Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is Stack Overflow trying to start audio?

meta.stackoverflow.com

Post reply on HN
Print view View original

371–380 of 416 posts

Re: Why is Stack Overflow trying to start audio?

#371

Post by ChrisSD »

dTal wrote: post #361
ehnto wrote: post #316

Earlier quoted context omitted.

It's amazing to me that an advert can run arbitrary javascript at all. It wasn't long ago that this would have been seen as a massive security risk by site owners and ad platforms alike. I'll give them the benefit of the doubt and assume that perhaps it's a structured service provided by the ad network, and the ad buyer just checks a box. But as a site owner even that would be too much for me. I've been playing aroun…

>It's amazing to me that an advert can run arbitrary javascript at all. I'm not fully up to date with how these things are usually set up - is there anything in the web security model that prevents "ads" from exfiltrating arbitrary information from any page that they're on? Could an ad read my keystrokes, or scrape private messages?

It is possible to restrict ads using CORS headers, sandboxed iframes and cross origin restrictions. However this is rarely done effectively. Often the ads have a ridiculous level of access.

Re: Why is Stack Overflow trying to start audio?

#373

Post by londons_explore »

dTal wrote: post #361
ehnto wrote: post #316

Earlier quoted context omitted.

It's amazing to me that an advert can run arbitrary javascript at all. It wasn't long ago that this would have been seen as a massive security risk by site owners and ad platforms alike. I'll give them the benefit of the doubt and assume that perhaps it's a structured service provided by the ad network, and the ad buyer just checks a box. But as a site owner even that would be too much for me. I've been playing aroun…

>It's amazing to me that an advert can run arbitrary javascript at all. I'm not fully up to date with how these things are usually set up - is there anything in the web security model that prevents "ads" from exfiltrating arbitrary information from any page that they're on? Could an ad read my keystrokes, or scrape private messages?

Ads are iframed, and don't have permissions to do anything to the host page.

Doesn't stop them fingerprinting the browser though

Re: Why is Stack Overflow trying to start audio?

#374

Post by boomlinde »

Tangentially related anecdote: I came across a site the other day that requested access to the MIDI API for no apparent reason. Is this a common tracking vector? The available MIDI interfaces can say something about the system but in 99% of cases (the 99% that don't have any physical MIDI interfaces) I don't imagine that you'll discover anything other than operating system family.

Re: Why is Stack Overflow trying to start audio?

#375

Post by seitling »

vbsteven wrote: post #328
ehnto wrote: post #316

Earlier quoted context omitted.

It's amazing to me that an advert can run arbitrary javascript at all. It wasn't long ago that this would have been seen as a massive security risk by site owners and ad platforms alike. I'll give them the benefit of the doubt and assume that perhaps it's a structured service provided by the ad network, and the ad buyer just checks a box. But as a site owner even that would be too much for me. I've been playing aroun…

It’s not the internet we want but it is the one we have. In the end it is your own responsibility for which code gets executed on your machine. I run NoScript with all JS blocked by default and only whitelist the domains I want. On most sites you can get by with no JS or just scripts from the same domain whitelisted. Maybe a CDN from time to time

"... only whitelist the domains I want ..."

Well, this is easy to exploit. Use an URL under my domain and proxy to the ad server. JavaScript is a problem. Simple as that.

Re: Why is Stack Overflow trying to start audio?

#376

Post by dragonwriter »

NikolaNovak wrote: post #260
manigandham wrote: post #244

Earlier quoted context omitted.

Those sites are far smaller than Stackoverflow. Bespoke campaigns don't always pay more, and usually mean less total revenue for the site if that's all they run.

But... Shouldn't smaller sites find it *harder to gain attention of publishers and obtain bespoke ads? In my mind major respected operation like SO should have an easier job. I interpreted OP to imply "nobody is big enough to run bespoke ads". I guess I don't have metrics for it and my impression that's clearly a more reliable investment of one's advertising dollars is a mistaken one :-/

> Shouldn't smaller sites find it *harder to gain attention of publishers and obtain bespoke ads?

I suspect there's a demand problem: while a bigger site might be better at gaining the attention of those buying non-network ads, there may not be a sufficient volume that is even considering buying ads in that market to support a larger site, and changing that takes either more or bigger sites than even SO.

Re: Why is Stack Overflow trying to start audio?

#377

Post by scarface74 »

bongobongo wrote: post #329
paulie_a wrote: post #204

Earlier quoted context omitted.

The tech industry has a bit of habit over emphasizing their importance. In reality they have much less clout than they like to think. Techies expect the world to bend over backwards because they make money. A decent chunk of that is basically funded by ads.

The unique combination of arrogance and ignorance on HN grates on me, too. And a lot of it is motivated by what you suggest, which is the high compensation of techies relative to other knowledge workers—it makes them think they are inherently special rather than just temporarily overvalued. That being said, techies—unlike admen—are still builders and the people who build the shit will always ultimately have the clout…

Software developers have been paid better than the average “knowledge worker” for at least the two plus decades that I’ve been doing it.

I don’t just mean Silicon Valley/West Coast.

Re: Why is Stack Overflow trying to start audio?

#378

Post by Ajedi32 »

coldpie wrote: post #86
Nick-Craver wrote: post #68

I just wanted to chime in from Stack Overflow here and let people know: we are aware of the issue. And we're NOT okay with it. We're trying to sort out how to kill the audio behavior now. It's not very straightforward to find where it's coming from, but we are working on it. We've also reached out to Google for their assistance in tracking it down. If anyone can offer advice, we'll more than happily take it. - Nick C…

Why are you allowing arbitrary javascript to be served to your users?

I think this comment[1] on the linked Meta question explains it pretty well:

> To the people confused why ads need to run their own Javascript (even ones that are just static images): The short answer is that Ad Networks do not and cannot trust website operators. They need to run their own JavaScript served from their own servers in order to verify that a real user saw the ad and for how long, and they can't trust the website operator to tell them. And these pieces of JavaScript tend to be more invasive and privacy-destroying than the website's JS because they care, far more than the actual website does, that the "user" is not a bank of iphones in a sweatshop in China.

[1]: https://meta.stackoverflow.com/questions/386487/why-is-stack...

Re: Why is Stack Overflow trying to start audio?

#379

Post by vbsteven »

kowdermeister wrote: post #365
vbsteven wrote: post #328

Earlier quoted context omitted.

It’s not the internet we want but it is the one we have. In the end it is your own responsibility for which code gets executed on your machine. I run NoScript with all JS blocked by default and only whitelist the domains I want. On most sites you can get by with no JS or just scripts from the same domain whitelisted. Maybe a CDN from time to time

It's indirectly what most people wanted: good content for free.

In a way yes, but for me it's not about that. It's about not letting everyone and their mother execute their code on my machine for whatever reason. Ads, tracking, cryptomining, surveillance.

Mind you that I am only running NoScript and not a "real" adblocker. Show me ads in a static image and I'm fine with that. Selfhost the ads on your own domain and you are also going to get whitelisted.

I mainly do it for cases like this where Stackoverflow has enabled an ad network that is pushing code to all of their users that is doing some weird things (like querying/opening audio devices) and stackoverflow is not even aware that it is doing that. What if it was a cryptominer?

Re: Why is Stack Overflow trying to start audio?

#380

Post by jacobush »

DCoder wrote: post #280
zeta0134 wrote: post #238

Earlier quoted context omitted.

My Vizio's built-in software tries to do that. There's a reason it's not allowed to connect to wifi.

When you say "it's not allowed", do you trust its own settings? Are you sure it's not doing something like [0]? How do you even protect against that? [0]: https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choo...

I guess with GDPR.
Post reply on HN