7 ms·

Websites using SSAI (server side ad injection)

108 points by ressetera 8y ago

RandomInteger4 8y ago
Slightly tangential, but does anyone have a good crash course intro guide to ad ops?
- tacon 8y ago
  https://wordpress.tv/2017/10/15/james-strang-introduction-to-ad-ops/ https://wordpress.tv/2017/10/15/james-strang-introduction-to...
doctorpangloss 8y ago
Before anyone thinks this is a Eureka anti-ad-blocking technology: Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. Otherwise, obviously, the server could just maliciously record impressions/clicks. Then, logically, if uBlock Origin doesn't remove the ad, but does successfully remove the mediator's script, the server can never book the impression. So why waste precious bandwidth (actually INCREASING the cost of ad delivery for the publisher) delivering an ad you can never be paid for? Boggles the mind. Embedding the ad into the video is more akin to a native ad, which is generally understood by the advertiser to not have measurable conversion and to be strictly context (as opposed to user) targeted. We are going full circle--that is, back to the beginning--of ad technology.
- kondro 8y ago
  But for giant sites like NY Times or the like, you can solve this through commercial agreements and rights to audit.
- zeta0134 8y ago
  > Before anyone thinks this is a Eureka anti-ad-blocking technology: Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. I don't suppose I understand why clientside JavaScript is needed here. The serverside code could simply generate a unique hash for every visitor, and include that in the campaign link. Then, server-side code on the receiving end can read this hash, record a unique hit, and monitor the user on the campaign landing page to see if a lead is generated. This seems obvious to me, but I don't actually work in advertising. Where is the break in this system? What am I missing that allows this to be exploited, in a way that only clientside JavaScript can fix? EDIT: In context, I've realized that my proposed solution might work for clicks, but would do nothing for tracking impressions. Hrm. I'm not really sure if that problem is solvable. Then again, I'm also not a fan of impression based ad tracking (it feels creepy) so maybe I don't mind if it remains broken.
  - martimarkov 8y ago
    The server could track it based on the fact it delivered the content to the end user with the same unique hash present, no?
    - esrauch 8y ago
      You mean like a tracking pixel? The issue here is that all requests to the ad domain can be blocked by the ad blocker.
  - deleted 8y ago
    [deleted]
  - C4stor 8y ago
    A couple leads to answer you : - Video advertising is not happy with only impressions and clicks metrics. In general, advertiser will want to know if their video played while in view from a human (or at least in view on a screen), and for how long it has played (or at the very least a rough estimate, like say how much midpoints). - The concept of "impression" itself is often not very well defined, but counting it at "the server served a request with the video payload" is really a too optimistic view of things which leaves big holes exploitable by fraudsters. Having client side javascript playing at least requires additional software running, aka additional costs (if minimal) for fraudster. - You can't really "just" monitor the user on the campaign landing page, since it's different sites involved, it involves different cookies, and actually reconciliating them is doable, but it'd require some work that the advertiser may not be willing or able to do.
    - dx034 8y ago
      If all script appears to come from the website (advertiser scripts routed via the website with random filenames), it'll probably be pretty hard to filter that kind of behavior without breaking other websites.
      - C4stor 8y ago
        Sure ! You still need client side javascript though
- Pristina 8y ago
  clearly we need an AI/ML that will actively scan any video footage and cut out anything that looks like an ad. then people might actually find out what is and isn't ad.
  - sovok_x 8y ago
    It will start cutting out actual origin footage at some point because non-obvious ads are already there from the beginning mixed with primary content in a way they can't be easily separated.
- techslave 8y ago
  are ads only sold cpc these days? no cpm ads?
  - cocochanel 8y ago
    CPM ads still out there, for brand awareness. But you'll be paying for ads that no one clicks. So most advertisers go for CPC.
- enriquto 8y ago
  > We are going full circle--that is, back to the beginning--of ad technology. I guess they will end serving ads and "content" from the same site, but this site will be controlled directly by the advertisers, not by the publishers.
  - _-___________-_ 8y ago
    AMP
- nemothekid 8y ago
  >Otherwise, obviously, the server could just maliciously record impressions/clicks. I'd imagine that advertisers would just bake it into the cost of the impression like they do today for click fraud. In fact, I think this type of fraud is much preferable to click fraud.
- spenczar5 8y ago
  It's entirely possible to stitch a targeted advertisement into a video file. This happens.
- shittyadmin 8y ago
  Honestly, I'd be happy with that - the biggest problem with ads today is that they're a major source of tracking and malware.
- manigandham 8y ago
  That's not what native ads are. They are about following the form and behavior of the surrounding content and can have all the same complex interaction and conversion tracking as any other ad. Also video players with embedded ads have been around for years. The technology is already more advanced this and is just starting to roll out. Despite what you might think, there are plenty of checks against fraud and any publisher that does such blatant video fraud will get caught very quickly.
- geocar 8y ago
  > Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. > Otherwise, obviously, the server could just maliciously record impressions/clicks. I offer ads† to publishers server-side via XML or JSON, and they can stitch them into the page however they want, and I've been doing this for years. My publishers often get paid by click, but some of the more valuable ads are paid on referral. Occasionally I see a CPM/CPD deal go through, but it's usually to a larger publisher that I can understand how they get their traffic. I won't help anyone do a CPM/CPD deal unless I understand their traffic. You're right that it's much too easy to buy traffic from e.g. Google and spray it at my impression and click trackers, which is why I don't rely on them: Adblock and uBlock can remove the trackers all they want, but their users still get ads from my platform, and my publishers will still get paid. †: Strictly speaking: I offer a platform for publishers, and often help my customers get introductions/recommendations/connections to advertisers who believe in data-driven online sponsorship. > Embedding the ad into the video is more akin to a native ad, which is generally understood by the advertiser to not have measurable conversion Server-side stitching can be done in realtime, bespoke, and with standard VAST tags. Not everyone is doing this, because dash/HLS are simpler and still "good enough". > and to be strictly context (as opposed to user) targeted. I've worked with several (big) brands who have done completers and demo-guaranteed video campaigns. There is absolutely user-targeting in video.
  - tobyhinloopen 8y ago
    > There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. You cannot overwrite javascript properties in frames from another domain, right? Am I missing something? A fake webbrowser requires a lot of IP addresses. Wide-spread abuse seems hard to me, especially when combined with Google's hidden "I'm not a robot" thingy.
- rolandog 8y ago
  What if there existed a standard protocol to (automatically) interact with website's CMSs for the buying and selling of ad space via an API? Maybe even programmatically allowing the upload of images or videos? (Maybe even ADsafe [0] scripts?) [0] https://github.com/douglascrockford/ADsafe https://github.com/douglascrockford/ADsafe
- slimscsi 8y ago
  The server could continue to serve ads until the client reports back that one ad was rendered. If the message is blocked, the content would never be delivered. Thus making ad blockers content blockers. I'm not saying this is a good thing or bad thing. Im just saying there are more cats and more mice out there.
bratao 8y ago
This has been talked about as an obvious evolution for the Ads Network for quite a while. Do anyone with knowledge in this area , know why is taking so long for Adsense/ Criteo come up with a solution like this?
- foepys 8y ago
  The ad network needs to trust the website to not only deliver the ads reliably but also to report back correct data (impressions, clicks, etc). We are talking about quite a lot of money here.
- cocochanel 8y ago
  The way I understand it, SSAI is a video solution because you don't have to worry about impression (you have the view count), just the click so it can be done server side. Google has their own SSAI solution they call DAI. Criteo doesn't do it mainly because they have low video inventory. Correct me if I'm wrong.
fixermark 8y ago
I get the distinct impression, in the war of ads vs. consumer, that some people will not be satisfied until they've submarined advertising all the way down to sponsored content and we have to go way out of our way to notice that the Try Guys are always drinking Coca-Cola or something.
- jessedhillon 8y ago
  Once a revolution starts, it doesn't stop until it eats itself.
- manigandham 8y ago
  There will always be those fringe people who insist on content being valueless even though they consume hours of it. The greater problem is that the ad industry is too unregulated and greedy which has led to a tragedy of the commons with malware and poor UX everywhere, leading to adblockers installed by many who otherwise wouldn't mind.
  - KozmoNau7 8y ago
    If someone puts content out there for free, it is by definition freely available, and I decide 100% which content I want my browser to accept and show, and which content to ignore. If you want to make sure you get paid for your content, put it behind a paywall. Yes, the number of users will drop, but you can't have your cake and eat it, too. Otherwise, ask nicely for donations or Patreon support or do old-fashioned sponsored content, obviously with full disclaimers that the content is sponsored, so people can decide whether they want to watch it or not. Specifically talking about video ads, look at what Glenn Fricker from Spectre Media Group does on his Youtube channel. He often gets demonitized because he tends to swear a lot. So he asks people to "spend a buck, give a fuck" on Patreon, and he does short sponsor midway interludes in his videos. It's always a short clip of himself talking about the product or service in question, and it's always something he uses himself, he won't advertise something he can't vouch for. So you don't get the jarring cuts to some random ad agency's standard BS video that runs on thousands of un-related videos. That's how to do it. Part of and related to the channel's content, but also clearly demarcated and made fully clear that it is sponsorship/advertising. And most importantly: No tracking!
diafygi 8y ago
For everyone saying this ruins impression tracking, couldn't an ad-network just act as a "CDN" (e.g. client <-- Ad-CDN <-- server). They'd basically man-in-the-middle the server response and inject the ads into wherever in the html the server put the ad-tags. To the client, it would still be SSAI, but the Ad-CDN could still record impressions. Not that any server owner should do this (giving over control of your website ultimately to the ad-network? fuck that), but as ad-tech becomes more desperate, shouldn't these types of MITM setups get pushed more?
- edmundsauto 8y ago
  What if Cloudflare acting as a reverse proxy, that would really complicate things.
- teddyh 8y ago
  An “Ad-CDN” is exactly what AMP is.
dest 8y ago
The ML algo of Adblock Radio could be used to bypass those video ads. The case of radio ads is a typical example of server-side ad injection. https://www.adblockradio.com https://www.adblockradio.com https://github.com/adblockradio/adblockradio https://github.com/adblockradio/adblockradio (Disclaimer: I built this)
tobyhinloopen 8y ago
In the end, websites will just be server-side generated images. :D
- h43z 8y ago
  And then Adblockers will convert it back to html and strip ads from it.
  - tobyhinloopen 8y ago
    Please let me know how to convert images to HTML & how adblockers know what part of it is an ad. That cannot be done reliably without machine learning.
    - h43z 8y ago
      Then they will use ML.

108 points by ressetera 8y ago

RandomInteger4 8y ago

Slightly tangential, but does anyone have a good crash course intro guide to ad ops?

tacon 8y ago
https://wordpress.tv/2017/10/15/james-strang-introduction-to-ad-ops/ https://wordpress.tv/2017/10/15/james-strang-introduction-to...

doctorpangloss 8y ago

Before anyone thinks this is a Eureka anti-ad-blocking technology: Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. Otherwise, obviously, the server could just maliciously record impressions/clicks. Then, logically, if uBlock Origin doesn't remove the ad, but does successfully remove the mediator's script, the server can never book the impression. So why waste precious bandwidth (actually INCREASING the cost of ad delivery for the publisher) delivering an ad you can never be paid for? Boggles the mind. Embedding the ad into the video is more akin to a native ad, which is generally understood by the advertiser to not have measurable conversion and to be strictly context (as opposed to user) targeted. We are going full circle--that is, back to the beginning--of ad technology.

kondro 8y ago
But for giant sites like NY Times or the like, you can solve this through commercial agreements and rights to audit.
zeta0134 8y ago
> Before anyone thinks this is a Eureka anti-ad-blocking technology: Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. I don't suppose I understand why clientside JavaScript is needed here. The serverside code could simply generate a unique hash for every visitor, and include that in the campaign link. Then, server-side code on the receiving end can read this hash, record a unique hit, and monitor the user on the campaign landing page to see if a lead is generated. This seems obvious to me, but I don't actually work in advertising. Where is the break in this system? What am I missing that allows this to be exploited, in a way that only clientside JavaScript can fix? EDIT: In context, I've realized that my proposed solution might work for clicks, but would do nothing for tracking impressions. Hrm. I'm not really sure if that problem is solvable. Then again, I'm also not a fan of impression based ad tracking (it feels creepy) so maybe I don't mind if it remains broken.
- martimarkov 8y ago
  The server could track it based on the fact it delivered the content to the end user with the same unique hash present, no?
  - esrauch 8y ago
    You mean like a tracking pixel? The issue here is that all requests to the ad domain can be blocked by the ad blocker.
- deleted 8y ago
  [deleted]
- C4stor 8y ago
  A couple leads to answer you : - Video advertising is not happy with only impressions and clicks metrics. In general, advertiser will want to know if their video played while in view from a human (or at least in view on a screen), and for how long it has played (or at the very least a rough estimate, like say how much midpoints). - The concept of "impression" itself is often not very well defined, but counting it at "the server served a request with the video payload" is really a too optimistic view of things which leaves big holes exploitable by fraudsters. Having client side javascript playing at least requires additional software running, aka additional costs (if minimal) for fraudster. - You can't really "just" monitor the user on the campaign landing page, since it's different sites involved, it involves different cookies, and actually reconciliating them is doable, but it'd require some work that the advertiser may not be willing or able to do.
  - dx034 8y ago
    If all script appears to come from the website (advertiser scripts routed via the website with random filenames), it'll probably be pretty hard to filter that kind of behavior without breaking other websites.
    - C4stor 8y ago
      Sure ! You still need client side javascript though
Pristina 8y ago
clearly we need an AI/ML that will actively scan any video footage and cut out anything that looks like an ad. then people might actually find out what is and isn't ad.
- sovok_x 8y ago
  It will start cutting out actual origin footage at some point because non-obvious ads are already there from the beginning mixed with primary content in a way they can't be easily separated.
techslave 8y ago
are ads only sold cpc these days? no cpm ads?
- cocochanel 8y ago
  CPM ads still out there, for brand awareness. But you'll be paying for ads that no one clicks. So most advertisers go for CPC.
enriquto 8y ago
> We are going full circle--that is, back to the beginning--of ad technology. I guess they will end serving ads and "content" from the same site, but this site will be controlled directly by the advertisers, not by the publishers.
- _-___________-_ 8y ago
  AMP
nemothekid 8y ago
>Otherwise, obviously, the server could just maliciously record impressions/clicks. I'd imagine that advertisers would just bake it into the cost of the impression like they do today for click fraud. In fact, I think this type of fraud is much preferable to click fraud.
spenczar5 8y ago
It's entirely possible to stitch a targeted advertisement into a video file. This happens.
shittyadmin 8y ago
Honestly, I'd be happy with that - the biggest problem with ads today is that they're a major source of tracking and malware.
manigandham 8y ago
That's not what native ads are. They are about following the form and behavior of the surrounding content and can have all the same complex interaction and conversion tracking as any other ad. Also video players with embedded ads have been around for years. The technology is already more advanced this and is just starting to roll out. Despite what you might think, there are plenty of checks against fraud and any publisher that does such blatant video fraud will get caught very quickly.
geocar 8y ago
> Clearly you still need client-side javascript, distributed by the mediator, to ensure that the impression is actually delivered and the click is actually registered. There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. > Otherwise, obviously, the server could just maliciously record impressions/clicks. I offer ads† to publishers server-side via XML or JSON, and they can stitch them into the page however they want, and I've been doing this for years. My publishers often get paid by click, but some of the more valuable ads are paid on referral. Occasionally I see a CPM/CPD deal go through, but it's usually to a larger publisher that I can understand how they get their traffic. I won't help anyone do a CPM/CPD deal unless I understand their traffic. You're right that it's much too easy to buy traffic from e.g. Google and spray it at my impression and click trackers, which is why I don't rely on them: Adblock and uBlock can remove the trackers all they want, but their users still get ads from my platform, and my publishers will still get paid. †: Strictly speaking: I offer a platform for publishers, and often help my customers get introductions/recommendations/connections to advertisers who believe in data-driven online sponsorship. > Embedding the ad into the video is more akin to a native ad, which is generally understood by the advertiser to not have measurable conversion Server-side stitching can be done in realtime, bespoke, and with standard VAST tags. Not everyone is doing this, because dash/HLS are simpler and still "good enough". > and to be strictly context (as opposed to user) targeted. I've worked with several (big) brands who have done completers and demo-guaranteed video campaigns. There is absolutely user-targeting in video.
- tobyhinloopen 8y ago
  > There's no point to client-side JavaScript: The baddies just write JavaScript that rewrites basic objects using Object.defineProperty so that document.visibilityState always says so (and so on), or that lie to the visibility sensor. Or they just make a whole fake web browser that runs on a Server. You are in an arms-race, and verification companies simply can't/don't do a very good job. You cannot overwrite javascript properties in frames from another domain, right? Am I missing something? A fake webbrowser requires a lot of IP addresses. Wide-spread abuse seems hard to me, especially when combined with Google's hidden "I'm not a robot" thingy.
rolandog 8y ago
What if there existed a standard protocol to (automatically) interact with website's CMSs for the buying and selling of ad space via an API? Maybe even programmatically allowing the upload of images or videos? (Maybe even ADsafe [0] scripts?) [0] https://github.com/douglascrockford/ADsafe https://github.com/douglascrockford/ADsafe
slimscsi 8y ago
The server could continue to serve ads until the client reports back that one ad was rendered. If the message is blocked, the content would never be delivered. Thus making ad blockers content blockers. I'm not saying this is a good thing or bad thing. Im just saying there are more cats and more mice out there.

bratao 8y ago

This has been talked about as an obvious evolution for the Ads Network for quite a while. Do anyone with knowledge in this area , know why is taking so long for Adsense/ Criteo come up with a solution like this?

foepys 8y ago
The ad network needs to trust the website to not only deliver the ads reliably but also to report back correct data (impressions, clicks, etc). We are talking about quite a lot of money here.
cocochanel 8y ago
The way I understand it, SSAI is a video solution because you don't have to worry about impression (you have the view count), just the click so it can be done server side. Google has their own SSAI solution they call DAI. Criteo doesn't do it mainly because they have low video inventory. Correct me if I'm wrong.

fixermark 8y ago

I get the distinct impression, in the war of ads vs. consumer, that some people will not be satisfied until they've submarined advertising all the way down to sponsored content and we have to go way out of our way to notice that the Try Guys are always drinking Coca-Cola or something.

jessedhillon 8y ago
Once a revolution starts, it doesn't stop until it eats itself.
manigandham 8y ago
There will always be those fringe people who insist on content being valueless even though they consume hours of it. The greater problem is that the ad industry is too unregulated and greedy which has led to a tragedy of the commons with malware and poor UX everywhere, leading to adblockers installed by many who otherwise wouldn't mind.
- KozmoNau7 8y ago
  If someone puts content out there for free, it is by definition freely available, and I decide 100% which content I want my browser to accept and show, and which content to ignore. If you want to make sure you get paid for your content, put it behind a paywall. Yes, the number of users will drop, but you can't have your cake and eat it, too. Otherwise, ask nicely for donations or Patreon support or do old-fashioned sponsored content, obviously with full disclaimers that the content is sponsored, so people can decide whether they want to watch it or not. Specifically talking about video ads, look at what Glenn Fricker from Spectre Media Group does on his Youtube channel. He often gets demonitized because he tends to swear a lot. So he asks people to "spend a buck, give a fuck" on Patreon, and he does short sponsor midway interludes in his videos. It's always a short clip of himself talking about the product or service in question, and it's always something he uses himself, he won't advertise something he can't vouch for. So you don't get the jarring cuts to some random ad agency's standard BS video that runs on thousands of un-related videos. That's how to do it. Part of and related to the channel's content, but also clearly demarcated and made fully clear that it is sponsorship/advertising. And most importantly: No tracking!

diafygi 8y ago

For everyone saying this ruins impression tracking, couldn't an ad-network just act as a "CDN" (e.g. client <-- Ad-CDN <-- server). They'd basically man-in-the-middle the server response and inject the ads into wherever in the html the server put the ad-tags. To the client, it would still be SSAI, but the Ad-CDN could still record impressions. Not that any server owner should do this (giving over control of your website ultimately to the ad-network? fuck that), but as ad-tech becomes more desperate, shouldn't these types of MITM setups get pushed more?

edmundsauto 8y ago
What if Cloudflare acting as a reverse proxy, that would really complicate things.
teddyh 8y ago
An “Ad-CDN” is exactly what AMP is.

dest 8y ago

The ML algo of Adblock Radio could be used to bypass those video ads. The case of radio ads is a typical example of server-side ad injection. https://www.adblockradio.com https://www.adblockradio.com https://github.com/adblockradio/adblockradio https://github.com/adblockradio/adblockradio (Disclaimer: I built this)

tobyhinloopen 8y ago

In the end, websites will just be server-side generated images. :D

h43z 8y ago
And then Adblockers will convert it back to html and strip ads from it.
- tobyhinloopen 8y ago
  Please let me know how to convert images to HTML & how adblockers know what part of it is an ad. That cannot be done reliably without machine learning.
  - h43z 8y ago
    Then they will use ML.