Hacker News new | ask | show | jobs
by lmm 64 days ago
> advertisers will just require that you compile their library into the first party js code, negating any benefit from such a security model.

It will become harder for advertisers to deny responsibility for ads that violate their stated policies if they have to submit the ads ahead of time. Also site operators will need a certain level of technical competence to do this.
1 comments
miki123211 64 days ago
More likely, advertisers will need you to insert a "bootloader" that fetches their code and passes it to eval().

Alternatively, they might require you to set up a subdomain with a cname alias pointing to them (or a common CDN), negating any security benefits of such a practice.

link
thepasch 64 days ago
> More likely, advertisers will need you to insert a “bootloader” that fetches their code and passes it to eval().

Sounds like legal precedent waiting to be set. “Run our code so that it looks like your code, acts like your code, and has all the same access as your code” seems like it should be a slam dunk if said code ends up doing a Very Bad Thing to your visitors.

But of course that’s assuming common sense, and the law’s relationship with that isn’t always particularly apparent.

link
ImPostingOnHN 64 days ago
There is already plenty of precedent for real-time-served ads which are annoying, or malicious, or install malware; or outright exploit vulnerabilities in the browser.
link