News for hackers. Stuff that matters.
Re:I've removed all ad network code from my blog by mrweasel on Thursday January 05, 2017 @08:35AM (#13326968)
It also doesn't solve the issues for most advertisers. I can't imagine that a large e-commerce site would want to make thousands of individual deals with sites that may or may not generate the desired traffic.

His solution doesn't really scale, for the advertisers, which is why the ad networks exists.

My main issue with ad networks is that they simply aren't technically competent enough to run an internet facing business. Most of them seem to be run by good sales people and not so good IT staff. Most of those I've dealt with simply doesn't understand how the internet works.

Re:I've removed all ad network code from my blog by wheaties on Thursday January 05, 2017 @10:36AM (#13327918)
>> My main issue with ad networks is that they simply aren't technically competent enough to run an internet facing business.

As someone who works in Ad tech, let me be the first to say that there are a few A-players and a ton of C-players. The problem is, the C-players are so crappy that everyone associates all of ad tech with them. A good analogy is the difference between Black Hat and White Hat SEO. Most of the C-players right now don't have any incentive to invest in the tech so they can be where my employer currently is on that spectrum.

Clarification: I don't speak for my employer.

Re:I've removed all ad network code from my blog by pavel_lishin on Thursday January 05, 2017 @10:59AM (#13328137)
They're the ones who've shit in the well your employer is trying to get the rest of us to drink from.
Re:I've removed all ad network code from my blog by a3n on Thursday January 05, 2017 @03:32PM (#13331093)
> there are a few A-players and a ton of C-players.

So I am certain to suffer from C-players, and my browser may never encounter an A-player.

If there were a way for me to a) believe that ad network X is non-malicious A-player, b) for me on my side of the browser to set and forget whitelisting that A-player, c) to know that the A-player hasn't been acquired by a malicious C-player, and d) that a publisher was only using non-malicious A-players, THEN I would enable (some) ads.

But it's too much work on my side. A-players need to be talking to publishers and C-players, and driving the C-players OUT. Until then, I block indiscriminately.

I'm not against ads, I'm against unnecessary risk.

Re:I've removed all ad network code from my blog by rhizome on Thursday January 05, 2017 @04:40PM (#13331682)
Which class is Zedo in?
Re:I've removed all ad network code from my blog by croon on Thursday January 05, 2017 @09:10AM (#13327174)
> It also doesn't solve the issues for most advertisers. I can't imagine that a large e-commerce site would want to make thousands of individual deals with sites that may or may not generate the desired traffic.

Agreed.

Idea: Is it possible to replace ad networks with ad brokers? The broker keeps a ledger of interested parties on both sides. Someone looking to buy ad space specifies relevant market segments (data analysts, single moms, golfers, etc), and the broker connects them to relevant sites.

Metrics could be solved by passing a token when linking back to ad space buyer, or the broker still embedding, but much less intrusively than an ad network, both the blog/site and the ad space buyer tracking independently and reporting back to broker for backwards statistics, etc.

I'm sure there are other issues, but this is just off the top of my head.

Re:I've removed all ad network code from my blog by JStanton617 on Thursday January 05, 2017 @09:13AM (#13327191)
This is exactly what an ad network is
Re:I've removed all ad network code from my blog by coldpie on Thursday January 05, 2017 @09:22AM (#13327249)
Yeah. The problem with current ad networks is twofold. One is advertisers require metrics, metrics require some form of tracking or JS, and advertisers don't trust the ad networks to give accurate metrics, so they require the ability to embed their own JS. This is where you get the app store redirects and malware. Two, ad networks are scummy as shit and don't do any auditing so long as advertisers are willing to pay. You pay us, we'll put your code on client sites. No questions asked.

I think the solution is that advertisers will just need to give up the idea of having reliable metrics on ads, since that's the source of the problem. It's kind of a tragedy of the commons situation: no one would use an ad network that simply distributes JPGs because it has no metrics (malware), but users will block ads that have metrics (malware). There are two solutions: give up metrics, or install an ad blocker on every machine. Ad networks are rapidly pushing us towards the latter.

Re:I've removed all ad network code from my blog by ensignavenger on Thursday January 05, 2017 @11:21AM (#13328378)
I don't think advertisers need all of the tracking crap they seem to think they do, for many decades advertisers have had much less tacking ability and the industry thrived. Even without ad network JavaScript, you get more tracking ability on the web than any other medium, because you can give each ad a unique URL, and once you have a click from that URL , you have the prospect on you own site and can track the results. Prospect bounces almost immediately? Well, that wasn't very successful- prospect buys your product/service- success! Prospect spends 15 minutes on your site, reading several articles? Not so bad. What do I need from the publisher that ad network JavaScript provides?
Re:I've removed all ad network code from my blog by trprog on Thursday January 05, 2017 @08:17PM (#13333121)
>prospect buys your product/service- success!

I suspect tying payments to actual user actions, in particularly the user buying something, is the best solution. Affiliate marketing essentially. Its easy to verify and very tough to profitably game so the company running the ads can pay their ad network/publishers/marketing staff with confidence.

Ultimately the advertiser doesn't really care how many impressions (or whatever) they get. They care how many people buy their thing or take some specified action.

I suspect the big roadblock is that some ad networks, publishers and marketeers don't particularly want there to be a concrete ungameable metric that requires them to produce ads that actually move product. If you are counting views or clicks it is easier to look like you are succeeding than if you are only counting people who actually get their wallet out.

Re:I've removed all ad network code from my blog by ensignavenger on Friday January 06, 2017 @10:06AM (#13336769)
They can still count clicks and views- you know if someone visited your site or not from an ad that uses a custom URL- so if that is what you want to measure, your don't need any JavaScript. If you find a publisher is sending you too much garbage (fake) traffic, you don't advertise with that publisher anymore. Thus it behooves the publisher to do fraud prevention on their end.
Re:I've removed all ad network code from my blog by notheguyouthink on Thursday January 05, 2017 @09:26AM (#13327272)
What about a sort of metrics protocol? Ie, the ad network puts up it's own JS, the advertisers don't get to put up any code. The Networks JS will be configured to optionally call a custom metrics endpoint with some data - ie, the advertisers own servers.

Very little trust is needed, and customers don't get crazy JS on their pages. Is something wrong with this model?

Re:I've removed all ad network code from my blog by vertex-four on Thursday January 05, 2017 @09:35AM (#13327353)
The issue is that large-scale advertisers don't actually trust the ad networks - the network could make up data, and has less reason to track fraudulent clicks/etc.
Re:I've removed all ad network code from my blog by rpastuszak on Thursday January 05, 2017 @10:36AM (#13327915)
Yesss, and with video ads, where VAST is involved, once the ad script starts loading, it has no knowledge about the actual media file, as it has to follow a chain of XML files leading to different middlemen (for tracking purposes), ad exchanges, etc... Bidders in ad exchanges can be exchanges as well.

Dealing with bots, fraudulent clicks and malware is one of the things that sets some ad platforms from the really nasty ones.

Re:I've removed all ad network code from my blog by ReverseCold on Thursday January 05, 2017 @10:30AM (#13327855)
> The Networks JS will be configured to optionally call a custom metrics endpoint with some data - ie, the advertisers own servers.

So no more trust required for the advertisers?

Re:I've removed all ad network code from my blog by ddebernardy on Thursday January 05, 2017 @09:35AM (#13327350)
> Is something wrong with this model?

Detecting fraudulent ad views and clicks.

Re:I've removed all ad network code from my blog by walterbell on Thursday January 05, 2017 @10:30AM (#13327854)
Which parties perform fraud / bot detection today?
Re:I've removed all ad network code from my blog by ddebernardy on Thursday January 05, 2017 @11:59AM (#13328818)
There was a dozen plus last I worked in the field. There are scores of horror stories related to ad fraud. In particular:

- PPV ads that get stacked. That, several ads laid out on top of each other so that only one (if any at all) is visible.

- PPV ads that get served to bots. Sometimes purposely so, other times as a result of phantom users who replay sessions to build fake profiles for PPC purposes.

- Ad injection that replace legit ads or include new ones via browser toolbars or compromised devices.

- PPC fraud, of course, including some combined with all of the above.

- PPA fraud through cookie stuffing, meaning flooding browsers with cookies to make it look like the traffic originate from where it doesn't.

- PPA fraud through ad injection. Nothing converts better than a popover served via ad injection for the very site you're shopping on.

I'm sure I'm forgetting quite a few, but at a high level those are the main ones to be aware of. As an advertiser you generally cannot rely on the stats you're provided with.

Re:I've removed all ad network code from my blog by walterbell on Thursday January 05, 2017 @12:04PM (#13328888)
Is it safe to assume that all of these go away within a closed network like Facebook? If so, the numbers that advertisers see on Facebook (vs elsewhere) could help quantify fraud.
Re:I've removed all ad network code from my blog by ddebernardy on Thursday January 05, 2017 @12:49PM (#13329432)
Only partially, unfortunately. One of the things sophisticated fraudsters do is replay actual user sessions to build fake profiles. That is, they record scrolls and clicks on compromised devices, and have other users build similar profiles by following similar sessions on other compromised devices. This includes browsing FB and interacting with AdWords of course, and screws up PPV, PPC, and PPI metrics all over.

On top of building more valuable fake user profiles for the latter two purposes, doing this allows to bypass click-density based ad fraud detection. See this article for an example of what you see when you can sometimes observe using the latter when detecting the less sophisticated fraudsters:

http://adage.com/article/digital/inside-google-s-secret-war-...

As the latter article implies, Google's team is pretty sophisticated at detecting fraud. But even then, seeing things like this suggests there are edge cases they'd like to see go away or that are hard to detect:

https://news.ycombinator.com/item?id=13327228

Re:I've removed all ad network code from my blog by geocar on Thursday January 05, 2017 @10:44AM (#13327983)
The advertiser may choose a partner and run it with the ad, or they may choose a partner and require the publishers produce reports from that partner. Some advertisers will simply require some notable anti-fraud vendor, and the publisher is free to choose the cheapest/least effective.
Re:I've removed all ad network code from my blog by losteric on Thursday January 05, 2017 @10:30AM (#13327852)
Traditional news media is dying because advertisers are running to the internet, where they can get lots of highly targeted impressions and deep metrics for pennies on the dollar... perhaps that trend will turn around soon.

Advertising's tragedy of the commons isn't unique to the internet. Other media went through the same adoption cycle of over-promising followed by consumer backlash.

I'm hopeful we'll see advertisers return to the model of (mostly) blindly trusting their advertisers. It will be interesting to see how our largely ad-supported internet changes as a result.

Re:I've removed all ad network code from my blog by rpastuszak on Thursday January 05, 2017 @10:29AM (#13327837)
> I think the solution is that advertisers will just need to give up the idea of having reliable metrics on ads, since that's the source of the problem.

One of the things I found incredibly annoying when I was working in this area was the fact that definitions of some metrics can be so drastically different, eg. viewable impressions, completed view impressions (in video) - these difference were so huge that a video played off screen, a video played with only 1px (or 50% height) visible - have been treated as exactly the same thing.

I heard about a company that changed their way of measuring these metrics to something more realistic than... well, a video playing off-screen, whilst increasing prices, which sounds like a decent move - they ended up losing ca. 70% of their revenue.

The problem is that it's really difficult to explain your customers that you've been potentially lying to them (or at least that's the impression they might get).

Regarding the performance footprint - I recommend taking a look at the VAST/VPAID spec. It's not uncommon for an ad to fetch 3-4 xml files containing dozens of tracking pixels coming from 10s of domains. There's also no guarantee that any if the intermediate VAST files contains the right content, how long the chain is or where it comes from.

[EDIT] disclaimer: I might've used incorrect names here, since it's been quite a long time since I've worked in this area, I hope you still get the idea.

Re:I've removed all ad network code from my blog by mamcx on Thursday January 05, 2017 @09:54AM (#13327509)
Let's imagine that not all the advertisers are that shady, and just don't know better. Or if I wish to serve a subset of them, how break into this business? How get the first batch of customers?

I have some ideas about build a server-side ad-network, but because I imagine is very hard to get customers I dismiss it, for the same reason: You need to be "famous/large" to attract customer in the ad-space.

Re:I've removed all ad network code from my blog by geocar on Thursday January 05, 2017 @10:48AM (#13328032)
Well, who do you think your customers are?

Publishers want someone to handle monetisation of their website. If they get enough traffic, they want that someone to work in-house, but if they don't, they want some one (ad network) to do it for them.

Advertisers want impressions/clicks/performance.

A (successful) ad network needs to do both, so bootstrapping invariably looks something like matchmaking in the very beginning.

If you want to find my email address and reach out, I'm happy to talk to you more about bootstrapping: I've gotten more than one ad network off the ground.

Re:I've removed all ad network code from my blog by mamcx on Thursday January 05, 2017 @08:01PM (#13333026)
I follow the links in the hn account and don't see the email.

Mine are at http://elmalabarista.com

Re:I've removed all ad network code from my blog by coldpie on Thursday January 05, 2017 @09:58AM (#13327539)
Some exist already, you may gain inspiration from them. Project Wonderful is one I know about. There was some guy on here a year ago claiming to have an ethical ad network, but when I visited his client sites, it was mostly "Click Here to win a Free iPod" scams. I think you're right, it'd take a lot of work to find both clients and advertisers interested in working with you given your ethics-inspired limitations.

Edit: The other problem you'll run into is the tragedy issue I mentioned. Your ads will be blocked by most ad-blockers' scorched-Earth policy, which comes from your shitty, unethical competitors. Good luck to ya ;)

Re:I've removed all ad network code from my blog by croon on Thursday January 05, 2017 @09:23AM (#13327251)
Well, the distinction I was trying to make was that instead of blindly iframe:ing the ad network, you as a blog hoster could have full control over how to implement the ad (because some metrics would still be there), yet have access to/be included in a large database of buyers/sellers.
Re:I've removed all ad network code from my blog by rhizome on Thursday January 05, 2017 @04:43PM (#13331701)
This is already the current state of the art. One problem is that you get chains of "brokers" inflating the middle of the ad-serving equation, each one trying to price their position in the chain with a just-in-time auction. The milliseconds (if we're lucky) add up.
Re:I've removed all ad network code from my blog by johnward on Thursday January 05, 2017 @10:35AM (#13327905)
This is why networks like buysellads started. Advertisers wanted blog traffic but didn't want direct deals or standard adsense units.
Re:I've removed all ad network code from my blog by night815 on Thursday January 05, 2017 @08:47AM (#13327038)
"Most of them seem to be run by good sales people and not so good IT staff."

Sounds like a good solution to me.

Re:I've removed all ad network code from my blog by mrweasel on Thursday January 05, 2017 @08:55AM (#13327077)
In terms of profit I'm sure it fine, but if you want a stable and fast ad network, free of malware and viruses then you need the best IT staff money can buy. It may also hurt profits, because you security team would reject some customers.
Re:I've removed all ad network code from my blog by saiya-jin on Thursday January 05, 2017 @08:51AM (#13327062)
no, good solution would be having good IT people with good sales, nothing less