A small company called Limited Run has announced their intent to leave the Facebook eco-system far behind.

Not really news I hear you cry, but wait, there’s more.

From their post it seems as though they were spending a reasonable amount on advertising with Facebook and were analysing the demographics of their audience. They noticed that something was wrong with the click-throughs they were receiving and decided to investigate further. From what they saw it seemed as though the clicks were not being generated by users within browsers. When they took their initial findings to Facebook they asked them to provide further details and evidence backing up their claim. Dutifully they captured data over the next month (from outside of the supplied Facebook eco-system) or so which when they analysed it in detail showed that it was highly likely that up to 80% of the clicks were potentially being produced by bots. Again they approached Facebook who again asked for specific Facebook IPs etc.

At the same time, they wanted to change their Facebook “domain” name to be something more representative of where they are as a company. When they approached Facebook to inquire about this possibility they were told that there would be a few of a few thousand dollars, but if they increased their per month advertising spend with them that the fee would be waived.

This broke the proverbial back of the proverbial camel.

What’s interesting here is the fact that there is no client side control for these advertising systems. They are completely at the mercy of the clickers - there doesn’t appear to be a flat fee for impressions, just a charge per (1000) click. I should have realised this before, but didn’t, but there’s a clear abuse opportunity here for the determined hacker. Could we see an Anonymous group attack along these lines in the near future? Why DDOS a site if you can simply hit them where it hurts - their wallet…

Food for thought.