Just want to say thanks. I use Safari by choice and feel good about it, and this ongoing effort is part of the reason.
WebKit Tracking Prevention Policy
151–160 of 254 posts
Re: WebKit Tracking Prevention Policy
#152I expect that tracking will just move to being proxied server side. It will be more annoying for the people setting it up but services will spring up to help. Little will change in the advertising and tracking space.
That annoyance may be enough to keep many actors from just plugging 10 random trackers into their sites, especially when it means running code from less-than-trust-worthy parties on their own servers instead of their user machines. At the very minimum it aligns incentives better for developers to think about these things. And with IPv6 privacy extensions IP addresses will also be less useful for server-side tracking.
> especially when it means running code from less-than-trust-worthy parties on their own servers instead of their user machines.
But most will be OK with their servers running Google, Amazon, Oracle BlueKai and Facebook code, the scariest ones by amount of data.
Re: WebKit Tracking Prevention Policy
#153Earlier quoted context omitted.
The bad actors just need to open their own website in webkit to check if they are being blocked in some way. They will always know if a particular tracking strategy they are using is not working. So there is no harm in making the list public. The benefit of making the list public is that blocking tech is in some sense of the word censorship. The public needs to know who is being blocked to ensure transparency and to…
Isn't WebKit open source though, including this tech?
An open-source program can easily use a closed-source blocking list. For example, the blocking list could be distributed as a list of hashes, and the program hashes the domain name to search for it in the list.
Re: WebKit Tracking Prevention Policy
#154I expect that tracking will just move to being proxied server side. It will be more annoying for the people setting it up but services will spring up to help. Little will change in the advertising and tracking space.
That annoyance may be enough to keep many actors from just plugging 10 random trackers into their sites, especially when it means running code from less-than-trust-worthy parties on their own servers instead of their user machines. At the very minimum it aligns incentives better for developers to think about these things. And with IPv6 privacy extensions IP addresses will also be less useful for server-side tracking.
"IPv6 privacy extensions...."
I recall these extensions are just optional. How many implementations actually implement these extensions? I recall Windows 10 had this broken for a year and almost nobody noticed...
Re: WebKit Tracking Prevention Policy
#155Earlier quoted context omitted.
Sure, but YouTube doesn't stop tracking you when you pay.
But what does that mean? YouTube keeps a history list, which I download and periodically reset. If it didn't I would need to add some sort of Firefox add-on that remembered which videos I'd seen. What else are they "tracking"? Does YouTube have tracking on other sites (like Facebook, Twitter etc)? I haven't seen anything like that. You can switch the history off, I presume that would work even without Premium, but it…
Part of the answer is that YouTube algorithms optimize for engagement, not satisfaction. They don’t show me what they think I’ll like, they show me what they think I’ll keep clicking into. You can pay to subscribe, but that doesn’t change their algorithm.
Re: WebKit Tracking Prevention Policy
#156Earlier quoted context omitted.
For some reason people just have an aversion to paying for stuff they use. Facebook's revenue per user is less than 7$, I don't use facebook, but do not mind paying that little for something I use instead of getting tracked wherever I go. Similarly Google's service that I use like gmail and photos are easily worth about 7$ per month. I would pay if they said they will stop tracking me. I don't know about youtube.
Google makes $21 on average per US user per month [1], almost all of which comes from advertising. Would you pay $21/mo for your Google services? [1] https://mondaynote.com/the-arpus-of-the-big-four-dwarf-every...
Google optimized to help me instead of manipulate me, that would be worth probably $1k a year for me.
Re: WebKit Tracking Prevention Policy
#157A first party is a website that a user is intentionally and knowingly visiting, as displayed by the URL field of the browser, and the set of resources on the web operated by the same organization. In practice, we consider resources to belong to the same party if they are part of the same registrable domain: a public suffix plus one additional label. Example: site.example, www.site.example, and s.u.b.site.example are…
We have mixed feelings about this. Most people could probably figure out that google.com and google.co.uk are owned by the same entity. And probably many people are aware that youtube.com and google.com are related. But some entities own hundreds of domain names with no clear lexical relationship. I doubt a lot of people would expect TechCrunch.com and huffpost.com to be related and would not really expect to be tracked between the two. So common ownership might not be enough to give users a reasonable expectation of a cross-site relationship.
Re: WebKit Tracking Prevention Policy
#158Earlier quoted context omitted.
Isn't WebKit open source though, including this tech?
An open-source program can easily use a closed-source blocking list. For example, the blocking list could be distributed as a list of hashes, and the program hashes the domain name to search for it in the list.
This is roughly how the Google safe browsing list for anti-phishing/malware is distributed (except with chunks and multiple levels of hashing).
Re: WebKit Tracking Prevention Policy
#159One advantage of Google's dominance and their business model being so reliant on tracking, is that it's become the moat for its competitors: investing energy into tracking protection is a good way for them to gain a competitive advantage over Google, since it's a feature that Google will not be able to copy.
So as long as Google's competitors remain in business, we'll probably at least have some alternatives that take privacy seriously.
Re: WebKit Tracking Prevention Policy
#160Would "Sign In With Apple" be considered a "Privileged Third Party" if they make sure it works but break other Single Sign On providers as an "Unintended Impact"?
Sign In With Apple has the same level of access as any other OAuth-based federated login scheme. The popular login services from Facebook and Google work fine in Safari. As others have mentioned, the way they are built does not require cross site tracking.