Order of the Bath

When we build web sites we don’t necessarily create all the content ourselves. For various reasons we might subcontract out parts of it to third parties. Some examples are banner advertising and external widgets such as page counters and other statistics. In each case the code we insert on behalf of the third party pulls in content from their web servers and we have little control over it.

Now you might imagine that the big advertising company that you are signed up with have their reputation to consider and would only serve you good banners but it is not as simple as that. They sell on advertising space (syndicate) to other companies. The person visiting your site may be in another country; the code can tell that and will adjust the response accordingly; that is called geo-targeting. Now the agency doesn’t necessarily have material for that country so they contract out to yet another company to do it for them. This can happen many times before the advert is delivered, sometimes on a geographical basis, sometimes on a share arrangement—all without you knowing anything about it. You trusted the original supplier, and they trusted their subcontractor but it is getting a bit thin by the time the eventual supplier is reached and it is not uncommon for that one to be sending a virus or spy-ware to your customer. Yes, they are still your customer and will hold you responsible for what happens.

The other example I suggested was page counters, they are useless but small site owners still seem to like them. There used to be hundreds of different ones around but I haven’t looked recently. Some of these go out of business or get bought out without you knowing. The web address may have lapsed and been snapped up by someone else. This new owner could be using it for anything—including sending mal-ware to your visitors. When was the last time you looked at that page counter? Is it still doing what you though it was?

There are two good, but rather technical, reports linked to from this Google Blog that you should read if you think you may be affected by this.

This entry was posted on 12 Feb 2008 at 14:13 by Rick and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.