4 ms·

This has been happening for so long that it's hard to believe Microsoft is not aware of it.

by natuz 8y ago

ocdtrekkie 8y ago
Given the malware Google's ads also ship, which Googlers here on HN have tried to have removed only to return an hour later, suffice to say malicious ads are an industry pervasive problem, and the solution is to kill the online advertising market. Aggressively. In fact, when I tried to look for a specific class of malicious ads (looking for "mapquest") recently, DuckDuckGo was even as bad as Google, it was Bing who gave the least malicious results. But obviously they've failed here. Automated advertising platforms have been overrun by malware and no automated solutions are going to fix it.
- derekp7 8y ago
  One solution that would go part way there is signed for browsers to only run signed javascript when it originates off site. Common libraries that are distributed via CDNs can be signed, and any javascript that ships with ads would have to be signed too. And any CA that signs too many malware (too many meaning more than one) gets their cert revoked.
- jamieweb 8y ago
  Nowadays it's impossible to support the creators you enjoy online by whitelisting ads without exposing your device to multiple megabytes of untrusted, vulnerability-filled JS and iFrames with links off to malware sites. I think that the sponsorship model many YouTubers use these days works really well, because there isn't any code involved that I have to run.
  - ocdtrekkie 8y ago
    Yeah, there's a few YouTube creators and a few coders I've added to Patreon from time to time. I'd much rather toss someone a dollar a month than watch a dollar worth of ads, where 70 cents goes to a FAANG company.
  - matt4077 8y ago
    I don't remember "untrusted JS" being any sort of problem in the last, say, 10 years? Now I'm sure you can dig up some vulnerabilities, and a select few of them may even had (remote) exploits. But I've never run into any problems, and I'm not especially careful, have been around the seedy underbelly of the web, and don't run any anti-virus. Just not clicking on any .exe that suddenly downloads seems to be enough. Being on MacOS rather than Windows may also help, although as far as I can tell, security on Windows today is also far far better than it was a decade or so ago. Considering all that, I can't shake the suspicion that people complaining about JS vulnerabilities to defend their use of ad blockers are just searching for justification.
    - bad_user 8y ago
      Obviously. Which is why we also have browser extensions that work around paywalls. People are cheap and don’t want to pay for content, it’s as simple as that.
    - jamieweb 8y ago
      Try visiting a popular tabloid news website and use the dev tools to see where it is loading content from. The number of horrendous tracking/ads/spam domains you'll see rushing by is unbelievable.
    - clarry 8y ago
      Not "JS vulnerabilities", but things that waste memory & cpu cycles and in worst case exploit your PC for things like bitcoin mining. Also consider that most browser vulnerabilities -- not "JS vulnerabilities" -- are virtually impossible to exploit without JS.
- joshuamorton 8y ago
  Just FYI, that ad you're talking about appears to really, truly be gone now. Im not sure why it reappeared, but I didn't need to take any other action for it to be removed.
  - ocdtrekkie 8y ago
    FYI, just screenshot after reading this comment: https://imgur.com/a/zZCcXc2 https://imgur.com/a/zZCcXc2 Malicious ads pretending to be MapQuest remain alive and well. After pausing my Pi-hole, I can confirm that it refuses to actually provide directions when asked, and promptly tries to add an extension to my web browser. Part of the problem with ad platforms like these (including Bing's), is even if you report one and take it down, it's trivial for the same people to stand up the same website on a different cloud server with a slightly different domain name and do it again. Notes: - My sole extension not made by Mozilla itself is the EFF's Privacy Badger. I also use Firefox Multi-Account Containers and the Facebook Container, both first party. - Do recall that advertisers can target users by a variety of variables (browser, location, etc.), your ad experience does not reflect everyone else's ad experience.
    - joshuamorton 8y ago
      That's very peculiar. I was running in incognito with no adblock, and checked across multiple devices and multiple internet connections, so you seem to be uniquely affected.
      - greglindahl 8y ago
        That's not peculiar at all. Different people see different ads, individual ads run out of budget, new ads are added, and so on.
      - 43920 8y ago
        I can see them as well: https://imgur.com/a/2r3NW8i https://imgur.com/a/2r3NW8i. Maybe it's location-dependent?
not_kurt_godel 8y ago
I'm sure they're aware of it and 'intend' to fix it, but given the often consumer-hostile tactics MSFT is fond of using to shove Bing, Edge, and other products down users' throats, and the fact that this issue, in its current form, happens to align with those goals, I wouldn't be surprised to learn it's not being treated as high priority.

This has been happening for so long that it's hard to believe Microsoft is not aware of it.

by natuz 8y ago

This has been happening for so long that it's hard to believe Microsoft is not aware of it.

Given the malware Google's ads also ship, which Googlers here on HN have tried to have removed only to return an hour later, suffice to say malicious ads are an industry pervasive problem, and the solution is to kill the online advertising market. Aggressively. In fact, when I tried to look for a specific class of malicious ads (looking for "mapquest") recently, DuckDuckGo was even as bad as Google, it was Bing who gave the least malicious results. But obviously they've failed here. Automated advertising platforms have been overrun by malware and no automated solutions are going to fix it.

derekp7 8y ago
One solution that would go part way there is signed for browsers to only run signed javascript when it originates off site. Common libraries that are distributed via CDNs can be signed, and any javascript that ships with ads would have to be signed too. And any CA that signs too many malware (too many meaning more than one) gets their cert revoked.
jamieweb 8y ago
Nowadays it's impossible to support the creators you enjoy online by whitelisting ads without exposing your device to multiple megabytes of untrusted, vulnerability-filled JS and iFrames with links off to malware sites. I think that the sponsorship model many YouTubers use these days works really well, because there isn't any code involved that I have to run.
- ocdtrekkie 8y ago
  Yeah, there's a few YouTube creators and a few coders I've added to Patreon from time to time. I'd much rather toss someone a dollar a month than watch a dollar worth of ads, where 70 cents goes to a FAANG company.
- matt4077 8y ago
  I don't remember "untrusted JS" being any sort of problem in the last, say, 10 years? Now I'm sure you can dig up some vulnerabilities, and a select few of them may even had (remote) exploits. But I've never run into any problems, and I'm not especially careful, have been around the seedy underbelly of the web, and don't run any anti-virus. Just not clicking on any .exe that suddenly downloads seems to be enough. Being on MacOS rather than Windows may also help, although as far as I can tell, security on Windows today is also far far better than it was a decade or so ago. Considering all that, I can't shake the suspicion that people complaining about JS vulnerabilities to defend their use of ad blockers are just searching for justification.
  - bad_user 8y ago
    Obviously. Which is why we also have browser extensions that work around paywalls. People are cheap and don’t want to pay for content, it’s as simple as that.
  - jamieweb 8y ago
    Try visiting a popular tabloid news website and use the dev tools to see where it is loading content from. The number of horrendous tracking/ads/spam domains you'll see rushing by is unbelievable.
  - clarry 8y ago
    Not "JS vulnerabilities", but things that waste memory & cpu cycles and in worst case exploit your PC for things like bitcoin mining. Also consider that most browser vulnerabilities -- not "JS vulnerabilities" -- are virtually impossible to exploit without JS.
joshuamorton 8y ago
Just FYI, that ad you're talking about appears to really, truly be gone now. Im not sure why it reappeared, but I didn't need to take any other action for it to be removed.
- ocdtrekkie 8y ago
  FYI, just screenshot after reading this comment: https://imgur.com/a/zZCcXc2 https://imgur.com/a/zZCcXc2 Malicious ads pretending to be MapQuest remain alive and well. After pausing my Pi-hole, I can confirm that it refuses to actually provide directions when asked, and promptly tries to add an extension to my web browser. Part of the problem with ad platforms like these (including Bing's), is even if you report one and take it down, it's trivial for the same people to stand up the same website on a different cloud server with a slightly different domain name and do it again. Notes: - My sole extension not made by Mozilla itself is the EFF's Privacy Badger. I also use Firefox Multi-Account Containers and the Facebook Container, both first party. - Do recall that advertisers can target users by a variety of variables (browser, location, etc.), your ad experience does not reflect everyone else's ad experience.
  - joshuamorton 8y ago
    That's very peculiar. I was running in incognito with no adblock, and checked across multiple devices and multiple internet connections, so you seem to be uniquely affected.
    - greglindahl 8y ago
      That's not peculiar at all. Different people see different ads, individual ads run out of budget, new ads are added, and so on.
    - 43920 8y ago
      I can see them as well: https://imgur.com/a/2r3NW8i https://imgur.com/a/2r3NW8i. Maybe it's location-dependent?

not_kurt_godel 8y ago

I'm sure they're aware of it and 'intend' to fix it, but given the often consumer-hostile tactics MSFT is fond of using to shove Bing, Edge, and other products down users' throats, and the fact that this issue, in its current form, happens to align with those goals, I wouldn't be surprised to learn it's not being treated as high priority.