6 ms·

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies

by jefftk 7y ago

The easiest way for site-owners to delegate control has been to include third-party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third-party JS comes from the same server that gives you the rest of the site's JS. (Disclosure: I work in ads; speaking only for myself)

poitrus 7y ago
They might yes, but it is orders of magnitude harder to setup and maintain than this, and as a website owner, you have to put even more trust in your ad serving solution than today.
- jefftk 7y ago
  Reverse proxying is a little harder, but not much. In NGINX, for example: location /adtech/ { proxy_pass https://adtech.example/; } What additional trust are you thinking about? HttpOnly cookies are already sent when you use the subdomain approach.
  - x0x0 7y ago
    js running on your domain can read eg login cookies at least if you cname definitelynotads.yourdomain.com to js.ads.com, the javascript running on definitelynotads... can't read host-only login cookies on yourdomain.com.
    - jefftk 7y ago
      Sites generally set Domain= on their cookies, and so include subdomains. For example, if you click "sign in" on apple.com it brings you to secure2.store.apple.com and after entering your password it sets a cookie with "Path=/; Domain=apple.com; Secure; HttpOnly". You're right that this does reduce security on some sites: if domain.example doesn't set Domain= on their cookies then ads.domain.example (CNAMED to js.ads.example) won't see the cookies but domain.example/ads would. This is pretty rare, though, because sites you log into generally do need their cookies to work across subdomains. Except this problem is easier to handle with reverse proxies than with subdomains: with subdomains the cookies are sent whether you want to or not, while with a reverse proxy the site owner can configure it to strip cookies.
    - A1kmm 7y ago
      In the vast majority of cases integration is by the including a script controlled by the advertising network in the page they are advertising on. So for the purposes of the browser security model, the script already runs in the domain of the host site. It can directly read any non-HttpOnly cookies, and can make any request it likes using XMLHttpRequest to APIs on the host site using the user's cookie without relying on CORs. The only very minor difference between first and third party script inclusion is access to HttpOnly cookies (depending on the cookie scoping). Both of the first party script inclusion approaches have mitigations available to the host site: in the proxy approach, the server could filter the cookies before proxying. In the CNAME approach, taking care with cookie scoping could solve the problem. Careless adoption is likely to open security flaws under both techniques.
      - mr_toad 7y ago
        > The only very minor difference between first and third party script inclusion is access to HttpOnly cookies That’s not a minor difference, http only is used for authentication.
        jefftk 7y ago
        Correct. Authentication should always be via cookies with "HttpOnly" set, since (a) the cookie is not needed client side and (b) it somewhat limits the damage XSS can do.
bsysop 7y ago
Do you think ad companies will really trust reverse-proxied ad traffic? Seems like a tremendous opportunity for fraud. Right now with user agents hitting ad servers directly, there's much less opportunity for content publishers to fake impressions and clicks.
- dylz 7y ago
  They already do - Instart Logic is one of the reverse proxies dedicated to serving ads first-party. For tracking and invasive device tracking (WebGL, plugin enumeration, Canvas, audiocontext, WebRTC, WebSocket-based portscanning of your LAN CIDR acquired from WebRTC, ...) there's Shape and Distil that both do inline reverse proxying.
  - aledalgrande 7y ago
    Is this form of aggressive identification without consent not going against the GDPR?
    - privateSFacct 7y ago
      When I browse European sites I'm always having to click through permissions - I imagine most folks are on autopilot by now in terms of saying "yes" especially in Europe - how can you even browse the web if you don't click yes one everything in Europe? What's the data on folks actually saying no to these popups / clickthrough alerts? I used to skim the relatively few permission / yes agreements (ie, this will auto sign you up for XX), but now they are showing up so many places it's not practical anymore I don't think? Even https://europa.eu/ https://europa.eu/ (the official EU website) has a cookie banner at the top of the very first page you hit. And instead of the website asking me - I normally just block cookies if I don't want to share them.
      - aledalgrande 7y ago
        I might be wrong, but GDPR was supposed to force businesses to provide a DNT option unless completely vital to the business. If that is true, most sites are liable for forcing you to click "yes". Update: I went and found this[1]: > this provision means that companies will process only the data absolutely necessary for the completion of its business and limit access to personal data to only those employees needing the information to complete the process consented to by the data subject [1] https://www.techrepublic.com/article/the-eu-general-data-protection-regulation-gdpr-the-smart-persons-guide/ https://www.techrepublic.com/article/the-eu-general-data-pro...
QUFB 7y ago
Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?
- jefftk 7y ago
  I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads https://www.jefftk.com/p/value-of-working-in-ads
  - noman-land 7y ago
    "It is difficult to get a man to understand something, when his salary depends on his not understanding it."
    - jefftk 7y ago
      I do the work I do because it allows me to donate: https://www.jefftk.com/donations https://www.jefftk.com/donations I would not do this work if I thought it was harmful, and if I decided it was harmful there are many jobs I could take instead. I'm open to being convinced that my work is net negative! I've quit Google before: https://www.jefftk.com/p/leaving-google-joining-wave https://www.jefftk.com/p/leaving-google-joining-wave
      - dessant 7y ago
        You're contributing to tech that erodes people's privacy, even when they actively fight against it. Don't delude yourself with net positives. The harm your employer causes still affects people, regadless of the useful things you may work on at Google, or the donations you give.
        SquareWheel 7y ago
        Not everyone shares your moral sentiments. I find your view elitist and unfair towards jefftk, who has been extremely open and amiable.
deleted 7y ago
[deleted]
earthboundkid 7y ago
Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.
- akira2501 7y ago
  > Or we could make all of that illegal I don't see a good way to do that, at least.. a way that's practical to actually enforce. As it is, the FTC is fairly toothless and is better at offering guidelines than policing. > as it does in every field except for the web Well.. that's just because they have dedicated account executives and sell advertising through a combination of direct solicitation and much smaller amount of "walk-in" business, that's not practical for all creators or formats. > Web is the one weirdo market with tracking. This has always been the holy grail for advertising, the other industries put up with statistical "audience modelling" only because they have to; however, working in one of those 'other fields' I can tell you.. our account executives will take as much direct tracking data as they can get. e.g. "Have you installed our Radio App?!" > Make that illegal and it will be good like all the other markets. I feel like we lost the fight a long time ago.. I remember when the 'Flash Blocker' plugin was a great tool. Unfortunately, too many modern sites are entirely reliant on JS in a way they never really were for Flash and the idea of using 'Script Blocker' that's on by default makes navigating the web exceptionally difficult. It's too bad, because it's probably the right solution.. why should the sites we visit have the right to execute programs on my computer by default?
- pas 7y ago
  The GDPR does that. It doesn't matter if you have the data in your own DB, you can't utilize it for purposes you haven't secured informed consent for.
  - earthboundkid 7y ago
    GDPR is a good first step.
rkagerer 7y ago
As the host of a few web properties, I've always been very discriminating when it comes to third party content (including trackers). In fact my broad rule of thumb is to avoid it. You don't need it to have a successful business model. I'm disappointed at webmasters who push garbage from their sites.
badrabbit 7y ago
I can see AD publishers offering CDN like services to help them get around blockage. Only solution is criminalizing this behavior. In no other context is stalking a person against their will and consent permissible in a "free" society.

by jefftk 7y ago

poitrus 7y ago

They might yes, but it is orders of magnitude harder to setup and maintain than this, and as a website owner, you have to put even more trust in your ad serving solution than today.

jefftk 7y ago
Reverse proxying is a little harder, but not much. In NGINX, for example: location /adtech/ { proxy_pass https://adtech.example/; } What additional trust are you thinking about? HttpOnly cookies are already sent when you use the subdomain approach.
- x0x0 7y ago
  js running on your domain can read eg login cookies at least if you cname definitelynotads.yourdomain.com to js.ads.com, the javascript running on definitelynotads... can't read host-only login cookies on yourdomain.com.
  - jefftk 7y ago
    Sites generally set Domain= on their cookies, and so include subdomains. For example, if you click "sign in" on apple.com it brings you to secure2.store.apple.com and after entering your password it sets a cookie with "Path=/; Domain=apple.com; Secure; HttpOnly". You're right that this does reduce security on some sites: if domain.example doesn't set Domain= on their cookies then ads.domain.example (CNAMED to js.ads.example) won't see the cookies but domain.example/ads would. This is pretty rare, though, because sites you log into generally do need their cookies to work across subdomains. Except this problem is easier to handle with reverse proxies than with subdomains: with subdomains the cookies are sent whether you want to or not, while with a reverse proxy the site owner can configure it to strip cookies.
  - A1kmm 7y ago
    In the vast majority of cases integration is by the including a script controlled by the advertising network in the page they are advertising on. So for the purposes of the browser security model, the script already runs in the domain of the host site. It can directly read any non-HttpOnly cookies, and can make any request it likes using XMLHttpRequest to APIs on the host site using the user's cookie without relying on CORs. The only very minor difference between first and third party script inclusion is access to HttpOnly cookies (depending on the cookie scoping). Both of the first party script inclusion approaches have mitigations available to the host site: in the proxy approach, the server could filter the cookies before proxying. In the CNAME approach, taking care with cookie scoping could solve the problem. Careless adoption is likely to open security flaws under both techniques.
    - mr_toad 7y ago
      > The only very minor difference between first and third party script inclusion is access to HttpOnly cookies That’s not a minor difference, http only is used for authentication.
      - jefftk 7y ago
        Correct. Authentication should always be via cookies with "HttpOnly" set, since (a) the cookie is not needed client side and (b) it somewhat limits the damage XSS can do.

bsysop 7y ago

Do you think ad companies will really trust reverse-proxied ad traffic? Seems like a tremendous opportunity for fraud. Right now with user agents hitting ad servers directly, there's much less opportunity for content publishers to fake impressions and clicks.

dylz 7y ago
They already do - Instart Logic is one of the reverse proxies dedicated to serving ads first-party. For tracking and invasive device tracking (WebGL, plugin enumeration, Canvas, audiocontext, WebRTC, WebSocket-based portscanning of your LAN CIDR acquired from WebRTC, ...) there's Shape and Distil that both do inline reverse proxying.
- aledalgrande 7y ago
  Is this form of aggressive identification without consent not going against the GDPR?
  - privateSFacct 7y ago
    When I browse European sites I'm always having to click through permissions - I imagine most folks are on autopilot by now in terms of saying "yes" especially in Europe - how can you even browse the web if you don't click yes one everything in Europe? What's the data on folks actually saying no to these popups / clickthrough alerts? I used to skim the relatively few permission / yes agreements (ie, this will auto sign you up for XX), but now they are showing up so many places it's not practical anymore I don't think? Even https://europa.eu/ https://europa.eu/ (the official EU website) has a cookie banner at the top of the very first page you hit. And instead of the website asking me - I normally just block cookies if I don't want to share them.
    - aledalgrande 7y ago
      I might be wrong, but GDPR was supposed to force businesses to provide a DNT option unless completely vital to the business. If that is true, most sites are liable for forcing you to click "yes". Update: I went and found this[1]: > this provision means that companies will process only the data absolutely necessary for the completion of its business and limit access to personal data to only those employees needing the information to complete the process consented to by the data subject [1] https://www.techrepublic.com/article/the-eu-general-data-protection-regulation-gdpr-the-smart-persons-guide/ https://www.techrepublic.com/article/the-eu-general-data-pro...

QUFB 7y ago

Honest question, and I'm not making any value judgements: Do you have any moral issues working an adtech?

jefftk 7y ago
I've written some about this here: https://www.jefftk.com/p/value-of-working-in-ads https://www.jefftk.com/p/value-of-working-in-ads
- noman-land 7y ago
  "It is difficult to get a man to understand something, when his salary depends on his not understanding it."
  - jefftk 7y ago
    I do the work I do because it allows me to donate: https://www.jefftk.com/donations https://www.jefftk.com/donations I would not do this work if I thought it was harmful, and if I decided it was harmful there are many jobs I could take instead. I'm open to being convinced that my work is net negative! I've quit Google before: https://www.jefftk.com/p/leaving-google-joining-wave https://www.jefftk.com/p/leaving-google-joining-wave
    - dessant 7y ago
      You're contributing to tech that erodes people's privacy, even when they actively fight against it. Don't delude yourself with net positives. The harm your employer causes still affects people, regadless of the useful things you may work on at Google, or the donations you give.
      - SquareWheel 7y ago
        Not everyone shares your moral sentiments. I find your view elitist and unfair towards jefftk, who has been extremely open and amiable.

deleted 7y ago

[deleted]

earthboundkid 7y ago

Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.

akira2501 7y ago
> Or we could make all of that illegal I don't see a good way to do that, at least.. a way that's practical to actually enforce. As it is, the FTC is fairly toothless and is better at offering guidelines than policing. > as it does in every field except for the web Well.. that's just because they have dedicated account executives and sell advertising through a combination of direct solicitation and much smaller amount of "walk-in" business, that's not practical for all creators or formats. > Web is the one weirdo market with tracking. This has always been the holy grail for advertising, the other industries put up with statistical "audience modelling" only because they have to; however, working in one of those 'other fields' I can tell you.. our account executives will take as much direct tracking data as they can get. e.g. "Have you installed our Radio App?!" > Make that illegal and it will be good like all the other markets. I feel like we lost the fight a long time ago.. I remember when the 'Flash Blocker' plugin was a great tool. Unfortunately, too many modern sites are entirely reliant on JS in a way they never really were for Flash and the idea of using 'Script Blocker' that's on by default makes navigating the web exceptionally difficult. It's too bad, because it's probably the right solution.. why should the sites we visit have the right to execute programs on my computer by default?
pas 7y ago
The GDPR does that. It doesn't matter if you have the data in your own DB, you can't utilize it for purposes you haven't secured informed consent for.
- earthboundkid 7y ago
  GDPR is a good first step.

rkagerer 7y ago

As the host of a few web properties, I've always been very discriminating when it comes to third party content (including trackers). In fact my broad rule of thumb is to avoid it. You don't need it to have a successful business model. I'm disappointed at webmasters who push garbage from their sites.

badrabbit 7y ago

I can see AD publishers offering CDN like services to help them get around blockage. Only solution is criminalizing this behavior. In no other context is stalking a person against their will and consent permissible in a "free" society.