6 ms·

I wish Google would do something against the so called 'Rogue Redirect Ads' in their AdSense network. Ads that redirect the parent frame. When I browse the web

by TekMol 9y ago

I wish Google would do something against the so called 'Rogue Redirect Ads' in their AdSense network. Ads that redirect the parent frame. When I browse the web on my Android phone, I get redirected to spam every 10 pageviews or so. And no, it's not a problem of the phone. It's a known issue that ads can break out of their iframe: https://www.androidpolice.com/2017/11/08/heres-protect-rogue-redirect-ads-right-now-chrome/ https://www.androidpolice.com/2017/11/08/heres-protect-rogue... IMO Javascript should not be allowed in ads at all. Unless that gets implemented, I have the feeling that all blog posts about improving the user experience are just lip service.

javery 9y ago
There is some work going on to remove Javascript, but it is slow going. Most publishers won't trade off revenue for performance and security so there is no incentive for the buyers to change their ways.
- TekMol 9y ago
  Giving publishers a choice would be a start. A checkbox 'Allow JavaScript' for AdSense publishers and a way to run revenue experiments about JS on/off.
- stordoff 9y ago
  That does raise the question is Google big/ubiquitous enough to force that on publishers? If Google unilaterally decided no more JS in ads., would the publishers grumble about it but adapt, or would they look to other ad networks.
  - marcodave 9y ago
    ...onwards to the WebAssembly ads!
adamgamble 9y ago
They have: https://blog.chromium.org/2017/11/expanding-user-protections-on-web.html https://blog.chromium.org/2017/11/expanding-user-protections...
- TekMol 9y ago
  I know that they have this new mechanism in Chrome 64. That is actually mentioned in the article I linked to. But I would prefer if the did not deliver Javascript inside ads in the first place.
  - matt4077 9y ago
    So you when you said you'd "wish Google would do something" you already knew that, in fact, they have already done something? And presumably the use of this lie was to provide an example to support your argument that ads should not contain Javascript at all?
    - spiznnx 9y ago
      Google runs an ad network and releases a browser. Presumably he is aware that Chrome is doing something, but wishes that AdSense and DoubleClick would do something.
y03a 9y ago
If you're on Android I very highly recommend using Firefox with uBlock Origin.
- sergiosgc 9y ago
  Or Firefox Focus. It quickly became my default browser on Android, with the regular Firefox left for sites where I maintain a session.
  - y03a 9y ago
    Focus is probably the best option on iOS but I don't trust Mozilla to block tracking the way I want it done, I'm far more comfortable with uBlock Origin handling it. If I want the extra protection of deleting my cookies and history on exit I'd rather just start a private tab. Most of the time, I want to stay logged in on sites.
    - mulmen 9y ago
      Why do you distrust Mozilla in this case?
      - NoGravitas 9y ago
        For me it's not a matter of trust, it's just that there's no customizability to the ad-blocking on Focus, even at the level of choosing blocklists to subscribe to, or adding particular elements to be blocked.
      - y03a 9y ago
        I don't want a company that releases a "privacy focused browser" with telemetry enabled by default deciding which tracking is "ok" and which isn't. I love Firefox compared to other browsers but there's definitely some user-hostile choices being made at Mozilla and I'd rather they just not get involved in ad blocking (other than ensuring the add-on architecture allows proper blockers to do what they need to get the job done right).
    - 9y ago
sekh60 9y ago
Try firefox on Android. It has full extension support, so you can use whatever adblocker or javascript blockers you like.
- tdeck 9y ago
  Brave is also a good choice.
incognito92735 9y ago
> Ads that redirect the parent frame. Putting the ad in an iframe without the allow-top-navigation[0] sandbox permission could prevent that. Or if the ad naturally consists of an iframe then a browser extension could intercept the iframe load and add the equivalent CSP rule[1]. Or google could do that themselves. I think they would still be allowed to open in a new tab. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if... [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
0xfeba 9y ago
Thanks for reminding me about this problem. A few websites I visit have spammy ads that do this and it is very frustrating, but I forget as soon as I leave the loo. And now I have FF and uBlock Origin on my phone.
vorpalhex 9y ago
> IMO Javascript should not be allowed in ads at all. I agree fully. I think part of the issue is that the folks submitting ads want to collect a lot of data. They probably don't use that data (or if they do, not well), nor do I trust them to not collect very invasive and unsafe data, but I suspect for many folks that having their own JS payload makes or breaks a possible ad network. Given concerns about Monero mining, redirects, and other hijinks, removing JS from ads is even more critical now. I think the compromise will be to give ads some kind of network provided hook to get data back to "home" eventually, though then the issues above only shift from the ad provider to the ad network provider.
- Klathmon 9y ago
  Or at the very least, provide a domain-specific-language that "compiles" to JS that can do very limited things like animations and others. That combined with requiring all of the assets to be hosted on the ad-network's servers would greatly improve the experience. (mainly because ad-networks are larger companies that the host website has a direct relationship with, so when users complain the site can talk to the ad-network, and the ad network can instantly do something about it) Sadly, they have no incentive to do that, as those ads would be more expensive to create, most likely make less money, and most users that block ads block all of them regardless of how invasive they are. Adblockers treat all ads the same, and so now advertisers are faced with the choices of: 1. make more shitty invasive ads 2. make "better" ads (better for the user) and make less money while spending more and having users still block them anyway. This is why I really believe that the "better ads" thing from google and others is a really good idea, because it helps re-align the incentives back with the user in some ways. If that works, shitty ads will be blocked much more widely, while good ads will get more views and more users.
  - feikname 9y ago
    I believe the term you are looking for is "transpiler".
    - Klathmon 9y ago
dingo_bat 9y ago
You should use a system wide ad blocker. Adhell2 is a good one. I've stopped seeing any kind of ads in my phone, even inside apps.
freehunter 9y ago
Similar things happen on iOS, too. I can't tell you how many times I'm trying to go to a seemingly legitimate site on my iPhone and I get redirected a dozen times and end up at "You've won a free Samsung tablet!" instead of the content I asked for.
- Polyphonie 9y ago
  You're probably either not using the right ad-blocker or fail to configure the ad-block properly. If you just want a content-blocker that works in Safari- I find Purify works the best. If you want a full system ad-blocker which works in most apps- NYT, BBC, Chrome though not in the YouTube, Instagram, Twitter apps- it would have to be a DNS based Ad-blocker like Adguard Pro.
toomanybeersies 9y ago
I started getting them for a while a few month ago. It made browsing certain sites on my phone almost impossible, I'd get a rogue redirect literally every time I tried to access the page.
com2kid 9y ago
I saw this happen on an AMP page. I was... rather surprised. One of AMP's huge value props is preventing that type of garbage. I'm also surprised that the publisher did that, I hope that'd be a good way to get blacklisted from the higher search ranking placement.
h1d 9y ago
How do you define "ads"?

by TekMol 9y ago

javery 9y ago

There is some work going on to remove Javascript, but it is slow going. Most publishers won't trade off revenue for performance and security so there is no incentive for the buyers to change their ways.

TekMol 9y ago
Giving publishers a choice would be a start. A checkbox 'Allow JavaScript' for AdSense publishers and a way to run revenue experiments about JS on/off.
stordoff 9y ago
That does raise the question is Google big/ubiquitous enough to force that on publishers? If Google unilaterally decided no more JS in ads., would the publishers grumble about it but adapt, or would they look to other ad networks.
- marcodave 9y ago
  ...onwards to the WebAssembly ads!

adamgamble 9y ago

They have: https://blog.chromium.org/2017/11/expanding-user-protections-on-web.html https://blog.chromium.org/2017/11/expanding-user-protections...

TekMol 9y ago
I know that they have this new mechanism in Chrome 64. That is actually mentioned in the article I linked to. But I would prefer if the did not deliver Javascript inside ads in the first place.
- matt4077 9y ago
  So you when you said you'd "wish Google would do something" you already knew that, in fact, they have already done something? And presumably the use of this lie was to provide an example to support your argument that ads should not contain Javascript at all?
  - spiznnx 9y ago
    Google runs an ad network and releases a browser. Presumably he is aware that Chrome is doing something, but wishes that AdSense and DoubleClick would do something.

y03a 9y ago

If you're on Android I very highly recommend using Firefox with uBlock Origin.

sergiosgc 9y ago
Or Firefox Focus. It quickly became my default browser on Android, with the regular Firefox left for sites where I maintain a session.
- y03a 9y ago
  Focus is probably the best option on iOS but I don't trust Mozilla to block tracking the way I want it done, I'm far more comfortable with uBlock Origin handling it. If I want the extra protection of deleting my cookies and history on exit I'd rather just start a private tab. Most of the time, I want to stay logged in on sites.
  - mulmen 9y ago
    Why do you distrust Mozilla in this case?
    - NoGravitas 9y ago
      For me it's not a matter of trust, it's just that there's no customizability to the ad-blocking on Focus, even at the level of choosing blocklists to subscribe to, or adding particular elements to be blocked.
    - y03a 9y ago
      I don't want a company that releases a "privacy focused browser" with telemetry enabled by default deciding which tracking is "ok" and which isn't. I love Firefox compared to other browsers but there's definitely some user-hostile choices being made at Mozilla and I'd rather they just not get involved in ad blocking (other than ensuring the add-on architecture allows proper blockers to do what they need to get the job done right).
  - 9y ago

sekh60 9y ago

Try firefox on Android. It has full extension support, so you can use whatever adblocker or javascript blockers you like.

tdeck 9y ago
Brave is also a good choice.

incognito92735 9y ago

> Ads that redirect the parent frame. Putting the ad in an iframe without the allow-top-navigation[0] sandbox permission could prevent that. Or if the ad naturally consists of an iframe then a browser extension could intercept the iframe load and add the equivalent CSP rule[1]. Or google could do that themselves. I think they would still be allowed to open in a new tab. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if... [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

0xfeba 9y ago

Thanks for reminding me about this problem. A few websites I visit have spammy ads that do this and it is very frustrating, but I forget as soon as I leave the loo. And now I have FF and uBlock Origin on my phone.

vorpalhex 9y ago

> IMO Javascript should not be allowed in ads at all. I agree fully. I think part of the issue is that the folks submitting ads want to collect a lot of data. They probably don't use that data (or if they do, not well), nor do I trust them to not collect very invasive and unsafe data, but I suspect for many folks that having their own JS payload makes or breaks a possible ad network. Given concerns about Monero mining, redirects, and other hijinks, removing JS from ads is even more critical now. I think the compromise will be to give ads some kind of network provided hook to get data back to "home" eventually, though then the issues above only shift from the ad provider to the ad network provider.

Klathmon 9y ago
Or at the very least, provide a domain-specific-language that "compiles" to JS that can do very limited things like animations and others. That combined with requiring all of the assets to be hosted on the ad-network's servers would greatly improve the experience. (mainly because ad-networks are larger companies that the host website has a direct relationship with, so when users complain the site can talk to the ad-network, and the ad network can instantly do something about it) Sadly, they have no incentive to do that, as those ads would be more expensive to create, most likely make less money, and most users that block ads block all of them regardless of how invasive they are. Adblockers treat all ads the same, and so now advertisers are faced with the choices of: 1. make more shitty invasive ads 2. make "better" ads (better for the user) and make less money while spending more and having users still block them anyway. This is why I really believe that the "better ads" thing from google and others is a really good idea, because it helps re-align the incentives back with the user in some ways. If that works, shitty ads will be blocked much more widely, while good ads will get more views and more users.
- feikname 9y ago
  I believe the term you are looking for is "transpiler".
  - Klathmon 9y ago

dingo_bat 9y ago

You should use a system wide ad blocker. Adhell2 is a good one. I've stopped seeing any kind of ads in my phone, even inside apps.

freehunter 9y ago

Similar things happen on iOS, too. I can't tell you how many times I'm trying to go to a seemingly legitimate site on my iPhone and I get redirected a dozen times and end up at "You've won a free Samsung tablet!" instead of the content I asked for.

Polyphonie 9y ago
You're probably either not using the right ad-blocker or fail to configure the ad-block properly. If you just want a content-blocker that works in Safari- I find Purify works the best. If you want a full system ad-blocker which works in most apps- NYT, BBC, Chrome though not in the YouTube, Instagram, Twitter apps- it would have to be a DNS based Ad-blocker like Adguard Pro.

toomanybeersies 9y ago

I started getting them for a while a few month ago. It made browsing certain sites on my phone almost impossible, I'd get a rogue redirect literally every time I tried to access the page.

com2kid 9y ago

I saw this happen on an AMP page. I was... rather surprised. One of AMP's huge value props is preventing that type of garbage. I'm also surprised that the publisher did that, I hope that'd be a good way to get blacklisted from the higher search ranking placement.

h1d 9y ago

How do you define "ads"?