Hacker News Reader

Comment by jefftk | Hacker News Reader

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone, but these are not accessible by default. In this case, it isn't even getting as far as a permissions prompt because the default Feature Policy doesn't allow camera or mic access in cross-origin iframes. (Ex, for Chrome: https://sites.google.com/a/chromium.org/dev/Home/chromium-se...) Instead, I think the most likely thing happening here is that an advertiser is running a script that is trying to do fingerprinting, and which is blocked by the browser protection.

(That it's an iframe running on https://[random].safeframe.googlesyndication.com tells us it's an ad served through Google Ad Manager, and the contents of the iframe are supplied by the advertiser.)

Disclosure: I work for Google, speaking only for myself

View on HN

Curiously no explanation why this sort of malicious behavior is accepted by "Google Ad Manager" in the first place.

If you haven't already installed: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

I'm not sure it is allowed; that's not a part of the business I know much about. Since ads can run arbitrary JS it's hard to enforce policy programmatically.

On the other hand, it's not clear to me that whatever this advertiser is trying to do is having any real effect, aside from causing a console message that it is being blocked. Access to the mic and camera from cross-origin iframes is blocked by default, and you can't even trigger a permissions prompt.

As for installing an ad blocker, even with all the messiness of advertising, I still prefer it to paywalls.

> Since ads can run arbitrary JS it's hard to enforce policy programmatically.

Letting ads run arbitrary JS is the policy, right? It's not like that's a requirement to make the internet work, that's just a Google policy that trades money for user experience.

Ads are allowed to run arbitrary JS, but that doesn't mean they are allowed to do arbitrary things by policy. That is, the technical restrictions are not able to be as strict as the policy.

A bunch of us were working on a project where ads would be fully declarative, and so no longer able to run arbitrary JavaScript, but this received very little interest outside of Google (advertisers didn't want to move to a new format, publishers didn't care) and we moved on.

(Still speaking only for myself)

Why is it up to the advertisers and publishers?

I suppose they're the paying customers.

how do you think google, an adtech company, makes money?

If they tried to unilaterally make such a change and ban the old formats, both the advertisers and publishers would complain to competition regulators around the world. And whether you think there would be any merit to those complaints or not, the outcome would still be another round of lawsuits with billions on the line.

> with billions on the line

Not my money. Why should I care about lawsuits between advertising networks and their advertisers, regulators and so on?

> Why should I care

You don't need to. But the person is asking why Google is or is not doing a particular thing. So it is their interests that are relevant to the current discussion, not yours.

I do wish google engineers would do something positive for society and switch to a career in subsistence farming. No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads.

But what do you see as the alternative for funding sites? The site we're on is funded by (declarative, non-personalized, non-obtrusive) ads. I would rather have ads than paywalls.

"Made for Adsense" sites have no value, if they get shut down, nothing is lost. Normal sites that switched to Adsense have become worse, because now they need clicks and engagement above all else, incentivizing click-bait and low-effort content. Nothing would be lost if they switched to subscription models and provided valuable content. There's little in between in my opinion, it's either "site doesn't use Adsense, it's a company site / personal blog / some institution", "site was made only to make money by adsense with the lowest price content possible, had a bunch of links bought and now provides a passive income to some SEO" and "site used to provide quality content, loses readership to spam-sites because Google has fucked up their sorting algos and now switches to low-value content as well, because anything else can't be financed".

Twitch shows that people are very willing to pay for content. I'd very much be happy to if that removed all of the spam.

If a website cannot survive without ads, maybe it doesn't need to actually exist in the first place. The world will go on.

I do think the world would go on, but it's a world I would like less. Some things would move behind paywalls, others would move to the boundary of whatever was considered advertising (sponsored content? Product placement?)

I think of it as a bit of social selection for websites. If a website has content people value, they find ways to support the website. If not, well, maybe the site not existing is not a terrible loss.

The world can move on without having the site shutdown, then. Don't visit those sites and pretend they don't exist.

Once upon a time, children, people made websites with no ads, and no paywalls. Sure, there weren't as many websites; and sure, they didn't have as many sliding panels and other gimmicks.

And for sure, I appreciate being able to buy stuff online. But I seem to be able to do that without viewing ads! Amazing!

> I would rather have ads than paywalls.

No offense but I've heard people who work at ad companies repeat this like a mantra, and it's a false dichotomy, akin to a coal company who dumps slag in rivers saying, "Well we think it's better than letting everyone freeze to death." We're not asking Google to stop advertising altogether and close up shop, just to make the internet ad ecosystem a little less awful and Orwellian.

> We're not asking Google to stop advertising altogether

I think my parent was: "No one needs ads. Not arbitrary JS ads, not declarative ads, not personalised ads, not any ads."

Fair enough, though the suggestion that Google engineers take up farming was probably not very serious. However, the idea that we have a choice between no ads or the most pernicious ads imaginable is certainly a false one.

> the idea that we have a choice between no ads or the most pernicious ads imaginable is certainly a false one

I agree with you. I spent a large part of 2018-2019 trying to make ads declarative, and am now working on (among other things) increasing the isolation of conventional ads [1] and implementing cross-site advertising without cross-site identity leakage [2].

But it sounds like you and my parent have very different views: there's a lot of space between "ads should be a lot better" and "ads should not exist".

[1] https://github.com/WICG/webpackage/issues/624

[2] https://github.com/WICG/turtledove/blob/main/FLEDGE.md

> Letting ads run arbitrary JS is the policy, right?

I mean, anything on the Web can run arbitrary JS. The entire point is that it's a sandbox environment where arbitrary JS can't do any harm (excluding cases where vulnerabilities are found).

If you're not comfortable with arbitrary JS running on your computer, you'd have to either (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy. None of those are particularly practicable.

Most of us operate on the generally-reasonable assumption that the sandbox is effective, and therefore that we're OK to [click on that random link from HN like you did just now / open that news site which pulls in a bunch of tracking scripts / etc].

Either way, this is not somehow a problem that's specific to Google Ad Manager in any way at all. I don't know what else you could really expect of them.

> (a) not use the Web, (b) disable JavaScript, or (c) only visit sites which you have vetted and deem to be trustworthy.

> I don't know what else you could really expect of them.

Your option C is basically how it must work, and mostly does. To be safe online we go to sites we trust. When Google delivers malicious JS through ads, the site operator probably doesn't know Google has harmed the user on their behalf, so their trustworthiness becomes moot. Is there some "safe ads" codeless option for site operators who want to protect their users while still showing ads? Has Google made site operators aware they occasionally deliver malicious JS to users?

> To be safe online we go to sites we trust.

I'm fairly confident in saying that nobody, but nobody, only goes to sites they trust. Come on. You're on HN: do you mean to tell me that you never click to open a link from a post unless you've pre-vetted the website and know it to be trustworthy? That's simply not a practicable model.

And every site pulls in JavaScript which, to you, is arbitrary. You don't know that they won't add a new third-party script, and you don't know that any given third-party script won't change. You don't know that transitively for the scripts loaded by the scripts. Etc etc etc. Nobody can practise the approach you are setting out here, not both diligently and honestly.

Your complaint here is just about how the internet works. It's absurd to expect Google to vet the JavaScript that all of its users host, as much as it's absurd to expect Squarespace or Weebly or even AWS or Cloudflare to do the same. The model of the internet does not and cannot rely on any and all JavaScript being vetted for 'malice' by a trusted party before being loaded. It relies on the JavaScript runtime being a safely isolated sandbox where malice or the lack thereof doesn't matter either way.

I didn't say people always have a good reason for trusting the sites they go to. I trust that HN links are safe because I think that someone would make a stink, at least, if there were malware on a page linked here. It's not perfect but it is how things work. A nasty part of contemporary business and business in general is: as long as trust isn't visibly betrayed, people go on trusting. That doesn't excuse any of the actors who benefit from the ignorance.

How about the company you work for disallow arbitrary JS in the ads they serve? We already know the answer though. Bottom line over doing what is right.

As I wrote above, this was something we tried: https://news.ycombinator.com/item?id=29615583

This was the main thing I worked on in 2018-2019, along with many other engineers. I wrote about it some in https://www.jefftk.com/p/value-of-working-in-ads If this is something that users were demanding I could see picking it up again, but as far as we could tell us a time there was minimal interest externally.

> Since ads can run arbitrary JS

What a fantastic idea to create a platform where anyone can pay to have code ran on millions of end-user machines, embedded in random websites. What could possibly go wrong?

Haha, easy way to create plausible deniability if you just allow everything to run :D. Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself?

In addition, why is it hard to enforce a policy that disallows any ad to reach out to the camera and microphone? I don't understand why that is hard to enforce.

Because ads can use Javascript which is notorious for how hard it is to vet code and how easy it is to hide functionality.

But why do they need that? What purpose does an ad with javascript serve?

Animations, tracking and fraud detection are the big areas. Ads were historically one of the strongest drivers of Flash, given how easy it made for creatives to implement animations without needing a frontend developer - ad buyers these days would instantly protest against any attempt to remove either of the three use cases.

And given that we are talking about sometimes eight figures worth of ad buying... no network will want to risk offending such clients.

I still don't understand it. I was under the impression that animations are also able to be served through HTML5? Both CSS and HTML should be sufficient. ~We're in the age where we're able to serve an entire sqlite database over a static website, yet an animation does require javascript?~

EDIT: I am wrong to think that serving and interacting with a sqlite database goes without javascript.

> We're in the age where we're able to serve an entire sqlite database over a static website

Making use of the SQLite database is entirely client side and requires JavaScript or WASM (the distinction is unimportant) - it requires running code on the frontend. This is not a great way to state your case.

You're right and I misinterpreted the sqlite implementation. I will edit my comment to reflect my error.

Animations can be CSS, yes. That's what you do in https://amp.dev/documentation/guides-and-tutorials/learn/a4a... (declarative ad format, no advertiser-written JS)

Then I don't understand the necessity for javascript in ads?

In this particular case, advertisers were not interested in moving to a declarative format, and publishers were not interested in requiring declarative ads. So it didn't end up going anywhere as a general purpose ad format.

> Doesn't that also make it easy for anyone running an ad to run hivemind in the ad itself?

Are you talking about crypto mining? That's a good example of something which is against policy but difficult to fully prevent technically. The core problem from someone trying to exploit this, however, is that crypto mining in the browser is minimally profitable, so you need to do a huge amount before seeing noticeable returns. The more you try to do the more likely you are to get caught, so while it does take some scrutiny from publishers and ad networks, it doesn't take very much.

(still speaking only for myself; this isn't something I know very much about)

Yes, I am talking indeed about crypto mining. I am also talking mostly about the aspect of wasting compute cycles and thus harming the environment through Google's means. Yes, it is minimally profitable, but that it is possible is weird if you ask me.

Sorry, what I meant was that it is minimally profitable at the best of times. Which means it doesn't take very much enforcement to shift it over to being negatively profitable, because it costs you more in time, engineering, etc. than you would make. And once it is a money losing proposition, the people trying to exploit users are no longer interested.

> Since ads can run arbitrary JS it's hard to enforce policy programmatically.

It's not that hard, at least not at my end. I just don't run ads.

Why on earth does goo think that running arbitrary JS on their visitors' computers is OK? I mean, I know this is the policy, and I assume the policy of other ad networks is at least as "liberal". So I'm sorry, chaps, but no ads run on this screen.

I wonder if this is a race to the bottom? I've noticed that TV ads these days are all for animal charities, equity release schemes, and incontinence pads. I don't know what they're running in web ads, but I'm pretty sure that the TV ads are so dire because everyone but old fogeys and poor people skip the ads. I'd assume the same old/poor people are the ones that have to see web ads.

Advertising to poor people has traditionally been a pretty bad pitch. So why isn't the online/TV ad industry crumbling? And how do I bet against their shares?

>Advertising to poor people has traditionally been a pretty bad pitch

Is that true? It seems like poor people spend, in aggregate, more than rich people and they tend to buy the cheaper, more mass-produced stuff. The grocery business alone must be build on the commerce of poor people, right?

> The grocery business alone must be build on the commerce of poor people, right?

How often do you see grocers advertising own-brand baked beans? If you see baked beans advertised at all, they're drawing attention to the fact that their Heinz beans are 1p cheaper than $COMPETITOR's Heinz beans.

I'm not convinced that advertisers spend much money on pitching to poor people. Most of the ad pitches that I see are for high-end products like cars, holidays, and household appliances. There's not much point in advertising to people whose weekly budget doesn't stretch to luxuries. They will buy only what they need; they don't have choices.

If placement is considered a kind of advertising spend (and I think it is) then impulse buys are going to be an ad spend in general. Gambling, porn, junk food, that kind of thing.

> Since ads can run arbitrary JS

That's the problem!

The author is concerned that an ad might be able to surreptitiously turn on the camera or microphone

You are correct, that is the author's concern.

The reason the rest of us are concerned is because the general public has been conditioned by Google and others to just press "Accept" any prompt that pops up, no matter how dangerous.

This is a catch-22 though.

If something dangerous to privacy is being widely used in the world, then putting it behind a prompt creates an avalanche of prompts, and results in user apathy.

But not prompting requires you to choose a default, which either default to block and breaks things (if it was actually required) or defaults to allow.

I would happily set all browsers to always deny all ads and untrusted domains the ability to use microphone and camera at all times. So there's no need for an avalanche of alerts, it just shouldn't be permissible for a resource from an untrusted source.

It may be widely used, but for a highly concentrated set of sites. I can't think of an occasion I've used it beyond Google, Microsoft, and Zoom properties. Perhaps Slack and Discord too? So there must be a better way.

> deny… untrusted domains the ability to use microphone and camera at all times

I believe this is the default for most browsers now, right? (Or have I been spoiled by Firefox?) This is the best way, where the camera is always inaccessible, unless you enable it for a domain which needs it. Since I rarely ever see the camera/mic request option, I don’t think we’ve been conditioned to allow this type of request. (Compared to cookies, which show up on nearly every site.)

If you want to disable permissions dialogues altogether, then what’s a trusted domain? Just zoom and a handful of others? If you write yourself a nice app which uses the mic, do you have to email Google to get yourself added to the list of trusted domains? That would be pretty bad for the open web, so permissions dialogues are the alternative

The solution to this is simple, but not easy: block everything by default and do not prompt to enable it (but do show an indicator of what has been blocked).

This is how Firefox tracker protection, uMatrix, noscript, and a plethora of ad blockers and other privacy tools work.

What? In what way have you been conditioned to accept prompts?

I think there is most definitely conditioning going on. I watched my fiance click on one of the "accept all cookies" GDPR-prompts (it's become an antipattern) a few days ago. She almost automatically did it without thinking. I went to the same site on my laptop and if you clicked decline, it immediately brought up modal dialogs that made that site unusable. I can see why 99% of people would be conditioning to just hit yes.

And you blame Google for that, instead of some brain-dead Eurocrat?

Who said anything about blaming google for users clicking “ok” without thinking about it?

The person to whom I replied!

To be fair, he said Google and others. I still don't know how much Google is responsible though.

Google goes way further and doesn't even serve a prompt. Instead they show you a opt-out plugin that you can download to run in your browser. Most blatant disregard of rules and feeling better than the rest behaviour if you ask me.

Link?

https://tools.google.com/dlpage/gaoptout

The site owner interacts with the user to get consent or not (often via a CMP) and then decides whether and how to invoke third-party scripts, including Google Analytics. The alternative would be for each third party script on the page to attempt to inject their own set of consent dialogues, but those would conflict with each other.

The extension you're linking allows someone to opt out of Google Analytics across all sites. That pretty much has to be a browser extension, because GA by default doesn't use any third-party cookies (and third party cookies are going away anyway).

(Disclosure: I work at Google, speaking only for myself)

Thank you for replying. Though, I do not understand why a plugin is required? It feels even more invasive to have such a thing running in the browser.

My understanding is that I have an advertisement ID attached to my user, and that enables Google to infer who I am and what my persona is about, to match me with personalized ads.

Wherever possible I disallow Google and all others to stop tracking me, having done so in my account. I find it odd I also need to disallow the tracking from Google, through a third party site (e.g. anyone's blog) even though I have already done so through every direct means possible. What do the consent settings in Google even mean then if I need to allow/disallow consent of tracking per seperate website in addition?

Your understanding is correct for Google Ads, but in its default (and most common) configuration, Google Analytics does not interact with that third party cookie ID. GA is primarily a tool for helping publishers understand what's happening on their sites, and so uses a first-party (per-site) cookie.

Which Eurocrat required stupid popups? And since when did US corporations kow-tow to EU bureaucrats? This is stupid corporations, hiding behind GDPR to plant cookies.

In this case there isn't a prompt: access to the camera and microphone is disallowed by default in cross-origin iframes. The site would have to specifically delegate permission to the ad before it could even trigger a prompt.

> just press "Accept" any prompt that pops up

I auto-press [Accept]. I use an ad-blocker. I reject 3rd-party cookies. I disable JS by default, and re-enable it selectively for sites that refuse to work without JS. If that re-enablement involves more than a few clicks, I'll close the site - there are other fish in the sea.

What am I doing wrong?

Is it a good idea for Google to allow random advertisers to use privacy sensitive code (like audio access or fingerprinting) in advertiser supplied iframe content?

People may be visiting a trusted site and then are asked to allow audio and video, not realising that it is an iframe asking for the permission.

Reply on news.ycombinator.com