Hacker News Reader

Comment by MichaelGG | Hacker News Reader

>For the technically curious: reading the address of the top frame is a challenging problem. For security reasons, browsers do not allow cross-domain scripting. So, it is not possible to just call the "top" object and read its properties. We have a proprietary solution for this.

Are they exploiting a security bug?

View on HN

I'll speculate they're using the referrer, although I think that only lets you jump up one level and then you're stuck. The client isn't required to send the referer header so it may not work at all. Still there are some plausible situations in which it works.

you'd be impressed by the amount of snake oil sold in the ad world.

for the latest ones, see the 'solutions' for viewability (i.e. another way to try to not pay publishers for displayed ads). they are all a joke that work on less than 1% of the cases you see in the wild. Yet, no mention of that is made.

When you see "proprietary", "patented", assume "BS".

now, answering your question, this is pretty much a mix of auto/manual monitoring. So with very little effectiveness. And/OR the publishers in question serve the page with Script tags, so they have access to the referrer of the original content page.

Maybe I'm confused as to where their kit runs, but there's no reason to assume they're using a commercial browser. It sounds like they're monitoring sites which screams "bot" to me.

I figure they have some sort of iframe busting script that lets them gain access to the top frame.

Reply on news.ycombinator.com