13 ms·

Agree. I’d go as far as forbidding embedded JS altogether which removes the attack vector for malware within advertising networks. The networks have proved time

Agree. I’d go as far as forbidding embedded JS altogether which removes the attack vector for malware within advertising networks. The networks have proved time and time again they are not able to prevent distribution of malware, and this is the primary reason I use an adblocker. Maybe a new <ad /> tag which points to a resource which can only serve an image, video or text. Absolutely no scripting. Pass along only the advertiser ID and the bare minimum. The problem is it’s not in Google or Microsoft’s interest to implement this. This has to come from legislation at US gov level. So it’ll never happen. I’ll continue ad blocking.

zrm 7y ago
Another possibility would be to create ad blockers that do that, i.e. block third party javascript but not pure text or images. Then you get the same result, simple ads get through but ad scripts don't, so the people who use ads without scripts are the only ones who make money from them.
- galangalalgol 7y ago
  umatrix does that, but third party is the problem. so many domains put their js on a separate domain. even if they own it.
  - SXX 7y ago
    There also websites that use CDN like CloudFront and sometimes their subdomains are changing quite often.
- TazeTSchnitzel 7y ago
  It's for this sort of reason that I like Privacy Badger. It tries to block tracking and trackers algorithmically, rather than ads per se.
- a1369209993 7y ago
  Such a ad blocker already exists; it's called NoScript.
  - TheKarateKid 7y ago
    Ad blockers block specific things - NoScript blocks all JS. It’s really not an acceptable alternative.
- klez 7y ago
  Blocking third party JavaScript will have the unwanted consequence of blocking CDNs as well, so at least you need some whitelist that allows those scripts.
  - TylerE 7y ago
    Which rather defeats the alleged purpose - you know ever CDN is monetizing your data.
- distances 7y ago
  I think it's too late for that. I, for one, wouldn't enable even static ads anymore even if my blocker offered the option. The trust is completely lost and would take a long time to rebuild.
jefftk 7y ago
> Maybe a new <ad /> tag which points to a resource which can only serve an image, video or text. Absolutely no scripting. Pass along only the advertiser ID and the bare minimum. How would fraud detection work in this model? How do advertisers know the requests are coming from real users and not bots? Without assurance there, advertisers would pay much less, and publishers would earn much less. (Disclosure: I work on ads at Google, speaking only for myself.)
- deanclatworthy 7y ago
  Good point. I guess it’d kill PPC. I’m not sure how advertisers detect fraud but maybe you can check the limited info sent along with the request and do whatever heuristics you do as usual.
- jrimbault 7y ago
  You don't ? And you get paid less by click but you also have more clicks ? (also cf NYT) This way you also avoid the arms race between ad networks, ad blockers and clickbot farms.
- wybiral 7y ago
  You can make the same argument about podcasts, television, radio, magazines, billboards, etc. At some point you rely on statistics that someone is giving you in all of those mediums but they still made money. I've personally made much more money producing content (YouTube and podcasts) by directly working with brands than I ever have from Adsense anyway so I'm not convinced that the advertisers "paying more" is helping content creators much to begin with. Patreon seems to be a symptom of that. Edit: Also, on the subject of advertisers paying less. Isn't part of the problem the fact that adtech giants like Google are saying "look, we have this awesome tracking and targeting tech so you can pay less for ads to reach your target audience". Thus reducing the potential ad money that those people would pay into potential revenue for content creators to reach their audience?
  - HeWhoLurksLate 7y ago
    Patron seems to be a symptom of that Wouldn't Patreon be more an indicator of said symptopms? I hate English sometimes, and its my native language.
clairity 7y ago
good idea! your ad tag is exactly the type of compromise we’ve been asking for since the web (and online ads) became a thing: first-party-served ads with only basic first-party analytics and clear delineation of the ads. unfortunately competition happens around targeting, segmentation, and conversion, which pushes us way past that.
tossAfterUsing 7y ago
> as far as forbidding embedded JS altogether I do this on my iOS device. It's a bit of a pain to not have JS enabled in safari, but I can always share a page from Safari --> Duckduckgo's browser which i have installed for just such occasions. Settings > Safari > Advanced > Javascript off
- acdha 7y ago
  Possibly the best feature of the Brave browser is having that be one tap away, remembered per-site. I really wish Firefox would copy it since I’m not optimistic about Brave’s longevity.
  - ddalex 7y ago
    Try the umatrix extension
    - earenndil 7y ago
      Doesn't work on ios.
      - 18pfsmt 7y ago
        This is true. uMatrix's interface is difficult even where it works on Android. This calls for custom firewall rules and/or Privoxy. https://en.wikipedia.org/wiki/Privoxy https://en.wikipedia.org/wiki/Privoxy
    - 18pfsmt 7y ago
      Applicable link: https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
    - acdha 7y ago
      I should have been more specific that I wanted it on iOS, too. That’s a good option for desktop and worth mentioning.
  - 7y ago
gnicholas 7y ago
One issue I’ve run into with blocking JS at the browser level is that it also ends up blocking extensions that use JS from working. I would block JS on websites much more if my extensions that use JS could still run. I don’t suppose there’s a config setting in Chrome that discriminates between the website’s JS and the JS from my extensions?
- schma 7y ago
  You can use NoScript to control which domains you want content loaded from and what type.
  - dredmorbius 7y ago
    It's often necessary to allow same-host scripts for extensions or bookmarklets to work. Those some-host scrips are often a considerable part of the problem.
HenryBemis 7y ago
That would imply ethical (actual) use of this tag. I cannot thing that any advertiser would ad this, just as they ignore the "Do not track". I fear that we will never we able to rely on the ad-makers honesty, as the hunt for the bottom-line never ends. It looks like this will be a war we will continue fighting with AdB+, NoScript, uBlock(s), hosts, and other tools. It has been a cat and mouse game. The tech changes, but the game goes on.
- greycol 7y ago
  Sure but then it becomes much more morally/ethically easy to justify running ad blockers (while allowing <ad/> through). Hell at that stage Mozilla could probably justify rolling ad blocking lists in as a default as long as they allow the labeled ads through. As you say the game will go on but maybe it the will be a more pleasant one to play.
tim333 7y ago
>forbidding embedded JS altogether which removes the attack vector for malware The more worrying ones I've seen don't rely on JS but are just links to bad sites. Downloading software can be a bit ridiculous these days with alongside the main download button about five ads saying "Download Now" linking to god knows what iffy software.

zrm 7y ago

Another possibility would be to create ad blockers that do that, i.e. block third party javascript but not pure text or images. Then you get the same result, simple ads get through but ad scripts don't, so the people who use ads without scripts are the only ones who make money from them.

galangalalgol 7y ago
umatrix does that, but third party is the problem. so many domains put their js on a separate domain. even if they own it.
- SXX 7y ago
  There also websites that use CDN like CloudFront and sometimes their subdomains are changing quite often.
TazeTSchnitzel 7y ago
It's for this sort of reason that I like Privacy Badger. It tries to block tracking and trackers algorithmically, rather than ads per se.
a1369209993 7y ago
Such a ad blocker already exists; it's called NoScript.
- TheKarateKid 7y ago
  Ad blockers block specific things - NoScript blocks all JS. It’s really not an acceptable alternative.
klez 7y ago
Blocking third party JavaScript will have the unwanted consequence of blocking CDNs as well, so at least you need some whitelist that allows those scripts.
- TylerE 7y ago
  Which rather defeats the alleged purpose - you know ever CDN is monetizing your data.
distances 7y ago
I think it's too late for that. I, for one, wouldn't enable even static ads anymore even if my blocker offered the option. The trust is completely lost and would take a long time to rebuild.

jefftk 7y ago

> Maybe a new <ad /> tag which points to a resource which can only serve an image, video or text. Absolutely no scripting. Pass along only the advertiser ID and the bare minimum. How would fraud detection work in this model? How do advertisers know the requests are coming from real users and not bots? Without assurance there, advertisers would pay much less, and publishers would earn much less. (Disclosure: I work on ads at Google, speaking only for myself.)

deanclatworthy 7y ago
Good point. I guess it’d kill PPC. I’m not sure how advertisers detect fraud but maybe you can check the limited info sent along with the request and do whatever heuristics you do as usual.
jrimbault 7y ago
You don't ? And you get paid less by click but you also have more clicks ? (also cf NYT) This way you also avoid the arms race between ad networks, ad blockers and clickbot farms.
wybiral 7y ago
You can make the same argument about podcasts, television, radio, magazines, billboards, etc. At some point you rely on statistics that someone is giving you in all of those mediums but they still made money. I've personally made much more money producing content (YouTube and podcasts) by directly working with brands than I ever have from Adsense anyway so I'm not convinced that the advertisers "paying more" is helping content creators much to begin with. Patreon seems to be a symptom of that. Edit: Also, on the subject of advertisers paying less. Isn't part of the problem the fact that adtech giants like Google are saying "look, we have this awesome tracking and targeting tech so you can pay less for ads to reach your target audience". Thus reducing the potential ad money that those people would pay into potential revenue for content creators to reach their audience?
- HeWhoLurksLate 7y ago
  Patron seems to be a symptom of that Wouldn't Patreon be more an indicator of said symptopms? I hate English sometimes, and its my native language.

clairity 7y ago

good idea! your ad tag is exactly the type of compromise we’ve been asking for since the web (and online ads) became a thing: first-party-served ads with only basic first-party analytics and clear delineation of the ads. unfortunately competition happens around targeting, segmentation, and conversion, which pushes us way past that.

tossAfterUsing 7y ago

> as far as forbidding embedded JS altogether I do this on my iOS device. It's a bit of a pain to not have JS enabled in safari, but I can always share a page from Safari --> Duckduckgo's browser which i have installed for just such occasions. Settings > Safari > Advanced > Javascript off

acdha 7y ago
Possibly the best feature of the Brave browser is having that be one tap away, remembered per-site. I really wish Firefox would copy it since I’m not optimistic about Brave’s longevity.
- ddalex 7y ago
  Try the umatrix extension
  - earenndil 7y ago
    Doesn't work on ios.
    - 18pfsmt 7y ago
      This is true. uMatrix's interface is difficult even where it works on Android. This calls for custom firewall rules and/or Privoxy. https://en.wikipedia.org/wiki/Privoxy https://en.wikipedia.org/wiki/Privoxy
  - 18pfsmt 7y ago
    Applicable link: https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
  - acdha 7y ago
    I should have been more specific that I wanted it on iOS, too. That’s a good option for desktop and worth mentioning.
- 7y ago

gnicholas 7y ago

One issue I’ve run into with blocking JS at the browser level is that it also ends up blocking extensions that use JS from working. I would block JS on websites much more if my extensions that use JS could still run. I don’t suppose there’s a config setting in Chrome that discriminates between the website’s JS and the JS from my extensions?

schma 7y ago
You can use NoScript to control which domains you want content loaded from and what type.
- dredmorbius 7y ago
  It's often necessary to allow same-host scripts for extensions or bookmarklets to work. Those some-host scrips are often a considerable part of the problem.

HenryBemis 7y ago

That would imply ethical (actual) use of this tag. I cannot thing that any advertiser would ad this, just as they ignore the "Do not track". I fear that we will never we able to rely on the ad-makers honesty, as the hunt for the bottom-line never ends. It looks like this will be a war we will continue fighting with AdB+, NoScript, uBlock(s), hosts, and other tools. It has been a cat and mouse game. The tech changes, but the game goes on.

greycol 7y ago
Sure but then it becomes much more morally/ethically easy to justify running ad blockers (while allowing <ad/> through). Hell at that stage Mozilla could probably justify rolling ad blocking lists in as a default as long as they allow the labeled ads through. As you say the game will go on but maybe it the will be a more pleasant one to play.

tim333 7y ago

>forbidding embedded JS altogether which removes the attack vector for malware The more worrying ones I've seen don't rely on JS but are just links to bad sites. Downloading software can be a bit ridiculous these days with alongside the main download button about five ads saying "Download Now" linking to god knows what iffy software.