Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebKit Tracking Prevention Policy

webkit.org

Post reply on HN
Print view View original

241–250 of 254 posts

Re: WebKit Tracking Prevention Policy

#241

Post by w1nst0nsm1th »

po wrote: post #148

A first party is a website that a user is intentionally and knowingly visiting, as displayed by the URL field of the browser, and the set of resources on the web operated by the same organization. In practice, we consider resources to belong to the same party if they are part of the same registrable domain: a public suffix plus one additional label. Example: site.example, www.site.example, and s.u.b.site.example are…

coca-cola.dev is not owned by Coca-Cola, even if coca-cola.be, cocacola.be, cocacola.fr and coca-cola.fr is owned by Coca-Cola.

The same way with bosch.com and bosch.dev. One is a famous tools manufacturer, the other is a web developer.

It is impossible to guess the entity behind domain names by only the domain name.

Re: WebKit Tracking Prevention Policy

#242

Post by ignoramous »

kitsunesoba wrote: post #227
ignoramous wrote: post #144

Strange for a page espousing anti-tracking [0] to load media in from apple.com. Granted Mozilla's page [1] is even a worse offender with google-analytics and newrelic embeds. Really makes you think what really drives the underlying narrative for such initiatives at corporates if not sabotaging competitors? OpenDNS founder, u/davidu, pointed out that DNS over HTTPS, something that takes aim at trackers and advocates p…

The App Store requires apps to obtain user consent before doing any kind of tracking and only allows one method of identifying users (advertising ID), which the user can reset whenever they feel that apps are getting too creepy with their tracking. While there have been other ways to fingerprint users, Apple has been aggressively pursuing each avenue and closing them off.

Agree. iOS has much better story than Android.

> Apple has been aggressively pursuing each avenue and closing them off.

That is key. It is all Apple.

VPNs can be a powerful mechanism too, and you can see third party VPNs come up with solutions that are way more aggressive at blocking trackers than Apple [0]. And from what I know, Apple makes it hard for such VPN apps to flourish. Not long ago, they kicked Adguard and Malwarebytes out [1] (though they now let them back in).

[0] https://guardianapp.com/

[1] https://news.ycombinator.com/item?id=17667398

Re: WebKit Tracking Prevention Policy

#243

Post by ec109685 »

om2 wrote: post #142
ec109685 wrote: post #133

Earlier quoted context omitted.

Isn’t link decoration an intractable problem? Ban query params and people switch to matrix params. Ban that and they subtly include it in the seo friendly text, band that and… It just seems somewhat wrong that a browser with a huge market share doesn’t use any standards / rfc process and invents new ways of blocking tracking / breaking agreed upon specifications from release to release in isolation.

We have a partial mitigation and it does not involve stripping query params. We'll be doing more stuff in standards first / in parallel now that more browsers are actively engaged in reducing tracking. A lot of the more extreme thing we'll only do for sites that we've classified as a tracker. Other browsers put identified trackers in all kinds of penalty boxes that aren't fully defined by standards yet. (We happen to…

I guess this is what the article’s main point — putting sites on notice that no matter how much they obfuscate their cross-site linking practices, WebKit can always hard code mitigation’s for that site.

If social.example links to blog.example, limit cookie storage to 24 hours, no matter what is in the link.

Re: WebKit Tracking Prevention Policy

#244

Post by qroshan »

beagle3 wrote: post #109
qroshan wrote: post #94

Earlier quoted context omitted.

Most of HN don't understand that the Advertising ecosystem is what is feeding the tech boom and their livelihood. Just like housing it is an entire ecosystem now with many people's jobs and livelihood is based on. Hit that ecosystem and you get a recession. However it doesn't stop at the recession. Most VCs are funding hundreds and thousands of startups with the hope that one of them is going to get sold to Google or…

That's usually called "the broken window fallacy". A kid goes out and breaks random windows in people's home; as a result, a lot of economic activity ensues - the glass producers, the people who produce glass cutters and specialized tools, the people who install windows, the cleaners who specialize in cleaning broken glass, etc ... The ad industry is breaking everyone's windows. It does indeed produce a lot of econom…

Broken Windows is actually not a fallacy (classic Keynsian vs Hayek argument) If past decade has proven anything. Keynsian economic policies worked (printing money forcing people to spend) while a Austrian Austerity would have been disastrous.

Again, HN will not understand the side effects of destroying a major ecosystem. They all think they are much smarter and can stand on their own and VC money has no effect on their livelihood and it's their superior linux skills that keep them making tons of money

Re: WebKit Tracking Prevention Policy

#245

Post by password4321 »

radicaldreamer wrote: post #15
om2 wrote: post #12

Earlier quoted context omitted.

Indeed, the Gtk+ and WPE ports, as well as Sony's Windows port, are the most active after the Apple-maintained ones.

Sony's Windows Port?

Thanks to these comments today I am finally running WebKit on Windows for preliminary Safari compatibility testing purposes.

This blog[1] explains how to get Windows builds[2] from the WebKit Build Archives on S3 that require Apple Application Support[3].

[1] https://medium.com/@alSkachkov/how-to-load-the-latest-webkit...

[2] https://build.webkit.org/builders/Apple%20Win%2010%20Release...

[3] 7-zip the iTunes installer to extract & install just AppleApplicationSupport.msi https://www.apple.com/itunes/download/win64

Re: WebKit Tracking Prevention Policy

#246

Post by qroshan »

eecc wrote: post #122
qroshan wrote: post #94

Earlier quoted context omitted.

Most of HN don't understand that the Advertising ecosystem is what is feeding the tech boom and their livelihood. Just like housing it is an entire ecosystem now with many people's jobs and livelihood is based on. Hit that ecosystem and you get a recession. However it doesn't stop at the recession. Most VCs are funding hundreds and thousands of startups with the hope that one of them is going to get sold to Google or…

We could be working on distributed systems and analytics engines to - say - chew through all the protein mediated DNA/RNA expressions. That would cost a few pennies in engineering skill and we might even find cures to things that might kill us or our loved ones. But no, we’re throwing these opportunities away trying to be the next overvalued IRC skin.

Again, this is someone who doesn't understand economics

Re: WebKit Tracking Prevention Policy

#247

Post by kitsunesoba »

ignoramous wrote: post #242
kitsunesoba wrote: post #227

Earlier quoted context omitted.

The App Store requires apps to obtain user consent before doing any kind of tracking and only allows one method of identifying users (advertising ID), which the user can reset whenever they feel that apps are getting too creepy with their tracking. While there have been other ways to fingerprint users, Apple has been aggressively pursuing each avenue and closing them off.

Agree. iOS has much better story than Android. > Apple has been aggressively pursuing each avenue and closing them off. That is key. It is all Apple. VPNs can be a powerful mechanism too, and you can see third party VPNs come up with solutions that are way more aggressive at blocking trackers than Apple [0]. And from what I know, Apple makes it hard for such VPN apps to flourish. Not long ago, they kicked Adguard and…

The problem with VPNs is that while they can enable privacy on a deeper level than Apple can in some cases, they also potentially pose a grave threat, as seen with Facebook’s “research” VPN which got shuttered not so long ago.

It’s a tough problem because there’s no way to verify what’s happening on the other end of the VPN during the app review process, and even if there were its too easy to change how the VPN operates to pass review and then flip it back afterwards.

Re: WebKit Tracking Prevention Policy

#248

Post by beagle3 »

qroshan wrote: post #244
beagle3 wrote: post #109

Earlier quoted context omitted.

That's usually called "the broken window fallacy". A kid goes out and breaks random windows in people's home; as a result, a lot of economic activity ensues - the glass producers, the people who produce glass cutters and specialized tools, the people who install windows, the cleaners who specialize in cleaning broken glass, etc ... The ad industry is breaking everyone's windows. It does indeed produce a lot of econom…

Broken Windows is actually not a fallacy (classic Keynsian vs Hayek argument) If past decade has proven anything. Keynsian economic policies worked (printing money forcing people to spend) while a Austrian Austerity would have been disastrous. Again, HN will not understand the side effects of destroying a major ecosystem. They all think they are much smarter and can stand on their own and VC money has no effect on th…

The past decade has proven that central banks can keep a system afloat for a decade. It remains to be seen if it proves anything else.

Re: WebKit Tracking Prevention Policy

#249

Post by om2 »

skim_milk wrote: post #238
p4bl0 wrote: post #163

Related to the way they classify between first party and third party (based on domain names, with its subdomain being the same party), the Public Suffix list [1] is a resource of great value. It allows to know when subdomains actually refers to different parties (e.g., xxx.github.io is neither the same party as yyy.github.io nor as github.io). [1] https://publicsuffix.org/

Wow! That list is surprisingly incomplete for TLDs. I should think twice before buying strange TLDs! I found .co.de, (co|com).cc, and .pro.aw missing after a minute of searching. Going to try to find more after work. Instead of having a nice free lunch break now I have to email some people...

Fortunately, they have an issue tracker and a documented update process: https://github.com/publicsuffix/list/wiki/Guidelines

Re: WebKit Tracking Prevention Policy

#250

Post by hesarenu »

scarface74 wrote: post #195
hesarenu wrote: post #170

Earlier quoted context omitted.

why can't they do it on their app?

Can I pay the manufacturer of a good directly and walk into a retail store to pick it up? But let’s not be overly idealistic, the vast majority of revenue in either App Store is from games and most of that is from in app purchases of coins, gyms, loot boxes etc.

Can I install another store in Mobile eco system. Yes I can.

But what you say is correct having another store would dent apple revenue would be loss of investors.

Post reply on HN