by groundpepper on 5/13/21, 4:28 PM with 2 comments
Specifically, why doesn't YouTube put their video ads on the same domain as the videos themselves, or even embed them dynamically in the videos at request time? Why doesn't Twitch stitch their ads into the live video stream?
I know for third party sites this isn't possible, because ad networks don't trust them to report honestly and want their own scripts running. But for the sites mentioned, and others like them, I haven't been able to figure out their reasoning for not doing this.
by buro9 on 5/19/21, 7:31 AM
I mean... on the level of JavaScript, SVG, CSS, etc... you either have to incredibly constrain what an advert can do as you cannot moderate them all or be aware of every possible attack vector... or serve them from a different domain so that the browser security model applies.
The risk to someone like Google of a rogue advert causing an account compromise is far greater than the risk of some % of lost revenue.
by littlecranky67 on 5/13/21, 4:49 PM