08:25:52 RRSAgent has joined #digimarketing 08:25:52 logging to http://www.w3.org/2015/09/17-digimarketing-irc 13:51:46 RRSAgent has joined #digimarketing 13:51:46 logging to http://www.w3.org/2015/09/17-digimarketing-irc 13:52:03 ktakeda: work with MIT on security and privacy 13:52:04 wseltzer: Session 1: Setting the stage: Academic perspective from Keio University followed by a perspective from the University of South Florida 13:52:51 ktakeda: suggestions for antipatterns for common failures in industry related to privacy and security 13:53:16 i/ktakeda/Topic: Session 1: Setting the Stage 13:53:52 ktakeda: objective is define good practicies related to privacy and security for web & digital marketing 13:54:39 ktageda: malvertising is one of the largest issues in advertising 13:54:51 ktakeda: malicious advertising is the biggest problem. as advertising becomes very efficient, it attracts malicious advertisers 13:55:07 ktakeda: the platform of choice to distribute malware 13:55:43 ktaketa: No clear solution to fight malvertising 13:56:51 ktaketa: the malware sites look just like real web page 13:56:54 Saravana has joined #digimarketing 13:57:09 ktakeda: ad networks used to show advertisements. using URL shorterning tools, the users land to programs with 0-day exploits 13:57:28 AshKalb has joined #digimarketing 13:57:40 ktageda: ktageda: 2nd large antipattern is unchangeable persistent ID 13:57:42 ktaketa: the malvertisements include links to several steps, shortened w URL shortening services, that once followed install some software in the user's browser that includes 0-day exploits (virus) 13:58:14 keiji: maliciious software is being spread through digital advertising. Purpotrators are using programmatic buying methods and through it they are placing the malicious software on the web posing as digital ads 13:58:16 chriscla has joined #digimarketing 13:58:19 ktakeda: users can't control being tracked or not with persistent ID's 13:58:59 ktageda: ktageda: 3rd large problem is user data inspection (too much access to users' data) 14:00:22 ktakeda: and this user data inspection is without consent 14:00:27 ktakeda: DPI - Deep Pocket Inspection providers are not successful 14:00:57 ktakeda: an example is the use of users' phone contact list without their consent 14:01:22 ktageda: ktageda: 4th large antipattern is accidental data exposure 14:02:09 ktakeda: Many companies make the mistake of placing business and critical data on the same server/environment as the front end web servers 14:02:13 ktakeda: common problem: people have a large to: or cc: list when sending email 14:02:43 ktakeda: this opens the backend data and make it vulnerable to Google hacks 14:03:21 ktakeda: 5th largest problem: local optimum. focusing too narrowly on local markets. hard to generalize 14:03:26 ktakeda: Local Optimum should be avoided 14:04:42 ktakeda: yahoo is surprisingly strong in Japan for search at over 30% usage 14:06:09 ktaketa: twitter is popular in Japan because more content-per-character can be expressed in a single tweet 14:06:13 ktakeda: tumblr is suprisingly strong in social media in china: 55+% marketshare 14:07:32 takeda: standardization would help address these antipatterns 14:08:34 balajir: Does Television Viewership Predict Presidential Election Outcomes? 14:08:59 balaji: I do research in learning patterns from applications of data to online marketing for a long time. Clickstream data, recommender systems 14:09:31 balaji: This research started with collaboration with Nielsen here in Tampa. We were looking to get access to data Nielsen has 14:09:45 balaji: TV watch data, and also what people buy. Partnership: what can we do? 14:10:03 balaji: It's november 5 2012. The world is awaiting news on the next US president. Who will it be? 14:10:21 balaji: What if we had data on who watched what TV shows in the preceding weeks Oct 1 - Nov 5. Can we predict the outcome? 14:10:33 balaji: think data first: opportunistic question. 14:10:52 balaji: Working with Nielsen, pulled together data on 547 TV programs, 165 populated counties, 49 states 14:11:12 balaji: Balaji Padmanabhan is his name; I will use balaji: 14:11:35 marktorrance: reasonable name :-) 14:11:52 balaji: Took a year to analyze data, transformed to 2 variables per show. Minutes per voter, and % of fans. 14:14:28 balaji: 49 or 165 rows depending on state/country, 547 shows. this is called fat data because of high dimensionality 14:14:38 Aaron_Nightingale has joined #digimarketing 14:15:29 balaji: very painful to ensure data is collected correctly/accurately 14:15:56 balaji: high level findings: was able to rank the programs based on "signal strength" 14:16:13 balaji: able to rank 547 programs based on their signal strength in predicting outcomes. 14:16:31 balaji: very concerned about overfitting (machine learning/statistics jargon, where predictions are only applicable to training data set) 14:16:32 balaji: Based on a single show alone, achieved 82% accuracy at the state level and 75% accuracy at the county level 14:16:34 balajir: data have been validated with facebook dta science report 14:16:49 The night before elections, the strongest state-based model would have predicted 8 out of 10 "swing states" accurately 14:17:43 balaji: built 547 models instead of one big model 14:19:25 balaji: Most predictive show: "the daily show w Jon Stewart" 14:19:51 balaji: If minutes per voter is low (<9.63), then it predicts Republican 18 of 21 14:20:16 If it is high, then one more split on percentage of fans: if over 2.57%, then it predicts Democrat, otherwise Republican 14:21:36 balaji: describes a predictive model that will work before the election based on swing states 14:22:41 balaji: built the model on "safe states", and then used those to predict swing states. Got 8 out of 10 correct. 14:23:31 balaji: Second show is Duck Dynasty -- predicts republican voters 14:23:53 balaji: Duck Dynasty > 21 minutes = Republican 14:24:01 rrsagent, make minutes 14:24:01 I have made the request to generate http://www.w3.org/2015/09/17-digimarketing-minutes.html wseltzer 14:24:06 rrsagent, make logs public 14:24:22 balaji: because of few rows but thousands of columns, solved by building many, simpler models 14:24:55 balaji: "If you beat the data hard enough, it will confess to anything" 14:24:59 balaji: problem: by chance alone, you can find some models that are randomly going to do very well 14:25:41 Meeting: Web and Digital Marketing Convergence 14:25:45 balaji: Randomized outcome and built models to test whether model building method is leading to false conclusions 14:26:10 wseltzer_irc has joined #digimarketing 14:26:25 balaji: by chance alone, how many models would you get that are accurate. This is how to tell whether your model accuracy (results) are trustworthy. 14:27:00 Chair: Chad_Hage, Reza_Jalili 14:27:05 rrsagent, make minutes 14:27:05 I have made the request to generate http://www.w3.org/2015/09/17-digimarketing-minutes.html wseltzer 14:27:38 balaji: Redid this analysis at the DMA level. New great show "Fox & Friends" 14:28:29 (DMA: Designated market area) 14:28:38 s/ktaketa/ktakeda/G 14:29:47 balaji: Fox & Friends got almost all of the close DMAs perfectly, with 1 mistake 14:31:21 balaji: election ad.spending an interesting case for multi-platform targeting and digital/web marketing convergence 14:32:10 balaji: can we build something that is cross platform and makes it easy for users to opt-in? 14:32:21 balaji: geo-targeting. we need to know somebody's homebase 14:32:23 balaji: geo targeting -- we need to know where someone's home base is where they are voting. 14:32:31 balaji: but want to advertise to those people wherever they are. 14:32:43 balaji: geo-history? 14:32:52 balaji: location identification needs to be precise at the state, county and DMA level for instance. 14:33:17 balaji: Personalized + context-sensitive advertising 14:33:21 balaji: marketers care about the homebase of a user, not their exact current localtion necessarily 14:33:44 balaji: want to advertise cross-device. tv to mobile 14:33:45 balaji: suppose you can predict they are likely to be democrat or republican based on what they watched on TV -- can we then reach them in a personalized way on other devices? 14:34:19 balaji: but want to do this in a way that is privacy friendly and puts the user in control 14:35:58 BillScannell has joined #digimarketing 14:36:12 bhill2 has joined #digimarketing 14:36:48 Q: could you improve the model by focusing on certain counties that are more important to the state level political outcomes? 14:36:54 A: we are looking at things like that now 14:37:13 Q: what modeling technique? A: Classification trees 14:37:58 Q: Have you made any comparison with Twitter data? And on the classification schemes, have you got any metrics which identify how much each variable contributes to the effect of the prediction? 14:38:14 A: Different models have their own scores for variable significance. In this case we didn't do it because we had only 2 variable. 14:39:04 balaji: A: first question on Twitter -- one extension we're doing right now is pulling in Twitter data for 2012 season. Personally I think it is useful, but it is one of the sources that has intent + manipulation online. It concerns me that there is a lot of intentional pings -- some noise in addition to the signal 14:39:18 balaji: e.g. robots promoting shows 14:40:54 wseltzer: Keiji, do you think this kind of political prediction is a pattern, or an anti-pattern? 14:41:23 keiji: can't really say 14:42:19 Satyam / Nielsen: Q: What about local optimization? A: If we make it too much, we get bound to that specific environment. e.g. in Japan, cell phone companies did avoid to use cookie in 1st gen web on cell phone; so they used caller ID instead -- sent single unique unchangeable ID 14:42:49 keiji: by using that tech, the service providers got used to using that unique ID, so they are not ready to switch to more volatile IDs like cookie IDs 14:43:18 COFFEE BREAK 14:45:14 rrsagent, make minutes 14:45:14 I have made the request to generate http://www.w3.org/2015/09/17-digimarketing-minutes.html wseltzer 14:58:54 kaz_ho has joined #digimarketing 15:10:07 gnorcie has joined #digimarketing 15:10:10 chage: introduction to session2 from Chad Hage 15:10:31 chage: 3 presentations on Metrics and Data Collection 15:10:32 Topic: Session 2, Metrics and Data Collection 15:10:47 presenting, Jarrett Wold, Ad-ID 15:12:37 jwold: Ad-ID is a unique identifier, like a product code for advertising assets 15:12:40 marktorrance_ has joined #digimarketing 15:13:07 BrendanIAB has joined #digimarketing 15:14:34 jwold: unique identifier leads to interop, reduce human error 15:14:41 AdID is a unique identifier for advertising assets, such as the creative 15:17:04 BillScannell has joined #digimarketing 15:17:16 jwold: AdID is at the center of the transition to a digital ad slate, e.g. for a TV commercial. 15:17:39 jwold: the ad slate would include metadata about the asset, like what itunes does 15:17:50 jwold: embedded into files 15:18:09 jwold: Developed XMP Ad-ID schema with IAB and Adobe 15:20:19 jwold: Working with SMPTE on the explanation of what the schema represents, as a standard 15:20:27 jwold: Working with IAB on VAST 4.0 15:21:21 Ad-ID slides: https://www.w3.org/2015/digital-marketing-workshop/slides/Ad-ID-W3C.pptx 15:23:03 jwold: AdID getting good adoption on both broadcast TV and online video. Trying to push adoption in other areas like audio and internet display 15:24:02 jwold: Media Interoperability: register -> operationalize -> measure + report 15:24:32 jwold: All commercials produced for TV, radio + digital platforms that include SAG-AFTRA union members, must use Ad-ID 15:24:50 interesting strategy for pushing adoption of an up and coming standard 15:25:12 jwold: SMPTE / CIMM OpenID - detect identifier of what is airing, and then do with it what you like 15:26:07 jwold: uses watermarking, but identifier gets lost during compression. Working with SMPTE / CIMM to try to get the ID to survive compression 15:26:27 sel has joined #digimarketing 15:27:17 REZA: Browser Aware Data Collection 15:27:34 reza: Reza Jalili, I work at Adobe 15:27:46 Reza's slides: https://www.w3.org/2015/digital-marketing-workshop/slides/Adobe_w3c-browser-aware-data-collection.pdf 15:28:43 reza: collection done with in-page JS includes 15:28:55 reza: users have no control, browsers don't know 15:29:20 reza: problems: each library has its own name, semantics are different, endpoints are all different 15:30:09 reza: customer problem: data collection companies have trouble aggregating this data due to data being non-interoperable 15:31:15 reza: proposal: find out what is being collected, understand legal entities involved and privacy rules in place 15:31:29 reza: give control to the user 15:33:44 Chad Hage, Nielsen: https://www.w3.org/2015/digital-marketing-workshop/slides/measurable_by_design.pptx 15:33:59 SteveZ has joined #digimarketing 15:35:08 chage: more and more programmatic ad delivery techniques are emerging, because iit's not being done in a consistent way 15:35:11 Satya has joined #digimarketing 15:35:28 chage: How do I measure reach, since things are so tailored/personalized? 15:36:03 chage: how do we identify non-human traffic? 15:36:11 chage: Tomorrow is fast approaching. Non-human traffic will be an even bigger problem in the future, when we have so many more connected channels 15:36:29 chage: 10 billion devices on the web by 2020 15:36:44 chage: Need for measurable, 3rd party independent, reliable + consistent by design 15:37:12 chage: working groups that exist today, or that could be formed out of this, could get us to reliability by design 15:37:38 chage: Proposal: simplify the delivery of ads into content by extending HTML spec to include document elements that make it simpler on clients such as browsers to detect, identify, acquire, and render an ad 15:37:52 chage: Ensure that these specs address both human and legitimate non-human traffic 15:39:06 Q: Satya from Nielsen Catalina: I've been working with AdID for mobile. You are saying you have an ID to uniquely identify the creatives. Do you also distinguish whether it was designed to be shown on a particular type of device? And where was it shown? 15:39:17 satya: is the metadata extendable? 15:40:04 jwold: A: In our UI, it's up to the advertiser to tag the asset e.g. what type of media it is (tv billboard). We are just a registration authority. 15:40:14 jwold: we do not track where the ad gets displayed 15:41:13 jwold: extending the metadata: we have an intensive XML with many more fields than I showed on the digital slate. e.g. an ad trafficker can put in the ad start + end dates, who the talent is for that ad; something like 128 fields. 15:41:31 bhill2 has joined #digimarketing 15:42:11 a: for the digital slate, we extended our XML for that particular specification. That's now an industry standard. 15:44:08 iab: Q for Reza: if we take the data away from people by putting more controls on it instead of the "tag based free-for-all" buffet we have today, how do we make that acceptable to the industry? 15:44:52 A (reza): Great -- that worked in the colonial town, but now as we want the industry to grow, we can improve quality of the data by adding controls e.g. a port keeps track of who is coming in and out, and standard ways of tracking the data, wouldn't that be interesting? 15:45:20 Q: Chad raised the issue of personalization. How will AdID respond to personalization issue? 15:45:26 skjung has joined #digimarketing 15:45:50 Q: we are getting to the point where in principle every ad could be individualized. 15:46:07 A: Right now we don't do anytihng about personalization, the info is all about that particular asset 15:47:31 Q: In the interactive world, there could be multiple "assets" coming together for a particular interaction 15:47:45 A: If you have 5 jpg files or png files, we are tracking those particular assets, and it starts from the creative side. 15:48:16 reza; Steve's question touches on Chad's issue -- when every ad is just for you and the audience is audience-of-one, what are you measuring anyway? 15:50:28 Q: (from Mozilla) I'm working on some custom elements that report things, and it's early, but it seems to solve the problems you want solved; question is how this would get adopted by the ad industry 15:50:42 display ads have momentum -- even if the new tech existed, how does that get to market? 15:51:11 A: (chage): if we put out something that's better, I think adoption will be there. This ecosystem has not shown that it's rigid -- it is in fact overly dynamic 15:54:01 andrea: Q: Thinking about mobile apps, when you install on Android, it asks what data it can use. IN browsers they ask if we want to use geo location. Couldn't we do the same for certain other information e.g. name, email, etc.? They can have default settings for all sites, and can make exceptions for certain sites - it would only ask for the info it needs when you arrive at a paritcular page that needs certain data 15:55:04 chage: how will the experience work when we're on a big screen or some other situation? It is no longer just a browser 15:55:41 andrea: What is the benefit of using adid for web? 15:55:47 Sel has joined #digimarketing 15:56:52 jwold: take an ad that starts at the creative, it gets shipped off for delivery, throughout the supply chain. With AdID you create the metadata within the system and get a unique ID -- that will live throughout the ecosystem. Eliminating human intervention and rekeying of the metadata. 15:58:00 satyam: in last year, there has been 5-fold increase in mobile consumption of TV content. 15:58:18 satyam: so I want to keep it in sync, so I can measure the ROI across all devices 15:59:37 jwold: we havea plugin for adobe bridge, that lets you plug the ad id into an asset. Shows the power of using our APIs. 16:00:47 brad: I like the idea of making reporting and measurement more first-class platform citizen. I have similar thigns in my talk. The hard part is the economics. Want to put users in control, but if the first thing they do is turn everything off including telemetry, google analytics, etc. 16:01:16 then people will go back to their old way of doing things. Interesting to explore economic models so that users will feel it is worthwhile to be included in the exchange of value in the platform. 16:01:48 reza: I agree. How far on that continuum do we want to go? We may want to get to the interoperability, and it could just work in the browser, but there may not be a switch for the user to control it. 16:02:08 brad: the user-agent is the user's agent. Let's start from that as a first principle. 16:03:31 Koshek Duta: Q: from U So Korea faculty, but building mobile ad tech platform out of Singapore. A few points: 16:04:03 Didn't hear the term fraud so far, but need to be concerned about that. Have seen numbers that 50-98% fraud click. I've seen it happening on the click, where you are going to places where agents are devices 16:04:12 On data collection, attribution; need to think about this 16:04:29 After the advertisement, how do we collect the data so we can show value to campaign managers + brands 16:04:59 Other point is where the ad was delivered *is* important, because of attention span, size 16:06:03 Need to think of the advertisement as a program, interacting with another platform over HTTP protocol. How do we deliver the ad, measure it, avoid fraud, etc. -- service oriented architecture in enterprise platform is good model for this we can learn from. 16:08:53 Mark_Torrance: CTO at Rocket Fuel 16:09:05 ... the more metadata the better,the more descriptive, the better 16:09:23 ... I'd love if ads had data about people, color, length, relation info 16:09:35 ... e.g., this is the 15 second version, this is the longer version 16:09:40 ... standard taxonomies 16:10:01 ... re Standardization, worried that the more commonality we introduce 16:10:15 ... the more the ads look the same, will users block it all? 16:10:38 ... I'd like to take the position that the user agent is the user's agent, but history of marketing is about surprising people 16:11:05 ... we don't have standards for billboard shape 16:11:19 ... tension between user experience goals and goals of marketers 16:11:58 Brad: user agent as user's agent was a statmeent of fat 16:12:00 s/fat/fact/ 16:12:06 ^fat^fact 16:12:11 :) 16:13:06 Have you guys been thinking about annotating ads with the purpose of the campaign or what is the purpose the data is used for? 16:13:32 What about models where the behavioral data never leaves the browser, but still some targeting + measurement can be applied? 16:14:00 jwold: we've thought about that, for that metadata and what we are specializing in, it's a fine line in terms of what makes sense for that creative asset. 16:14:38 Juan_Carlos_Garcia has joined #digimarketing 16:15:03 chage: there's a layer of data that gets added on top that explains what the purpose/intent of the advertising is. Today, we're looking at it like "this is the introduction of the brand" -- we infer a lot of things that we can deduce, but would love that to come into the actual stream and have it be more factual rather than deduction 16:15:27 david: Q: Please explain more about opportunities HTML enhancements can have for the browser, e.g. AdFrame? 16:15:48 chage: I'd love to look at any frame that is actually consistent and reliable + repeatable -- could produce measurement off of it 16:16:22 ... the way the existing tech stack is being used is so different -- even the same user does not get the same iframe every time. I want the consistency that specs have brought to other parts of the HTML paradigm. 16:18:52 ash from webops: Before we solve viewability, we have to be sure it is a human at the other end of the wire. 16:19:38 ... there are lots of other efforts; organizations like TAG are barreling forward aggressively with standards they are pushing. TAG is about to charge everyone $10k to identify themselves, and it's not a great standard. 16:19:55 ... any bad guy who wants to pay $10k is now in the whitelist 16:20:32 Point of correction on the TAG registration: 16:20:51 greg: one thing I heard is that if users turned off the ads they would. Companies could have followed do not track. Do advertisers actually want to give users choices? How can we create a situation -- if you are not viewing the ads we're serving then you won't get to see the rest of the site. 16:20:56 10k is the proposed price for validated registration - companies that are checked to be sure that they exist. 16:21:52 reza: there's policy and philosophy. We want to have a standards way for companies that want to be compliant so they can do that. We hope to come up with standards that allow flexible implementation on top of that. 16:22:17 The working group (public for anyone to join) is considering a very low fee for non-validated registration, 16:23:24 And validation is independent of certification (knowing whether a company is adhering to guidance on anti-fraud, anti-malware, anti-piracy efforts) 16:23:32 brad: question for everyone here. How many people run ad blocking software on their own browser? 16:23:39 a: about 15% 16:24:29 s/brad:/Brad_Lawrence:/ 16:24:40 brad: I run it to avoid 0-day exploits, and data consumption on the mobile space. That's what hurts the consumer. There was a small group of people very motivated by philosophical reasons for DNT, 16:25:00 ... when I look at my extended family who are tech savvy, they are not mostly wanting to DNT 16:25:18 ... tech people are telling our friends to use ad blocking, because we want them to avoid malware. 16:26:49 francis: if users don't have a granular choice, like "I'm willing to accept ads but only if they don't violate my privacy", then they will just go for a coarse choice like ad blocking. 16:27:20 s/francis/GregN/ 16:27:39 brad: In TV advertising, people worried TiVo would cripple advertising, but the opposite happened because it is mostly a passive medium 16:28:31 olivier (Firefox): I'm glad to hear us talking about this. People don't mind ads, and sometimes find them useful. Adwords is incredibly useful for many people. 16:28:56 ... The problem is not that they are ads, the problem is they don't know why they are seeing the ads, sometimes they are obtrusive, they didn't have a say, and don't know why they are being forced to see it. 16:29:45 ... the fact we can target + involve the user in communication is useful -- a male user could go to a website that sells clothes -- they could volunteer they are Male that could help the website know that so they can tailor the content. 16:30:09 reza: note that adblockers can have the business model of knowing lots of data about users and selling it. 16:31:04 chage: make the experiences delightful and users will want to come back. The economies of marketing are being discussed; what's been left behind before this conference is the technical aspect of it. 16:31:59 brad weltman IAB: comments. 16:32:53 ... "we always assume the gears will just work" -- the inverse is true in this room. You can't just take a technical solution and layer it on top -- we have to keep consumers and economics in mind too. Consumers want choice, and want to be involved, but they have to be not too annoyed. They won't want choice at every junction. 16:33:23 AshKalb has joined #digimarketing 16:33:28 LUNCH BREAK 17:35:05 keiji has joined #digimarketing 17:35:27 skjung has joined #digimarketing 17:36:15 bhill2 has joined #digimarketing 17:36:39 BillScannell has joined #digimarketing 17:37:16 BrendanIAB has joined #digimarketing 17:37:45 BACK FROM LUNCH 17:37:58 Session 3: Security and Viewability 17:39:40 Topic: Security and Viewability 17:39:54 Ash: fraud, Brad: malvertising, Olivier + Brendan: human security, Mark: viewability, one more 17:39:59 Sel has joined #digimarketing 17:40:21 Ash Kalb: Fraud 17:40:56 Ash: We are secuity company as well as measurment company. 17:41:18 tmichalareas has joined #digimarketing 17:41:43 cclark: introduction to security and viewability session 17:42:03 Ash Kalb slides: http://www.w3.org/2015/digital-marketing-workshop/slides/WO-W3C-ABK-20150917.pptx 17:42:26 Ash: advertising is about buying a slice of human attention 17:43:02 Ash: botnets are resident on computer 17:43:09 Ash: a clone of you. infinite number of scams 17:43:15 Bot nets have been used for raud, bot net, click fraud are being used to monetize. 17:43:24 Ash: Bot nets have been used for raud, bot net, click fraud are being used to monetize. 17:43:28 Ash: 5b USD annualy are attributed to fraud related to advertising 17:43:41 s/raud/fraud/ 17:43:43 Ash: scam is: paid as a publisher for running ads 17:43:48 s/raud/fraud/ 17:45:12 Ash: More sophisticated frauds are being introduce and generate traffic. 17:45:57 Ash: ad-fraud is the best way to monetize malware 17:46:16 Ash: This kind fraud motivate attacker to attack to people's computer. 17:46:42 Brad:I am new to this area. 17:47:30 Brad: But is is interesting area. It has very complex structure. 17:47:49 Brad: there are problems in the ad industry that could make it unravel 17:48:03 Brad: web based on trust. malvertising is catastrophic for this model 17:48:19 Brad: Malvertising collapses the boundaries between good and bad. 17:48:43 Brad: Malvertising is making ad blocking as essential as anti-viruses 17:49:13 chadhage has joined #digimarketing 17:49:19 Brad: publishers have to trust advertisers and ad networks 17:49:39 Brad: they don't really trust them, but most don't have enough power to demand better security 17:49:51 Brad: Advertisers and ad networks don't trust publishers 17:50:09 Brad: we need to improve the platform, less trust, more guarantees 17:51:04 Brad: if you can't sandbox it, you must be able to analyze it, if you can't analyze it, you must be able to sandbox it 17:51:11 Brad: If you can't asnbox it you must analyze it. 17:51:39 Brad: some approaches: ad "stitching". inline ads with publisher content on the server-side 17:51:48 Brad: Ad "Stitching" happens today many places. 17:51:58 Brad: this is completely nuts from a security standpoint 17:52:44 Brad: when is stiching OK? image/video + text. simple model, no script, no flash, no xhr, no cookies 17:52:46 Brad: It's not sandboxed at all you have to analyze it. 17:52:52 Brad: have to trust facebook that the ad has been seen 17:54:00 Brad: another angle is iframes and sandboxing. still had lots of hurdles to make it work with what people have wanted, e.g. working with plugins 17:54:11 Brad: maybe it's time to revisit iframe sandbox 17:54:18 Brad: iframes and sanboxing. Strong isolation; enforcing what content is hown and where links to go is still difficult. 17:54:24 Brad: Few have wanted to use it. 17:54:25 Brad: hybrids: analysis + sandboxing 17:55:10 Brad: no standard yet 17:55:10 Brad: propose an approach ad nework hybrids (Analysis + Sandboxing together) 17:55:23 Brad: still hard to do independent measurements 17:55:40 Brad: Cam WebAppSec WG help? 17:56:03 Brad: we work on Iron frame 17:56:09 Brad: should independent measurement and audit be a first-class citizen in the web platform? 17:56:39 Brad: scripts in a membrane? like a chrome extension? 17:56:47 Satya has joined #digimarketing 17:56:47 Brad: Declarative reporting like CSP. 17:57:12 Olivier: Let’s encrypt 17:57:26 Brand: Olivier: https is a good think to use 17:57:33 Olivier's slides: https://www.w3.org/2015/digital-marketing-workshop/slides/oyiptong_letsencrypt.pdf 17:57:43 Olivier:talks about encryption https 17:58:26 i/Brad: I am new/Brad Hill's slides (group deck); http://www.w3.org/2015/digital-marketing-workshop/slides/security-viewability-digital-marketing.pptx 17:58:43 Olivier: Privacy matter 17:59:23 Olivier: firesheep example that harvested cookies 17:59:24 AshKalb has joined #digimarketing 17:59:50 Olivier: Public commnication Firesheep is a tool to capture cookies sent through clea text and to hijack sessions. 18:00:33 Olivier: cases Google, AT&T 18:01:29 Olivier: Verizon: Perma-Cookie, Verizon-ID can link cookies used in past. 18:02:07 Olivier: XFINITTY Wifi inject javascript on web contents watched by user. 18:03:17 Olivier: in China there was injection of javascript to Baidu user used for DDoS. 18:04:13 Olivier: China there was DNS chashe poisoning. 18:05:16 Olivier: HTTPS isn't perfect, but it's better than HTTP 18:05:33 livier: HTTPs is better on Encryption, Data integrity, authentication than HTTP. 18:06:34 Olivier: Mozilla - new features are not accessible to HTTP only HTTPS 18:08:16 Olivier: htts is the way to go forward to avoid security issues 18:09:00 Brendan: Human security, talks two topics. 18:09:37 Brendan: We needs secure communication with https. 18:09:38 Brendan's slides are also in http://www.w3.org/2015/digital-marketing-workshop/slides/security-viewability-digital-marketing.pptx 18:09:45 rrsagent, make minutes 18:09:45 I have made the request to generate http://www.w3.org/2015/09/17-digimarketing-minutes.html wseltzer 18:10:19 Brendan: describing the advertising industry tree 18:10:41 Brendan: Advertise industry has a tree structure. 18:11:16 Brendan: If you talk in secure channel you would have less people. 18:11:33 Brendan: HTTPS is on the way to go. 18:11:53 Brendan: Reducing the 3rd parties to use for advertising reduces the opportunities for snooping 18:12:08 Brendan: There was some resitance. 18:12:26 Brendan: IABtech lab is developing an ad tech https implementer's guide 18:13:27 Brendan: Server Side At Insertion, insertion in the middle of commnication is bad. 18:13:54 Brendan: audio/video ad.insertion makes sense 18:14:47 Brendan: We are developing function to accept ad from different places then integrate them. 18:15:11 s/At Insertion/ad insertion/ 18:15:51 Brendan: Building trust with an increase number of 3rd parties is expensive 18:15:51 Agenda: http://www.w3.org/2015/digital-marketing-workshop/agenda.html 18:16:09 Brendan: Operators have small number of ad networks to trust. 18:17:44 Brendan: If I profile sites I may be able to make more value on ad. 18:18:02 Brendan: server ad-insertion reduces transparency for the end-users 18:18:58 Brendan: IAB and tech lab works to solve such issues. 18:19:10 marktorrance_: going to talk about viewability 18:19:19 Mark: Rocket Fuel tries to show ads to the right users based on machine learning 18:20:52 marktorrance_: customers look for proxies of what they are looking for 18:20:52 Mark: In Direct response campaigns marketers can figure out ROI based on the evaluation of sales 18:21:16 marktorrance_: looking to avoid waste: fraud and to avoid when an ad hasn't been seen 18:21:31 marktorrance_: Group M has come out for its own standard for video 18:22:02 MRC developed and issued the Videwability standard, IAB was a participant in the development. 18:22:48 marktorrance_: We need to manage different standards different ads now. 18:22:48 marktorrance_: with all those different standards for viewability, it's important to be able to measure delivery, by publisher and by third-party audits 18:22:55 marktorrance_: there are a of of trackers, and they all have reasons to be there. they want partners to be audited 18:23:10 marktorrance_: non-viewable impressions are lumped together with botnet fraud 18:23:31 marktorrance_: challenge for rocketfuel is that they had to bid to even display the ad 18:23:42 marktorrance_: sold at the time the page is rendered, not when the page is scrolled down 18:23:57 marktorrance_: asks: change it on the publisher side, to only bid when the ad is into view 18:24:14 marktorrance_: would decrease the time to load the page. let's not sell the ad if it's not viewable 18:24:45 marktorrance_: hard to know if an ad is viewable because of nested iframes. hard to know where it has been served or the geometry 18:25:07 marktorrance_: ironframe tries to do this maybe 18:25:42 marktorrance_: want the ability to answer: what is the site i'm on, what is the chain of sites from the site to me? 18:25:50 marktorrance_: ancestor origin in chrome is good 18:25:51 marktorrance_: We have nestaed iframe. We need to method to detect bad publisher inside. 18:26:15 marktorrance_: another is the geometry 18:27:05 marktorrance_: We have a way to present limited range of data can be shared with advertiser. 18:27:39 dan: we're not the bad guys 18:27:59 dan: working on ironframe 18:28:03 Dan: We are here in Tampa we are not bad guy. 18:28:30 Dan: I have broken most of browser in various ways. 18:28:34 s/in Tampa/in Tampa and not on a yacht,/ 18:29:14 Dan: is woking to develop iron frame. 18:29:30 dan: separate viewability in two things: natural viewability (below the fold) and absolute viewability 18:30:46 dan: another name for the viewability problem is clickjacking 18:30:54 Dan: Viewability issue has another problem on click jacking. 18:31:50 dan: retweet shows a popup because the only way to ensure authenticity has been a popup 18:35:54 Brendan: Attribution modeling is difficut to do right. 18:36:16 Brendan: To measure ROI we need right Attribution modeling. 18:36:50 Ash: For bot net it is easy to make fake click. 18:39:06 ???: HTTPS I have developed on of biggest DSP, as engineer using https for large traffic is night mare. 18:39:58 Brendan: Is challenge now as the browser improve it would become possible. 18:40:00 BillScannell has joined #digimarketing 18:41:09 Brad: HTTP2 is great if you use it is simply model but does not work in your model. 18:41:38 oyiptong: https://istlsfastyet.com/ 18:42:54 Dan: Huge night mare is most people can not properly configure crypt stuff. 18:45:59 Satya: How do you attribute if device change there user? 18:46:12 s/there/their/ 18:47:46 marktorrance_: matching user-households to panel data ~97% accurate on Rocket Fuel data 18:50:01 chrisclark: how important is functionality of script/display as compared to measurement accuracy? 18:50:26 BrendanIAB: it's important to reach media, e.g. video player 18:50:34 s/measurement accuracy/data collection/ 18:51:17 BrendanIAB: market differentiation, features around rich media interaction 18:51:41 ... VPAID, when an ad pops over the video, the video pauses 18:51:54 ... so you can order your movie tickets and go back to the trailer 18:52:11 marktorrance_: other than sending metrics back, another reason for scripting is bot determination 18:52:26 ... that's not going to be solved by taking away ability to run programs 18:52:47 BradHill: I'm not for taking away JS; what does the right sandbox or isolation mechanism look like? 18:53:15 dankaminsky: flash actually has a well-developed sandbox 18:53:32 BrendanIAB: IAB guidance on rich media no longer includes flash 18:54:00 BradHill: mobile, chrome, FF making it click-to-play, turning it off during the last zero day 18:54:17 dankaminsky: Google is doing dynamic translation from fflash to HTML5 18:54:28 BrendanIAB: Adobe's publishing tools export to HTML5 18:54:56