

While I agree with you I did just want to point out one thing.
This:
it’s mathematically impossible to fake.
Is not entirely true persay, every hashing function does have collisions that can occur. But the likely hood that someone baked an exploit in that kept the application functioning while adding their backdoor all the while somehow creating a hash collision with the original fingerprint is practically zero and honestly if someone did pull that off, fucking hats off because that has to be some sort of math and coding wizard beyond most. I should also point out that the file size would most likely/have to be different so there should be other methods of detecting the compromised build regardless.
Sorry I know that was very pedantic of me but I did want to call that out because its technically possible but the actual likely hood has to be so miniscule its almost irrelevant along with the fact that other tells would surely exist.





Sure but the metrics that companies produce after running an ad campaign to see if it was effective do not depend on those pay per click metrics. They will generally look at what the total sales or total amount of engagement with their content was pre and post the marketing campaign. If the number goes up they call it a success and will pay for another ad campaign. I guess the real question is are ad payouts for sites hosting them still generally based on pay per click or other engagement analytics that run after the campaigns are finished. That I am unsure of