Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Individual websites may be able to protect yourselves by:

- Using HTTPS directly, in particular with HSTS set (optimal).

- Use a third party like CloudFlare to add HTTPS via their proxy.

- Alternatively: HTTP with Content Security Policy set (since it will reject their scripts and CSS running as it isn't in the whitelist). This is only a short term solution since they can alter the CSP header, but it will work if you're stuck on HTTP for now. We bounce a lot of advertisers and malware off of our site this way.

Ultimately this is yet another "Use HTTPS!" broken record. But the CSP solution works until they get wise to it.

View on HN

Unfortunately the first two options aren't really viable if you're an ad supported website. HTTPS will kill your ad revenue since most ad scripts don't work properly over HTTPS.

That's a problem for site operators not users if more people force sites to switch to HTTP's more AdNetworks will start serving content via HTTPS.

The good thing is that at least most browsers these days are good at blocking mixed content so you won't have HTTP adds growing tumors due to injections anyhow.

What i don't understand is why AT&T has to do injection in the 1st place they can easily setup their own AdNetwork and partner with the large AdNetworks to route through AT&T's own internal servers.

Without injection, their own ad network is irrelevant. Nobody (more or less) is getting on Free AT&T Wi-Fi to visit AT&T's websites. Without injection, any ad revenue goes to the actual site operators.

Well that was a given in my statement... hence partner with the large AdNetworks, use the already existing scripts which are integrated much better into the existing sites, AT&T can simply server all requests to www.big.ad.network/ads.js from it's own servers in it's own internal network serving ads from their internal campaigns sharing revenue.... Heck considering that the ads AT&T can serve can be much more relevant to a specific location such as a mall, a large venue, or an airport heck even stores within say half a mile of the hotspot they might actually be "useful".

Adnetworks are saving bandwidth, AT&T doesn't have to fight with HTML injection which can break on many sites, AdNetworks get better targeted advertisement win for everyone...

Ads are fine over https. Choose your ad networks wisely.

Altering the CSP header would be more likely to get them in trouble, I think. So that's good too. :-)

Reply on news.ycombinator.com