Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites using SSAI (server side ad injection)

github.com

Post reply on HN
Print view View original

61–70 of 75 posts

Re: Websites using SSAI (server side ad injection)

#61

Post by jefftk »

Nextgrid wrote: post #38
tobyhinloopen wrote: post #35

Earlier quoted context omitted.

> There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. You cannot overwrite javascr…

You can't use ReCaptcha (or any captcha) for ads. Captchas work because they prevent access to content users want until they solve the captcha. If you put ads behind a captcha? Well in all honesty you're just doing a service to the user by hiding the ads behind a captcha they're never going to solve (even if they are not robots) because it's not in their best interest to do so.

> You can't use ReCaptcha (or any captcha) for ads. Captchas work because they prevent access to content users want until they solve the captcha.

If you've used ReCaptcha in the past few years [1] you might have noticed it often doesn't ask you to solve a captcha. The parent is describing using a similar approach of detecting bots to identify ad impressions that shouldn't be counted (spam).

[1] https://security.googleblog.com/2014/12/are-you-robot-introd...

(Disclosure: I work at Google in ads, though not in spam.)

Re: Websites using SSAI (server side ad injection)

#62

Post by KozmoNau7 »

portroyal wrote: post #59
KozmoNau7 wrote: post #39

Earlier quoted context omitted.

If someone puts content out there for free, it is by definition freely available, and I decide 100% which content I want my browser to accept and show, and which content to ignore. If you want to make sure you get paid for your content, put it behind a paywall. Yes, the number of users will drop, but you can't have your cake and eat it, too. Otherwise, ask nicely for donations or Patreon support or do old-fashioned s…

> I decide 100% which content I want my browser to accept and show, and which content to ignore. Devil's Advocate says the people who make your browser reduce 100% to maybe 60%. Browser extensions are the 10%.

Depends on which browser and which add-on loadout you use.

On Firefox, with appropriate small changes and with uBlock Origin, uMatrix and a few other add-ons, you bet I can adequately control the data accepted by my browser.

If you use Chrome, well that's another situation. Don't use Chrome.

Re: Websites using SSAI (server side ad injection)

#63

Post by hombre_fatal »

manigandham wrote: post #23
fixermark wrote: post #15

I get the distinct impression, in the war of ads vs. consumer, that some people will not be satisfied until they've submarined advertising all the way down to sponsored content and we have to go way out of our way to notice that the Try Guys are always drinking Coca-Cola or something.

There will always be those fringe people who insist on content being valueless even though they consume hours of it. The greater problem is that the ad industry is too unregulated and greedy which has led to a tragedy of the commons with malware and poor UX everywhere, leading to adblockers installed by many who otherwise wouldn't mind.

I think the biggest problem is that ads have given us a culture where people expect everything to be free which makes it really hard to compete with ads.

The malware stuff is a cherry on top, but not the main issue.

Re: Websites using SSAI (server side ad injection)

#64

Post by ozzmotik »

KozmoNau7 wrote: post #53
ozzmotik wrote: post #49

Earlier quoted context omitted.

>implying there is no tracking when watching a video on a Google owned platform

Use a VPN, use a private window, never log in. I posted an example of how advertising could be done in a more sensible way, not a ridiculous claim that Google doesn't track everything they possibly can.

i mean my comment wasn't trying to imply that was what you were suggesting. it was more along the lines of suggesting that in video organic and sponsored ads by content creators isn't going to stop you from being tracked. even with a VPN, a private window, and staying logged out, they can still likely fingerprint you so you better use noscript too! the point is there's no way to not be tracked short of removing the things that facilitate the tracking in the first place.

Re: Websites using SSAI (server side ad injection)

#65

Post by slimscsi »

doctorpangloss wrote: post #2

Before anyone thinks this is a Eureka anti-ad-blocking technology: Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. Otherwise, obviously, the server could just maliciously record impressions/clicks. Then, logically, if uBlock Origin doesn't remove the ad, but does successfully remove the mediator's scr…

The server could continue to serve ads until the client reports back that one ad was rendered. If the message is blocked, the content would never be delivered. Thus making ad blockers content blockers. I'm not saying this is a good thing or bad thing. Im just saying there are more cats and more mice out there.

Re: Websites using SSAI (server side ad injection)

#66

Post by bostik »

Nextgrid wrote: post #38
tobyhinloopen wrote: post #35

Earlier quoted context omitted.

> There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. You cannot overwrite javascr…

You can't use ReCaptcha (or any captcha) for ads. Captchas work because they prevent access to content users want until they solve the captcha. If you put ads behind a captcha? Well in all honesty you're just doing a service to the user by hiding the ads behind a captcha they're never going to solve (even if they are not robots) because it's not in their best interest to do so.

If you follow that train of thought to its logical (if perverse) conclusion, we can soon expect ads as the subject matter of captcha.

Instead of selecting three pictures that have a given "thing" in them, we'll be picking the ones showing a given brand among otherwise generic signs.

Re: Websites using SSAI (server side ad injection)

#67

Post by BenjiWiebe »

bostik wrote: post #66
Nextgrid wrote: post #38

Earlier quoted context omitted.

You can't use ReCaptcha (or any captcha) for ads. Captchas work because they prevent access to content users want until they solve the captcha. If you put ads behind a captcha? Well in all honesty you're just doing a service to the user by hiding the ads behind a captcha they're never going to solve (even if they are not robots) because it's not in their best interest to do so.

If you follow that train of thought to its logical (if perverse) conclusion, we can soon expect ads as the subject matter of captcha. Instead of selecting three pictures that have a given "thing" in them, we'll be picking the ones showing a given brand among otherwise generic signs.

I've seen some websites that do that, ie watch a short ad and then type in the brand name from the ad.

Re: Websites using SSAI (server side ad injection)

#68

Post by bostik »

BenjiWiebe wrote: post #67
bostik wrote: post #66

Earlier quoted context omitted.

If you follow that train of thought to its logical (if perverse) conclusion, we can soon expect ads as the subject matter of captcha. Instead of selecting three pictures that have a given "thing" in them, we'll be picking the ones showing a given brand among otherwise generic signs.

I've seen some websites that do that, ie watch a short ad and then type in the brand name from the ad.

So life imitates art - again. Too bad the artist is a dystopian dadaist.

Re: Websites using SSAI (server side ad injection)

#69

Post by tobyhinloopen »

Nextgrid wrote: post #38
tobyhinloopen wrote: post #35

Earlier quoted context omitted.

> There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. You cannot overwrite javascr…

You can't use ReCaptcha (or any captcha) for ads. Captchas work because they prevent access to content users want until they solve the captcha. If you put ads behind a captcha? Well in all honesty you're just doing a service to the user by hiding the ads behind a captcha they're never going to solve (even if they are not robots) because it's not in their best interest to do so.

There is a hidden "I'm not a robot" "captcha". You might use that to help detect whether the impression/view/click was legit.

https://developers.google.com/recaptcha/docs/invisible

You can programmatically invoke the challenge from the ad's javascript.

Re: Websites using SSAI (server side ad injection)

#70

Post by geocar »

tobyhinloopen wrote: post #35
geocar wrote: post #32

Earlier quoted context omitted.

> Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a…

> There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. You cannot overwrite javascr…

> You cannot overwrite javascript properties in frames from another domain, right? Am I missing something?

You don't need to.

The SSP or publisher can slip the naughty JavaScript directly into the ad tag.

> A fake webbrowser requires a lot of IP addresses.

You may be surprised to learn there's a market for buying IP addresses, and they're cheaper than the revenue a bad actor can gain from using them.

There's also a lot of toolbars that embed some limited tunnelling functionality that they can then resell.

There's also a market for hacked DSL routers that you can tunnel through.

Post reply on HN