, I'll show all Asian IP addresses their ad, and then show some other ad (or ads) to the rest of the world. Of course, Samsung may notice the low volume, so a better scheme is to also load their ad elsewhere, but placed on the page so it's not visible. If you look at the Javascript that gets served with the ads, there is generally a hunk of logic that tries to confirm the ad is genuinely visible, to try to deal with that last bit.

gyardley 11y ago

The biggest reason is that most publishers completely lack the ability to set up and manage an ad server. Next would probably be that the advertisers, fearing fraud, want the publishers to use a third-party ad server with reporting that they trust. Only after that comes concerns about behavioral targeting and tracking, and the absence of that affecting ad revenue. Finally, if they thought about it, they'd realize that ad blockers would just switch strategies and carry on blocking, so it hardly seems worth the effort.

corin_ 11y ago
65% your second point, 25% your third point, 8% your fourth point and 2% your first point. (First point maybe higher in terms of number of publishers but not in terms of number of advert impressions across the internet) (My %s are obviously non-scientific.)

0942v8653 11y ago

The lack of cross-site tracking makes the ads far less targeted, losing a good bit of the amount advertisers will pay for ads. Additionally, advertisers don't trust the logs of the site publishing the ads in the way they trust Google, further reducing the ad price. And adblockers already support hiding specific elements of the page, even if they don't involve making an HTTP request to a designated advertising domain. So people would stop using hosts files and start using proper browser extensions or HTTP proxies, and the ads would still be blocked (this could fix the iOS 9 content blocker problem, but not for long).

ubernostrum 11y ago
Ironically, Mozilla solved this in a privacy-respecting way, and the internet went apeshit over it and demanded its removal from the browser. That whole "sponsored tiles" thing was actually incredibly thoughtfully designed: * Third parties provide tiles to Mozilla, who gets to vet them, etc. * Tiles get put into bundles hosted by Mozilla and carrying metadata which can be used to target. * The browser periodically downloads bundles of tiles and client-side, the browser decides based on browsing history and bundle metadata which tiles to display. Nowhere in this process did advertisers or even Mozilla get to know the browsing history of the end user. Nowhere in this process did advertisers or Mozilla get to know which sites in the browser history caused the decision to display a particular tile. All storage of history and decision-making on what to show was done client-side-only. The more I think about it, the more I think something like that needs to be discussed as a real alternative to how things are done now.
- dredmorbius 11y ago
  Interesting, and thanks for posting that here. This points to a deeper problem, one not trivially solved via technology, of credibility. There've been several instances of technical solutions to problems for which I had a great deal of initial skepticism, some warranted, some less so. I was aware of both wireless networking and VOIP in the late 1990s, though neither broke through to mainstream for some years. Trust in the integrity of the underlying protocols being a chief concern (not entirely unwarranted). Challenge-response email anti-spam systems have a similar problem -- your CR system may be entirely legit, but other peoples' might well be spam-harvesting engines or otherwise bogus. Sponsored tiles requires a great deal of buy-in before it can gain mainstream acceptance. If there's a good description of the whole thing, might make for a good HN submission.

swang 11y ago

gets advertisers to agree to let website self-host ads, with access to click rates, etc spins up new server setups ad service spend couple days fidgeting with open source ad software ads deploy to subdomain ads.domain.com people start blocking ads.domain.com, assuming ads.<>.com wasn't already in your blocklist redeploys ads into domain.com/DEFINITELY_NOT_ADS people start blocking that URL its basically a cat and mouse game. most people don't have time for that. if you have a small client base though you can probably get away with selling a promo on a per month basis.

pixl97 11y ago
>people start blocking that URL That part can be entirely generated on the fly. Even more so you could put important content in random generation parts to foil the people using blockers on occasion.

caoilte 11y ago

More likely to see ad companies (Google, Facebook) start serving sites.

michaelbuckbee 11y ago

From the blockers side, this doesn't really help as domain filtering is just the first step, then dom elements, url fragments and finally HTML identifiers (like being a standard ad image size). From the user privacy side it's also mixed as there are still large scale efforts to link up users across sites and devices.

majewsky 11y ago
Depends on the application. I'm using uMatrix and always allow all content (including JS) that's served from the same domain. The problem for me really is tracking and visual clutter, and I assume that a first-party ad will not track me across domains and likely integrate well within the page layout. I'm fully aware though that I'm not the mean audience for adblocking.
- dredmorbius 11y ago
  uMatrix isn't an ad-blocker. It uses ... a matrix ... of domains/hosts and content types to determine what is or isn't allowed to be presented/fetched by a client. Dedicated ad-blockers, such as uBlock Origin, apply heuristics which are specifically tuned to advertising signals -- hosts, domains, and, as noted in parent to your post, various HTML and other entity clues to advertising content.
  - majewsky 11y ago
    Well, even if it technically isn't an adblocker, it's a darn good one in practice. And it sets up domain blocking by default, probably using the same lists as uBlock Origin.
    - dredmorbius 11y ago
      Yes, it's useful. No, it's not specific.