Why don't sites just serve up the ads from their own domain?
The dozens of domains and tons of javascript are all there as part of an effort to establish that the ad has been served to a human who might concievably be a customer for the product, and not a robot or some sort of third world ad-viewing farm.
Couldn't Samsung, now releasing their new phone, buy a website's entire ad space for a month or two, let's say techcrunch, and tell them to serve their new phone's ad themselves? Samsung is in for the eyeballs just like when they buy those huge outdoor ads, but even better, no intermediaries.
The publisher would even optimize the HTML5 ads for loading and rendering speed, and have a selection of them so they could rotate them. I believe it could work well for physical items.
If Samsung's marketing people are in Korea, I'll show all Asian IP addresses their ad, and then show some other ad (or ads) to the rest of the world.
Of course, Samsung may notice the low volume, so a better scheme is to also load their ad elsewhere, but placed on the page so it's not visible.
If you look at the Javascript that gets served with the ads, there is generally a hunk of logic that tries to confirm the ad is genuinely visible, to try to deal with that last bit.
That whole "sponsored tiles" thing was actually incredibly thoughtfully designed:
* Third parties provide tiles to Mozilla, who gets to vet them, etc.
* Tiles get put into bundles hosted by Mozilla and carrying metadata which can be used to target.
* The browser periodically downloads bundles of tiles and client-side, the browser decides based on browsing history and bundle metadata which tiles to display.
Nowhere in this process did advertisers or even Mozilla get to know the browsing history of the end user. Nowhere in this process did advertisers or Mozilla get to know which sites in the browser history caused the decision to display a particular tile. All storage of history and decision-making on what to show was done client-side-only.
The more I think about it, the more I think something like that needs to be discussed as a real alternative to how things are done now.
This points to a deeper problem, one not trivially solved via technology, of credibility. There've been several instances of technical solutions to problems for which I had a great deal of initial skepticism, some warranted, some less so.
I was aware of both wireless networking and VOIP in the late 1990s, though neither broke through to mainstream for some years. Trust in the integrity of the underlying protocols being a chief concern (not entirely unwarranted).
Challenge-response email anti-spam systems have a similar problem -- your CR system may be entirely legit, but other peoples' might well be spam-harvesting engines or otherwise bogus.
Sponsored tiles requires a great deal of buy-in before it can gain mainstream acceptance.
If there's a good description of the whole thing, might make for a good HN submission.
It's irrelevant if the ads were selected in the browser or not. You'd still have to download a lot of advertising that was irrelevant. And advertisers wouldn't have been happy with just client side choosing, it would have evolved into Firefox tracking you.
It was a very bad idea, and remains a very bad idea. I sure hope Mozilla never tries it again.
Next would probably be that the advertisers, fearing fraud, want the publishers to use a third-party ad server with reporting that they trust.
Only after that comes concerns about behavioral targeting and tracking, and the absence of that affecting ad revenue.
Finally, if they thought about it, they'd realize that ad blockers would just switch strategies and carry on blocking, so it hardly seems worth the effort.
Tracking makes advertisements much, much more expensive and thus profitable.
I don't even mind the ads so much as the delay.
If ads came from the sites own domains, this wouldn't work.
That should be enough information for cooperating servers to target an ad.
Say you have two users on Macbook Airs using auto-updating Chrome (which has bundled Flash) in the same office or university, and both came in through Google.
Is this an unlikely scenario? Not really.
Yes, they can try to "fingerprint" your browser into a unique hash but that method is more reliable for desktops than mobile phones.
Imagine a dozens of customers with identical iPhones sharing the wifi at Starbucks or the airport. (Everybody has the same ip address.) Sniffing for unique markers such as counting installed fonts and/or plugins isn't going to work on smartphones like it does on deskttops. Therefore, generating a cookie with an id is more reliable. Of course, people can negate that by configuring their phones to block cookies but it appears that most consumers don't do it (probably because it breaks other things such as banking, sports, etc websites.)
Since advertising revenue from mobiles is growing faster than desktops, and in some cases exceeds it (Twitter mobile ads), it doesn't look like ad networks will favor fingerprinting over cookies. (That's not to say some sophisticated ad networks don't blend both techniques.)
spins up new server
setups ad service
spend couple days fidgeting with open source ad software
ads deploy to subdomain ads.domain.com
people start blocking ads.domain.com, assuming ads.<>.com wasn't already in your blocklist
redeploys ads into domain.com/DEFINITELY_NOT_ADS
people start blocking that URL
its basically a cat and mouse game. most people don't have time for that.
if you have a small client base though you can probably get away with selling a promo on a per month basis.
That part can be entirely generated on the fly. Even more so you could put important content in random generation parts to foil the people using blockers on occasion.
From the user privacy side it's also mixed as there are still large scale efforts to link up users across sites and devices.
I'm fully aware though that I'm not the mean audience for adblocking.
Dedicated ad-blockers, such as uBlock Origin, apply heuristics which are specifically tuned to advertising signals -- hosts, domains, and, as noted in parent to your post, various HTML and other entity clues to advertising content.