Live data from Hacker News

Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

facebook.com

231–240 of 381 posts

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#231
post #188

Earlier quoted context omitted.

It's odd to me that your posts aren't more downvoted than they are.

You think I make this shit up? There are some really naive and stupid people on HN that have zero grasp on the history of intelligence agencies.

So, this is why people don't take you seriously.

I know a couple of guys like you in my local activist community, who take a very hostile "I know the truth and you're all fools!" attitude, despite the fact that their audience is mostly very sympathetic to most of their assertions. We know spying on the Internet takes place; HN is full of cantankerous old Internet geeks who've seen, first-hand, plenty of examples of the state (whatever state you may choose, as it happens all over the world) behaving unethically on the Internet, spying on people and punishing people for things that shouldn't be crimes.

But, your paranoid approach is counter-productive. You might as well be working for the people you claim to be afraid of, for all the good you do (negative good; you're convincing people that the folks who believe the government is spying are all paranoid nutjobs who scream at anyone who has the gall to mention other possible explanations).

So, let's review:

1. Just because spying has taken place, and is currently taking place, and may even have the complicity of facebook in that spying, it does not mean that facebook is running a botnet to steal advertiser dollars. The simplest explanation is that facebook looks the other way while others run the botnets. facebook wins (a lot, as long as most advertisers don't know it's happening), botnet owner wins (a little), and the advertiser loses. But, there are other plausible explanations, including incompetence.

2. When you paint things in a "Either you accept my theory in its entirety, or you're all idiots", you force people to choose a side. Nobody wants to be on the same side as an asshole, so you force them to choose the other side. You make people who may even agree with you (to a greater or lesser degree) to begin to formulate plausible reasons for why you're wrong about the crazier stuff you're spouting...further convincing themselves that you're entirely wrong. The best you can hope for is people ignore you and don't have the chance to be inoculated against your ideas; having you as their first exposure to these concepts guarantees they will be less likely to believe them in the future, even if they come from a more credible source. Humans are funny creatures.

Thus, I would point out that there are some really naive and stupid people on HN that have zero grasp of effective argument, persuasion, and even basic logic.

You might be well-served by reading about non-violent communication: http://en.wikipedia.org/wiki/Nonviolent_Communication

Edit: Removed the word "schizophrenic" as it was an insensitive use of the term, and was counter-productive to making my point.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#232
I want to say:

>80% of $FBs revenue is made from bots! OLOL

but what I actually think is

>They're just pissed their campaign didn't work out like they'd hoped

BUT I also think that it's equally likely that $FB would, if possible, defraud the clueless. How deep are [client]'s pockets? How literate are they in working to strict ROI goals?

I think this is probably a relatively new phenomenon. Facebook went public. Sales managers need to hit targets, they're thinking quarterly and they've got stock.

People know people and the rest is history.

If this has got legs then it's the perfect storm for facebook. :)

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#233
post #185

My startup is essentially an advertising aggregator (pooling traffic from a variety of publishers and routing it to advertisers) and dealing with things like bot detection is a HUGE chunk of what we work on, technology-wise. Let me try and give you an idea of how deep the rabbit hole can go. - Okay, you want to detect bots. Well, "good" bots usually have a user agent string like, "Mozilla/5.0 (compatible; Googlebot/2…

And then there are the "wet bots" - Amazon Turks and overseas humans (lowly) paid to use a regular browser and PC and manually click on stuff for whatever purpose (rig internet voting, drive fake advertising charges, steal data, skew hit counters - whatever).

Thank you for introducing me to the term "wet bots"!

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#235
post #228

Earlier quoted context omitted.

I assumed this just meant they built something on top of access logs that told them what percentage of page loads also loaded JavaScript. I don't know about your webserver, but mine doesn't tell me this kind of thing out of the box. Anyway, it's pretty irrelevant whether they added logging in their app (one line of code?) or enabled their webserver's built in logging.

Surprised no ones mentioned the noscript plugin. Since the user is on facebook they'd have facebook unblocked, but noscript still blocking everything else. How would you discern a noscript user from bot?

You wouldn't, but if the vast majority of your ad click visitors have javascript disabled, and only a tiny percentage of your other visitors do, what conclusion would you draw?

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#236
post #228

Earlier quoted context omitted.

I assumed this just meant they built something on top of access logs that told them what percentage of page loads also loaded JavaScript. I don't know about your webserver, but mine doesn't tell me this kind of thing out of the box. Anyway, it's pretty irrelevant whether they added logging in their app (one line of code?) or enabled their webserver's built in logging.

Surprised no ones mentioned the noscript plugin. Since the user is on facebook they'd have facebook unblocked, but noscript still blocking everything else. How would you discern a noscript user from bot?

You don't, but it's very unlikely that there were enough noscript users to match the stats. From the post:

"...in all of our years of experience, only about 1-2% of people coming to us have JavaScript disabled, not 80% like these clicks coming from Facebook."

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#237
post #89

Earlier quoted context omitted.

We built a page logger. Any time a page was loaded, we'd keep track of it. They reinvented the access log? By hand? Are people really that detached from how servers work?

I assumed this just meant they built something on top of access logs that told them what percentage of page loads also loaded JavaScript. I don't know about your webserver, but mine doesn't tell me this kind of thing out of the box. Anyway, it's pretty irrelevant whether they added logging in their app (one line of code?) or enabled their webserver's built in logging.

Access logs that write continually from different processes or threads (like PHP) can cause System IO to reach critical proportions. In any non-trivial enterprise application it's completely reasonable to have a stat-logic-layer for recording events... The access log can still do it's own sorta thing - this is more true if you have more than 1 server.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#238

Earlier quoted context omitted.

In my mind having an in-house bot network and being totally ignorant that you're charging for bot traffic via ads amount to the same thing. This is very, very bad.

It does not amount to the same thing at all. Keep some perspective.

It does amount to the same thing.

If I am writing a mechanism to charge for ads based on traffic, one of the first things to QA/write test cases for is fraudulent traffic.

The leap here is from facebook being remotely competent (which is likely), and willfully ignoring checks on certain types of traffic because it benefits them financially.

My assertion is that this is the same class of bad behavior as running your own bots. Note the distinction in 'willful' ignorance.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#239

My startup is essentially an advertising aggregator (pooling traffic from a variety of publishers and routing it to advertisers) and dealing with things like bot detection is a HUGE chunk of what we work on, technology-wise. Let me try and give you an idea of how deep the rabbit hole can go. - Okay, you want to detect bots. Well, "good" bots usually have a user agent string like, "Mozilla/5.0 (compatible; Googlebot/2…

I understand that it is challenging for a third party like you to identify the bots. But Facebook has more than enough signal on each user clicking on an ad (friends, posts, location, 'non ad-click activity' to 'ad-click activity' ratio) to determine if that user is a bot. Looks like they are choosing to not do anything with this information. "FB is turning a blind eye to keep their revenue" seems to stand up to Occa…

Couldn't agree more. It should be almost trivial for them to track down bots and flag bad accounts. I definitely wouldn't classify it as one of their harder problems.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#240
post #222

Earlier quoted context omitted.

We've found that identifying sources of traffic and patterns of usage is superior to simple user-agent detection, particularly as, since you've noted, user-agent spoofing is trivial, and/or some bot traffic is driven through user-based tools (say, script-driven MSIE bots). Instead of that, we'll watch for patterns of use in which high volumes of traffic come from unrecognized non-end-user network space. "Unrecognized…

One as-yet-unmentioned technique is to adjust a bot score by taking an OS fingerprint, and comparing that to the listed user agent. It's not perfect for a variety of reasons, but I found it to be a useful input for a similar bot detection problem. That said, this was a long time ago so I'd need to re-run some experiments to see if the hypothesis remained valid. For those not familiar with OS fingerprinting, it's a me…

Interesting. Any Linux equivalents or Java classes which offer similar capabilities (we're using a Java-based application server / webserver).
Post reply on HN