7 ms·

It’s completely insane. Can you imagine a TV station receiving ads on tapes and playing them to their audience without looking at them first? Can you imagine TV

It’s completely insane. Can you imagine a TV station receiving ads on tapes and playing them to their audience without looking at them first? Can you imagine TV stations occasionally showing ads containing porn, urging people to kill, showing extreme violence during cartoons, or containing specially crafted audio that blows out your speakers, and the TV station just shrugs and says they try their best to stop these things but they can’t stop everything? Imagine a TV ad that tries to make your phone call a 1-900 number so they can rip you off, and the station says they don’t know where it came from but they’re trying real hard to put a stop to it. And somehow watching the ads themselves before broadcasting them never crosses their mind.

manigandham 7y ago
Tv spots are very limited. Digital ad impressions number in the billions with 10s of millions of ad creatives. It’s not the same situation.
- mikeash 7y ago
  The only reason it’s not the same situation is because they’re willing to throw their users under the bus for a little extra cash. If they wanted to exert more control, they absolutely could. Ads would cost more and we’d see fewer distinct ads as a result.
  - manigandham 7y ago
    That is absolutely not the only reason. Digital ads work entirely different from the TV medium and its more than "a little extra cash". No single publisher today really has the power to change much, no matter how big they are. The issue likes with adtech (like Google) and advertisers.
    - mikeash 7y ago
      Digital ads could work where every single one is vetted by people before it’s served to any users. There is no reason it can’t work this way, other than it being a lot cheaper to skip that step.
      - manigandham 7y ago
        All creatives (and the root templates of dynamically construted ones) are actually audited on the advertiser-facing platforms before they ever get to the publisher. Unfortunately running javascript means these ads can do anything at any time and change into malware. Other than adding some technical guardrails, the best practice would be to ban bad actors (of which many are known and usually the same shady people) but many large adtech companies look the other way because it makes money and they have no consequences. Malware and adfraud is primarily a business problem, not a technical one.
        mikeash 7y ago
        So, don't allow them to run JavaScript. That's not necessary, just convenient.
        manigandham 7y ago
        See my other comment for how it all works: https://news.ycombinator.com/item?id=20290673 https://news.ycombinator.com/item?id=20290673 It's not that simple. There are many layers in the supply chain that currently requires JS. Publishers can't disable the JS and they can't demand JS-free creatives either.
        mikeash 7y ago
        Of course it’s that simple. Don’t let ads run JS. Done. You’re saying that doing this would drastically decrease ad revenue. Which is what I’m saying too: it’s about money, not necessity. Would a site like SO be unable to survive without ads that run arbitrary JS? I don’t know. Even if the answer is that they must do this to survive, it’s still insane that content companies let randos inject arbitrary code into their pages. If this is so entrenched in the industry that there’s no way around it, that just means the industry is insane.
        manigandham 7y ago
        Money is a necessity, that's how SO exists, and it wouldn't sustain its current size if it required JS-free network campaigns or tried to sell all ad space directly. Simple doesn't mean it's easy or realistic. Yes, adtech has major problems but they're being slowly worked on and won't change overnight. This applies to any other industry where you think can just walk in and solve everything if everyone just did X. Reality doesn't work that way.
    - pushpop 7y ago
      Yet adverts on porn sites do operate as per our wish list: * adverts are vetted by a human * adverts are not allowed to inject JavaScript. There have been a few interesting blog posts from businesses outside of the adult entertainment industry where they discuss just how work is involved in getting an advert approved on adult sites. It’s a sad state of affairs when an adblocker is less required on porn sites than it is on Stack Overflow.
      - manigandham 7y ago
        All major ad networks audit every single creative. The problem is javascript can change at anytime, and the publisher is the most exposed and also the most removed to be able to discover and mitigate. There have been some movements to whitelist the JS providers but volume is incentivized so most networks look the other way for now. Adult ads are definitely not better and are served by even looser networks that allow anything. That industry has pioneered things like popunders, clickjacking, and monetizing every possible action on a window while serving as the primary vector for malware and browser bitcoin mining. I'm not sure what blog posts you've read but the only strict standards they would have is on getting paid.
        pushpop 7y ago
        Like everything, it depends on the sites in question. Disreputable adult sites aren’t going to be any better nor worse than disreputable sites of any other content. However adult sites run as a reputable business - of which there are many - most certainly do follow the points I described earlier. What you’re effectively doing is looking at Source Forge and then arguing that Github, Gitlab and Bitbucket are all probably just as bad.
  - wdr1 7y ago
    Or -- the more expensive ads don't justify the ROI, meaning advertisers don't buy them, meaning fewer ads, but less content.
- simongr3dal 7y ago
  If you can't manage to oversee it because of the scale you don't deserve to take advantage of the scale.
  - manigandham 7y ago
    That sounds nice but is neither realistic or even sensible. There are other solutions like sandboxing to prevent access to features, it's not an unsolvable problem.
- bamboozled 7y ago
  Well I would argue if billions will see the content, that gives more reason to have it checked over before serving no?
  - manigandham 7y ago
    Billions? No single creative is seen by that many. In fact, with dynamic creative optimization (DCO) and all the optimization that happens, you can easily get creatives that are custom generated and only see by a few individuals or even a single person.
    - luckylion 7y ago
      The comment was referencing the parent: Digital ad impressions number in the billions with 10s of millions of ad creatives
      - manigandham 7y ago
        I wrote both comments. There are billions of impressions but a single creative is not seen by that many. The point is that the scale is too large to validate on the publisher side.
        pushpop 7y ago
        It seems to me there are two solutions to this problem: * remove the ability for 3rd parties to abuse their automatic powers (ie disable their ability to inject JavaScript) * or have a human manually vet every creative The problem here is you neither want to control their access nor take responsibility for monitoring their access. So the blame equally lies with yourselves for not managing an easily exploitable vector of attack. If this were any other system, eg VPN, security professionals would tear you a new asshole and point out just how irresponsible your lack of management is. You’re only excuse here is greed and frankly I’m disgusted.
        manigandham 7y ago
koolba 7y ago
I bet you could do that with an ad that plays “Alexa- call 1-900-555-1234”.
josephg 7y ago
It’s worse than that. Imagine a TV ad which sends malicious code that gets executed to your television, which profiles the hardware in your TV and sends information about your viewing habits (tied to a unique ID) back to the advertiser. In any other context we would call this a security vulnerability. I think that label also applies here.
- Spooky23 7y ago
  You don’t need to, it happens already. Many TVs do screen grabs and send everything you do to the manufacturer or partners.
- zeta0134 7y ago
  My Vizio's built-in software tries to do that. There's a reason it's not allowed to connect to wifi.
  - DCoder 7y ago
    When you say "it's not allowed", do you trust its own settings? Are you sure it's not doing something like [0]? How do you even protect against that? [0]: https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choose_to_not_connect_your_samsung_smart/ https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choo...
    - SmellyGeekBoy 7y ago
      Don't buy a "smart" TV?
      - cerebellum42 7y ago
        Isn't every decent TV these days a smart TV? Not exactly practical advice
        neop1x 7y ago
        don't connect smartTV to the internet, juse use the DP/HDMI inout ;)
baroffoos 7y ago
The state of web ads is closer to the public pinboard only instead of having ads for grandmas couch its Mr CEO trying every trick to drain your money and track you.

manigandham 7y ago

Tv spots are very limited. Digital ad impressions number in the billions with 10s of millions of ad creatives. It’s not the same situation.

mikeash 7y ago
The only reason it’s not the same situation is because they’re willing to throw their users under the bus for a little extra cash. If they wanted to exert more control, they absolutely could. Ads would cost more and we’d see fewer distinct ads as a result.
- manigandham 7y ago
  That is absolutely not the only reason. Digital ads work entirely different from the TV medium and its more than "a little extra cash". No single publisher today really has the power to change much, no matter how big they are. The issue likes with adtech (like Google) and advertisers.
  - mikeash 7y ago
    Digital ads could work where every single one is vetted by people before it’s served to any users. There is no reason it can’t work this way, other than it being a lot cheaper to skip that step.
    - manigandham 7y ago
      All creatives (and the root templates of dynamically construted ones) are actually audited on the advertiser-facing platforms before they ever get to the publisher. Unfortunately running javascript means these ads can do anything at any time and change into malware. Other than adding some technical guardrails, the best practice would be to ban bad actors (of which many are known and usually the same shady people) but many large adtech companies look the other way because it makes money and they have no consequences. Malware and adfraud is primarily a business problem, not a technical one.
      - mikeash 7y ago
        So, don't allow them to run JavaScript. That's not necessary, just convenient.
        manigandham 7y ago
        See my other comment for how it all works: https://news.ycombinator.com/item?id=20290673 https://news.ycombinator.com/item?id=20290673 It's not that simple. There are many layers in the supply chain that currently requires JS. Publishers can't disable the JS and they can't demand JS-free creatives either.
        mikeash 7y ago
        Of course it’s that simple. Don’t let ads run JS. Done. You’re saying that doing this would drastically decrease ad revenue. Which is what I’m saying too: it’s about money, not necessity. Would a site like SO be unable to survive without ads that run arbitrary JS? I don’t know. Even if the answer is that they must do this to survive, it’s still insane that content companies let randos inject arbitrary code into their pages. If this is so entrenched in the industry that there’s no way around it, that just means the industry is insane.
        manigandham 7y ago
        Money is a necessity, that's how SO exists, and it wouldn't sustain its current size if it required JS-free network campaigns or tried to sell all ad space directly. Simple doesn't mean it's easy or realistic. Yes, adtech has major problems but they're being slowly worked on and won't change overnight. This applies to any other industry where you think can just walk in and solve everything if everyone just did X. Reality doesn't work that way.
  - pushpop 7y ago
    Yet adverts on porn sites do operate as per our wish list: * adverts are vetted by a human * adverts are not allowed to inject JavaScript. There have been a few interesting blog posts from businesses outside of the adult entertainment industry where they discuss just how work is involved in getting an advert approved on adult sites. It’s a sad state of affairs when an adblocker is less required on porn sites than it is on Stack Overflow.
    - manigandham 7y ago
      All major ad networks audit every single creative. The problem is javascript can change at anytime, and the publisher is the most exposed and also the most removed to be able to discover and mitigate. There have been some movements to whitelist the JS providers but volume is incentivized so most networks look the other way for now. Adult ads are definitely not better and are served by even looser networks that allow anything. That industry has pioneered things like popunders, clickjacking, and monetizing every possible action on a window while serving as the primary vector for malware and browser bitcoin mining. I'm not sure what blog posts you've read but the only strict standards they would have is on getting paid.
      - pushpop 7y ago
        Like everything, it depends on the sites in question. Disreputable adult sites aren’t going to be any better nor worse than disreputable sites of any other content. However adult sites run as a reputable business - of which there are many - most certainly do follow the points I described earlier. What you’re effectively doing is looking at Source Forge and then arguing that Github, Gitlab and Bitbucket are all probably just as bad.
- wdr1 7y ago
  Or -- the more expensive ads don't justify the ROI, meaning advertisers don't buy them, meaning fewer ads, but less content.
simongr3dal 7y ago
If you can't manage to oversee it because of the scale you don't deserve to take advantage of the scale.
- manigandham 7y ago
  That sounds nice but is neither realistic or even sensible. There are other solutions like sandboxing to prevent access to features, it's not an unsolvable problem.
bamboozled 7y ago
Well I would argue if billions will see the content, that gives more reason to have it checked over before serving no?
- manigandham 7y ago
  Billions? No single creative is seen by that many. In fact, with dynamic creative optimization (DCO) and all the optimization that happens, you can easily get creatives that are custom generated and only see by a few individuals or even a single person.
  - luckylion 7y ago
    The comment was referencing the parent: Digital ad impressions number in the billions with 10s of millions of ad creatives
    - manigandham 7y ago
      I wrote both comments. There are billions of impressions but a single creative is not seen by that many. The point is that the scale is too large to validate on the publisher side.
      - pushpop 7y ago
        It seems to me there are two solutions to this problem: * remove the ability for 3rd parties to abuse their automatic powers (ie disable their ability to inject JavaScript) * or have a human manually vet every creative The problem here is you neither want to control their access nor take responsibility for monitoring their access. So the blame equally lies with yourselves for not managing an easily exploitable vector of attack. If this were any other system, eg VPN, security professionals would tear you a new asshole and point out just how irresponsible your lack of management is. You’re only excuse here is greed and frankly I’m disgusted.
        manigandham 7y ago

koolba 7y ago

I bet you could do that with an ad that plays “Alexa- call 1-900-555-1234”.

josephg 7y ago

It’s worse than that. Imagine a TV ad which sends malicious code that gets executed to your television, which profiles the hardware in your TV and sends information about your viewing habits (tied to a unique ID) back to the advertiser. In any other context we would call this a security vulnerability. I think that label also applies here.

Spooky23 7y ago
You don’t need to, it happens already. Many TVs do screen grabs and send everything you do to the manufacturer or partners.
zeta0134 7y ago
My Vizio's built-in software tries to do that. There's a reason it's not allowed to connect to wifi.
- DCoder 7y ago
  When you say "it's not allowed", do you trust its own settings? Are you sure it's not doing something like [0]? How do you even protect against that? [0]: https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choose_to_not_connect_your_samsung_smart/ https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choo...
  - SmellyGeekBoy 7y ago
    Don't buy a "smart" TV?
    - cerebellum42 7y ago
      Isn't every decent TV these days a smart TV? Not exactly practical advice
      - neop1x 7y ago
        don't connect smartTV to the internet, juse use the DP/HDMI inout ;)

baroffoos 7y ago

The state of web ads is closer to the public pinboard only instead of having ads for grandmas couch its Mr CEO trying every trick to drain your money and track you.