Hacker News Reader

Comment by shadowgovt | Hacker News Reader

What major city would you recommend Google employ at 100% to vet enough advertisers to support nearly 30 billion daily ad impressions?

Or, alternatively, should there be a few tens of thousands of firms allowed to advertise on the Internet and the rest of us can just pound sand?

(... actually, now that I think that "out loud," a distributed trust model would be an interesting idea. Google, instead of vetting ads, could vet trusted ad resellers, and knock entire resellers off the network that failed to do due diligence. The resellers would be responsible for policing their various houses and if you didn't like the terms one provided you could go to another. This is, perhaps, one of those situations where more middlemen would be desirable).

View on HN

Why should we care that it's not profitable for Google to do so? I would argue they are facilitating illegal activities, so why shouldn't they financially (and maybe criminally) liable? If that destroys their business model, why should we care?

I already mentioned that it doesn't scale.

The real issue, IMO, is that Google's business model is just fundamentally bad. But Google is large enough that it doesn't matter. They're like a large industrial polluter poisoning the lands and arguing that there's nothing they can effectively do about it because addressing the problem would be bad for their business.

Well, their business and the business of everyone that advertises online. So it comes back to "Should we all pound sand because of a (statistically) few bad actors?"

Firefox advertises at the top of "download browser." Should we cede their ability to be found to whoever Google thinks should be at the top of that organic result? Because by user numbers alone, it probably won't be Firefox!

I think a strong case can be made that if a business cannot operate without causing harm to unconsenting others, it should not be operating.

> because of a (statistically) few bad actors?

It doesn't actually matter how many or few bad actors there are. What matters is how much harm is being done.

I'm not sure what your point is about Firefox, but in general, it doesn't matter if mitigating the harm Google's ad system does adversely affects Firefox or any other advertiser.

Who are the unconsenting others? The people who chose to trust a Google ad?

I'm not sure what consent means if it doesn't mean "user clicked on a result after asking Google for results." The backstop here is the user doesn't come back because they got screwed by Google, not that some third-party makes that decision for people.

But yes, I suspect if Google can't get on top of this problem they'll lose their leadership position in search.

> I'm not sure what consent means if it doesn't mean "user clicked on a result after asking Google for results."

First, I'm talking about ads, not search results. Although Google conflates the two as much as they can get away with, and people often get confused as to which is which.

I can't imagine how clicking on an ad can be interpreted as consent to being exposed to malware. In order to be considered "consent", the person has to be fully and accurately informed of what they're being asked to consent to.

> The backstop here is the user doesn't come back because they got screwed by Google

I truly wish we lived in a world where that could be expected.

I don't see why we wouldn't expect it. Wouldn't be worth talking about if it wasn't a possibility.

Google dethroned search vendors before them and they aren't bulletproof. If they are, might as well pack up DDG and everything else right now. Shut off the servers and decrease the greenhouse gas emissions, right?

No, I think the backstop here is that DDG has a wonderful opportunity to be the search engine where you don't have to worry about getting vended malware via an ad above the first organic result.

We’ve all paid to drink from this punch bowl, should we ask for a refund just because a few bad actors pissed in it?

It can scale just fine... Green certs for SSL have been able to scale just fine... why, you pay for it. Advertisers should have to pay for verification.. it doesn't have to be an excessive fee, and can be connected to a bank account in good standing. Holding an amount in escrow during the first year could help as well.

Why shouldn't advertisers have to clear the same hurdle as opening a bank account in most western countries?

Adtech veteran here. That's not how the industry works.

All ads on major DSPs already require approval before they can run. Advertiser accounts too, especially at scale. While there are plenty of technical openings for fraud and malware, the vast majority is from known actors that can be resolved through business practices.

A trillion-dollar megacorporation with hundreds of thousands of employees has more than enough resources to handle this. The reason it doesn't is because of the flow of money and incentives across the vast supply chain from advertisers and agencies to vendors and publishers.

Adtech veteran here (from the other side). The trillion dollar corporation has vast teams and assets invested in this project. No temporary monetary incentive is worth the risk of being seen as a likelier vendor of malware than quality searches.

But the opposing operators get more and more sophisticated, countermeasures that work to half decade ago get circumvented, and the arms race continues.

Lacking a technical fix, isn't this fundamentally a KYC problem? There's an arms race of fraud against banks and financial companies, but it seems like they're managing okay.

Yes. Holding online advertising to KYC standards would lock most advertisers out of the ecosystem. But most aren't bad actors.

Why would it lock out most advertisers?

Because Google (like other online advertisers and most online services) doesn't have any tighter KYC restrictions than accepting a valid credit card (which, we assume, has already been KYC'd by a bank).

Requiring bank-scale KYC on top of that to also work with the advertisers would cut the 4 million advertisers Google currently serves down to a tiny fraction of that (if for no other reason than they don't have infrastructure to background-vet 4 million customers; they don't currently).

Perhaps this is the right approach. It would end the days of being able to set up an advertising account in a few hours. Perhaps that's not needed anymore.

(This would, of course, mean people giving even more PII to Google. However one feels about that).

> "doesn't have any tighter KYC restrictions"

Yes that's the problem.

> "Requiring bank-scale KYC..."

Nobody said that. The KYC part is an analogy to the financial industry to use procedures to screen out bad actors. But it doesn't need the same requirements.

> " they don't have infrastructure to background-vet 4 million customers"

KYC is not difficult. Again, banks and finance companies which are far smaller than Google do this all the time, for all of their customers and anyone involved in transactions. This is 100s of millions of clients.

> "Perhaps this is the right approach."

This approach is far more nuanced than the binary outcome you're interpreting. There are ad and account approvals already. There are different scales requiring different support and sales already. Having more intensive checks as the spending scales is a very simple and effective strategy that can be applied today.

The company doesn't care about the number of customers, it cares about the revenue against potential risk (just like every other every business), and currently the risk is acceptable for these ads and advertisers to continue.

There's probably some middle ground between "bank-scale KYC" and "people don't steal credit card numbers, do they?". You really think their current process can't be improved on? With all of their billions, their PhDs, their regulatory capture, finding a way to let in most of the real advertisers while keeping out the scammers isn't just too expensive, it's literally impossible? Despite the fact that they have a near monopoly and the legitimate advertisers will jump through almost any hoop imaginable?

> It would end the days of being able to set up an advertising account in a few hours. Perhaps that's not needed anymore.

That ability was never needed and was never a good idea.

According to whom? The organization that can't distinguish bad actors from good? I mean, you may be right, but he point is, they could do it, they just choose not to because it would be unprofitable.

They chose not to because it would lock most advertisers out. That's pretty much counter to everyone's goals. It's analogous to the "stop crime by jailing all of Texas" solution.

That makes no sense. It seems you're confused about KYC. It's a screening process that blocks known bad actors (eg: in finance that is anyone convicted of certain crimes, on watchlists, denied by regions or sanctions, etc). Most advertisers would not be affected at all.

By the way, this is already done since Google does check advertiser accounts against various sanctions and watchlists as part of dosing business in every country they operate in.

So if it's already done, it's not sufficient to stop bad advertisers?

It’s done for governmental and judicial issues like not working with terrorist organizations. It’s not accounting for bad advertiser history and related behaviors and connections.

The point is that it’s not a resource or scale issue (as you keep arguing), but a profit and incentives issue as I said before.

So a credit score but for the ad industry.

The risk is carefully managed. These malware ads are on the results page and are allowed until enough issues are raised. In other places, like Google's SSP for the rest of the web, there's far more malware because that reputational risk is pushed to the publishers.

Countermeasures aren't needed if adtech just stopped working with known bad actors and recognizable malpractices.

> Countermeasures aren't needed if adtech just stopped working with known bad actors and recognizable malpractices.

True, but it looks to me like adtech depends on working with bad actors and mostly ignoring bad practices. It's one of the reasons why I consider the adtech industry itself to be malicious.

These are good candidates for automated systems and LLMs (if they are as good and general as they say they are in Google's papers).

Reply on news.ycombinator.com