6 ms·

> Since ads can run arbitrary JS it's hard to enforce policy programmatically. Letting ads run arbitrary JS is the policy, right? It's not like that's a requi

> Since ads can run arbitrary JS it's hard to enforce policy programmatically. Letting ads run arbitrary JS is the policy, right? It's not like that's a requirement to make the internet work, that's just a Google policy that trades money for user experience.

jefftk 5y ago
Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new format, publishers didn't care) and we moved on. (Still speaking only for myself)
- _hyn3 5y ago
  Why is it up to the advertisers and publishers?
  - Tsiklon 5y ago
    I suppose they're the paying customers.
  - fault1 5y ago
    how do you think google, an adtech company, makes money?
  - jsnell 5y ago
    If they tried to unilaterally make such a change and ban the old formats, both the advertisers and publishers would complain to competition regulators around the world. And whether you think there would be any merit to those complaints or not, the outcome would still be another round of lawsuits with billions on the line.
    - denton-scratch 5y ago
      > with billions on the line Not my money. Why should I care about lawsuits between advertising networks and their advertisers, regulators and so on?
      - asdfasgasdgasdg 5y ago
        > Why should I care You don't need to. But the person is asking why Google is or is not doing a particular thing. So it is their interests that are relevant to the current discussion, not yours.
- barneygale 5y ago
  I do wish google engineers would do something positive for society and switch to a career in subsistence farming. No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads.
  - jefftk 5y ago
    But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.
    - luckylion 5y ago
      "Made for Adsense" sites have no value, if they get shut down, nothing is lost. Normal sites that switched to Adsense have become worse, because now they need clicks and engagement above all else, incentivizing click-bait and low-effort content. Nothing would be lost if they switched to subscription models and provided valuable content. There's little in between in my opinion, it's either "site doesn't use Adsense, it's a company site / personal blog / some institution", "site was made only to make money by adsense with the lowest price content possible, had a bunch of links bought and now provides a passive income to some SEO" and "site used to provide quality content, loses readership to spam-sites because Google has fucked up their sorting algos and now switches to low-value content as well, because anything else can't be financed". Twitch shows that people are very willing to pay for content. I'd very much be happy to if that removed all of the spam.
    - Ansil849 5y ago
      If a website cannot survive without ads, maybe it doesn't need to actually exist in the first place. The world will go on.
      - jefftk 5y ago
        I do think the world would go on, but it's a world I would like less. Some things would move behind paywalls, others would move to the boundary of whatever was considered advertising (sponsored content? Product placement?)
samhw 5y ago
> Letting ads run arbitrary JS is the policy, right? I mean, anything on the Web can run arbitrary JS. The entire point is that it's a sandbox environment where arbitrary JS can't do any harm (excluding cases where vulnerabilities are found). If you're not comfortable with arbitrary JS running on your computer, you'd have to either (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy. None of those are particularly practicable. Most of us operate on the generally-reasonable assumption that the sandbox is effective, and therefore that we're OK to [click on that random link from HN like you did just now / open that news site which pulls in a bunch of tracking scripts / etc]. Either way, this is not somehow a problem that's specific to Google Ad Manager in any way at all. I don't know what else you could really expect of them.
- smolder 5y ago
  > (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy. > I don't know what else you could really expect of them. Your option C is basically how it must work, and mostly does. To be safe online we go to sites we trust. When Google delivers malicious JS through ads, the site operator probably doesn't know Google has harmed the user on their behalf, so their trustworthiness becomes moot. Is there some "safe ads" codeless option for site operators who want to protect their users while still showing ads? Has Google made site operators aware they occasionally deliver malicious JS to users?
  - samhw 5y ago
    > To be safe online we go to sites we trust. I'm fairly confident in saying that nobody, but nobody, only goes to sites they trust. Come on. You're on HN: do you mean to tell me that you never click to open a link from a post unless you've pre-vetted the website and know it to be trustworthy? That's simply not a practicable model. And every site pulls in JavaScript which, to you, is arbitrary. You don't know that they won't add a new third-party script, and you don't know that any given third-party script won't change. You don't know that transitively for the scripts loaded by the scripts. Etc etc etc. Nobody can practise the approach you are setting out here, not both diligently and honestly. Your complaint here is just about how the internet works. It's absurd to expect Google to vet the JavaScript that all of its users host, as much as it's absurd to expect Squarespace or Weebly or even AWS or Cloudflare to do the same. The model of the internet does not and cannot rely on any and all JavaScript being vetted for 'malice' by a trusted party before being loaded. It relies on the JavaScript runtime being a safely isolated sandbox where malice or the lack thereof doesn't matter either way.

jefftk 5y ago

Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy. A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new format, publishers didn't care) and we moved on. (Still speaking only for myself)

_hyn3 5y ago
Why is it up to the advertisers and publishers?
- Tsiklon 5y ago
  I suppose they're the paying customers.
- fault1 5y ago
  how do you think google, an adtech company, makes money?
- jsnell 5y ago
  If they tried to unilaterally make such a change and ban the old formats, both the advertisers and publishers would complain to competition regulators around the world. And whether you think there would be any merit to those complaints or not, the outcome would still be another round of lawsuits with billions on the line.
  - denton-scratch 5y ago
    > with billions on the line Not my money. Why should I care about lawsuits between advertising networks and their advertisers, regulators and so on?
    - asdfasgasdgasdg 5y ago
      > Why should I care You don't need to. But the person is asking why Google is or is not doing a particular thing. So it is their interests that are relevant to the current discussion, not yours.
barneygale 5y ago
I do wish google engineers would do something positive for society and switch to a career in subsistence farming. No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads.
- jefftk 5y ago
  But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.
  - luckylion 5y ago
    "Made for Adsense" sites have no value, if they get shut down, nothing is lost. Normal sites that switched to Adsense have become worse, because now they need clicks and engagement above all else, incentivizing click-bait and low-effort content. Nothing would be lost if they switched to subscription models and provided valuable content. There's little in between in my opinion, it's either "site doesn't use Adsense, it's a company site / personal blog / some institution", "site was made only to make money by adsense with the lowest price content possible, had a bunch of links bought and now provides a passive income to some SEO" and "site used to provide quality content, loses readership to spam-sites because Google has fucked up their sorting algos and now switches to low-value content as well, because anything else can't be financed". Twitch shows that people are very willing to pay for content. I'd very much be happy to if that removed all of the spam.
  - Ansil849 5y ago
    If a website cannot survive without ads, maybe it doesn't need to actually exist in the first place. The world will go on.
    - jefftk 5y ago
      I do think the world would go on, but it's a world I would like less. Some things would move behind paywalls, others would move to the boundary of whatever was considered advertising (sponsored content? Product placement?)

samhw 5y ago

> Letting ads run arbitrary JS is the policy, right? I mean, anything on the Web can run arbitrary JS. The entire point is that it's a sandbox environment where arbitrary JS can't do any harm (excluding cases where vulnerabilities are found). If you're not comfortable with arbitrary JS running on your computer, you'd have to either (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy. None of those are particularly practicable. Most of us operate on the generally-reasonable assumption that the sandbox is effective, and therefore that we're OK to [click on that random link from HN like you did just now / open that news site which pulls in a bunch of tracking scripts / etc]. Either way, this is not somehow a problem that's specific to Google Ad Manager in any way at all. I don't know what else you could really expect of them.

smolder 5y ago
> (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy. > I don't know what else you could really expect of them. Your option C is basically how it must work, and mostly does. To be safe online we go to sites we trust. When Google delivers malicious JS through ads, the site operator probably doesn't know Google has harmed the user on their behalf, so their trustworthiness becomes moot. Is there some "safe ads" codeless option for site operators who want to protect their users while still showing ads? Has Google made site operators aware they occasionally deliver malicious JS to users?
- samhw 5y ago
  > To be safe online we go to sites we trust. I'm fairly confident in saying that nobody, but nobody, only goes to sites they trust. Come on. You're on HN: do you mean to tell me that you never click to open a link from a post unless you've pre-vetted the website and know it to be trustworthy? That's simply not a practicable model. And every site pulls in JavaScript which, to you, is arbitrary. You don't know that they won't add a new third-party script, and you don't know that any given third-party script won't change. You don't know that transitively for the scripts loaded by the scripts. Etc etc etc. Nobody can practise the approach you are setting out here, not both diligently and honestly. Your complaint here is just about how the internet works. It's absurd to expect Google to vet the JavaScript that all of its users host, as much as it's absurd to expect Squarespace or Weebly or even AWS or Cloudflare to do the same. The model of the internet does not and cannot rely on any and all JavaScript being vetted for 'malice' by a trusted party before being loaded. It relies on the JavaScript runtime being a safely isolated sandbox where malice or the lack thereof doesn't matter either way.