Hacker News new | ask | show | jobs
by Nextgrid 2644 days ago
How are the ads served? Are you using Javascript or simple images? If it's the former I'm afraid there's no way to trust you (as the JS can change at any time and become malicious).
2 comments

We use JavaScript to fetch the ads, but the ads themselves are static images. We went with static images for a few reasons. 1) Speed. There's no need to download a bunch of JavaScript, CSS, and HTML. 2) Security. No JS in the ads means no bitcoin mining on the ad network [1] 3) Privacy. Since we host all of the images/ads, advertisers can't inject their own tracking code.

If the JavaScript to load the ads is a non-blocker, send me an email and we can discuss other options.

[1]: https://arstechnica.com/information-technology/2018/01/now-e...

I love what you're doing here, by the way. This sounds like how advertising should be done.

> We use JavaScript to fetch the ads

Sadly, since I keep JS disabled in order to help protect myself from all the bad advertisers out there, depending on JS means that your system would be filtered out too. Collateral damage and all that.

Perhaps you do this, but if not, then you might consider using a noscript element to alert people like me that they might want to allow your script to run.

That's a good point. We'll add this to our long list of things to do :)
You can use subresource integrity to prevent them swapping out the javascript.

https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...