Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

131–140 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#131

Post by streptomycin »

voakbasda wrote: post #96
streptomycin wrote: post #60

Earlier quoted context omitted.

The problem isn't that advertisers should be allowed to ship malware, it's that it's hard to distinguish malware from non-malware. Also the adjacent problem of "not quite malware, but shitty code that spams error logs and runs way slower than it should".

Shitty code should be rejected too, if they have any kind of a standard for of quality. If it runs slow during testing, how do you think users will feel when they run it on their systems? Code that makes your system appear infected with malware is indistinguishable from actual malware.

They already try to detect and ban poor performing ads, but it is hard to do perfectly.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#132

Post by samhw »

ineptech wrote: post #74
jefftk wrote: post #71

Earlier quoted context omitted.

I'm not sure it is allowed; that's not a part of the business I know much about. Since ads can run arbitrary JS it's hard to enforce policy programmatically. On the other hand, it's not clear to me that whatever this advertiser is trying to do is having any real effect, aside from causing a console message that it is being blocked. Access to the mic and camera from cross-origin iframes is blocked by default, and you…

> Since ads can run arbitrary JS it's hard to enforce policy programmatically. Letting ads run arbitrary JS is the policy, right? It's not like that's a requirement to make the internet work, that's just a Google policy that trades money for user experience.

> Letting ads run arbitrary JS is the policy, right?

I mean, anything on the Web can run arbitrary JS. The entire point is that it's a sandbox environment where arbitrary JS can't do any harm (excluding cases where vulnerabilities are found).

If you're not comfortable with arbitrary JS running on your computer, you'd have to either (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy. None of those are particularly practicable.

Most of us operate on the generally-reasonable assumption that the sandbox is effective, and therefore that we're OK to [click on that random link from HN like you did just now / open that news site which pulls in a bunch of tracking scripts / etc].

Either way, this is not somehow a problem that's specific to Google Ad Manager in any way at all. I don't know what else you could really expect of them.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#133

Post by mrtranscendence »

jeffbee wrote: post #106
fault1 wrote: post #104

Earlier quoted context omitted.

I think there is most definitely conditioning going on. I watched my fiance click on one of the "accept all cookies" GDPR-prompts (it's become an antipattern) a few days ago. She almost automatically did it without thinking. I went to the same site on my laptop and if you clicked decline, it immediately brought up modal dialogs that made that site unusable. I can see why 99% of people would be conditioning to just hi…

And you blame Google for that, instead of some brain-dead Eurocrat?

Who said anything about blaming google for users clicking “ok” without thinking about it?

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#134

Post by streptomycin »

hetspookjee wrote: post #93
streptomycin wrote: post #60

Earlier quoted context omitted.

The problem isn't that advertisers should be allowed to ship malware, it's that it's hard to distinguish malware from non-malware. Also the adjacent problem of "not quite malware, but shitty code that spams error logs and runs way slower than it should".

Why should ads be so free to run arbitrary code? It seems to me that in the end Google should be held responsible for anything they serve to others. If they'd be fined for this lack of oversight, perhaps they'd block javascript as a whole until they do have proper oversight in place?

Because advertisers pay more for it, and publishers like making money. If Google didn't offer it, someone else would, and they might do even worse than Google at sandboxing the code and trying to filter out abusive ads.

Not saying it's a great situation, just explaining why there's not an easy solution.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#135

Post by aasasd »

tomudding wrote: post #31

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…

IIRC FF puts the domain on the ‘blocklist’ after the first manual choice, at least if the user selects ‘block’ instead of one-time ‘deny’ (haven't seen the dialog in a while).

Hopefully The Browser doesn't pester the user each time, either.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#136

Post by hetspookjee »

streptomycin wrote: post #134
hetspookjee wrote: post #93

Earlier quoted context omitted.

Why should ads be so free to run arbitrary code? It seems to me that in the end Google should be held responsible for anything they serve to others. If they'd be fined for this lack of oversight, perhaps they'd block javascript as a whole until they do have proper oversight in place?

Because advertisers pay more for it, and publishers like making money. If Google didn't offer it, someone else would, and they might do even worse than Google at sandboxing the code and trying to filter out abusive ads. Not saying it's a great situation, just explaining why there's not an easy solution.

It's an odd argument to say that Google must do it in this poor way, as it is atleast better than how the others would do it. If Google stopped offering it to not waste compute cycles of others or invade too much, that would be a good choice. It seems Google would not like to lead by example but rather take the profits and risk the fine as cost-of-doing-business. If google would stop doing it. It would atleast cause >30% of the worldwide ads to run arbitrary code. A massive improvement on both user privacy and climate. The wasted cycles are not free.

The solution is easy on Google's side. Just don't do it and accept the reduction in revenue. But I guess the economic incentives are just too big, like you say.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#137

Post by judge2020 »

caymanjim wrote: post #118
_fat_santa wrote: post #113

Earlier quoted context omitted.

I attack if from a different direction. All these companies want to fingerprint your device and track you for really one reason at the very end: showing you a targeted ad. Now what happens if they can't deliver that ad (because you have an adblocker installed), well all that tracking and fingerprinting they just did is moot, because there's nothing actionable they can do with it. That's my rather naive opinion, idk a…

I care a lot less about whether or not I see an ad than I do about the shadow dossier being compiled about me based on my browsing habits. So no, I don't think all the fingerprinting is moot. I'd rather see untargeted advertising than have my personal profile bought and sold.

Do you have ads blocked on google.com then? Because all ads there are contextual, not personalized.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#139

Post by jefftk »

Ansil849 wrote: post #129
jefftk wrote: post #112

Earlier quoted context omitted.

But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.

If a website cannot survive without ads, maybe it doesn't need to actually exist in the first place. The world will go on.

I do think the world would go on, but it's a world I would like less. Some things would move behind paywalls, others would move to the boundary of whatever was considered advertising (sponsored content? Product placement?)
Post reply on HN