Facebook Bots Are Not Stealing Your Ad Spend • Hacker News Board

Re: Facebook Bots Are Not Stealing Your Ad Spend

#21

Post by MichaelApproved » Wed, Aug 01, 2012, 8:19 PM UTC

mikeryan wrote: post #12

gwern wrote: post #6

> The first is that the traffic coming in had JavaScript disabled. If this was the case then the JavaScript analytics software would not detect the incoming traffic and therefore would not be able to log the result at all. Did you read their post? To quote: > Here's what we found: on about 80% of the clicks Facebook was charging us for, JavaScript wasn't on. And if the person clicking the ad doesn't have JavaScript,…

If this was the case then the JavaScript analytics software would not detect the incoming traffic and therefore would not be able to log the result at all. Most Javascript analytics packages also wrap an image call in a noscript tag to capture hits for browsers which do not have JS enabled. So yes, you can log the result with JS turned off.

That still won't detect bots. If you build a click-bot, you're probably only going to click the link and download the source. You wouldn't care about loading any images so the 1x1 pixel image still won't track the page load.

To track bots effectively, you need to check your server logs. In fact, you could build a strong case for a bot click if the requesting IP pulled the source HTML but didn't follow up with any image requests from the page. Not loading images is typical bot behavior.

Re: Facebook Bots Are Not Stealing Your Ad Spend

#22

Post by devdazed » Wed, Aug 01, 2012, 8:19 PM UTC

mikeryan wrote: post #12

gwern wrote: post #6

> The first is that the traffic coming in had JavaScript disabled. If this was the case then the JavaScript analytics software would not detect the incoming traffic and therefore would not be able to log the result at all. Did you read their post? To quote: > Here's what we found: on about 80% of the clicks Facebook was charging us for, JavaScript wasn't on. And if the person clicking the ad doesn't have JavaScript,…

If this was the case then the JavaScript analytics software would not detect the incoming traffic and therefore would not be able to log the result at all. Most Javascript analytics packages also wrap an image call in a noscript tag to capture hits for browsers which do not have JS enabled. So yes, you can log the result with JS turned off.

Yes that would definitely tell him that people without JS turned on were viewing his page. It would not magically tell him that these came from facebook (or should have).

Re: Facebook Bots Are Not Stealing Your Ad Spend

#23

Post by devdazed » Wed, Aug 01, 2012, 8:23 PM UTC

[deleted] wrote: post #9

[deleted]

You're assuming that he did set up a landing page or modified the url. There is no evidence to suggest he did that. Also, this article says nothing about facebook. It was ad-networks that the blank was run on.

Re: Facebook Bots Are Not Stealing Your Ad Spend

#24

Post by devdazed » Wed, Aug 01, 2012, 8:24 PM UTC

allwein wrote: post #14

Here's another possibility that popped into my head while reading this article. What about browser prefetches? Is it possible that a browser, say Chrome, is prefetching linked pages and that prefetching is being detected by Facebook as an ad click? I'll admit I know little to nothing about how prefetching works.

This is an interesting theory.

Re: Facebook Bots Are Not Stealing Your Ad Spend

#25

Post by xentronium » Wed, Aug 01, 2012, 8:59 PM UTC

allwein wrote: post #14

Here's another possibility that popped into my head while reading this article. What about browser prefetches? Is it possible that a browser, say Chrome, is prefetching linked pages and that prefetching is being detected by Facebook as an ad click? I'll admit I know little to nothing about how prefetching works.

If this worked like you think, bad things would happen. Think about all the "?action=delete" or "/logout" links spread all over the internet.

Re: Facebook Bots Are Not Stealing Your Ad Spend

#26

Post by kordless » Wed, Aug 01, 2012, 9:01 PM UTC

devdazed wrote: post #18

nakor wrote: post #8

Earlier quoted context omitted.

I can't believe someone who has 'delivered highly scalable solutions' actually managed to write this line on his blog with a straight face. How were you not able to deduce that the devs likely detected disabled javascript without the use of javascript? His whole post is devoid of content and nothing but statements without any real substance or evidence.

The point of my article was not on how the dev was detecting JS. So I didn't want to go into detail on it. Even if he did that (which he never claims he does) He would only see that people are coming in with JS turned off, not that they came from facebook.

He does make the claim that 80% the clicks they were paying for had JS disabled. That would imply the referrers were set on those requests to be from Facebook and the IPs hitting the pages weren't registering in his JS based analytics package. We know he's logging the hits to a file, so presumably that data is there.

You claimed 'There were a few false assumptions made in the post. The first is that the traffic coming in had JavaScript disabled.' Care to elaborate on how it's a false assumption if the implied statement above is true?

I'll give you that he may be wrong, but I really don't see where there's concrete evidence to support your claim he's making false assumptions!

Re: Facebook Bots Are Not Stealing Your Ad Spend

#27

Post by kordless » Wed, Aug 01, 2012, 9:09 PM UTC

tijs wrote: post #16

nakor wrote: post #8

Earlier quoted context omitted.

I can't believe someone who has 'delivered highly scalable solutions' actually managed to write this line on his blog with a straight face. How were you not able to deduce that the devs likely detected disabled javascript without the use of javascript? His whole post is devoid of content and nothing but statements without any real substance or evidence.

How do you reliably check that javascript is turned off without resorting to javascript? edit: never mind; an img in a noscript tag.

Or. Hits to a website result in a list of unique IPs accessing the site. Remove any IPs from the list which are known to be running JavaScript. The remaining IPs aren't running JavaScript or are ignoring/breaking your script.

This begs the question whether or not there was a scenario where there was a hit to the site, the referrer was set to Facebook, JS was enabled in the browser, but the resulting hit didn't result in a JS enabled request to the analytics software.

Another poster mentioned prefetching as a likely culprit. Google is known to prefetch search results for you, but it requires the use of the rel="prerender" tag. I find it highly unlikely that is what's happening here.

Re: Facebook Bots Are Not Stealing Your Ad Spend

#28

Post by [deleted] » Wed, Aug 01, 2012, 9:47 PM UTC

kordless wrote: post #26

devdazed wrote: post #18

Earlier quoted context omitted.

The point of my article was not on how the dev was detecting JS. So I didn't want to go into detail on it. Even if he did that (which he never claims he does) He would only see that people are coming in with JS turned off, not that they came from facebook.

He does make the claim that 80% the clicks they were paying for had JS disabled. That would imply the referrers were set on those requests to be from Facebook and the IPs hitting the pages weren't registering in his JS based analytics package. We know he's logging the hits to a file, so presumably that data is there. You claimed 'There were a few false assumptions made in the post. The first is that the traffic comin…

[deleted]

Re: Facebook Bots Are Not Stealing Your Ad Spend

#29

Post by bimr » Wed, Aug 01, 2012, 10:16 PM UTC

Umm... the facebook post already stated that javascript analytics could only verify 20% of the traffic. They also explained that they wrote their own analytics sans javascript to verify that javascript was disabled.

How did he miss that? Self-inflicted black-eye for simplereach.com

Re: Facebook Bots Are Not Stealing Your Ad Spend

#30

Post by vampirechicken » Wed, Aug 01, 2012, 11:13 PM UTC

xentronium wrote: post #25

allwein wrote: post #14

Here's another possibility that popped into my head while reading this article. What about browser prefetches? Is it possible that a browser, say Chrome, is prefetching linked pages and that prefetching is being detected by Facebook as an ad click? I'll admit I know little to nothing about how prefetching works.

If this worked like you think, bad things would happen. Think about all the "?action=delete" or "/logout" links spread all over the internet.

Bad things deserve to happen to web app operators who do not protect delete and logout by putting them behind POST[1] request.

[1] pedantry - PUT, POST, DELETE implement it however you want. Just don't change database state using GET.