Comment by cyphar | Hacker News Reader

Comment by cyphar | Hacker News Reader

Despite what your opinion might be on the ethics and justifications of the people involved, I find it quite concerning that they're being painted as "ad fraudsters". This sounds like the same Orwellian re-definition of words as "piracy". There is no implicit or explicit, social or legal contract that says if I click an ad that I must then purchase the product. Nor is there any agreement that if I click an ad that I have to be interested in the product. So you couldn't really argue it's deception. And most importantly, I have no financial gain from doing it (EDIT: assuming that I'm not the person who is making money from the ads). The term "fraud" is an intentional misuse of the word to frame the conversation in a way that is quite deceptive.

Is exploiting a flaw in the existing CPC advertising system "fraud"? No. Is it unethical? Possibly, depending on what your view is on the justification. You could argue that devaluing the worth of tracking-based advertising is trying to do a net good, and that it might counteract Google's attempts to become a monopoly in online advertising. But you could also argue it's going to ruin small businesses that rely on advertising as a significant part of their income.

>There is no implicit or explicit, social or legal contract that says if I click an ad that I must then purchase the product. Nor is there any agreement that if I click an ad that I have to be interested in the product.

I understand you want to fight ads but your comments (e.g. your usage of "I" as in the "websurfer enduser") are not relevant to this particular WSJ story.

In this case, the "click fraud" is the correct label because the website operators (not the websurfer) of ad inventory explicitly agreed to Google's AdX policies.[1][2]

Yes, you're right that the end user didn't make an explicit contract. However, the website operator/seller that voluntarily opted into the AdX exchange _did_.

Like you, I'm also hypersensitive to Orwellian doublespeak but in this case, your vigilance is misplaced. Your comment (almost verbatim) is more relevant for the AdNauseam thread that's currently on the front page because that _is_ about endusers fighting back with the justification that they didn't agree to any ad Terms-of-Service.

[1] see section "Invalid Activity" : https://support.google.com/adxseller/answer/6337462?hl=en

[2] see section "Invalid activity" : https://support.google.com/platformspolicy/answer/3013851?vi...

I think you're missing the point of "click fraud[1]". Unscrupulous actors are using botnets to "click" ad network links on their sites, which they then get money for.

[1] https://en.wikipedia.org/wiki/Click_fraud

I'm penalized about 15% of my revenue every month due to invalid traffic. 99% of the traffic is organic, and google doesnt give me any idea where this invalid traffic is coming from.

It's called fraud because it's systemized. An individual accidentally clicking on an ad, or clicking on an ad without been actually interested in a product is far from suspicious, we've all done it and we'll do it again. But that's not what this is about.

Say you have a couple of web sites and you've strapped AdSense on them. Income is ok but nothing spectacular. One day you decide to go black-hat. So you purchase a couple hundred static IPs or even better rent them from private proxies. Then you set-up a bot that systematically clicks on your ads. If you keep it low profile without becoming greedy it could run for years without anyone taking notice.

Then some other day you become greedy. You realize that if you scale your model it could bring you shitloads of money. So you build a malware and distribute it to tens of thousands of PCs. Actually you don't even have to write the code yourself, malware has been commoditized these days. So now you have 100k PCs which means that you have tons of traffic. And since you only have a handful of websites you commoditize the "business", offering ad clickthroughs for money to various publishers. Run it for a couple of years and you've become a millionaire. At this point of course eventually Google will shut you down because they have a whole department of very smart people who're monitoring these things. But nothing stops you from building other sites or no sites at all if you drive all your traffic to third parties. And let's not forget that AdSense isn't the only form of advertising. There are ads based on mere impressions. Which means that all you have to do is drive traffic to those sites.

This isn't a far-fetched scenario, it's already happening in unprecedented scale. Estimates indicate that at least 30% of ad traffic is fraudulent. Take a look at Methbot [1] for example. A botnet that was set-up to deliver fake video traffic and netted more than $5M daily.

[1]. https://www.forbes.com/sites/thomasbrewster/2016/12/20/methb...

DING DING DING we have a winnner..

Not to mention bots to scrape other legitimate sites and recreate them only with slightly reshuffled texts and a bazillion other ads and links to legitimate and illegitimate other sites, paid spamming to spread your malware and drive traffic into your network, spoof SEO and fake promotions by spam commenting on websites, blogs, etc. I'm probably missing a few thousand other things.

Worked in webhosting for a couple of years.. it was amazingly eyeopening to contend with the fact that yes, people actually make all of that junk content that I do my best to ignore, and that there are reasons behind it...

> An individual accidentally clicking on an ad, or clicking on an ad without been actually interested in a product is far from suspicious, we've all done it and we'll do it again. But that's not what this is about.

I have to admit that I was hoping that is what this would be about. I suspect that almost all ad clicks on mobile devices are "accidental" in the sense that those pages are optimized to ensure the maximum number of accidental clicks.

It is a soft form of fraud when they know bots and dodgy apps are being allowed to take clicks as legitimate advertising. There are tools that pick this up as well as analysis to encourage refunds from AdWords but for some reason Google have lagged on this technology, dispute a massive information advantage. Maybe it is innocent reasons. But I don't believe that. So I feel they are doing fraud in a light form by not improving tools as well as they can to remove bad clicks and take the payment.

Surely the attacker has agreed to the terms before displaying the ads and are in breach of that agreement? They are getting money through deception. Sounds like fraud to me.

That's the usual mental gymnastics I often see on HN.

Reply on news.ycombinator.com