News for hackers. Stuff that matters.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by saidajigumi on Thursday January 24, 2019 @12:31PM (#18990787)
This is precisely why an ad-blocker is a non-negotiable part of defense in depth. I'm sympathetic to web publishers who legit need the ad revenue to operate, but they're caught in the middle: asking me to drop this critical layer of protection is a non-starter.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by MRD85 on Thursday January 24, 2019 @01:20PM (#18991329)
I had my experience with this in 2006 or 2007. I was younger then and I was served a malicious ad on a video game website. This ad was only showing for 1 in every 1000 or so users, which made it quite difficult to detect back then. Ever since then I've run an adblocker and/or scriptblocker.

I'm constantly asked by websites to drop my ad blocker but why would I do that? If they want to serve ads than maybe there is a way they can do it themselves, as opposed to a third party serving them.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by jnbiche on Thursday January 24, 2019 @03:53PM (#18992828)
> If they want to serve ads than maybe there is a way they can do it themselves, as opposed to a third party serving them

Indeed there is a way. And if they do it the old-fashioned way, using static ad assets, then the ads aren't typically blocked by ad blockers, anyway (at least not automatically).

Furthermore, these kinds of embedded, static ads lead to more honest, authentic relationships between content providers, advertisers, and viewers.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by fatboy on Thursday January 24, 2019 @05:28PM (#18993694)
From what I’ve been told by the web team at the company I work at, images get blocked by ad blockers if they match the industry-standard advert sizes for banners etc. We serve our own ads that we sell directly to businesses related to our content, but it’s often done through the customer’s PR agency, who sort out the ads for various different outlets, and are not interested in making different sizes that wouldn’t be blocked just for us.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by romwell on Thursday January 24, 2019 @06:02PM (#18993948)
>PR agency are not interested in making sizes that wouldn’t be blocked

Sounds like the PR agency is interested in making ads which nobody would see. Great job, PR agency.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by Jernik on Thursday January 24, 2019 @05:05PM (#18993508)
unfortunately for content producers, this kind of advertising is typically more work and less profit
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by iaabtpbtpnn on Thursday January 24, 2019 @01:47PM (#18991628)
Of course there is a way they can do that, because that's how it always used to work. It's just not as cheap or easy.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by feketegy on Friday January 25, 2019 @05:57AM (#18997036)
For me ad blocking is non-negotiable.

In my opinion if a website can't make a profit without ads, then it shouldn't exist. There are a tons of other ways to make money from a website without showing a single ad on the page.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by saidajigumi on Friday January 25, 2019 @12:20PM (#19000086)
I disagree. Case in point: there are websites that sell ad space the "old fashioned way" meaning they're directly paid by the advertiser, they get a predetermined format and placement, text-only with a link. Absolutely no JS, no tracking. If the advertiser wants to track visitors, they create a single unique landing page for their link.

This is 100% acceptable to me for the following reasons: first, these site owners fully control the ad presentation on the site, and there's zero possibility of unvetted JS going through because the advertiser delivers plain text to a knowledgable human publisher who is the one who will run the placement. Likewise, the advertiser gains no knowledge of visitors who didn't elect to click the ad link and visit their site.

This gets to my comments above: the quest for a fully-scalable inventory of both eyeballs and advertisers is a hugely corrupting influence on so many levels. Small companies wanting to build relationships to help each other, without exploiting visitors in the process, is OK in my view.