Hacker News Reader

Comment by anonymouz | Hacker News Reader

Obviously the NY Times is not happy with its ads being replaced by someone.

However, in my opinion this would be acceptable if it were the intention of the user. I hold the point of view that it is entirely my decision how to display websites on my devices. For example, it is up to me whether I display ads, run Javascript, or Flash. Similarly it would be okay if I decided to install a program that replaced ads on popular websites by different ones.

But it seems obvious to me that the users installing this software have no clue what they are doing, and are in fact essentially installing hidden malware. And this should be the way this problem is attacked and dealt with. Not via some perceived moral rights by websites to not have their ads replaced, but simply by the fact that this company is essentially installing malware without consent. This is what should be criminally prosecuted in my opinion.

View on HN

It all comes down to consent. I should be able to install a browser plugin that blocks ads entirely, or a plugin that replaces their ads with ones more relevant to me.

This is not a new technique, there have been adware/spyware apps for nearly a decade that do similar things. The ones that do it openly as a "legitimate business" claim the user consented, like Gator/Claria and Direct Revenue did. The netherworld ones dispense with that fantasy and just install.

Often the advertisers have no idea their ads are being served up through these shady networks. For example, in 2005 Gator was showing ads from the Yahoo network as part of the Overture keyword search. As an Overture advertiser you couldn't control whether ads appeared there.

>This is what should be criminally prosecuted in my opinion.

It seems to me all the talk of laws is rather pointless. If the NY Times can detect that this is happening then they can refuse to serve pages to clients that do it, and instead give them instructions on how to remove the malware. That solves the problem for everybody. The user takes a minute to follow the instructions to clean their machine of malware, then continues on to read the article.

Why does everything need a legal solution?

(And yes, Malware Corp. can try to sue you for telling people to remove their crapware, but anybody can sue anybody for anything. Doesn't mean they'll win.)

I figure it's a legal liability issue. What if the NYT provides instructions for removing the adware, and if following those instructions create problems for some user(s)? NYT's legal team probably concluded that it'd create unnecessary legal exposure.

The culprit should not be NYT; it's the company that's spreading the adware.

An interesting thought experiment might be: what if TiVo replaced TV commercials with their own ad's..?

Why should the NYTimes have to spend their resources and lose their revenue to educate and support people removing that software? That's an expensive cat and mouse game that they shouldn't be forced to play.

Better that they should have to spend the same money in additional taxes to support government investigations and prosecutions, only to have the bad guys move offshore and keep at it?

I think you're perhaps overestimating the cost of banning such things too. For one thing, there is no reason to go it alone. Major ad networks should be providing websites with tools to identify and disinfect affected clients. Then the cost to the NY Times et al would be little more than installing the supplied tools on their servers.

In addition, there is a certain amount of "starve them and they die" that needs to happen here. If something is illegal but still profitable, it continues to happen. On the other hand, if it becomes unprofitable because no websites will service infected clients then it disappears even if it's still legal.

The cost isn't in implementing the detection or writing a nice notice, it's in supporting the people it's for. Removal can be hard, look at Sony's bs with rootkits the other year.

Aside from that websites are a terrible way to fix a problem, there's probably still a massive amount of the internet 'best viewed in X' even though standards and non-IE browsers have been popularized for years. It's taken like a decade of campaigning, education and updates to reduce IE6 to insignificance.

Browser / operating system vendors are in a good position to tackle it and there's precedence for that too, but a single website even as big as the NYTimes is in a weak position to do anything except sue.

You don't literally have to have every website on board. You just need a critical mass such that any given malware-infected user will encounter a website that they consider important but that they can't access, and therefore have an incentive to take steps to remove the malware. That goes a long way to deprive the malware authors of infected users, even if there continue to be some websites that don't block the malware.

And as for browser and OS vendors, it seems like there is a clear way for the Times to push that along: If this problem is nontrivially impacting ad revenue then Google has a clear incentive to work with them on Chrome and Android, and with that as leverage, they can go to other browser and OS vendors and say "take the same measures to keep your users from coming to our website infected with this crap or we'll be recommending that they use Google's products instead."

I'm concerned about the the integrity of the user's computer. That is where I propose legal steps should be taken against the company.

The problem with legal solutions is the global market problem. Ban it in the US and EU and you'll still see it being peddled from Russia and China and infecting world-wide computer users all the same. But at the same time you shackle your economy with (invariably overbroad) legislation that increases compliance costs for small businesses and entrepreneurs and gives large corporations another bludgeon to use against smaller competitors.

Better to just let the market put the bad guys out of business because the good guys all blacklist them.

This is really no different from hiring a butler, with the understanding that he will clip out some of the ads in your physical newspaper and replace them with personals for shell companies he operates.

I'm not sure I agree with that.

When you load the NY Times website, you use up their resources (hosting, delivery, etc) and they're paying some fee to give you the privilege of viewing that page.

They pay for that using ads. Their choice.

You don't like that? Great. Stop visiting that website. That's your prerogative. But to visit the website, use their resources, AND block their way of generating revenue to pay for that...well, that's both immoral and wrong.

"You don't like that? Great. Stop visiting that website. That's your prerogative. But to visit the website, use their resources, AND block their way of generating revenue to pay for that...well, that's both immoral and wrong."

That's a summary opinion without the backing of law or even a thorough examination of the ethics involved. What is unethical/annoying to you may not be to someone else.

The poster is free to use AdBlock and other scripts to improve his browsing experience and the NYT is free to install ways to get around ADB (of which many exist) or make content available to those who want it for free.

The NewYork times servers send information to an information processing device, they are going to have to accept the fact that the data they send back is not the webpage on your screen and instead must be processed by the browser and other software. If the NYT doesn't like it, they can stop serving content to devices that don't render the content the way they prefer.

Well, the perceived moral right is sometimes what it takes for an individual entity to "get things done". I think it's safe to say that the NYT can't wait until users become tech savvy or for Google to come up with a good blacklist policy. So the NYT, if holding on to revenue is still a priority, will have to approach this problem as a self-interested, self-righteous party.

Frankly, the route you propose --criminal legislation -- would not be possible without overbearing laws on the order of SOPA. How would you envision a law that banned a plugin provider from injecting "bad" content into a consenting user's browser? Defining the "bad" is what gets us into trouble here

I don't think new laws are needed. If the malware poses as one thing and then does another this should (hopefully, IANAL) be covered by existing laws against cracking or computer fraud. I'm not proposing putting any Orwellian laws on the book, but simply see this as a case of the company abusing the users' computer systems and apply existing laws to it. To me this is entirely analogous to some bored "hacker" talking people into installing a trojan on their computer.

Since malice seems obvious and the operation is clearly a commercial one, I don't see how this being anywhere in a gray area.

Reply on news.ycombinator.com