4 ms·

Don't all the ad networks use JavaScript? Has any network never let malicious code from advertisers slip through? (I guess Google? But I'd prefer not to have ev

by crtasm 8y ago

Don't all the ad networks use JavaScript? Has any network never let malicious code from advertisers slip through? (I guess Google? But I'd prefer not to have even more people embedding their js everywhere I browse)

dmortin 8y ago
How is it different when ads are served from server side? Most sites (especially smaller ones) would still use an ad network, because they don't have their own resources to find advertisers, which it calls from server side to retrieve the ad. And when the retireved ad code is injected into the page on server side it could still lead to some malicious site or whatever.
- TeMPOraL 8y ago
  I suppose it would be easier to sue such site's operator, as malware is suddenly served directly from first-party. Thus, creating a strong incentive for site operators to actually curate their ad experience, instead of subscribing to whatever network is most profitable any given day.
  - dmortin 8y ago
    So this would again hurt the little guys (blogs, forums, smaller sites managed by 1 or 2 people) who don't have the capacity to find advertisers and curate ads, and for this reason, have to use an ad network. The big sites, facebook and co. can easily do some curation and find advertisers, so as it was mentioned before these changes would only eliminate the small players while further concentrating the web into the hands of the big guys.
    - acdha 8y ago
      It already does. This would increase the incentive not to switch to some claiming to offer slightly higher payouts and hope that they’re not cutting corners.
    - Kalium 8y ago
      If your question is "Are we as a society willing to sacrifice the income of some small sites to keep users from being infected and having their privacy invaded?", then you may wish to contemplate the possibility that a lot of people might just say "Yes".
      - dmortin 8y ago
        No, the question is: do we want more and more content concentrated into the hands of big players, eliminating little, independent publishers? Do we want this? If the answer is no then there must be a feasible, scalable alternative for small players before we eliminate the current ad based model, otherwise the little guys will die and all we have will be huge media sites pushing their own agendas without small, independent publishers having a chance of standing up to them. That is the dilemma.
        Kalium 8y ago
        > No, the question is: do we want more and more content concentrated into the hands of big players, eliminating little, independent publishers? Do we want this? Herein lies the catch: you have correctly and properly identified a potential side-effect. The question, I think, is this: how many users and how much privacy are we willing to sacrifice for this precious, wonderful, beloved, amazing side-effect? I know my answer, and I see no dilemma at all. The horrific outcome you so rightly point to is not an ideal outcome, in isolation. At the same time, there's never a guarantee that there must be some convenient alternative. The wish for a thing does not conjure it into being, or even prove that it is possible. And in this case, some might decide that our beloved side-effect isn't as important as some other things. Though I understand if some prefer to see the security and privacy of users as something to be traded off against for financial convenience.
        dmortin 8y ago
        The danger of possible outlets for alternative voices controlled more and more by big corporations is at least as bad as the privacy implications. So there must be a tradeoff if we wan't privacy, but we also want to have publishing outlets independent of big corporations. There is currently no perfect solution where we can have total privacy and also little publishers can sustain themselves. I'm saying that we must find a balance where we have some of both. Having 100% of one while giving up the other is not the answer.
manigandham 8y ago
Yes, there are networks that have always remained clean. It's a business problem more than technical. But the topic was smaller sites running 3rd party networks which necessarily only integrate via client-side JS. That has nothing to do with what kind of ads are being run. It's the same exact ad calls to the ad exchanges, just done via HTTP from the server rather than JS in the browser.
- michaelt 8y ago
  You can't virus-scan an e-mail that doesn't pass through your server. How would you inspect javascript that doesn't pass through your server? Or do you have to just get a bit of paper from the ad network saying they won't make any mistakes, then take their word for it without any way of auditing their claim?
  - manigandham 8y ago
    That's not how it works. The payload is dynamic javascript. Just because you make some calls on the server-side doesn't mean you can inspect the payload with any real reliability, and if it was that easy then it would already be done by the ad exchanges who send the payloads in the first place. There is an entire inner industry around security and malware for programmatic ads, with a few companies that are pretty good at it, but it is not something that can just run as a simple server for any small publisher to deploy.
- acdha 8y ago
  > there are networks that have always remained clean Can you name them? The major ones have had persistent failures which make me think this is more due to not being targeted or being some of the niche networks like The Deck which didn’t have capacity to scale up.
908087 8y ago
Google has been caught serving malware / malicious ads numerous times, IIRC. Here are a couple incidents I found with a quick search: https://www.wired.com/2010/12/doubleclick/ https://www.wired.com/2010/12/doubleclick/ https://www.fastcompany.com/3062867/overlay-malware-google-adsense https://www.fastcompany.com/3062867/overlay-malware-google-a...

by crtasm 8y ago

dmortin 8y ago

How is it different when ads are served from server side? Most sites (especially smaller ones) would still use an ad network, because they don't have their own resources to find advertisers, which it calls from server side to retrieve the ad. And when the retireved ad code is injected into the page on server side it could still lead to some malicious site or whatever.

TeMPOraL 8y ago
I suppose it would be easier to sue such site's operator, as malware is suddenly served directly from first-party. Thus, creating a strong incentive for site operators to actually curate their ad experience, instead of subscribing to whatever network is most profitable any given day.
- dmortin 8y ago
  So this would again hurt the little guys (blogs, forums, smaller sites managed by 1 or 2 people) who don't have the capacity to find advertisers and curate ads, and for this reason, have to use an ad network. The big sites, facebook and co. can easily do some curation and find advertisers, so as it was mentioned before these changes would only eliminate the small players while further concentrating the web into the hands of the big guys.
  - acdha 8y ago
    It already does. This would increase the incentive not to switch to some claiming to offer slightly higher payouts and hope that they’re not cutting corners.
  - Kalium 8y ago
    If your question is "Are we as a society willing to sacrifice the income of some small sites to keep users from being infected and having their privacy invaded?", then you may wish to contemplate the possibility that a lot of people might just say "Yes".
    - dmortin 8y ago
      No, the question is: do we want more and more content concentrated into the hands of big players, eliminating little, independent publishers? Do we want this? If the answer is no then there must be a feasible, scalable alternative for small players before we eliminate the current ad based model, otherwise the little guys will die and all we have will be huge media sites pushing their own agendas without small, independent publishers having a chance of standing up to them. That is the dilemma.
      - Kalium 8y ago
        > No, the question is: do we want more and more content concentrated into the hands of big players, eliminating little, independent publishers? Do we want this? Herein lies the catch: you have correctly and properly identified a potential side-effect. The question, I think, is this: how many users and how much privacy are we willing to sacrifice for this precious, wonderful, beloved, amazing side-effect? I know my answer, and I see no dilemma at all. The horrific outcome you so rightly point to is not an ideal outcome, in isolation. At the same time, there's never a guarantee that there must be some convenient alternative. The wish for a thing does not conjure it into being, or even prove that it is possible. And in this case, some might decide that our beloved side-effect isn't as important as some other things. Though I understand if some prefer to see the security and privacy of users as something to be traded off against for financial convenience.
        dmortin 8y ago
        The danger of possible outlets for alternative voices controlled more and more by big corporations is at least as bad as the privacy implications. So there must be a tradeoff if we wan't privacy, but we also want to have publishing outlets independent of big corporations. There is currently no perfect solution where we can have total privacy and also little publishers can sustain themselves. I'm saying that we must find a balance where we have some of both. Having 100% of one while giving up the other is not the answer.

manigandham 8y ago

Yes, there are networks that have always remained clean. It's a business problem more than technical. But the topic was smaller sites running 3rd party networks which necessarily only integrate via client-side JS. That has nothing to do with what kind of ads are being run. It's the same exact ad calls to the ad exchanges, just done via HTTP from the server rather than JS in the browser.

michaelt 8y ago
You can't virus-scan an e-mail that doesn't pass through your server. How would you inspect javascript that doesn't pass through your server? Or do you have to just get a bit of paper from the ad network saying they won't make any mistakes, then take their word for it without any way of auditing their claim?
- manigandham 8y ago
  That's not how it works. The payload is dynamic javascript. Just because you make some calls on the server-side doesn't mean you can inspect the payload with any real reliability, and if it was that easy then it would already be done by the ad exchanges who send the payloads in the first place. There is an entire inner industry around security and malware for programmatic ads, with a few companies that are pretty good at it, but it is not something that can just run as a simple server for any small publisher to deploy.
acdha 8y ago
> there are networks that have always remained clean Can you name them? The major ones have had persistent failures which make me think this is more due to not being targeted or being some of the niche networks like The Deck which didn’t have capacity to scale up.

908087 8y ago

Google has been caught serving malware / malicious ads numerous times, IIRC. Here are a couple incidents I found with a quick search: https://www.wired.com/2010/12/doubleclick/ https://www.wired.com/2010/12/doubleclick/ https://www.fastcompany.com/3062867/overlay-malware-google-adsense https://www.fastcompany.com/3062867/overlay-malware-google-a...