9 ms·

What media companies don’t want you to know about ad blockers

119 points by CaptainZapp 10y ago

anilgulecha 10y ago
Yes, ads are too big a vector for malware to ignore, so turning on ad-blocking is non-negotiable. That being given, the only alternative for NYT and friends is for subscription which they don't have the taste for, since it gives them the true value of their journalism. The difference in this true value, and older ad-based value: their take from the revenue-sharing agreement with malware-creators. We just got better with dealing with malware, and their malware based revenue took a hit.
Puts 10y ago
It's strange that the most simple and elegant solution to ad-blocking, self hosted ads are not considered by anyone. Magazines and papers have always done this in print. Yes there is overhead, because you have to handle the content manually and it's hard, even tough not impossible to measure impressions. But with print it's always been this way and now the media industry wants to both have the cake and eat it, because they don't want to handle ads but they want the revenue. And maybe I should clarify, how does self-hosted ads solve the problem? - It's hard to block ads on the same domain as the main content. - Just loading an image with an ad is not as much of an performance hit as javascript loaded tracking ads and thus should not annoy users as much. - More secure, because you can not hack one single ad service and distribute mallware to thousands of sites. Besides, the solution is less complex, and complexity always leads to bad security.
- chx 10y ago
  Ah, my naive friend. How can an advertiser know it's not being shortcharged? Having a "neutral" third party helps here.
  - distances 10y ago
    The same way it works with newspapers, I'd say. Check that it is there when you expect it to be there.
    - danielhughes 10y ago
      Even with newspapers advertisers don't simply accept the circulation numbers that the publishers report. They pay third parties to provide independent numbers. It's not just about whether the ad appears but rather knowing how many people saw it.
      - hawski 10y ago
        So maybe there could be 3rd party company to check such things. Also ads could be sold at auction. I.e. auction for 24h display of ad in header from $1 on some news site.
        cmdrfred 10y ago
        Actually that's not a bad idea. Why not hit the site that the ad's are reportedly on from some IP addresses unknown to the ad provider. Do this over and over again until you have enough data to assume that say 1/5th of impressions are you then compare that to a neutral 3rd party source (Google Analytics comes to mind) of the total hits for that day. 5000 hits / 1/5 of those are impressions of your ad = 1000 impressions. Compare this to the numbers provided by the ad provider itself. All you'd need to do is spot check and it should keep everyone honest. I'm surprised people don't do this already.
  - syshum 10y ago
    Independent Auditing happens in all kinds of industries and for all kinds of reasons There is no reason a neutral 3rd party can not review logs, software, or other data to ensure in house ad metrics are accurate.
  - AznHisoka 10y ago
    Advertisers can track clicks very easily on their own via google analytics and other platforms. What's so hard about that?
    - a_small_island 10y ago
      Because if it's CPM, then you're paying for users on the publisher who simply view it.
  - hammock 10y ago
    Advertisers have not cared much to date. For example the amount of money they pour into Facebook ads despite massive click fraud.
  - anoctopus 10y ago
    They could always use a platform that is pay-per-action, so that you aren't paying unless people actually buy things. (I work on the ad systems team of an affiliate marketing company, where essentially all advertisement contracts are done on a PPA basis, rather than PPC)
- mjevans 10y ago
  Ads really need to be put on a diet. * Either a /static/ image or colored text * Normalized (re-packed, stripped of all other data, etc) * Vetted by a human somewhere to not be 'misleading in appearance' (not checking facts, but making sure that it doesn't look like a download button or anything else not obviously an ad) * Based on the content of the context and nothing else (you can bake them statically based on the story and/or comments thread on the page)
  - Puts 10y ago
    Yes, the vetting part is also important. As it is now renowned newspapers are serving ads that are border fraudulent, and I don't really understand how they are putting their reputation at risk this way by letting third parties publish non-vetted content on their site.
    - huehehue 10y ago
      I'm wondering when the Google Play Store wild west era will end. I've seen numerous apps containing ads with text (e.g. "Install Candy Crash!") laid over borderline pornographic images that have nothing to do with the advertised service. I guess it catches the eye? I don't think shifting responsibility to publishers is the answer. A half-serious idea would be to have a neutral regulatory body issue "licenses to advertise" but how long until corporate interests took that over?
    - jerf 10y ago
      "I don't really understand how they are putting their reputation at risk this way by letting third parties publish non-vetted content on their site." I read it as a measure of their financial desperation. They're eating their seed corn (their reputation is their most valuable asset in that without that, what else do they have?), and, well, what other choice do they have? HN has been talking about the other choices for years, but every time I see someone try one, they sink.
- madshiva 10y ago
  I agree it's a very good idea. This would also promote more local ads than big commercial ads. At the end, I know they need to get money but ads don't serve any purpose. I mean I never buy product from ad, I have only things that suite what I have search 10 minute ago. Why putting ads for that? I already know the product and this will never push me to buy something.
  - developer2 10y ago
    Try telling this to anyone in the ad marketing business. They'll claim their tactics are extremely effective. Regarding "I never buy product from ad", they'll tell you "yes you do, we're manipulating your subconscious and you don't even know it's working!". Really, they're mostly spinning a web of lies that keeps them employed. You won't find employment doing this for a living if you don't pretend like most of what you do really impacts everyone. I'm one of those people who will actively abandon products that market too heavily or with material that manipulates its consumers. I switched away from Dove soaps/shampoos back when they started their viral "Campaign for Real Beauty" shenanigans. Pretending you care about your customers' self-image problems... to market soap... turned me off.
  - madeofpalk 10y ago
    There's two types of advertisements - Direct Action marketing, where they want a very specific outcome out of the ad (to buy something), and 'brand advertisement' where they just want you to be aware of the ad. It's the difference between Coke & Budweiser, and Squarespace & Geico ads.
- paulrouget 10y ago
  But then tracking and targeting is not possible.
  - Puts 10y ago
    Targeting is very much possible, just as with magazines. If you have a recipes site you could have ads for kitchen tools. If you have a music site you have ads for local events. If you have lifestyle magazine you have clothing and interior ads. I would even go as far and say that this type of targeting is better then now when you go to a webshop, search for a product and suddenly starts seeing that product plastered all over the web, often even after you actually already bought the freaking product.
  - alkonaut 10y ago
    > But then tracking and targeting is not possible That is kind of the point. Online ads should go back being exactly like print ads are. Sold individually, static, untargeted and un-trackable. Not because the ad-networks, advertisers or site owners think its best, but because its the only type of ad that the viewers will accept eventually.
- madeofpalk 10y ago
  I work for a 'big online old media company' and can offer some insight for all of this. First up, I strongly believe our industry has dug ourselves into the hole and really fucked itself over. Daily I use an adblocker to make the internet faster and easier to use (which is ironic because I'm the one who implemented the 'plz disable adblocker' banner on our site and i see it every single day http://i.imgur.com/xQza4fS.png http://i.imgur.com/xQza4fS.png) Problems with self hosting: - It's super duper hard to change the status quo. For them, the current solution 'works fine', once they fight the supposed evil that ad blockers are. Trust me, I fight for this sort of stuff and they just don't understand things the way we do. - You can't do as much or sell ads for as much. You can charge more if you know more data about your visitors and can sell the ads to clients under the impression that it'll reach the exact demographic they're looking for. - For some companies, it's already too much of a chore to have an in-house dev team to manage the content website. Have to have _people_ manage all these self hosted ads is not appealing to these companies. Very similar to AWS vs self-hosting - An image is less interactive, so you can't sell it for as much. Those big fancy ads that are interactive are sold more many many more times the price as just a single jpg more. - If you're 'lucky' to work in a media org big enough to have a sales team, even they don't sell out every single ad placement all the time - there's a big tailed on these states they still want to monetise and ad networks helps them do that. That aside, things are changing. Everything on our site happens over HTTPS, which is a plus. We do win 'arguments' to move things in-house and not served from an ads network, where appropriate. We have an in-house 'studio team' who creates custom campaigns and creatives for clients, and they're almost entirely self hosted.
  - imglorp 10y ago
    Would it help to have an off the shelf, self-hosted ad platform available? Perhaps a plugin to an existing CMS?
    - madeofpalk 10y ago
      That might help, but it depends what problem you're trying to solve then - if everyone was using the same platform, then it would be easy for adblockers to block it. If part of your pitch is that you avoid adblockers, then once you get big enough you'll constantly be fighting an uphill battle.
- nimbix 10y ago
  Self hosted ads would change nothing when it comes to blocking. Some ad servers allow you to proxy all the requests through your subdomain, but ads still get blocked. CSS selector based blocking is widespread and adding another `.sidebar > .ad` rule to adblock is no big deal.
  - onion2k 10y ago
    There's no reason why the ads and the CSS for them can't be served by a small proxy application that runs on the server(s) of the site, and works by changing the name of any selector to a random string on every page load. Potentially it could also generate random DOM nodes in the HTML so xpath based blocking wouldn't work either.
    - valine 10y ago
      I suppose you could have a stateful adblocker that looks for the element changing between page loads, and ignores the randomly generated elements that aren't visible to the user. Of course it would only work the second time you load the page. The adblocker could load a second copy of the page in the background, and then update the DOM of the first page after it determines which elements were regenerated.
      - onion2k 10y ago
        That'd be an interesting approach. I like the idea of diff'ing a page to detect sneaky ad injection.
      - jackmaney 10y ago
        An interesting idea, but it would be difficult at best to prevent false positives on sites with dynamic elements.
    - Thiez 10y ago
      Those random DOM nodes will probably be easy to recognize because they can't affect how the final page looks. If all else fails there is still the option of rendering the page, using image-based add detection, and killing/hiding the associated DOM nodes. There are only so many ways to obfuscate your DOM without screwing up the page layout and making your UI people angry. The battle against add blockers cannot be won.
- amelius 10y ago
  > It's hard to block ads on the same domain as the main content. Well, I'm sure that it would not be impossible: - ads are the changing part of a webpage, so they can be identified - ads could be collaboratively removed, by allowing the user to select the ad, then send its fingerprint to a central entity, so that others can benefit - AI techniques could be used to identify and remove ads.
- stevesearer 10y ago
  I self-host the ads on my site in addition to selling the space directly. Because the content of the site is narrow (photo tours of office design projects) it ends up attracting a certain group of people who are interested in office design and office furniture (self-targeting if you will).
- hammock 10y ago
  Social media (Facebook/Twitter/Instagram) ads are self-hosted, and while they evade adblockers it has not kept users from being annoyed.
- eli 10y ago
  Uh, self hosted ads get blocked too - just check a popular filter subscription. Any moderately popular news site will have filter authors going out of their way to block their ads in the filters regardless of URL domain. I feel like there's this myth that adblock is just trying to block "bad" ads, but the evidence shows most blockers really try very hard to block all ads. Trying to stay one step ahead of that is a losing proposition for media companies.
massysett 10y ago
NY Times guy is still justified. No, his company should not serve malware. But if I get malware and it hijacks my machine, that means my browser and machine were both insecure. An ad blocker seems to me to be a bizarre way to make up for an insecure browser. People get this odd vehement behavior when told that companies that depend on ads won't like it if you block their ads. The grown up thing to do would be to stop using these companies if you dislike their stance against your ad blocker. Instead there is this childish whining, as though people are entitled to free news without ads.
- setrofim_ 10y ago
  Browsers are insecure. Fact of life. A lot of work is being done to rectify this; but in the near future, this will continue to be the case. Meanwhile, using ad blockers for security may seem bizarre, but it works.
- blub 10y ago
  Judging by your post you seem to have no knowledge about computer security. There is probably no internet-connected workstation today that is safe from malware, so one needs every bit of protection they can get. Not running an ad-blocker or even better something like the Firefox protection tracker is foolish.
- omginternets 10y ago
  This is like claiming a firewall is unnecessary because properly-configured software should be unexploitable. It's correct in a certain sense, but it ignores that configuration is terribly difficult to do correctly, hence the idea that security should be layered. Ad-blocking is a security layer; browser configuration is terribly difficult to do correctly.
  - lmm 10y ago
    > This is like claiming a firewall is unnecessary because properly-configured software should be unexploitable. It's correct in a certain sense, but it ignores that configuration is terribly difficult to do correctly, hence the idea that security should be layered. I actually agree with that. Firewalls are often incredibly complex codebases and usually written in C (with a rationale of the need for performance). Exposing such a thing to arbitrary internet traffic virtually guarantees exposing a vulnerability. Just don't open network ports except for services that you want to expose to the network. If you really need to expose an insecure service to a limited set of machines, use a VPN.
msravi 10y ago
Looks like Indian newspapers are ganging up on their readers to force then to turn off adblockers. Goodbye, TimesOfIndia and HindustanTimes! https://news.ycombinator.com/item?id=12007472 https://news.ycombinator.com/item?id=12007472 Clicking on an article in timesofindia takes you to this: http://timesofindia.indiatimes.com/blocked.cms http://timesofindia.indiatimes.com/blocked.cms
- corobo 10y ago
  How do they manage that? I imagine they'd use JS to check if the ad loaded maybe, can it be beat by just disabling JS entirely for that site?
  - msravi 10y ago
    Yes, it can. In uMatrix: hindustantimes.com www.hindustantimes.com script block indiatimes.com timesofindia.indiatimes.com script block lets you get past the blocker.
deleted 10y ago
[deleted]
kempe 10y ago
Security but also readability is why I use addblocker. Sites I like that does not interfererar too much with adds, then I turn addblocker off for that site. However, way too many sties gets unreadable and are annoying to go to because of how adds are used and thus addblocker is very nice.
- Klathmon 10y ago
  I know this is an unpopular opinion, but what makes you different from someone that walks out of cabs without paying because "cab drivers are dangerous and it's inconvenient to have to pay after i'm at my location"?
  - tremon 10y ago
    Because you are hogging the cabbie's time and car. The potential income lost by having a cab drive you around for free is several orders of magnitude above the digital version. Now, comparing it to free-riding a subway/bus service on the other hand...
    - Klathmon 10y ago
      Well, let's compare it, because that is a much better comparison! Every time i bring it up i get downvoted, but why is blocking ads but still consuming the content okay? I'm genuinely curious. To me it really feels like stealing. Like sneaking into a movie theater/concert/amusement park without paying, or like you said free-riding a subway/bus. And when looked at through that lens, many of the excuses people make seem comical. (Ads make pages slow, they are ugly to look at, I don't agree with the business model). To me those excuses sound like saying "I don't think the movie is worth it, so i'm just not going to pay" while walking into the theater, or walking into a concert without paying because "waiting in line to get a ticket takes too long, so i just won't". I'm hoping to have an actual conversation here and figure out why I feel so differently about this than many of the people on here do. What am I missing?
      - marcusarmstrong 10y ago
hellofunk 10y ago
So many sites now won't serve you content unless you turn off the ad-blocker. I have done so for those sites, but now I'm thinking of just boycotting those sites. CBS News is one of them, and I think it is a bit insulting to tell users not to protect their computer when they visit your website.
- douche 10y ago
  If a site is obnoxious enough to block you for ad-blocking, the chance that they actually have compelling, unique content is close to 0%. Most of the worst offenders are content farms and plagiarist shops.
- waterphone 10y ago
  Blocking them entirely is fair, and I do so in many cases to avoid accidentally going there anymore, but you can also use uBlock Origin as your adblocker and turn on the Adblock Warning Removal List and Anti-Adblock Killer filter lists, which will eliminate most of these ridiculous scripts. Sometimes so many sites in a short time add those adblocker-blocker scripts that it takes a little time for the lists to catch up, but overall it does such a good job that when people started complaining about such things earlier this year I had no idea what they were talking about because it had invisibly blocked everything for me so far.
  - hellofunk 10y ago
    Great tip about uBlock Origin. I am using ABP and it didn't do that, but now both are running together, actually. What's strange is that the number of ads they claim to block is different with each.
    - waterphone 10y ago
      They have different filter lists and can both be further customized as well, so it's not surprising that they block different things.
billpg 10y ago
I installed flash/java blockers when I was worried about vulnerabilities in those plug-ins, later removing those plug-ins entirely. You should not install an ad-blocker if you really want a flash/java blocker. You'll still be vulnerable. (Yes, there have been vulnerabilities in JS et al too, but blocking JS is a very different proposition.)
- distances 10y ago
  I selectively block JS, with uMatrix. I allow 1st party scripts by default, and block all else by default. Yes it's a bit tedious to enable domains when something breaks, but I'm actually fine with that. Would of course not recommend this to just anyone.
wiz21c 10y ago
ads are just a too complicated way of making money. if they want money for their stuff, then they should remove the adds, put a nice big pay wall and voilà. "No one who refuses to contribute to the creation of high quality journalism has the right to consume it.” I'll pay or not. But I won't have to fight an arm race anymore. Or maybe the guy is lying : he wants a very particular kind of "contribution" to his journalism. Maybe a contribution in terms of tracking, personal information, etc...
- pgwhalen 10y ago
  I think any media provider out there would prefer a subscription model - it's just so much simpler. Unfortunately people just aren't paying for it as much as they need to.
  - Klathmon 10y ago
    I don't want to pay for everything. I already shell out over $50 a month for various subscriptions. For my less common websites, I'd rather "pay" by viewing ads. (And I refuse to just steal the content. If the ads are too much, then don't use the site. IMO you don't get to choose if you pay for something based on how much you like it...) And the people on HN and reddit that announce to the world that ads shouldn't exist and anything that uses ads is a terrible thing seem crazy to me. I'm a happy ad viewer. It keeps the content free and the creators paid. If you asked people whether they want to pay for something or view ads, the answer will be ads in the vast majority of cases. And dispite all the talk of malware in ads, I've never seen it. I'm sure it exists, but until I begin to see it in my own experience or hear from friends and family about it, I'm going to keep enjoying ads as a monetization method.
    - coldpie 10y ago
      > (And I refuse to just steal the content. If the ads are too much, then don't use the site. IMO you don't get to choose if you pay for something based on how much you like it...) Genuinely asking: how do you keep track of this? Do you add bad sites to some domain blacklist? How do you protect yourself from e.g. ads that auto-play audio, or take over control of the website for a period of time, or redirect to the app store on mobile?
omginternets 10y ago
Every time this debate pops up, I find myself asking the same question: why aren't media companies creating ads I want to consume? This is a trick question: they are. It's called native advertising. Ad blockers block the scummy ads. It's still possible to make a living by serving ads, but it implies that one can't be lazy in his monetization strategy.
- pmontra 10y ago
  I think it's quite difficult. There are some ads that there only for brand building. Not sure if we want to see them. Let's count them out because they are not for things we want to buy right now ("buy" a product could be "vote" for a candidate, etc.) We're left with ads for items we didn't know and we discover we want to buy. Or for items we know and the ad remembers we want to buy them. We follow the link and buy them. The problem is: how many things of that kind are we buying every day right now? One, maybe not even one. So this leaves us with a handful or ads to be served to us per week or per month, with the assumption of an omniscient ad server that knows what we will buy. We're still not there. Luckily, I'd say. Then there is the malware thing: they don't care to send us ads we want to consume, they just send as many ads as they can to maximize the infection rate.
  - omginternets 10y ago
    Hmm I think you've missed my point (or perhaps my point was poorly stated). The point is that serving up sidebar/header/pop-up ads is no longer effective because these forms of advertising are intrusive and subject to blocking. What seems to be effective is the "sponsored content" or "native advertising" model whereby ads are served in a form that mimics desirable content. The crucial point here is that the advertisement is useful and relevant to the consumer, and so is not interpreted as an interruption or distraction. Moreover, these ads don't tend to carry malware because they're media produced by the media company in question, often hosted on the same domain. This is a model that presently works. My point is that ad-blockers block obsolete ads, whose monetization is increasingly malware-driven, precisely because the content is no longer relevant to consumers.
uptownJimmy 10y ago
Any website that blocks me for using an ad-blocker will never see my eyes again. End of discussion.
- proactivesvcs 10y ago
  "Here's the thing about anti-virus. We use viruses to pay our talented journalists, editors and many other staff. When you browse our site without anti-virus it means we can't pay out staff and keep making articles you love. Please disable your anti-virus to continue."
- jasonkostempski 10y ago
  I started work on a simple Chrome plugin for myself with hardcoded urls I want redacted from my internet experience. It takes a regex pattern and a css rule and applies the css rule to the first visible element containing the pattern in text or attributes. When I have it running, my screen looks like this [1]. Unfortunatley, I can't get Chrome to STFU about disabling developer mode every time I open it so I don't use it right now. Here's code if anyone is interested [2] [1] http://imgur.com/9HXNIcD http://imgur.com/9HXNIcD [2] https://gist.github.com/anonymous/ce893a061d5dbd611f064e95549e4cc7 https://gist.github.com/anonymous/ce893a061d5dbd611f064e9554...
56k 10y ago
Also, let's not forget performance. Many ads make pages take forever to load and sometimes even crash.
- wingerlang 10y ago
  > ..sometimes even crash I don't think this is the case. Either way you might get one crash per millions of loaded ads. Making this argument just silly. Not sure if you write software or not but crashes are more or less expected, just keep them below X% and it's "ok".
  - Bartweiss 10y ago
    I'm not sure I agree. Depending on how we define 'crash', I've certainly seen ads render pages unusable or prevent my access to content. Infinite request loops, script crashes that take down desired video content, improper loading covering content, and more. The obvious example would be sites with mediocre mobile pages fighting to serve ads. It's pretty standard to hit broken redirects, script issues, and all sorts of other crash-like behaviors visiting those.
deleted 10y ago
[deleted]
nalllar 10y ago
The title is clickbait. It should be changed to mention the security benefits of adblockers.
wildpeaks 10y ago
Subscriptions instead of ads do still work depending on the newspaper. See "Canard PC" who successfully funded an ads-free web version of its paper magazine (the kickstarter is even finishing today): https://www.kickstarter.com/projects/canardpc/canard-pc-online https://www.kickstarter.com/projects/canardpc/canard-pc-onli...
ryuuchin 10y ago
Obligatory uBlock Origin[1] plug with a recommendation to run it in "medium mode"[2] which offers the best bang for your buck (i.e. the most that can be blocked with the least amount of effort from the user). Dynamic filtering is extremely easy to use in this mode and gives such a huge payoff in terms of what it can protect you from vs just using filter lists. [1] https://github.com/gorhill/uBlock#installation https://github.com/gorhill/uBlock#installation [2] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...
anotherevan 10y ago
Ad blockers is a misnomer. They are HTML firewalls.
taneq 10y ago
Dammit, the title is clickbait and I clicked on it. I feel dirty.
taneq 10y ago
Dammit, the title is clickbait and I clicked on it. I feel dirty.
zapt02 10y ago
This article is built around the same logic as saying you shouldn't drive a car because you'll end up in an accident, and that not driving is the only option. Ad serving has problems, but you can't invalidate the claims that media companies need to make revenue by saying you want to minimize risks.
- madeofpalk 10y ago
  This is the thinking of people in the media industry (I know, I work there). Thats there's only two options: have the scummy ads we have now, or have none at all and media orgs die. But no one seems to talk about the middleground - ad serving done responsibly. I'm fine with ads, as they're performant and don't abuse my computer.
- Bartweiss 10y ago
  Advertising is not intrinsic to media content, it's one possible revenue model. The metaphor isn't to driving a car, it's traveling from A to B. Which means that it's the false dichotomy that self-driving cars and mass transit are trying to break.
a3n 10y ago
I pay for NYT access. If they block me because I block ads, then I'm leaving. These people do nothing to ensure the security of the ad networks they use. I'm not an expert or have any contact with that industry, but my impression is that at best the idea of security is an unacceptable cost.
- a3n 10y ago
  "These people" and "nothing" was ignorant and harsh. Apologies to any white hat developers involved in these things.

119 points by CaptainZapp 10y ago

Yes, ads are too big a vector for malware to ignore, so turning on ad-blocking is non-negotiable. That being given, the only alternative for NYT and friends is for subscription which they don't have the taste for, since it gives them the true value of their journalism. The difference in this true value, and older ad-based value: their take from the revenue-sharing agreement with malware-creators. We just got better with dealing with malware, and their malware based revenue took a hit.

Puts 10y ago

It's strange that the most simple and elegant solution to ad-blocking, self hosted ads are not considered by anyone. Magazines and papers have always done this in print. Yes there is overhead, because you have to handle the content manually and it's hard, even tough not impossible to measure impressions. But with print it's always been this way and now the media industry wants to both have the cake and eat it, because they don't want to handle ads but they want the revenue. And maybe I should clarify, how does self-hosted ads solve the problem? - It's hard to block ads on the same domain as the main content. - Just loading an image with an ad is not as much of an performance hit as javascript loaded tracking ads and thus should not annoy users as much. - More secure, because you can not hack one single ad service and distribute mallware to thousands of sites. Besides, the solution is less complex, and complexity always leads to bad security.

chx 10y ago
Ah, my naive friend. How can an advertiser know it's not being shortcharged? Having a "neutral" third party helps here.
- distances 10y ago
  The same way it works with newspapers, I'd say. Check that it is there when you expect it to be there.
  - danielhughes 10y ago
    Even with newspapers advertisers don't simply accept the circulation numbers that the publishers report. They pay third parties to provide independent numbers. It's not just about whether the ad appears but rather knowing how many people saw it.
    - hawski 10y ago
      So maybe there could be 3rd party company to check such things. Also ads could be sold at auction. I.e. auction for 24h display of ad in header from $1 on some news site.
      - cmdrfred 10y ago
        Actually that's not a bad idea. Why not hit the site that the ad's are reportedly on from some IP addresses unknown to the ad provider. Do this over and over again until you have enough data to assume that say 1/5th of impressions are you then compare that to a neutral 3rd party source (Google Analytics comes to mind) of the total hits for that day. 5000 hits / 1/5 of those are impressions of your ad = 1000 impressions. Compare this to the numbers provided by the ad provider itself. All you'd need to do is spot check and it should keep everyone honest. I'm surprised people don't do this already.
- syshum 10y ago
  Independent Auditing happens in all kinds of industries and for all kinds of reasons There is no reason a neutral 3rd party can not review logs, software, or other data to ensure in house ad metrics are accurate.
- AznHisoka 10y ago
  Advertisers can track clicks very easily on their own via google analytics and other platforms. What's so hard about that?
  - a_small_island 10y ago
    Because if it's CPM, then you're paying for users on the publisher who simply view it.
- hammock 10y ago
  Advertisers have not cared much to date. For example the amount of money they pour into Facebook ads despite massive click fraud.
- anoctopus 10y ago
  They could always use a platform that is pay-per-action, so that you aren't paying unless people actually buy things. (I work on the ad systems team of an affiliate marketing company, where essentially all advertisement contracts are done on a PPA basis, rather than PPC)
mjevans 10y ago
Ads really need to be put on a diet. * Either a /static/ image or colored text * Normalized (re-packed, stripped of all other data, etc) * Vetted by a human somewhere to not be 'misleading in appearance' (not checking facts, but making sure that it doesn't look like a download button or anything else not obviously an ad) * Based on the content of the context and nothing else (you can bake them statically based on the story and/or comments thread on the page)
- Puts 10y ago
  Yes, the vetting part is also important. As it is now renowned newspapers are serving ads that are border fraudulent, and I don't really understand how they are putting their reputation at risk this way by letting third parties publish non-vetted content on their site.
  - huehehue 10y ago
    I'm wondering when the Google Play Store wild west era will end. I've seen numerous apps containing ads with text (e.g. "Install Candy Crash!") laid over borderline pornographic images that have nothing to do with the advertised service. I guess it catches the eye? I don't think shifting responsibility to publishers is the answer. A half-serious idea would be to have a neutral regulatory body issue "licenses to advertise" but how long until corporate interests took that over?
  - jerf 10y ago
    "I don't really understand how they are putting their reputation at risk this way by letting third parties publish non-vetted content on their site." I read it as a measure of their financial desperation. They're eating their seed corn (their reputation is their most valuable asset in that without that, what else do they have?), and, well, what other choice do they have? HN has been talking about the other choices for years, but every time I see someone try one, they sink.
madshiva 10y ago
I agree it's a very good idea. This would also promote more local ads than big commercial ads. At the end, I know they need to get money but ads don't serve any purpose. I mean I never buy product from ad, I have only things that suite what I have search 10 minute ago. Why putting ads for that? I already know the product and this will never push me to buy something.
- developer2 10y ago
  Try telling this to anyone in the ad marketing business. They'll claim their tactics are extremely effective. Regarding "I never buy product from ad", they'll tell you "yes you do, we're manipulating your subconscious and you don't even know it's working!". Really, they're mostly spinning a web of lies that keeps them employed. You won't find employment doing this for a living if you don't pretend like most of what you do really impacts everyone. I'm one of those people who will actively abandon products that market too heavily or with material that manipulates its consumers. I switched away from Dove soaps/shampoos back when they started their viral "Campaign for Real Beauty" shenanigans. Pretending you care about your customers' self-image problems... to market soap... turned me off.
- madeofpalk 10y ago
  There's two types of advertisements - Direct Action marketing, where they want a very specific outcome out of the ad (to buy something), and 'brand advertisement' where they just want you to be aware of the ad. It's the difference between Coke & Budweiser, and Squarespace & Geico ads.
paulrouget 10y ago
But then tracking and targeting is not possible.
- Puts 10y ago
  Targeting is very much possible, just as with magazines. If you have a recipes site you could have ads for kitchen tools. If you have a music site you have ads for local events. If you have lifestyle magazine you have clothing and interior ads. I would even go as far and say that this type of targeting is better then now when you go to a webshop, search for a product and suddenly starts seeing that product plastered all over the web, often even after you actually already bought the freaking product.
- alkonaut 10y ago
  > But then tracking and targeting is not possible That is kind of the point. Online ads should go back being exactly like print ads are. Sold individually, static, untargeted and un-trackable. Not because the ad-networks, advertisers or site owners think its best, but because its the only type of ad that the viewers will accept eventually.
madeofpalk 10y ago
I work for a 'big online old media company' and can offer some insight for all of this. First up, I strongly believe our industry has dug ourselves into the hole and really fucked itself over. Daily I use an adblocker to make the internet faster and easier to use (which is ironic because I'm the one who implemented the 'plz disable adblocker' banner on our site and i see it every single day http://i.imgur.com/xQza4fS.png http://i.imgur.com/xQza4fS.png) Problems with self hosting: - It's super duper hard to change the status quo. For them, the current solution 'works fine', once they fight the supposed evil that ad blockers are. Trust me, I fight for this sort of stuff and they just don't understand things the way we do. - You can't do as much or sell ads for as much. You can charge more if you know more data about your visitors and can sell the ads to clients under the impression that it'll reach the exact demographic they're looking for. - For some companies, it's already too much of a chore to have an in-house dev team to manage the content website. Have to have _people_ manage all these self hosted ads is not appealing to these companies. Very similar to AWS vs self-hosting - An image is less interactive, so you can't sell it for as much. Those big fancy ads that are interactive are sold more many many more times the price as just a single jpg more. - If you're 'lucky' to work in a media org big enough to have a sales team, even they don't sell out every single ad placement all the time - there's a big tailed on these states they still want to monetise and ad networks helps them do that. That aside, things are changing. Everything on our site happens over HTTPS, which is a plus. We do win 'arguments' to move things in-house and not served from an ads network, where appropriate. We have an in-house 'studio team' who creates custom campaigns and creatives for clients, and they're almost entirely self hosted.
- imglorp 10y ago
  Would it help to have an off the shelf, self-hosted ad platform available? Perhaps a plugin to an existing CMS?
  - madeofpalk 10y ago
    That might help, but it depends what problem you're trying to solve then - if everyone was using the same platform, then it would be easy for adblockers to block it. If part of your pitch is that you avoid adblockers, then once you get big enough you'll constantly be fighting an uphill battle.
nimbix 10y ago
Self hosted ads would change nothing when it comes to blocking. Some ad servers allow you to proxy all the requests through your subdomain, but ads still get blocked. CSS selector based blocking is widespread and adding another `.sidebar > .ad` rule to adblock is no big deal.
- onion2k 10y ago
  There's no reason why the ads and the CSS for them can't be served by a small proxy application that runs on the server(s) of the site, and works by changing the name of any selector to a random string on every page load. Potentially it could also generate random DOM nodes in the HTML so xpath based blocking wouldn't work either.
  - valine 10y ago
    I suppose you could have a stateful adblocker that looks for the element changing between page loads, and ignores the randomly generated elements that aren't visible to the user. Of course it would only work the second time you load the page. The adblocker could load a second copy of the page in the background, and then update the DOM of the first page after it determines which elements were regenerated.
    - onion2k 10y ago
      That'd be an interesting approach. I like the idea of diff'ing a page to detect sneaky ad injection.
    - jackmaney 10y ago
      An interesting idea, but it would be difficult at best to prevent false positives on sites with dynamic elements.
  - Thiez 10y ago
    Those random DOM nodes will probably be easy to recognize because they can't affect how the final page looks. If all else fails there is still the option of rendering the page, using image-based add detection, and killing/hiding the associated DOM nodes. There are only so many ways to obfuscate your DOM without screwing up the page layout and making your UI people angry. The battle against add blockers cannot be won.
amelius 10y ago
> It's hard to block ads on the same domain as the main content. Well, I'm sure that it would not be impossible: - ads are the changing part of a webpage, so they can be identified - ads could be collaboratively removed, by allowing the user to select the ad, then send its fingerprint to a central entity, so that others can benefit - AI techniques could be used to identify and remove ads.
stevesearer 10y ago
I self-host the ads on my site in addition to selling the space directly. Because the content of the site is narrow (photo tours of office design projects) it ends up attracting a certain group of people who are interested in office design and office furniture (self-targeting if you will).
hammock 10y ago
Social media (Facebook/Twitter/Instagram) ads are self-hosted, and while they evade adblockers it has not kept users from being annoyed.
eli 10y ago
Uh, self hosted ads get blocked too - just check a popular filter subscription. Any moderately popular news site will have filter authors going out of their way to block their ads in the filters regardless of URL domain. I feel like there's this myth that adblock is just trying to block "bad" ads, but the evidence shows most blockers really try very hard to block all ads. Trying to stay one step ahead of that is a losing proposition for media companies.

massysett 10y ago

NY Times guy is still justified. No, his company should not serve malware. But if I get malware and it hijacks my machine, that means my browser and machine were both insecure. An ad blocker seems to me to be a bizarre way to make up for an insecure browser. People get this odd vehement behavior when told that companies that depend on ads won't like it if you block their ads. The grown up thing to do would be to stop using these companies if you dislike their stance against your ad blocker. Instead there is this childish whining, as though people are entitled to free news without ads.

setrofim_ 10y ago
Browsers are insecure. Fact of life. A lot of work is being done to rectify this; but in the near future, this will continue to be the case. Meanwhile, using ad blockers for security may seem bizarre, but it works.
blub 10y ago
Judging by your post you seem to have no knowledge about computer security. There is probably no internet-connected workstation today that is safe from malware, so one needs every bit of protection they can get. Not running an ad-blocker or even better something like the Firefox protection tracker is foolish.
omginternets 10y ago
This is like claiming a firewall is unnecessary because properly-configured software should be unexploitable. It's correct in a certain sense, but it ignores that configuration is terribly difficult to do correctly, hence the idea that security should be layered. Ad-blocking is a security layer; browser configuration is terribly difficult to do correctly.
- lmm 10y ago
  > This is like claiming a firewall is unnecessary because properly-configured software should be unexploitable. It's correct in a certain sense, but it ignores that configuration is terribly difficult to do correctly, hence the idea that security should be layered. I actually agree with that. Firewalls are often incredibly complex codebases and usually written in C (with a rationale of the need for performance). Exposing such a thing to arbitrary internet traffic virtually guarantees exposing a vulnerability. Just don't open network ports except for services that you want to expose to the network. If you really need to expose an insecure service to a limited set of machines, use a VPN.

msravi 10y ago

Looks like Indian newspapers are ganging up on their readers to force then to turn off adblockers. Goodbye, TimesOfIndia and HindustanTimes! https://news.ycombinator.com/item?id=12007472 https://news.ycombinator.com/item?id=12007472 Clicking on an article in timesofindia takes you to this: http://timesofindia.indiatimes.com/blocked.cms http://timesofindia.indiatimes.com/blocked.cms

corobo 10y ago
How do they manage that? I imagine they'd use JS to check if the ad loaded maybe, can it be beat by just disabling JS entirely for that site?
- msravi 10y ago
  Yes, it can. In uMatrix: hindustantimes.com www.hindustantimes.com script block indiatimes.com timesofindia.indiatimes.com script block lets you get past the blocker.

deleted 10y ago

[deleted]

kempe 10y ago

Security but also readability is why I use addblocker. Sites I like that does not interfererar too much with adds, then I turn addblocker off for that site. However, way too many sties gets unreadable and are annoying to go to because of how adds are used and thus addblocker is very nice.

Klathmon 10y ago
I know this is an unpopular opinion, but what makes you different from someone that walks out of cabs without paying because "cab drivers are dangerous and it's inconvenient to have to pay after i'm at my location"?
- tremon 10y ago
  Because you are hogging the cabbie's time and car. The potential income lost by having a cab drive you around for free is several orders of magnitude above the digital version. Now, comparing it to free-riding a subway/bus service on the other hand...
  - Klathmon 10y ago
    Well, let's compare it, because that is a much better comparison! Every time i bring it up i get downvoted, but why is blocking ads but still consuming the content okay? I'm genuinely curious. To me it really feels like stealing. Like sneaking into a movie theater/concert/amusement park without paying, or like you said free-riding a subway/bus. And when looked at through that lens, many of the excuses people make seem comical. (Ads make pages slow, they are ugly to look at, I don't agree with the business model). To me those excuses sound like saying "I don't think the movie is worth it, so i'm just not going to pay" while walking into the theater, or walking into a concert without paying because "waiting in line to get a ticket takes too long, so i just won't". I'm hoping to have an actual conversation here and figure out why I feel so differently about this than many of the people on here do. What am I missing?
    - marcusarmstrong 10y ago

hellofunk 10y ago

So many sites now won't serve you content unless you turn off the ad-blocker. I have done so for those sites, but now I'm thinking of just boycotting those sites. CBS News is one of them, and I think it is a bit insulting to tell users not to protect their computer when they visit your website.

douche 10y ago
If a site is obnoxious enough to block you for ad-blocking, the chance that they actually have compelling, unique content is close to 0%. Most of the worst offenders are content farms and plagiarist shops.
waterphone 10y ago
Blocking them entirely is fair, and I do so in many cases to avoid accidentally going there anymore, but you can also use uBlock Origin as your adblocker and turn on the Adblock Warning Removal List and Anti-Adblock Killer filter lists, which will eliminate most of these ridiculous scripts. Sometimes so many sites in a short time add those adblocker-blocker scripts that it takes a little time for the lists to catch up, but overall it does such a good job that when people started complaining about such things earlier this year I had no idea what they were talking about because it had invisibly blocked everything for me so far.
- hellofunk 10y ago
  Great tip about uBlock Origin. I am using ABP and it didn't do that, but now both are running together, actually. What's strange is that the number of ads they claim to block is different with each.
  - waterphone 10y ago
    They have different filter lists and can both be further customized as well, so it's not surprising that they block different things.

billpg 10y ago

I installed flash/java blockers when I was worried about vulnerabilities in those plug-ins, later removing those plug-ins entirely. You should not install an ad-blocker if you really want a flash/java blocker. You'll still be vulnerable. (Yes, there have been vulnerabilities in JS et al too, but blocking JS is a very different proposition.)

distances 10y ago
I selectively block JS, with uMatrix. I allow 1st party scripts by default, and block all else by default. Yes it's a bit tedious to enable domains when something breaks, but I'm actually fine with that. Would of course not recommend this to just anyone.

wiz21c 10y ago

ads are just a too complicated way of making money. if they want money for their stuff, then they should remove the adds, put a nice big pay wall and voilà. "No one who refuses to contribute to the creation of high quality journalism has the right to consume it.” I'll pay or not. But I won't have to fight an arm race anymore. Or maybe the guy is lying : he wants a very particular kind of "contribution" to his journalism. Maybe a contribution in terms of tracking, personal information, etc...

pgwhalen 10y ago
I think any media provider out there would prefer a subscription model - it's just so much simpler. Unfortunately people just aren't paying for it as much as they need to.
- Klathmon 10y ago
  I don't want to pay for everything. I already shell out over $50 a month for various subscriptions. For my less common websites, I'd rather "pay" by viewing ads. (And I refuse to just steal the content. If the ads are too much, then don't use the site. IMO you don't get to choose if you pay for something based on how much you like it...) And the people on HN and reddit that announce to the world that ads shouldn't exist and anything that uses ads is a terrible thing seem crazy to me. I'm a happy ad viewer. It keeps the content free and the creators paid. If you asked people whether they want to pay for something or view ads, the answer will be ads in the vast majority of cases. And dispite all the talk of malware in ads, I've never seen it. I'm sure it exists, but until I begin to see it in my own experience or hear from friends and family about it, I'm going to keep enjoying ads as a monetization method.
  - coldpie 10y ago
    > (And I refuse to just steal the content. If the ads are too much, then don't use the site. IMO you don't get to choose if you pay for something based on how much you like it...) Genuinely asking: how do you keep track of this? Do you add bad sites to some domain blacklist? How do you protect yourself from e.g. ads that auto-play audio, or take over control of the website for a period of time, or redirect to the app store on mobile?

omginternets 10y ago

Every time this debate pops up, I find myself asking the same question: why aren't media companies creating ads I want to consume? This is a trick question: they are. It's called native advertising. Ad blockers block the scummy ads. It's still possible to make a living by serving ads, but it implies that one can't be lazy in his monetization strategy.

pmontra 10y ago
I think it's quite difficult. There are some ads that there only for brand building. Not sure if we want to see them. Let's count them out because they are not for things we want to buy right now ("buy" a product could be "vote" for a candidate, etc.) We're left with ads for items we didn't know and we discover we want to buy. Or for items we know and the ad remembers we want to buy them. We follow the link and buy them. The problem is: how many things of that kind are we buying every day right now? One, maybe not even one. So this leaves us with a handful or ads to be served to us per week or per month, with the assumption of an omniscient ad server that knows what we will buy. We're still not there. Luckily, I'd say. Then there is the malware thing: they don't care to send us ads we want to consume, they just send as many ads as they can to maximize the infection rate.
- omginternets 10y ago
  Hmm I think you've missed my point (or perhaps my point was poorly stated). The point is that serving up sidebar/header/pop-up ads is no longer effective because these forms of advertising are intrusive and subject to blocking. What seems to be effective is the "sponsored content" or "native advertising" model whereby ads are served in a form that mimics desirable content. The crucial point here is that the advertisement is useful and relevant to the consumer, and so is not interpreted as an interruption or distraction. Moreover, these ads don't tend to carry malware because they're media produced by the media company in question, often hosted on the same domain. This is a model that presently works. My point is that ad-blockers block obsolete ads, whose monetization is increasingly malware-driven, precisely because the content is no longer relevant to consumers.

uptownJimmy 10y ago

Any website that blocks me for using an ad-blocker will never see my eyes again. End of discussion.

proactivesvcs 10y ago
"Here's the thing about anti-virus. We use viruses to pay our talented journalists, editors and many other staff. When you browse our site without anti-virus it means we can't pay out staff and keep making articles you love. Please disable your anti-virus to continue."
jasonkostempski 10y ago
I started work on a simple Chrome plugin for myself with hardcoded urls I want redacted from my internet experience. It takes a regex pattern and a css rule and applies the css rule to the first visible element containing the pattern in text or attributes. When I have it running, my screen looks like this [1]. Unfortunatley, I can't get Chrome to STFU about disabling developer mode every time I open it so I don't use it right now. Here's code if anyone is interested [2] [1] http://imgur.com/9HXNIcD http://imgur.com/9HXNIcD [2] https://gist.github.com/anonymous/ce893a061d5dbd611f064e95549e4cc7 https://gist.github.com/anonymous/ce893a061d5dbd611f064e9554...

56k 10y ago

Also, let's not forget performance. Many ads make pages take forever to load and sometimes even crash.

wingerlang 10y ago
> ..sometimes even crash I don't think this is the case. Either way you might get one crash per millions of loaded ads. Making this argument just silly. Not sure if you write software or not but crashes are more or less expected, just keep them below X% and it's "ok".
- Bartweiss 10y ago
  I'm not sure I agree. Depending on how we define 'crash', I've certainly seen ads render pages unusable or prevent my access to content. Infinite request loops, script crashes that take down desired video content, improper loading covering content, and more. The obvious example would be sites with mediocre mobile pages fighting to serve ads. It's pretty standard to hit broken redirects, script issues, and all sorts of other crash-like behaviors visiting those.

deleted 10y ago

[deleted]

nalllar 10y ago

The title is clickbait. It should be changed to mention the security benefits of adblockers.

wildpeaks 10y ago

Subscriptions instead of ads do still work depending on the newspaper. See "Canard PC" who successfully funded an ads-free web version of its paper magazine (the kickstarter is even finishing today): https://www.kickstarter.com/projects/canardpc/canard-pc-online https://www.kickstarter.com/projects/canardpc/canard-pc-onli...

ryuuchin 10y ago

Obligatory uBlock Origin[1] plug with a recommendation to run it in "medium mode"[2] which offers the best bang for your buck (i.e. the most that can be blocked with the least amount of effort from the user). Dynamic filtering is extremely easy to use in this mode and gives such a huge payoff in terms of what it can protect you from vs just using filter lists. [1] https://github.com/gorhill/uBlock#installation https://github.com/gorhill/uBlock#installation [2] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

anotherevan 10y ago

Ad blockers is a misnomer. They are HTML firewalls.

taneq 10y ago

Dammit, the title is clickbait and I clicked on it. I feel dirty.

taneq 10y ago

Dammit, the title is clickbait and I clicked on it. I feel dirty.

zapt02 10y ago

This article is built around the same logic as saying you shouldn't drive a car because you'll end up in an accident, and that not driving is the only option. Ad serving has problems, but you can't invalidate the claims that media companies need to make revenue by saying you want to minimize risks.

madeofpalk 10y ago
This is the thinking of people in the media industry (I know, I work there). Thats there's only two options: have the scummy ads we have now, or have none at all and media orgs die. But no one seems to talk about the middleground - ad serving done responsibly. I'm fine with ads, as they're performant and don't abuse my computer.
Bartweiss 10y ago
Advertising is not intrinsic to media content, it's one possible revenue model. The metaphor isn't to driving a car, it's traveling from A to B. Which means that it's the false dichotomy that self-driving cars and mass transit are trying to break.

a3n 10y ago

I pay for NYT access. If they block me because I block ads, then I'm leaving. These people do nothing to ensure the security of the ad networks they use. I'm not an expert or have any contact with that industry, but my impression is that at best the idea of security is an unacceptable cost.

a3n 10y ago
"These people" and "nothing" was ignorant and harsh. Apologies to any white hat developers involved in these things.