5 ms·

Haha, easy way to create plausible deniability if you just allow everything to run :D. Doesn't that also make it easy for anyone running an ad to run hivemind i

Haha, easy way to create plausible deniability if you just allow everything to run :D. Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself? In addition, why is it hard to enforce a policy that disallows any ad to reach out to the camera and microphone? I don't understand why that is hard to enforce.

mschuster91 5y ago
Because ads can use Javascript which is notorious for how hard it is to vet code and how easy it is to hide functionality.
- hetspookjee 5y ago
  But why do they need that? What purpose does an ad with javascript serve?
  - mschuster91 5y ago
    Animations, tracking and fraud detection are the big areas. Ads were historically one of the strongest drivers of Flash, given how easy it made for creatives to implement animations without needing a frontend developer - ad buyers these days would instantly protest against any attempt to remove either of the three use cases. And given that we are talking about sometimes eight figures worth of ad buying... no network will want to risk offending such clients.
    - hetspookjee 5y ago
      I still don't understand it. I was under the impression that animations are also able to be served through HTML5? Both CSS and HTML should be sufficient. ~We're in the age where we're able to serve an entire sqlite database over a static website, yet an animation does require javascript?~ EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.
      - jefftk 5y ago
        Animations can be CSS, yes. That's what you do in https://amp.dev/documentation/guides-and-tutorials/learn/a4a_spec/ https://amp.dev/documentation/guides-and-tutorials/learn/a4a... (declarative ad format, no advertiser-written JS)
        hetspookjee 5y ago
        Then I don't understand the necessity for javascript in ads?
        jefftk 5y ago
        In this particular case, advertisers were not interested in moving to a declarative format, and publishers were not interested in requiring declarative ads. So it didn't end up going anywhere as a general purpose ad format.
      - danachow 5y ago
        > We're in the age where we're able to serve an entire sqlite database over a static website Making use of the SQLite database is entirely client side and requires JavaScript or WASM (the distinction is unimportant) - it requires running code on the frontend. This is not a great way to state your case.
        hetspookjee 5y ago
        You're right and I misinterpreted the sqlite implementation. I will edit my comment to reflect my error.
jefftk 5y ago
> Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself? Are you talking about crypto mining? That's a good example of something which is against policy but difficult to fully prevent technically. The core problem from someone trying to exploit this, however, is that crypto mining in the browser is minimally profitable, so you need to do a huge amount before seeing noticeable returns. The more you try to do the more likely you are to get caught, so while it does take some scrutiny from publishers and ad networks, it doesn't take very much. (still speaking only for myself; this isn't something I know very much about)
- hetspookjee 5y ago
  Yes, I am talking indeed about crypto mining. I am also talking mostly about the aspect of wasting compute cycles and thus harming the environment through Google's means. Yes, it is minimally profitable, but that it is possible is weird if you ask me.
  - jefftk 5y ago
    Sorry, what I meant was that it is minimally profitable at the best of times. Which means it doesn't take very much enforcement to shift it over to being negatively profitable, because it costs you more in time, engineering, etc. than you would make. And once it is a money losing proposition, the people trying to exploit users are no longer interested.

mschuster91 5y ago

Because ads can use Javascript which is notorious for how hard it is to vet code and how easy it is to hide functionality.

hetspookjee 5y ago
But why do they need that? What purpose does an ad with javascript serve?
- mschuster91 5y ago
  Animations, tracking and fraud detection are the big areas. Ads were historically one of the strongest drivers of Flash, given how easy it made for creatives to implement animations without needing a frontend developer - ad buyers these days would instantly protest against any attempt to remove either of the three use cases. And given that we are talking about sometimes eight figures worth of ad buying... no network will want to risk offending such clients.
  - hetspookjee 5y ago
    I still don't understand it. I was under the impression that animations are also able to be served through HTML5? Both CSS and HTML should be sufficient. ~We're in the age where we're able to serve an entire sqlite database over a static website, yet an animation does require javascript?~ EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.
    - jefftk 5y ago
      Animations can be CSS, yes. That's what you do in https://amp.dev/documentation/guides-and-tutorials/learn/a4a_spec/ https://amp.dev/documentation/guides-and-tutorials/learn/a4a... (declarative ad format, no advertiser-written JS)
      - hetspookjee 5y ago
        Then I don't understand the necessity for javascript in ads?
        jefftk 5y ago
        In this particular case, advertisers were not interested in moving to a declarative format, and publishers were not interested in requiring declarative ads. So it didn't end up going anywhere as a general purpose ad format.
    - danachow 5y ago
      > We're in the age where we're able to serve an entire sqlite database over a static website Making use of the SQLite database is entirely client side and requires JavaScript or WASM (the distinction is unimportant) - it requires running code on the frontend. This is not a great way to state your case.
      - hetspookjee 5y ago
        You're right and I misinterpreted the sqlite implementation. I will edit my comment to reflect my error.

jefftk 5y ago

> Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself? Are you talking about crypto mining? That's a good example of something which is against policy but difficult to fully prevent technically. The core problem from someone trying to exploit this, however, is that crypto mining in the browser is minimally profitable, so you need to do a huge amount before seeing noticeable returns. The more you try to do the more likely you are to get caught, so while it does take some scrutiny from publishers and ad networks, it doesn't take very much. (still speaking only for myself; this isn't something I know very much about)

hetspookjee 5y ago
Yes, I am talking indeed about crypto mining. I am also talking mostly about the aspect of wasting compute cycles and thus harming the environment through Google's means. Yes, it is minimally profitable, but that it is possible is weird if you ask me.
- jefftk 5y ago
  Sorry, what I meant was that it is minimally profitable at the best of times. Which means it doesn't take very much enforcement to shift it over to being negatively profitable, because it costs you more in time, engineering, etc. than you would make. And once it is a money losing proposition, the people trying to exploit users are no longer interested.