17 ms·

I had no idea that Google Adwords allowed advertisers to run arbitrary Javascript in user's browsers because that just seems so monumentally stupid. Is that th

by quasse 9y ago

I had no idea that Google Adwords allowed advertisers to run arbitrary Javascript in user's browsers because that just seems so monumentally stupid. Is that their general policy or was this some kind of script injection input cleansing fuckup on their part?

deleted 9y ago
[deleted]
klodolph 9y ago
For ads it makes a certain amount of sense... you can put animations in the ads that are driven by JS, or make the ads interactive. Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in.
- jMyles 9y ago
  > Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in. I'm probably missing something obvious here, but: how doesn't it run in the security context of the page?
  - chii 9y ago
    presumably ads are served inside an iframe that's different from the website it's displayed on.
- tripzilch 9y ago
  > For ads it makes a certain amount of sense... you can put animations in the ads that are driven by JS, or make the ads interactive. Does nobody remember that Google Ads actually got popular first because they didn't allow for this kind of crap?
  - lithos 9y ago
    In time all companies listen to their customers.
mtgx 9y ago
And this is why you use an adblocker.
advisedwang 9y ago
This is very common, and isn't just Google Adwords. Advertisers, or rather the ad-tech companies they user, want to do this to verify that ad views are 'legitimate' and gather extra data to help them bid. Without this advertisers have to trust ad exchanges to play fair, which of course they don't have any incentive to do. This is just yet another reason "Ads pay for content on the internet" hurts everyone.
- hazelnut 9y ago
  And they said the internet will be safer without Flash
  - 534b44a 9y ago
    Flash wasn't open, they should had made their own browser when they still had the chance. One can still do some aggressive fingerprinting using new browser technologies.
- tripzilch 9y ago
  Oh, I know the other ad networks used to do this since forever. But Google's ad network used to pretend to be better. It started way back when they initially served text-only ads, which were perceived by many users as much more pleasant (and even more likely to click) than distracting banner ads (let alone animated ones). Most people (that care about this kind of thing) already knew that many of the other ad networks allowed this sort of thing. The more shady, the more likely. Google wasn't like that. And this gained them a lot of goodwill, for providing a good clean ad network without all the dancing monkey scams. They just did the tracking with their own scripts, providing a dashboard/control panel with stats to the advertisers. I'm really curious since when they started allowing 3rd party scripts to be included in their ads. And I am not at all surprised if the "big announcement" of this feature was kind of a quiet affair. Because this is the first time I hear Google Ads allows this and I'm just,... yeah. Surprised? Disappointed? Mostly just very pissed off. I was already blocking most ads, but if you ever expect me to whitelist anything ever again, you better host the ad yourself and not use a 3rd party network, because apparently all of them are scum. Funny detail: if you host the ad yourself you don't even need to ask me to whitelist it, because most adblockers simply don't block these things as they are not distinguishable from a thumbnail link to an external domain :)

by quasse 9y ago

deleted 9y ago

[deleted]

klodolph 9y ago

For ads it makes a certain amount of sense... you can put animations in the ads that are driven by JS, or make the ads interactive. Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in.

jMyles 9y ago
> Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in. I'm probably missing something obvious here, but: how doesn't it run in the security context of the page?
- chii 9y ago
  presumably ads are served inside an iframe that's different from the website it's displayed on.
tripzilch 9y ago
> For ads it makes a certain amount of sense... you can put animations in the ads that are driven by JS, or make the ads interactive. Does nobody remember that Google Ads actually got popular first because they didn't allow for this kind of crap?
- lithos 9y ago
  In time all companies listen to their customers.

mtgx 9y ago

And this is why you use an adblocker.

advisedwang 9y ago

This is very common, and isn't just Google Adwords. Advertisers, or rather the ad-tech companies they user, want to do this to verify that ad views are 'legitimate' and gather extra data to help them bid. Without this advertisers have to trust ad exchanges to play fair, which of course they don't have any incentive to do. This is just yet another reason "Ads pay for content on the internet" hurts everyone.

hazelnut 9y ago
And they said the internet will be safer without Flash
- 534b44a 9y ago
  Flash wasn't open, they should had made their own browser when they still had the chance. One can still do some aggressive fingerprinting using new browser technologies.
tripzilch 9y ago
Oh, I know the other ad networks used to do this since forever. But Google's ad network used to pretend to be better. It started way back when they initially served text-only ads, which were perceived by many users as much more pleasant (and even more likely to click) than distracting banner ads (let alone animated ones). Most people (that care about this kind of thing) already knew that many of the other ad networks allowed this sort of thing. The more shady, the more likely. Google wasn't like that. And this gained them a lot of goodwill, for providing a good clean ad network without all the dancing monkey scams. They just did the tracking with their own scripts, providing a dashboard/control panel with stats to the advertisers. I'm really curious since when they started allowing 3rd party scripts to be included in their ads. And I am not at all surprised if the "big announcement" of this feature was kind of a quiet affair. Because this is the first time I hear Google Ads allows this and I'm just,... yeah. Surprised? Disappointed? Mostly just very pissed off. I was already blocking most ads, but if you ever expect me to whitelist anything ever again, you better host the ad yourself and not use a 3rd party network, because apparently all of them are scum. Funny detail: if you host the ad yourself you don't even need to ask me to whitelist it, because most adblockers simply don't block these things as they are not distinguishable from a thumbnail link to an external domain :)