12 ms·

Okay, so malware actors create new accounts and try new ways. That’s no surprise. That doesn’t adequately explain or forgive the behavior by Google here. They’r

Okay, so malware actors create new accounts and try new ways. That’s no surprise. That doesn’t adequately explain or forgive the behavior by Google here. They’re one of the largest, most profitable enterprises in history, it’s no longer an excuse.

shadowgovt 4y ago
The behavior by Google here is "Doing everything they can figure out how to do to get the malvertisers off their network without breaking the network itself." It appears that, in the short run, the malvertisers are winning the arms race. ... but if you have any ideas they haven't tried, I suspect they'd love to hear about it in a job interview for any of the openings for ad quality SWE.
- deminature 4y ago
  This is not some impossibly intractable algorithmic problem to solve. Simply actioning malware reports on the ad would be sufficient. If an ad receives hundreds of reports over the course of months, there's problem something wrong with it and should trigger a human review, at which point the malicious intent of the ad is obvious. Why include a report button on ads at all if its effectively a placebo button?
  - shadowgovt 4y ago
    What is your evidence that the malware reports aren't being actioned? The malware continuing to appear isn't sufficient evidence. Malware moves hosts and ad accounts all the time. ETA: from the article itself, in 2021 Google "Removed over 3.4 billion ads, restricted over 5.7 billion ads and suspended over 5.6 million advertiser accounts." That's a ton of action, but AdWords alone also serves 29 billion ad impressions a day. It doesn't take more than a few bad actors slipping through the cracks to get seen (and at these orders of magnitude, "a few" is still "millions." Completely impractical for human hand-review).
    - deminature 4y ago
      And yet despite these numbers, somehow the most prominent open source software is relentlessly impersonated and Google is the facilitator, FTA: https://twitter.com/wdormann/status/1616497407390355456 https://twitter.com/wdormann/status/1616497407390355456 It's clear this will never be prioritized without regulation as scammers money is as good as anyone else's and open source projects cannot afford to sue Google to force action.
- JohnFen 4y ago
  Perhaps the network needs to be broken, then.
- cycomanic 4y ago
  Someone else already said this it's not that hard they could simply do a manual review of ads, but that's obviously going to eat into their profits so they will not do it. I think this really requires governments to step in. I mean one could easily argue that Google is facilitating fraud here, so maybe they should be liable?
  - shadowgovt 4y ago
    The notion that is not hard to review millions of advertisers does not align with reality.
    - Nextgrid 4y ago
      You could make the same argument about disposing of toxic waste (it's definitely cheaper and easier to just dump it in the river than to deal with the "reality" of processing millions of litres of sludge).
      - shadowgovt 4y ago
        I actually think the problems of dealing with toxic waste are far more tractable than the problems of vetting every ad in a network serving 30 billion impressions a day. Toxic waste doesn't try and hide from the litmus paper or the geiger counter.
        Nextgrid 4y ago
        Yet there is still a cost to dealing with toxic waste, which encourages companies to not make any more of it than necessary. There's currently no cost (it's all profit, in fact) to promoting malicious ads in search results, so why wouldn't Google do it? There is no reason they have to serve 30 billion impressions a day. If vetting takes that down to 1 billion, that's fine. Lower the volumes (and raise the prices to fund manual vetting) until the problem is resolved. Toxic waste disposal is a solved problem thanks to (enforced!) regulations that force companies to do so under threat of heavy penalties, not altruism or the fact that the waste doesn't hide from a Geiger counter. We need the same for online advertising.
JohnFen 4y ago
I agree. There is one thing Google could do that would eliminate the vast majority of this sort of thing. They could require a manual review of all ads and advertisers before putting each ad into the pool. Like traditional media does. But that doesn't scale, so it's not going to happen. But avoiding something because it doesn't scale is a deliberate choice, and I think it's fair to consider Google to be at fault for allowing this state of affairs to continue as it is.
- Chabsff 4y ago
  That doesn't work because it's not the ads themselves that serve the malware, but the page the ads point to. Changing that after the review is done is trivial, and asking landing pages to never change is simply unreasonable for a vast number of reasons.
  - JohnFen 4y ago
    That's why I included "vet the advertisers". It's not just the ads that need to be examined, but the people putting the ads up.
    - shadowgovt 4y ago
      What major city would you recommend Google employ at 100% to vet enough advertisers to support nearly 30 billion daily ad impressions? Or, alternatively, should there be a few tens of thousands of firms allowed to advertise on the Internet and the rest of us can just pound sand? (... actually, now that I think that "out loud," a distributed trust model would be an interesting idea. Google, instead of vetting ads, could vet trusted ad resellers, and knock entire resellers off the network that failed to do due diligence. The resellers would be responsible for policing their various houses and if you didn't like the terms one provided you could go to another. This is, perhaps, one of those situations where more middlemen would be desirable).
      - JohnFen 4y ago
        I already mentioned that it doesn't scale. The real issue, IMO, is that Google's business model is just fundamentally bad. But Google is large enough that it doesn't matter. They're like a large industrial polluter poisoning the lands and arguing that there's nothing they can effectively do about it because addressing the problem would be bad for their business.

shadowgovt 4y ago

The behavior by Google here is "Doing everything they can figure out how to do to get the malvertisers off their network without breaking the network itself." It appears that, in the short run, the malvertisers are winning the arms race. ... but if you have any ideas they haven't tried, I suspect they'd love to hear about it in a job interview for any of the openings for ad quality SWE.

deminature 4y ago
This is not some impossibly intractable algorithmic problem to solve. Simply actioning malware reports on the ad would be sufficient. If an ad receives hundreds of reports over the course of months, there's problem something wrong with it and should trigger a human review, at which point the malicious intent of the ad is obvious. Why include a report button on ads at all if its effectively a placebo button?
- shadowgovt 4y ago
  What is your evidence that the malware reports aren't being actioned? The malware continuing to appear isn't sufficient evidence. Malware moves hosts and ad accounts all the time. ETA: from the article itself, in 2021 Google "Removed over 3.4 billion ads, restricted over 5.7 billion ads and suspended over 5.6 million advertiser accounts." That's a ton of action, but AdWords alone also serves 29 billion ad impressions a day. It doesn't take more than a few bad actors slipping through the cracks to get seen (and at these orders of magnitude, "a few" is still "millions." Completely impractical for human hand-review).
  - deminature 4y ago
    And yet despite these numbers, somehow the most prominent open source software is relentlessly impersonated and Google is the facilitator, FTA: https://twitter.com/wdormann/status/1616497407390355456 https://twitter.com/wdormann/status/1616497407390355456 It's clear this will never be prioritized without regulation as scammers money is as good as anyone else's and open source projects cannot afford to sue Google to force action.
JohnFen 4y ago
Perhaps the network needs to be broken, then.
cycomanic 4y ago
Someone else already said this it's not that hard they could simply do a manual review of ads, but that's obviously going to eat into their profits so they will not do it. I think this really requires governments to step in. I mean one could easily argue that Google is facilitating fraud here, so maybe they should be liable?
- shadowgovt 4y ago
  The notion that is not hard to review millions of advertisers does not align with reality.
  - Nextgrid 4y ago
    You could make the same argument about disposing of toxic waste (it's definitely cheaper and easier to just dump it in the river than to deal with the "reality" of processing millions of litres of sludge).
    - shadowgovt 4y ago
      I actually think the problems of dealing with toxic waste are far more tractable than the problems of vetting every ad in a network serving 30 billion impressions a day. Toxic waste doesn't try and hide from the litmus paper or the geiger counter.
      - Nextgrid 4y ago
        Yet there is still a cost to dealing with toxic waste, which encourages companies to not make any more of it than necessary. There's currently no cost (it's all profit, in fact) to promoting malicious ads in search results, so why wouldn't Google do it? There is no reason they have to serve 30 billion impressions a day. If vetting takes that down to 1 billion, that's fine. Lower the volumes (and raise the prices to fund manual vetting) until the problem is resolved. Toxic waste disposal is a solved problem thanks to (enforced!) regulations that force companies to do so under threat of heavy penalties, not altruism or the fact that the waste doesn't hide from a Geiger counter. We need the same for online advertising.

JohnFen 4y ago

I agree. There is one thing Google could do that would eliminate the vast majority of this sort of thing. They could require a manual review of all ads and advertisers before putting each ad into the pool. Like traditional media does. But that doesn't scale, so it's not going to happen. But avoiding something because it doesn't scale is a deliberate choice, and I think it's fair to consider Google to be at fault for allowing this state of affairs to continue as it is.

Chabsff 4y ago
That doesn't work because it's not the ads themselves that serve the malware, but the page the ads point to. Changing that after the review is done is trivial, and asking landing pages to never change is simply unreasonable for a vast number of reasons.
- JohnFen 4y ago
  That's why I included "vet the advertisers". It's not just the ads that need to be examined, but the people putting the ads up.
  - shadowgovt 4y ago
    What major city would you recommend Google employ at 100% to vet enough advertisers to support nearly 30 billion daily ad impressions? Or, alternatively, should there be a few tens of thousands of firms allowed to advertise on the Internet and the rest of us can just pound sand? (... actually, now that I think that "out loud," a distributed trust model would be an interesting idea. Google, instead of vetting ads, could vet trusted ad resellers, and knock entire resellers off the network that failed to do due diligence. The resellers would be responsible for policing their various houses and if you didn't like the terms one provided you could go to another. This is, perhaps, one of those situations where more middlemen would be desirable).
    - JohnFen 4y ago
      I already mentioned that it doesn't scale. The real issue, IMO, is that Google's business model is just fundamentally bad. But Google is large enough that it doesn't matter. They're like a large industrial polluter poisoning the lands and arguing that there's nothing they can effectively do about it because addressing the problem would be bad for their business.