Hacker News new | past | comments | ask | show | jobs | submit login
Ask HN: Why don't publishers serve ads from their domains to thwart ad-blockers?
39 points by akc on Sept 15, 2015 | hide | past | favorite | 83 comments



Here's how a typical banner/adspace currently works:

1. The ad/banner space downloads a javascript file

2. Javascript runs, collects browser+cookie+other identifying information and sends it on up to an ad exchange

3. The ad-exchange systems cross-reference the information it receives with other information it already has (think huge low latency k/v store) in order to try to identify you further, perform cross-device identification, save more information

4. The ad-exchange system then rolls all this information together and fans out this package saying "here is a male aged 25-35 who likes ponies and bick shaving cream" to dozens or hundreds of partnered ad providers

5. Each ad provider looks at their content, finds a close match, and then bids on how much they would pay in order to serve content to this person

6. Ad-exchange receives all the bids and picks the second highest bidder (no idea why it's the second highest)

7. Ad-exchange then sends this second highest bidder's ad URL back to the waiting javascript running in the users browser, and ad-exchange marks the winning bid so it knows who won/who has to pay at the end of the month.

8. From 1 to here usually has an SLA of occurring in less than 170ms

9. User's browser then loads up the response URL and the ad displays

Asking website operators to host their own thing is feasible, but perhaps not worthwhile. The big money maker in adspace is targeted advertising, and small sites will never have the infrastructure to be able to really identify anybody but perhaps their core users. Others have mentioned reverse proxies to make content appear as if it came from the target site, and that may exist, but the reality is whatever these guys do is currently being defeated pretty handily by community driven ad blocking. Perhaps we will eventually see what you're talking about though


> 6. Ad-exchange receives all the bids and picks the second highest bidder (no idea why it's the second highest)

It's called a Vickrey Auction. It allows bidders to bid their true value (instead of trying to outbid all of the other bidders, as is what results from a first-price auction).

https://en.wikipedia.org/wiki/Vickrey_auction


>6. Ad-exchange receives all the bids and picks the second highest bidder (no idea why it's the second highest) >7. Ad-exchange then sends this second highest bidder's ad URL back to the waiting javascript running in the users browser, and ad-exchange marks the winning bid so it knows who won/who has to pay at the end of the month.

It's a second-price auction - the highest bidder is picked, but the second-highest price is paid (more or less). The URL thus is from the highest bidder, not the second highest bidder.


Generally ads pay up to an order of magnitude more if there is some level of tracking and targeting available, and that's what most ad blockers target. Paying a bunch of money to show ads to who-knows-who who-knows-how-many-times isn't very valuable. Paying money to show ads to owners of Shitzus that make over $100,000/year is worth $12/click.

I'm pretty certain that as ad blockers grow there will be a lot more work-around (doing the work on the backend and serving up static HTML or a lot more native ads), but ad blockers aren't quite to the level that it's worth it to make those changes.


Is there that much of a difference? Publishers should have a pretty good breakdown of their visitors demographic distribution.


It depends on the publication. If you're ESPN you have a pretty good idea (which, by the way, makes the publication as a whole more valuable)

If you're Yahoo, however, it's pretty much a toss up.


I guess one of the "benefits" of serving ads from a third party site is that you can cookie the user on the thirdparty domain, and build a profile as the user moves between participant sites. ("Re-targeting"). Serving ads from a first party domain likely loses this information since there won't be a shared cookie? Also it might complicate installation (you'd need to install some server side software that fetches ad content from the ad network, and probably some custom development to integrate it without being caught by a one-line rule in adblock?)

Also! With more and more ads running javascript based animations, you really don't want shady ad-network-provided JS running in the context of your main site. (XSS)


Can't you set a cookie then re-direct to the PNG/JPG back on your own server?

Aynway, I've seen some domains shifting some crucial images like a play button into ad containers/folders just to come around ad blocker. Easy to adjust within ad blockers though.


Not sure what you mean; if you mean to point an <img src> at a third party domain that responds with a 301 redirect together with a Set-Cookie then that won't really work because 1. you are pointing to a third party domain which the OP already suggested is blocked so the client never loads it and 2. you would need a complicated image hosting system on the first party domain for no good reason and 3. the first party domain image host won't see the cookie and can't pick an ad that matches the user's profile ("retargeting"). Did you mean something else?


We do that but Ad-blockers block even those ads. We have our own text-based adds like Google Adsense text ads which are just <div> tags and those get filtered out as well.


I work hard to block all ads, including those. It's super helpful if you can provide an HTML class to your divs so I can more easily block them, but I will keep on working on blocking all ads by all means possible. I'm thinking of building an ad extension that doesn't show the ads but reports to js that the ad is still there, so that websites think that ad is there. It might also help for some cases to download the ad contents but not display them.

I do not think this is any more immoral than you trying to make my computer display things I do not want. If you want my money, just ask for it. Don't tell me via ads to give my money to somone else. Google Contributor is a promising experiment. Bitcoin micropayments are also convenient.


The only reason I know that it blocks these ads is because I also run an ad blocker.

We have a very strict ad policy; we manage all our ads internally, don't do any tracking, and all ads are 100% relevant to the content of the site. I have click-through rates on some ads types that are so far above the industry average you'd think I'm lying. We consider our ads just another service we provide on the site one that benefits us and our visitors.

The content is funded by ads and paying for content on the web to every single click you link isn't feasible. So morality aside, it's tragedy of the commons: People without adblockers effectively fund those that do. If the scales tip too far, the funds dry up and content will just go away.


I don't think that's the tragedy of the commons, because there is no "commons." Your website, and your time spent creating content, are not commons in the economic sense. If you want to charge people for your content, it's relatively simple to do so. I don't think you can invoke "tragedy of the commons" when you're choosing to not charge people for your content and then getting upset that some people view your content while choosing to not view ads.


The commons is the web itself. This is hacker news, we click links on different domains a hundred times every day. Each of those sites could charge you for all their content but then you'd be broke or nobody would make enough money to keep the lights on.

As for the technological means to mitigate that; they aren't at all feasible yet. So the reality is most people support sites by viewing ads and those that don't view ads aren't supporting them at all. Most people, if forced to pay for certain content, just wouldn't bother because it's not worth it for them. I feel like that whenever I hit a paywall limit from a HN link; I enjoy the content but not that much overall.


> Each of those sites could charge you for all their content but then you'd be broke or nobody would make enough money to keep the lights on.

Indeed, there are discussions on HN that argue that it should explicitly ban paywall articles from being submitted.


> If the scales tip too far, the funds dry up and content will just go away

Or the user-generated content, which fora require to attract new users to keep feeding the content-cycle, will just migrate to other platforms. Nu-Usenet, whatever it might be.

Some forum sites realise this and disable ads for top contributors, to try to keep them in the fold.


Stop browsing ad supported content then. It's a simple solution that works for everyone involved. Everyone says "i'd happily pay" but few put their money where their mouth is.

For the HN downvoters why is choosing not to consume the ad supported content so bad?


That's like saying "stop downloading F2P games" or "don't support the RIAA/MPAA". There are really just so few sites that aren't ad supported.

"It's a simple solution that works for everyone involved."

It's literally none of those things. It's not simple, it's not a solution, and it doesn't work for anyone involved.


Leaching content is not much different than the early days of MP3s. So I'm hopeful we'll find a new business model that works without me having to pay for every site on the web I want to browse. I can't remember the last time I pirated an album. The ease of streaming services has made it so convenient that I don't want to manage local files.

Still I don't buy the argument that just because you don't want to pay for the content (by viewing ads) that you should still be able to consume it without ads. From a technical perspective I guess the client can do whatever it wants with the data returned but it's still not "right".


We're not talking about dodging a toll booth or throwing a hat over the security alarms while walking out of a store. I ate a sample at Costco without buying the product. I got a spray of cologne at Macy's without asking what brand it was. I went to 7/11 on "free slurpee day" and got my free slurpee and nothing else. I'm an extreme couponer who walked out the door owing nothing.

I'm not taking anything from you because you gave it to me for free. Pirating is one thing. You're getting something for free that the distributor expects you to pay for. You're going out of your way to get something for free that you know you have to pay for. My ad blocker doesn't get me into Netflix for free, nor does it get past the NYT's paywall. It doesn't do anything fundamentally different from hitting "Reading Mode" built into my iPhone. Hell, it doesn't do anything fundamentally different from the Chrome extension "Cloud to Butt". It doesn't get me for-pay content for free. It couldn't possibly be any further from pirating MP3s.


> I'm not taking anything from you because you gave it to me for free

logical fallacy. You took it for free, but it had a price. If the ad has a $3 RPM it means you seeing the ad pays $0.003 to the content producer.

The price was just to let that ad load. not even to watch it or to read it.

It was free for you because you took it, by using a browser extension that lets you watch the site in a different way than the one that was intended.


All ISPs should be required to convert to nonprofit organizations, and the portion of a user's monthly bill that used to be profit for the ISP needs to instead be evenly distributed in a fair way to the owners of all sites visited by the user.


I'm not sure if this is sarcasm or not.


Sites could easily refuse to serve content to people who run adblockers or who turn off Javascript.

Instead, by serving their content upon request, the sites are implicitly agreeing to my terms. So, I'm not doing anything wrong by running an ad-blocker on my computer.

I think it would be great if someone codified this too. If servers can have Terms of Service, so can users. Wouldn't it be great if my browser could send a TOS to each site once before I accepted content from them? A simple notification of my terms, via a custom header sent from a browser extension would work today, but I don't feel that I need to do this since most servers happily give me their content.


Actually, ad blockers work hard to make sure this can't happen. I'd like for a site to be able to identify those users and decide not to serve content but there is a reason why adblockers don't want this. If I can identify that you are running an adblocker then I could do something even more malicious than serving an ad.

There is no way to identify an ad blocker in the initial request. If there was the adblocker would just spoof those params anyway. The way most of the scripts detect ad blockers is to load some JS class in an file that is likely to be blocked by an ad blocker. If the class is loaded they assume that ads are not blocked.


Actually, there are sites that already can and do detect adblock so however hard the adblockers are working to stop this, it's not working. Getting hung up on the fact that you can't do it in the initial request is introducing a strawman.

> If I can identify that you are running an adblocker then I could do something even more malicious than serving an ad.

Well, then you'd be an asshole. Running an adblocker on my computer is not malicious, so some site responding with a possibly illegal action wouldn't be a good solution for anyone.


Why would I do that? Helping people monetize their website isn't my problem.

If ad-blocking eventually forces 95% of "content providers" to shutdown, I don't really care. There's too much blogspam, too many pointless "me too" posts, and just too much crap out there for me to care. If the whole system implodes and goes away it really won't bother me much. The interesting content will be able to survive with subscriptions or pay-per-read or something.

Unfortunately, I think a lot of people don't want to admit that most of the web is more a waste of time than anything, and given the option, nobody would pay for most it. Would I pay $x a month to read nautil.us or medium? Yes. Would I subscribe to some idiot who posts his two cents about an article and then links to medium? No.

I buy books and ebooks, pay for music, and pay to watch movies, I don't mind paying for interesting web content. But I'd be stupid to pay for it or not read it when I can easily, legally read it for free.


> I think a lot of people don't want to admit that most of the web is more a waste of time than anything, and given the option, nobody would pay for most it.

I kind of agree with this but yet so much content that I think is worthless still gets massive amounts of traffic. Like those stupid viral facebook lists that make you click through 30 pages, quizzes or whatever the linkbait flavor of the week is. Yet so many of my friends must find some value in them or they wouldn't keep sharing them.


But, like I said, most people wouldn't pay for any of those things. They're "valuable" in that they're amusing and silly and free. Charge anything for them, and they would practically disappear overnight. Even people who don't explicitly block the ads are used to ignoring them at this point.

I'd like to see the overlap between people who click through web ads with people who respond to or click through spam email.


You dont know if target is ad supported when you click on a link.


I'll give you that argument. Even though people continue to return to those same sites. Then complain about sites that try to implement other means of monetization like paywalls.


That solution doesn't work at all for the massive numbers of people who want content and don't want to pay for it.


How does choosing to not consume ad-supported content help the situation? There is no difference between not viewing an ad-supported web page, and viewing it with an adblocker, apart from the extremely small cost of serving the page. And if the cost of serving the page to adblocking visitors is too high, then that's an extremely obvious flaw in the web site's business model, and is in no way the fault of the adblocking visitors.


Hosting is basically a commodity now but there is still cost involved. Especially if you are actually producing unique content. If I choose to steal a physical product is that an "obvious flaw in the business model" too?

Look, I'm not arguing that advertising is the only way to make money. In fact I think it's ultimately going to die or come to some form users and content producers can agree on. Especially with companies like Apple, and Google (who ironically makes a ton of money on ads) turning against ads. There are certain types of advertising that users do accept right now. Mostly things like "content marketing". Where a user reads some blog post or helpful tip which is really just a way to promote another service or product that the user pays for. Those even do well on HN. Then again HN is basically an advertisement in itself for Y Combinator startup news.

I do think the ability to make money helped the web grow and continue to grow. Advertising is and was a large part of that.


> If I choose to steal a physical product is that an "obvious flaw in the business model" too?

If you give away a physical product, with an implicit expectation that each recipient will take part in some other interaction that will give you a small amount of money, then that is an obvious flaw in the business model.

If you want to apply your analogy of theft, then you need to discuss password-protected web content where people pay for subscriptions. In that case, if someone hacks your site or steals another subscriber's password, then your analogy would hold.


Could you give some examples of websites where there is some form of ToS that contractually disallows access without viewing the ads?

I think you'll find that the overwhelming majority of websites have no such terms of use, so who are you to tell us how we should be accessing these sites?


Is updating the ToS going to actually change anything?


Probably not, as the people who block all ads will likely continue to do so (and who reads ToS anyway?)

But without it, how can you back up any kind of complaint about someone not displaying the ads? There never was any obligation. It's like yelling at someone who leaves their lounge to make a cup of tea during a TV ad break.


I guess it's similar to walking away from the TV. However, DVR providers attempted to use technology to automatically skip ads and there was a huge backlash. The advertisers seem to have won the battle with TV even though you can still fast forward on DVR. Sometimes on-demand doesn't allow it. I still think users are going to win the battle on the web.


Its a race that (if the ad industry gets smarter) will be very hard for the ad blockers to match.

Because publishers have control of the website, they can do things like randomize the div name, parameter names, javascript names, javascript functions, sizes of the ad, randomize images for the ad, use dynamic JS positioning, etc..

Basically if a publisher was serving their own ads and didn't want them blocked, you would be extremely hard pressed to counteract it.

As far as building your extension- You cant build it so its automated. No matter what you build, Any publisher could bypass it within minutes. The best you can do is make it so the site doesnt work if ads are showing, but publishers are already fine with this (hence why warnings are put up saying 'disable adblock to continue')


> Its a race that (if the ad industry gets smarter) will be very hard for the ad blockers to match.

Not really. I currently have my browser setup to strip out the main text content and display it "reader" style with images pre-loaded but requiring a click to display.

Even if you get tricky with loading of content via JavaScript trickery adblockers can always run the JavaScript etc but only "fake" render it.


Thats like saying ad blockers cant win because you browse the web from view-source:

Even in that case, If the pub wanted to, he could check to see if you requested additional ad-serving JS/images/resources from a request before showing you the html/js content. If the sites 'content' is loaded with JS rather than being visible in the static source, there is not going to be much you can do.


> Thats like saying ad blockers cant win because you browse the web from view-source:

Personally I find most of the value is in the content and not the layout. So it's not really anything like view source which mixes them and makes it very difficult to read the content.

Of course it's a bit different with full blown web apps but I can't think of any web app I use that is supported by advertising.

> If the sites 'content' is loaded with JS rather than being visible in the static source, there is not going to be much you can do.

The problem is now two-fold: 1) You are going to hurt your search rankings, and 2) it is possible for ad blockers to get around. Like I said just get the browser to load and run the js, ads, etc, and just not render anything that's not clearly content.

Ad driven sites could up the game by requiring user interaction before they load the content, but if the interaction is simple and repeatable then its easy to tag and handle.

They could start requiring captchas etc that are integrated with the ads before requesting the content via js but at this point I'd really start to question whether your regular users will stick around.


So to be clear:

1: Search rankings not effected, because you do a "if useragent is googlebot and iprange = x, show normal site"

2: You are going to run the advertisements on the publishers site, even if they have nasty malware attached to them and use your system resources? Not displaying those ads wont keep your computer safe. Does not seem like a good idea.

3: There is so much logic capable in JS which can determine if its being hidden or not - What color is position x,y ? Its white? thats not correct... dont load the site. There could be a infinite amount of these non-interaction gotchas you will not be able to automate- You will have to go back and try to write a rule each time, and that rule will be tricky if everything is randomized.


>I do not think this is any more immoral than you trying to make my computer display things I do not want.

Your browser make a request to a URL, receives a response, and renders it. It seems you're trying to imply that the presence of ads in that response is somehow immoral, but if so, that argument doesn't make a lot of sense. If you don't want to see advertising, fine (I personally believe you have every right to control what you see in your browser, even if that inconveniences the site owners) but don't pretend that advertising is somehow in violation of a contract that doesn't exist.


  Ads subsidise the internet for the people that cant afford it. Subscription models will kill off the web/internet as we have it. I don't care for ads either specially those that hamper with the viewing of the content. If you dont want to see ads just visit the sites.


Really? How does content in <div> tags not get filtered out as well, or does it?


The filter list will block the div by id, class, or by its position among some other containing element.


But how does it know that it is an ad? Some advanced heuristics?


It's all manual. Someone sees it and submits the item into the EasyList blocklist: https://easylist.adblockplus.org/ - it looks like http://forums.lanik.us/ is used for reporting items to block or unblock.


Filter lists are curated by humans. It's an arms race between two smart groups.


Probably adblockers keep a dictionary of filters for blocking native ads.


I don't block your same-domain ads because my concern about ads is mostly controlling what I am connecting to, and avoiding severe nuisances like sudden popups and stupid flash movies playing loudly out of nowhere.


Counting Impressions.

A different model is needed if the publishers servers have to get the ad first and then give it to the client because the ad server then needs to trust the publisher to report impressions honestly and the publisher has an incentive to inflate that number.


A: Drops 'impressions' as the metric for allocating money for ads. Use something else like clicks which take you to the advertiser's site.


Welcome to the 90s, when advertising on the web was not profitable. ;)

I totally agree with what is wrong with advertising on the web, which is basically everything, but there is also value to impressions.

Let's say a new movie is coming out. I don't care if you go to the movie website, I just want to get the actors' faces in front of you with a movie name.

Same goes for a political candidate. I don't need you to go to Bernie Sanders' website, I just need you to know that he's running and a couple of things that he stands for.

The problem is that advertising and tracking are inherently connected today. Want to target ads to people who are likely to respond to them? You need profiles on all those users. Want privacy? You need to starve the collection of your data to build profiles.

IMO this is precisely why Google still gives me better results than DuckDuckGo - not _only_ do they sometimes know who I am and things about me, but their data set is based on knowing so much about all of us.

I also find that supremely unsettling.

Having worked on ad-driven properties, I'll say it's pretty common to track things at both ends. The advertiser always wants the impressions / click-throughs / whatever to be as low as possible, and the operators of the site want it to be higher. Much negotiation ensues.

Also, most folks don't have direct ad sales, though this is the holy grail in ad-driven properties, most sites use doubleclick and a suite of others, and often an intermediary inventory management service which picks the ads which pay the most for a given hour or day and maybe switch out providers based on their speed (doubleclick also gets really slow at busy times and will cause your site not to load :/)


1 - that transfers all risk from the advertiser to the publisher. Did the advertiser's creative not perform? Bad targeting? It's now the pub's problem.

2 - brand advertising isn't really meant to create clicks, but rather a positive impression of a brand. eg those cute cheerios ads or the xmas polar bear coke ads.


You're assuming the point of all display ads is to make you click. Many advertisers don't care whether you click or not, they just want to make sure you saw the ad/message. Many brands don't require online engagement, they want to reinforce what their brands means.


Ads have many specialized requirements that you wouldn't really want to build yourself. Tracking, tokenization of url parameters, rotating ads to meet impression goals, and typically advertisers have build their ads to be served by major ad networks, so you would have to replicate their systems to support those ad units. Ads are way more complicated than most people realize.


I've heard some Ad networks are asking clients to setup reverse-proxys, so they can make the image APPEAR to come from same origin. It's getting crazy!


As an engineer in a Ads company, I totally agree. It's not just grab ad content from your customer, write some api integration with various publisher and send them the ad. The complexity involved in serving an ad properly and efficiently is way beyond the understanding of outsiders. Rotation, different kind of measurable metrics (we have at least 3x metrics than you can see from google analytics), ad serving efficiency (believe or not, we are able to serve ads faster than some publishers serve their own content), tons of targeting configurations and more. Tracking makes all those things possible.


It's possible the industry could build some sort of "cross advertiser network API" that would allow proper accounting/selection of ads while remaining on one company's domain (from the perspective of that user's web browser). It would require the cooperation of a lot of parties, many of which (optimizing firms for example) have a vested interest in the way things work now.


I believe a website is responsible for everything that is delivered and all tracking that happens when they publish a page and deliver it. They don't get to segregate their content from ad content and wash their hands of responsibility for any lies or misuse of data by the later.

So forcing domains to host the ads they insert and all the tracking that goes with makes that more explicit and thus a good thing.


The reason is one. And it is because ad blockers actually do not affect both the publishers and ad companies that much. About only less 5% of the internet users world wide have ever employed ad blockers (http://www.channelnewsasia.com/news/business/in-bringing-ad-...). I am sure they will move ad serving to the backend when they get better reasons to shun of client side technology. Its just not worth it....yet.


This is changing fast depending on the audience for your content. Some publishers are now seeing 40%+ of their traffic ad blocked. Some countries are seeing 30%+ of total population using ad block. Ad block usage is up 41% year over year...this is going to be a very serious issue very soon for many publishers.

Some of my numbers are from: http://bits.blogs.nytimes.com/2015/08/10/study-of-ad-blockin...


thanx for the enlightement!!!


Who counts the impressions, to pay the ad client?


There are other bases for compensation. Conversions / actions / clickthroughs.

Measure what you can see. Don't obsess over what you cannot.


Good point, I had this question earlier about ads in general, but this didn't even pass my mind.


Idea: ad network w/ a daemon the publisher installs in their infrastructure between the users and the content. Maintains a blockchain which verifies exactly how many impressions there have been.


OP probably means major publishers who can solicit advertisers more directly.


Which tend to still use 3rd party ad severs. Probably because they don't want to develop that tech in house.


Because advertisers don't trust publishers. They need a third party agency with no immediate interest in the game that could guarantee reliable reporting. For example if the ads are served from the publisher then the advertising network has no way of identifying fake clicks/impressions made by botnets.


Tried this once. Ad block maintainers went out of their way to create custom filters for our site.


I think the only thing you can do these days is to rotate ad directories _and_ file names constantly, i.e. multiple times each hour just to run around ad blockers and their maintainers.

Or did you go already that far?


If I made an ad system that needed to track a user, I would want to use my own domain because then I can save the user's state between websites using my own domain's local storage.


Ad blockers don't just block domains. They also block (full) url patterns, which are easily adapted to sites (and there are many) which host ads for themselves.


Slightly OT: If more publishers defaulted to SSL, they would thwart lots of corporate ad filtering that strips out Adsense and the like.


It doesnt work. If your site is popular enough, ad blockers would still target the ads on your website using site-specific rules.


 		||         
 		||
       Sales    ||    Tech
                ||
                ||


Followup question to some folks within the ad industry which I'm sure are reading:

I serve Google AdSense on one of my sites with 10'000 - 20'000 ad impressions daily. What amount of $ would one expect to make with those impressions if changing ad networks away from Google? Any recommendations?


Are you starting from a false assumption? Delegation seems like the logical answer. Content publishers already delegate out a DNS label/domain for CDNs. Why wouldn't they also delegate a DNS label/domain to a third party for ad infrastructure?


1.) cross-domain tracking

2.) ease of integration

3.) independent analytics




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: