Hacker News Reader

Comment by shadowgovt | Hacker News Reader

I just searched for Blender and I cannot reproduce this.

... but what I suspect happened is they got reports, took a few days to down the ad, the ad goes up under another URL, they get reports, take a few days to down the ad, etc. The malware vendors are tenacious and have a pretty much bottomless well of Turking for CAPTCHAs and backup accounts.

ETA: none of this to imply that Google shouldn't fix the problem or that they don't need to divert more resources to it (if for no other reason than it does actually threaten their bottom line if they can't get on top of it and people conclude it's not worth it to keep recommending Google search to naive users). But the problem's generally harder to fix than most people believe.

View on HN

Okay, so malware actors create new accounts and try new ways. That’s no surprise. That doesn’t adequately explain or forgive the behavior by Google here. They’re one of the largest, most profitable enterprises in history, it’s no longer an excuse.

The behavior by Google here is "Doing everything they can figure out how to do to get the malvertisers off their network without breaking the network itself." It appears that, in the short run, the malvertisers are winning the arms race.

... but if you have any ideas they haven't tried, I suspect they'd love to hear about it in a job interview for any of the openings for ad quality SWE.

This is not some impossibly intractable algorithmic problem to solve. Simply actioning malware reports on the ad would be sufficient. If an ad receives hundreds of reports over the course of months, there's problem something wrong with it and should trigger a human review, at which point the malicious intent of the ad is obvious. Why include a report button on ads at all if its effectively a placebo button?

What is your evidence that the malware reports aren't being actioned?

The malware continuing to appear isn't sufficient evidence. Malware moves hosts and ad accounts all the time.

ETA: from the article itself, in 2021 Google "Removed over 3.4 billion ads, restricted over 5.7 billion ads and suspended over 5.6 million advertiser accounts." That's a ton of action, but AdWords alone also serves 29 billion ad impressions a day. It doesn't take more than a few bad actors slipping through the cracks to get seen (and at these orders of magnitude, "a few" is still "millions." Completely impractical for human hand-review).

And yet despite these numbers, somehow the most prominent open source software is relentlessly impersonated and Google is the facilitator, FTA: https://twitter.com/wdormann/status/1616497407390355456

It's clear this will never be prioritized without regulation as scammers money is as good as anyone else's and open source projects cannot afford to sue Google to force action.

Perhaps the network needs to be broken, then.

Someone else already said this it's not that hard they could simply do a manual review of ads, but that's obviously going to eat into their profits so they will not do it.

I think this really requires governments to step in. I mean one could easily argue that Google is facilitating fraud here, so maybe they should be liable?

The notion that is not hard to review millions of advertisers does not align with reality.

You could make the same argument about disposing of toxic waste (it's definitely cheaper and easier to just dump it in the river than to deal with the "reality" of processing millions of litres of sludge).

I actually think the problems of dealing with toxic waste are far more tractable than the problems of vetting every ad in a network serving 30 billion impressions a day.

Toxic waste doesn't try and hide from the litmus paper or the geiger counter.

Yet there is still a cost to dealing with toxic waste, which encourages companies to not make any more of it than necessary. There's currently no cost (it's all profit, in fact) to promoting malicious ads in search results, so why wouldn't Google do it?

There is no reason they have to serve 30 billion impressions a day. If vetting takes that down to 1 billion, that's fine. Lower the volumes (and raise the prices to fund manual vetting) until the problem is resolved.

Toxic waste disposal is a solved problem thanks to (enforced!) regulations that force companies to do so under threat of heavy penalties, not altruism or the fact that the waste doesn't hide from a Geiger counter. We need the same for online advertising.

The cost is possibly losing trust in Google search. It's a pretty big cost, and one of the reasons Google invests so heavily in stopping bad ads.

There's no downside to losing trust as long as you have a monopoly and none of the alternatives are any better (and they are not - Bing, Yahoo, etc - all ad-funded search engines will have the exact same problem).

But even if we accept that there is a downside, it's clearly not enough because this problem keeps happening again and again. Whatever downside there is needs to be increased by a few orders of magnitude for them to take the problem seriously.

What monopoly do they have? DDG is right there, and better if their competition has a reputation for vending malware links.

Why would I care if this easy for Google? I'm saying that we need to provide a government led "incentive". If Google becomes financially (criminally?) liable for the damage they cause with fraudulent ads, they would quickly implement a way to solve the problem. If I you mean it's difficult to regulate for the government, why? They don't need to find the fraudulent ads, someone who has been affected just needs to provide evidence and get a ruling against Google for "hosting" it.

The problem with gov't regulation is that the pages have a good chance of not being within the jurisdiction of what ever gov't is trying to do the regulating. So unless someone like Uncle Sam is going to say that ISPs must not peer with known places, there's no way that blocking access to these out-of-jurisdiction pages can be stopped.

I agree.

There is one thing Google could do that would eliminate the vast majority of this sort of thing. They could require a manual review of all ads and advertisers before putting each ad into the pool. Like traditional media does.

But that doesn't scale, so it's not going to happen. But avoiding something because it doesn't scale is a deliberate choice, and I think it's fair to consider Google to be at fault for allowing this state of affairs to continue as it is.

That doesn't work because it's not the ads themselves that serve the malware, but the page the ads point to. Changing that after the review is done is trivial, and asking landing pages to never change is simply unreasonable for a vast number of reasons.

That's why I included "vet the advertisers". It's not just the ads that need to be examined, but the people putting the ads up.

What major city would you recommend Google employ at 100% to vet enough advertisers to support nearly 30 billion daily ad impressions?

Or, alternatively, should there be a few tens of thousands of firms allowed to advertise on the Internet and the rest of us can just pound sand?

(... actually, now that I think that "out loud," a distributed trust model would be an interesting idea. Google, instead of vetting ads, could vet trusted ad resellers, and knock entire resellers off the network that failed to do due diligence. The resellers would be responsible for policing their various houses and if you didn't like the terms one provided you could go to another. This is, perhaps, one of those situations where more middlemen would be desirable).

I already mentioned that it doesn't scale.

The real issue, IMO, is that Google's business model is just fundamentally bad. But Google is large enough that it doesn't matter. They're like a large industrial polluter poisoning the lands and arguing that there's nothing they can effectively do about it because addressing the problem would be bad for their business.

Well, their business and the business of everyone that advertises online. So it comes back to "Should we all pound sand because of a (statistically) few bad actors?"

Firefox advertises at the top of "download browser." Should we cede their ability to be found to whoever Google thinks should be at the top of that organic result? Because by user numbers alone, it probably won't be Firefox!

I think a strong case can be made that if a business cannot operate without causing harm to unconsenting others, it should not be operating.

> because of a (statistically) few bad actors?

It doesn't actually matter how many or few bad actors there are. What matters is how much harm is being done.

I'm not sure what your point is about Firefox, but in general, it doesn't matter if mitigating the harm Google's ad system does adversely affects Firefox or any other advertiser.

Who are the unconsenting others? The people who chose to trust a Google ad?

I'm not sure what consent means if it doesn't mean "user clicked on a result after asking Google for results." The backstop here is the user doesn't come back because they got screwed by Google, not that some third-party makes that decision for people.

But yes, I suspect if Google can't get on top of this problem they'll lose their leadership position in search.

> I'm not sure what consent means if it doesn't mean "user clicked on a result after asking Google for results."

First, I'm talking about ads, not search results. Although Google conflates the two as much as they can get away with, and people often get confused as to which is which.

I can't imagine how clicking on an ad can be interpreted as consent to being exposed to malware. In order to be considered "consent", the person has to be fully and accurately informed of what they're being asked to consent to.

> The backstop here is the user doesn't come back because they got screwed by Google

I truly wish we lived in a world where that could be expected.

I don't see why we wouldn't expect it. Wouldn't be worth talking about if it wasn't a possibility.

Google dethroned search vendors before them and they aren't bulletproof. If they are, might as well pack up DDG and everything else right now. Shut off the servers and decrease the greenhouse gas emissions, right?

No, I think the backstop here is that DDG has a wonderful opportunity to be the search engine where you don't have to worry about getting vended malware via an ad above the first organic result.

We’ve all paid to drink from this punch bowl, should we ask for a refund just because a few bad actors pissed in it?

It can scale just fine... Green certs for SSL have been able to scale just fine... why, you pay for it. Advertisers should have to pay for verification.. it doesn't have to be an excessive fee, and can be connected to a bank account in good standing. Holding an amount in escrow during the first year could help as well.

Why shouldn't advertisers have to clear the same hurdle as opening a bank account in most western countries?

Why should we care that it's not profitable for Google to do so? I would argue they are facilitating illegal activities, so why shouldn't they financially (and maybe criminally) liable? If that destroys their business model, why should we care?

Adtech veteran here. That's not how the industry works.

All ads on major DSPs already require approval before they can run. Advertiser accounts too, especially at scale. While there are plenty of technical openings for fraud and malware, the vast majority is from known actors that can be resolved through business practices.

A trillion-dollar megacorporation with hundreds of thousands of employees has more than enough resources to handle this. The reason it doesn't is because of the flow of money and incentives across the vast supply chain from advertisers and agencies to vendors and publishers.

Adtech veteran here (from the other side). The trillion dollar corporation has vast teams and assets invested in this project. No temporary monetary incentive is worth the risk of being seen as a likelier vendor of malware than quality searches.

But the opposing operators get more and more sophisticated, countermeasures that work to half decade ago get circumvented, and the arms race continues.

Lacking a technical fix, isn't this fundamentally a KYC problem? There's an arms race of fraud against banks and financial companies, but it seems like they're managing okay.

Yes. Holding online advertising to KYC standards would lock most advertisers out of the ecosystem. But most aren't bad actors.

Why would it lock out most advertisers?

Because Google (like other online advertisers and most online services) doesn't have any tighter KYC restrictions than accepting a valid credit card (which, we assume, has already been KYC'd by a bank).

Requiring bank-scale KYC on top of that to also work with the advertisers would cut the 4 million advertisers Google currently serves down to a tiny fraction of that (if for no other reason than they don't have infrastructure to background-vet 4 million customers; they don't currently).

Perhaps this is the right approach. It would end the days of being able to set up an advertising account in a few hours. Perhaps that's not needed anymore.

(This would, of course, mean people giving even more PII to Google. However one feels about that).

> "doesn't have any tighter KYC restrictions"

Yes that's the problem.

> "Requiring bank-scale KYC..."

Nobody said that. The KYC part is an analogy to the financial industry to use procedures to screen out bad actors. But it doesn't need the same requirements.

> " they don't have infrastructure to background-vet 4 million customers"

KYC is not difficult. Again, banks and finance companies which are far smaller than Google do this all the time, for all of their customers and anyone involved in transactions. This is 100s of millions of clients.

> "Perhaps this is the right approach."

This approach is far more nuanced than the binary outcome you're interpreting. There are ad and account approvals already. There are different scales requiring different support and sales already. Having more intensive checks as the spending scales is a very simple and effective strategy that can be applied today.

The company doesn't care about the number of customers, it cares about the revenue against potential risk (just like every other every business), and currently the risk is acceptable for these ads and advertisers to continue.

There's probably some middle ground between "bank-scale KYC" and "people don't steal credit card numbers, do they?". You really think their current process can't be improved on? With all of their billions, their PhDs, their regulatory capture, finding a way to let in most of the real advertisers while keeping out the scammers isn't just too expensive, it's literally impossible? Despite the fact that they have a near monopoly and the legitimate advertisers will jump through almost any hoop imaginable?

> It would end the days of being able to set up an advertising account in a few hours. Perhaps that's not needed anymore.

That ability was never needed and was never a good idea.

According to whom? The organization that can't distinguish bad actors from good? I mean, you may be right, but he point is, they could do it, they just choose not to because it would be unprofitable.

They chose not to because it would lock most advertisers out. That's pretty much counter to everyone's goals. It's analogous to the "stop crime by jailing all of Texas" solution.

That makes no sense. It seems you're confused about KYC. It's a screening process that blocks known bad actors (eg: in finance that is anyone convicted of certain crimes, on watchlists, denied by regions or sanctions, etc). Most advertisers would not be affected at all.

By the way, this is already done since Google does check advertiser accounts against various sanctions and watchlists as part of dosing business in every country they operate in.

So if it's already done, it's not sufficient to stop bad advertisers?

It’s done for governmental and judicial issues like not working with terrorist organizations. It’s not accounting for bad advertiser history and related behaviors and connections.

The point is that it’s not a resource or scale issue (as you keep arguing), but a profit and incentives issue as I said before.

So a credit score but for the ad industry.

The risk is carefully managed. These malware ads are on the results page and are allowed until enough issues are raised. In other places, like Google's SSP for the rest of the web, there's far more malware because that reputational risk is pushed to the publishers.

Countermeasures aren't needed if adtech just stopped working with known bad actors and recognizable malpractices.

> Countermeasures aren't needed if adtech just stopped working with known bad actors and recognizable malpractices.

True, but it looks to me like adtech depends on working with bad actors and mostly ignoring bad practices. It's one of the reasons why I consider the adtech industry itself to be malicious.

These are good candidates for automated systems and LLMs (if they are as good and general as they say they are in Google's papers).

They could make a bot that trawls the add URLs every so often and if it detects malware activity it could put a strike on the account associated with that ad. A few strikes, and they are banned and their ad account closed. It wouldn't be perfect, but it would help take out the worst offenders.

They have that and they currently use it. It does take out the worst offenders.

But Google had to down on the order of some million accounts in 2021. The crawlers hit rate is probably not enough to keep up with this problem.

I mean they _do_ have VirusTotal to compare hashes to. It's obviously not fool-proof but it's an option.

That's how one might like to think traditional media works but then again the Lakers play in the FTX (previously Staples) Center, and plenty of other orgs have taken shady crypto money as well. It's not exactly like human review is a perfect solution.

It's certainly not a perfect solution. But it would be vastly superior to whatever they're doing now.

Scams in reputable, real-life advertising are orders of magnitude less frequent than in online advertising.

The problem is Google has no incentive to do it. Section 230 gives them blanket immunity. They make just as much money shipping malware as legitimate ads.

Charge Google a fine every time they serve a malicious ad and they will fix it.

I don't think this is a thing that section 230 covers.

It is. It's one of the reasons it's such an inept law: It refers to the concept of moderation in the context of "good faith" efforts, but fails to account for the influence of money in decisionmaking. This impacts all user-generated content, whether it be a social media post or an ad.

Except that advertising is already covered by existing regulations that 230 doesn't supercede. But IANAL, and I'll concede that I may be thinking of how it should be rather than how it is.

Nonetheless, all of my comments are engaging in wishful thinking. Google is a monster and I'm not sure anyone can tame it anytime soon.

They could also offer complimentary priority ad space for non-profit open source projects (even if only projects heavily targeted by malvertising), so their information appears before the spam, maybe with a prominent special tag. I don't know if that would noticeably harm their advertising revenue.

It is sort of "whack-a-mole".

I see some shady ads right now via adsense on https://getpaint.net

Screenshot: https://imgur.com/a/WRvrddy

Someone will report them, and they will go away, then reappear from a different Adwords account. They don't seem to have a smarter heuristic sort of thing to reject ads that only say, for example "Download Now".

Why are they accepting ads for a product from anyone but the verified maker of the product in the first place? Surely there's budget in that river of ad money to do the most basic due diligence?

Is that extortion? Pay us or malware displaces you as the first thing people see?

That said, it’s pretty common to get a competitor ad above the top search result.

It's not "extortion" so much as "stupid." "Pay us or we'll convince people our search results are crap" is a really bad business model.

You know how many people will think “teamviewer or Firefox must have gotten hacked” before “google sent me to a bad site” OR not notice for days and have no idea where it came from?

Being allowed to advertise on someone else's brand, trademark, etc. has been pretty much a cornerstone of online advertising since the birth of online advertising. It's justified as the way mom-and-pops have any hope at all of competing with big-box names; otherwise, Dan's Local Electronics couldn't show up on searches for Best Buy as a potential micro-targeted local alternative.

I'm not talking about advertising on someone else's brand, I'm talking about advertising AS someone else's brand, or malicious impersonation. The most basic vetting of advertising would catch this, but apparently this is not occurring.

Our observation of what is occurring doesn't match what is occurring.

Here's how the vetting you're imagining works:

1. The automated system goes to the advertised site. But Google's IPs are public knowledge, so the site vends a "safe" version to Google's checkers.

2. If Google sends a human being? Same story. That human's coming from a Google IP.

3. Google has a small set of non-Google IPs that they privately use for checking. This process seems to have broken down. My guess is malvertisers have caught wise and have managed to build a good list of those IPs to cloak against Google's back- and side-channel verifies too.

In terms of the actual ad copy: I suspect a lot of that is checked automatically, and the rest is often checked by contractors. So you're trying to solve the "Build an AI to understand when something is confusing" problem. There's probably room for improvement here, but it's not as surprising as I wish it were that stuff slips through the cracks at that layer.

> But Google's IPs are public knowledge

You're telling me that even though attackers of various sophistication are able to get clean, residential IPs all the time for nefarious purposes, Google can't do the same? Come on. It's not that they can't, it's that they don't care.

They definitely can. You underestimate how quickly they are identified as Google ad-check bots by the actors who don't want to be seen.

Because in the vast majority if markets the manufacturer is not the reseller. This is even true in many places in the software market.

True, but it seems like in the case of Blender, there is no reseller, so an easy solution is to literally blacklist the word "Blender" (when it comes to software - I'm sure they have semantic analysis behind the scenes to differentiate Blender the 3D software vs a smoothie blender). The ban can be reversed if an official from the Blender project reaches out (if they ever need to advertise for example).

So nobody's allowed to advertise a better 3d modeling option on searches for "blender?"

You can allow it as targeting, but disallow the word "Blender" in the ad copy, which is what these scams would use to misrepresent themselves and trick the user into downloading malware.

Using your competitors name is legal in US advertising

Not really hard to fix. They know the true is blender.org. Just display that.

But as policy they want to force companies to pay for clicks to their own brands.

Reply on news.ycombinator.com