10 Nov 2026 Search

Massive solar project at Texas coal plant secures $1.8 billion green loan by Anne Fischer. The campus combines power generation, surface mining, energy storage, data center capacity, and high voltage transmission.

Techs on Decks Returns to the USS Hornet on November 14 Live demos, free for students.

Specialising to Extinction by Brian Jacobs. We are producing more slop, and more fraudulent ads designed to cheat consumers than ever before.

The Demon-crats. And Modern Marketing. by George Tannenbaum. (Includes an anecdote about a missed opportunity for IBM to build reputation by not doing “retargeting” ads. But the story is bigger than that. This would have been an opportunity to reach more of the right people, and get less wrong data from the wrong people, because the early tech adopters IBM would have wanted as customers are the same people who block, among other things, retargeting. More: The missing part of the your ad here page)

American Voters Overwhelmingly Reject AI Data Centers by Matthew Gault. Anti-data center candidates overwhelmingly won statewide races across the country. In Burgin, Kentucky, mayoral candidate George Hensley lost his bid after voting to approve a hyperscale project—to a write-in candidate.

11th Circuit sides with Florida over social media ban for minors by Alex Pickett. HB 3 operates not as an outright prohibition of platform usage but rather as a conditional ban of sorts—namely, on platforms’ use of addictive features and algorithms, [U.S. Circuit Court Judge Kevin] Newsom wrote. HB 3 is facially content neutral: It regulates social-media platforms based on their functional capabilities and features, not the content they communicate, the judge continued. The law neither references the substance of the speech on any platform nor draws distinctions based on it.

Meta, Scam Ads and the Shrinking Scope of the Hosting Exemption under Article 6 DSA by Mattijs Baneke, Sam Wolters, Ana-Caterina Ciusca. The Court rejected Meta’s arguments and, in line with the recent case law of the CJEU, held that a platform which exercises a degree of control through curation or monetisation of content cannot qualify as a neutral host and benefit from the hosting provider liability exemption. (Not just a degree of control in this case. Meta’s ad system is designed to provide an advantage to scammers: but I want to turn people into dinosaurs)

Sports Leagues Can’t Stop Putting Ad Revenue Ahead Of Fan And Player Interests by James Hercher. (It’s worse than it appears, though: Modern sports fans and the attribution cartel)

09 Nov 2026 Search

previously: journalist-owned news sites (Sunday Internet optimism, part 2)

A late good morning to AdExchanger. I was on the way to speak at Texas Linux Fest when this went up, so I slacked off on posting this here.

Gamers Love Ad Blockers. So This Site Found Another Way To Show Them Ads

What we did with this project was to sort of cheat at coming up with an answer to a difficult question.

One of the hardest metrics to get for a web site is the ad blocking rate. That’s partly because several different kinds of software get lumped together as “ad blockers”, and most of them also help the user to avoid being measured.

Ad blocking rate is impossible to measure correctly without also measuring bots. If either metric is wrong they’ll both be wrong. And bots have gotten much more numerous, varied, and mostly more aggressive. (See the DNA Lounge vs. AI scrapers saga.) Getting an accurate metric for human ad blocker users keeps getting harder.

So we used FouAnalytics to do the heavy work of bot detection.

Ad blocking data is a useful way to check if you’re reaching the right audience. How does the blocking rate for a brand’s own best customers or prospects compare to the rate in the context where they plan to advertise? If the rate is different, the audience is different. In this case, WiseGuyGaming is at 18% and has a largely AAA gaming audience.

A site that reaches more casual mobile gamers might come in lower, and a site for game developers or edgy indie games is going to be higher.

From the brand side, if you don’t measure the ad blocking rate and compare to the rates in the contexts where the ads run, you could be reaching the wrong audience and not realizing it.

For example, by now an infosec audience is going to consider most online ads as part of the insecurity department and not be reachable that way at all. If you have ever wondered why the best security vendors do so much event marketing, that’s why. The customers don’t tracker-block the bar code on their conference badges.

In any case, the higher the blocking rate, the more important the need to work directly with content brands on events and sponsored content. Brands that don’t measure ad blocking rate are likely reaching more bots and unintended audiences than anyone realizes.

But it’s worse than it appears

The even worse part is that a brand with a high blocking rate that’s looking at conventional adtech/martech metrics is going to be looking at data from an unrepresentative, more trackable fraction of the audience. And the higher the block rate, the worse that any decisions based on that data are going to be.

More later.

08 Nov 2026 Search

Previously: Notes and links from my talk at Texas Linux Fest

This is an extended version, with links, of the question and answer session from my Texas Linux Fest keynote yesterday.

First of all thank you great talk. A lot of this focused on Google and Facebook, or Meta. Is Apple any better? Apple has aspirations.

So the problem is enshittification, and this is Cory Doctorow’s term for when a service starts out being good for the customers and good for the companies that use it, then they start ripping off the customers while keeping the companies happy, and then surprise they start ripping off both sides.

Apple is earlier on the enshittification cycle than other companies, but they’re still on it, and they’ve still got a bunch of sneaky stuff that they have no alternative but to turn on in order to keep “number go up.”

If you follow W3C inside baseball, you will see Apple participation in the attribution cartel, which is a project to put advertising tracking into the web browser. Apple Safari already has something like it. It’s a low-profile thing and it’s moving along fairly slowly. Apple obviously doesn’t need to squeeze on surveillance because they’ve got a revenue stream from devices that people really like to buy. But in order to keep number go up, they are eventually going to squeeze more and more.

I have a question about reviews, which they were supposed to be a guard against scam sites and all that, when you can look at user reviews, customer reviews, and get a signal that there’s product quality or brand trust, but it seems those have been co-opted as well. Is there anything in that space that’s fighting against fake reviews or bot reviews? Is there a trust emerging there?

The reviews problem is a big one because the original algorithm for Google was PageRank. You’ve got trusted site links to other trusted sites and you can calculate the trust level of various sites. And so that was a really promising approach because what it does is moves the reputation graph outside of one company’s black box. And the reputation graph, in this case it’s represented by linking relationships among sites and blogs.

In theory you could write your own PageRank-ish algorithm to check it as well. Now in in recent years, Google has moved away from that and they’ve moved toward more hidden black box signals within their own data center, and they’re actually discouraging websites from contributing to the reputation graph.

My website, I don’t really care about my search engine ranking. I will link to legit businesses in a lot of different categories. But one of the prime pieces of SEO advice that they give is if you want to do well in Google, well, purge your site of everything except for one subject. Google wants to keep that reputation graph in-house so that more people are making decisions based on a Google ad and fewer people are making decisions based on the reputation of a site.

The level to which Google is squeezing on stuff like review content and ability to figure out the reputation of a site, that is a massive opportunity for someone to build a PageRank-like search engine and start to recapture some of those those reputation relationships that that people are still actively sharing.

A site that’s good for understanding the reviews issue is HouseFresh. They evaluate air purifiers and they actually do the tests and they consistently lose out to slop sites in Google because of that reputation graph problem.

Were Internet ads a good idea? And if you were able to rewind time and change reality, would you be willing to share like a few things that you think would have made it different?

Alternate reality time.

A better timeline would be the one where lawyers dug up the California Invasion of Privacy Act and applied it to web tracking in the 1990s, and didn’t wait until the 2020s.

If that legal argument had been made when conversations about things like third-party cookies were first happening, and more people had realized that cross-context tracking is legally actionable wiretapping, then a lot of sites would have been motivated to invest more in the kind of control over audience data that enables a sustainable ad-supported site.

See McKinley Park News - Building a Trustworthy News Business.

Among the worst abuse of integrated third-party scripts occurs through advertising networks and advertising technology (or “adtech”) designed as much to profit from exploitation of user data as enabling relationships between buyers and sellers. Too many news publications have swallowed the poison pill of easy- to-implement, revenue-generating third-party ad systems, failing to consider how this can harm users, denude business prospects and destroy trust.

The McKinley Park News does not use third-party ad systems for a host of reasons:

We could have had decades of work in that kind of direction—where reader data stays with the sites that produce the content they value, and we wouldn’t have taken the wrong turn toward commodification of “content” by intermediaries.

You talked about a lot of things I generally knew about but didn’t really understand how the whole advertising industry fit together and why it was so harmful. My question is, do you have a good resource that one might use to evangelize to a less technical person about what you’ve talked about here in this presentation?

Consumer Reports ran a feature called CR Data Bootcamp where there’s a series of lessons that you can go through to clean up your your privacy situation. I think that’s a really good one for normal users. But the problem is that putting all this extra work on normal users is not sustainable. And CSO Online really had the right idea, which is you’re the system administrator. You know this bad thing’s happening. Push out the tooling that will protect your people rather than counting on everyone to keep up with all of this and make the right choices. So yes, regular users should be checking a few things, but a lot of it is on the open source scene at least in part because we got here because of the open source scene.

(I also have effective privacy tips, some of which the sysadmin can handle, and some of which would have to be done by the individual.)

More from Texas Linux Fest

Texas Linux Fest 2026 Observations by Borislav Sabotinov. Stable enterprise distributions, design for reducing AI errors, cloud workspaces for developers, home labs, and more.

Bonus links

From Linux to Wikipedia: How Volunteers Build the Internet by Benjamin Mako Hill, Christian Pentzold and Aaron Shaw, and Creating a New Internet Bargain to Preserve Fair Use and Protect the Commons by Lisa Macpherson and Anna Tumadóttir. (Will collaborative projects survive scraper bots and slop input?)

Everyone Everywhere Hated Meta’s New AI Training Terms. Now, They’re On Pause by Samantha Cole. (Where there’s a privacy violation against individual users, there’s probably some kind of racket being run against companies. Google stole a damn sammich.)

It’s Time For City Builders To Embrace Productive Chaos by Eden Kupermintz. (Fan theory: politics lags gaming rules. We have new urbanism today because of what worked in SimCity.)

07 Nov 2026 Search

Update: “Surviving the Rugpull Economy” is on YouTube for anyone who wants the video version.

Abstract

The story of open source and the Internet is a story of dystopia timelines that didn’t happen. We avoided the Clipper Chip, key escrow. And the Fritz Chip, DRM mandates. Sure, threats to security, and DRM lock-in, are still there, but thanks to a lot of hard work, they’re manageable. Today’s biggest threat, though, isn’t coming from outside forces like governments or big copyright holders. Our ongoing collapse of trust and rise of crime is rooted in some good ideas from open source, gone wrong.

It’s not just social media scams and deepfakes. Dishonest business practices from the sketchier corners of the Internet have gone mainstream. We’re in a rugpull economy now. Let’s figure out where we went wrong and how to get back on track.

Intro

I was going to give my practical privacy tips talk, but then it turned out that they gave me the big room, so I wanted to think about the big picture.

Why are we doing privacy tips in the first place? Why not: How to share more of your personal information with brands you love? Why is privacy even a feature?

Privacy is not about something to hide. In a lot of situations, the reason we have privacy is that it makes a market work. Imagine you go on vacation, and go to an old-fashioned rug market. Are you going to hand every rug merchant your shopping list, budget, and departure date?

The basics of privacy are like the basics of not showing your cards in a card game. When privacy breaks down, a lot of other human activities break down, including markets.

Normie corporate privacy

And, of course, there are a lot of deceptive people out there. So the stuff that we used to do as privacy nerds has gotten all mainstream and corporate.

The Federal Trade Commission says scams are up 3x since 2020.

The Pew Research Center, in Online Scams and Attacks in America Today, says that 73% of U.S. adults have experienced some kind of online scam or attack.

When you give up too much information, you make it too easy to target you. Scams you’re likely to believe, malware that looks like software you want, whatever. So the kind of privacy advice I used to share with privacy nerds is now part of mainstream corporate IT best practices. CSO Online recommends:

  • Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it.

  • Favor browsers with built-in tracking protection.

  • Block ad and tracking domains at the DNS or secure web gateway layer; this reaches in-app ads on managed phones.

  • Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.

Wherefore do the wicked prosper?

How did it get so far?

The prophet Jeremiah asked,

Wherefore doth the way of the wicked prosper? wherefore are all they happy that deal very treacherously?

That’s not what I expected the Internet would get us. The Internet, and free software, were going to be awesome. I started running desktop Linux in 1994, back when you had to exit your own X mode lines, and you could zorch your (tube) monitor if you got it wrong. Yes, that was actually a thing.

Linux and the Internet kept getting better.

Internet 2, dystopia 0

The open source scene has beaten some powerful dystopia narratives.

Encryption backdoors and DRM are both still around, but last I checked the one remaining device in my house that will play DVDs is one of the Linux boxes. Both have gone from extinction-level threat to manageable problem.

Yes, we still need to get political and stay political to keep them from coming back, but for now, open source and the Internet have won.

Now the dystopia is coming from inside the house

But now we have dystopia at home.

A public service announcement from the FBI says “cyber criminals are using search engine advertisement services to impersonate brands and direct users to malicious sites.

And the FBI recommends installing an ad blocker. We are on the way to an new kind of dystopia when a major law enforcement agency of the USA is saying that a major company in the USA is doing so much crime you got to just block them. So how did we get here?

Today’s scam and surveillance dystopia has its roots in the open source scene.

We can still beat this one, and this time it’s really on us.

From open source to surveillance dystopia by way of economics

Commoditize the complement was awesome back in the days of “old Google.” Replace expensive single-vendor systems with Linux, plus whatever hardware works best at the time for a reasonable price.

Hardware as a commodity was a good idea. The problem happened when “content” was treated as a commodity. Adtech constantly tries to get the most expensive possible ad into the cheapest possible context.

For adtech, surveillance was never about the surveillance. It was about connecting the reader of some expensive content to some other context where you could show them an ad for cheaper.

A recent paper shows I’m right. A Longitudinal Study of Extended User IDs in the Online Advertising Ecosystem, by Michael Smith, Riley Grossman, Krzysztof Franaszek, Antonio Torres-Agüero, Pritam Sen, Cristian Borcea, and Yi Chen, describes how web trackers are giving “user IDs” to bots. If it were about the surveillance, this would have been a big deal. But it wasn’t. (A small mention in AdExchanger, that’s about it.) Adtech is a racket against the web publisher.

Why did advertising-supported web sites turn out to be so hard?

The old magazine business model was something like this: subscriptions cover the cost of printing and postage, and ads pay for the content. Without printing and postage, the ads should pay for things. But it didn’t work.

Walt Mossberg recalled,

[W]e were seated next to the head of this advertising company, who said to me something like, “Well, I really always liked AllThingsD and in your first week I think Recode’s produced some really interesting stuff.” And I said, “Great, so you’re going to advertise there, right? Or place ads there.” And he said, “Well, let me just tell you the truth. We’re going to place ads there for a little bit, we’re going to drop cookies, we’re going to figure out who your readers are, we’re going to find out what other websites they go to that are way cheaper than your website and then we’re gonna pull our ads from your website and move them there.”

The first generation of adtech was all about good ad, bad context.

But then it got worse.

The “progress” of online advertising was in creating ever more efficient auction-based markets, to match an ad to a user in real time. In 2006, Jakob Nielsen pointed out the problem with those, in Search Engines as Leeches on the Web. An auction-based market tends to capture all the advertisers’ profits, as they bid up the price of ads to where the cost of the ad equals the expected profit from additional customer.

As the auction gets more and more efficient, some slots go un-sold. Which explains why Big Tech systems are now deliberately designed to match scammers and victims.

The biggest example of adversarial personalization is the Big Tech senior fraud situation. Many older people are spending less money on discretionary purchases but are sitting on retirement savings, so Big Tech ML systems automatically “learn” to match them not with legit products and services, but with fraud operators.

Scam bidders don’t just fill in the ad impressions to the people normal advertisers don’t want (or, that Google and Meta ML “learns” not to serve normal ads to). Meta is earning a fortune on a deluge of fraudulent ads, but those fraudulent advertisers are also acting as shill bidders to drive up the auction prices for the legit advertisers.

Meta makes 10% of ad revenue from fraud directly—but possibly much more because the bidding functions representing all the other ads must pay more in order to outbid the numerous scams. If Meta is so good at AI then what’s this doing here?

Number must go up

Advertising revenue globally is about a trillion dollars, hard to estimate, maybe a little more. Meta and Google ad revenue, added together, is about half that. 580 billion if you add their Q2 2026 revenue and annualize it (multiply the quarterly number by four). The only way left to grow is to keep taking a bigger and bigger fraction of every sale, and the way to do that to keep dumping more good ads into bad contexts, and scam and malware ads everywhere.

A majority of a major industry is now controlled by two transnational crime organizations.

Crime is inevitable for Meta and Google now that they control a majority of advertising but must continue to grow at startup-like rates.

Excuses, excuses

But this platform, it’s so big! This is why you don’t hire a Big Tech CEO to manage a Burger King. “There are so many Burger Kings with so many customers! How could we possibly mop all the restrooms?” You just have to hire enough people. And if the rules of the platform ad “game” were less scam-friendly, less work by employees would be required anyway.

But union busting! Don’t Big Tech CEOs hate hiring moderators? Especially moderators who unionize? The crime is built in to the rules of the ad system, not just in the amount of work invested.

The problem isn’t scale or labor/management issues. The problem is deliberate design and policy decisions. Two good examples are:

What legit brands need from advertising

Advertising works when

content + signal ≥ interruption + resources + risk

Advertising can provide two benefits to the audience: it can support some kind of resource (which technically doesn’t have to be “content,” bus bench ads are a thing, too) and it can send a credible signal of the advertiser’s intentions in the market.

And advertising asks the audience to pay, with some kind of interruption—otherwise it would be not advertising, but content marketing—and spend some kind of resources, such as battery and bandwidth, and often accept some kind of risk.

Michael Farmer points out that:

  • The 2009-2024 sales growth rate of 40 out of 60 major advertisers has been very depressed, averaging (as a group) only 2% per year for 15 years.

  • By contrast, the market had real GDP growth of 2.4% per year plus inflation of 2.3% per year — so the benchmarked nominal GDP growth rate was 4.7% per year.

Advertising has stopped working for legit brands, and very few people in the ad industry have paid attention. So much crime, so little pay.

What I was wrong about

I thought that legit brands would want some form of post-creepy advertising, designed for honest sellers. What I did was point out the ad medium/brand mismatch. I did say that today’s surveillance advertising is optimized for the needs of deceptive sellers, and doesn’t carry the signal that legitimate brands need. Right so far.

But here’s where I messed up. As an Internet Optimist, I assumed that the decision-makers for the highest-reputation brands would be dissatisfied enough with the situation to seek out advertising media better suited to costly signaling.

But that’s not what was happening, if I had been paying attention to other trends.

Brand decision-makers did take steps to deal with the problem that a higher-reputation brand doesn’t benefit from an advertising system optimized for lower-quality sellers—but did it the other way around, by cutting quality and/or service and burning brand reputation.

But I was wrong about ad reform. Brands let their quality and reputation slide in order to match the available advertising, not the other way around.

Bernadette Banner, an expert in historic garments and in making and altering clothing in general, did a video on selecting fabrics. But in a rugpull economy, that’s harder than it looks.

The unfortunate reality is that those sorts of recommendations do not stand the test of time The recommendation section will become obsolete especially when shops start going out of business, especially the really highly recommended small businesses. Or with bigger more reliable brands it’s very common that these get bought up by private equity and become enshittified and so their quality degrades.

So what can we do about it?

This is our mess to clean up.

We’re not going to get off the Internet and touch grass. Get to the public library and volunteer to help people get their privacy issues fixed.

TODO add link to Alameda library drop-in help sessions.

Privacy is a collective problem. It’s not personal. We’re all safer when less money is flowing to scammers and to Big Tech.

And people inside big companies want to do the right thing, you just have to be able to justify it. I still think Google could go legit again.

The jury system can save us (again)

A December 17, 2002 jury verdict was, in my opinion, the end of the DRM dystopia narrative. In a Not guilty verdict, the jury straight-up jury nullified the anticircumvention section of the DMCA.

Today, juries are handing over some pretty good privacy verdicts. Thanks to the California legislature, we have some good tools to use against surveillance dystopia, and other states do too.

The fight against surveillance and scam dystopia does not have to be prohibitively expensive.

More: Audience Q&A

05 Nov 2026 Search

I can’t make this stuff up. Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign on InfoHawk.

Step one is

The victim arrives from a search ad A Google Search ad imitates the restaurant’s listing and shows a look-alike domain.

Some scammer registers a domain, and Google “helpfully” allows them to run ads using a registered trademark of a real restaurant.

One more good example of how the Google Search trademark policy is the greatest criminal scheme of the 21st century. In this case, Google isn’t helping to steal $6 billion in cryptocurrency, but all of these little crimes add up, too.

I really wonder how much the incremental search ad revenue for Google compares to the losses resulting from these, both for individuals and for the legitimate businesses that have to clean up after fraud and lose a real sale. This really looks like “break a plate glass window to steal a $3 cable” level of crime.

The problem with the trademark policy for Google Search ads is that Google doesn’t enforce it, unless someone complains about a specific ad and advertiser.

And the people who know which ads to complain about aren’t the people who get targeted for the ad. Google’s machine learning systems “learn” to match the ads with people likely to click. So a legit trademark holder isn’t going to see the fake. Likely victims are.

Combine that with how the ads are designed to be harder and harder to tell from real results, and Google has designed pretty much an ideal system for distributing malware and scams. Even if they did decide to staff up and fund the abuse department, the fundamental qualities of the system are rigged for, not against, abuse.

But number must go up—scam ads don’t just bring in ad revenue, they bid against the legit ads for the same slots, so they drive up ad rates for other advertisers, too.

Election news

Monique Priestley has been elected to the state Senate in Vermont, representing Orange County. Yes, this week was a big election for the Internet, but this particular result is encouraging in another way.

I spent $0 supporting Meta & Google which earns billions of dollars annually off of unchecked fraud and scams, supports child s*xual abuse material (CSAM) websites with ad placements, and seeks to addict and manipulate people of all ages. I spent $0 on targeted ads abusing your sensitive data (your phone number, IQ, education level, annual income, and political leanings, as examples)….My campaign used privacy-protective, non-traditional platforms to fundraise and manage voter information.

It’s possible to win without Google and Meta.

And that’s good. Brazil isn’t the only country that’s going to have to come up with a way to protect people from the various harms that these companies inflict, and their influence on politics. Just having them steal your sandwich is getting off lightly.

Here in the USA, most of the potential for improvement is at the state level, at least for now.

States are going after Meta and Google about a variety of bad behavior, including privacy violations and mental health issues resulting from habit-forming design. But if you grab on to one of these problems and really follow it backward, it turns out that every harm perpetrated against a user is the result of some scheme being run against an advertiser. Google didn’t set out to steal your sandwich—that was a side effect of policy changes made to unfairly drive up the price of search ads, above what legit restaurants would pay.

A solid advertiser protection law would end up mostly helping consumers, by cutting off user harms at the root. (Related: a privacy law shortcut)

In The answer to fighting ad fraud goes further than regulators’ proposals, Rob Leathern from InfoHawk is partly right about ad libraries. But every ad needs to be in a library, and every user of the platform needs to be able to see it. Privacy is about collective safety. A library only for “qualified organizations” is not enough—if Big Tech knows anything about existing qualified organizations, it’s how to subvert or neutralize them. A new trademark enforcer or NGO with a better algorithm, or an investigator on a trial engagement from a legit advertiser needs to be able to sniff around without warning. And platforms have enough bandwidth to make life hell for owners of small business websites, they should be able to host ad libraries with some of it.

More: Surviving the rugpull economy: notes and links from my talk at Texas Linux Fest

Bonus links

Want to Rent an Internet Address at the White House? by Brian Krebs. Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.

Has YouTube lost its cap? Why is Google allowing so many dubious ads? by Gordon Young. How many of these commercials would ever be cleared to run on conventional television? (icymi: cleaning up YouTube. Ever notice how YouTubers will promote sponsors, sell merch, ask people to join their Patreon, even follow them on other video services…but nobody says anything about turning the surveillance ads back on?)

03 Nov 2026 Search

Ari Paparo writes, in When Will Advertising Be Solved?,

Like many hypotheses to be tested, we might differentiate the strong form of the solving advertising argument from the weak form.

The strong form is something like this:

AI will enable any advertiser to set a budget and then optimally purchase advertising to produce the maximum return on ad spend.

But that’s not solving advertising.

“Any advertiser” can include a North Korean malware operation, and too often does.

Advertising can really only work for the buyer as well as for the seller if it’s based on some action that’s obviously—to the audience—harder for a legitimate advertiser than for a deceptive advertiser.

The “any advertiser” version is turning a once-useful advertising industry into just a subset of “security risks to block on the Internet.” And the problem is deeper than whether or not to include afterthought “anti-fraud” on top of an ad system where the core rules are designed to advantage fraud. Solving advertising has to have a market design that puts deception at a disadvantage. This is harder than it looks, but still doable. Print media pulled it off when they were breathing the fumes from molten lead all day.

The strong form of solving advertising—with AI in the picture or not—has to be considered from the audience point of view, too. Advertising works when

content + signal ≥ interruption + resources + risk

Advertising can provide two benefits to the audience: it can support some kind of resource (which technically doesn’t have to be “content,” bus bench ads are a thing, too) and it can send a credible signal of the advertiser’s intentions in the market.

And advertising asks the audience to pay, with some kind of interruption—otherwise it would be not advertising, but content marketing—and spend some kind of resources, such as battery and bandwidth, and often accept some kind of risk.

But read what the mainstream IT media and organizations have to say about online advertising, and it’s pretty obvious that with today’s online ads, the balance doesn’t work out. Blocking the ads is safer.

Krystal Scanlon and Sam Bradley write, in, Google search loses its free pass with buyers,

Across conversations with 18 media buyers, Digiday found clients putting Google through the kind of scrutiny usually saved for newer channels.

Google’s spin on the situation is that they just need to “AI” harder, but something else is going on. The Google search ads have signal trending down, while risk trends up. The FBI warning not to click on the search ads is still up, the best-informed users are blocking the Google search ads entirely, and everyone is learning that Google is less and less trustworthy.

Blaming insufficient AI for Google’s disappointing earnings will turn out to be a mistake.

Google Search ad for a fake Homebrew download

For example, see today’s Initial Findings and Response Update from Binance.

Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine.

Yes, it was Google. Malicious Ad for Homebrew Leads to MacSync Stealer.

Google’s Ad Transparency Center and search ads trademark policy are designed to be fraud-friendly. The problem isn’t the level of resources thrown at anti-fraud, it’s the way the rules of Google’s ad system are designed to facilitate fraud. They could do the fixes in how Google can go legit at relatively low cost—they just don’t want to.

If your employees or family members are getting ads on Google Search, you have a security problem. Early adopters and security-sensitive users have known this for a while, and the knowledge is spreading.

An industry that can “solve advertising” for all advertisers is an industry on track to be blocked, regulated, and sued.

Anyway, I’m supposed to run my mouth about the rugpull economy at Texas Linux Fest in Austin on Saturday, so I hope to see you there: Texas Linux Fest 2026

02 Nov 2026 Search

Noreply at Macy’s dot com asks,

How are you finding the product?

Good question. The last email from this company was to share this information:

Tracking: delayed

As far as I can tell from the site, not even the shipping company can find the product. Last scanned 10/22/2026, in Illinois.

This is a basic-ass customer-facing IT issue. One system is supposed to prompt customers to leave a review, or a one to five stars rating, or whatever, and another system is supposed to let people know when to expect their stuff to arrive. Right now, the two systems are not hooked up correctly, so I got asked for a review of a product that I haven’t received yet. no, this isn’t a problem of ha ha privacy nerd, you made your shopping experience worse by blocking tracking—I made an account and put in all my right info.

So what’s going on?

By activating data-driven and personalized omnichannel experiences, we empowered Macy’s to transform how customers experience their brand, creating seamless, magical shopping moments and increased relevancy, that’s what’s going on. Macy’s hired a fancy-pants consulting firm to set up “comprehensive customer journey experiences that feel personal, effortless, and magical.”

Which means, of course, less money left over for the basics.

Investments in personalization—most of which is adversarial, getting the maximum price from those with fewer options and only giving discounts to those classified as bargain hunters—tend to crowd out investments in product and service improvements.

The optimistic view on AI shopping agents is that they will shift the relative ROI of the two kinds of investments. A retailer that chooses to splash out on a big “personalized multichannel experiences” project will be slammed by agents trying a variety of “customer journeys” to see which shopping persona gets the best deal. A retailer that fixes the basics will tend to get picked more over time, as more shoppers act like highly-informed shoppers thanks to agent help.

But another possibility is that shopping agents go the way of the Honey browser extension and start off working for their users, then sell out to retailers—who end up paying agents to choose them instead of improving.

I’m still cautiously optimistic because of what happened with Honey. A client-side tool doesn’t have the network effects that Google or Meta have relied on, to slide deeper and deeper into crime without losing users. People quit Honey without losing touch with friends. A shopping agent might even have reverse network effects, as a less widely used agent would face less investment in countermeasures.

More later.

Bonus links

Teaching Paradox: Hearts of Iron IV, Part IVb: Iron Ends by Bret Devereaux. (Is it possible to make a playable World War II game where the Axis has a chance—without changing the economic rules to make it so that, in-game, totalitarian states are not dumb and bad?)

Google admits AI search makes less money, but it’s fixing that with more ads by Ryan Whitwam. As part of the financial disclosure, Google announced an expansion of ads in AI Mode. If you do decide to dip into Google’s search chatbot, you’ll probably see more contextual advertising. These ads will begin appearing in more international markets soon.

31 Oct 2026 Search

The Nudgestock conference sponsored my trip to the beautiful town of Folkestone, England—to be wrong about ad reform.

What I did was point out the ad medium/brand mismatch. I did say that personalized advertising is optimized for the needs of deceptive sellers, and doesn’t carry the signal that legitimate brands need. Right so far.

But here’s where I messed up. As an Internet Optimist, I assumed that the decision-makers for the highest-reputation brands would be dissatisfied enough with the situation to seek out advertising media better suited to costly signaling.

But that’s not what was happening, if I had been paying attention to other trends.

Brand decision-makers did take steps to deal with the problem that a higher-reputation brand doesn’t benefit from an advertising system optimized for lower-quality sellers—but did it the other way around, by cutting quality and/or service and burning brand reputation.

Remember John Moschitta Jr., the fast-talking manager from the FexEx commercial? “When it absolutely, positively has to be there overnight.”

You can’t do that kind of cultural imprinting advertising in a personalized medium. So I figured that FedEx would keep bugging their agency and the rest of the ad system to give them an ad medium that could. Because sending something FedEx was different from sending it some other way. Anyone else remember the feeling of dropping a package off at FedEx on time and then just not worrying about it? They would have needed an ad medium that gets that across. (A good brand is like a miniature version of Pascal’s Wager: you spend extra money in order to avoid catching hell for not choosing it. So the brand needs to not just deliver the ad impression, but also deliver the “impression” that the ad recipient’s peers got it too.)

But I was wrong. What happened instead is that, now, sending a package FedEx is more like “when it maybe, kinda, has to be there whenevs.” The brand changed to fit the available advertising, not the other way around.

Go back to other brands that did some memorable advertising, say Levi’s 501s, and the story is similar. A vintage pair, if you can find them, will outlast the new ones. Why did Levi’s change material used for 501 jeans? Can I buy old ones new anywhere?

Anyway, where I went wrong is that instead of high-reputation clients making the ad business offer them a signal-carrying option, scam culture spread out to normal businesses too. It’s a rugpull economy out there. So much crime, so little pay.

And yes, I’m doing another talk in the big room. Texas Linux Fest has me booked for the keynote, on “Surviving the Rugpull Economy.” Some of what I have been writing on here lately is going to be in that. This time I think I’m a little closer to right. More: Surviving the rugpull economy: notes and links from my talk at Texas Linux Fest

Related

It’s the death of the price tag, finished off by AI pricing by Bob Sullivan. If it feels like everything you do today is a video game with surprise gremlins attacking at every turn, that’s because—it is. Booby traps are everywhere. You can’t so much as buy a coffee, an avocado, or a curtain rod without you and your data being entered into a cynical value extraction experiment.

Bonus links

Turning an Old Phone’s Motherboard into an RC Plane Controller by Maya Posch. The smartphone was bought used for $23, with the default Xiaomi ROM overwritten by LineageOS to get a more lightweight and up to date Android installation on it.

Even more ads are coming to Google search, Google says by Matt Binder. (You still have to block these, at least according to the FBI. Winners don’t click search ads)

We Must Kill Windows For A Just Future by Chris Person. They will extract rent from you and your employer at every plausible juncture and give you garbage in exchange. You must accept in your heart that Windows is a lost cause.

No one paid me to disagree with Jonathan Haidt. It was teenagers who taught me that he was wrong. by danah boyd. And when it comes to internet-enabled predation, the biggest risk is not teenagers using the latest social media site. The biggest risk is single moms using online dating apps. Pedophiles seek out these women to get access to their children. It’s sick. But no one wants to hear that. They want to focus on the digital tools young people use….Truth be told, I’d have no problem if certain social media platforms would be banned for everyone. I think that many of the products in this space have devolved into garbage.

29 Oct 2026 Search

previously: the insecurity department

Alessandro De Zanche asks Can We Really Blame Apple For Blocking ID Tech?

Discover-Tech was on Google’s list of Certified External Vendors. It was also on IAB Europe’s Global Vendor List since July 2, 2020. That means it was “registered and approved” by IAB Europe, an association that says it takes “reasonable steps to vet and approve” applicants, including “the identity of the party or parties controlling the vendor.”

But, for most of the period in which Discover-Tech had IAB Europe’s blessing, its company records showed links to the spyware industry on its board and among its shareholders….

So can we blame Apple for not treating the industry’s vendor lists as a guarantee of trust and safety? No.

It’s worse than it appears. Claudie Moreau reports, in EXCLUSIVE: IAB Europe lists ad vendor despite possible spyware link that this “mole” has taken its whack and popped right back up again. Prof. Ronald J. Deibert, director of Citizen Lab, wrote,

We found that the domains adv45.volasim[.]com and adv50.volasim[.]com provided versions of Discover-Tech Ltd.’s campaign management system “Controlium” which we consider to be associated with Discover-Tech Ltd.’s deployment of spyware via targeted ads.

But an IAB Europe update which removed Discover-Tech from its Global Vendor List (GVL) on 8 October added Volasim to the list on the same day.

In my previous post about this I mentioned that Apple is pretty squarely in the mainstream on web ad security issues. The FBI, CERN, now CSO Online are recommending ad blocking.

The adtech scene seems to be remarkably complacent about the security problem, but the IT industry in general is on a tear about security stuff because of all the AI bug reports, so the situation is going to have to get fixed somehow. So what’s going to fix it? Lately people have been fired up about the prospects of two high-impact server-side projects that would squeeze out the existing mess of third-party scripts in the browser.

Prebid Server overhaul: The open-source project where adtech firms go to interoperate has a hell of an idea: What if we had an advertising system that was all, like, fair, with no special peek at everyone’s cards for Google? Anthony Vargas explains, in Prebid’s Proposed Auction Overhaul Would Do What The Court Wouldn’t: Separate AdX From GAM. Lots more adtech nerd details there. But the big idea is giving Google the exact same access to the real-time auction as everyone else.

IAB Tech Lab Trusted Server: This one is kind of a cookies and milk thing with Prebid Server, but can be implemented independently. Shailley Singh explains, in Apple’s Private browsing and the only practical path for advertising.

Instead of the browser connecting to a bunch of different third parties for ads and tracking, the browser just connects to Trusted Server, and Trusted Server does the first-party routing to other services. That doesn’t seem like a win from the user side—at first it looks like a proxy hop that makes ad and tracker blocking harder while passing all the same info to all the same third parties. (Yes, eventually Apple will figure out how to block that too.) But in practice, Trusted Server has the potential to make a large, and ultimately user-positive, impact.

That’s because a Trusted Server is “trusted” only as much as you trust the publisher.

Google makes money by getting the most lucrative possible ad onto the cheapest possible content. That’s why (if you ever turn your ad blocker off, as I sometimes do for research purposes) you see stuff like Google running a CVS Pharmacy ad on a copyright-infringing download of Algorithms and Data Structures for Massive Datasets by Dzejla Medjedovic, Emin Tahirovic, and Ines Dedovic.

Google-delivered CVS ad on an infringing ebook site featuring the book “Algorithms and Data Structures for Massive Datasets”

And, if I’m following the Trusted Server development correctly, an untrusted publisher would have severe difficulties in running one. A sketchy “publisher” (like the Google-supported pirate ebook site above) would be able to generate their own realistic-looking traffic to replace or supplement whatever they got organically, but nobody would believe them.

In Economics 101 Land, Trusted Server would become a huge win for the legit, actually trusted, publishers. On the supply and demand chart for ad impressions, quantity supplied would go way down, as Google can no longer dump a bunch of crap ad impressions into the real-time auction. And meanwhile, the Prebid Server project would make the whole market fairer and result in more of the value of each ad making it through to the publisher. Two big slices of Google crime removed, more money for legit players.

Google retaliation

So, cool story bro, thanks to two server projects the publishing and advertising bourgeoisie are going to bring down the overlord, the online economy is going to level up from Google-feudal to the next node on the tree of civilization, all well?

Not quite. Google still has a lot of political juice and can use it in mysterious ways. (Were they behind the mysterious “Alliance for Legal Fairness,” based in a WeWork in Virginia, that tried to carve out a commercial exception for California wiretapping law?) So it’s not going to be all legit server this, legit server that, without some pushback. With control of Google Chrome, they’re going to keep doing anticompetitive shenanigans. When the same company controls the browser’s JS implementation, their own ad JS, and the default tool for reporting how much the ads slow things down, they’re going to win some.

At least some legit publishers will have a source of funds to make all these much-needed changes. Ricky Sutton explains, in Two swords hang over Google. A judge holds one. Yours is $36 billion. Web publishers have filed “numerous private lawsuits” over Google’s past conduct. And the DOJ has already found that Google illegally monopolized the adtech market—so each individual case is down to how much exactly a particular publisher lost.

Any web publisher with decent business records and a decent lawyer is going to get a nice settlement, or judgment if it gets that far, from Google. (A list of the publisher lawsuits targeting Google’s ad tech practices) But somehow they have to not waste it.

In Who Will Stand Up For The Open Web?, James Hercher summarizes the conventional wisdom.

Banner blindness is near universal, search traffic has run dry and publishers are struggling for oxygen.

A consensus has emerged in recent years that the above statements are true, and that the open web as we know it is on an irreversible decline. Sure, certain corners of the web might be saved from extinction, like pandas preserved in zoos or display inventory nested within a curated deal.

In fact, the open web’s demise has been so thoroughly accepted as reality that during the remedy phase of the Google ad tech antitrust trial last year, Google’s attorneys and US District Court Judge Leonie Brinkema seriously questioned whether open web display ads would even exist as a material source of supply in a few years’ time, and thus whether it even made sense to pursue a years-long remedy strategy.

But, to go back to the news I started this post with, the open web has it worse than that. The adtech business is so far outside the mainstream security consensus that the ad blocker has gone from niche, to mainstream, to basically required.

It would be too easy to take the Google settlement, migrate the existing adtech stack, security risks and all, to the server side and call it good for another couple of years. But except for those who have retirement coming up quickly, that’s not very future-proof. Some of that Google settlement money has to go to squeezing out some of the ridiculous amount of crime that online advertising has built up—cutting dishonest third parties out of the loop instead of just putting a server in front of them.

More later.

Bonus links

How Google is Pushing Scam Videos on Elderly and Cognitively Impaired People by Nathan J. Robinson. (On the Internet, the more complicated the math they try to snow you with, the more basic the underlying racket really is.)

Renting the Frontier, Owning the Core IP: How We Cut AI Forecast Costs from $40M to $11M By Andy Nolan. (Ever notice there are “AI” projects that involve pointing an LLM at a project that people already know needs to be done, and that they can measure whether or not it worked, and there are also “AI” projects that are basically one person spiraling? Assigning a project to the right square of the 3×3 grid covered here might be a way to prevent some of the second.)

Scam With Your Friends: A Guide for Parents by Alina BÎZGĂ. The lesson is not that children should never be curious about how scams work. In fact, understanding common tactics is a good way to avoid them. The important distinction is this: recognizing manipulation is a safety skill; using it against someone causes harm.

25 Oct 2026 Search

previously: CCPA and CIPA on the same site. It is possible to comply with both “flavors” of California privacy law—CCPA and CIPA—by setting up one flow for the Global Privacy Control users, and another flow for people who prefer cross-context personalized advertising. One question, though. Would everybody who wants personalized ads be locked in to Rewarded Interest?

The second option I covered includes Rewarded Interest (which just came out in Apple’s App Store, by the way. Pretty straightforward answer to the problem of how to provide personalized ads to Apple users who want them.)

But there is only one Rewarded Interest, and GPC users can choose any browser. By January all the browsers are going to have to offer it.

Rewarded Interest doesn’t have lock-in, though. It is designed to integrate with the existing OpenRTB web ads. And there’s nothing preventing some competitor from offering their own user ID system that plugs in to OpenRTB the same way.

One company is an obvious contender to offer an alternative ID—and they’re already well-known as a fast follower on software.

  • Amazon has buy-side adtech, Amazon Ads Agent, a ready-to-go integration for their version of CMAID, whatever they call it.

  • Amazon has plenty of bonus offers to reward people for their data, so they don’t have to pay out all rewards in cash.

  • Amazon already has a first-party relationship with most households in the USA.

So the answer is no. People who choose personalization will end up with more than one option. They’ll pick an ID to use based on which one gives them the best deal. I don’t know if that will be Amazon or someone else. This is a competition problem for Rewarded Interest, not a lock-in problem for the people who choose personalized ads.

Bonus links

Cybersecurity bounty hunter says Samsung TVs use AI to record audio and screenshots for ads — ‘Finally found a company that truly listens to its customers,’ says hacker by Jhet Borja. (consumer tip: buy a smart TV now, while the surveillance-subsidized price is still in effect)

No signs of AI payoff outside the tech sector by Torsten Slok. VC-backed companies are spending more and more on tokens, but mainstream corporate America does not need the latest model and is unwilling to pay for it.

Elon Musk Just Gave Europe a Reason to Replace American Technology by Steve Blank. (The Eurostack needed content marketing, and Starlink delivered. It looks like Elon Musk’s cracked-out communications style did the Eurostack a big favor. It has been too easy for IT decision-makers outside the USA to rationalize the decision to stick with lock-in a little longer. But now it’s a lot harder to go through the motions of business as usual. Blank says that this saga will “cost the U.S. both leadership and jobs” but I doubt it. We still have some of the best actual IT R&D teams here, and someone will figure out a corporate and organizational structure that combines A-list engineers, programmers, and managers in the USA with owning entities/key-holders in more trustworthy jurisdictions.)

McKinley Park News - Our Local News Is Leaving Facebook, Instagram and Meta by Justin Kerr. In Meta’s upcoming terms on October 30, 2026 (as below), if any enterprise has any type of presence on Facebook or Instagram, then Meta and their cronies — and their AI bots — have a right to scrape away that business’s content published outside of Meta and sell or use it in competing business products. This scraping applies even to third-party websites like the McKinley Park News that are entirely separate from Meta and its services.

LLMs are making formal software verification feasible at a much larger scale by Keane Lucas, Aengus Lynch, Luna Tong, Luke Champine, Zygi Straznickas, Dino Distefano, Harshikaa Agrawal Evyatar Ben Asher, Ava Howell, Sami Jawhar, Chris Rohlf, Nickolai Zeldovich Nicholas Carlini, Rajashree Agrawal, Jason Gross. Using Claude, we proved security properties at the assembly code level (RISC-V) in over 100 real-world open-source software libraries. To our knowledge, this represents the first large-scale effort to use AI to apply formal verification to production software at the assembly code level. While writing the proofs, Claude also discovered bugs that had eluded detection for years, despite trillions of test runs.

Advertisers Pull Meta Ads That Had Unwanted AI Glow-ups b Trishla Ostwal (See previous link. Meta has access to the kind of technology that can do projects like that, and they use it to…make ads that misrepresent the product, with any and all risks on the advertiser. And block political accounts: Van Hollen Demands Answers From Zuckerberg Over No Kings Accounts, Battle over Meta’s alleged Bolsonaro bias intensifies days before Brazil presidential runoff)

Devs Shouldn’t Have To Protect Their Games, Valve Should Be Protecting Their Shopfront By Luke Plunkett. If I want to play City Builder 2000, for example, and log on to find 19 games all claiming to be some variation of City Builder 2000, I am not going to sit there doing detective work trying to find out which game is the one I actually want to play. I am going to close Steam down and do something else with my time, because that is not how you run a shopfront.