3 ms·

What are the implications?

sidewndr46 2y ago
It more or less boiled down to "we would be labeled an advertiser and not a destination for information on the internet". Like being an advertiser stopped people from using Google search or something
- Groxx 2y ago
  Or newspapers, both before and after it. They've always been vast advertising platforms, but don't have anywhere near the same stigma that online advertisers have acquired (for extremely good reasons imo - they're as invasive as possible, while printed media has rather tight limits) They could have become the dominant advertisers online too, and then no doubt they'd be just as nasty. But they lost that war multiple times, first to doubleclick-likes and then to social media.
debit-freak 2y ago
Presumably that adblockers (or rather their users) would object to blocking domains that folks might actually want to load content from. I can’t imagine “domain” is the only signal one could use to identify ads, though. To truly befuddle them you’d make advertisements truly indistinguishable from content. This is not trivial.
- sidewndr46 2y ago
  Not entirely true. If you lower the quality of your content enough the advertisements are in fact indistinguishable. I often enjoy reading the "chumbox" at the bottom of the news article more than the reporting itself
- grotorea 2y ago
  I think what we're asking is what are the implications for the advertisement company. And yeah, I can trivially block stuff in uBO by using CSS rules for example, so that's still on the table.
  - debit-freak 2y ago
    > I think what we're asking is what are the implications for the advertisement company. Higher impressions? Higher integration cost? I guess I'm not sure what the confusion might be. Advertisers obviously want to ram their bullshit down as many eyesockets as they can find.
dpifke 2y ago
If third party ad servers get access to your main domain's cookies, they can impersonate your signed-in users and steal their data.
- _fool 2y ago
  ...Unless you're savvy. Thank goodness for the availability of https://publicsuffix.org/ https://publicsuffix.org/ (as long as you only use your main domain and don't need to share cookies with your own subdomains), and the includeSubDomains directive to HSTS! But - if you already set this up, you probably are savvy enough to avoid the problems created (or your provider is)
  - aaronmdjones 2y ago
    HSTS won't prevent this at all; the advertiser merely needs to also set up TLS by getting a certificate for that subdomain, which they can already do precisely because it goes to their web server -- not yours. This also lets them steal cookies marked secure (sent over HTTPS only). Edit: A combination of DNS CAA with an account identifier restriction in the record would prevent this. Then the advertiser would complain, and any ads served would have to be over plaintext, which would cause browser warnings about mixed content and allow MITM injection of (more) malicious content.

It more or less boiled down to "we would be labeled an advertiser and not a destination for information on the internet". Like being an advertiser stopped people from using Google search or something

Groxx 2y ago
Or newspapers, both before and after it. They've always been vast advertising platforms, but don't have anywhere near the same stigma that online advertisers have acquired (for extremely good reasons imo - they're as invasive as possible, while printed media has rather tight limits) They could have become the dominant advertisers online too, and then no doubt they'd be just as nasty. But they lost that war multiple times, first to doubleclick-likes and then to social media.

debit-freak 2y ago

Presumably that adblockers (or rather their users) would object to blocking domains that folks might actually want to load content from. I can’t imagine “domain” is the only signal one could use to identify ads, though. To truly befuddle them you’d make advertisements truly indistinguishable from content. This is not trivial.

sidewndr46 2y ago
Not entirely true. If you lower the quality of your content enough the advertisements are in fact indistinguishable. I often enjoy reading the "chumbox" at the bottom of the news article more than the reporting itself
grotorea 2y ago
I think what we're asking is what are the implications for the advertisement company. And yeah, I can trivially block stuff in uBO by using CSS rules for example, so that's still on the table.
- debit-freak 2y ago
  > I think what we're asking is what are the implications for the advertisement company. Higher impressions? Higher integration cost? I guess I'm not sure what the confusion might be. Advertisers obviously want to ram their bullshit down as many eyesockets as they can find.

dpifke 2y ago

If third party ad servers get access to your main domain's cookies, they can impersonate your signed-in users and steal their data.

_fool 2y ago
...Unless you're savvy. Thank goodness for the availability of https://publicsuffix.org/ https://publicsuffix.org/ (as long as you only use your main domain and don't need to share cookies with your own subdomains), and the includeSubDomains directive to HSTS! But - if you already set this up, you probably are savvy enough to avoid the problems created (or your provider is)
- aaronmdjones 2y ago
  HSTS won't prevent this at all; the advertiser merely needs to also set up TLS by getting a certificate for that subdomain, which they can already do precisely because it goes to their web server -- not yours. This also lets them steal cookies marked secure (sent over HTTPS only). Edit: A combination of DNS CAA with an account identifier restriction in the record would prevent this. Then the advertiser would complain, and any ads served would have to be over plaintext, which would cause browser warnings about mixed content and allow MITM injection of (more) malicious content.