16 ms·

Forbes Site, After Begging You Turn Off Adblocker, Serves Up Malware 'Ads'

606 points by jackgavigan 11y ago

ikeboy 11y ago
Blogspam of the story discussed in https://news.ycombinator.com/item?id=10870892 https://news.ycombinator.com/item?id=10870892
georgespencer 11y ago
My process 1. Click Forbes link 2. Get blank page where ad should be and "Continue to site" link 3. Click continue 4. Get request to turn off ad blocker 5. Laugh that I can't remember that Forbes blocks ad blockers 6. Google the headline 7. Read the story someplace else Hope that helps.
- ZeroGravitas 11y ago
  This seems like something that could be automated into a browser plugin.
  - bduerst 11y ago
    Use a good news RSS feed to find similar articles. I think there are some that aggregate by story.
- ikeboy 11y ago
  Copying titles into archive.is works for forbes and wsj.
- mmoche 11y ago
  My favorite part of their anti-adblocker approach was when I actually disabled my blocker and ran into a hilarious "ad-light"[0] experience that was so ad-heavy I immediately gave up and found somewhere else to read an article. Countless "sponsored" article links, old-timey banner ads, and 75% of the visible page devoted to items other than content. [0]https://twitter.com/mmoche/status/710167616535531520 https://twitter.com/mmoche/status/710167616535531520
  - pkfrank 11y ago
    I had an identical experience and reaction: https://twitter.com/PeterKimFrank/status/710164166636675072 https://twitter.com/PeterKimFrank/status/710164166636675072
- XCSme 11y ago
  Every time I reached the Forbes website I was really wondering if there is any option to hide a website from Google search results. So, I would like to never have any result from forbes.com (even if I search forbes). Do you know if there are Chrome Extensions or settings you can turn on in Google Search to hide certain websites?
  - ValentineC 11y ago
    There's a Chrome extension (by Google, no less) for this! https://chrome.google.com/webstore/detail/personal-blocklist-by-goo/nolijncfnkgaikbjbdaogikpmpbdcdef?hl=en https://chrome.google.com/webstore/detail/personal-blocklist...
  - deleted 11y ago
    [deleted]
  - NathanKP 11y ago
    This is the official Google extension for doing that: https://chrome.google.com/webstore/detail/personal-blocklist-by-goo/nolijncfnkgaikbjbdaogikpmpbdcdef https://chrome.google.com/webstore/detail/personal-blocklist...
    - sosuke 11y ago
      Wow! Thank you very much I never thought of looking for an extension. For a very short time I found that feature in my search results directly. Then it just went away.
      - dunham 11y ago
        Yeah, Google did that for a short time. I used to use it to filter out content farms. They've gotten better at filtering content farms since then, and dropped the feature - probably because it was too expensive resource-wise to personalize results like that.
    - FilterSweep 11y ago
      Not sure if it's very functional. I blocked W3Schools + Wildcards (because I'd rather read MDN) and after a few months of working their results continued appearing at the top of my page. There are a few blog posts around the net where some users have tried similar and found that W3 schools was also serving up content from another place that had not been blocked.
- cesarb 11y ago
  My process 1. Open Forbes link in a new tab 2. Get redirected to completely blank page with only /welcome/ in the URL path 3. Temporarily enabling JavaScript for its domain and reloading won't help, since it lost the original URL and I don't remember where I got the link, so I don't even try 4. Give up and close the tab For most sites where JavaScript is required, temporarily enabling (uBlock origin advanced mode) and reloading is enough. Forbes is the only one I recall which completely loses the URL in the redirect.
  - gorhill 11y ago
    If you are using uBlock Origin, Forbes' anti-blocker is bypassed with default settings.
- ultramancool 11y ago
  My process 1. Install https://github.com/reek/anti-adblock-killer https://github.com/reek/anti-adblock-killer 2. Laugh maniacally.
  - TheLogothete 11y ago
    Why do you insist to consume content when the publisher tells you they don't want your visit if you don't want their ads?
    - ultramancool 11y ago
      Because I wanted to see the content? Is that what you're really asking? Am I supposed to feel some kind of moral obligation to see the ads just because they want me to, even if my browser is perfectly capable of blocking them? Sorry, but it's _my_ computer. I control it. Publishers don't get to decide what it does or does not do. I do.
      - kodablah 11y ago
        I think they mean: Why do you want to consume content from companies like that?
        ultramancool 11y ago
        The quality of their publishing practice doesn't necessarily reflect the quality of the content.
      - manigandham 11y ago
        Moral obligation is the reason to not take/copy other things. This is the same as music/movie piracy. Basically you're doing it because you dont have the legal/physical repercussions of taking other things in life.
        ultramancool 11y ago
- jasonkostempski 11y ago
  I really want a plug that will let me mark sites like Forbes and then decorate any links to it indicating I've already decided I don't want to go there. This way Forbes doesn't even get a +1 visit from me. I've had this thought several times over the last few months so last night I started work on a Chrome plugin that takes a regex pattern and css styles, finds the pattern in the markup and then applies the css to the first visible element containing the pattern. I'm hoping it will be useful for more than just reminding myself to not click links.
  - colinbartlett 11y ago
    That would be useful but it almost sounds better to register the view of their landing page and then not register the view of their article. Surely they will see a widening gap over time?
  - wrong_variable 11y ago
    start a github repo - maybe we can help ?
    - jasonkostempski 11y ago
      I will, sometime in the next week, hold me to it. I've actually got something working. So far I've got a hardcoded list of rules and styles and it works, even if the page content changes dynamically. I have to make all changes in code and manually reload the extension every time but it's not bad since I don't need to change things often.
  - Nadya 11y ago
    >I really want a plug that will let me mark sites like Forbes and then decorate any links to it indicating I've already decided I don't want to go there. This way Forbes doesn't even get a +1 visit from me. Host file. forbes.com 127.0.0.1 At home I have a giant list of sites I've blocked for this. #Requests I turn off uBlock. Doing them the courtesy of not giving them any traffic instead.
    - 11y ago
- Aelinsaar 11y ago
  Works for me too, and I like to add 8.) Reflect for a moment on how much of human endeavor is wasted effort before it even began.
- baldfat 11y ago
  I use a text command line reader for news and I really have found it makes these things just go away :) I use w3m
- Pxtl 11y ago
  What cheeses me off is that I get blocked from many sites just for using FlashBlock. I'm not blocking all ads, I'm just using a "disable flash by default and enable manually if necessary".
  - beagle3 11y ago
    Does that still happen? I remember this being the case years ago, but in the last 3, especially since Firefox went "click to flash", I haven't encountered this.
- nashashmi 11y ago
  I once disabled something in by adblocker that prevented Forbes from knowing I had an adblocker. Basically, you only allow that one adblocker detector to come through. Of course it is not like I remember what it was, but I don't have to bother with Forbes anymore.
untog 11y ago
IMO, this is the biggest issue facing ad providers today. I get the anti-ad blocker complaints - there are a lot of sites that depend entirely upon advertising revenue for their continued existence. And this isn't just crappy blogmills - even a company like the New York Times doesn't make enough money from subscriptions alone to continue operating without advertising of some sort. Maybe there's a different model out there but as far as I'm aware no-one has found it yet, and in the mean time I'm quite prepared to tolerate advertising on web sites in return for the content I get. I'll even tolerate a pre-roll ad or a full-screen takeover before I get to a page every now and then - but there's a line. The mild end of it (for me) is ads clearly intended to make you click by accident, and the severe end of it is malware like this. And in my experience it's on the rise. By all means implore your users to turn off their ad blockers. But clean house first and make sure you know what you're serving. The real problem is that it's borderline impossible for anyone to do so, given how many reseller networks exist out there these days. I often see people say that sites should arrange and sell their own advertising - but the reality is there's no money in it. Selling yourself out to the Google ad behemoth is often the only way out.
- bduerst 11y ago
  >Maybe there's a different model out there but as far as I'm aware no-one has found it yet You could try Google Contributor. It shows you pictures of cats instead of ads, and let's you give a couple pennies to the website. It's not 100% but it's something different.
  - untog 11y ago
    I actually do. It works very well, but still involves loading a lot of JS on the page. Still, a lot better than anything else.
    - deleted 11y ago
      [deleted]
- ArtDev 11y ago
  Even Google ads contained malware recently.
tombert 11y ago
I remember thinking this was suspicious. I remember about three months ago I added a bunch of known malware sites to my hostfile so that I wouldn't give them traffic, and I couldn't get to Forbes. Funny, too, because I don't even use Ad-block.
slipstream- 11y ago
And that's why I use a nice helpful userscript that aims to work around these things: https://github.com/adsbypasser/adsbypasser https://github.com/adsbypasser/adsbypasser
coldpie 11y ago
I'm willing to compromise on web advertising, but not while this is possible. I don't understand why on Earth ad networks, and more importantly content publishers, allow arbitrary Javascript and Flash through their networks and onto their websites. You as a content publisher are not allowed to compromise your users' security, full stop. You are responsible for any compromises that come through your website. Until content publishers get that through their thick fucking skulls, I will continue to use an ad blocker and strongly recommend them to everyone I know. I would rather all ad-supported businesses fail than allow this malware to continue be distributed.
deleted 11y ago
[deleted]
joeblau 11y ago
I use Steven Blacks hosts script[1] and every time I see Forbes paywall, I just leave. If the article is that important, some other outlet will cover the news. [1] - https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- peatmoss 11y ago
  I knew about someonewhocares, but this is appears to aggregate that plus several others. Thank you for the tip!
SCAQTony 11y ago
Those sites that serve up malware scripts and call them ads, perhaps ad-blockers should rebrand and start calling themselves malware-blockers?
revelation 11y ago
Seems simple enough, sue Forbes.
kr0 11y ago
I block all ads globally. Until this "different model" becomes prevalent I'm not budging. The argument that there are websites that can't operate without ads is valid, but there is no websites that __actually__ need ads that would be willing to wall users of ad blockers. Sites like YouTube could never implement such a wall without significant loss of revenue.
delgaudm 11y ago
So far pi-hole[1] network based ad-blocker has proven to be the best use of the Raspberry Pi i bought and didn't know what to do with it. [1] https://pi-hole.net/ https://pi-hole.net/
- andrepd 11y ago
  Seems interesting. What is the performance/latency penalty?
  - paulbennett 11y ago
    Performance seems fine (on a Pi 2). I am going to have to add some URLs to the whitelist though, as it has recently started affecting the ability to log into Xbox Live.
intrasight 11y ago
Forbes should just turn off that steaming pile of a web site. Either that or turn off all the ads since it is only damaging their reputation.
ArtDev 11y ago
This is why I use an adblocker blocker blocker (https://github.com/reek/anti-adblock-killer/ https://github.com/reek/anti-adblock-killer/).
- dbcurtis 11y ago
  Seems to me this functionality could be wrapped up in a web proxy. The proxy can pretend to allow all the ads, and simply drop them on the way to clients. Of course this doesn't deal with the issue of ads soaking up a bunch of bandwidth. I get tired of installing ad blockers on every machine/device in the house, and on some machines use multiple different browsers -- I'm suffering from blocker installation fatigue.
  - ryandrake 11y ago
    > I get tired of installing ad blockers on every machine/device in the house, and on some machines use multiple different browsers -- I'm suffering from blocker installation fatigue. If you run dnsmasq, you can block [1] a lot of ads for your entire house at once through DNS. 1: https://www.debian-administration.org/article/535/Blocking_ad_servers_with_dnsmasq https://www.debian-administration.org/article/535/Blocking_a...
    - w-ll 11y ago
      There's also Pi Hole, which you setup on a raspberry pi. Which is nice because you can leave it on all day. Where as at night when I shut down my desktop but might be using my phone or a tablet. https://pi-hole.net/ https://pi-hole.net/
      - itslennysfault 11y ago
        This looks awesome, but is there a way to bypass this from the browser? Occasionally, I give in and disable ad block if I really want to see something.
    - dbcurtis 11y ago
oli5679 11y ago
Yesterday I tried to read a Forbes article on my mobile. It presented me with the banner asking me to turn ad-blocker off (which I haven't installed). I reloaded the page and was faced with pop-ups claiming I had won free Amazon products.
- coldpie 11y ago
  If you're interested in mobile ad blocking (if you're concerned about the security of your mobile device, you should be), uBlock Origin works very well in Firefox for Android. I strongly recommend you install it before your device is compromised.
  - danieldk 11y ago
    Or on iOS Purify, which was made by the developer of uBlock, Chris Aljoudi: https://www.purify-app.com/ https://www.purify-app.com/
hashkb 11y ago
Wasn't there a report like this about Forbes and malware a few months ago? Have they responded in press? (Hopefully on Medium so I can read it.)
- coldpie 11y ago
  As far as I've seen, content publishers' response to being caught distributing malware is to say "It's the ad network's fault! We'll work with them to clean it up." They never name the ad network and no changes will be implemented. The only way to protect yourself is to install an ad blocker.
  - lostgame 11y ago
    Or not use the site. :P
  - logfromblammo 11y ago
    C: Excuse me? Are you the produce manager? M: Yes, that's me. C: Oh, good. Yesterday, I bought a banana here. When I got it home, I discovered there was a bomb in it. M: I'm only the produce manager. I don't deal with bombs. C: But the bomb was *in* the banana. M: How was it? C: How was what? M: The banana. Not bruised or overripe or anything? C: No, the banana was fine. It was a perfectly normal banana. ...with a bomb in it. M: Ah, good. Another satisfied customer. C: I am *not* satisfied! I could have been killed! M: Were you? C: Obviously not! M: So what's the problem? C: There was a bomb in my banana! M: Well, we just sell the bananas as we get them, from the banana-modifying company. C: Why can't you just get your bananas direct from the plantation? Why can't I get an unaltered, unmodified banana--without any bombs in it? M: Excuse me, sir or madam, but this is a *business*. How do you expect us to pay our employees with a store full of unmodified bananas? C: [facepalm]
- davesque 11y ago
  I think this is reporting on the same incident. The comments on the article are dated from early January.
ihsw 11y ago
So what's wrong with image-only ads? Why do we have to let advertisers inject their own JS into a web page?
vlunkr 11y ago
Forbes is truly terrible at this. I tried to read something there, had to disable my ad blocker and ghostery. After refreshing, ghostery counted 40+ trackers on the site. https://www.ghostery.com/ https://www.ghostery.com/ - I recommend it
forrestthewoods 11y ago
This is why I block all ads, all the time. No exception. There are no "good" ads.
- bitJericho 11y ago
  Same. Ads aren't good for anybody's health.
K0nserv 11y ago
My $0.02 Publishers should look to Stack Overflow and be inspired to run ads of high quality and relevance[0]. Throw out the ad networks, tracking, and reject rich media ads. Instead focus on high value ads that align well with your readership and manually verify the quality of these ads. If publishers do this I am willing to turn of my ad blocker. 0: https://blog.stackoverflow.com/2016/02/why-stack-overflow-doesnt-care-about-ad-blockers/ https://blog.stackoverflow.com/2016/02/why-stack-overflow-do...
- ktRolster 11y ago
  Publishers want to make more money than Stack Overflow. That's basically why.
chris_wot 11y ago
You know, this is why my dad's computer is riddled with malware every single time I go over to his place. No new apps were installed, he doesn't even know how. But he does browse the web. First thing I'm doing when I get over there is install the most restrictive ad blocker I can find.
crablar 11y ago
Forbes is dealing with ad networks that aren't trustworthy. The ad networks that are most profitable are going to have some terrible deal flow that includes malware and viruses.
brianbreslin 11y ago
If Forbes set a minimum price for their ad backfill inventory (the shitty ad inventory they fill with low quality ads), could it economically not make sense to the networks to fill that space with malware ads?
- DanielDent 11y ago
  Unfortunately I think you have it backwards. Malware ads are being displayed because they are winning the auctions. That's because - on a CPM basis - malware authors are probably the ones who will always be able to pay the most. A successfully infected machine is worth a good chunk of change. Ad networks are uniquely suited to malware delivery. Have an exploit which only works for OS X users? Don't bid on the windows users.
nyolfen 11y ago
if you're interested in escalating the adblock arms race, i've been using IsraBlock[0][1] and it seems to work well [0] https://chrome.google.com/webstore/detail/israblock/kekndmaoonpjhjhobkcegfaaikgnccbo?hl=en https://chrome.google.com/webstore/detail/israblock/kekndmao... [1] https://addons.mozilla.org/en-US/firefox/addon/israblock/?src=cb-dl-recentlyadded https://addons.mozilla.org/en-US/firefox/addon/israblock/?sr...
chinathrow 11y ago
Sue them, file a class action and I am sure, they will learn.
- deleted 11y ago
  [deleted]
fightfortheuser 11y ago
And that's why I never go to forbes anymore. It's a bad user experience. Now they can add greedy and not secure to the list.
- takno 11y ago
  Treat yourself and switch to never going there for the indifferent to poor quality of the content. Whenever I hit the adwall I'm just grateful for the reminder that I don't have to waste my time on that
barretts 11y ago
Forbes' "Please turn off your adblocker" interstitial is a great reminder not to read Forbes' clickbait bullshit pseudo-journalism.
- shkkmo 11y ago
  as opposed to this article's clickbait bullshit pseudo-journalism? https://news.ycombinator.com/item?id=11455718 https://news.ycombinator.com/item?id=11455718
tmaly 11y ago
I noticed there are a lot more sites that can detect Ad Blockers. They hassle you about disabling the blocker. Why not just make the ad inline into the content of the page. It would speed up the site as you would not have to make all the extra connections to these ad networks via thirdparty javascript.
- flying_kangaroo 11y ago
  Ad networks don't want to trust publishers to accurately report page hits with inline images, they also would presumably like to be able to track users and serve up "tailored" ads, which they can't really do if they don't get any information on the user before serving the ad.
jordigh 11y ago
Wow, the language, "hold their content hostage". I hate ads probably more than most[1], but still, if Forbes doesn't want to give up their articles without fair compensation, that's their prerogative. They're not taking hostages. -- [1] https://news.ycombinator.com/item?id=10939083 https://news.ycombinator.com/item?id=10939083
- lostgame 11y ago
  Uh...'fair compensation' is not installing malware. I don't think that's ever fair.
  - jordigh 11y ago
    I didn't say it was. I thought that was implied when I said I hated ads. But the language of holding your own writings "hostage" because you don't want to give them up without some kind of compensation is just absurd. I wish Forbes just was honest and went full paywall. I wish everyone did this.
xori 11y ago
Pretty sure they didn't actually serve malware and that news sites just made the click-bait title for clicks. http://www.ghettoforensics.com/2016/03/of-malware-and-adware-why-forbes-was.html#more http://www.ghettoforensics.com/2016/03/of-malware-and-adware...
- shkkmo 11y ago
  I understand everyone's frustration around this issue, I hate site that block adblocker users as well. However, this article is an example of unethical journalism. TL;DR Article says "Well, how about they start treating their ad inventory with at least a percentage of the care with which they treat their content?" The researcher who discovered the issue says "Forbes almost immediately reached out and we started a dialog. We shared logs, events, and descriptions of the ad." In contrast, when the researcher reached out the correct the Engadget article that started this and quoted him, he got no response.
- jessriedel 11y ago
  Yea, the Tech Dirt article is suggests a bunch of nefarious stuff, but doesn't actually state anything unambiguously.
Esau 11y ago
Maybe we need to hold websites accountable for the ads that are served through them. Maybe once they are sued a few times, they will take this seriously.
vthallam 11y ago
Apart from this, i have given up on Forbes because they keep almost all content in multiple pages with no option to load in a single page(at least on mobile).
brokentone 11y ago
There needs to be a user-side ad validation layer, something that displays any ad that meets industry security, load time, and tracking standards.
JacobJans 11y ago
Google is largely responsible for the situation we're now in. As the largest provider of ads on the web, they regularly turn a blind eye to malware advertising served by their network. They simply do not take malware seriously. They continually let it exist on their ad network. As a publisher that uses Adsense I find this extremely frustrating. As example: I've spent quite a bit of time attempting to block ads that lead to the "ask.com toolbar." These are always deceptive. They confuse my visitors and then I hear about it. Additionally ads where the only text is "Download Now" or "Read Your Private Messages" are clearly deceptive. And yet they're allowed. There are so many easy ways Google could improve the situation. And yet, they don't. This is a serious problem, and it is only going to get worse until Google responds appropriately.
- morley 11y ago
  The problem isn't Google or DoubleClick; it's a structural problem with the ad industry. Most sites that serve ads can't sell all their inventory directly, so they fill their remaining impressions with ad networks, who sell bulk inventory space. Those ad networks have the same economic limitations from selling all their inventory, so they need to sell _their_ remaining impressions to another network. And so on down the line. All it takes is for one ad network to get a little loose with their serving policy for a malware provider to make an in. And I can't think of a way for an upstream ad network (or even DoubleClick) to ban malware, without tracking down that errant provider. You can't blacklist a domain, because usually the ad network hosts the ad itself. And like it or not, ads have to run Javascript or Flash. It's a crappy situation to be in, but it's not any one actor's fault (except for the malware advertiser), and the fix isn't easy or else someone would have thought of it.
  - coldpie 11y ago
    > And like it or not, ads have to run Javascript or Flash. They certainly don't need to run whatever arbitrary scripts the advertiser wants. The advertising network can provide whatever functionality the advertiser needs, there's no reason to leave this obvious hole open. The idea that I can pay someone some cash to put whatever arbitrary JS I want directly into Forbes's website is utterly ludicrous.
cjbprime 11y ago
https://twitter.com/wilkieii/status/684270238158958593 https://twitter.com/wilkieii/status/684270238158958593
mavdi 11y ago
Business opportunity: Browser extension that gets all the articles, post-processes to strip the ads and serves the content when user asks for the same article url. I'd pay $9.99 for it. If the publishers won't get on board a unified subscription service, let's just go around them.
- unimpressive 11y ago
  Pretty flagrant copyright violation. However something like this idea is what Brendan Eich is currently working on with Brave.
sysbot 11y ago
Lower your shields so we can fire our nuclear torpedos at you!
decals42 11y ago
This article is true, but it's from January. Why is it at the top of the heap now?
noahster11 11y ago
Simple fix: https://github.com/Mechazawa/FuckFuckAdblock https://github.com/Mechazawa/FuckFuckAdblock I don't know why more people use this. It simply blocks sites from taking you hostage
ArkyBeagle 11y ago
They're dead to me. Dead.
Overtonwindow 11y ago
If I really, really need to read an article on Forbes, I put the link in Pocket. Strips away all the advertising and everything.
justsaysmthng 11y ago
What bothers me in the ad blocker debate is that publishers want me to turn it off so I can see the ads. Not click on them, just see them. Even though I never click on any ads, they still consider it valuable to subliminally influence me into wanting stuff I don't want. To me, this is even shittier than forcing me to click on an ad before giving me the content. But to also serve me malware... is beyond shitty, it's dangerous. Content is cheap these days. There's too much of it out there, high quality and free. In fact, I wouldn't mind if there were less content produced on the Internet. I know that the content that is really valuable will still stay and all the bullshit that needs ads to stay afloat will disappear. Forbes with malware? No, thanks. For me the rule of thumb is this - if you need me to turn off my ad blocker, then I don't need your content.
Animats 11y ago
Why isn't this producing litigation? Users can sue Forbes. Forbes can sue their ad supplier. There's a strong argument for negligence here.
Magi604 11y ago
I'll just take this opportunity to plug the Forbes™ Splash Screen Bypass Chrome extension. It's not my extension, and I don't know the nitty gritty details of how it works, but I do know it stops that horrible Forbes splash screen from popping up.
guelo 11y ago
You don't want me as a reader and I don't want to read your ads, including the ad about turning off my ad blocker. But the search engine I use sent me to your site and it doesn't let me filter out sites with ads. I wish it did. Obviously Google is never going to do it since they're the ones selling ads. I had hopes for duckduckgo but they're showing more and more ads. What I'm saying is, we need a search engine that excludes sites with ads.
http-teapot 11y ago
I run both AdBlock and Ghostery. I experienced the same interstitial as every one, was particularly interested in the article headline, disabled AdBlock, reloaded the page, still blocked, disabled Ghostery, reload the page, worked. Ghostery disabled, it initially reported that about 60 trackers loaded in the page which then quickly turned to 97 to then reach more than 110 trackers. I highly recommend installing Ghostery. https://twitter.com/teapot/status/707016161234276352 https://twitter.com/teapot/status/707016161234276352 https://twitter.com/teapot/status/707016382286680066 https://twitter.com/teapot/status/707016382286680066
- danieldk 11y ago
  Why use a blocker by a company that sells user statistics?[1] Seriously wondering, since uBlock provides virtually the same and more. [1] https://en.wikipedia.org/wiki/Ghostery#Business_model https://en.wikipedia.org/wiki/Ghostery#Business_model
  - http-teapot 11y ago
    I'll give uBlock a try! I am aware of Ghostery's business model and I am not against businesses selling metrics and/or ads in general. I think there should be consequences for companies that do not have the best interests for the users.
spriggan3 11y ago
Between that and the pop ups that try to trick you into calling fake Windows customer services, why are they still asking themselves why people block ads?
joesmo 11y ago
How is this not a violation of the CFAA? Why isn't Forbes being held responsible and prosecuted? So if I go and access one file whose name is not public on Forbes' website, I'm looking at least at 5-10 years in jail but Forbes can infect millions and they get off scott free. The problem isn't ad blockers, the problem is the ad networks. They are criminal and should be held responsible. They should be shut down like any other spam network. They should be made to pay. And anyone who uses these criminal networks to infect computers is an accomplice and should be treated so. At the very least, the people who are anti ad blockers will hopefully shut the fuck up now because they're wrong and it's not a matter of opinion.
davesque 11y ago
Because it may not be obvious, this article is from early January. A number of different sites reported on these incidents back when they happened. Here are a few examples: http://www.engadget.com/2016/01/08/you-say-advertising-i-say-block-that-malware/ http://www.engadget.com/2016/01/08/you-say-advertising-i-say... http://www.extremetech.com/internet/220696-forbes-forces-readers-to-turn-off-ad-blockers-promptly-serves-malware http://www.extremetech.com/internet/220696-forbes-forces-rea... http://www.networkworld.com/article/3021113/security/forbes-malware-ad-blocker-advertisements.html http://www.networkworld.com/article/3021113/security/forbes-...
- shkkmo 11y ago
  And as xori points out, they are all examples of irresponsible clickbait journalism. https://news.ycombinator.com/item?id=11455718 https://news.ycombinator.com/item?id=11455718
- lowestkey 11y ago
  Was wondering if it was happening again or what the deal was. Just a months old article popping up again for some reason.
PhasmaFelis 11y ago
I saw the title and thought "What, again?" But the article is three months old; it's about the original incident.
hvoiiita 11y ago
I'm glad I stopped going to Forbes when they put up the adblock blocker
netman21 11y ago
I stopped writing my column on security for Forbes after they started to refuse entry based on Ad Blocker use.
tracker1 11y ago
I'm not sure why one of these big sites haven't been hit with a class action lawsuit... the website is responsible for the content it delivers... period. Especially when they force users to disable their ad blockers. It seems to me, that someone who got an $xxx ransomware, or paid the nerd herd to remove malware from their computers could be the base of a class action lawsuit... That's what it will take to get this crap to change is to actually hold one of these larger media sites responsible.
- ridgeguy 11y ago
  Agreed. If Forbes is serving malware to visitors who have complied with its instruction to turn off their adblockers, and if those visitors suffer damages due to malware served through Forbes, you'd think there's the basis for at least individual suits against Forbes, maybe class action. One argument is that Forbes has a duty of care and the ability to prevent serving damaging malware to its compliant invitees (visitors). They're in breach of that duty, so maybe damages for negligence?
perseusprime11 11y ago
I stopped visiting Forbes site. I will not turn off my Adblocker.
coreyp_1 11y ago
I have stopped going to Forbes at all for this very reason.
mamcx 11y ago
What is the reason a server-side solution is rarely used? What are the opportunities to develop such thing?
tripzilch 11y ago
Apart from the security aspects (and Forbes' responsibility therein), I'd like to say something about an argument I hear often in this context: That without payment via advertising, the "quality content"-writers won't have a reason to produce more quality content and it will dry up (or something; the actual consequences are often left to the imagination). Consider clickbait. Consider listicles, blogspam, the "you'll never guess X these celebrities Y", reposts of photos of cool-seeming-yet-utterly-impractical things to do with food/furniture/clothing/lifestyle/health/etc. At some point you probably helped clean out a friends' Windows laptop, tried to Google whether some process or application is useful or safe to remove--yeah those sites. I can't list all the types and categories, there's hundreds. The only reason trash like this even exists, the only way this unfathomable high-volume fire-hose of vapidity is made possible, is because of these advertising networks. This is what the vast majority of all those advertising dollars buys us. Who is more likely to stop producing content if advertising revenue disappears? The high-volume low-effort clickbait-linkspam writers, or the "quality content" writers that actually care about the things they write about? I'm convinced that if the online advertising industry were to collapse some day (I can hope, but I doubt it'll happen), it will be a net-positive for ALL the content online. Not just because an Internet without advertisement is just so much nicer, but also because the clickbait writers will be the first to stop producing "content", because unlike the quality writers that care, there will be exactly zero reason for them to continue producing informational landfill.
Mikho 11y ago
The other day on Forbes site I clicked political article title in "relevant articles" section just to be directed to penis enlargement web-site w/ popups & malware. Interestingly the political article was definitely relevant not to the article I read, but to my region. Checked back and found that this "relevant" section is actually some 3rd party content exchange widget that masks malware links under popular keywords and titles relevant to a reader region where all titles lead to a malware web-sites.

606 points by jackgavigan 11y ago

Blogspam of the story discussed in https://news.ycombinator.com/item?id=10870892 https://news.ycombinator.com/item?id=10870892

georgespencer 11y ago

My process 1. Click Forbes link 2. Get blank page where ad should be and "Continue to site" link 3. Click continue 4. Get request to turn off ad blocker 5. Laugh that I can't remember that Forbes blocks ad blockers 6. Google the headline 7. Read the story someplace else Hope that helps.

ZeroGravitas 11y ago
This seems like something that could be automated into a browser plugin.
- bduerst 11y ago
  Use a good news RSS feed to find similar articles. I think there are some that aggregate by story.
ikeboy 11y ago
Copying titles into archive.is works for forbes and wsj.
mmoche 11y ago
My favorite part of their anti-adblocker approach was when I actually disabled my blocker and ran into a hilarious "ad-light"[0] experience that was so ad-heavy I immediately gave up and found somewhere else to read an article. Countless "sponsored" article links, old-timey banner ads, and 75% of the visible page devoted to items other than content. [0]https://twitter.com/mmoche/status/710167616535531520 https://twitter.com/mmoche/status/710167616535531520
- pkfrank 11y ago
  I had an identical experience and reaction: https://twitter.com/PeterKimFrank/status/710164166636675072 https://twitter.com/PeterKimFrank/status/710164166636675072
XCSme 11y ago
Every time I reached the Forbes website I was really wondering if there is any option to hide a website from Google search results. So, I would like to never have any result from forbes.com (even if I search forbes). Do you know if there are Chrome Extensions or settings you can turn on in Google Search to hide certain websites?
- ValentineC 11y ago
  There's a Chrome extension (by Google, no less) for this! https://chrome.google.com/webstore/detail/personal-blocklist-by-goo/nolijncfnkgaikbjbdaogikpmpbdcdef?hl=en https://chrome.google.com/webstore/detail/personal-blocklist...
- deleted 11y ago
  [deleted]
- NathanKP 11y ago
  This is the official Google extension for doing that: https://chrome.google.com/webstore/detail/personal-blocklist-by-goo/nolijncfnkgaikbjbdaogikpmpbdcdef https://chrome.google.com/webstore/detail/personal-blocklist...
  - sosuke 11y ago
    Wow! Thank you very much I never thought of looking for an extension. For a very short time I found that feature in my search results directly. Then it just went away.
    - dunham 11y ago
      Yeah, Google did that for a short time. I used to use it to filter out content farms. They've gotten better at filtering content farms since then, and dropped the feature - probably because it was too expensive resource-wise to personalize results like that.
  - FilterSweep 11y ago
    Not sure if it's very functional. I blocked W3Schools + Wildcards (because I'd rather read MDN) and after a few months of working their results continued appearing at the top of my page. There are a few blog posts around the net where some users have tried similar and found that W3 schools was also serving up content from another place that had not been blocked.
cesarb 11y ago
My process 1. Open Forbes link in a new tab 2. Get redirected to completely blank page with only /welcome/ in the URL path 3. Temporarily enabling JavaScript for its domain and reloading won't help, since it lost the original URL and I don't remember where I got the link, so I don't even try 4. Give up and close the tab For most sites where JavaScript is required, temporarily enabling (uBlock origin advanced mode) and reloading is enough. Forbes is the only one I recall which completely loses the URL in the redirect.
- gorhill 11y ago
  If you are using uBlock Origin, Forbes' anti-blocker is bypassed with default settings.
ultramancool 11y ago
My process 1. Install https://github.com/reek/anti-adblock-killer https://github.com/reek/anti-adblock-killer 2. Laugh maniacally.
- TheLogothete 11y ago
  Why do you insist to consume content when the publisher tells you they don't want your visit if you don't want their ads?
  - ultramancool 11y ago
    Because I wanted to see the content? Is that what you're really asking? Am I supposed to feel some kind of moral obligation to see the ads just because they want me to, even if my browser is perfectly capable of blocking them? Sorry, but it's _my_ computer. I control it. Publishers don't get to decide what it does or does not do. I do.
    - kodablah 11y ago
      I think they mean: Why do you want to consume content from companies like that?
      - ultramancool 11y ago
        The quality of their publishing practice doesn't necessarily reflect the quality of the content.
    - manigandham 11y ago
      Moral obligation is the reason to not take/copy other things. This is the same as music/movie piracy. Basically you're doing it because you dont have the legal/physical repercussions of taking other things in life.
      - ultramancool 11y ago
jasonkostempski 11y ago
I really want a plug that will let me mark sites like Forbes and then decorate any links to it indicating I've already decided I don't want to go there. This way Forbes doesn't even get a +1 visit from me. I've had this thought several times over the last few months so last night I started work on a Chrome plugin that takes a regex pattern and css styles, finds the pattern in the markup and then applies the css to the first visible element containing the pattern. I'm hoping it will be useful for more than just reminding myself to not click links.
- colinbartlett 11y ago
  That would be useful but it almost sounds better to register the view of their landing page and then not register the view of their article. Surely they will see a widening gap over time?
- wrong_variable 11y ago
  start a github repo - maybe we can help ?
  - jasonkostempski 11y ago
    I will, sometime in the next week, hold me to it. I've actually got something working. So far I've got a hardcoded list of rules and styles and it works, even if the page content changes dynamically. I have to make all changes in code and manually reload the extension every time but it's not bad since I don't need to change things often.
- Nadya 11y ago
  >I really want a plug that will let me mark sites like Forbes and then decorate any links to it indicating I've already decided I don't want to go there. This way Forbes doesn't even get a +1 visit from me. Host file. forbes.com 127.0.0.1 At home I have a giant list of sites I've blocked for this. #Requests I turn off uBlock. Doing them the courtesy of not giving them any traffic instead.
  - 11y ago
Aelinsaar 11y ago
Works for me too, and I like to add 8.) Reflect for a moment on how much of human endeavor is wasted effort before it even began.
baldfat 11y ago
I use a text command line reader for news and I really have found it makes these things just go away :) I use w3m
Pxtl 11y ago
What cheeses me off is that I get blocked from many sites just for using FlashBlock. I'm not blocking all ads, I'm just using a "disable flash by default and enable manually if necessary".
- beagle3 11y ago
  Does that still happen? I remember this being the case years ago, but in the last 3, especially since Firefox went "click to flash", I haven't encountered this.
nashashmi 11y ago
I once disabled something in by adblocker that prevented Forbes from knowing I had an adblocker. Basically, you only allow that one adblocker detector to come through. Of course it is not like I remember what it was, but I don't have to bother with Forbes anymore.

untog 11y ago

IMO, this is the biggest issue facing ad providers today. I get the anti-ad blocker complaints - there are a lot of sites that depend entirely upon advertising revenue for their continued existence. And this isn't just crappy blogmills - even a company like the New York Times doesn't make enough money from subscriptions alone to continue operating without advertising of some sort. Maybe there's a different model out there but as far as I'm aware no-one has found it yet, and in the mean time I'm quite prepared to tolerate advertising on web sites in return for the content I get. I'll even tolerate a pre-roll ad or a full-screen takeover before I get to a page every now and then - but there's a line. The mild end of it (for me) is ads clearly intended to make you click by accident, and the severe end of it is malware like this. And in my experience it's on the rise. By all means implore your users to turn off their ad blockers. But clean house first and make sure you know what you're serving. The real problem is that it's borderline impossible for anyone to do so, given how many reseller networks exist out there these days. I often see people say that sites should arrange and sell their own advertising - but the reality is there's no money in it. Selling yourself out to the Google ad behemoth is often the only way out.

bduerst 11y ago
>Maybe there's a different model out there but as far as I'm aware no-one has found it yet You could try Google Contributor. It shows you pictures of cats instead of ads, and let's you give a couple pennies to the website. It's not 100% but it's something different.
- untog 11y ago
  I actually do. It works very well, but still involves loading a lot of JS on the page. Still, a lot better than anything else.
  - deleted 11y ago
    [deleted]
ArtDev 11y ago
Even Google ads contained malware recently.

tombert 11y ago

I remember thinking this was suspicious. I remember about three months ago I added a bunch of known malware sites to my hostfile so that I wouldn't give them traffic, and I couldn't get to Forbes. Funny, too, because I don't even use Ad-block.

slipstream- 11y ago

And that's why I use a nice helpful userscript that aims to work around these things: https://github.com/adsbypasser/adsbypasser https://github.com/adsbypasser/adsbypasser

coldpie 11y ago

I'm willing to compromise on web advertising, but not while this is possible. I don't understand why on Earth ad networks, and more importantly content publishers, allow arbitrary Javascript and Flash through their networks and onto their websites. You as a content publisher are not allowed to compromise your users' security, full stop. You are responsible for any compromises that come through your website. Until content publishers get that through their thick fucking skulls, I will continue to use an ad blocker and strongly recommend them to everyone I know. I would rather all ad-supported businesses fail than allow this malware to continue be distributed.

deleted 11y ago

[deleted]

joeblau 11y ago

I use Steven Blacks hosts script[1] and every time I see Forbes paywall, I just leave. If the article is that important, some other outlet will cover the news. [1] - https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts

peatmoss 11y ago
I knew about someonewhocares, but this is appears to aggregate that plus several others. Thank you for the tip!

SCAQTony 11y ago

Those sites that serve up malware scripts and call them ads, perhaps ad-blockers should rebrand and start calling themselves malware-blockers?

revelation 11y ago

Seems simple enough, sue Forbes.

kr0 11y ago

I block all ads globally. Until this "different model" becomes prevalent I'm not budging. The argument that there are websites that can't operate without ads is valid, but there is no websites that __actually__ need ads that would be willing to wall users of ad blockers. Sites like YouTube could never implement such a wall without significant loss of revenue.

delgaudm 11y ago

So far pi-hole[1] network based ad-blocker has proven to be the best use of the Raspberry Pi i bought and didn't know what to do with it. [1] https://pi-hole.net/ https://pi-hole.net/

andrepd 11y ago
Seems interesting. What is the performance/latency penalty?
- paulbennett 11y ago
  Performance seems fine (on a Pi 2). I am going to have to add some URLs to the whitelist though, as it has recently started affecting the ability to log into Xbox Live.

intrasight 11y ago

Forbes should just turn off that steaming pile of a web site. Either that or turn off all the ads since it is only damaging their reputation.

ArtDev 11y ago

This is why I use an adblocker blocker blocker (https://github.com/reek/anti-adblock-killer/ https://github.com/reek/anti-adblock-killer/).

dbcurtis 11y ago
Seems to me this functionality could be wrapped up in a web proxy. The proxy can pretend to allow all the ads, and simply drop them on the way to clients. Of course this doesn't deal with the issue of ads soaking up a bunch of bandwidth. I get tired of installing ad blockers on every machine/device in the house, and on some machines use multiple different browsers -- I'm suffering from blocker installation fatigue.
- ryandrake 11y ago
  > I get tired of installing ad blockers on every machine/device in the house, and on some machines use multiple different browsers -- I'm suffering from blocker installation fatigue. If you run dnsmasq, you can block [1] a lot of ads for your entire house at once through DNS. 1: https://www.debian-administration.org/article/535/Blocking_ad_servers_with_dnsmasq https://www.debian-administration.org/article/535/Blocking_a...
  - w-ll 11y ago
    There's also Pi Hole, which you setup on a raspberry pi. Which is nice because you can leave it on all day. Where as at night when I shut down my desktop but might be using my phone or a tablet. https://pi-hole.net/ https://pi-hole.net/
    - itslennysfault 11y ago
      This looks awesome, but is there a way to bypass this from the browser? Occasionally, I give in and disable ad block if I really want to see something.
  - dbcurtis 11y ago

oli5679 11y ago

Yesterday I tried to read a Forbes article on my mobile. It presented me with the banner asking me to turn ad-blocker off (which I haven't installed). I reloaded the page and was faced with pop-ups claiming I had won free Amazon products.

coldpie 11y ago
If you're interested in mobile ad blocking (if you're concerned about the security of your mobile device, you should be), uBlock Origin works very well in Firefox for Android. I strongly recommend you install it before your device is compromised.
- danieldk 11y ago
  Or on iOS Purify, which was made by the developer of uBlock, Chris Aljoudi: https://www.purify-app.com/ https://www.purify-app.com/

hashkb 11y ago

Wasn't there a report like this about Forbes and malware a few months ago? Have they responded in press? (Hopefully on Medium so I can read it.)

coldpie 11y ago
As far as I've seen, content publishers' response to being caught distributing malware is to say "It's the ad network's fault! We'll work with them to clean it up." They never name the ad network and no changes will be implemented. The only way to protect yourself is to install an ad blocker.
- lostgame 11y ago
  Or not use the site. :P
- logfromblammo 11y ago
  C: Excuse me? Are you the produce manager? M: Yes, that's me. C: Oh, good. Yesterday, I bought a banana here. When I got it home, I discovered there was a bomb in it. M: I'm only the produce manager. I don't deal with bombs. C: But the bomb was *in* the banana. M: How was it? C: How was what? M: The banana. Not bruised or overripe or anything? C: No, the banana was fine. It was a perfectly normal banana. ...with a bomb in it. M: Ah, good. Another satisfied customer. C: I am *not* satisfied! I could have been killed! M: Were you? C: Obviously not! M: So what's the problem? C: There was a bomb in my banana! M: Well, we just sell the bananas as we get them, from the banana-modifying company. C: Why can't you just get your bananas direct from the plantation? Why can't I get an unaltered, unmodified banana--without any bombs in it? M: Excuse me, sir or madam, but this is a *business*. How do you expect us to pay our employees with a store full of unmodified bananas? C: [facepalm]
davesque 11y ago
I think this is reporting on the same incident. The comments on the article are dated from early January.

ihsw 11y ago

So what's wrong with image-only ads? Why do we have to let advertisers inject their own JS into a web page?

vlunkr 11y ago

Forbes is truly terrible at this. I tried to read something there, had to disable my ad blocker and ghostery. After refreshing, ghostery counted 40+ trackers on the site. https://www.ghostery.com/ https://www.ghostery.com/ - I recommend it

forrestthewoods 11y ago

This is why I block all ads, all the time. No exception. There are no "good" ads.

bitJericho 11y ago
Same. Ads aren't good for anybody's health.

K0nserv 11y ago

My $0.02 Publishers should look to Stack Overflow and be inspired to run ads of high quality and relevance[0]. Throw out the ad networks, tracking, and reject rich media ads. Instead focus on high value ads that align well with your readership and manually verify the quality of these ads. If publishers do this I am willing to turn of my ad blocker. 0: https://blog.stackoverflow.com/2016/02/why-stack-overflow-doesnt-care-about-ad-blockers/ https://blog.stackoverflow.com/2016/02/why-stack-overflow-do...

ktRolster 11y ago
Publishers want to make more money than Stack Overflow. That's basically why.

chris_wot 11y ago

You know, this is why my dad's computer is riddled with malware every single time I go over to his place. No new apps were installed, he doesn't even know how. But he does browse the web. First thing I'm doing when I get over there is install the most restrictive ad blocker I can find.

crablar 11y ago

Forbes is dealing with ad networks that aren't trustworthy. The ad networks that are most profitable are going to have some terrible deal flow that includes malware and viruses.

brianbreslin 11y ago

If Forbes set a minimum price for their ad backfill inventory (the shitty ad inventory they fill with low quality ads), could it economically not make sense to the networks to fill that space with malware ads?

DanielDent 11y ago
Unfortunately I think you have it backwards. Malware ads are being displayed because they are winning the auctions. That's because - on a CPM basis - malware authors are probably the ones who will always be able to pay the most. A successfully infected machine is worth a good chunk of change. Ad networks are uniquely suited to malware delivery. Have an exploit which only works for OS X users? Don't bid on the windows users.

nyolfen 11y ago

if you're interested in escalating the adblock arms race, i've been using IsraBlock[0][1] and it seems to work well [0] https://chrome.google.com/webstore/detail/israblock/kekndmaoonpjhjhobkcegfaaikgnccbo?hl=en https://chrome.google.com/webstore/detail/israblock/kekndmao... [1] https://addons.mozilla.org/en-US/firefox/addon/israblock/?src=cb-dl-recentlyadded https://addons.mozilla.org/en-US/firefox/addon/israblock/?sr...

chinathrow 11y ago

Sue them, file a class action and I am sure, they will learn.

deleted 11y ago
[deleted]

fightfortheuser 11y ago

And that's why I never go to forbes anymore. It's a bad user experience. Now they can add greedy and not secure to the list.

takno 11y ago
Treat yourself and switch to never going there for the indifferent to poor quality of the content. Whenever I hit the adwall I'm just grateful for the reminder that I don't have to waste my time on that

barretts 11y ago

Forbes' "Please turn off your adblocker" interstitial is a great reminder not to read Forbes' clickbait bullshit pseudo-journalism.

shkkmo 11y ago
as opposed to this article's clickbait bullshit pseudo-journalism? https://news.ycombinator.com/item?id=11455718 https://news.ycombinator.com/item?id=11455718

tmaly 11y ago

I noticed there are a lot more sites that can detect Ad Blockers. They hassle you about disabling the blocker. Why not just make the ad inline into the content of the page. It would speed up the site as you would not have to make all the extra connections to these ad networks via thirdparty javascript.

flying_kangaroo 11y ago
Ad networks don't want to trust publishers to accurately report page hits with inline images, they also would presumably like to be able to track users and serve up "tailored" ads, which they can't really do if they don't get any information on the user before serving the ad.

jordigh 11y ago

Wow, the language, "hold their content hostage". I hate ads probably more than most[1], but still, if Forbes doesn't want to give up their articles without fair compensation, that's their prerogative. They're not taking hostages. -- [1] https://news.ycombinator.com/item?id=10939083 https://news.ycombinator.com/item?id=10939083

lostgame 11y ago
Uh...'fair compensation' is not installing malware. I don't think that's ever fair.
- jordigh 11y ago
  I didn't say it was. I thought that was implied when I said I hated ads. But the language of holding your own writings "hostage" because you don't want to give them up without some kind of compensation is just absurd. I wish Forbes just was honest and went full paywall. I wish everyone did this.

xori 11y ago

Pretty sure they didn't actually serve malware and that news sites just made the click-bait title for clicks. http://www.ghettoforensics.com/2016/03/of-malware-and-adware-why-forbes-was.html#more http://www.ghettoforensics.com/2016/03/of-malware-and-adware...

shkkmo 11y ago
I understand everyone's frustration around this issue, I hate site that block adblocker users as well. However, this article is an example of unethical journalism. TL;DR Article says "Well, how about they start treating their ad inventory with at least a percentage of the care with which they treat their content?" The researcher who discovered the issue says "Forbes almost immediately reached out and we started a dialog. We shared logs, events, and descriptions of the ad." In contrast, when the researcher reached out the correct the Engadget article that started this and quoted him, he got no response.
jessriedel 11y ago
Yea, the Tech Dirt article is suggests a bunch of nefarious stuff, but doesn't actually state anything unambiguously.

Esau 11y ago

Maybe we need to hold websites accountable for the ads that are served through them. Maybe once they are sued a few times, they will take this seriously.

vthallam 11y ago

Apart from this, i have given up on Forbes because they keep almost all content in multiple pages with no option to load in a single page(at least on mobile).

brokentone 11y ago

There needs to be a user-side ad validation layer, something that displays any ad that meets industry security, load time, and tracking standards.

JacobJans 11y ago

Google is largely responsible for the situation we're now in. As the largest provider of ads on the web, they regularly turn a blind eye to malware advertising served by their network. They simply do not take malware seriously. They continually let it exist on their ad network. As a publisher that uses Adsense I find this extremely frustrating. As example: I've spent quite a bit of time attempting to block ads that lead to the "ask.com toolbar." These are always deceptive. They confuse my visitors and then I hear about it. Additionally ads where the only text is "Download Now" or "Read Your Private Messages" are clearly deceptive. And yet they're allowed. There are so many easy ways Google could improve the situation. And yet, they don't. This is a serious problem, and it is only going to get worse until Google responds appropriately.

morley 11y ago
The problem isn't Google or DoubleClick; it's a structural problem with the ad industry. Most sites that serve ads can't sell all their inventory directly, so they fill their remaining impressions with ad networks, who sell bulk inventory space. Those ad networks have the same economic limitations from selling all their inventory, so they need to sell _their_ remaining impressions to another network. And so on down the line. All it takes is for one ad network to get a little loose with their serving policy for a malware provider to make an in. And I can't think of a way for an upstream ad network (or even DoubleClick) to ban malware, without tracking down that errant provider. You can't blacklist a domain, because usually the ad network hosts the ad itself. And like it or not, ads have to run Javascript or Flash. It's a crappy situation to be in, but it's not any one actor's fault (except for the malware advertiser), and the fix isn't easy or else someone would have thought of it.
- coldpie 11y ago
  > And like it or not, ads have to run Javascript or Flash. They certainly don't need to run whatever arbitrary scripts the advertiser wants. The advertising network can provide whatever functionality the advertiser needs, there's no reason to leave this obvious hole open. The idea that I can pay someone some cash to put whatever arbitrary JS I want directly into Forbes's website is utterly ludicrous.

cjbprime 11y ago

https://twitter.com/wilkieii/status/684270238158958593 https://twitter.com/wilkieii/status/684270238158958593

mavdi 11y ago

Business opportunity: Browser extension that gets all the articles, post-processes to strip the ads and serves the content when user asks for the same article url. I'd pay $9.99 for it. If the publishers won't get on board a unified subscription service, let's just go around them.

unimpressive 11y ago
Pretty flagrant copyright violation. However something like this idea is what Brendan Eich is currently working on with Brave.

sysbot 11y ago

Lower your shields so we can fire our nuclear torpedos at you!

decals42 11y ago

This article is true, but it's from January. Why is it at the top of the heap now?

noahster11 11y ago

Simple fix: https://github.com/Mechazawa/FuckFuckAdblock https://github.com/Mechazawa/FuckFuckAdblock I don't know why more people use this. It simply blocks sites from taking you hostage

ArkyBeagle 11y ago

They're dead to me. Dead.

Overtonwindow 11y ago

If I really, really need to read an article on Forbes, I put the link in Pocket. Strips away all the advertising and everything.

justsaysmthng 11y ago

What bothers me in the ad blocker debate is that publishers want me to turn it off so I can see the ads. Not click on them, just see them. Even though I never click on any ads, they still consider it valuable to subliminally influence me into wanting stuff I don't want. To me, this is even shittier than forcing me to click on an ad before giving me the content. But to also serve me malware... is beyond shitty, it's dangerous. Content is cheap these days. There's too much of it out there, high quality and free. In fact, I wouldn't mind if there were less content produced on the Internet. I know that the content that is really valuable will still stay and all the bullshit that needs ads to stay afloat will disappear. Forbes with malware? No, thanks. For me the rule of thumb is this - if you need me to turn off my ad blocker, then I don't need your content.

Animats 11y ago

Why isn't this producing litigation? Users can sue Forbes. Forbes can sue their ad supplier. There's a strong argument for negligence here.

Magi604 11y ago

I'll just take this opportunity to plug the Forbes™ Splash Screen Bypass Chrome extension. It's not my extension, and I don't know the nitty gritty details of how it works, but I do know it stops that horrible Forbes splash screen from popping up.

guelo 11y ago

You don't want me as a reader and I don't want to read your ads, including the ad about turning off my ad blocker. But the search engine I use sent me to your site and it doesn't let me filter out sites with ads. I wish it did. Obviously Google is never going to do it since they're the ones selling ads. I had hopes for duckduckgo but they're showing more and more ads. What I'm saying is, we need a search engine that excludes sites with ads.

http-teapot 11y ago

I run both AdBlock and Ghostery. I experienced the same interstitial as every one, was particularly interested in the article headline, disabled AdBlock, reloaded the page, still blocked, disabled Ghostery, reload the page, worked. Ghostery disabled, it initially reported that about 60 trackers loaded in the page which then quickly turned to 97 to then reach more than 110 trackers. I highly recommend installing Ghostery. https://twitter.com/teapot/status/707016161234276352 https://twitter.com/teapot/status/707016161234276352 https://twitter.com/teapot/status/707016382286680066 https://twitter.com/teapot/status/707016382286680066

danieldk 11y ago
Why use a blocker by a company that sells user statistics?[1] Seriously wondering, since uBlock provides virtually the same and more. [1] https://en.wikipedia.org/wiki/Ghostery#Business_model https://en.wikipedia.org/wiki/Ghostery#Business_model
- http-teapot 11y ago
  I'll give uBlock a try! I am aware of Ghostery's business model and I am not against businesses selling metrics and/or ads in general. I think there should be consequences for companies that do not have the best interests for the users.

spriggan3 11y ago

Between that and the pop ups that try to trick you into calling fake Windows customer services, why are they still asking themselves why people block ads?

joesmo 11y ago

How is this not a violation of the CFAA? Why isn't Forbes being held responsible and prosecuted? So if I go and access one file whose name is not public on Forbes' website, I'm looking at least at 5-10 years in jail but Forbes can infect millions and they get off scott free. The problem isn't ad blockers, the problem is the ad networks. They are criminal and should be held responsible. They should be shut down like any other spam network. They should be made to pay. And anyone who uses these criminal networks to infect computers is an accomplice and should be treated so. At the very least, the people who are anti ad blockers will hopefully shut the fuck up now because they're wrong and it's not a matter of opinion.

davesque 11y ago

Because it may not be obvious, this article is from early January. A number of different sites reported on these incidents back when they happened. Here are a few examples: http://www.engadget.com/2016/01/08/you-say-advertising-i-say-block-that-malware/ http://www.engadget.com/2016/01/08/you-say-advertising-i-say... http://www.extremetech.com/internet/220696-forbes-forces-readers-to-turn-off-ad-blockers-promptly-serves-malware http://www.extremetech.com/internet/220696-forbes-forces-rea... http://www.networkworld.com/article/3021113/security/forbes-malware-ad-blocker-advertisements.html http://www.networkworld.com/article/3021113/security/forbes-...

shkkmo 11y ago
And as xori points out, they are all examples of irresponsible clickbait journalism. https://news.ycombinator.com/item?id=11455718 https://news.ycombinator.com/item?id=11455718
lowestkey 11y ago
Was wondering if it was happening again or what the deal was. Just a months old article popping up again for some reason.

PhasmaFelis 11y ago

I saw the title and thought "What, again?" But the article is three months old; it's about the original incident.

hvoiiita 11y ago

I'm glad I stopped going to Forbes when they put up the adblock blocker

netman21 11y ago

I stopped writing my column on security for Forbes after they started to refuse entry based on Ad Blocker use.

tracker1 11y ago

I'm not sure why one of these big sites haven't been hit with a class action lawsuit... the website is responsible for the content it delivers... period. Especially when they force users to disable their ad blockers. It seems to me, that someone who got an $xxx ransomware, or paid the nerd herd to remove malware from their computers could be the base of a class action lawsuit... That's what it will take to get this crap to change is to actually hold one of these larger media sites responsible.

ridgeguy 11y ago
Agreed. If Forbes is serving malware to visitors who have complied with its instruction to turn off their adblockers, and if those visitors suffer damages due to malware served through Forbes, you'd think there's the basis for at least individual suits against Forbes, maybe class action. One argument is that Forbes has a duty of care and the ability to prevent serving damaging malware to its compliant invitees (visitors). They're in breach of that duty, so maybe damages for negligence?

perseusprime11 11y ago

I stopped visiting Forbes site. I will not turn off my Adblocker.

coreyp_1 11y ago

I have stopped going to Forbes at all for this very reason.

mamcx 11y ago

What is the reason a server-side solution is rarely used? What are the opportunities to develop such thing?

tripzilch 11y ago

Apart from the security aspects (and Forbes' responsibility therein), I'd like to say something about an argument I hear often in this context: That without payment via advertising, the "quality content"-writers won't have a reason to produce more quality content and it will dry up (or something; the actual consequences are often left to the imagination). Consider clickbait. Consider listicles, blogspam, the "you'll never guess X these celebrities Y", reposts of photos of cool-seeming-yet-utterly-impractical things to do with food/furniture/clothing/lifestyle/health/etc. At some point you probably helped clean out a friends' Windows laptop, tried to Google whether some process or application is useful or safe to remove--yeah those sites. I can't list all the types and categories, there's hundreds. The only reason trash like this even exists, the only way this unfathomable high-volume fire-hose of vapidity is made possible, is because of these advertising networks. This is what the vast majority of all those advertising dollars buys us. Who is more likely to stop producing content if advertising revenue disappears? The high-volume low-effort clickbait-linkspam writers, or the "quality content" writers that actually care about the things they write about? I'm convinced that if the online advertising industry were to collapse some day (I can hope, but I doubt it'll happen), it will be a net-positive for ALL the content online. Not just because an Internet without advertisement is just so much nicer, but also because the clickbait writers will be the first to stop producing "content", because unlike the quality writers that care, there will be exactly zero reason for them to continue producing informational landfill.

Mikho 11y ago

The other day on Forbes site I clicked political article title in "relevant articles" section just to be directed to penis enlargement web-site w/ popups & malware. Interestingly the political article was definitely relevant not to the article I read, but to my region. Checked back and found that this "relevant" section is actually some 3rd party content exchange widget that masks malware links under popular keywords and titles relevant to a reader region where all titles lead to a malware web-sites.