6 ms·

I've worked for adware companies for a long time. I find it crazy how many news publications, investors, and technologists don't realize how many companies are

I've worked for adware companies for a long time. I find it crazy how many news publications, investors, and technologists don't realize how many companies are part of the adware ecosystem. Iron Source is one of them and they just raised a lot of money from JPMorgan and Morgan Stanley to fund acquisitions in preparation for their IPO. AMAA.

infogulch 12y ago
I'll bite. Here's a question I saw in a thread about lenovo/superfish (can't find it now), followed by some of my own: What's it like building software that literally no one wants on their computer? Is that last question wrong, and are there actually people that truly, unequivocally enjoy adware? Is there a reality-distortion-field where some people building such software actually believe that they're making things that most people want? Are meetings/discussions about building the adware ever openly malevolent towards users? Or is it always "just business"?
- exadsthrowaway 12y ago
  Another ex-adware person here: Building software nobody wants is pretty soul-crushing (I've since left the ad industry altogether), and I haven't heard a case of anyone actually wanting my previous employer's software. Of course there's rationalizations ("That's just the way the internet works", "If we don't do it someone else will", and the insane "They agreed to the terms"), but I don't think anyone has the mental capacity to convince themselves people actually want malware. People making adware generally aren't openly malevolent, but there seems to be the consensus that 'users' who install the software are idiots (sometimes with the implication that this makes it okay to scam them). That said, it's still lucrative (and with very low risk of any repercussions), so most of the industry just wants money and doesn't really care.
  - PinnBrain 12y ago
    Those that install adware are less intelligent--no need to paper over that. Do the writers of educational shows for small children think it ironic that they are more intelligent than their customers?
    - belorn 12y ago
      You mean those like Lenovo, or people who bought their laptops?
      - PinnBrain 12y ago
        The people.
    - DanBC 12y ago
      Since adware often uses dark patterns to trick people into installing it I'm not sure you can draw any conclusions about intelligence. Ability to scrutinise every panel of an installation script, and check or uncheck a variety of boxes that might be described with double or tripple negatives -- and that's for the adware that is polite enough to tell you ot's going to install itself.
      - PinnBrain 12y ago
        But the presence of a nuisance toolbar afterwards will be quite obvious.
        DanBC 12y ago
        Ignoring for a moment all the adware that doesn't install toolbars -- superfish doesn't -- you seem to have no idea about actual users. Most people would not notice an extra toolbar, or would think it's part of the default browser.
        tmzt 12y ago
        Not knowing how to repair something can result in a form of learned helplessness, a belief that you are less of something than someone else. There are efforts to show people that they don't need to buy a new computer, or install software that intentionally limits what their computer can do, or pretends to fix it for a fee. Even the programs that actually work to remove these kinds of threats (including AdAware and SD Search and Destroy) can blur the distinction between actions that are necessary to repair the problem and things that are a different kind of nuisance but not directly a threat to the operation of the computer (like tracking cookies). Software that makes installing it to use it optional is preferred, as the ongoing monitoring can often tax the computer as badly as the software being removed. (Note I'm talking only about anti-adware software here, not general anti-virus software.) I would love to give a better option than re-install your operating system all of your software, and even that is often a difficult option since the re-installation mediums aren't even shipped with the computer in many cases. I don't want to direct a person to a service where they take the computer to be fixed that often charges more than seems fair for the hands-off approach they take to re-imaging. Oh, on your last part, I've encountered more than one laptop where all of the installed browsers had been limited to a fraction of the screen being readable due to the number of toolbars, and general search engines being inaccessible or unusable due to the number of injection adds and popups.
  - taylorbuley 12y ago
    And its big players too! I've uninstalled dozens and dozens of Ask.com and Yahoo Toolbars. In once instance, there were three in a row stacked on top of each other embedded into Firefox. Google bundled with WinZip if I remember correctly.
  - wanderingstan 12y ago
    In the mid-2000's I had a new co-worker who had recently come from Gator[1]. Even not working there any longer, he maintained that their software was an incredible product and that the injected ads were "yeah, a little aggressive, but they're fixing that!" His rationalization powers were shocking. [1] https://en.wikipedia.org/wiki/Claria_Corporation#Gator https://en.wikipedia.org/wiki/Claria_Corporation#Gator
    - stuart78 12y ago
      From that Wikipedia article: "Gator's end user license agreement attempts to disallow its manual removal by prohibiting "unauthorized means" of uninstallation." Reading the word Gator really took me back in time. Never worked on that stuff, but it brought back the visceral pain of sitting down at a friend or inlaw's computer to find Gator or one of its peers installed. Each time the internal debate: to simply remove it, to try and explain why it is bad or simply to ignore...
    - ex-adware 12y ago
      Pretty much! And the funny thing is that every company is always "fixing that" until they make the advertising less aggressive and revenue drops 30%. Then they turn the dial back up.
- at-fates-hands 12y ago
  >>> Is that last question wrong, and are there actually people that truly, unequivocally enjoy adware? I used to think the same thing, then met a guy who was a fairly prolific ad spammer. He basically said the reason any type of adware exists is because it actually works. He said if nobody ever bought anything or clicked on any of the annoying pop-ups, adware would disappear inside of six months. In essence, for web savy users, it's completely baffling why people would want this on their PC's. In reality, there are a ton, and I mean a TON of people who do click on the links and do buy from these types of invasive ads, which continue to be a very lucrative, very competitive market.
  - heywire 12y ago
    Brian Krebs' book Spam Nation talks about this quite a bit. So many people still buy prescription medications and fake watches and such through junk email. Enough that it still makes financial sense for the spammers to keep at it.
    - taylorbuley 12y ago
      Interestingly, I read an academic paper that discussed how spamming vendors often actually deliver on these prescription medications, etc. You'd think they'd take the money and and run scammers, but in fact it's marketing for actual commerce.
      - JackuB 12y ago
        I think lot of those real businesses are selling their products this way, because scam/adware networks are much cheaper than AdSense (few dollars for ten thousands of views) I saw lot of adware ads are also for courses for _rich life_/making money on internet etc. I can imagine these businesses' target demo are people that get affected by adware.
      - DanBC 12y ago
        Although the medication you get may be counterfeit and either contaminated or not the actual chemical that you want.
- asher 12y ago
  I never worked on Adware, but I worked on a system called PrintMe, which enabled users to print to printers in Kinko's, airports, hotels, etc. (I saw PrintMe as a logical next step after working on Cisco's internal CEPS printing system.) PrintMe partnered with Adobe to add a PrintMe entry in the File menu of Acrobat. This was not received with universal applause. Typical disgruntled user: https://grumpybear.wordpress.com/2010/05/09/remove-printme-internet-printing-from-adobe-acrobat-7/ https://grumpybear.wordpress.com/2010/05/09/remove-printme-i... Nobody was openly malevolent towards users. There was earnest hope that busy business travellers, who otherwise wouldn't know about PrintMe, might use that menu entry once and become hooked. We knew the product was very useful to a certain kind of traveller, but getting that person to notice and try the product was hard.
- btipling 12y ago
  I worked on the Ask Toolbar back in 2009. I did an AMA about it on reddit way back when[1]. I was hired to work on Bloglines, a Google Reader competitor that was shut down and I moved to the toolbar to work on the Firefox version. I just wanted to make a good toolbar that people liked using. I worked on a Facebook version of the toolbar. A lot of the ugly things about the toolbar, the way it gets installed and what it changes for users are options the company (Nero, Oracle etc) that adopts the toolbar pick. It was a really good team with great people, but despite this I didn't feel good about working on the toolbar because of how it was used. Everyone on my team just wanted to make a really good toolbar. I am not proud of the work but not because of anything our team did. I don't plan to do any kind of work like that again. [1] http://www.reddit.com/r/IAmA/comments/bqvme/i_am_an_ask_toolbar_developer_amaa/ http://www.reddit.com/r/IAmA/comments/bqvme/i_am_an_ask_tool...
- ex-adware 12y ago
  These are all very fair questions. You find ways to mentally make it not about the adware. You're building a monetization system that allows other software makers to continue their craft! No one wants adware. I think my first response supports your notion of a reality distortion field. People try and forget its adware and think more about the cool technical challenges (millions of installs per day!) or reframe it to not be about the adware. The meetings were never openly malevolent towards users and there was a legal team to make sure user rights were never actually violated. People would come to our meetings and they would never realize we were an adware company, it just sounded like normal ad tech.
  - exadsthrowaway 12y ago
    That's certainly one of the ways to rationalize it - scaling out the infra was actually pretty fun. Legal stuff and the 'monetization' rationality are pretty spot on with my experience. There were even a few puff pieces from local tech outlets that had no idea they were a malware company.
    - ex-adware 12y ago
      Sounds like you're not from Download Valley. US?
Matt_Cutts 12y ago
Can you talk a little more about the players and the landscape? Do you live in Download Valley?
- adwarekiller 12y ago
  Another ex-adware person here, from the download valley itself. AFAIK, the key roles in the adware ecosystem are: a. Distribution Done mainly through "Pey Per Install" companies such as IronSource, InstallMontizer (actually funded by YC: https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711), InstallRex, etc. These folks bundle legitimate programs with adware in their installers. They use dark patterns (http://www.hanselman.com/blog/DownloadWrappersAndUnwantedSoftwareArePureEvil.aspx http://www.hanselman.com/blog/DownloadWrappersAndUnwantedSof...) in order to deceive users to install the offered "product". Some of them make it intentionally hard (practically impossible for the non-techie user) to uninstall the adware, or downloading additional adware without user consent (drive-by). Other shady practices include the use of malvertising (e.g. ad that mimic flash, acrobat or OS update) and the most extreme one, which is rare but exists, is exploit kits. b. Monetization Done mainly with advertising and information harvesting. Common practices (aka "revenue models"): ad injection (banners, pop-up\under, etc), affiliate fraud ("price comparison widgets", or just forcefully redirect user through affiliate link) , lead generation (e.g. scraping insurance details), social networks spam (Selling views, likes, followers, etc - works because google\fb\etc eliminates fake bot account fairly efficiently, but adware just impersonate real authenticated sessions) and selling cheap traffic.
  - adwarekiller 12y ago
    I can't edit the original comment for some reason. Sorry for the n00bism, its my first comment here on HN. I want to add this: The profit of an adware company is the difference between its user acquisition cost and the revenue from the monetization phase. As the monetization phase gets shortened by AV detection and removal, the lower the revenue gets. This cause adware vendor to adapt new methods that transitionally were associated with "more evil" malware (banking trojans): they use crypters and vulnerabilities in AVs in order to evade detection, randomly generated domain names (for the C&C, inject and publishing domains), etc. Feel free to AMA
dlwhite 12y ago
Who are the largest adware companies by ad impression volume?
- adwarekiller 12y ago
  Many people consider 50onRed (under International Web Services LLC: http://www.advertising-support.com/ http://www.advertising-support.com/) as the biggest company in the field. According to a publication from March 2014, they serve up to 1.5 billion impressions per day (http://adage.com/article/digital/big-ad-injection-scheme-hits-target-youtube-walmart/293088/ http://adage.com/article/digital/big-ad-injection-scheme-hit...).
- ex-adware 12y ago
  I'm not sure, but if adwarekiller's numbers are correct that could put them up there.

infogulch 12y ago

I'll bite. Here's a question I saw in a thread about lenovo/superfish (can't find it now), followed by some of my own: What's it like building software that literally no one wants on their computer? Is that last question wrong, and are there actually people that truly, unequivocally enjoy adware? Is there a reality-distortion-field where some people building such software actually believe that they're making things that most people want? Are meetings/discussions about building the adware ever openly malevolent towards users? Or is it always "just business"?

exadsthrowaway 12y ago
Another ex-adware person here: Building software nobody wants is pretty soul-crushing (I've since left the ad industry altogether), and I haven't heard a case of anyone actually wanting my previous employer's software. Of course there's rationalizations ("That's just the way the internet works", "If we don't do it someone else will", and the insane "They agreed to the terms"), but I don't think anyone has the mental capacity to convince themselves people actually want malware. People making adware generally aren't openly malevolent, but there seems to be the consensus that 'users' who install the software are idiots (sometimes with the implication that this makes it okay to scam them). That said, it's still lucrative (and with very low risk of any repercussions), so most of the industry just wants money and doesn't really care.
- PinnBrain 12y ago
  Those that install adware are less intelligent--no need to paper over that. Do the writers of educational shows for small children think it ironic that they are more intelligent than their customers?
  - belorn 12y ago
    You mean those like Lenovo, or people who bought their laptops?
    - PinnBrain 12y ago
      The people.
  - DanBC 12y ago
    Since adware often uses dark patterns to trick people into installing it I'm not sure you can draw any conclusions about intelligence. Ability to scrutinise every panel of an installation script, and check or uncheck a variety of boxes that might be described with double or tripple negatives -- and that's for the adware that is polite enough to tell you ot's going to install itself.
    - PinnBrain 12y ago
      But the presence of a nuisance toolbar afterwards will be quite obvious.
      - DanBC 12y ago
        Ignoring for a moment all the adware that doesn't install toolbars -- superfish doesn't -- you seem to have no idea about actual users. Most people would not notice an extra toolbar, or would think it's part of the default browser.
        tmzt 12y ago
        Not knowing how to repair something can result in a form of learned helplessness, a belief that you are less of something than someone else. There are efforts to show people that they don't need to buy a new computer, or install software that intentionally limits what their computer can do, or pretends to fix it for a fee. Even the programs that actually work to remove these kinds of threats (including AdAware and SD Search and Destroy) can blur the distinction between actions that are necessary to repair the problem and things that are a different kind of nuisance but not directly a threat to the operation of the computer (like tracking cookies). Software that makes installing it to use it optional is preferred, as the ongoing monitoring can often tax the computer as badly as the software being removed. (Note I'm talking only about anti-adware software here, not general anti-virus software.) I would love to give a better option than re-install your operating system all of your software, and even that is often a difficult option since the re-installation mediums aren't even shipped with the computer in many cases. I don't want to direct a person to a service where they take the computer to be fixed that often charges more than seems fair for the hands-off approach they take to re-imaging. Oh, on your last part, I've encountered more than one laptop where all of the installed browsers had been limited to a fraction of the screen being readable due to the number of toolbars, and general search engines being inaccessible or unusable due to the number of injection adds and popups.
- taylorbuley 12y ago
  And its big players too! I've uninstalled dozens and dozens of Ask.com and Yahoo Toolbars. In once instance, there were three in a row stacked on top of each other embedded into Firefox. Google bundled with WinZip if I remember correctly.
- wanderingstan 12y ago
  In the mid-2000's I had a new co-worker who had recently come from Gator[1]. Even not working there any longer, he maintained that their software was an incredible product and that the injected ads were "yeah, a little aggressive, but they're fixing that!" His rationalization powers were shocking. [1] https://en.wikipedia.org/wiki/Claria_Corporation#Gator https://en.wikipedia.org/wiki/Claria_Corporation#Gator
  - stuart78 12y ago
    From that Wikipedia article: "Gator's end user license agreement attempts to disallow its manual removal by prohibiting "unauthorized means" of uninstallation." Reading the word Gator really took me back in time. Never worked on that stuff, but it brought back the visceral pain of sitting down at a friend or inlaw's computer to find Gator or one of its peers installed. Each time the internal debate: to simply remove it, to try and explain why it is bad or simply to ignore...
  - ex-adware 12y ago
    Pretty much! And the funny thing is that every company is always "fixing that" until they make the advertising less aggressive and revenue drops 30%. Then they turn the dial back up.
at-fates-hands 12y ago
>>> Is that last question wrong, and are there actually people that truly, unequivocally enjoy adware? I used to think the same thing, then met a guy who was a fairly prolific ad spammer. He basically said the reason any type of adware exists is because it actually works. He said if nobody ever bought anything or clicked on any of the annoying pop-ups, adware would disappear inside of six months. In essence, for web savy users, it's completely baffling why people would want this on their PC's. In reality, there are a ton, and I mean a TON of people who do click on the links and do buy from these types of invasive ads, which continue to be a very lucrative, very competitive market.
- heywire 12y ago
  Brian Krebs' book Spam Nation talks about this quite a bit. So many people still buy prescription medications and fake watches and such through junk email. Enough that it still makes financial sense for the spammers to keep at it.
  - taylorbuley 12y ago
    Interestingly, I read an academic paper that discussed how spamming vendors often actually deliver on these prescription medications, etc. You'd think they'd take the money and and run scammers, but in fact it's marketing for actual commerce.
    - JackuB 12y ago
      I think lot of those real businesses are selling their products this way, because scam/adware networks are much cheaper than AdSense (few dollars for ten thousands of views) I saw lot of adware ads are also for courses for _rich life_/making money on internet etc. I can imagine these businesses' target demo are people that get affected by adware.
    - DanBC 12y ago
      Although the medication you get may be counterfeit and either contaminated or not the actual chemical that you want.
asher 12y ago
I never worked on Adware, but I worked on a system called PrintMe, which enabled users to print to printers in Kinko's, airports, hotels, etc. (I saw PrintMe as a logical next step after working on Cisco's internal CEPS printing system.) PrintMe partnered with Adobe to add a PrintMe entry in the File menu of Acrobat. This was not received with universal applause. Typical disgruntled user: https://grumpybear.wordpress.com/2010/05/09/remove-printme-internet-printing-from-adobe-acrobat-7/ https://grumpybear.wordpress.com/2010/05/09/remove-printme-i... Nobody was openly malevolent towards users. There was earnest hope that busy business travellers, who otherwise wouldn't know about PrintMe, might use that menu entry once and become hooked. We knew the product was very useful to a certain kind of traveller, but getting that person to notice and try the product was hard.
btipling 12y ago
I worked on the Ask Toolbar back in 2009. I did an AMA about it on reddit way back when[1]. I was hired to work on Bloglines, a Google Reader competitor that was shut down and I moved to the toolbar to work on the Firefox version. I just wanted to make a good toolbar that people liked using. I worked on a Facebook version of the toolbar. A lot of the ugly things about the toolbar, the way it gets installed and what it changes for users are options the company (Nero, Oracle etc) that adopts the toolbar pick. It was a really good team with great people, but despite this I didn't feel good about working on the toolbar because of how it was used. Everyone on my team just wanted to make a really good toolbar. I am not proud of the work but not because of anything our team did. I don't plan to do any kind of work like that again. [1] http://www.reddit.com/r/IAmA/comments/bqvme/i_am_an_ask_toolbar_developer_amaa/ http://www.reddit.com/r/IAmA/comments/bqvme/i_am_an_ask_tool...
ex-adware 12y ago
These are all very fair questions. You find ways to mentally make it not about the adware. You're building a monetization system that allows other software makers to continue their craft! No one wants adware. I think my first response supports your notion of a reality distortion field. People try and forget its adware and think more about the cool technical challenges (millions of installs per day!) or reframe it to not be about the adware. The meetings were never openly malevolent towards users and there was a legal team to make sure user rights were never actually violated. People would come to our meetings and they would never realize we were an adware company, it just sounded like normal ad tech.
- exadsthrowaway 12y ago
  That's certainly one of the ways to rationalize it - scaling out the infra was actually pretty fun. Legal stuff and the 'monetization' rationality are pretty spot on with my experience. There were even a few puff pieces from local tech outlets that had no idea they were a malware company.
  - ex-adware 12y ago
    Sounds like you're not from Download Valley. US?

Matt_Cutts 12y ago

Can you talk a little more about the players and the landscape? Do you live in Download Valley?

adwarekiller 12y ago
Another ex-adware person here, from the download valley itself. AFAIK, the key roles in the adware ecosystem are: a. Distribution Done mainly through "Pey Per Install" companies such as IronSource, InstallMontizer (actually funded by YC: https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711), InstallRex, etc. These folks bundle legitimate programs with adware in their installers. They use dark patterns (http://www.hanselman.com/blog/DownloadWrappersAndUnwantedSoftwareArePureEvil.aspx http://www.hanselman.com/blog/DownloadWrappersAndUnwantedSof...) in order to deceive users to install the offered "product". Some of them make it intentionally hard (practically impossible for the non-techie user) to uninstall the adware, or downloading additional adware without user consent (drive-by). Other shady practices include the use of malvertising (e.g. ad that mimic flash, acrobat or OS update) and the most extreme one, which is rare but exists, is exploit kits. b. Monetization Done mainly with advertising and information harvesting. Common practices (aka "revenue models"): ad injection (banners, pop-up\under, etc), affiliate fraud ("price comparison widgets", or just forcefully redirect user through affiliate link) , lead generation (e.g. scraping insurance details), social networks spam (Selling views, likes, followers, etc - works because google\fb\etc eliminates fake bot account fairly efficiently, but adware just impersonate real authenticated sessions) and selling cheap traffic.
- adwarekiller 12y ago
  I can't edit the original comment for some reason. Sorry for the n00bism, its my first comment here on HN. I want to add this: The profit of an adware company is the difference between its user acquisition cost and the revenue from the monetization phase. As the monetization phase gets shortened by AV detection and removal, the lower the revenue gets. This cause adware vendor to adapt new methods that transitionally were associated with "more evil" malware (banking trojans): they use crypters and vulnerabilities in AVs in order to evade detection, randomly generated domain names (for the C&C, inject and publishing domains), etc. Feel free to AMA

dlwhite 12y ago

Who are the largest adware companies by ad impression volume?

adwarekiller 12y ago
Many people consider 50onRed (under International Web Services LLC: http://www.advertising-support.com/ http://www.advertising-support.com/) as the biggest company in the field. According to a publication from March 2014, they serve up to 1.5 billion impressions per day (http://adage.com/article/digital/big-ad-injection-scheme-hits-target-youtube-walmart/293088/ http://adage.com/article/digital/big-ad-injection-scheme-hit...).
ex-adware 12y ago
I'm not sure, but if adwarekiller's numbers are correct that could put them up there.