Hacker News Reader

Comment by corford | Hacker News Reader

It's going to be hard for facebook because they're such a big target.

I think where ad-blockers will start to have problems is with the millions of lesser known sites. Once these publishers swap over to proxying ad-content through their own domains and using a handful of simple evasion tactics (random file name for the self hosted JS file that pulls in the ad, site specific pseudo-random DOM element names for the ad spaces, not using an obvious sub-domain to load proxied ad content from); stopping ads getting through is going to require a lot more effort than blacklisting a few ad-server domains.

View on HN

A question: once site owners proxy ads through their own domains, will they become liable when they serve malware?

Right now the usual defense seems to be "we just buy 'em", but that's going to be a lot less convincing once Forbes.com is actively serving malware from their own site.

No idea, I'm not a lawyer. Assuming liability is a real problem presumably this is fixed by ad networks improving their vetting and offering some sort of insurance to publishers in the event malware sneaks through.

Alternatively, as mentioned in another comment, proxying might mean simply installing a managed ad-server within the publisher's infrastructure. So from an end-user PoV it looks like it's coming from the publisher's server but in reality it's still being served from a third party managed box.

Until the adserver serves malicious ads (which has happened dozens of times on high profile sites in the past year or so), and then the website is sued.

Yeah but if the adserver is a black box that's managed by the ad network I would have thought the website could pass the liability on to them (and state this in their ToS somewhere)

Proxying ads would be a big security risk though since it means they would run within the same sandbox as the rest of the page, which might be why it hasn't often been done yet.

It'd also be a big risk in that it'd be easier to cheat the ads as they'd all come from the same connecting IP. I doubt advertisers would appreciate that much.

Indeed, proxying is basically pointless. At that point, it would be better for the site and for the advertisers (and users who don't block ads) for the site to simply self-report. At least then they avoid the extra overhead and load times (which might, btw, be detectable by ad blockers).

Alternatively, advertisers could host a server on the site's domain. A subdomain or specific path would be easily blocked, but a random path wouldn't be, e.g. http://www.example.com/626164776F6C66/ with identifier generated randomly. Plenty of existing content already looks this way.

Yeah, this is how I envisage it. Publisher gets a docker image (or whatever) from the ad-network and hosts it internally on their network. Then you just need to map a random path from nginx/haproxy. Client IP can be passed through too.

I can't see that working out well, it'd just be way too easy to cheat, you could fake any IP you wanted, pretend to be connecting from the regular consumer ISPs and generate fake hits, fake clicks and otherwise easily steal from the ad network. This will never happen, it's a non-starter. They have enough problems with fake clickers already. There's no way to pass it using a reverse proxy, docker image, whatever, where the hosting website doesn't have ultimate control over the data they provide to the ad network.

Basically if this happens I'm switching my career to stealing from ad networks for fun and profit.

True it would be an issue for CPC/CPM campaigns but less so for CPA.

Not sure what the solution would be for CPC/CPM - off the top of my head maybe a random CNAME that pointed to an ad-server controlled IP so they could cross-audit client IPs via a JS drop in file? Presumably ad-blockers would easily pick that up though.

It would also mean that when sites end up buying malware-laden ads, they'd be serving them off their own domain. I'm not sure what consequences that would have (legally or with search engines and browsers) but I'll bet it's not pretty.

Security is a problem but my guess is publishers will care about profit first and worry about security later.

Other than proxying I can't see how advertisers and publishers solve the ad-block problem without completely rethinking how ads are bought,sold,tracked and delivered.

Proxying seems to be one of the lowest-friction ways for them to continue business as usual, security be damned.

If I include and run a script from example.com, doesn't that already happen? How else would using a CDN for, say, jQuery work?

They can just not send you the actual content until you've downloaded the advertising content of the page.

And in HTTP/2.0 they'll just switch to pushing the ads out to you.

In either case they can't guarantee it'll get on the screen, but they assuredly can make sure you download the damned ads.

Long term browsers will become more and more closed, DRMed, protected and such so that people have much less control over how stuff is displayed on screen.

And as that happens they'll lose users who have become accustomed to the conveniences of ad blocking and open web pages.

I'm also pessimistic about where it's going. As if the segregation on the web isn't bad enough already. We might end up with two kind of webs- one independent and open, another capitalized and closed. Just the fact that indieweb.org needs to exist tells us what's waiting.

Tim Berners Lee would cry if we end up with 2 webs.

> Once these publishers swap over to proxying ad-content through their own domains

Do you know anyone who is doing this already?

They will, once the "free money" of normal shitty ads stops working. Then, once the amount of work required to serve proxied ad-content through their own domains is more than the benefit of the "free money" of shitty ads, the force of human nature means that most publishers will move to that model. Personally, I think this will become a machine learning battlefield in the next handful of years.

> Personally, I think this will become a machine learning battlefield in the next handful of years.

Everyone will get their own personal AI stalker bot from the birth. I have such high hopes for humanity. When we at it maybe also replace politicians with AI, I'm sure they will do a better job than we mortals.

Luckily, we have the power of AI to help us! :-)

Reply on news.ycombinator.com