AdNauseam, developer discussion

========================================================================

>> Forum PM

========================================================================

Re: AdNauseam (discussion with the developer)
Sent: 30 Aug 2017, 11:48
From: dhowe
Recipient: Moonchild
Moonchild,
Greetings. I am the primary developer of the AdNauseam extension... Wondering if you might have a moment to discuss the issue ?
much appreciated,
Daniel

========================================================================

 Sent: 30 Aug 2017, 12:37
From: Moonchild
Recipient: dhowe

    dhowe wrote:
    Greetings. I am the primary developer of the AdNauseam extension... Wondering if you might have a moment to discuss the issue ?


Absolutely. I'm not sure if you've taken a look at the thread on this forum about it yet, but if you haven't please read my posts in it explaining the problem with your extension that makes it directly harmful due to its clickbot nature.

========================================================================

 Sent: 30 Aug 2017, 14:46
From: dhowe
Recipient: Moonchild
Sure, and of course I have read your posts and the various responses on the forum. So you know, my intent in contacting is not to argue, but only to make sure we fully understand each others positions (both being long-time members of the FOSS community) ... then if we still disagree, thats ok

So, whats your preferred place to chat: signal, telegram, email ?

========================================================================

 Sent: 30 Aug 2017, 21:54
From: Moonchild
Recipient: dhowe
Good.

I don't even know what "signal" is, so definitely not preferred. I don't use Telegram. If you prefer instant messaging we can use XMPP/Jabber, my account being {{scrubbed}} for that, or (maybe best to get our points across) via e-mail. You can use {{scrubbed}} for that.

Either way, you've read my responses. I also understand the reason why the extension was created but in my observations it completely misses the mark and the collateral is severe.

========================================================================

>> e-mail

========================================================================

From: Daniel Howe
To: Moonchild
Subject: Re: AdNauseam (discussion with the developer)
Message-Id: <D73B446F-79DB-4E79-8B3F-324FDD693E51@rednoise.org>
Date: Thu, 31 Aug 2017 22:46:30 -0400

Moonchild,

Thanks for the reply. We have read your explanation (and the forum discussion) for the ‘block’ of AdNauseam and there are a few counter-arguments we’d like to make:

1. First it seems that we're in agreement on the basic idea that user well-being should be the primary objective, and so that is a good starting point... We only disagree as to how that well-being can be best served. We believe that users are already being harmed, in quite significant ways, by the surveillance advertising system. This system relentlessly tracks users from site-to-site without their knowledge or consent, imposes significant costs, both financial (for users on fixed data plans) and in terms of page-load times, and exposes them to malware (a fact that has been very well-documented).  These do not even begin to list the general privacy threats stemming from these accumulations of personal data maintained by vast commercial actors (what happens, for example, when such data is lost to hackers?)

2. We also both worry about the health of the large ecosystem (the web) in which we all work. However, we would argue that the current state of the ecosystem is already quite unhealthy and does not at all represent a desirable equilibrium we’d want to maintain or protect. The way we see it, surveillance advertising is one of the most harmful forces on this ecosystem, definitely not our small attempt at protest. In fact there is significant evidence that the recent false news trends and recent various forms of hateful expression have been directly fueled by advertising payments [1].

3. We disagree with your classification of ADN as malware for a number of reasons: malware works against the user's own interests/intentions, AdNauseam does not; malware misrepresents or hides its functions, AdNauseam does not; malware operates without the user's knowledge or consent; AdNauseam does not; once installed malware is difficult or impossible to remove; AdNauseam is not. It is far easier, we’d argue, to characterize tracking and profiling by ad networks as malware, as it works against user interests, misrepresents its function, and operates without the user's knowledge or consent -- and ever since it took over the web's ecosystem and established itself as the status quo, it has become impossible to remove.

4. You claim that our efforts will end up hurting small publishers and web sites whose only option for funding is (tracking) advertising.

First, we argue (as you yourself suggest on your home page**) that other more 'responsible' alternatives exist for websites, big or small, who wished to generate revenue via ads. Our project is not against online advertising itself, but only irresponsible and harmful advertising. In fact, if a website is acting responsibly and asserts this with a simple text-only DNT notice [2], ads on their website are neither hidden, nor clicked by AdNauseam by default.

** Actually would be great if you could provide some more info on what you use for your advertising, as we weren't able to find it in your documentation. From a quick inspection, it looks like your site contacts hundreds of 3rd-parties, including Google, Facebook, and other tracking ad networks (see https://github.com/dhowe/AdNauseam/wiki/Pale-Moon-website)

Second, it is not our intent to harm small publishers, or publishers at all. As stated in our documentation we target advertisers and ad-networks. Is it possible that some small websites may be injured in the process? Perhaps (though in the short term their revenues may actually increase), but it is clear that the harmful and unethical system currently in place will not change while advertising profits remain as high as they are...

As the EFF (who we worked with on AdNauseam) put it: "This brings us to the fundamental challenge: the publishing and advertising ecosystem must reform in order to recover the user trust lost due to widespread bad practices in the industry” [3]. Unfortunately, the big players (Google, Facebook, etc.) hear only one language, that of money. There are alternative, more ethical models for funding that are currently being experimented with, but none of them will become truly viable without some financial (dis)incentive for the big players who have monopolized the market into stagnation.

Looking forward to your feedback…

cheers,
Daniel


[1] Dave, Paresh.  "Without these ads, there wouldn't be money in fake news."  The Los Angeles Times. December 6, 2016.
     Nicas, Jack. "Fake-News Sites Inadvertently Funded by Big Brands." The Wall Street Journal. December 8, 2016.
     Marshall, Jack. "IAB Chief Calls on Online Ad Industry to Fight Fake News." The Wall Street Journal. January 30, 2017.
     Tambini, Damian. "How advertising fuels fake news." LSE Media Policy Project Blog. February 24, 2017.

[2] https://www.eff.org/issues/do-not-track

[3] ibid

========================================================================

Subject: Re: AdNauseam (discussion with the developer)
To: Daniel Howe
From: Moonchild
Message-ID: <59A842AB.70203@palemoon.org>
Date: Thu, 31 Aug 2017 19:08:59 +0200


Daniel,

Thanks for taking the time to write your counter-arguments down for
me, however it seems you are unaware of some of the mechanics at work
here. As I already stated in my forum PM reply, your intention with
the extension is clear, however, it completely misses the mark.

On 01/09/2017 04:46, Daniel Howe wrote:
> 1. [...] We believe that users are already being harmed, in quite
> significant ways, by the surveillance advertising system. This
> system relentlessly tracks users from site-to-site without their
> knowledge or consent, imposes significant costs, both financial
> (for users on fixed data plans) and in terms of page-load times,
> and exposes them to malware (a fact that has been very
> well-documented).

The problem is that AdNauseam makes this surveillance worse (and that
is where it completely misses the mark as far as that is concerned) by
first collecting the ads (causing requests to advertisers) and then
purposefully generating clicks, instead of preventing the content from
being grabbed. I have absolutely no problem with the other two
components of your extension (ad blocking and malware domain
blocking), but the bot-ad-clicking is a problem, even from this
privacy point of view. You are generating visits to external sites
that would otherwise not know of the user's existence, and in turn to
their linked external sites, in effect putting the user on the map and
making them many-fold easier to track from site to site by
broadcasting the presence to linked target sites.

Also, I'd like to remind you that upholding privacy for any visitor to
any public site on the web is a paradox. As a user, you are moving
around in the public space. The tracking is possible mainly because
the advertising in general is in the hands of a few very large
corporations that will be able to track users' "motions" because they
have sensors (in the form of ads) on a very large percentage of sites
on the web. Making this presence more obvious with generated clicks
only makes the tracking more accurate and you are going right against
the premise behind your extension: it doesn't do its job, and in fact,
does the opposite of what it sets out to do.

> 2. We also both worry about the health of the large ecosystem (the
> web) in which we all work. However, we would argue that the current
> state of the ecosystem is already quite unhealthy and does not at
> all represent a desirable equilibrium we’d want to maintain or
> protect. The way we see it, surveillance advertising is one of the
> most harmful forces on this ecosystem, definitely not our small
> attempt at protest. In fact there is significant evidence that the
> recent false news trends and recent various forms of hateful
> expression have been directly fueled by advertising payments [1].

I absolutely agree that some things are definitely not in the most
desirable state, but the whole false news trends (and the equally
false counter-initiatives that are just censorship in disguise) are
*completely* beside the point here. It doesn't matter what advertising
money is used for. It also doesn't matter that false news would
generate advertising money by creating a buzz and the resulting
traffic to otherwise unknown or not-visited websites.

Approaching it in a way that is harmful is not going to shift that
balance in favor of the desired equilibrium either, because you are,
whether you intend to or not, hurting publishers (or at the very least
hurting them disproportionately more than the ad networks because of a
combination of factors, see below) who use advertising on legitimate
sites with legitimate interests and a legitimate need to obtain
revenue to keep afloat. This is especially true for publishers of free
software who, save a few corporations (with their own issues of
freedom as a result) will have to depend on their independence and
independent income to keep doing what they are doing. Many FOSS
projects are small teams or individuals who have no other source of
funding for their projects -- individual donations are by far and wide
a joke that won't help with practical expenses. I've seen the same in
the early years of Pale Moon.
In fact, the only reason Pale Moon is still a thing after mid-2016
when Google pulled a nasty on us is because I had been able to branch
out to alternative sources of income to support the project (our
partnership with DuckDuckGo chief among them) -- only thanks to the
steady, organic growth we've seen because of my work and principles.
Many small-time publishers won't have that option, and it will ring
their death bell -- not unlike many vloggers who had to shut down
because of the youtube revenue "adpocalypse".

> 3. We disagree with your classification of ADN as malware for a
> number of reasons: malware works against the user's own
> interests/intentions, AdNauseam does not; malware misrepresents or
> hides its functions, AdNauseam does not; malware operates without
> the user's knowledge or consent; AdNauseam does not; once installed
> malware is difficult or impossible to remove; AdNauseam is not.

Malware is a general term for malicious software. It does not have to
be hidden to be malicious; it does not have to act like a worm, trojan
or other difficult to counter or remove piece of software to be
malicious. It does not have to harm the user installing it to be
malicious.

Malware does not have to target the user who installs it. Botnet
clients are malware; while they do not harm the user installing the
software, they cause harm to innocent third parties (either targeted
or not) by using the user's resources. AdNauseam does this.

Malware is often installed with the user's knowledge and consent, but
is malicious in that it misleads the users into thinking that its
purpose is something different than what it effectively achieves.
(e.g.: a productivity toolbar in a browser that causes ad popups)
AdNauseam does this too. It misrepresents its functions
(anti-surveillance while causing more surveillance. Causing a protest
to ad networks (good intention) while causing harm to publishers,
instead (bad effective result)) and goes against the user's intentions
by achieving something different (and in this case also opposite) than
its claimed purpose.

If you want to avoid a discussion about semantics, then we can agree
that AdNauseam is at the very least harmful. Part of this harm is by
design (but ineffective, see below) but a bigger part of this seems to
be unintentional.

Whether there is intent or not involved is, however, not a criterion
for what ends up on our blocklist; that is pure a matter of objective
observation and evaluation of observed behavior and result from said
behavior.

> 4. You claim that our efforts will end up hurting small publishers
> and web sites whose only option for funding is (tracking)
> advertising.
>
> First, we argue (as you yourself suggest on your home page**) that
> other more 'responsible' alternatives exist for websites, big or
> small, who wished to generate revenue via ads.

Can you please point me to the exact location where this is stated?
The only statement similar to that is where we alert people who use ad
blockers that we use responsible ad services (which means that we
avoid known malicious ad networks wherever possible) to keep the users
as safe from malvertising as feasible.

> Our project is not against online advertising itself, but only
> irresponsible and harmful advertising. In fact, if a website is
> acting responsibly and asserts this with a simple text-only DNT
> notice [2], ads on their website are neither hidden, nor clicked by
> AdNauseam by default.

DNT is, however, a completely failed concept because there is no
organizational structure in place to ensure that sites that state they
do not track, really don't track. Also, as you have seen from your
analysis of www.palemoon.org, placing an ad through a bidding system
(which is the regular way of offering ad space) contacts third party
servers, out of direct control of the publisher, that may or may not
track. Stating that the website "does not track" doesn't mean that
external content does not track, and relying on such a statement is
completely pointless as a result, since it is almost certainly false
in practice.

> ** Actually would be great if you could provide some more info on
> what you use for your advertising, as we weren't able to find it in
> your documentation. From a quick inspection, it looks like your
> site contacts hundreds of 3rd-parties, including Google, Facebook,
> and other tracking ad networks (see
> https://github.com/dhowe/AdNauseam/wiki/Pale-Moon-website)

We use Meridian(Sovrn) as a "first bid" (RTB) network. This currently
a trial and I'm not generally happy with the way it looks despite
their promises, so may remove them. When there is no fill from them,
it falls back to Google AdSense (single cascade). That is all that is
in use.
Any further content pulled in by either ad provider is out of our
control, and as expected contacting other sites and servers in their
ad network to provide the bidding service and display ad content --
which may be as complex as an html5 iframe. That is the very nature of
an ad network.
We place our trust in these providers that they exclude malvertising
domains. If you want to prevent that behavior, then blocking the
initial ad script call is your only sure-fire way. Actively pulling in
the ad and then on top "clicking" on it will contact many more
external sources, whether you discard the response or not.

> Second, it is not our intent to harm small publishers, or
> publishers at all. As stated in our documentation we target
> advertisers and ad-networks. Is it possible that some small
> websites may be injured in the process? Perhaps (though in the
> short term their revenues may actually increase), but it is clear
> that the harmful and unethical system currently in place will not
> change while advertising profits remain as high as they are...

It's great that it's not your intent! I had no doubts about that,
however what you really intend to do with the extension, you don't
achieve either, and the unintentional result is being harmful (and as
a result unethical) here. You say you have read my explanation on the
forum, but judging by the statement here you haven't fully
comprehended or grasped what factually happens.

The short-term increase caused by false clicks will only last as long
as the ad network does not detect the nature of the traffic (and trust
me, their algorithms for detecting fake clicks are pretty damn
accurate because of so many attempts at click-fraud that occur all the
time). For example, any fake clicks will always cause a noticeable and
otherwise unwarranted increase in ad target site impressions, and
those impressions will have 0% conversion since they are not displayed
to the user.

After that, two things will happen:

1. Direct harm: The ad network will put a hard filter on the
publisher's account (not just the detected website) to dock any and
all pay that looks even the most remotely like invalid traffic.
Because of delayed payment by ad networks, this is usually done on
anything that has not been paid out yet, retroactively. This kind of
docking usually is not reflected in what advertisers pay (since they
pay the moment ads are placed) and will be a net **win** for the ad
network until the delay catches up with the catalog price of the ad
positions.
In the worst case, publishers may see their account closed with no
opportunity for appeal, effectively cutting their income off
completely, overnight, by no action of their own -- that's a financial
take-down. It's usually up to the publishers to try (note: try) and
provide evidence that "it wasn't them" when they are accused of
click-fraud.

2. Indirect harm: The paid revenue value of the ad positions on all
sites on the account will drop like a brick. Ad networks will no
longer adopt the ad positions as "prime" placements when the account
is marked as "generates invalid traffic above the threshhold", and
advertisers aren't willing to pay top dollar for positions known to
attract fake traffic. This devaluation is usually permanent, even if
the publisher "shapes up to them" later on.

While (2) is a longer-term effect for ad networks (since their catalog
of ad positions will have fewer "favored" sites), it does not cause a
loss for them because Advertisers will use fixed budgets, and in turn
will just end up with their ads shifted to other sites or paying more
per impression because of increased competition with a smaller (but
higher quality of conversions) market. So in effect it has zero
influence on advertisers or ad networks unless your small protest
would cover a large percentage of browser users out there, which is
likely not going to happen.

As a result, the net outcome of AdNauseam is that people's browsers
are turned into clickbots that hurt the very sites they like to visit,
and does nothing to combat "ad surveillance", nor hurt ad networks.
AdNauseam only does harm by its bot-clicking. As such, I saw no
alternative but to block it by default in the browser, until its
behavior is no longer harmful.

Counter the EFF, all of this knowledge comes from from personal
experience and having moved in the website and advertising business in
many levels for over 10 years. I agree the system is not at all fair
and driven by mo'money in many respects, but damaging the very people
who would, if able to band together in a concerted effort, be able to
start making a change in attitude is definitely not going to help
their or your cause.

I'm sure your immediate question would be "but adblockers are harmful
too?", and you are correct. There is however an important difference
between ad blocking (preventing content from being downloaded by the
client and resulting in a shifted balance between bandwidth used and
revenue gained by all involved, which is usually not that big of a
deal, and otherwise not harming revenue of ads displayed) and
generating fake user actions (actively harming website publishers'
revenue over ALL their ad's clicks, not just the ones generated by the
bot). On top, being selective in what sites to generate clicks on
makes the extension even more like an attack on targeted websites and
more like your own limited definition of malware.

Sorry that this has gotten very lengthy, but I wanted to make sure to
try and be as clear as possible to get across why I cannot in good
conscience allow your extension to be freely installed and leveraging
the browser to cause harm to others who have had no part in creating
or maintaining this unbalanced ad monopoly.

If you think I'm overlooking something essential, please let me know
-- it seems rather clear-cut to me though.

Moonchild.

========================================================================

Subject: Re: AdNauseam (discussion with the developer)
From: Daniel Howe
To: Moonchild
Date: Fri, 1 Sep 2017 14:13:01 -0400
Message-Id: <75EB3476-CBEF-4D2E-B2E3-E4455FBF5D66@rednoise.org>


Thanks for the reply. I think that at this point it is perhaps best to agree to disagree, as you seem committed to your position and/or more comfortable than we are with the status quo. That you would consider your use of Google/Doubleclick ad networks, exposing even casual visitors to your site to hundreds of trackers without their knowledge or consent, to be “responsible”, is difficult for us to understand. However, the Web, like all communities, thrives on respect for a range of different opinions and options, as I think you would agree. It is disheartening that you don’t respect the users of Pale Moon enough to come to their own decisions on such matters, but in the end this is your call to make.

[image of anti-adblock announcement on www.palemoon.org]

========================================================================

Subject: Re: AdNauseam (discussion with the developer)
To: Daniel Howe
From: Moonchild
Message-ID: <59A90C8B.5070409@palemoon.org>
Date: Fri, 1 Sep 2017 09:30:19 +0200


Hi Daniel,

It's disappointing to see that you are using our use of Google ads on
our home page as the only argument to discard our entire discussion!
I thought better of you.

--- about the ads; tangent ---
Do you realize that the "alternative" to using this network is using
small-time networks that use all the dirty tricks in the book to have
people download actual viruses, trojans, and other form of your
definition of malware? I've tried several dozen, and none of them were
responsible in their ad content because all they would look at would be
maximum revenue regardless of content of ads. In that respect those are
way worse than Google in that it's a wild west and real danger to
website visitors -- Sovrn and Google are responsible in their ad
content, whether you hate them or not doesn't change that fact.

Also, as another thread on the forum is indicating: I'm going to reduce
our use of display ads on our websites when it becomes feasible, so
please don't underestimate the effort I am making in my own way to
combat this status quo and user tracking through ads. Being able to have
donations and sponsorship pay for our sites to become ad-free is a
primary goal. And then everyone wins.

This still has nothing to do at all with the fact that blocking these
ads would stop the potential tracking for website visitors. This is
still an option that I indicate clearly -- users can donate and ignore
the message on our page when they do. Close it and it's gone; or they
can not do anything else and keep blocking, or block the message too --
that's fine too.
--- end tangent ---

But sure, if this is only how far you're willing to go, then I'll agree
to disagree; mainly because you choose to ignore the facts I laid out in
our discussion about your extension's level of damage. I find it really
sad to see a good idea at heart being locked in an unacceptable
execution with a disinterest when pointed to (I think solvable)
behavioral issues with the extension.
Your extension will remain on our block list as long as it won't change
its damaging behavior at the "harmful" level (hard-blocked by default).

With your permission, I'd like to make (parts of) our discussion public
for our users to provide some feedback and keep things transparent to
them, without having to re-write them (dealing with AdNauseam has
otherwise already been too much of a timesink, all in all).

Looking forward to your reply,

MC

[quoted text removed]

========================================================================

Subject: Re: AdNauseam (discussion with the developer)
From: Daniel Howe
In-Reply-To: <59A90C8B.5070409@palemoon.org>
Date: Fri, 1 Sep 2017 16:20:02 -0400
Message-Id: <C53E6D08-F5E5-4B27-891F-F8C88A5A236B@rednoise.org>
To: Moonchild

MC,
I am fine with you publishing the discussion in its entirety, however I would
request you not to extract any parts or sections from the larger context.
thanks,
Daniel

[quoted text removed]

========================================================================

Subject: Re: AdNauseam (discussion with the developer)
To: Daniel Howe
From: Moonchild
Message-ID: <59A919E8.3040009@palemoon.org>
Date: Fri, 1 Sep 2017 10:27:20 +0200


Of course I'll keep things in context.

[quoted text removed]

========================================================================

Subject: Re: AdNauseam (discussion with the developer)
From: Daniel Howe
In-Reply-To: <59A919E8.3040009@palemoon.org>
Date: Fri, 1 Sep 2017 16:45:20 -0400
Message-Id: <A6B60D57-7E29-4E04-AAD5-0610E6E341A5@rednoise.org>
To: Moonchild

Just to be fully clear, I am fine if you publish the entire conversation,
but I do not give permission for the publication of any parts or sections.
best of luck going forward,
Daniel

[quoted text removed]