One of the questions was to talk about cross site scripting.
I described the basic concept and then mentioned how so many sites volunteer to be cross site scripted, by loading random scripts from multiple ad networks.
Some years ago I was working at Zvents on front end code for their partner sites. These were news sites who just loved to pull in as many ad network scripts as they could.
Those ad networks did not make my job easy. Here I was, trying to create a nice experience for our users, and robust across multiple browsers... And the ad network scripts kept breaking fundamental JavaScript features! A lot of my time went into reverse engineering their scripts so I could figure out how they were breaking things and work around it.
A pox on ad networks, I say.
Unless you're also writing the operating system, can we all agree to stop using the term "full stack"?
I'm generally ad tolerant. (I've said this on HN before). I didn't block ads. I'd even click ads if they were relevant to my interest. Although I don't think I've ever bought anything from an ad or as a result of clicking an ad.
I can understand the "ads are a way to pay for the content you use" argument and I have some sympathy for it.
Yet even I have installed an ad-blocker. I mostly use a mobile connection. Installing an ad-blocker has considerably reduced the stuff I download. An Ad blocker literally saves me money.
It's fine to decide that ad networks don't have a "right" to run code on your machine, but the moral response (assuming you don't have an answer to the "consume content question") is to configure your adblocker to close any tab that would otherwise load an ad. If instead, you decide to view the page without the ad, then you need some answer beyond "I don't give ad networks the right to run code on my machine".
(I'm not saying ad blocking is morally wrong, just that your justification for it isn't sufficient. I block ads myself.)
If you want to ask me to pay before those bytes will be sent to my private space, that's fine. You can recommend, but you cannot impose that I use a certain way to display your information. If I prefer using Lynx to view your website, I have the right to do that (and it won't show your ads because it's not even graphical). If I prefer using a modified version of Chromium, that's no different.
Ad blocking on a web browser is no different from muting the TV and grabbing a snack when the ads come on.
Yes, I understand advertising is a business model. That business model should take into account that a certain fraction of users are going to block them. If too many users start blocking ads, we can and will develop new business models to drive businesses. For example, perhaps a new form of advertising could be fun for the user, such that they wouldn't want to block them.
People listen to certain rock songs backwards thinking there is a satanic message hidden.
People watch movie trilogies in orders other than the one the filmmakers intended (Such as the Star Wars Machete Order).
People create mods for games that change the look and some times playing style.
When CSS first came about, modifying styles was outright encouraged.
Today there are numerous browser extensions that modify the experience of Reddit, Facebook, and other popular sites.
Hell, there are several businesses built on modifying Gmail for better workflows.
It's not advertising itself that I object to, it's distractingly annoying motion and sound, and it's third party content injection. Advertising can be great, but the current trend is for it to be flashy and obnoxious, and that's not OK.
Some of this argument doesn't hold up. Websites are not electrical signals that just enter your space". You're explicitly requesting access to them. And, they are not free to operate. Your requests to view them cost the producer some amount of money.
I'm not a fan of ads myself and think they are frequently outright abusive (even without malware). In fact, I pretty much detest the volume of advertising today.
But, I don't get this idea that we have a right* to consume web content hosted on a private entity's servers. There is a choice not to consume at all. Yes, companies like CNN shove so many ads in their vids that they are now more ads than content. So, I no longer watch vids on CNN.
I also think the analogy between ad blocking and grabbing a snack during TV ads is lacking. In the former case, there is a "set and forget" tech that guarantees that no ads will be seen...ever. In the latter case, one must actively avoid each advertisement, and do so with near perfect timing.
>...business model should take into account that a certain fraction of users are going to block [ads]
The reasoning here reminds me of that employed by people who believe music should be free. But, I can't figure out why people who presumably appreciate an artist, think that artist should work for nothing. The answer is that they don't actually believe that. Instead, it really boils down to "let someone else pay for it".
Not really. You can't spy on your neighbours or decrypt and watch pay satellite or cable tv.
The people who make this argument aren't inconsistent, they also likely believe that decrypting satellite, breaking DRM, or generally hacking or cracking shouldn't be illegal but dealt with through proper security or private contract.
(I do happen to be male, but I just noticed, and just wanted to make a suggestion for the future.)
(If you went through the trouble of looking up who I am via googling me or such, and then wrote the comment, then please ignore this and thank you for your attention to detail.)
Radar detectors are illegal in some places.
I rode the bus last week and the entire time I was reading my book. I never read any of the overhead ads before getting off the bus.
http://www.nytimes.com/2001/09/25/science/scientist-at-work-...
For some websites (like cbc.ca) it's a perfect comparison.
If they don't like this, they don't have to send the content to me. If they want to try to make it difficult for me to see the content without also seeing the ads, they have that right. I have the right to take extra measures to block the ads anyway and still view the content.
Again, if they don't like this, they don't have to send the content to me at all. If they really want to make sure I view the ads, they are perfectly within their rights to only show ads first, and then make me take a test to ensure I looked at the ads and understood them and remembered things about them, and only then show me the content after having proved I viewed their ads and paid close attention to them.
They could also devise measures to detect ad-blocking, and then block my IP address from viewing content in the future until I pay a fee or prove that I've viewed ads as above.
As long as websites willingly send me content, I have every right to view it, however I choose to, and I do not care what a bunch of pro-advertising moralists in discussion forums think about it, and I utterly reject their insane idea that some unwritten contract exists that somehow requires me to not view content without viewing ads.
While driving do you pay attention to each billboard or ignore them?
Do you switch radio stations when commercials begin and the content you wanted to hear is over?
My response is that it has always been my right to decide what I see and pay attention to. Adblockers are the extension and automation of my will.
I shed no tears if you don't get a +1 in impressions according to the metrics your advertising network keeps, because if they took the time to gather the same statistics for other advertisements I encounter in my life, they'd get the same result.
That lack of impressions implies something important: your mode of advertising/revenue generation is shit and it should be changed. Luckily, it seems enough people think the same way that it can't be ignored.
Advertising is ugly, it is an unwanted distraction and it is often visual pollution. Take a drive through districts that ban billboard advertising. The obstruction of natural beauty and assault on the senses becomes offensive on your return to areas that have no such restrictions.
Computers make it easier to track who views ads, something that's hard to track in real life. Computers also make it easier to automatically apply that mental adblock, something that's also hard to do in real life.
What right do these corporations have to manipulate people into buying things, making them feel incomplete for they do not have the abs, the breasts, and phones and the shoes that the sexy models of these ad boards have? Burn them all, I say.
Too bad nobody campaigns for elections with stating they will get rid of all and every advertisement not closely tied to a local or nearby business.
People calling out others and saying that another person has no right to this and that is nothing but forceful catering. You see others live happily and call them out on it. Go live in the pit of your misery if you will, but cease telling others what they can or cannot do.
By accessing and continuing to access a website, you agree to their terms.
The court did not agree that "the server sent me the data so it's legal" is valid.
There's no bugs or exploits involved with the ad-blocking scenario. Sure, the website intends me to view the site with the ads, but what you are failing to understand is, they have no moral or legal right to tell me what I do with the bytes that they purposefully, in full awareness, sent me.
What does "in full awareness" mean? If they knew you were blocking ads, they wouldn't have sent it. The bug is that they didn't detect it. Why is ATTs thing a bug and this not?
I think the fundamental issue you are having is that you don't believe in property rights. Namely you don't think that my computer is mine, and that stuff that gets transferred to it; assuming the transfer was done legally in good faith, belongs to me.
I highly doubt you feel this way about meatspace; I doubt you think someone who hands me an apple has the right to tell me how to eat it. Yet when it comes to computers, you do feel this way.
pdkl95 has done a much better job than me of arguing this point, so I should probably just stop. But it bears repeating:
HTTP is not a contract. Sending me your content is not me agreeing to do stuff that is linked on some other page. If you want me to agree to view ads, or paypal you $20 first, or give you my first born child; you need to send me to another page first where I agree to it. TOS is not a gotcha. You can't trick people to agreeing to something; there has to be a "meeting of the minds".
This is precisely the point that I'm disputing, not the notion of property rights.
You still haven't given any definition of the terms you're trying to use to justify a distinction between the two. You claimed that any time someone requests something over http and the server sends data back, the person cannot have been doing anything illegal. You have not given any principled difference between that and the cases where courts found differently.
I've linked to lawyers making the same argument as me; I don't believe you've found any lawyers who agree with your claims here.
Re contracts: as I've said, that applies to scenarios when you've agreed to TOS. If you know a website has certain terms, then accessing it is agreeing to them. So your point is only valid if you can credibly claim that you didn't know the website doesn't allow ad blocking. If you think you can convince a judge that you had no idea some websites don't allow ad blocking, and that you therefore had no intention of breaking any agreements by browsing the web with your ad blocker installed, do whatever you want. But the very fact that we're having this conversation and you aren't telling me "no website would ever outlaw ad blockers in their terms" means that you recognize it as a possibility. It would be an interesting legal question as to whether mere probable knowledge (i.e. negligence) can suffice to be liable, or one would need to demonstrate actual knowledge: if the latter is found to be the legal interpretation, then I suspect ad blockers could be required to recognize when a site refuses to be viewed with an ad blockers, and not show the site at all then. Installing an ad blocker that doesn't do this would then be malicious.
This is admittedly speculation, although it gets closer as to what the actual legal question would be here. If you can cite precedent that bears on this directly, that would be better.
> If they knew you were blocking ads, they wouldn't have sent it. The bug is that they didn't detect it.
No, they have no way of detecting it. That's not a bug, it's how the medium functions. You might as well say radio stations wouldn't transmit if they knew I turned them off for a few minutes during commercial breaks, and claim that that is a bug, and that I am illegally exploiting that bug for free radio.
Oh my goodness, I went to the bathroom during a commercial break when watching TV last night. How much should I pay the TV station for stealing that show from them?
Radio stations inherently can't selectively broadcast. Websites can.
The fact that websites already attempt to prevent ad blocked users from viewing content means that they would block it if they would know. Exploiting the fact that they don't know in a particular case (by using ad blocker blocker blockers, which are a thing) is exploiting a bug.
Plenty of websites have a contract or agreement about data they send you. See e.g. Youtube's terms of service, section 5.C.
If they can, then there's no problem. If they can't selectively broadcast, or can't do it exactly as they want to, then you're back to the radio case.
> The fact that websites already attempt to prevent ad blocked users from viewing content means that they would block it if they would know.
Fine, but they apparently don't know how to block everyone they want to, so it's their choice to continue sending data to everyone they aren't blocking.
> Exploiting the fact that they don't know in a particular case (by using ad blocker blocker blockers, which are a thing) is exploiting a bug.
No, that's not even close to a bug. You clearly don't know what a bug is. This is a limitation of the transmission medium, known by all parties, where all parties can chose to stop participating at any time. They are in general unable to verify with certainty what any given client will do with the data that the server sends back. This is a property of the protocol used by everyone, not a bug in the server's software.
> Plenty of websites have a contract or agreement about data they send you. See e.g. Youtube's terms of service, section 5.C.
That says nothing about not displaying ads - it's talking about violating copyright. And it's not something it even normally displays to people AFAIK.
For the 1000th time, SHOW that contract. Do you even understand what a contract is? Youtube et al have a document they call the "terms of service", but that is not a contract.
Seriously, show where Youtube offered terms, where the user had the opportunity to read, review, and understand those terms, and where they signal their acceptance and intention to be bound by the terms of the contract. The exchange of consideration - that is, Youtube sending a video in exchange for the user giving their time to watch certain ads - only happens after the offer and acceptance.
Documents don't magically become contracts because you wish they were binding. Do I really need to include a link to a TOS for reading my comments to demonstrate why unilateral contracts are an insane idea?
This belief that you get to control what people do with data after you hand it over is highly unusual and antisocial.
That was in Europe, and for "non competition", not breach of contract as I'm suggesting.
Also, "nobody will sue me" does not mean you're doing the legal or moral thing.
It means there is no legal basis to do that. You were asking if those arguments could stand in a court, they already did. So the answer is: YES
2. When has ignorance of TOS being upheld in court to invalidate a contract with regard to ad blocking?
Your "hacking" analogy is irrelevant; hacking and contracts are completely different categories of law.
> the law
I am very familiar with contract law. You might want to read about it sometime. HTTP does not involve an offer, a meeting of the minds about the obligations the contract would create for each party, or anything that signals acceptance of the offer.
If you want to argue that an HTTP request creates any obligation for either party, then you need to show the elements[1] that created the contract.
[1] https://en.wikipedia.org/wiki/Contract#Elements_of_contract_...
See also http://www.law360.com/articles/726505/expect-lawsuits-agains...
Asking for a page over HTTP isn't hacking; again, this is entirely off-topic.
> TOS
The TOS wasn't even presented to the client. (an <a> tag to the TOS isn't a the TOS itself, nor is it an offer of a contract. It isn't even an "invitation to treat".
> agreed to
Nothing has been agreed to. An HTTP request sends a GET, and the server volunteered to send a page of content as their reply. They could have sent an offer of a contract, or some sort of "access denied" message, or any other response.
> See also
LOL. That page is a nice example of properly handling a request.
The use of ad blockers is on the rise, especially...
</div>
<div style="font-weight: bold">
To view the full article, register now.
</div>
See what just happened there? They made an offer, I declined to accept it and didn't receive the content. You negotiate the contract before you exchange consideration.
> /articles/726505/expect-lawsuits-against-ad-blockers
I'm sure there will be lawsuits against ad blockers. That's what failing businesses do. That doesn't mean their claims are valid.
Contracts are not surprises or gotchas. Show how the elements of a contract (an offer, acceptance of that offer, each party's intent to be bound, and the exchange of consideration), or your claims are just wishful thinking.
It can be. See e.g. https://www.eff.org/cases/us-v-auernheimer, which as far as I can tell involved only http/s requests.
>Nothing has been agreed to. An HTTP request sends a GET, and the server volunteered to send a page of content as their reply. They could have sent an offer of a contract, or some sort of "access denied" message, or any other response.
Again, as the example above shows, this logic has not been accepted by the courts.
Re law360: I followed a link from Google and didn't realize that it was regwalled.
If this became a standard, automatic component of the web and of browsers, known at install time, wouldn't that move ad blocking into poor legal territory?
At that point it still wouldn't be equivalent to pirating, IMO, but rather more like using DeCSS to circumvent DVD scrambling.
You're not paying. This seems more like borrowing a DVD from a library or friend, then ripping it using such software and watching it after you return it.
See also http://www.cnet.com/news/web-ad-blocking-may-not-be-entirely...
There is no contract if I have not signed anything. Viewing a website does not constitute a contract.
Websites can take their TOS and shove them up their asses.
If they don't want me seeing content without blocking ads, they are free to refuse to send me that content without me proving I've viewed the ads.
Just browsing to a website is not like that. There's no place where you have to read any TOS and click "I agree" when you go to abcnews.com or whatever.
If you present reasonable[1] terms first, then receive some type of notification that the terms were accepted (as you say, signature is not the only option), only then will a contract formed that could obligate someone to not run an ad blocker.
[1] unconscionable or misleading terms are unacceptable and can get the contract - whole or in part - thrown out.
The user paid for their cable subscription beforehand.
The user paid for the magazine beforehand.
That is not necessarily true for pirating movies.
* Static images
* tastefully integrated
* Self hosted, so no networks tracking me worldwide
* No JS
I'd even be happy to click, and perhaps buy from ads like that.
This comes from someone who goes elsewhere rather than turn off noscript or uBlock. :)
Well done, you invented the future of online advertising. Oh, wait...
I gave up and installed ad block for my parents after they've complained about lewd ads on the local news website.
This is how its "above the fold" looks like without blocked ads (I put red outlines around parts that are content): http://imgur.com/7g5ZmcG
Right now there're no porn ads, but usually it serves them too.
I have a hosts file that blocks most of the ad servers but do not have any plugins within Firefox that disable js or block adverts. Your page looks complete - i.e. nothing showing 'unable to load' signs as one might expect. Privacy Badger shows 4 trackers (amber)...
cse.google.com www.google.com platform.twitter.com syndication.twitter.com
The adverts appear to be smallish static images with links back to office furniture companies &c.
I found the SpaceStor advert for their 'railway carriage' internal booth quite interesting so I clicked on it and was taken to a UK Web site - are you processing location information or did I just get lucky?
Interesting example to pass round.
If you dial the office browse are in to show tech companies there are a good portion that the audience here will recognize: http://officesnapshots.com/offices/?fwp_industry=technology
Didn't do any technical check, only verified visually.
It's been tried before. Google "CFAA flash cookies" or "Halperin v Text Enhance".
Didn't pan out. The plaintiffs typically fail to meet the $5k damage minimum within CFAA. I assume there are other strategies advertisers could use to defend it, but the $5k minimum is an easy path.
Edit: A snippet of an article about the Halperin case...
'the court says that it can’t aggregate the harm to other putative class members to satisfy the damage threshold unless the damage arises out of a “single act.” And that poses a problem as the complaint is currently pled. The surreptitious install of the program by thousands of consumers (and putative class members) is not a “single act,” so Halperin can’t rely on this “act” when aggregating. Halperin argued that he shouldn’t be subject to the no-aggregation rule.'
Additionally, if the botnet does what it typically does..that is, coordinate to attack a specific website, that sounds a lot like a "single act".
I'm not trying to argue with you, just noting that others have tried to persue your line of thought and failed.
Edit: Regarding "I'm just wondering how ads/trackers get such a pass from CFAA"
To date, they get a pass because nobody can show $5k damages for a "single act". Of course, that may not be the only defense strategy they could employ. It's worked well enough thus far that they haven't needed to argue anything else.
In the reverse direction, where an end user does something like "add some funny thing to the url" on a popular website, it's easy to show $5k of damages, because the target isn't one person's home PC.
That's arguably a huge bug in the legal system. Maybe there's a niche for private compensation services. Anonymously crowd-funded. Somali model.
Maybe this seems silly. Because we're all so used to it.
But think. If some kid gets access to foo.com, that's a crime, no? So how is it not a crime to access random users' devices without permission?
Why?
For that, this: echo '0.0.0.0 heimdalsecurity.com' >> /etc/hosts
To my knowledge, there isn't a single publisher or ad network that take full legal responsibility if they distribute malware, false goods, or have other form of illegal ads. If there is one, let me know and I will take a look.
Got burnt by some ransomware, now what? Use that backup you hopefully have and that's it. In the time between backup and damage, the primary browser would have touched just about every ad network in existence and nobody knows how many other unpublished holes might have been responsible for the malware to leak in.
Art the other end of the range, if you are a security expert analyzing the incoming flood, you may have an abstract case of attempted computer fraud, but no concrete damages.
Edit: could this change once ad-blockers have caused the introduction of server-side splicing of ads and content? (I suspect that this will become the main business of edge server operators not too far down the road)
That's a good point. Maybe ad-blockers will impose accountability.
Edit: There's a tendency to be irresponsible when effectively anonymous. But there's still risk. Let's say that some ad network is hosting ransomware. Well over 99% of victims will have no provable damages. But maybe you take out some business and all of the day's backups. There's also the potential for class tort.
Each personal computer and laptop should be in the range of a $200. A work desktop or server should be in the range of $2000-5000, since then you got to verify the integrity of data and secrecy of costumers. Since a maladvertisement attack hits tens of thousands of users, a class action suit could be in any range, and it would be hard to guess the end result.
No. I'm not incentivized to and it is not in my best interests.
> Or do you rely on Eyeo/ABP by using their acceptable ads list while they take a cut?
Is that enabled by default? I rarely see / notice ads.
The only time an ad might be remotely useful to me is if it's product placement which is on topic for a search that I am performing where I am already looking to buy something. At any other time it's just wasting bandwidth (which on some networks might actually cost me).
I think that 'ads' are the wrong tool for the job. Ads are about 'making impressions', but doing so is actually an attack on the intellectual process of the subject that is being impressed. The very least an Ad should do is compensate for that attack by delivering actually useful and desired information. An ad should know from the context it's presented in what that user seeks and attempt to deliver value to that user. Ideally it should be about finding a match between consumers and the producers that match their need. The toxic part of ads is that they are not driven by this bounty, but instead by attempts at various companies to become the thing that fulfills a need which might not exist or which might be actively unhealthy.
All advertising was "clean" at some point, consisting of just images and links. Web advertising changed direction at some point, following the money vendors paid them. And it's absolutely impossible to guarantee that owners or investors won't change policies later. Even if a company says that they'll never do it and put it in the TOS, they can still change it at a later date with no repercussions. Even doing something outside the TOS has few consequences, so sites and ad companies can lie about their policies. Which would be cheaper than actually reinventing themselves. So, thinking about it like this, your incentives aren't reliable and will likely expire at some point in time, rendering this approach useless.
Expecting users in various industries with various levels of skill to have the motivation and expertise to clean up your industry for you is beyond ridiculous. Each individual user has such a low financial impact on final ad revenue that it would take a social movement beyond massive to have any reasonable effect.
You're really targeting the wrong audience, here. There either needs to be some type of reliable third-party (if that's even possible, given the corruptability of this industry) who tracks ad network reliability, or vendors need to incentivize clean ad networks by not buying ads on networks that allow for exploits. You need to either self-regulate, or eventually be forced by regulation (either legal or through ad blocking). If there was a reliable, trustworthy industry clean up solution that didn't revolve around people paying to remove demerits (e.g. Yelp review), maybe we could all stop furiously ducking ads and see what's left after the adpocalypse.
Here's a solution for you. Perhaps an enterprising "clean" ad network could build an extension that checks pages for third-party-hosted javascript, hidden images, and all the other tracking/exploitation techniques and rates them with an icon. That would be a far better way to market, as long as they don't try to exploit that gained goodwill. Post it on Github, keep it open. Base the entire thing about tracking sites that (directly or indirectly) use subversive techniques. Rate them and give them a black eye publicly, and include a public appeals process. This has to be automated and updated so that they can't get around it with new exploits. Build the results of this into a list that can be used by adblockers directly. But even without disabling ad blocking, you could see from this extension at a glance which sites operate in a non-user-hostile manner.
EDIT: This solution here means that users don't have to "check" to see which sites and platforms are clean. They opt-in to find the information, and then it shows up on whatever site the see. All major browsers have been adding support for Chrome-style extensions. And I can find this information out before disabling ad-blocking, and be notified of sites that have significantly worsened. Seriously, if serving ads is something you want to do, I can't think of a better way to increase reliability than this. Also, you can't use this extension to track users, either. Even anonymously.
Once again, users shouldn't have to go seek out clean advertising. There's literally no incentive at all for someone to say, "I want to see ads, so I'm going to spend hours investigating agency practices and which servers belong to which agency". And there never will be. As a user, it would cost me hours of time to educate myself, and I'd have to do it repeatedly to keep aware of which companies are toeing the line this week. All to earn you a few cents out of the goodness of my heart. The people who are buying and serving ads need to clean it up, or risk it collapsing around them. And they really should not expect sympathy or understanding until it's no longer risky to offer it.
I think ads are an awful solution to the problem.
I don't know what the better solution is but there have already been attempts made with flatr and similar.
In my opinion everyone should run adblock and the industry should move on.
Currently there is a massive movement towards ads you can't tell are ads in websites and news articles.
These are about as bad but they do fix a lot of the current issues with display ads.
Very occasionally, I even see an ad that is useful to me as well.
You might not like it, but sites are going to have to go back to the days where they host the ads on their own domain. I suppose they may still interact with an external network so they don't have to handle the sales themselves, but making sure everything is hosted from their own domain means it'll be much easier to hold them liable if malware is delivered through their site.
For web ads, I thought that most places had given up on charging by impression, and only charged by click-through.
Not blocking ads in this context is kind of like not patching your server after hearing of heartbleed.
You'll need to have turned on advanced mode for it to work. And of course, this only works with PW because PW serves ads from only its domain. Most ad networks aren't nearly so nice.
When you're sure your changes are good, hit the lock button to save them.
... it's complicated, I know. Sorry!
The task of whitelisting becomes much more involved when networks are incentivized to act maliciously or turn your private data into something profitable.
You'll have to be on the constant look out for when Network A decides "don't be evil" affects their bottom line.
It is completely crazy.
I try to stay out of the moral discussions about "consuming" content without "paying" for it. The way I see it, ad networks will regain their rights to run code on my machine when they start taking positive steps to ensure that said code will not cause harm or copy unauthorized information off my machine.