11 ms·

Of course they are malicious. They're serving the high-profit ads, which obviously includes malware, where they could be serving low-profit, safe (but boring) a

by tomp 11y ago

Of course they are malicious. They're serving the high-profit ads, which obviously includes malware, where they could be serving low-profit, safe (but boring) ads. That's equivalent to pharmacists selling illegal drugs (heroin, cocaine) simply because they obviously make them more profits.

cstross 11y ago
There's a subtle difference: pharmacists are regulated by statute and are legally liable if medication they dispense on prescription causes injury. (Source: I used to be a pharmacist -- in the UK, > 25 years ago, precise regulations vary by jurisdiction.) Ad networks are utterly unregulated. In terms of this pharmacy metaphor they're snake-oil salesmen.
- Retric 11y ago
  All industry's are regulated. The general case is normal laws. Ad networks serving links to compromised websites is likely already illegal.
  - cstross 11y ago
    I'm talking about professional registration (exams, licenses to practice, supervisory body, jail sentences for impersonation, forefeiture of registration for ethics infractions), not bog-standard trade law.
    - Retric 11y ago
      In the case of Ad networks serving up malware I don't know if that's a real defense. Yes, proactive regulation is often far more effective, but reactive regulation can often catch the worst offenders.
econnors 11y ago
It's not that simple. At any one time, a publisher can be serving ads from a few exchanges, a few different private sellers, and custom built ads for brands. And these all are served in different combinations across several different ad units on multiple pages. And some of those ad sellers may be backfilling with other ad networks, or maybe the publisher is backfilling certain ads from the ad exchanges at certain CPM prices. I'd liken it more to a hardware product being shipped with faulty materials when multiple manufacturers are involved and it's extremely difficult to identify the responsible party. Sure, they're responsible for the end product, but it's not so black and white.
- newjersey 11y ago
  Whatever the combination, I'll blame the site I visit. I've seen bad ads on imgur one time I used the Internet without blocking ads. The ad just started downloading "Firefox patch" without me clicking anything. It is not black and white but it is pretty close. Edit: I have to give Firefox credit here. It actually just prompted me whether I'd like to save the file. I did and uploaded it to virus total. Probably not a good idea if you do anything sensitive on your computer.
- belorn 11y ago
  Your description doesn't show why a pharmacist selling illegal drugs is dissimilar to a website selling ad space to illegal ad-space buyers. Any time where you've got multiple producers and multiple retailers, you get middle people like those you describe that must juggle demand and supply. Pharmacists have an equally complex path from producer to customer as ads have from ad-space buyer to website visitor. However, let's instead look at the chain of events: An innocent gets malware from an advertisement. The publisher blames the ad-network who in turn blames the criminal. The ad-network claims that they can't curate the advertisements or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime. An innocent gets mistreated by a fake doctor. The hospital blames the hiring agency, who in turn blames the criminal. The hiring agency claims that they can't do background checks and verify CVs of applicants or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime? Why is there such discrepancy between the two cases? Why can one agency do curation and still function, while the other can't? Why can the publisher get away with using a bad ad-network while a hospital is fully legally responsible for using a bad hiring agency? Those seem to be very simple questions, ones that should have very simple answers.
  - toyg 11y ago
    > Why can the publisher get away [...] while a hospital is fully legally responsible The word "legally" gives it away: because there are laws. But we don't like dem laws here on teh intertubes, so far-west it is.
    - 11y ago
CiPHPerCoder 11y ago
In this case, high-profit ads include dynamic content (JavaScript or Flash). Safe (but boring) ads would simply be an image or text link with no tracking capabilities that doesn't use CSS hacks to interrupt your page reading. It just sits up there saying, "If you want it, check this out."
- colejohnson66 11y ago
  I can honestly say that I've clicked on quite a few static ads with the intention of learning more. Dynamic ads, however, I refuse to click.
  - CiPHPerCoder 11y ago
    Same, and in a few cases I didn't realize they were ads because they were so non-intrusive.
- puddintane 11y ago
  Tracking still happens with "safe" ads. Generally "image pixels" as they call em are actually server side scripts that then pretend to be an image that way they can still track the users IP and what they were doing at that point in time.
  - CiPHPerCoder 11y ago
    That data is already sent to the server. This doesn't give the server control over the user's hardware.
- wlesieutre 11y ago
  Javascript and Flash ads are the more immediately dangerous ads, but you can still distribute malware over image and text links. You just move from exploiting browser vulnerabilities to exploiting user trust, like all of the imitation VLC download pages that have popped up over the years. We'd be better off with only static image/text ads, yes, but malware distribution by means of poorly vetted advertising wouldn't totally vanish.
FussyZeus 11y ago
I don't think most ad networks are intentionally serving ads like that. Occam's razor, etc. Doesn't make them less culpable for the damage they cause, I'm just saying I don't think it's something they make additional money on, I think it's something that gets slipped under the radar by a few bad actors. They obviously aren't incentivized enough to stop it though so why not implement a more direct compensation? If a user gets a malware program on their machine and it can be traced back to a given provider, that provider should be billed accordingly for the cost of the removal (including if the user can do it themselves, they should get paid for that anyway) as well as lost productivity time. Currently any ad network serving malware just gets to ¯\_(ツ)_/¯ and keep on making money, and considering how damaging some of this shit can be I'd say that's the first point that needs addressing.
eyeinthepyramid 11y ago
You've clearly never worked with ad networks. Even Google serves up malicious ads every once in a while.
- riskable 11y ago
  There's a difference between merely malicious ads ("Click here for free stuff!"->takes you to a site that exploits your browser) and ads that actively exploit the browser. Any ad network can fall victim to malicious ads but only ad networks that allow embedded scripts can be abused to actively exploit browsers. The solution is dead simple: Don't allow embedded scripts in ads. Period. End of story. Problem no longer a problem. "We're all done here."

by tomp 11y ago

cstross 11y ago

There's a subtle difference: pharmacists are regulated by statute and are legally liable if medication they dispense on prescription causes injury. (Source: I used to be a pharmacist -- in the UK, > 25 years ago, precise regulations vary by jurisdiction.) Ad networks are utterly unregulated. In terms of this pharmacy metaphor they're snake-oil salesmen.

Retric 11y ago
All industry's are regulated. The general case is normal laws. Ad networks serving links to compromised websites is likely already illegal.
- cstross 11y ago
  I'm talking about professional registration (exams, licenses to practice, supervisory body, jail sentences for impersonation, forefeiture of registration for ethics infractions), not bog-standard trade law.
  - Retric 11y ago
    In the case of Ad networks serving up malware I don't know if that's a real defense. Yes, proactive regulation is often far more effective, but reactive regulation can often catch the worst offenders.

econnors 11y ago

It's not that simple. At any one time, a publisher can be serving ads from a few exchanges, a few different private sellers, and custom built ads for brands. And these all are served in different combinations across several different ad units on multiple pages. And some of those ad sellers may be backfilling with other ad networks, or maybe the publisher is backfilling certain ads from the ad exchanges at certain CPM prices. I'd liken it more to a hardware product being shipped with faulty materials when multiple manufacturers are involved and it's extremely difficult to identify the responsible party. Sure, they're responsible for the end product, but it's not so black and white.

newjersey 11y ago
Whatever the combination, I'll blame the site I visit. I've seen bad ads on imgur one time I used the Internet without blocking ads. The ad just started downloading "Firefox patch" without me clicking anything. It is not black and white but it is pretty close. Edit: I have to give Firefox credit here. It actually just prompted me whether I'd like to save the file. I did and uploaded it to virus total. Probably not a good idea if you do anything sensitive on your computer.
belorn 11y ago
Your description doesn't show why a pharmacist selling illegal drugs is dissimilar to a website selling ad space to illegal ad-space buyers. Any time where you've got multiple producers and multiple retailers, you get middle people like those you describe that must juggle demand and supply. Pharmacists have an equally complex path from producer to customer as ads have from ad-space buyer to website visitor. However, let's instead look at the chain of events: An innocent gets malware from an advertisement. The publisher blames the ad-network who in turn blames the criminal. The ad-network claims that they can't curate the advertisements or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime. An innocent gets mistreated by a fake doctor. The hospital blames the hiring agency, who in turn blames the criminal. The hiring agency claims that they can't do background checks and verify CVs of applicants or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime? Why is there such discrepancy between the two cases? Why can one agency do curation and still function, while the other can't? Why can the publisher get away with using a bad ad-network while a hospital is fully legally responsible for using a bad hiring agency? Those seem to be very simple questions, ones that should have very simple answers.
- toyg 11y ago
  > Why can the publisher get away [...] while a hospital is fully legally responsible The word "legally" gives it away: because there are laws. But we don't like dem laws here on teh intertubes, so far-west it is.
  - 11y ago

CiPHPerCoder 11y ago

In this case, high-profit ads include dynamic content (JavaScript or Flash). Safe (but boring) ads would simply be an image or text link with no tracking capabilities that doesn't use CSS hacks to interrupt your page reading. It just sits up there saying, "If you want it, check this out."

colejohnson66 11y ago
I can honestly say that I've clicked on quite a few static ads with the intention of learning more. Dynamic ads, however, I refuse to click.
- CiPHPerCoder 11y ago
  Same, and in a few cases I didn't realize they were ads because they were so non-intrusive.
puddintane 11y ago
Tracking still happens with "safe" ads. Generally "image pixels" as they call em are actually server side scripts that then pretend to be an image that way they can still track the users IP and what they were doing at that point in time.
- CiPHPerCoder 11y ago
  That data is already sent to the server. This doesn't give the server control over the user's hardware.
wlesieutre 11y ago
Javascript and Flash ads are the more immediately dangerous ads, but you can still distribute malware over image and text links. You just move from exploiting browser vulnerabilities to exploiting user trust, like all of the imitation VLC download pages that have popped up over the years. We'd be better off with only static image/text ads, yes, but malware distribution by means of poorly vetted advertising wouldn't totally vanish.

FussyZeus 11y ago

I don't think most ad networks are intentionally serving ads like that. Occam's razor, etc. Doesn't make them less culpable for the damage they cause, I'm just saying I don't think it's something they make additional money on, I think it's something that gets slipped under the radar by a few bad actors. They obviously aren't incentivized enough to stop it though so why not implement a more direct compensation? If a user gets a malware program on their machine and it can be traced back to a given provider, that provider should be billed accordingly for the cost of the removal (including if the user can do it themselves, they should get paid for that anyway) as well as lost productivity time. Currently any ad network serving malware just gets to ¯\_(ツ)_/¯ and keep on making money, and considering how damaging some of this shit can be I'd say that's the first point that needs addressing.

eyeinthepyramid 11y ago

You've clearly never worked with ad networks. Even Google serves up malicious ads every once in a while.

riskable 11y ago
There's a difference between merely malicious ads ("Click here for free stuff!"->takes you to a site that exploits your browser) and ads that actively exploit the browser. Any ad network can fall victim to malicious ads but only ad networks that allow embedded scripts can be abused to actively exploit browsers. The solution is dead simple: Don't allow embedded scripts in ads. Period. End of story. Problem no longer a problem. "We're all done here."