13 ms·

Given that ad networks are the #1 vector for spreading malware, I view ad blocking as basic computer hygiene. To me, it's no more controversial than washing one

Given that ad networks are the #1 vector for spreading malware, I view ad blocking as basic computer hygiene. To me, it's no more controversial than washing one's hands after using the restroom. I try to stay out of the moral discussions about "consuming" content without "paying" for it. The way I see it, ad networks will regain their rights to run code on my machine when they start taking positive steps to ensure that said code will not cause harm or copy unauthorized information off my machine.

gboudrias 11y ago
It's strange too, since ads are mostly pictures (or text) you'd think they could just serve that and prohibit, like, JS, but nope!
- iofj 11y ago
  Well some can, and do. However the ad business has long since become a race to the bottom. Refusing customer demands is not a way to "win" a race to the bottom.
- stevesearer 11y ago
  Check out my site and let me know what you think? I serve only images that are self-hosted and have found that my readers really appreciate it.
  - fiatjaf 11y ago
    Doesn't make sense.
    - fiatjaf 11y ago
      http://officesnapshots.com/ http://officesnapshots.com/
  - keithpeter 11y ago
    Looks like your editorial content is in the main left-hand column and the adverts are in the narrower right hand column when viewed on a laptop with a 1280px wide screen (linux/firefox). I have a hosts file that blocks most of the ad servers but do not have any plugins within Firefox that disable js or block adverts. Your page looks complete - i.e. nothing showing 'unable to load' signs as one might expect. Privacy Badger shows 4 trackers (amber)... cse.google.com www.google.com platform.twitter.com syndication.twitter.com The adverts appear to be smallish static images with links back to office furniture companies &c. I found the SpaceStor advert for their 'railway carriage' internal booth quite interesting so I clicked on it and was taken to a UK Web site - are you processing location information or did I just get lucky? Interesting example to pass round.
    - stevesearer 11y ago
      They are UK-based. Glad you found the experience a decent one, the more I hear about ad-blocking, the more I feel encouraged to just make ads more simple and it seems to be paying off.
  - reitanqild 11y ago
    Worked nice in mobile Firefox. Didn't do any technical check, only verified visually.
  - anexprogrammer 11y ago
    Any site that served ads like that I'd be happy to white list. I'd go further and be happy for uBlock or adblock to never block those sort of ads (uBlock didn't btw). * Static images * tastefully integrated * Self hosted, so no networks tracking me worldwide * No JS I can still read in comfort. Much like newspapers and magazines used to be. I'd even be happy to click, and perhaps buy from ads like that. This comes from someone who goes elsewhere rather than turn off noscript or uBlock. :) Well done, you invented the future of online advertising. Oh, wait...
    - jimbobimbo 11y ago
      Speaking of "tastefully integrated"... I gave up and installed ad block for my parents after they've complained about lewd ads on the local news website. This is how its "above the fold" looks like without blocked ads (I put red outlines around parts that are content): http://imgur.com/7g5ZmcG http://imgur.com/7g5ZmcG Right now there're no porn ads, but usually it serves them too.
  - rokhayakebe 11y ago
    This is why I love HN. You randomly find the people behind things you love. OS is great (Although I used to love it more when I knew the companies being listed).
    - stevesearer 11y ago
      I probably publish the same number of offices from household name type companies as before, but there are definitely many more others now. If you dial the office browse are in to show tech companies there are a good portion that the audience here will recognize: http://officesnapshots.com/offices/?fwp_industry=technology http://officesnapshots.com/offices/?fwp_industry=technology
- tyingq 11y ago
  There are some reasonable reasons for the javascript, like a/b testing, seeing where in the ad you clicked, how long you waited before clicking, etc.
  - mirimir 11y ago
    How is that not a CFAA violation?
    - dsjoerg 11y ago
      Why would it be?
      - mirimir 11y ago
        Unauthorized snooping? Maybe this seems silly. Because we're all so used to it. But think. If some kid gets access to foo.com, that's a crime, no? So how is it not a crime to access random users' devices without permission?
      - tyingq 11y ago
        At a high level, a plaintiff would claim that advertisers were using javascript to gain "unauthorized access" to "information from any protected computer". It's been tried before. Google "CFAA flash cookies" or "Halperin v Text Enhance". Didn't pan out. The plaintiffs typically fail to meet the $5k damage minimum within CFAA. I assume there are other strategies advertisers could use to defend it, but the $5k minimum is an easy path.
        mirimir 11y ago
        Well, in class actions, individual class-member damages are often small. Like $50 or whatever. But there are millions of class members.
        tyingq 11y ago
        Also tried and failed. Something legal about failing a test for appropriate aggregation. Edit: A snippet of an article about the Halperin case... 'the court says that it can’t aggregate the harm to other putative class members to satisfy the damage threshold unless the damage arises out of a “single act.” And that poses a problem as the complaint is currently pled. The surreptitious install of the program by thousands of consumers (and putative class members) is not a “single act,” so Halperin can’t rely on this “act” when aggregating. Halperin argued that he shouldn’t be subject to the no-aggregation rule.'
donatj 11y ago
I'd like to see some stats on that. I'm relatively certain email is still the biggest attack vector. JavaScript in this day and age is remarkably well sandboxed.
- eli 11y ago
  Don't forget hacked WordPress sites
- hluska 11y ago
  Here's one: https://heimdalsecurity.com/blog/biggest-threat-in-your-browser/ https://heimdalsecurity.com/blog/biggest-threat-in-your-brow...
  - sdoering 11y ago
    You mean this site that pops you into said article, but then scrolls you to the top of the page to shove advertising into your face without even letting you glimpse at the searched for content? For that, this: echo '0.0.0.0 heimdalsecurity.com' >> /etc/hosts
    - generj 11y ago
      How many users know how to edit their hosts file?
      - garrettgrimsley 11y ago
        I think that it was more a statement about the distaste that the author holds for that godawful site than an instruction for users to follow.
        generj 11y ago
        My point was that the problem is NOT easily solved for the typical user.
- 11y ago
PhasmaFelis 11y ago
This is similar to my position. Some people take an absolute moral stance that it is unacceptable to show people any ads, ever. That seems silly to me. My problem is with ads that are intrusive, or deceptive/clickbait, or malware-laden, or slow my browser to a crawl.
- deleted 11y ago
  [deleted]
deleted 11y ago
[deleted]
brettz 11y ago
There are ad networks that do take positive steps to ensure that code is not harmful. Do you look into the ad networks you block and whitelist ones that are clean? Or do you rely on Eyeo/ABP by using their acceptable ads list while they take a cut?
- enraged_camel 11y ago
  I would consider unblocking an ad network that serves static-image ads only. No gif banners, no JavaScript, no obnoxious or deceptive behavior such as trying to blend into the page and looking like a native page element to trick the user to click it.
  - deleted 11y ago
    [deleted]
  - striking 11y ago
    Project Wonderful is unblocked on my browser.
    - rspeer 11y ago
      Is there a straightforward way to unblock a particular ad network, such as Project Wonderful, using uBlock Origin?
      - striking 11y ago
        Go to projectwonderful.com and use the advanced selector's global column to turn the projectwonderful.com row green. You'll need to have turned on advanced mode for it to work. And of course, this only works with PW because PW serves ads from only its domain. Most ad networks aren't nearly so nice. When you're sure your changes are good, hit the lock button to save them. ... it's complicated, I know. Sorry!
- lugg 11y ago
  > Do you look into the ad networks you block and whitelist ones that are clean? No. I'm not incentivized to and it is not in my best interests. > Or do you rely on Eyeo/ABP by using their acceptable ads list while they take a cut? Is that enabled by default? I rarely see / notice ads.
nikcub 11y ago
In the future we'll look back at this era of web advertising and security completely bemused: the state today is that most major websites hand over control, context and trust to unknown and untrusted third parties to execute whatever code they wish. They do this dozens of times per page request. It is completely crazy.
Stratoscope 11y ago
A funny coincidence: I had a phone screen yesterday for a full stack developer job at 23andMe. (Very good people from my experience so far!) One of the questions was to talk about cross site scripting. I described the basic concept and then mentioned how so many sites volunteer to be cross site scripted, by loading random scripts from multiple ad networks. Some years ago I was working at Zvents on front end code for their partner sites. These were news sites who just loved to pull in as many ad network scripts as they could. Those ad networks did not make my job easy. Here I was, trying to create a nice experience for our users, and robust across multiple browsers... And the ad network scripts kept breaking fundamental JavaScript features! A lot of my time went into reverse engineering their scripts so I could figure out how they were breaking things and work around it. A pox on ad networks, I say.
- insaneirish 11y ago
  > A funny coincidence: I had a phone screen yesterday for a full stack developer job at 23andMe. Unless you're also writing the operating system, can we all agree to stop using the term "full stack"?
  - martiuk 11y ago
    Yeah and DevOps as a job title, I keep getting calls asking for someone who's had 6 years DevOps experience...
  - b123400 11y ago
    "Full stack" is an alias for web developer nowadays, and I thought everyone kind of assume that. Btw if one shouldn't use the term "full stack" unless he is also writing operation system, then maybe anyone who doesn't write hardware driver is not full stack as well.
DanBC 11y ago
> I try to stay out of the moral discussions about "consuming" content without "paying" for it. The way I see it, ad networks will regain their rights to run code on my machine when they start taking positive steps to ensure that said code will not cause harm or copy unauthorized information off my machine. I'm generally ad tolerant. (I've said this on HN before). I didn't block ads. I'd even click ads if they were relevant to my interest. Although I don't think I've ever bought anything from an ad or as a result of clicking an ad. I can understand the "ads are a way to pay for the content you use" argument and I have some sympathy for it. Yet even I have installed an ad-blocker. I mostly use a mobile connection. Installing an ad-blocker has considerably reduced the stuff I download. An Ad blocker literally saves me money.
ikeboy 11y ago
The controversial part isn't the adblocking per se, but the viewing of pages that have ads while using an adblocker. It's fine to decide that ad networks don't have a "right" to run code on your machine, but the moral response (assuming you don't have an answer to the "consume content question") is to configure your adblocker to close any tab that would otherwise load an ad. If instead, you decide to view the page without the ad, then you need some answer beyond "I don't give ad networks the right to run code on my machine". (I'm not saying ad blocking is morally wrong, just that your justification for it isn't sufficient. I block ads myself.)
- Touche 11y ago
  The answer is the same as why you are morally justified in skipping commercials on your DVR, or ripping ads out of a magazine. Content creators do not get to decide how you view their content.
  - ikeboy 11y ago
    I notice you did not include pirating movies. Do you think there's a difference?
    - Touche 11y ago
      Of course, pirated movies are not acquired legally. We can debate the (moral) legitimacy of the laws, but that's a different animal than modifying content that you have legally obtained.
      - anonymousab 11y ago
        So if websites sent you a license agreement before serving content, which required you to load the ads for that content as the condition of viewing it, would blocking ads at that point be illegal? If this became a standard, automatic component of the web and of browsers, known at install time, wouldn't that move ad blocking into poor legal territory?

gboudrias 11y ago

It's strange too, since ads are mostly pictures (or text) you'd think they could just serve that and prohibit, like, JS, but nope!

iofj 11y ago
Well some can, and do. However the ad business has long since become a race to the bottom. Refusing customer demands is not a way to "win" a race to the bottom.
stevesearer 11y ago
Check out my site and let me know what you think? I serve only images that are self-hosted and have found that my readers really appreciate it.
- fiatjaf 11y ago
  Doesn't make sense.
  - fiatjaf 11y ago
    http://officesnapshots.com/ http://officesnapshots.com/
- keithpeter 11y ago
  Looks like your editorial content is in the main left-hand column and the adverts are in the narrower right hand column when viewed on a laptop with a 1280px wide screen (linux/firefox). I have a hosts file that blocks most of the ad servers but do not have any plugins within Firefox that disable js or block adverts. Your page looks complete - i.e. nothing showing 'unable to load' signs as one might expect. Privacy Badger shows 4 trackers (amber)... cse.google.com www.google.com platform.twitter.com syndication.twitter.com The adverts appear to be smallish static images with links back to office furniture companies &c. I found the SpaceStor advert for their 'railway carriage' internal booth quite interesting so I clicked on it and was taken to a UK Web site - are you processing location information or did I just get lucky? Interesting example to pass round.
  - stevesearer 11y ago
    They are UK-based. Glad you found the experience a decent one, the more I hear about ad-blocking, the more I feel encouraged to just make ads more simple and it seems to be paying off.
- reitanqild 11y ago
  Worked nice in mobile Firefox. Didn't do any technical check, only verified visually.
- anexprogrammer 11y ago
  Any site that served ads like that I'd be happy to white list. I'd go further and be happy for uBlock or adblock to never block those sort of ads (uBlock didn't btw). * Static images * tastefully integrated * Self hosted, so no networks tracking me worldwide * No JS I can still read in comfort. Much like newspapers and magazines used to be. I'd even be happy to click, and perhaps buy from ads like that. This comes from someone who goes elsewhere rather than turn off noscript or uBlock. :) Well done, you invented the future of online advertising. Oh, wait...
  - jimbobimbo 11y ago
    Speaking of "tastefully integrated"... I gave up and installed ad block for my parents after they've complained about lewd ads on the local news website. This is how its "above the fold" looks like without blocked ads (I put red outlines around parts that are content): http://imgur.com/7g5ZmcG http://imgur.com/7g5ZmcG Right now there're no porn ads, but usually it serves them too.
- rokhayakebe 11y ago
  This is why I love HN. You randomly find the people behind things you love. OS is great (Although I used to love it more when I knew the companies being listed).
  - stevesearer 11y ago
    I probably publish the same number of offices from household name type companies as before, but there are definitely many more others now. If you dial the office browse are in to show tech companies there are a good portion that the audience here will recognize: http://officesnapshots.com/offices/?fwp_industry=technology http://officesnapshots.com/offices/?fwp_industry=technology
tyingq 11y ago
There are some reasonable reasons for the javascript, like a/b testing, seeing where in the ad you clicked, how long you waited before clicking, etc.
- mirimir 11y ago
  How is that not a CFAA violation?
  - dsjoerg 11y ago
    Why would it be?
    - mirimir 11y ago
      Unauthorized snooping? Maybe this seems silly. Because we're all so used to it. But think. If some kid gets access to foo.com, that's a crime, no? So how is it not a crime to access random users' devices without permission?
    - tyingq 11y ago
      At a high level, a plaintiff would claim that advertisers were using javascript to gain "unauthorized access" to "information from any protected computer". It's been tried before. Google "CFAA flash cookies" or "Halperin v Text Enhance". Didn't pan out. The plaintiffs typically fail to meet the $5k damage minimum within CFAA. I assume there are other strategies advertisers could use to defend it, but the $5k minimum is an easy path.
      - mirimir 11y ago
        Well, in class actions, individual class-member damages are often small. Like $50 or whatever. But there are millions of class members.
        tyingq 11y ago
        Also tried and failed. Something legal about failing a test for appropriate aggregation. Edit: A snippet of an article about the Halperin case... 'the court says that it can’t aggregate the harm to other putative class members to satisfy the damage threshold unless the damage arises out of a “single act.” And that poses a problem as the complaint is currently pled. The surreptitious install of the program by thousands of consumers (and putative class members) is not a “single act,” so Halperin can’t rely on this “act” when aggregating. Halperin argued that he shouldn’t be subject to the no-aggregation rule.'

donatj 11y ago

I'd like to see some stats on that. I'm relatively certain email is still the biggest attack vector. JavaScript in this day and age is remarkably well sandboxed.

eli 11y ago
Don't forget hacked WordPress sites
hluska 11y ago
Here's one: https://heimdalsecurity.com/blog/biggest-threat-in-your-browser/ https://heimdalsecurity.com/blog/biggest-threat-in-your-brow...
- sdoering 11y ago
  You mean this site that pops you into said article, but then scrolls you to the top of the page to shove advertising into your face without even letting you glimpse at the searched for content? For that, this: echo '0.0.0.0 heimdalsecurity.com' >> /etc/hosts
  - generj 11y ago
    How many users know how to edit their hosts file?
    - garrettgrimsley 11y ago
      I think that it was more a statement about the distaste that the author holds for that godawful site than an instruction for users to follow.
      - generj 11y ago
        My point was that the problem is NOT easily solved for the typical user.
11y ago

PhasmaFelis 11y ago

This is similar to my position. Some people take an absolute moral stance that it is unacceptable to show people any ads, ever. That seems silly to me. My problem is with ads that are intrusive, or deceptive/clickbait, or malware-laden, or slow my browser to a crawl.

deleted 11y ago
[deleted]

deleted 11y ago

[deleted]

brettz 11y ago

There are ad networks that do take positive steps to ensure that code is not harmful. Do you look into the ad networks you block and whitelist ones that are clean? Or do you rely on Eyeo/ABP by using their acceptable ads list while they take a cut?

enraged_camel 11y ago
I would consider unblocking an ad network that serves static-image ads only. No gif banners, no JavaScript, no obnoxious or deceptive behavior such as trying to blend into the page and looking like a native page element to trick the user to click it.
- deleted 11y ago
  [deleted]
- striking 11y ago
  Project Wonderful is unblocked on my browser.
  - rspeer 11y ago
    Is there a straightforward way to unblock a particular ad network, such as Project Wonderful, using uBlock Origin?
    - striking 11y ago
      Go to projectwonderful.com and use the advanced selector's global column to turn the projectwonderful.com row green. You'll need to have turned on advanced mode for it to work. And of course, this only works with PW because PW serves ads from only its domain. Most ad networks aren't nearly so nice. When you're sure your changes are good, hit the lock button to save them. ... it's complicated, I know. Sorry!
lugg 11y ago
> Do you look into the ad networks you block and whitelist ones that are clean? No. I'm not incentivized to and it is not in my best interests. > Or do you rely on Eyeo/ABP by using their acceptable ads list while they take a cut? Is that enabled by default? I rarely see / notice ads.

nikcub 11y ago

In the future we'll look back at this era of web advertising and security completely bemused: the state today is that most major websites hand over control, context and trust to unknown and untrusted third parties to execute whatever code they wish. They do this dozens of times per page request. It is completely crazy.

Stratoscope 11y ago

A funny coincidence: I had a phone screen yesterday for a full stack developer job at 23andMe. (Very good people from my experience so far!) One of the questions was to talk about cross site scripting. I described the basic concept and then mentioned how so many sites volunteer to be cross site scripted, by loading random scripts from multiple ad networks. Some years ago I was working at Zvents on front end code for their partner sites. These were news sites who just loved to pull in as many ad network scripts as they could. Those ad networks did not make my job easy. Here I was, trying to create a nice experience for our users, and robust across multiple browsers... And the ad network scripts kept breaking fundamental JavaScript features! A lot of my time went into reverse engineering their scripts so I could figure out how they were breaking things and work around it. A pox on ad networks, I say.

insaneirish 11y ago
> A funny coincidence: I had a phone screen yesterday for a full stack developer job at 23andMe. Unless you're also writing the operating system, can we all agree to stop using the term "full stack"?
- martiuk 11y ago
  Yeah and DevOps as a job title, I keep getting calls asking for someone who's had 6 years DevOps experience...
- b123400 11y ago
  "Full stack" is an alias for web developer nowadays, and I thought everyone kind of assume that. Btw if one shouldn't use the term "full stack" unless he is also writing operation system, then maybe anyone who doesn't write hardware driver is not full stack as well.

DanBC 11y ago

> I try to stay out of the moral discussions about "consuming" content without "paying" for it. The way I see it, ad networks will regain their rights to run code on my machine when they start taking positive steps to ensure that said code will not cause harm or copy unauthorized information off my machine. I'm generally ad tolerant. (I've said this on HN before). I didn't block ads. I'd even click ads if they were relevant to my interest. Although I don't think I've ever bought anything from an ad or as a result of clicking an ad. I can understand the "ads are a way to pay for the content you use" argument and I have some sympathy for it. Yet even I have installed an ad-blocker. I mostly use a mobile connection. Installing an ad-blocker has considerably reduced the stuff I download. An Ad blocker literally saves me money.

ikeboy 11y ago

The controversial part isn't the adblocking per se, but the viewing of pages that have ads while using an adblocker. It's fine to decide that ad networks don't have a "right" to run code on your machine, but the moral response (assuming you don't have an answer to the "consume content question") is to configure your adblocker to close any tab that would otherwise load an ad. If instead, you decide to view the page without the ad, then you need some answer beyond "I don't give ad networks the right to run code on my machine". (I'm not saying ad blocking is morally wrong, just that your justification for it isn't sufficient. I block ads myself.)

Touche 11y ago
The answer is the same as why you are morally justified in skipping commercials on your DVR, or ripping ads out of a magazine. Content creators do not get to decide how you view their content.
- ikeboy 11y ago
  I notice you did not include pirating movies. Do you think there's a difference?
  - Touche 11y ago
    Of course, pirated movies are not acquired legally. We can debate the (moral) legitimacy of the laws, but that's a different animal than modifying content that you have legally obtained.
    - anonymousab 11y ago
      So if websites sent you a license agreement before serving content, which required you to load the ads for that content as the condition of viewing it, would blocking ads at that point be illegal? If this became a standard, automatic component of the web and of browsers, known at install time, wouldn't that move ad blocking into poor legal territory?