Right? Imagine IRL advertising that would break into your house and put up advertising posters or plant listening devices.

Seems more taking a plant to your house while knowing it will listen to you, while there is plant that won't listen to you but that you have to pay for.

That listening device is the cost of the plant... don't like it? Then pay to avoid it...

It's that simple, there's no alternative. They have to pay to make that content and send it to you. If it's not advertising that pay for it, that cash won't appear out of thin air. Someone needs to pay for it and if it's not an advertiser that does, it needs to be you.

There's plenty of news agency that offer paid membership without ads, go for them.

There's plenty of people that can't afford to pay or that just doesn't have the means to. I remember the amount of content I was able to learn because advertising was subsidizing it. My parent were sadly against paying on the internet and I'm far from being the only one that learned that way.

I don’t think I would like that at all.

> Sites bemoan ad blockers but then take no responsibility fo the ads that are show. That needs to change - it’s not like print advertising.

It has been changing and improving for years.

Your statement is true for the ad content for sure. (Though sites do take flack for inappropriate ad content, just like print publications have.)

This is irrelevant to the OP’s link, though, since it’s not a keylogger and keyloggers aren’t actually possible.

Ads are subject to the security rules imposed by the browser, and for the most part every abuse that ads have attempted have been shut down. Sometimes not as fast as we’d like, I admit, but for the most part I think the system is working.

Ads can no longer play audio, they can’t see data passing between me and the site they’re embedded into, they can’t abuse popups anymore, etc., etc.. Every time an advertiser comes up with some new annoying way to try and get extra attention, the good folks designing the web and making the browsers patch the hole.

I like that the web standards and browsers, and laws to some extent, are where the responsibility lies, and I wouldn’t want to have individual sites taking responsibility for the security of ads.

As for bemoaning ad blockers, at least keep in mind the ads in ad-supported free content is their revenue stream, and that the majority of ads aren’t malicious. Personally, I’d love to see a better free business model than ad-supported free content. In the mean time, paying directly for ad-free content, and putting up with ads are our main options.

We couldn't even trust them to not play sound blasting ads at 1am let alone with this.

Change or not, I think the trend is not to trust ads anymore. I question whether or not it’s feasible in the long term to sustain a model based on tracking people, selling their data, and calling that “advertising.”

Oh and if you want to see what CNN is crapping out without the cruft, lite.cnn.io works well.

Surveillance is not advertising.

I can hear them responding with something like:

Surveillance is helpful information gathering and customer profiling in order to understand customer needs better. This enables us to put more relevant ads in front of your eyes. It also helps us to understand when is most convenient to sneak in the middle of the night and harvest your and your family's vital organs, as permitted by the service agreement you signed.

Bad ads appear with every ad network, and ad networks are lazy to stop it because they know that sites will take all the blame (your comment is a great example). Pop into /r/adops sometime (or the associated slack channel) and watch site owners working nonstop to try to find a solution to this problem. It's mostly a game of whack-a-mole at this point with no real long-term solution in sight.

Google's monopoly status means it fulfills 90+% of the ads. I can guarantee you that CNN has no control. There is no competition. So, erm, maybe the onus is on Google?

Surely a company as big as CNN can run their own ad service instead of contracting it out. Do they pass the buck like this for ads on their TV channel?

They probably do run it. Just they are looking for the highest paying ads that don't have a boob in them or a penis. If the highest paying ad is a keylogger, that's generally not what they're looking for when they're filtering it out.

Is this confirmed to be Google ads? Because otherwise the comment is needlessly misleading.

According to a comment below the JavaScript originated from CNN and was likely used for debugging.

CNN absolutely has control. CNN could vote with their dollars and use a different ad platform.

Which other ad server and ad intermediation service would you recommend?

I don't know, I'm not in the business of specifying and choosing ad services.

I think you could name multiple competitive players in lots of areas that aren't your core business. You can't name any others in ad services because Google is a monopolist.

> I think you could name multiple competitive players in lots of areas that aren't your core business. You can't name any others in ad services because Google is a monopolist.

That is totally silly - What in the world makes you think I think about the advertisement industry more than the absolute minimum amount possible?

Anyway, the other options are:

- They run their own ad platform - They don't run ads

Do you have any proof that the ad was served by Google or are you just guessing? I was under the impression they had checks to prevent this.

Tons of malvertising comes through Google. When one company owns the whole space, finding just one vulnerability is enormously economically attractive.

>Tons of malvertising comes through Google.

Can you cite that as your previous accusation was already proven to be incorrect.

>When one company owns the whole space, finding just one vulnerability is enormously economically attractive.

Google doesn't own the whole space.

Google ads container keyloggers? I doubt that.

> Google ads container keyloggers? I doubt that.

Just to be clear, I think they are talking about advertisements placed via Google's platform, not ad campaigns by Google.

I think there is only one way to solve this: programmatic ads cannot contain executable code (no access to local storage or network) and ads must come from the same origin as the page they are on. For example, YouTube will host an ad for Subaru on YouTube's servers. The sticking point as people have pointed to me before on HN is fraud. The customer (in this case Subaru) does not trust Google to be honest in counting the number of impressions.

Perhaps what we need is legislation banning this behavior across the board. When no ad vendor is able to allow customers to do what they please on user's web browsers, the customer has no recourse other than to accept that this is not possible. I don't know how such a legislation would work though. Perhaps it needs to be an industry alliance instead of legislation?

Again, I still doubt that Google places ads with key loggers via their platform. Maybe I misunderstand something about how they operate though, and I can't recreate anything close to what the original article shows. In fact, I can't even load cnn.com right now.

It is possible, and thus against their policy, and thus invites the worst of the web to circumvent their detection systems. https://support.google.com/adwordspolicy/answer/6020954?hl=e...