4 ms·

Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it af

by corin_ 13y ago

Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? And even if I submit code that is malicious from the start, if it also correctly serves an advert, will you actually notice the extra code if all it's doing is opening a few extra connections? Maybe you have answers to these questions - I've never worked on an adops side at all, I'm on the buying side, so never had to worry about it. p.s. Dropped you an email earlier Brad - give me a shout, I really want to try out Perfect Audience!

dangrossman 13y ago
> Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? You can let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs. There's no risk in the script changing if you're only hosting inline code they have no access to after review.
- rorrr2 13y ago
  > let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs How would you do that? That's equivalent to the halting problem. There is an infinite number of ways to assemble code that will execute arbitrary code, which can can assemble code that will execute arbitrary code, which ...
  - deleted 13y ago
    [deleted]
    - rorrr2 13y ago
      It means that every piece of the code must be examined by a human. That's expensive.
      - deleted 13y ago
        [deleted]
- corin_ 13y ago
  There's many (perfectly legitimate) buyers out there for whom this would be a deal breaker. If you don't run the adverts through my server (i.e. including using JS on my adserver) then you won't be serving my adverts. And in the world of media buying, that's not at all uncommon.
brandnewlow 13y ago
D'oh! Just wrote you back. My bad. So the vetting we do is somewhat extreme. We ask you to sign on as an enterprise customer to run ads like that. Making things more official tends to weed people out pretty quickly and leaves us just the well-intending players.

by corin_ 13y ago

dangrossman 13y ago

> Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users? You can let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs. There's no risk in the script changing if you're only hosting inline code they have no access to after review.

rorrr2 13y ago
> let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs How would you do that? That's equivalent to the halting problem. There is an infinite number of ways to assemble code that will execute arbitrary code, which can can assemble code that will execute arbitrary code, which ...
- deleted 13y ago
  [deleted]
  - rorrr2 13y ago
    It means that every piece of the code must be examined by a human. That's expensive.
    - deleted 13y ago
      [deleted]
corin_ 13y ago
There's many (perfectly legitimate) buyers out there for whom this would be a deal breaker. If you don't run the adverts through my server (i.e. including using JS on my adserver) then you won't be serving my adverts. And in the world of media buying, that's not at all uncommon.

brandnewlow 13y ago

D'oh! Just wrote you back. My bad. So the vetting we do is somewhat extreme. We ask you to sign on as an enterprise customer to run ads like that. Making things more official tends to weed people out pretty quickly and leaves us just the well-intending players.