7 ms·

Why are you allowing arbitrary javascript to be served to your users?

wlesieutre 7y ago
Not just arbitrary JavaScript, arbitrary JavaScript where they can’t easily even see where it came from! Sheesh. Could we require advertisers to sign their ad code to have a trail of where it came from, prevent tampering, and make it easier to pull the plug on bad actors? The people bearing the costs of the internet ad economy aren’t the people in any position to do anything about it. So there’s very little pressure to fix anything. Maybe if the US government started threatening to enact something like GDPR unless the a democratic industry gets its shit together.
- manigandham 7y ago
  Large adtech demand/sell side platforms do not want to remove these bad actors because they make money on percentage of spend. They are incentivized to increase volume and ad spend at all costs, and there is no regulation to stop them from doing otherwise by continuing to deal with shady companies and known malware techniques.
- deleted 7y ago
  [deleted]
nerdponx 7y ago
Wish I could upvote this 1,000 times. It's ridiculous. It's a text-based ad. At worst, it's a clickable image. At what point did it become okay in your minds to let advertisers run arbitrary code? I've left ads turned on specifically on StackOverflow because 1) I want to support StackOverflow, and 2) I trust them not to run malicious ads. I don't even care that they're running ads network-wide. But if they're going to be running these kinds of ads anywhere on the site, they're going right on the ad block list along with everyone else.
- mikeash 7y ago
  It’s completely insane. Can you imagine a TV station receiving ads on tapes and playing them to their audience without looking at them first? Can you imagine TV stations occasionally showing ads containing porn, urging people to kill, showing extreme violence during cartoons, or containing specially crafted audio that blows out your speakers, and the TV station just shrugs and says they try their best to stop these things but they can’t stop everything? Imagine a TV ad that tries to make your phone call a 1-900 number so they can rip you off, and the station says they don’t know where it came from but they’re trying real hard to put a stop to it. And somehow watching the ads themselves before broadcasting them never crosses their mind.
  - manigandham 7y ago
    Tv spots are very limited. Digital ad impressions number in the billions with 10s of millions of ad creatives. It’s not the same situation.
    - mikeash 7y ago
      The only reason it’s not the same situation is because they’re willing to throw their users under the bus for a little extra cash. If they wanted to exert more control, they absolutely could. Ads would cost more and we’d see fewer distinct ads as a result.
      - manigandham 7y ago
        That is absolutely not the only reason. Digital ads work entirely different from the TV medium and its more than "a little extra cash". No single publisher today really has the power to change much, no matter how big they are. The issue likes with adtech (like Google) and advertisers.
        mikeash 7y ago
        Digital ads could work where every single one is vetted by people before it’s served to any users. There is no reason it can’t work this way, other than it being a lot cheaper to skip that step.
runn1ng 7y ago
More money that way
_eht 7y ago
Why are you allowing arbitrary JavaScript to run on your device?
- colanderman 7y ago
  Sites like StackOverflow require JavaScript to work (or at least, to work in a manner approaching interactivity). So, even someone who disables JavaScript normally, would presumably enable it in order to use this popular and useful site. Furthermore – and importantly – they place trust in StackOverflow not to abuse the privilege of executing arbitrary JavaScript. That is an entirely reasonable thing for a technically savvy modern web user to do. By serving this ad with JavaScript not vetted to StackOverflow's presumed standard, StackOverflow has violated that trust. Thus the onus is on them, not the user, to remove the offending ad or risk damaging their brand. Honestly, what you said is like saying "why would you ever not keep a hand on your wallet" after someone got pickpocketed in a nice restaurant. Reasonable people have reasonable expectations of safety in certain places which they trust to provide it for them. No-one should go around being constantly paranoid of pickpockets everywhere, no more than anyone on the web should be constantly paranoid of malicious JavaScript even on sites with established records of safety.
  - DCoder 7y ago
    > So, even someone who disables JavaScript normally, would presumably enable it in order to use this popular and useful site. I agree that StackOverflow is at fault here, but enabling JS is not a binary choice — "allow all JS on this site" vs "block all JS on this site" are not your only options. Tools like uMatrix allow me to control JS coming from different domains on different domains independently. For example, on SO I have enabled JS from Stack Exchange and related domains, but not from Google or other snoopers.
zhangjunphy 7y ago
Revenues are important. The users will not notice unless something happens. And when something happens they forget fast.
m0dest 7y ago
The solution is in sight. It's called Feature Policy. https://feature-policy-demos.appspot.com/ https://feature-policy-demos.appspot.com/ https://developers.google.com/web/updates/2018/06/feature-policy https://developers.google.com/web/updates/2018/06/feature-po...
- lol768 7y ago
  This is not a solution. JS still runs, it just has limited access to certain features. You also need to somehow <iframe> the ad content (and serve it from somewhere else with the feature policy header set/attribute on the iframe set) or else sacrifice use of these features on your own site. The solution is to make the ads inert. They do not need to run code.
Ajedi32 7y ago
I think this comment[1] on the linked Meta question explains it pretty well: > To the people confused why ads need to run their own Javascript (even ones that are just static images): The short answer is that Ad Networks do not and cannot trust website operators. They need to run their own JavaScript served from their own servers in order to verify that a real user saw the ad and for how long, and they can't trust the website operator to tell them. And these pieces of JavaScript tend to be more invasive and privacy-destroying than the website's JS because they care, far more than the actual website does, that the "user" is not a bank of iphones in a sweatshop in China. [1]: https://meta.stackoverflow.com/questions/386487/why-is-stack-overflow-trying-to-start-audio#comment706774_386499 https://meta.stackoverflow.com/questions/386487/why-is-stack...

Not just arbitrary JavaScript, arbitrary JavaScript where they can’t easily even see where it came from! Sheesh. Could we require advertisers to sign their ad code to have a trail of where it came from, prevent tampering, and make it easier to pull the plug on bad actors? The people bearing the costs of the internet ad economy aren’t the people in any position to do anything about it. So there’s very little pressure to fix anything. Maybe if the US government started threatening to enact something like GDPR unless the a democratic industry gets its shit together.

manigandham 7y ago
Large adtech demand/sell side platforms do not want to remove these bad actors because they make money on percentage of spend. They are incentivized to increase volume and ad spend at all costs, and there is no regulation to stop them from doing otherwise by continuing to deal with shady companies and known malware techniques.
deleted 7y ago
[deleted]

nerdponx 7y ago

Wish I could upvote this 1,000 times. It's ridiculous. It's a text-based ad. At worst, it's a clickable image. At what point did it become okay in your minds to let advertisers run arbitrary code? I've left ads turned on specifically on StackOverflow because 1) I want to support StackOverflow, and 2) I trust them not to run malicious ads. I don't even care that they're running ads network-wide. But if they're going to be running these kinds of ads anywhere on the site, they're going right on the ad block list along with everyone else.

mikeash 7y ago
It’s completely insane. Can you imagine a TV station receiving ads on tapes and playing them to their audience without looking at them first? Can you imagine TV stations occasionally showing ads containing porn, urging people to kill, showing extreme violence during cartoons, or containing specially crafted audio that blows out your speakers, and the TV station just shrugs and says they try their best to stop these things but they can’t stop everything? Imagine a TV ad that tries to make your phone call a 1-900 number so they can rip you off, and the station says they don’t know where it came from but they’re trying real hard to put a stop to it. And somehow watching the ads themselves before broadcasting them never crosses their mind.
- manigandham 7y ago
  Tv spots are very limited. Digital ad impressions number in the billions with 10s of millions of ad creatives. It’s not the same situation.
  - mikeash 7y ago
    The only reason it’s not the same situation is because they’re willing to throw their users under the bus for a little extra cash. If they wanted to exert more control, they absolutely could. Ads would cost more and we’d see fewer distinct ads as a result.
    - manigandham 7y ago
      That is absolutely not the only reason. Digital ads work entirely different from the TV medium and its more than "a little extra cash". No single publisher today really has the power to change much, no matter how big they are. The issue likes with adtech (like Google) and advertisers.
      - mikeash 7y ago
        Digital ads could work where every single one is vetted by people before it’s served to any users. There is no reason it can’t work this way, other than it being a lot cheaper to skip that step.

runn1ng 7y ago

More money that way

_eht 7y ago

Why are you allowing arbitrary JavaScript to run on your device?

colanderman 7y ago
Sites like StackOverflow require JavaScript to work (or at least, to work in a manner approaching interactivity). So, even someone who disables JavaScript normally, would presumably enable it in order to use this popular and useful site. Furthermore – and importantly – they place trust in StackOverflow not to abuse the privilege of executing arbitrary JavaScript. That is an entirely reasonable thing for a technically savvy modern web user to do. By serving this ad with JavaScript not vetted to StackOverflow's presumed standard, StackOverflow has violated that trust. Thus the onus is on them, not the user, to remove the offending ad or risk damaging their brand. Honestly, what you said is like saying "why would you ever not keep a hand on your wallet" after someone got pickpocketed in a nice restaurant. Reasonable people have reasonable expectations of safety in certain places which they trust to provide it for them. No-one should go around being constantly paranoid of pickpockets everywhere, no more than anyone on the web should be constantly paranoid of malicious JavaScript even on sites with established records of safety.
- DCoder 7y ago
  > So, even someone who disables JavaScript normally, would presumably enable it in order to use this popular and useful site. I agree that StackOverflow is at fault here, but enabling JS is not a binary choice — "allow all JS on this site" vs "block all JS on this site" are not your only options. Tools like uMatrix allow me to control JS coming from different domains on different domains independently. For example, on SO I have enabled JS from Stack Exchange and related domains, but not from Google or other snoopers.

zhangjunphy 7y ago

Revenues are important. The users will not notice unless something happens. And when something happens they forget fast.

m0dest 7y ago

The solution is in sight. It's called Feature Policy. https://feature-policy-demos.appspot.com/ https://feature-policy-demos.appspot.com/ https://developers.google.com/web/updates/2018/06/feature-policy https://developers.google.com/web/updates/2018/06/feature-po...

lol768 7y ago
This is not a solution. JS still runs, it just has limited access to certain features. You also need to somehow <iframe> the ad content (and serve it from somewhere else with the feature policy header set/attribute on the iframe set) or else sacrifice use of these features on your own site. The solution is to make the ads inert. They do not need to run code.

Ajedi32 7y ago

I think this comment[1] on the linked Meta question explains it pretty well: > To the people confused why ads need to run their own Javascript (even ones that are just static images): The short answer is that Ad Networks do not and cannot trust website operators. They need to run their own JavaScript served from their own servers in order to verify that a real user saw the ad and for how long, and they can't trust the website operator to tell them. And these pieces of JavaScript tend to be more invasive and privacy-destroying than the website's JS because they care, far more than the actual website does, that the "user" is not a bank of iphones in a sweatshop in China. [1]: https://meta.stackoverflow.com/questions/386487/why-is-stack-overflow-trying-to-start-audio#comment706774_386499 https://meta.stackoverflow.com/questions/386487/why-is-stack...