Ad Nauseam

That may be true of the general HN crowd, but I doubt it's true for most people. I block ads because they make the web ugly and slow. It's simply nicer to browse sites without them.

In my case at least, "surveillance" doesn't factor into it. If I were to see ads, I'd actually prefer they be targeted to my interests.

OK, remember you asked for it

"If you know otherwise, then please cite the specific CVEs. Otherwise, you're just spreading false information"

man, you are so full of it

want proof ? no problemo

1. CVE are organised by vendors and products

HTML and JS does not show as products, only browsers

see http://www.cvedetails.com/top-50-products.php

look #3 Firefox, #4 Chrome, #8 IE

that explains why you will never see a specific HTML and/or JS CVE, that does not mean they don't exists.

Also in term of volume, browsers have more CVE than Flash, it's all here in the numbers: Firefox 1320, Chrome 1216, but no let's ignore them and focus on Flash 713 CVE.

Just that it make your whole argument biased, the part "JavaScript itself has been pretty stable for years" is ridiculous, search for JS blackhole exploit, Rowhammer.js exploit, Heap Overflow exploit in JS, etc. you don't see them in CVE but they are here and exploitable.

It's better to think than JS is secure looking at that http://www.cvedetails.com/vendor/10288/Javascript.html

yeah no exploit in JS, none, we are all safe LOL

this for example http://www.cvedetails.com/cve/CVE-2015-0817/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 https://www.mozilla.org/en-US/security/advisories/mfsa2015-2...

you don't see it show up under the tag "JavaScript"

2. Number of CVE listed do no equals CVE exploited in the wild

so you say "It averages to about 1 every 3 days", that's completely false

1 vendor patch for a particular product can close numerous CVE at the same time so it's more like "we squashed 50 CVE in 1 day"

look at http://www.cvedetails.com/cve/CVE-2015-8449/

follow up on https://helpx.adobe.com/security/products/flash-player/apsb1...

that's 1 patch, it does not indicate 1 CVE every 3 days, look at the details

"These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8050, ..." that's more than 50 CVE of the same type patched and closed at the same time

Also look the "Acknowledgments", numerous security team reported all those CVE for them to be patched, there is no indications they were exploited in the wild.

Saying such things as "oh 30 CVE discovered in 1 month, so that means there were 1 CVE per day" is totally misleading, even more misleading to assume all those CVE were exploited by default (eg. "could lead to").

At best it indicates that they (Adobe and other security team) are more serious about discovering and patching those CVE and so they close more of them more often.

Well, in the gaming scene, most of my news comes from social media sites, fan sites and fan run wikis, which don't tend to be run as businesses.

For example, if I want the latest information about Zelda U, I wouldn't go to IGN or Kotaku or Polygon, but instead to Zelda Informer, Dungeon or Wiki depending on what exactly I was looking for. If it was more general information, then that's what the likes of GoNintendo are for.

Of course, I could always just go to the company instead of a middleman; most of them are moving towards marketing straight to the consumer rather than the press. Given that most of say, IGN's information comes from summarising things like Nintendo Directs and E3 presentations, or from what's trending on Reddit or Twitter or Youtube, it seems more logical to go straight to the source than through the middleman.

Would this work in all fields? No, stuff that's dangerous or complex (like say, reporting on the war in Syria or what not) tends to need more professional organisations. But if you're after information on games, TV shows, movies, music, celebrity gossip or sports, then to some degree you can pretty much entirely replace the professional media with fan sites and blogs.

It's also why paywalls are going to be a problem even in the short term; anything factual you put behind one is going to end up on the fan run sites and aggregators anyway. If a big site puts something interesting up behind their paywall, then it'll be maybe about ten minutes before someone's ripped the whole thing, stuck it on sites like Youtube and its then been posted across the entire blogosphere.

Actually, I intentionally left that out. I thought 4000 words was long enough. Surveillance would add in another 4000 words.

"Evil" is a ridiculous word to use in the first place; but for what it's worth, in my opinion, a platitude like "[ads are] not perfect, nor evil," glosses over the fact that ads often are vectors for attacks that rely on deception, ignorance, and unwitting surveillance, which definitely has an ugly moral flavor. The business model may not be inherently evil (what is?), but it sure seems to be a convenient technology for deliberate abuse via fraud and malware.