6 ms·

> I proposed a simple solution to ad fraud on our platform - assume any UA coming from an IP range owned by a cloud provider was a bot Ad fraud is an adversari

by jefftk 4y ago

> I proposed a simple solution to ad fraud on our platform - assume any UA coming from an IP range owned by a cloud provider was a bot Ad fraud is an adversarial game, and you can't 'solve' it with simple things like this. You'll temporarily cause a lot of pain for the bot operators (yay!) but then they'll adjust and start sending the traffic from botnets (hacked consumer devices). Which is already what they do when trying to defraud advertisers on networks that take fraud seriously (which it sounds like your company didn't). (Disclosure: I used to work on ads at Google)

tehlike 4y ago
What he said, same disclaimer
tjoff 4y ago
So obviously it is better doing nothing since it benefits us??
- jefftk 4y ago
  Of course not! The my parent's company is completely in the wrong, and running an online advertising business with a "pretend they're not there" approach to bots is a terrible idea. I'm just saying it's nowhere near as easy as my parent seems to expect.
  - ad_versary 4y ago
    > I'm just saying it's nowhere near as easy as my parent seems to expect. Apple could eliminate most ad fraud that pretends to be its platforms, by generating tokens from its secure enclave for advertisers, and providing a REST API to validate the token is from a live device. And of course, as you are in this industry, you know that Apple devices are the highest quality, valuable, converting clicks in the ecosystem. Then again, PAT would diminish inventory, prices would rise, and people would get better, but nonetheless similar, ROI that they get today. It is intellectually dishonest to make predictions about ROI. Nobody really knows. Bot farms, fraud, those are all red herrings. Most advertising has shitty creatives.
    - jefftk 4y ago
      > Apple could eliminate most ad fraud that pretends to be its platforms, by generating tokens from its secure enclave for advertisers, and providing a REST API to validate the token is from a live device. What stops someone from buying an Apple device and generating a zillion tokens?
      - syntheticcorp 4y ago
        Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.
        jefftk 4y ago
        I wonder if there are ways to trick the enclave into thinking time is passing faster... Pegging the rate limiter to 100% on an old iphone is also going still give you a lot of tokens very cheaply.
        lossolo 4y ago
        > I wonder if there are ways to trick the enclave into thinking time is passing faster... Most of serious implementations have their own clocks or incremented counters, which makes tricking them very hard even for a state actor.
lucideer 4y ago
> they'll adjust and start sending the traffic from botnets I'm not saying using a botnet is "hard", per se, but the difference in difficulty compared to using a hosting provider is significant. If bot operators are being forced to use botnets, I'd say the solution is working very well.
- josteink 4y ago
  > If bot operators are being forced to use botnets, I'd say the solution is working very well. If ad-fraud goes from "We accidentally ran these 'indexing-bots' against some websites, causing some counters to be off. Sorry about that!" to "We deployed our code to run on stolen or hacked machines through botnets paid for in crypto on the dark web", you've moved from legally gray to clearly illegal. I can see no down-sides with such a move.
  - jefftk 4y ago
    I'm not objecting to making the move (definitely do it) but about selling it as a "solution" when it's really beginning a perpetual fight. People often don't recognize that they are in an adversarial situation, where taking a step that looks like it solves the problem does much less than you expect because other people will later counter your work.
    - lucideer 4y ago
      > selling it as a "solution" when it's really beginning a perpetual fight If your qualifying definition of "solution" is "magic bullet" then there are no solutions. Every solution is a component in the perpetual fight.
      - jefftk 4y ago
        Only in adversarial games, and most of engineering isn't adversarial. Enabling compression on your website or designing your UI to make things clear to users give real improvements that don't degrade with time. Other sorts of improvements like optimizing your JS delivery or your server specs decay with time, because people make incidental changes elsewhere, but this is a slow process. Adversarial situations are very different because there's a motivated person on the other end trying to counter what you're doing, and gains are especially short-lived.
golergka 4y ago
But what if you (the party who bans the cloud provider IP ranges) don't have a majority share of the market, and your bigger competitors don't block these ranges? Then it would be easier to bot owners to just move onto your competitors, and you would have higher efficiency than them.
- bluGill 4y ago
  What if the customers you want to attract use a cloud provider?
vinay_ys 4y ago
Anything that makes things more expensive for the fraudsters than the defender is a win.
otikik 4y ago
This is like burglars. You don't need to scare all the burglars, you just need to make your house slightly more inconvenient to rob than your neighbor's door.
kome 4y ago
there is some big logical fallacies in this line of thinking. better to say that google is totally fine bots traffic. that's what you said, after all.
BeFlatXIII 4y ago
That might be a net benefit for the web if it’s more profitable to rent out botnets for ad fraud than sell them for DDoS-on-demand.
EdwardDiego 4y ago
That's fair, it wouldn't have prevented all fraud, but it would've excised a decent segment of obvious fraud, and tbh, we weren't Google, so the transition from t2.micros to bot nets may have proven economically unviable for the cut-rate scammers. All "well, actually" aside, my point was, and remains... ...we could've taken some action against obvious fraud, but we didn't, because the business team didn't want their numbers to go down.

by jefftk 4y ago

tehlike 4y ago

What he said, same disclaimer

tjoff 4y ago

So obviously it is better doing nothing since it benefits us??

jefftk 4y ago
Of course not! The my parent's company is completely in the wrong, and running an online advertising business with a "pretend they're not there" approach to bots is a terrible idea. I'm just saying it's nowhere near as easy as my parent seems to expect.
- ad_versary 4y ago
  > I'm just saying it's nowhere near as easy as my parent seems to expect. Apple could eliminate most ad fraud that pretends to be its platforms, by generating tokens from its secure enclave for advertisers, and providing a REST API to validate the token is from a live device. And of course, as you are in this industry, you know that Apple devices are the highest quality, valuable, converting clicks in the ecosystem. Then again, PAT would diminish inventory, prices would rise, and people would get better, but nonetheless similar, ROI that they get today. It is intellectually dishonest to make predictions about ROI. Nobody really knows. Bot farms, fraud, those are all red herrings. Most advertising has shitty creatives.
  - jefftk 4y ago
    > Apple could eliminate most ad fraud that pretends to be its platforms, by generating tokens from its secure enclave for advertisers, and providing a REST API to validate the token is from a live device. What stops someone from buying an Apple device and generating a zillion tokens?
    - syntheticcorp 4y ago
      Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.
      - jefftk 4y ago
        I wonder if there are ways to trick the enclave into thinking time is passing faster... Pegging the rate limiter to 100% on an old iphone is also going still give you a lot of tokens very cheaply.
        lossolo 4y ago
        > I wonder if there are ways to trick the enclave into thinking time is passing faster... Most of serious implementations have their own clocks or incremented counters, which makes tricking them very hard even for a state actor.

lucideer 4y ago

> they'll adjust and start sending the traffic from botnets I'm not saying using a botnet is "hard", per se, but the difference in difficulty compared to using a hosting provider is significant. If bot operators are being forced to use botnets, I'd say the solution is working very well.

josteink 4y ago
> If bot operators are being forced to use botnets, I'd say the solution is working very well. If ad-fraud goes from "We accidentally ran these 'indexing-bots' against some websites, causing some counters to be off. Sorry about that!" to "We deployed our code to run on stolen or hacked machines through botnets paid for in crypto on the dark web", you've moved from legally gray to clearly illegal. I can see no down-sides with such a move.
- jefftk 4y ago
  I'm not objecting to making the move (definitely do it) but about selling it as a "solution" when it's really beginning a perpetual fight. People often don't recognize that they are in an adversarial situation, where taking a step that looks like it solves the problem does much less than you expect because other people will later counter your work.
  - lucideer 4y ago
    > selling it as a "solution" when it's really beginning a perpetual fight If your qualifying definition of "solution" is "magic bullet" then there are no solutions. Every solution is a component in the perpetual fight.
    - jefftk 4y ago
      Only in adversarial games, and most of engineering isn't adversarial. Enabling compression on your website or designing your UI to make things clear to users give real improvements that don't degrade with time. Other sorts of improvements like optimizing your JS delivery or your server specs decay with time, because people make incidental changes elsewhere, but this is a slow process. Adversarial situations are very different because there's a motivated person on the other end trying to counter what you're doing, and gains are especially short-lived.

golergka 4y ago

But what if you (the party who bans the cloud provider IP ranges) don't have a majority share of the market, and your bigger competitors don't block these ranges? Then it would be easier to bot owners to just move onto your competitors, and you would have higher efficiency than them.

bluGill 4y ago
What if the customers you want to attract use a cloud provider?

vinay_ys 4y ago

Anything that makes things more expensive for the fraudsters than the defender is a win.

otikik 4y ago

This is like burglars. You don't need to scare all the burglars, you just need to make your house slightly more inconvenient to rob than your neighbor's door.

kome 4y ago

there is some big logical fallacies in this line of thinking. better to say that google is totally fine bots traffic. that's what you said, after all.

BeFlatXIII 4y ago

That might be a net benefit for the web if it’s more profitable to rent out botnets for ad fraud than sell them for DDoS-on-demand.

EdwardDiego 4y ago

That's fair, it wouldn't have prevented all fraud, but it would've excised a decent segment of obvious fraud, and tbh, we weren't Google, so the transition from t2.micros to bot nets may have proven economically unviable for the cut-rate scammers. All "well, actually" aside, my point was, and remains... ...we could've taken some action against obvious fraud, but we didn't, because the business team didn't want their numbers to go down.