Hacker News Reader

Comment by CiPHPerCoder | Hacker News Reader

In this case, high-profit ads include dynamic content (JavaScript or Flash). Safe (but boring) ads would simply be an image or text link with no tracking capabilities that doesn't use CSS hacks to interrupt your page reading. It just sits up there saying, "If you want it, check this out."

View on HN

Tracking still happens with "safe" ads. Generally "image pixels" as they call em are actually server side scripts that then pretend to be an image that way they can still track the users IP and what they were doing at that point in time.

That data is already sent to the server. This doesn't give the server control over the user's hardware.

Javascript and Flash ads are the more immediately dangerous ads, but you can still distribute malware over image and text links. You just move from exploiting browser vulnerabilities to exploiting user trust, like all of the imitation VLC download pages that have popped up over the years.

We'd be better off with only static image/text ads, yes, but malware distribution by means of poorly vetted advertising wouldn't totally vanish.

Yes, and they'd be burning image library 0days in the process. Security would improve overall.

I can honestly say that I've clicked on quite a few static ads with the intention of learning more. Dynamic ads, however, I refuse to click.

Same, and in a few cases I didn't realize they were ads because they were so non-intrusive.

Reply on news.ycombinator.com