5 ms·

The researchers in the article are quoted as saying they don't know who's fault this is. That's B.S. It's absolutely the fault of the ad network/ad buying too

The researchers in the article are quoted as saying they don't know who's fault this is. That's B.S. It's absolutely the fault of the ad network/ad buying tool/DSP/whatever. When you open up a platform to let people buy ads, there are loads of decisions to be made. The ones around "what content do we let people submit without vetting" are pretty simple. At Perfect Audience, self-service customers can upload static image banners and traffic those. We host them. No JS. No flash. If folks want to traffic those kinds of ads, we have an enterprise support play they can sign up for and we'll help them do that easily. Letting anyone traffic js or flash files without prior vetting is hugely lazy. I wish they'd named the ad network they bought through so they could be black-balled and barred from the exchanges. It's so easy to say no to crap advertising, and yet there's always unscrupulous players who say yes to it. There's no excuse. It's all their fault for just not giving a crap. Edit: Also, when you get access to the ad exchanges, you sign a ton of documents and agree to be responsible for what you traffic in many ways. This network is dropping the ball.

rfnslyr 13y ago
>It's absolutely the fault of the ad network/ad buying tool/DSP/whatever. So which is it? They generally know whose fault it is, but not whose fault it is (person/team/some developer) is what they probably meant.
- brandnewlow 13y ago
  It's the CEO's fault. It's a business decision to allow un-checked code in ads or to not assign enough resources to properly check the code.
kposehn 13y ago
Agreed. I do want to know what network it is - probably a fly-by-night outfit. We can allow HTML/JS in our ads because we inspect them and only allow direct references (no external libraries) in-ad.
- tracker1 13y ago
  Okay, so you allow me to post an advert with a direct reference to "//myhost.com/ad/campain-456/advert.js" ??? If that's the case, what's to prevent me from changing that JS file? The safer thing to do, would be to require that the entire payload be delivered together, index.html, with images/js/css etc (uncompressed)... then do the min/merge and inline it all into the html before serving.
  - kposehn 13y ago
    We don't allow any external calls/loads and strictly limit access to just DOM operations in the iframe. Not many people use JS in ads with our platform, so we spend the time to thoroughly vet them.
corin_ 13y ago
Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? And even if I submit code that is malicious from the start, if it also correctly serves an advert, will you actually notice the extra code if all it's doing is opening a few extra connections? Maybe you have answers to these questions - I've never worked on an adops side at all, I'm on the buying side, so never had to worry about it. p.s. Dropped you an email earlier Brad - give me a shout, I really want to try out Perfect Audience!
- dangrossman 13y ago
  > Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? You can let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs. There's no risk in the script changing if you're only hosting inline code they have no access to after review.
  - rorrr2 13y ago
    > let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs How would you do that? That's equivalent to the halting problem. There is an infinite number of ways to assemble code that will execute arbitrary code, which can can assemble code that will execute arbitrary code, which ...
    - deleted 13y ago
      [deleted]
      - rorrr2 13y ago
        It means that every piece of the code must be examined by a human. That's expensive.

rfnslyr 13y ago

>It's absolutely the fault of the ad network/ad buying tool/DSP/whatever. So which is it? They generally know whose fault it is, but not whose fault it is (person/team/some developer) is what they probably meant.

brandnewlow 13y ago
It's the CEO's fault. It's a business decision to allow un-checked code in ads or to not assign enough resources to properly check the code.

kposehn 13y ago

Agreed. I do want to know what network it is - probably a fly-by-night outfit. We can allow HTML/JS in our ads because we inspect them and only allow direct references (no external libraries) in-ad.

tracker1 13y ago
Okay, so you allow me to post an advert with a direct reference to "//myhost.com/ad/campain-456/advert.js" ??? If that's the case, what's to prevent me from changing that JS file? The safer thing to do, would be to require that the entire payload be delivered together, index.html, with images/js/css etc (uncompressed)... then do the min/merge and inline it all into the html before serving.
- kposehn 13y ago
  We don't allow any external calls/loads and strictly limit access to just DOM operations in the iframe. Not many people use JS in ads with our platform, so we spend the time to thoroughly vet them.

corin_ 13y ago

Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? And even if I submit code that is malicious from the start, if it also correctly serves an advert, will you actually notice the extra code if all it's doing is opening a few extra connections? Maybe you have answers to these questions - I've never worked on an adops side at all, I'm on the buying side, so never had to worry about it. p.s. Dropped you an email earlier Brad - give me a shout, I really want to try out Perfect Audience!

dangrossman 13y ago
> Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? You can let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs. There's no risk in the script changing if you're only hosting inline code they have no access to after review.
- rorrr2 13y ago
  > let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs How would you do that? That's equivalent to the halting problem. There is an infinite number of ways to assemble code that will execute arbitrary code, which can can assemble code that will execute arbitrary code, which ...
  - deleted 13y ago
    [deleted]
    - rorrr2 13y ago
      It means that every piece of the code must be examined by a human. That's expensive.