Brendan Eich, founder of Brave and creator of JavaScript, joined the show to talk about the history of the web, how it has been funded, and the backstory on the early browser wars and emerging monetization models. We also talked about why big problems are hard to solve for the Internet and the tradeoffs between centralization and distribution.
Brendan Eich: [35:47] Yeah, so thatâs the really radical idea, and itâs not fully implemented. Brave, with the right opt-in - we wouldnât wanna surprise users with this, but Brave should be your personal Google; it should be your personal data set and machine learning, which adds value to the data.
You know how people say âFacebook sells your dataâ? They donât, because if they did, it would all get quickly arbitraged to a low price, and itâs seasonal enough, thereâs enough repeated behavior among users that it wouldnât be necessary for them to keep selling it. It would be extracted and in bulk. Facebook doesnât sell all your data. What they do is they say âCome onto our platform and do adsâ, or âCome onto our platform and transact in a very limited way with the data.â Thatâs what Google does with the web. Google is a really brilliant, once-in-a-generation business. They started with search ads - very clean, because when youâre searching, you have strong intent, youâre looking for something, youâre willing to see a promotion, especially if itâs algorithmically well-placed. It could be better than the organic results that Altavista would have found in â98. Thatâs why Google started rising fast then, and they did search ads even then; they were making enough money they got the famous angel investment from Andreas Bechtolsheim. He asked them, âHow do you make money?â and Sergey said âPlaced results, search ads.â Andreas said, âIâm using Altavista, but they get tricked by pages that put a little dictionary in the HTML comment, and suddenly that page is authoritative for every word in that dictionary, and they get undue search rank in Altavista. What do you do about that?â Larry Page said, âOh, we take care of that because we count incoming links to do reputation, pagerank.â Then Andreas said, âHow much are you making?â This was like â98, when Sergey and Larry were still I think on Stanford campus. They said, âA hundred thousand a month and growingâ, and Andreas said, âLet me go to my car and get my checkbookâ, and he wrote a famous angel investment check which paid off very well.
That search ad business is still strong for Google, but search is kind of flattening out. The smartphone is less of a searchy device, itâs more of a social and bespoke search, or custom app experience. Voice is rising, AI is changing things⌠Search is flattening. Itâs gonna be a challenge for Google to keep satisfying Wall-Streetâs needs as a public company.
Google also did something clever - in 2008 they bought DoubleClick, because they saw if you didnât convert all those search ads on the search engine result page, those quality texty result up top that were clearly identified at ads, but sometimes could be better than the organic results â if you didnât click on those, you went off into the organic results, and you visited publisher sites and ecommerce sites⌠You kind of got distracted and surfed a bit for fun, celebrity-stalked somebody a bit⌠Then you came back to your major purchase, but maybe you did it through an ecommerce site and Google had no piece of that action. So they bought DoubleClick, because DoubleClick had a display ad business. They were all over publisher sites, they were on a lot of ecommerce sites. And they had cookies, they could be audience profiles by tracking people across sites.
[38:59] That gave Google a more complete model of the user, from search, through browsing to various sites that DoubleClick had cookies on or other footprint on, and Googleâs been integrating things ever since - YouTubeâs gotten big⌠In some way theyâre the web, eating their own ecosystem, but theyâre also getting a more complete user model.
I think you may have seen, even Chrome will now be mixing your history into the advertising model if you donât opt out, I believe. Powerful business, but itâs got some downsides. Increasingly, Google and Facebook own 90 cents of every marginal ad dollar spent. Every extra ad dollar being spent this year above last year, 90 cents out of it goes to Google and Facebook. And thatâs not a stable setting, even if you donât mind those two being the new duopoly on search and ads, or social and ads, because Facebookâs coming after Google, and Googleâs search business is flat. So thereâs a problem there.
Also, thereâs a huge privacy problem. People just donât like being tracked that way. They get retargeted by bad ads, they get creepy ads, ads that make your eyes bleed, parasite pictures, belly fat reducers, wrinkle reducers⌠And they get malware now. Malware is actually being placed, and has been for a few years. This is kind of an under-reported story, because a lot of it works by being ransomware - it holds your PC hostage, encrypts the disk and says, âHereâs how buy Bitcoin and send Bitcoinâ, and it charges not too much. So grandma paid $600 or $1,200 to get her pictures back of her grandchildren, and sheâs too embarrassed to admit it.
There was a hospital in Southern California where all the systems in the hospital were thrown by ransomware. That gets you more on the FBI and Interpol radar, but these are criminal gangs hiding in nation-states that donât necessarily prosecute them. Theyâre using very sophisticated exploit kits; thatâs the payload that downloads and tries a bunch of vulnerabilities.
The ones we know about from the last year and a half, Angler in particular, used Flash and Silverlight and Java plugin vulnerabilities. Brave turns off plugins by default. The plugins should die, Steve Jobs was right. Thoughts on music - he was right about DRM; thoughts on Flash - he was right about Flash. God bless Steve Jobs. [laughter]
Iâm not gonna endorse everything he ever did, but he did two solid things there for the web and for security. These exploit kits now are trying browser vulnerabilities. Iâm pretty sure Neutrino is the one that superseded Angler and itâs trying browser vulnerabilities, because every sophisticated endpoint software is endlessly vulnerable, and you have to keep patching it. Thatâs what Chrome does, thatâs what Firefox does, thatâs what Microsoft does now⌠It was one of the lessons of the last 15 years in browsers, that you have to release all the time to keep ahead of the exploits. You have to fuzz-test your codebase with travesty JavaScript-generated JavaScript that finds all the safety bugs.
[42:01] These exploit kits are out there, and theyâre coming in through ad exchanges. How do they do it? They actually create fake ad agencies. These are fake businesses, with fake CEOs and CMOs, fake people pictures, bios, and they go and buy ads⌠They put custom creative ads into ad exchanges. They pay the fees to get into the exchange, and then in real-time bidding processes automated ad exchanges place these ads on publisher pages, sometimes even gateway to other exchanges. They get onto a Chrome ad exchange at a low price, but they can claim to guarantee some conversion or some performance to the publisher who wants to sell the ad space for the ad. And the publishers fall for this every time, because they wanna fill out every space they can with ads, even at the bottom of the page, where the parasite pictures are. And they generally donât directly sell that to brands or agencies; itâs not good space, so they say âOh sure, programmatic ad partner. Come on in and own my space and put whatever you want in there.â Programmatic means automated, if it means anything. So he goes and says âOkay, letâs use this ad exchangeâŚâ Itâs AOL, or OpenEx or Yahoo!âŚ
Pretty soon, you donât know where those ads are coming from. Theyâre coming from Russia, but they look like legitimate ads. And hereâs the crazy thing - sometimes if you scan their JavaScript, they all come with JavaScript, for tracking pixels to confirm that the ad was viewed, things like that. You donât see anything overtly bad; you might see some funny little image, a processing loop that maybe is commented innocuously look like itâs doing something to do gamma correction on the image. What itâs actually is taking a graphic decoding of an exploit kit loader from image pixel perturbations. In other words, itâs taken out of the hiding, some kind of signal, a covert message in an image or a picture is being done to hide the guilty code thatâs gonna load the Angler exploit kit.
This leads to the New York Times, BBC, AOL and other top sites in late March having ransomware malvertising on their properties. If you think about it, this is actually an outrage, right? Why should world-class online publishers tolerate this? Why should they not control the quality of the ads. Why shouldnât they have only direct, trusted relationships? Well, as I say, the bottom of the fold, and even the middle of the fold (middle of the page) ad spaces just arenât as valuable as the top, and even big publishers that have direct sales forces and their own tech teams and do beautiful, custom sponsorship adsâŚ
[44:48] My favorite example, Louis Vuitton handbags on Elle.com. That takes up the bottom half of the frontpage, it looks nice, itâs a trustworthy ad as far as I know - thereâs very little third party about it; thereâs some tracking⌠Itâs a custom video ad from Questra or somebody, but itâs pretty legit. Thatâs not the problem. Itâs the stuff below that that all the publishers want to fill their space and make a little bit of money. Otherwise, if they leave the space dead, theyâre just leaving money on the table. And that leads to malware coming on the pages.
To get back to Brave, we saw this coming. We said ad blocking - even in 2015 when we started - was rising. We started May 2015. We didnât know that iOS, thanks to Tim Cook, would start making ad blocking easy to use with Safari. They make it an app install model, instead of a browser extension model. They make it content blocking, and it rose quickly to the top of the app store last fall and it became very popular until it saturated short-term demand, and it changed the whole conversation. It made people across the ecosystem - from the marketers who spend on advertising, to the publishers who rely on whatever of that spend is left after all the middle players and the parasites have taken their skim - it made everybody say âOh no, ad blocking is not going away. Itâs not just AdBlock Plus or uBlock Origin. Now itâs iOS. Itâs Apple. And Apple had walked away from advertising as a business I think twice. But it wasnât just because ads are annoying or unaesthetic; thatâs a very shallow way to characterize it. Ads are actually dangerous, because theyâre over delegated through these ad exchanges, and thereâs no contractual relationship.
Doug Crockford knew this. If you remember Dougâs work at Yahoo! with AdSafe, which was a static verifier for JavaScript and was kind of like before Google Caja, which became Secure EcmaScript, AdSafe was Dougâs very picky way of trying to get Yahoo! ads not to contain malware. This has been a longstanding problem, and as I said, itâs under-reported because ransomware - the price the criminals extract is low enough people are embarrassed and they can pay it, get their system back⌠Itâs very hard to track these criminals down. But even ignoring the ransomware threat, just the privacy problem that your data profile is constantly being sucked out of your machine and youâre not benefitting from it, youâre actually suffering from increasingly worse ads, even ignoring the malware; just annoying ads. Retargeting, which is when you get hammered by an ad youâve already seen⌠Because it sometimes nags you into buying something you wouldnât, or in the best case reminds you of something you forgot you do wanna buy. It has a little bit of lift, like a fraction of a percent, and that means that itâs gonna get done; itâs not gonna be left on the table. That money is not gonna be left on the table.
So advertising has become this toxic parasite system, in my opinion. Itâs over delegated, thereâs too much principal versus agent conflict of interest, there are layers of that, and along with that, there are layers of confirmation bias in the data thatâs extracted in the model.
[47:54] They say they have great data, all these ad tech companies; they wanna go public or they wanna get bought by Oracle, and they say they have magnificent data which will increase yield. But if you look year to year, the actual performance of advertising, the so-called yield, doesnât really go up. Money just goes from one pocket to a different pocket. Publishers are still suffering, and there are long-term negative externalities, like secular trends that are bad for everybody, like the rise of ad blocking and the rise of malvertising.
Brave is trying to address this, but not just - Iâm being very negative here - weâre not just gonna cure something thatâs bad; we wanna make things actively better. We wanna make this anti-Google, personal Google. We want you to be in charge of your data, and that means not only should you not have bad ads or annoying ads or dangerous ads, you should have a piece of the action. You should get revenue, you should be able to control the terms of the economics. And if you donât want ads, you can donate, and then you can block guilt-free.