Archive for the ‘broken’ Category

Don’t let the lawyers run the business

Monday, August 17th, 2009

This past weekend, my sysadmin ( James Sparenberg ) and I, were figuring out which cloud hosting service to use. We had been pitched a number of times by GoGrid. I had been given a “try us out” credit by the very pleasant sales person. I was going through the process of signing up.

  1. name (check)
  2. company (check)
  3. address (check)
  4. read the Acceptable Use Policy, Beta Agreement and the Terms of Service… uh, oh

Beta Agreement:

2.  You will not disclose any Confidential Information to a third party, including without limitation a GoGrid Competitor, or use it for any purpose other than to facilitate beta testing.  However, you may disclose Confidential Information to the extent required by law, provided you give GoGrid advanced notice reasonably sufficient to allow it to contest such disclosure.  “Confidential Information” refers to any information regarding the Service unless such information is: (a) provided at the GoGrid Website (http://www.gogrid.com) and made available to Internet users without an account or password; (b) already publicly known other than through your act or omission; or (c) made available by GoGrid to customers of the Service after beta testing and after the official public launch of the Service.

3.  You agree that violation of the provisions of this Beta Agreement might cause GoGrid irreparable injury, for which monetary damages would not provide adequate compensation, and that in addition to any other remedies available, GoGrid will be entitled to injunctive relief against such breach or threatened breach, without the necessity of proving actual damages.

Danger, Will Robinson, Danger. At GoGrid’s sole discretion, they can go after me for lots of money and high-legal fees. According to a strict reading of this agreement, my balance and usage information is GoGrid’s confidential information.

It gets worse with GoGrid’s Acceptable Use Policy

A. The following activities are expressly prohibited:
2. Intellectual property infringement, including violations of copyright, trademark, and patent rights, and use or distribution of pirated software.

B. Disruptions & security:
GoGrid may suspend Service in whole or in part if it reasonably suspects an AUP violation. Customer will reimburse GoGrid for any expenses resulting from Customer’s violation of the AUP, including attorneys’ fees. GoGrid may also disable Customer’s service if GoGrid suspects that such service is the target of an attack or in any way interferes with services provided to other customers, even if Customer is not at fault. GoGrid does not issue refunds for terminating service due to any of the causes above.

So if GoGrid gets any sort of DMCA notice, legitimate or not, GoGrid can decide to take company’s website offline without compensation. If an Amplafi user is abusing the service, GoGrid will shutdown our entire service.

This arbitrary exposure to business disruption is unacceptable. If any corporate officer agreed to these terms I would fire them.

GoGrid’s (unacceptable) Terms of Service:

4. Acceptable Use.

(ii) Notwithstanding any provision to the contrary in this Agreement, and without limiting any of GoGrid’s rights or remedies, GoGrid may suspend Service in whole or in part in the event that GoGrid reasonably suspects an AUP violation. Reasonable suspicion pursuant to the preceding sentence includes, without limitation, a third party notice or claim that Customer’s use of the Service infringes on third party rights. GoGrid will make reasonable efforts to notify Customer before any such suspension, unless the AUP violation calls for immediate action to prevent injury or liability, in GoGrid’s opinion and at its sole discretion. Suspension pursuant to this Subsection 4(a)(ii) may continue so long as GoGrid reasonably suspects an AUP violation. GoGrid is not liable for any Service suspension authorized by this Subsection 4(a)(ii), or for any related loss, even if the suspected AUP violation did not occur.

GoGrid will shutdown Amplafi’s website for any reason at all. “Reasonable effort to notify” is not defined and is highly subject to interpretation.

6. Maintenance & Security.
GoGrid is not responsible for providing physical access to or copies of software, data, or content stored on GoGrid’s equipment under any circumstances and is not required to provide network access (i) after any termination or suspension of Customer’s Service or (ii) in the event of hardware failure, abuse by hackers or other third parties, improper administration by Customer, or other interruption of network access.

GoGrid will shutdown an account for arbitrary reasons and then discard all customer data…. if this is a day that ends in a ‘y’.

8. Warranties, Disclaimers, & Limitations of Liability.
(b) GOGRID WILL NOT BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, PUNITIVE, OR MULTIPLE DAMAGES, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. GOGRID’S MAXIMUM LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL AMOUNT OF FEES PAID BY CUSTOMER DURING THE 12 MONTHS PRECEDING THE INJURY GIVING RISE TO THE CLAIM.

And you can’t do squat about it.

Sorry! No sale!

We decided to go with Rackspace.

Rackspace (reasonable!) Terms of Service

7. Law/AUP. You agree to use the Services in compliance with applicable law and our AUP, which is incorporated by reference in the Terms of Service. You agree that Rackspace may, in its reasonable commercial judgment consistent with industry standards, amend the AUP from time to time to further detail or describe reasonable restrictions and conditions on your use of the Services. Amendments to the AUP are effective on the earlier of our notice to you that an amendment has been made, or the first day of the next Renewal Term. You agree to cooperate with our reasonable investigation of any suspected violation of the AUP. In the event of a dispute between the parties regarding interpretation of the AUP, our commercially reasonable interpretation of the AUP shall prevail.

Wow! A ToS requires that the Customer be proactively notified!

8. Your Information. You represent and warrant to Rackspace that (i) all information you provide to Rackspace for purposes of establishing and maintaining the Services is accurate; (ii) if you are an individual, you are at least eighteen years of age; (iii) you will not use the Services for the development, design, manufacture, production, stockpiling, or use of nuclear, chemical or biological weapons, weapons of mass destruction, or missiles in any country listed in Country Groups D:4 and D:3 of Supplement No. 1 to Part 740 of the United States Export Administration Regulations, and (iv) you will not provide access to the Services to any person (including a natural person or government or private entity) located in or a national of embargoed or highly restricted country under United States Export Regulations, which include as of June, 2008, Cuba, Iran, Iraq, Libya, North Korea, Sudan, or Syria. You agree that Rackspace may, without notice and without liability to you report to the appropriate governmental authorities any conduct by you or any of your EUs that Rackspace reasonably believes violates applicable law, and provide any information that it has about you and your EUs in response to a formal or informal request from a law enforcement or government agency or in response to a formal request in a civil action that on its face meets the requirements for such a request.

Notice the last line, the request must be official — not just some sort of automated DMCA notice generated by a spambot in Hollywood.

12. Suspension/Termination.
(a) Suspension of Services. You agree that Rackspace may suspend the Services if: (i) Rackspace reasonably believes that the Services are being used in violation of the AUP; (ii) you fail to cooperate with any reasonable investigation of any suspected violation of the AUP; (iii) Rackspace reasonably believes that suspension of the Services is necessary to protect its network or its other customers, (iv) as required by a law enforcement or government agency, or (v) if the Card cannot be charged for payment in accordance with Section 5. You agree to pay a reasonable fee for reinstatement (“Reinstatement Fee”) following any suspension.
(b) Termination by You. The Terms of Service may be terminated by you at any time as long as all Fees then due together with unpaid Recurring Fees for the remainder of the Initial Term or the Renewal Term, as the case may be, are fully paid on the business day following the termination date.
(c) Termination by Rackspace. The Terms of Service may be terminated by Rackspace prior to the expiration of the Initial Term or any Renewal Term without liability as follows: (i) upon seventy-two (72) hours notice if you are overdue on the payment of any Fee; (ii) you materially violate any provision of the Terms of Service or the AUP, and fail to cure the violation within ten (10) days after receipt of a written notice from Rackspace describing the violation in reasonable detail in our sole discretion; (iii) upon twenty-four (24) hours notice if the Services are used in violation of a material term of the AUP more than once, or (iv) upon twenty-four (24) hours notice if you violate Section 8 (Your Information).

Notice the explicit difference between GoGrid’s termination policy and Rackspace. Rackspace says that they will suspend unilaterally. GoGrid goes right to termination. Rackspace explicitly lists out timeframes. Rackspace imposes a 10-day advanced written notification requirement upon themselves. Furthermore, Rackspace requires that the violation be material ( i.e. significant ) and repeated.

14. Confidential Information.
Information that is developed by a party on its own, without reference to the other’s Confidential Information, or that becomes available to a party other than through violation of these Terms of Service or applicable law, shall not be “Confidential Information” of the other party. Each party agrees not to use the other’s Confidential Information except in connection with the performance or use of the Services, as applicable, the exercise of its legal rights under these Terms of Service or the Order Form, or as may be required by law. Each party agrees not to disclose the other party’s Confidential Information to any third person except as follows: to its respective service providers, agents and representatives, provided that such service providers, agents or representatives agree to confidentiality measures that are at least as stringent as those stated in these Terms of Service; to law enforcement or government agency if requested, or if a party reasonably believes that the other party’s conduct may violate applicable criminal law; as required by law;
or in response to a subpoena or other compulsory legal process, provided that the disclosing party must give the other party written notice of at least seven days prior to disclosing Confidential Information under this subsection (or prompt notice in advance of disclosure, if seven days advance notice is not reasonably feasible), unless the law forbids such notice.

Wow, once again a reasonable time to hire legal talent to address a legal issue.

Rackspace Acceptable Use Policy:

Copyrighted Material
You may not use the Rackspace Cloud’s network or Services to download, publish, distribute, or otherwise copy or use in any manner any text, music, software, art, image or other work protected by copyright law unless:
• you have been expressly authorized by the owner of the copyright for the work to copy the work in that manner; or
• you are otherwise permitted by established copyright law to copy the work in that manner.
It is the Rackspace Cloud’s policy to terminate in appropriate circumstances the services of customers who are repeat infringers.

What a difference the lawyers can make! GoGrid’s ToS, AUP, and Beta agreement are completely one sided and read like some free consumer service, not something that should be entrusted with any serious business. Rackspace’s agreement is balanced. Gives everyone an opportunity to seek legal advice. And more importantly, treats the cloud services as running serious business applications.

Its worth noting that under GoGrid’s AUP, ToS and Beta agreement — Facebook, YouTube, and many other popular legitimate services would be shutdown.

No thanks, GoGrid.

Mac OSX — the most insecure OS around

Friday, August 7th, 2009

A year ago, I gave up on Windows. I was tired of the nervous eggshell feeling with anti-virus software, security patches, and a machine that would mysteriously be slower and slower no matter what I did.

Because of MacOSX Unix roots, I made the switch to MacOSX confident that my personal computer would be safe.

This faith has been severely shaken. I now regard MacOSX as one of the most INSECURE operation systems.

MacOSX has a dangerous default DNS/DHCP configuration. Even worse, this dangerous configuration can not be fixed from the UI. Even the command line fix is difficult. And worst of all Apple is aware of this and does nothing.

There are 5 bits of background you should know:

  1. DNS is a fundamental part of the internet. DNS is the ‘name resolution’ service that converts ‘mail.google.com’ into the ipaddress: ‘74.125.19.19′ which is what your computer really uses to contact GMail servers so you can read your email. This conversion from the human readable ‘mail.google.com’ to ‘74.125.19.19′ is analogous to the post office converting the postal address on your snail mail envelope to a Zip+4 encoding that is printed at the bottom of the envelope. This encoding is what is actually read by the postal service mail sorting machines to determine where your snail mail goes. Now imagine that the postal service’s encoding machine was compromised. This compromised postal encoding machine was changed so that no matter what the Zip+4 code was supposed to be the machine always encoded the location of Dick Cheney’s house. As a result, all your mail that was processed by that compromised postal service would go first to Dick Cheney. Dick Cheney would get a chance to open all your snail mail, read it, copy it, etc. He could then reseal the original envelope, reencode the envelope with the correct barcode and put the envelope back in the postal service system to be delivered to the correct address. so that no matter what address you had actually printed on your envelope. All this would happen without you being aware of the problem nor able to stop it from happening.

    Everything internet related depends on correct translation of ‘apple.com’ or ‘bankofamerica.com’ to the correct IP address, not some third party server. How does the your machine know that it is communicating with apple.com and not some evil server? Your computer relies on the DNS lookup being correct. If the DNS lookup is compromised then when your software update runs to check for the latest security patches it is really installing a virus from evilserver.com not apple.com.

    There has been recent concern about DNS spoofing. ( links ). Being the cautious person that I am, I decided to explicitly listed opendns.org’s DNS servers (208.67.222.222 and 208.67.220.220) as the DNS Servers to trust in my Network configuration. I felt pretty cocky and safe.

  2. The second bit of the puzzle is DHCP. In order to talk to the world, computers need to have their own personal unique ipaddress (it’s very own ZIP+4 code). Every time you go into an internet cafe and pop open your laptop, your laptop uses the DHCP service to figure out what unique ipaddress (192.168.1.101) it should use while you are in that cafe. DHCP is nice because otherwise you would have to manually figure out and set an ipaddress for your computer that is different than everyone else’s laptop. And if someone else picks the same address as you did, all of a sudden your internet connection starts behaving odd. In addition to supplying a ipaddress, the DHCP server also supplies a DNS server that should be used. This is useful when you have your laptop at work and you need to go to an internal website such as http://go/wave Notice there is no ‘.org’, or ‘.com’ after ‘http://go/’ this means that ‘go’ is only visible when you are at work and can access the internal DNS server using the information that the corporate DHCP server supplied to your laptop.

    So to summarize DHCP supplies your laptop with the information needed for the world to talk to your laptop ( by assigning an ipaddress to your computer) , and helps you find out about the world (by telling your computer about the corporate DNS server). DNS servers enables your laptop talk to the world by giving your laptop a ‘go-to-machine’ for all its addressing questions.

  3. Third, DNS servers are usually big expensive computers secured by “smart people”. However, the DHCP server is really just a bit of software running on a Linksys router at your internet cafe. Your internet cafe’s Linksys router probably has the default password and no one ever checks on it. There are millions of this routers, with minimal security, no one checking on them and your laptop is trusting these unsecured routers with the keys to your kingdom. Your laptop is asking this router — “tell me which DNS server to trust?”
  4. Fourth, Lets say that you are paranoid enough to say ” ohh this is bad. I am not going to trust such a router in a greasy, dark corner with telling my precious laptop which DNS server to trust.” So if you are like me you configure your laptop with an explicit list of DNS servers thinking that your laptop, especially your oh-so-secure Mac would never disobey you about something so critical as DNS.
  5. Fifth, you would be wrong. The insecure MacOSX does disobey and it does trust that greasy spoon router over you. MacOsX doesn’t let the user (YOU!) say that only certain machines are allowed to be your laptop’s DNS servers! Furthermore even if you have supplied your own custom DNS servers that you trust, the insecure MacOSX trusts the greasy spoon DHCP server’s DNS servers over your trusted DNS servers. And there is NO way to convince MacOSX otherwise.

This means that if the DHCP server at your internet cafe has been compromised you are as well.

How I found out

So here I am feeling all cocky and safe. I type in my company’s web address, ‘amplafi.net’ and amplafi.net resolved to 113.29.236.168 which offered that the website was for sale!… I freaked out!

hacked-dns

I discovered my MacOSX laptop was insisting on trusting these EVIL DNS servers 206.13.28.12 206.13.31.12 . Was the 10.5.8 OSX patch that was installed 6 hours ago really what it seemed? Who knows? When I installed updates to Firefox plugins was I really installing the correct versions or a compromised version that would report back to some site in Russia all my bank account information? I have no way of knowing.

This is the really scary part about everything. John Simpson reports:

Under 10.4 and earlier, when I specified a custom nameserver, the system would use only the nameserver(s) I specified. However, under 10.5 Apple has apparently changed that behavior, and uses my specified nameservers in addition to the DNS servers specified by the DHCP server. It shows the DHCP-provided server IP on the list, greyed out, so you can’t delete it.

For a while, I adopted a “grin and bear it” attitude — after all, the DHCP server at home is handing out the IP of my internal Linux server (also running djbdns) as the DNS server, so I was only unsafe when I used the laptop outside the house. However, with the recently announced vulnerability in the DNS protocol, the massive world-wide patch effort by major DNS vendors, and the fact that many networks haven’t applied the patches yet, I don’t really feel safe relying on anybody else’s nameservers.

I tried calling Apple about this, but it turns out that my AppleCare contract doesn’t cover technical support such as this.

My next approach was to just brute-force search the system for anything relating to DHCP. It took a while, but I was able to find the file which needed to be changed, and figure out the necessary changes. Basically, I found a file which controls which options are used by the DHCP client when handling a response from a DHCP server. I removed the DNS-related options from this list, and after rebooting the system, the laptop now ignores the DNS server options being sent by the DHCP server.

The file I found is named IPConfiguration.xml, and it’s buried in this folder: /System/Library/SystemConfiguration/IPConfiguration.bundle/Contents/Resources. You need to create a copy of that file, edit the copy, and remove a few entries in the DHCPRequestedParameterList key. (The entries to remove are those for 6, 15, and 119.) I have added full details on this process to my djbdns setup page, in the section titled Disabling DNS servers from DHCP.

Thankfully I found this web page from 2008(!) that showed how to fix this problem (thanks John M. Simpson):

It is possible to make the DHCP client ignore the “DNS server” options in the DHCP response. It’s not for the faint of heart, but if you’ve been able to handle the rest of the instructions on this page, you can handle this bit as well.

I have done this on my own laptop (a MacBook Pro) and it does work.

Be aware that this is a GLOBAL change. If you do this, your machine will not use the DNS servers specified by any DHCP server. This may affect your machine’s ability to easily work with corporate networks (especially those using Windows Active Directory) or other networks which use private DNS namespaces.

$ sudo -s
Password: You will not see your password as you enter it.
# cd /System/Library/SystemConfiguration/IPConfiguration.bundle/Contents/Resources
# vi IPConfiguration.xml

Find this block...

        <key>DHCPRequestedParameterList</key>
        <array>
                <integer>1</integer>
                <integer>3</integer>
                <integer>6</integer>
                <integer>15</integer>
                <integer>119</integer>
                <integer>95</integer>
                <integer>252</integer>
                <integer>44</integer>
                <integer>46</integer>
                <integer>47</integer>
        </array>

Comment out the 6, 15, and 119 entries. The result should look like this:

        <key>DHCPRequestedParameterList</key>
        <array>
                <integer>1</integer>
                <integer>3</integer>
                <!-- commented out so that Bad DNS servers coming from DHCP servers
                are not used.
                <integer>6</integer>
                <integer>15</integer>
                <integer>119</integer>
                -->
                <integer>95</integer>
                <integer>252</integer>
                <integer>44</integer>
                <integer>46</integer>
                <integer>47</integer>
        </array>

Save your changes.

Be sure to flush the DNS cache.

On MacOsX:

dscacheutil -flushcache

I have tried John’s suggestion and those scary DNS servers are no longer present. But has my machine been compromised already? I will be visiting the apple store in a few hours asking for answers.

The story continues. I was sitting next to a customer. On her windows box she was picking up the same bad DNS servers. It wasn’t until later when I got home that I discovered all this information. I suspect (but am not completely certain) that windows will not override an explicitly specified DNS server.

Update: So after talking with some people, its pretty clear that MacOsX shares this issue with Windows XP because offering out internal DNS servers is part of what DHCP does. However with Windows XP, it is easy to explicitly lock down the DNS servers.

How to lock down a Windows XP box with safe DNS servers:

On Windows:

network-connections-step1

before-changing-dns-step2

use-opendns-dns-servers-step3

To clear Windows DNS cache:

ipconfig /flushdns

Email/Calendar : Missing features

Sunday, May 17th, 2009

Continuing my “broken” series of things that everyone uses but no one fixes. Many of these missing features are email and calendar integration.

Email. Much maligned. These are the key “broken”/ missing features. For some reason, not one major email provider nor any mail program ( that I know of ) has provided these missing features. Without these features, email is “broken”.

This list is in ranked preference.

  1. Easy calendar linking
  2. Deadline handling
  3. Delayed processing
  4. Notes
  5. Emphasis
  6. Quote management
  7. Cross linking
  8. Task integration
  9. Countdown

Easy calendar linking

Gmail makes a half-ass attempt at this but it has never worked for me.

Furthermore it looks like Gmail is only expecting 1 event per message. Most email newsletters have multiple events announced.

Properly done, this feature would allow users to select from the email body:

  • date/time information
  • location information
  • registration urls
  • deadline (early bird for example)

A floating, AJAX-y div that would allow users to select each bit of information separately until all needed information has been submitted.

Furthermore, the user should be able to create multiple events from a single email.

All created events are linked to the original email.

Deadline handling

This would support GTD methodology. An email comes in referencing an event (see above) or a request (“I need the financials by Thursday for the Friday morning C-level meeting” ). The recipient does not want to act on this request right away but they certainly don’t want to forget either.

Deadline handling makes sure the deadline is not forgotten and the email is removed (optionally) from the visible inbox( Inbox is distracting, “did I open this email .. oh yeah I did”).

With deadline handling, the user selects a series of dates that would trigger reminder notes to the user as the deadline approaches. The user also may create a task that indicates how much time the task will take. The deadline reminders would be increasingly color-coded based on how much time remains from the end of the task to the calendar item (“green”, “yellow”, “red” ).

Using the request example,

I need the financials by Thursday for the Friday morning C-level meeting

The user would create a deadline for Thursday 5pm. The task will take 2 hours and the user wants alarms on Thursday. The “red” alarm would be at 3pm on Thursday ( because the financials take 2 hours and must be done by 5pm ).

The email would then be archived so it is not there to distract the user. And the user will not accidentally forget the request because it got buried in the inbox.

Since one email may contain multiple requests, this feature would need to support multiple requests.

Delayed processing

This extends deadline processing to some degree, but is used more for the “softer” deadlines. Many messages have an implicit “sell-by” date. For example, emails about organizing or announcing an event. Once the event has happened, the back-and-forth messages can be deleted/archived. But until the event happens the messages should not be touched.

This allows easy handling of messages where the user doesn’t want to instantly delete the message but wants the message gone after a delay.

This feature would be immensely valuable to me personally. My inbox is cluttered with email chains planning events in 2004. Being able to attach a self-destruct would clean over 50% of my email.

[enhancement: if I don't open this email again in the next 30 days, delete it - kind of like spam processing for non-spam messages.]

Notes

What it says. I want to be able to attach a private note to an email. If I forward or reply to the email, the note is not included.

Some use cases: The email results in a phone conversation or chat. I want to be able to attach the phone notes or chat log to the email.

Why is this missing???

Emphasis

A big email, with lots of “stuff” that is not important. But one set of information that I do care about. I want to be able to select that text for special emphasis. Conversely, I want to selectively diminish other parts of the email.

This would allow the important data to easily be re-found and for unimportant parts to be collapse from view.

Quote management

In a long email back and forth, I want to be able to collapse levels of the quoted previous messages in the thread.

Cross linking

2+ emails are related (for me) I want to connect two messages with no obvious connection. These messages are not in teh same email thread and have no obvious computable connection. Different senders, different email threads but the content happens to be related.

Task integration

A bunch of messages are all related to a certain task. Allow the user to connect those emails to a task. When the task is completed, the messages are archived (or deleted). Since a single email may relate to multiple tasks, the email is only deleted/archived when all the tasks have been completed.

The text corresponding to completed tasks is “deemphasized” ( see “Emphasis” missing feature )

Countdown

Reminders are transitory alarms. For some reminders, a countdown clock to the event is better.
This avoids the need to set multiple reminder alarms.
This wouldn’t work for SMS reminders but would work if it was part of the calendar / email display.

Ad networks: missing features

Saturday, May 16th, 2009

Ad networks missing features:

  1. Interconnection with bookmarking services
  2. Browser back button support
  3. Rich interaction
  4. Selective Memory
  5. Show different video ads
  6. Limit the ad selection

Interconnection with bookmarking services

You’ve interrupted me. The ad is interesting. Well-targeted. Good job. I am interested. But not right now. Right now I want to finish reading page 2 of this article.

Why are you demanding that I follow the ad link now? Interact with delicious.com, xmarks.com or simply my browser bookmark ability. Let me bookmark the ad link as a private bookmark for later. Bookmarking services have simple APIs. Spend the 13 seconds. Do the integration.

In the “old” print advertising medium. A prospect could tear out the ad from the magazine or newspaper for later. Why can’t the “new” media do this?

Browser back button support

You wanted to sell to me. I am ignoring your ad. I click on a link, not your ad. I then notice your ad. Mission accomplished…. too late. The page refreshes. The ad is gone.

I click the browser back button. The browser shows the previous page.

Except for the ad I wanted to read. Your ad. No clicks for you!

In the “old” print medium, the ad on page A3 does not change and disappear just because I have flipped the page. I can go back to not just the article, but to the ads!

Rich interaction

Hat-tip to meebo.com for breaking the old model. But for everyone else, why is the only interaction with the ad, a link?

  • If the ad is related to an event? Make it so someone can put the event on their calendar. Generate the ical file
  • provide sales contact information as a vcard that reminds the user of when and where they saw the ad. Maybe even a link to the ad itself!
  • Add the ability to email /forward the ad!

Get creative with the interaction!

In the “old” print medium, ads have a phone number and a physical address. How is this any different than a link?

Selective Memory

Consumers know that ad networks track them. Acknowledge this. Let the consumers edit your memory. The user’s only alternative is deleting cookies so the ad network know nothing. Allowing consumers a choice, gives the ad networks a chance remember something.

In old print media, there is an advertisers index on the magazine back cover. How come websites don’t have the same functionality? Maybe not all advertisers, only the premium advertisers get listed in the advertisers index.

Show different video ads

For christ’s sakes guys, how come consumers have to suffer from watching the same pre-roll 10 second ad repeatedly. I hate CNN, FOX, etc. Every 5 video clips I get shown the same pre-roll ad for the same product. My ears bleed. Even if I am interested in watching more videos, I run away! Fast!

Limit the ad selection

It is well known that it takes multiple impressions to reach the consumer. For the time the visitor is on a website, increase the number of ad impressions. Make it so that a visitor sees the IBM ads 8 times rather than showing 8 different ads for 8 different companies.

Hopefully someone like Frank will do something about this!