Iframes and abuse prevention.

[jpettitt]

The spec as drafted has multiple issues related to revenue sharing, fraud, and abuse prevention.

16 and #23 have some discussion of where the <meta> tag and monetization object should live. The document vs navigator choice has some implications for abuse prevention.

As written the spec disallows meta tags in iframes. This is impossible to enforce as <iframe> contents are not visible to parent frames. Depending on the, as yet unspecified error handling, an iframe could include a monetization meta tag and trigger a denial of service on the parent by virtue of having more than one tag.

Conversely, if meta tags in iframes are ignored a malicious actor could frame content pages and include a monetization tag in the top frame thus hijacking the payment from the child frame content. This become particularly tricky when dealing with embedded videos where there may be multiple, legitimately monetized child frames on a page.

The mechanics of allocating payment between multiple claimants, some legitimate some not are extremely complex. For example a page that collates the best cat videos from YouTube probably deserves some revenue for bringing the audience. While at the same time the embedded videos also deserve revenue to reward the creators. This is currently achieved vi banner and pre roll ads respectively. It's unclear how this can be done within the current spec.

[sublimator]

This is impossible to enforce as