6 ms·

Meet the Company Hijacking New York Times Ad Revenue

59 points by digisth 14y ago

danso 14y ago
> At first glance, it seems unlikely that Sambreel is pervasive enough to affect the ad industry. After all, how many people are going to download junky browser plug-ins? On the other hand, Sambreel’s reported use of underhanded tactics could mean it is indeed widespread. The pervasiveness of hijacking plug-ins is depressing. I lent my roommate my top-of-the-line MBP from 2008 and within a couple of months it was filled with bizarre homepage hijacking plugins. A few days ago I got a hijacked DM-tweet from a top investigative journalist. I wonder if general computer literacy and best practices will ever outpace spammers' ability to infect computers?
- w1ntermute 14y ago
  Why is it even possible to install these plugins in the first place? Shouldn't they be blacklisted?
  - rsync 14y ago
    Some folks are using general purpose computing devices to access the web.
    - w1ntermute 14y ago
      I'm aware of that. I meant that Chrome should be blacklisting these plugins so that they cannot be installed, even manually.
      - rhplus 14y ago
        Blacklists are a constant game of whack-a-mole. Anything you add to the blacklist will be replaced by 10 more variants. Whitelisting would be a more reliable solution. It has snuck into consumer computing under a different name: app stores.
        paulgb 14y ago
        Interestingly, this is what Crome has done. The app store used to be a distribution point, but as of recent versions of Chrome it's become an exclusive source of extensions for exactly this reason. (There are fortunately ways around it, but it does minimize the threat of malware).
        w1ntermute 14y ago
        Correct, that's why I said "manually". I'm assuming these plug-ins are not already available in the Chrome store. I'm saying that in addition to that, Google should implement some sort of blacklisting, so that it doesn't get installed manually either.
brokentone 14y ago
A social media professional (relatively computer savvy) I know came to me recently thinking the Facebook page she managed had banner ads on it. I quickly found she had a browser extension adding it (don't remember if it's one this company created). This company is parasitic, not adding value for anyone, the publisher or user. Despite the complaints about the Chrome store becoming more of a walled garden, perhaps it would help situations like this.
- fleitz 14y ago
  You hit the nail on the head, the walled garden isn't about malware, it's about killing ad replacement and the adwords revenue it kills.
antonioevans 14y ago
Is this new? Advice : Read all user reviews when downloading addons / plugins or any software.
- mahmud 14y ago
  astroturfing & paid reviews.
charlieirish 14y ago
I'm surprised we haven't seen more of this. I fully expect companies like refer.ly and skimlinks.com to implement this model with a twist: share the revenue with customers. Customers could install the extension/plugin and browse sites as normal. However the ads they see would be earning them cash.
- paulgb 14y ago
  This would violate the TOS of Amazon and I'm pretty sure most other similar programs. In general I don't expect skimlinks' business model to work. Referral programs exist to incentivize linking to your site, not to share profit with a third party when a user of their site would have linked to you anyway.
- sbarre 14y ago
  Yeah that was tried over 10 years ago with AllAdvantage. http://en.wikipedia.org/wiki/AllAdvantage http://en.wikipedia.org/wiki/AllAdvantage
anonymouz 14y ago
Obviously the NY Times is not happy with its ads being replaced by someone. However, in my opinion this would be acceptable if it were the intention of the user. I hold the point of view that it is entirely my decision how to display websites on my devices. For example, it is up to me whether I display ads, run Javascript, or Flash. Similarly it would be okay if I decided to install a program that replaced ads on popular websites by different ones. But it seems obvious to me that the users installing this software have no clue what they are doing, and are in fact essentially installing hidden malware. And this should be the way this problem is attacked and dealt with. Not via some perceived moral rights by websites to not have their ads replaced, but simply by the fact that this company is essentially installing malware without consent. This is what should be criminally prosecuted in my opinion.
- fungi2 14y ago
  This is really no different from hiring a butler, with the understanding that he will clip out some of the ads in your physical newspaper and replace them with personals for shell companies he operates.
- danso 14y ago
  Well, the perceived moral right is sometimes what it takes for an individual entity to "get things done". I think it's safe to say that the NYT can't wait until users become tech savvy or for Google to come up with a good blacklist policy. So the NYT, if holding on to revenue is still a priority, will have to approach this problem as a self-interested, self-righteous party. Frankly, the route you propose --criminal legislation -- would not be possible without overbearing laws on the order of SOPA. How would you envision a law that banned a plugin provider from injecting "bad" content into a consenting user's browser? Defining the "bad" is what gets us into trouble here
  - anonymouz 14y ago
    I don't think new laws are needed. If the malware poses as one thing and then does another this should (hopefully, IANAL) be covered by existing laws against cracking or computer fraud. I'm not proposing putting any Orwellian laws on the book, but simply see this as a case of the company abusing the users' computer systems and apply existing laws to it. To me this is entirely analogous to some bored "hacker" talking people into installing a trojan on their computer. Since malice seems obvious and the operation is clearly a commercial one, I don't see how this being anywhere in a gray area.
shortformblog 14y ago
I remember the day I figured out a Chrome plugin I regularly used was doing this. It was a Gmail notifier that had been widely used when I started using it. And after a while, I was getting the most annoying ads on YouTube without realizing that Google hadn't changed anything. Rather, the plugin changed and added the ads to YouTube. It was so under-the-radar that I wouldn't have noticed unless I had decided one day to look up why YouTube was allowing allowing ads with sound to play over videos. I'm a savvy user, but that was literally slipped under my nose. I think a lot of users that wouldn't have been nailed by such plugins in the past are starting to find them to be a huge problem.
- Evbn 14y ago
  Well, the official YouTube ads are rather invasive and awful as well...
DanielBMarkham 14y ago
I own my browser. I may choose to replace all ads on content I consume with poetry, or white space. We need to be careful here. Simply because an ad-centric revenue model grew up around web content doesn't mean it is written in stone.
- bpatrianakos 14y ago
  I'm not sure if I can agree with this. While I do understand where you're coming from I'm hesitant to say its okay to willfully replace ads on web pages. That's a point I don't have very strong opinions on but I do strongly believe that plugins like the one in question are unquestionably unethical and not okay. You do own your browser but you don't own the sites you visit or their content. To me when someone argues for being able to replace ads on a website that's almost the equivalent of saying "I am entitled to take ownership of and alter anything I lay my eyes on". Some people counter by arguing that if it's not alright to replace ads then it's not okay to use custom CSS rules or plugins or apps designed to enhance readability. The fundamental difference between those things is that site owners want you to read their content and almost universally happily accept people using custom CSS and readability type plugins but replacing ads is different in that you are making a choice to put someone else's content on their site to the site owmer's detriment. If I were running a site that relied on ad revenue I'd almost prefer plugins that stripped out the ads altogether to one's that replace ads with one's that someone else will profit from. In the case of the former you could reasonably assume the visitor wouldn't be clicking any ads anyway but in the case of the latter that user may still click and youd get nothing. Imagine there was an eyeglass company that sold glasses that would replace certain things you saw with other things that they decided on. I know this is far out but just follow me here. Now imagine owners of these glasses walk into a mall and the glasses replaced window signage and ads with ones from the eyeglass maker's preferred partners. The shop owners in the mall would be upset but the maker of the eyeglasses would claim they're just giving their customers the deals they want. And then a certain portion of the people who wear these glasses say "I own my eyes. I may choose to replace anything I see with whatever I want". In 1996 I was 10 years old and grew up from that point on with the web. Ads were annoying for a time but the people posting and creating them learned really fast that their strategy wasn't working and from then on ads have been pretty polite. They mostly just sit in their grid positions. Sometimes they're animated and sometimes they have sound but it's off by default. I don't get why people hate online ads so much. They're easy to ignore and rarely if ever become intrusive these days. But that's a whole 'neither topic. My main point is that suppressing ads is one thing but to replace ads with others that deprive a site from the CPC revenue is unequivocally wrong. It may be legal but it's wrong.
option_greek 14y ago
What a coincidence... I removed this junk yesterday from my fathers computer. In this case, it inserts ads on top of Google search results and shows options to search using yahoo search among the other junk. Very annoying.
crb 14y ago
This sort of ad replacement is one of the ways Kim Dotcom intends to keep himself in his mansion: http://news.ycombinator.com/item?id=4576834 http://news.ycombinator.com/item?id=4576834
tptacek 14y ago
The New York Times could probably commission a Sambreel detector for less money than it's losing to these scumbags. You have a right to the screen real estate in your own browser, of course, but the NYT has the right not to serve you content if you're not going to abide by its terms. Whatever you think about the ethics of ad blocking (not a quagmire I want to wade into), NYT ads fund one of the best regarded operations in all of journalism, while Sambreel ads fund... what, exactly? Let's not lose sight of what a scam this is.
- tomjen3 14y ago
  I agree it is a scam, but I disagree that NYT is good journalism. Good journalism is meassured in impact and NYT haven't gotten anybody kicked out of office in years. It is a rag.
  - deleted 14y ago
    [deleted]
- lowboy 14y ago
  If a user knowingly choses to install a plugin that includes Sambreel, it's not a scam. It's their browser to do with what they will. Having said that, I'm guessing that there are a lot of scummy plugins/extensions that don't alert the user to Sambreel being installed. That's what's the scam here. Also, the target of the funding shouldn't enter into a discussion about legality/ethics of the method.
  - tptacek 14y ago
    The NYT is entitled to set terms that forbid the viewing of their site with Sambreel installed.
tjarmain 14y ago
What's amusing to me is that you can build something like this with 100 lines of JavaScript and a bit of Rails scaffolding (I know because I've done it).
nthitz 14y ago
Curious. Doesn't bode well for the Kim Dotcom's MEGA project.
skarip 14y ago
I have to say I have more of a problem with the advertising exchange that is allowing this to happen than the "adware" company itself. Rubicon has to not only represent the campaign buyers interests but also maintain publisher brand safety to sustain a business model. It's just a matter of time before real publishers will inevitably leave Rubicon if they continue to disregard this fact.

59 points by digisth 14y ago

danso 14y ago

> At first glance, it seems unlikely that Sambreel is pervasive enough to affect the ad industry. After all, how many people are going to download junky browser plug-ins? On the other hand, Sambreel’s reported use of underhanded tactics could mean it is indeed widespread. The pervasiveness of hijacking plug-ins is depressing. I lent my roommate my top-of-the-line MBP from 2008 and within a couple of months it was filled with bizarre homepage hijacking plugins. A few days ago I got a hijacked DM-tweet from a top investigative journalist. I wonder if general computer literacy and best practices will ever outpace spammers' ability to infect computers?

w1ntermute 14y ago
Why is it even possible to install these plugins in the first place? Shouldn't they be blacklisted?
- rsync 14y ago
  Some folks are using general purpose computing devices to access the web.
  - w1ntermute 14y ago
    I'm aware of that. I meant that Chrome should be blacklisting these plugins so that they cannot be installed, even manually.
    - rhplus 14y ago
      Blacklists are a constant game of whack-a-mole. Anything you add to the blacklist will be replaced by 10 more variants. Whitelisting would be a more reliable solution. It has snuck into consumer computing under a different name: app stores.
      - paulgb 14y ago
        Interestingly, this is what Crome has done. The app store used to be a distribution point, but as of recent versions of Chrome it's become an exclusive source of extensions for exactly this reason. (There are fortunately ways around it, but it does minimize the threat of malware).
      - w1ntermute 14y ago
        Correct, that's why I said "manually". I'm assuming these plug-ins are not already available in the Chrome store. I'm saying that in addition to that, Google should implement some sort of blacklisting, so that it doesn't get installed manually either.

brokentone 14y ago

A social media professional (relatively computer savvy) I know came to me recently thinking the Facebook page she managed had banner ads on it. I quickly found she had a browser extension adding it (don't remember if it's one this company created). This company is parasitic, not adding value for anyone, the publisher or user. Despite the complaints about the Chrome store becoming more of a walled garden, perhaps it would help situations like this.

fleitz 14y ago
You hit the nail on the head, the walled garden isn't about malware, it's about killing ad replacement and the adwords revenue it kills.

antonioevans 14y ago

Is this new? Advice : Read all user reviews when downloading addons / plugins or any software.

mahmud 14y ago
astroturfing & paid reviews.

charlieirish 14y ago

I'm surprised we haven't seen more of this. I fully expect companies like refer.ly and skimlinks.com to implement this model with a twist: share the revenue with customers. Customers could install the extension/plugin and browse sites as normal. However the ads they see would be earning them cash.

paulgb 14y ago
This would violate the TOS of Amazon and I'm pretty sure most other similar programs. In general I don't expect skimlinks' business model to work. Referral programs exist to incentivize linking to your site, not to share profit with a third party when a user of their site would have linked to you anyway.
sbarre 14y ago
Yeah that was tried over 10 years ago with AllAdvantage. http://en.wikipedia.org/wiki/AllAdvantage http://en.wikipedia.org/wiki/AllAdvantage

anonymouz 14y ago

Obviously the NY Times is not happy with its ads being replaced by someone. However, in my opinion this would be acceptable if it were the intention of the user. I hold the point of view that it is entirely my decision how to display websites on my devices. For example, it is up to me whether I display ads, run Javascript, or Flash. Similarly it would be okay if I decided to install a program that replaced ads on popular websites by different ones. But it seems obvious to me that the users installing this software have no clue what they are doing, and are in fact essentially installing hidden malware. And this should be the way this problem is attacked and dealt with. Not via some perceived moral rights by websites to not have their ads replaced, but simply by the fact that this company is essentially installing malware without consent. This is what should be criminally prosecuted in my opinion.

fungi2 14y ago
This is really no different from hiring a butler, with the understanding that he will clip out some of the ads in your physical newspaper and replace them with personals for shell companies he operates.
danso 14y ago
Well, the perceived moral right is sometimes what it takes for an individual entity to "get things done". I think it's safe to say that the NYT can't wait until users become tech savvy or for Google to come up with a good blacklist policy. So the NYT, if holding on to revenue is still a priority, will have to approach this problem as a self-interested, self-righteous party. Frankly, the route you propose --criminal legislation -- would not be possible without overbearing laws on the order of SOPA. How would you envision a law that banned a plugin provider from injecting "bad" content into a consenting user's browser? Defining the "bad" is what gets us into trouble here
- anonymouz 14y ago
  I don't think new laws are needed. If the malware poses as one thing and then does another this should (hopefully, IANAL) be covered by existing laws against cracking or computer fraud. I'm not proposing putting any Orwellian laws on the book, but simply see this as a case of the company abusing the users' computer systems and apply existing laws to it. To me this is entirely analogous to some bored "hacker" talking people into installing a trojan on their computer. Since malice seems obvious and the operation is clearly a commercial one, I don't see how this being anywhere in a gray area.

shortformblog 14y ago

I remember the day I figured out a Chrome plugin I regularly used was doing this. It was a Gmail notifier that had been widely used when I started using it. And after a while, I was getting the most annoying ads on YouTube without realizing that Google hadn't changed anything. Rather, the plugin changed and added the ads to YouTube. It was so under-the-radar that I wouldn't have noticed unless I had decided one day to look up why YouTube was allowing allowing ads with sound to play over videos. I'm a savvy user, but that was literally slipped under my nose. I think a lot of users that wouldn't have been nailed by such plugins in the past are starting to find them to be a huge problem.

Evbn 14y ago
Well, the official YouTube ads are rather invasive and awful as well...

DanielBMarkham 14y ago

I own my browser. I may choose to replace all ads on content I consume with poetry, or white space. We need to be careful here. Simply because an ad-centric revenue model grew up around web content doesn't mean it is written in stone.

bpatrianakos 14y ago
I'm not sure if I can agree with this. While I do understand where you're coming from I'm hesitant to say its okay to willfully replace ads on web pages. That's a point I don't have very strong opinions on but I do strongly believe that plugins like the one in question are unquestionably unethical and not okay. You do own your browser but you don't own the sites you visit or their content. To me when someone argues for being able to replace ads on a website that's almost the equivalent of saying "I am entitled to take ownership of and alter anything I lay my eyes on". Some people counter by arguing that if it's not alright to replace ads then it's not okay to use custom CSS rules or plugins or apps designed to enhance readability. The fundamental difference between those things is that site owners want you to read their content and almost universally happily accept people using custom CSS and readability type plugins but replacing ads is different in that you are making a choice to put someone else's content on their site to the site owmer's detriment. If I were running a site that relied on ad revenue I'd almost prefer plugins that stripped out the ads altogether to one's that replace ads with one's that someone else will profit from. In the case of the former you could reasonably assume the visitor wouldn't be clicking any ads anyway but in the case of the latter that user may still click and youd get nothing. Imagine there was an eyeglass company that sold glasses that would replace certain things you saw with other things that they decided on. I know this is far out but just follow me here. Now imagine owners of these glasses walk into a mall and the glasses replaced window signage and ads with ones from the eyeglass maker's preferred partners. The shop owners in the mall would be upset but the maker of the eyeglasses would claim they're just giving their customers the deals they want. And then a certain portion of the people who wear these glasses say "I own my eyes. I may choose to replace anything I see with whatever I want". In 1996 I was 10 years old and grew up from that point on with the web. Ads were annoying for a time but the people posting and creating them learned really fast that their strategy wasn't working and from then on ads have been pretty polite. They mostly just sit in their grid positions. Sometimes they're animated and sometimes they have sound but it's off by default. I don't get why people hate online ads so much. They're easy to ignore and rarely if ever become intrusive these days. But that's a whole 'neither topic. My main point is that suppressing ads is one thing but to replace ads with others that deprive a site from the CPC revenue is unequivocally wrong. It may be legal but it's wrong.

option_greek 14y ago

What a coincidence... I removed this junk yesterday from my fathers computer. In this case, it inserts ads on top of Google search results and shows options to search using yahoo search among the other junk. Very annoying.

crb 14y ago

This sort of ad replacement is one of the ways Kim Dotcom intends to keep himself in his mansion: http://news.ycombinator.com/item?id=4576834 http://news.ycombinator.com/item?id=4576834

tptacek 14y ago

The New York Times could probably commission a Sambreel detector for less money than it's losing to these scumbags. You have a right to the screen real estate in your own browser, of course, but the NYT has the right not to serve you content if you're not going to abide by its terms. Whatever you think about the ethics of ad blocking (not a quagmire I want to wade into), NYT ads fund one of the best regarded operations in all of journalism, while Sambreel ads fund... what, exactly? Let's not lose sight of what a scam this is.

tomjen3 14y ago
I agree it is a scam, but I disagree that NYT is good journalism. Good journalism is meassured in impact and NYT haven't gotten anybody kicked out of office in years. It is a rag.
- deleted 14y ago
  [deleted]
lowboy 14y ago
If a user knowingly choses to install a plugin that includes Sambreel, it's not a scam. It's their browser to do with what they will. Having said that, I'm guessing that there are a lot of scummy plugins/extensions that don't alert the user to Sambreel being installed. That's what's the scam here. Also, the target of the funding shouldn't enter into a discussion about legality/ethics of the method.
- tptacek 14y ago
  The NYT is entitled to set terms that forbid the viewing of their site with Sambreel installed.

tjarmain 14y ago

What's amusing to me is that you can build something like this with 100 lines of JavaScript and a bit of Rails scaffolding (I know because I've done it).

nthitz 14y ago

Curious. Doesn't bode well for the Kim Dotcom's MEGA project.

skarip 14y ago

I have to say I have more of a problem with the advertising exchange that is allowing this to happen than the "adware" company itself. Rubicon has to not only represent the campaign buyers interests but also maintain publisher brand safety to sustain a business model. It's just a matter of time before real publishers will inevitably leave Rubicon if they continue to disregard this fact.