5 ms·

> btw if you're using this plugin on Firefox, enjoy the exploits that your browser downloads and runs in the background by clicking every ad! :-D It doesn't d

> btw if you're using this plugin on Firefox, enjoy the exploits that your browser downloads and runs in the background by clicking every ad! :-D It doesn't download or run anything. Just clicks links without even rendering the response, pretty small attack surface there I'd say.

Someone1234 10y ago
Also pretty easy to detect/block. Just add a redirect that redirects on page draw after the click. Only record clicks that successfully redirect.
- problems 10y ago
  Yeah, it might make for slightly weird flow when clicking ads, but you could totally do it. So instead of doing that and being respectful and competitive Google decided to ban the extension.
  - dpark 10y ago
    "Respectful" is a really bizarre expectation since this plugin by its nature does not respect Google's or other ad networks. I don't know why Google would demonstrate respect to a plugin designed to damage their ad network.
    - problems 10y ago
      Because other browser vendors would accept such a plugin as they're not ad networks. This seems to me very much like a case of Google being too big, having their hands in both the ad market and the browser market and abusing that position. Respect may not have been the right word, but I was going for "not a blatant abuse of power".
      - dpark 10y ago
        I'm not very sympathetic to click fraud. Almost no one would think it acceptable if a site owner were using a click farm to artificially inflate the ad click through rate, but somehow a browser extension doing the same is okay? I have no problem with ad blocking but actively poisoning the network is a different thing entirely. If Google decided to block users of AdNauseum and similar plugins from using Google web products, you'd probably say it's blatant abuse of power and I'd say it sounds reasonable, exactly as it's reasonable for sites to block users running ad blockers.
        problems 10y ago
        I'd say it's perfectly acceptable for site owners to perform "click fraud" too. It's their computer after all, they can use it however they want. If click fraud is what they want to do, go for it. It's up to the ad networks to counter that on their end - on their own computers - in a fair and reasonable way. Just as browser extension runners have every right to have their computer do what they want it to - if that's click ads, so be it. Ultimately, I own my computer, it should do what I tell it to. As others have pointed out, Google could have easily detected this extension and ignored its clicks, just as they do with regular click fraud in most cases. Instead they chose a path which makes Chrome violate user choice. That I have a problem with.
        paulmd 10y ago
        > Almost no one would think it acceptable if a site owner were using a click farm to artificially inflate the ad click through rate, but somehow a browser extension doing the same is okay? Yes. Context and intent matter. "Almost nobody would think it acceptable to drive recklessly on their commute home, but somehow ambulance drivers get to run red lights and exceed the speed limit?"
        dpark 10y ago
        I know you're making an analogy but comparing AdNauseum to ambulance drivers is a bit of a stretch. One of these is saving lives. The other has no purpose except to inflict damage on ad networks. Aside from damaging ad networks, it also actively harms site owners by increasing the risk of them getting blocked from the ad networks that fund their work. I don't see a lot of merit in AdNauseum. It feels to me like a petty "fuck you" response from people who don't like ads.
dguido 10y ago
This was not the case when I looked at the code years ago. I would not trust any statements to the contrary without reviewing it again for changes.
dpark 10y ago
A "click" is a download. In order for the ad network to register your click, you are necessarily sending a request and receiving a response. Whether the browser ends up rendering that response, I don't know, but it's certainly possible, especially because ads generally involve redirects which may also be instrumented and may involve JS instrumentation, making spoofing clicks difficult without following redirects and rendering the resulting page.

Someone1234 10y ago

Also pretty easy to detect/block. Just add a redirect that redirects on page draw after the click. Only record clicks that successfully redirect.

problems 10y ago
Yeah, it might make for slightly weird flow when clicking ads, but you could totally do it. So instead of doing that and being respectful and competitive Google decided to ban the extension.
- dpark 10y ago
  "Respectful" is a really bizarre expectation since this plugin by its nature does not respect Google's or other ad networks. I don't know why Google would demonstrate respect to a plugin designed to damage their ad network.
  - problems 10y ago
    Because other browser vendors would accept such a plugin as they're not ad networks. This seems to me very much like a case of Google being too big, having their hands in both the ad market and the browser market and abusing that position. Respect may not have been the right word, but I was going for "not a blatant abuse of power".
    - dpark 10y ago
      I'm not very sympathetic to click fraud. Almost no one would think it acceptable if a site owner were using a click farm to artificially inflate the ad click through rate, but somehow a browser extension doing the same is okay? I have no problem with ad blocking but actively poisoning the network is a different thing entirely. If Google decided to block users of AdNauseum and similar plugins from using Google web products, you'd probably say it's blatant abuse of power and I'd say it sounds reasonable, exactly as it's reasonable for sites to block users running ad blockers.
      - problems 10y ago
        I'd say it's perfectly acceptable for site owners to perform "click fraud" too. It's their computer after all, they can use it however they want. If click fraud is what they want to do, go for it. It's up to the ad networks to counter that on their end - on their own computers - in a fair and reasonable way. Just as browser extension runners have every right to have their computer do what they want it to - if that's click ads, so be it. Ultimately, I own my computer, it should do what I tell it to. As others have pointed out, Google could have easily detected this extension and ignored its clicks, just as they do with regular click fraud in most cases. Instead they chose a path which makes Chrome violate user choice. That I have a problem with.
      - paulmd 10y ago
        > Almost no one would think it acceptable if a site owner were using a click farm to artificially inflate the ad click through rate, but somehow a browser extension doing the same is okay? Yes. Context and intent matter. "Almost nobody would think it acceptable to drive recklessly on their commute home, but somehow ambulance drivers get to run red lights and exceed the speed limit?"
        dpark 10y ago
        I know you're making an analogy but comparing AdNauseum to ambulance drivers is a bit of a stretch. One of these is saving lives. The other has no purpose except to inflict damage on ad networks. Aside from damaging ad networks, it also actively harms site owners by increasing the risk of them getting blocked from the ad networks that fund their work. I don't see a lot of merit in AdNauseum. It feels to me like a petty "fuck you" response from people who don't like ads.

dguido 10y ago

This was not the case when I looked at the code years ago. I would not trust any statements to the contrary without reviewing it again for changes.

dpark 10y ago

A "click" is a download. In order for the ad network to register your click, you are necessarily sending a request and receiving a response. Whether the browser ends up rendering that response, I don't know, but it's certainly possible, especially because ads generally involve redirects which may also be instrumented and may involve JS instrumentation, making spoofing clicks difficult without following redirects and rendering the resulting page.