5 ms·

If the small players can only continue to exist by serving malvertising, some might opine that they might not have a right to continue to exist with that busine

• manigandham 8y ago
  Why must non-server advertising be the same as malvertising? The integration type is different from the ads that are possible. Server-side integration doesn't affect what ads are available.
  • crtasm 8y ago
    Don't all the ad networks use JavaScript? Has any network never let malicious code from advertisers slip through? (I guess Google? But I'd prefer not to have even more people embedding their js everywhere I browse)
    • dmortin 8y ago
      How is it different when ads are served from server side? Most sites (especially smaller ones) would still use an ad network, because they don't have their own resources to find advertisers, which it calls from server side to retrieve the ad. And when the retireved ad code is injected into the page on server side it could still lead to some malicious site or whatever.
      • TeMPOraL 8y ago
        I suppose it would be easier to sue such site's operator, as malware is suddenly served directly from first-party. Thus, creating a strong incentive for site operators to actually curate their ad experience, instead of subscribing to whatever network is most profitable any given day.
        • dmortin 8y ago
          So this would again hurt the little guys (blogs, forums, smaller sites managed by 1 or 2 people) who don't have the capacity to find advertisers and curate ads, and for this reason, have to use an ad network. The big sites, facebook and co. can easily do some curation and find advertisers, so as it was mentioned before these changes would only eliminate the small players while further concentrating the web into the hands of the big guys.
          • acdha 8y ago
            It already does. This would increase the incentive not to switch to some claiming to offer slightly higher payouts and hope that they’re not cutting corners.
          • Kalium 8y ago
            If your question is "Are we as a society willing to sacrifice the income of some small sites to keep users from being infected and having their privacy invaded?", then you may wish to contemplate the possibility that a lot of people might just say "Yes".
            • dmortin 8y ago
              No, the question is: do we want more and more content concentrated into the hands of big players, eliminating little, independent publishers? Do we want this? If the answer is no then there must be a feasible, scalable alternative for small players before we eliminate the current ad based model, otherwise the little guys will die and all we have will be huge media sites pushing their own agendas without small, independent publishers having a chance of standing up to them. That is the dilemma.
              • Kalium 8y ago
                > No, the question is: do we want more and more content concentrated into the hands of big players, eliminating little, independent publishers? Do we want this? Herein lies the catch: you have correctly and properly identified a potential side-effect. The question, I think, is this: how many users and how much privacy are we willing to sacrifice for this precious, wonderful, beloved, amazing side-effect? I know my answer, and I see no dilemma at all. The horrific outcome you so rightly point to is not an ideal outcome, in isolation. At the same time, there's never a guarantee that there must be some convenient alternative. The wish for a thing does not conjure it into being, or even prove that it is possible. And in this case, some might decide that our beloved side-effect isn't as important as some other things. Though I understand if some prefer to see the security and privacy of users as something to be traded off against for financial convenience.
    • manigandham 8y ago
      Yes, there are networks that have always remained clean. It's a business problem more than technical. But the topic was smaller sites running 3rd party networks which necessarily only integrate via client-side JS. That has nothing to do with what kind of ads are being run. It's the same exact ad calls to the ad exchanges, just done via HTTP from the server rather than JS in the browser.
      • michaelt 8y ago
        You can't virus-scan an e-mail that doesn't pass through your server. How would you inspect javascript that doesn't pass through your server? Or do you have to just get a bit of paper from the ad network saying they won't make any mistakes, then take their word for it without any way of auditing their claim?
        • manigandham 8y ago
          That's not how it works. The payload is dynamic javascript. Just because you make some calls on the server-side doesn't mean you can inspect the payload with any real reliability, and if it was that easy then it would already be done by the ad exchanges who send the payloads in the first place. There is an entire inner industry around security and malware for programmatic ads, with a few companies that are pretty good at it, but it is not something that can just run as a simple server for any small publisher to deploy.
      • acdha 8y ago
        > there are networks that have always remained clean Can you name them? The major ones have had persistent failures which make me think this is more due to not being targeted or being some of the niche networks like The Deck which didn’t have capacity to scale up.
    • 908087 8y ago
      Google has been caught serving malware / malicious ads numerous times, IIRC. Here are a couple incidents I found with a quick search: https://www.wired.com/2010/12/doubleclick/ https://www.wired.com/2010/12/doubleclick/ https://www.fastcompany.com/3062867/overlay-malware-google-adsense https://www.fastcompany.com/3062867/overlay-malware-google-a...
  • Kalium 8y ago
    People who do their own server-side advertising tend to be far pickier and much more careful with what ads they use. They tend not to do instant auctions, and tend towards newspaper-style ads. Does this render them immune to malvertising? As you imply, it by no means does so. You're completely correct. It might, however, reduce the chances by a non-zero amount as compared to a third party executing arbitrary code in their client as blessed by you. But, none of that is important. I think the most important lesson here is that nobody has a right to a given business model. No website, big or small, has a fundamental right to generate revenue based on advertising. Advertising may be essential to some business models, but those business models are not essential to anything.
    • manigandham 8y ago
      > fundamental right to generate revenue based on advertising. What? Who's talking about rights here? Especially to a business model? That's a strange interpretation and companies are free to do what they want. Advertising is itself a business model, and marketing (of which advertising is a subset) is critical to the commercial success of pretty much every corporation that exists. The biggest issue with directly negotiated ad campaigns is scale. Unless you are a major publisher, no advertiser is going to spend time dealing with small buys across multiple small sites, which is the whole point of small sites using ad networks that can aggregate and streamline demand and optimize yield. Also much of that 3rd party javascript is for measurement. Digital ads require accurate metrics and the industry won't be going back to blind buys with no visibility and only the publishers promise.
      • zzzcpan 8y ago
        The point of small sites using ad networks is for ad networks to make a lot of money on many small sites in aggregate. The amount of money each small site gains from this is tiny and unimportant.
        • manigandham 8y ago
          That's because they're a small site. Earnings are proportional to value in traffic and audience. Small sites do not make big money.