6 ms·

I’m amazed that web sites still let ads run arbitrary scripts. Serve and image and/or some text along with a link and call it done. If interactivity is somehow

I’m amazed that web sites still let ads run arbitrary scripts. Serve and image and/or some text along with a link and call it done. If interactivity is somehow really necessary, define a few templates and allow no deviation from them. But I guess these sites would rather just continue to be a conduit for screwing with their viewers.

paultopia 8y ago
This. It seems like the default model for ad impressions is just "run whatever you want, go wild." Untrusted code? SURE! Ads for blatantly fraudulent product? PARTY TIME! Even more basic shadiness is astonishingly rampant---I recently made the mistake of opening a well-known and very stuffy academic blog with countless daily visitors from a browser not stuffed full of ad blockers, and immediately got a half-naked Ashley Madison ad on my work machine. What we need is some third-party intermediary to screen, not the ads, but the sites hosting the ads---some kind of certification authority that says "this is a list of websites that don't allow people to run untrusted code or scams," and then allows users to block everything else by default.
- antsar 8y ago
  Certification sounds good until a major "certified" site goes rogue (or gets hacked) and hosts malware. Then everyone who trusted the "adblock except certified sites" premise gets burned, and reverts to regular adblock.
ChrisSD 8y ago
Outbrain does this. People hate Outbrain.
- function_seven 8y ago
  Do people hate Outbrain because Outbrain does this? Or is it due to the nature of their ads? (I'm assuming we're talking about the "Around the Web" chum boxes, right?)
  - ChrisSD 8y ago
    Yep the hate is probably for the type of machine generated click bait content that ends up on there. But other than that they do advertising right. Each ad is a picture, some text and a link. All hosted by Outbrain.
sourthyme 8y ago
Why aren't these ad scripts sandboxed? I thought you can't have arbitrary code from cross site domains have access.
- eliya_confiant 8y ago
  The industry is moving in a direction where more and more ads will be sandboxed, we are just not there quite yet.
- dmux 8y ago
  They often are sandboxed within an iframe element: (https://www.iab.com/guidelines/safeframe/ https://www.iab.com/guidelines/safeframe/)
- pmoriarty 8y ago
  Why do ads need to contain code at all? Why not limit them to just static images?
- tinus_hn 8y ago
  Because that’s not how the web works. There is only one sandbox per frame and all code in that frame is in the same sandbox. It doesn’t make much sense to do it differently because JavaScript can modify the behavior of the built in objects and thus that of other scripts in the same environment.
- Macha 8y ago
  Because the advertisers want to be able to load it with scripts to track stuff like viewability, fraud etc., and since they have the money they ultimately have the power.
ddebernardy 8y ago
> Serve and image and/or some text along with a link and call it done. I'm amazed too. But I'm also fairly certain publishers would love to do that. It's just not as practical as you make it sound. (And frankly, if you do come up with a solution for this, by all means reach out and let's bring it to the ad tech market; we'll rapidly make a fortune.) For starters, how do you deal with ad fraud? What do you do with fraudulent sites that e.g. stack dozens of ads on top of each other so they all count as views? Or those that have zombie devices replay actual site visits and ad clicks? Or those that have toolbars replace ads with something else? Picture an EasyJet special offer popping up in the middle of your screen as you're pulling out your CC to book a ticket on RyanAir. This type of stuff happens; many times without the offending company even knowing how its ads got served to a zombie device. Companies lose billions per year to ad fraud. It's an enormous problem. Whether it's PPV (ad stacking), PPC (click bots), or PPA (CC fraud), you need some sort of tracking to weed out fraud. And then there's the logistics of the whole thing. In theory there are more user-friendly ways to market and serve ads than real time bidding platforms. In practice, not so much. Apple tried to sell vetted ads at one point with a direct sales force to interact with relevant brands; it miserably failed. Similarly, there used to be a rather high quality ad network that ran image/text-only ads on Daring Fireball and a bunch of other sites; it eventually shut down. Selling your own ads is a non-starter unless you've a large audience already. So the truth is, and for better or worse, the simpler and cheaper way to buy and sell ads may very well be RTB for the foreseeable future.
- karmelapple 8y ago
  How about not pay per impression?
  - ddebernardy 8y ago
    Well, speaking as a marketer, I'd beg to ask what you're selling me if you're unable to show me what I'm getting for my ad spend. If I'm worrying about branding for a large company, then yeah, perhaps I'd happily pay for billboard ads, TV ads, radio ads, or some placement on a high traffic website. More realistically I'm working with an SMB and when they pay a few thousands on ads they want to know their ROI so they can decide if it's moving the needle or not. Also, PPC and PPA are what SMBs prefer to buy. PPV only holds its ground when used for brand recognition purposes, with the caveat that it's hilariously easy for fraudulent publishers to stack ads on top of each other and get away with it.

paultopia 8y ago

This. It seems like the default model for ad impressions is just "run whatever you want, go wild." Untrusted code? SURE! Ads for blatantly fraudulent product? PARTY TIME! Even more basic shadiness is astonishingly rampant---I recently made the mistake of opening a well-known and very stuffy academic blog with countless daily visitors from a browser not stuffed full of ad blockers, and immediately got a half-naked Ashley Madison ad on my work machine. What we need is some third-party intermediary to screen, not the ads, but the sites hosting the ads---some kind of certification authority that says "this is a list of websites that don't allow people to run untrusted code or scams," and then allows users to block everything else by default.

antsar 8y ago
Certification sounds good until a major "certified" site goes rogue (or gets hacked) and hosts malware. Then everyone who trusted the "adblock except certified sites" premise gets burned, and reverts to regular adblock.

ChrisSD 8y ago

Outbrain does this. People hate Outbrain.

function_seven 8y ago
Do people hate Outbrain because Outbrain does this? Or is it due to the nature of their ads? (I'm assuming we're talking about the "Around the Web" chum boxes, right?)
- ChrisSD 8y ago
  Yep the hate is probably for the type of machine generated click bait content that ends up on there. But other than that they do advertising right. Each ad is a picture, some text and a link. All hosted by Outbrain.

sourthyme 8y ago

Why aren't these ad scripts sandboxed? I thought you can't have arbitrary code from cross site domains have access.

eliya_confiant 8y ago
The industry is moving in a direction where more and more ads will be sandboxed, we are just not there quite yet.
dmux 8y ago
They often are sandboxed within an iframe element: (https://www.iab.com/guidelines/safeframe/ https://www.iab.com/guidelines/safeframe/)
pmoriarty 8y ago
Why do ads need to contain code at all? Why not limit them to just static images?
tinus_hn 8y ago
Because that’s not how the web works. There is only one sandbox per frame and all code in that frame is in the same sandbox. It doesn’t make much sense to do it differently because JavaScript can modify the behavior of the built in objects and thus that of other scripts in the same environment.
Macha 8y ago
Because the advertisers want to be able to load it with scripts to track stuff like viewability, fraud etc., and since they have the money they ultimately have the power.

ddebernardy 8y ago

> Serve and image and/or some text along with a link and call it done. I'm amazed too. But I'm also fairly certain publishers would love to do that. It's just not as practical as you make it sound. (And frankly, if you do come up with a solution for this, by all means reach out and let's bring it to the ad tech market; we'll rapidly make a fortune.) For starters, how do you deal with ad fraud? What do you do with fraudulent sites that e.g. stack dozens of ads on top of each other so they all count as views? Or those that have zombie devices replay actual site visits and ad clicks? Or those that have toolbars replace ads with something else? Picture an EasyJet special offer popping up in the middle of your screen as you're pulling out your CC to book a ticket on RyanAir. This type of stuff happens; many times without the offending company even knowing how its ads got served to a zombie device. Companies lose billions per year to ad fraud. It's an enormous problem. Whether it's PPV (ad stacking), PPC (click bots), or PPA (CC fraud), you need some sort of tracking to weed out fraud. And then there's the logistics of the whole thing. In theory there are more user-friendly ways to market and serve ads than real time bidding platforms. In practice, not so much. Apple tried to sell vetted ads at one point with a direct sales force to interact with relevant brands; it miserably failed. Similarly, there used to be a rather high quality ad network that ran image/text-only ads on Daring Fireball and a bunch of other sites; it eventually shut down. Selling your own ads is a non-starter unless you've a large audience already. So the truth is, and for better or worse, the simpler and cheaper way to buy and sell ads may very well be RTB for the foreseeable future.

karmelapple 8y ago
How about not pay per impression?
- ddebernardy 8y ago
  Well, speaking as a marketer, I'd beg to ask what you're selling me if you're unable to show me what I'm getting for my ad spend. If I'm worrying about branding for a large company, then yeah, perhaps I'd happily pay for billboard ads, TV ads, radio ads, or some placement on a high traffic website. More realistically I'm working with an SMB and when they pay a few thousands on ads they want to know their ROI so they can decide if it's moving the needle or not. Also, PPC and PPA are what SMBs prefer to buy. PPV only holds its ground when used for brand recognition purposes, with the caveat that it's hilariously easy for fraudulent publishers to stack ads on top of each other and get away with it.