your server will be right with you

previously: the insecurity department

Alessandro De Zanche asks Can We Really Blame Apple For Blocking ID Tech?

Discover-Tech was on Google’s list of Certified External Vendors. It was also on IAB Europe’s Global Vendor List since July 2, 2020. That means it was “registered and approved” by IAB Europe, an association that says it takes “reasonable steps to vet and approve” applicants, including “the identity of the party or parties controlling the vendor.”

But, for most of the period in which Discover-Tech had IAB Europe’s blessing, its company records showed links to the spyware industry on its board and among its shareholders….

So can we blame Apple for not treating the industry’s vendor lists as a guarantee of trust and safety? No.

It’s worse than it appears. Claudie Moreau reports, in EXCLUSIVE: IAB Europe lists ad vendor despite possible spyware link that this “mole” has taken its whack and popped right back up again. Prof. Ronald J. Deibert, director of Citizen Lab, wrote,

We found that the domains adv45.volasim[.]com and adv50.volasim[.]com provided versions of Discover-Tech Ltd.’s campaign management system “Controlium” which we consider to be associated with Discover-Tech Ltd.’s deployment of spyware via targeted ads.

But an IAB Europe update which removed Discover-Tech from its Global Vendor List (GVL) on 8 October added Volasim to the list on the same day.

In my previous post about this I mentioned that Apple is pretty squarely in the mainstream on these issues. The FBI, CERN, and now CSO are recommending ad blocking.

So what’s going to fix it? Lately the adtech scene has been fired up about the prospects of two high-impact server-side projects that would squeeze out the existing mess of third-party scripts in the browser.

Prebid Server: The open-source project where adtech firms go to interoperate has a hell of an idea: What if we had an advertising system that was all, like, fair, with no special peek at everyone’s cards for Google? Anthony Vargas explains, in Prebid’s Proposed Auction Overhaul Would Do What The Court Wouldn’t: Separate AdX From GAM. Lots more adtech nerd details there. But the big idea is giving Google the exact same access to the real-time auction as everyone else.

IAB Tech Lab Trusted Server: This one is kind of a cookies and milk thing with Prebid Server, but can be implemented independently. Shailley Singh explains, in Apple’s Private browsing and the only practical path for advertising.

Instead of the browser connecting to a bunch of different third parties for ads and tracking, the browser just connects to Trusted Server, and Trusted Server does the first-party routing to other services. That doesn’t seem like a win from the user side—at first it looks like a proxy hop that makes ad and tracker blocking harder while passing all the same info to all the same third parties. (Yes, eventually Apple will figure out how to block that too.) But in practice, Trusted Server has the potential to make a large, and ultimately user-positive, impact.

That’s because a Trusted Server is “trusted” only as much as you trust the publisher.

Google makes money by getting the most lucrative possible ad onto the cheapest possible content. That’s why (if you ever turn your ad blocker off, as I sometimes do for research purposes) you see stuff like a CVS Pharmacy ad running on a copyright-infringing download of Algorithms and Data Structures for Massive Datasets by Dzejla Medjedovic, Emin Tahirovic, and Ines Dedovic.

And, if I’m following the Trusted Server development correctly, there’s no way for an untrusted publisher to run one. A sketchy “publisher” (like the Google-supported pirate ebook site above) would be able to generate their own realistic-looking traffic to replace or supplement whatever they got organically, but nobody would believe them.

In Economics 101 Land, Trusted Server would become a huge win for the legit, actually trusted, publishers. On the supply and demand chart for ad impressions, quantity supplied would go way down, as Google can no longer dump a bunch of crap ad impressions into the real-time auction.

Google retaliation

So, cool story bro, thanks to two server projects the legit publishing and advertising bourgeoisie are going to bring down the overlord, the advertising economy is going to level up from Google-feudal to the next node on the tree of civilization, all well?

Not quite. Google still has a lot of political juice and can use it in mysterious ways. (Were they behind the mysterious “Alliance for Legal Fairness,” based in a WeWork in Virginia, that tried to carve out a commercial exception for California wiretapping law?) So it’s not going to be all legit server this, legit server that, without some pushback. With control of Google Chrome, they’re going to keep doing anticompetitive shenanigans. When the same company controls the browser’s JS implementation, their own ad JS, and the default tool for reporting how much the ads slow things down, they’re going to win some.

At least some legit publishers will have a source of funds to make some much-needed changes. Ricky Sutton explains, in Two swords hang over Google. A judge holds one. Yours is $36 billion. Web publishers have filed “numerous private lawsuits” over Google’s past conduct. And the DOJ has already found that Google illegally monopolized the adtech market—so each individual case is down to how much exactly a particular publisher lost.

Any web publisher with decent business records and a decent lawyer is going to get a nice settlement, or judgment if it gets that far, from Google. But somehow they have to not waste it.

In Who Will Stand Up For The Open Web?, James Hercher summarizes the conventional wisdom.

Banner blindness is near universal, search traffic has run dry and publishers are struggling for oxygen.

A consensus has emerged in recent years that the above statements are true, and that the open web as we know it is on an irreversible decline. Sure, certain corners of the web might be saved from extinction, like pandas preserved in zoos or display inventory nested within a curated deal.

In fact, the open web’s demise has been so thoroughly accepted as reality that during the remedy phase of the Google ad tech antitrust trial last year, Google’s attorneys and US District Court Judge Leonie Brinkema seriously questioned whether open web display ads would even exist as a material source of supply in a few years’ time, and thus whether it even made sense to pursue a years-long remedy strategy.

But, to go back to the news I started this post with, the open web has it worse than that. The ad blocker has gone from niche, to mainstream, to basically required.

It would be too easy to take the Google settlement, migrate the existing adtech stack, security risks and all, to the server side and call it good for another couple of years. But except for those who have retirement coming up quickly, that’s not very future-proof. Some of that Google settlement money has to go to squeezing out some of the ridiculous amount of crime that online advertising has built up—cutting dishonest third parties out of the loop instead of just putting a server in front of them.

More later.

Bonus links

How Google is Pushing Scam Videos on Elderly and Cognitively Impaired People by Nathan J. Robinson. (On the Internet, the more complicated the math they try to snow you with, the more basic the underlying racket really is.)

Renting the Frontier, Owning the Core IP: How We Cut AI Forecast Costs from $40M to $11M By Andy Nolan. (Ever notice there are “AI” projects that involve pointing an LLM at a project that people already know needs to be done, and that they can measure whether or not it worked, and there are also “AI” projects that are basically one person spiraling? Assigning a project to the right square of the 3×3 grid covered here might be a way to prevent some of the second.)

Scam With Your Friends: A Guide for Parents by Alina BÎZGĂ. The lesson is not that children should never be curious about how scams work. In fact, understanding common tactics is a good way to avoid them. The important distinction is this: recognizing manipulation is a safety skill; using it against someone causes harm.