TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

How I got XSS’d by my ad network

82 pointsby rubikscubealmost 10 years ago

11 comments

proactivesvcsalmost 10 years ago
&quot;When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site&quot;<p>I&#x27;ve seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It&#x27;s beyond me how they can consider this to be an acceptable risk.
评论 #9885686 未加载
评论 #9884162 未加载
评论 #9885056 未加载
nicboobeesalmost 10 years ago
If you&#x27;re going to put adverts on your site, always put them within an iframe, pointed at a separate &quot;adverts&quot; only domain. This will ensure they can&#x27;t execute javascript within your own website context.
评论 #9884631 未加载
评论 #9884487 未加载
评论 #9886177 未加载
评论 #9884541 未加载
jon-woodalmost 10 years ago
The throw away comment on how ad networks are a cesspit at the end of that article really spoke to me - if it weren&#x27;t for the abundance of &quot;Recommended Stories&quot; and &quot;From elsewhere on the web&quot; crap selling weight loss pills and click bait I&#x27;d be far less inclined to run with an ad blocker.<p>The fact that these ads disguise themselves as content that the site owner is recommending is particularly insidious, since it will likely encourage people to click through thinking that they can trust the content.
myfonjalmost 10 years ago
In retrospect it seems he could have saved himself a Fiddler session if he just opened console debugger in browser and used `?&quot;-(function(){debugger}())-&quot;` in URL instead of `?&quot;-prompt()-&quot;`. (I would not have guessed this either, but may come handy next time.)
评论 #9885252 未加载
cm2187almost 10 years ago
This is why browsers should have an option &quot;Block third party javascript&quot; similar to &quot;Block third party cookies&quot;.<p>With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
评论 #9885050 未加载
评论 #9884228 未加载
评论 #9884283 未加载
评论 #9884144 未加载
评论 #9885110 未加载
teh_klevalmost 10 years ago
I&#x27;ve resisted using an ad-blocker for years because I&#x27;m happy for the sites I visit daily to earn revenue that way, and for many it&#x27;s the only way they can. I limited myself to running Privacy badger and blocking Facebook&#x2F;Twitter tracking cookies, that kinda thing.<p>But this is the straw that&#x27;s broken my camel&#x27;s back and it spoils things for those of us who don&#x27;t mind a few ads here and there. uBlock now installed, sod the ad networks.
评论 #9884771 未加载
mrweaselalmost 10 years ago
Whenever I talk to people who work for ad networks or similar companies, I&#x27;m, without fail, impressed by how little technical knowledge they possess. If you work for a company that sells internet services, you should at least have some basic understanding of how the internet works.
0x0almost 10 years ago
What a shame he didn&#x27;t actually pull the plug on the ad network :(
pkialmost 10 years ago
as far as i can tell, adsafeprotected isn&#x27;t actually for your or your visitors&#x27; protection, but for the advertisers (it seems to run a huge gob of incredibly slow scripts to &quot;ensure&quot; visibility, that there is actually an eyeball on the ad and that it&#x27;s not hidden or collapsed or something)
mahousealmost 10 years ago
What alternatives are there anyway?<p>I wonder what could be done to serve 3rd-party ads, making sure they can&#x27;t hinder the experience of the users of the webpage.<p>Is this just laziness from those ad networks, or do we currently have the tools to counter this?
andersonmvdalmost 10 years ago
That&#x27;s called Malvertising :P