Like the fox offering an opt-out list to the chickens...
It's probably a service mandated by regulation, not out of the goodness of VISA.
And it's probably running on the slowest and cheapest hardware they can buy, without any monitoring.
Visa Advertising Solutions (VAS) Opt Out
181–190 of 253 posts
Re: Visa Advertising Solutions (VAS) Opt Out
#182This needs to end. Surveillance capitalism should be opt in (or just plain illegal).
Half the people on this forum are being paid by it. The other half are thinking of ways to improve it, to make more money :-)
Re: Visa Advertising Solutions (VAS) Opt Out
#183Earlier quoted context omitted.
Your credit card mostly on gets merchant name and total purchase value, so the uses are fairly niche. It’s more likely merchants themselves indirectly selling your purchase data. You can sometimes click the small blue triangle in the corner of an ad (called adchoices) to see how it was targeted.
One hundred percent of the time when I've clicked that button, it says "XYZCorp is advertising to people located in the United States", even when the ad is clearly more targeted than that.
So, assuming that this is FB or Goog, then that makes sense. FB certainly encourage advertisers to use broad targeting with conversion optimisation.
This means that the audience is 18+ living in USA, but the combination of the targeting plus the optimisation (click and conversion prediction, mostly) means that it seems much more targeted than it is.
Re: Visa Advertising Solutions (VAS) Opt Out
#184Why we are opted-in by default?
Re: Visa Advertising Solutions (VAS) Opt Out
#185Pet peeve: Why do they use subdomains (marketingreportoptout.visa.com), thus making it a bit easier for the scammers to register similar domains? marketingreportoptout-visa.com is still available for any scammer to register. It costs Visa (or anyone) less than $200 to register it for 10 years. Can't they at least register these very obvious domains? How difficult is it to use URLs like this? visa.com/marketingoptout…
From a technical standpoint, it is possible to configure separate DNS records for subdomains, so something.visa.com can be set up completely independently from their main website. And it won't have to share cookies either, making it more secure. For visa.com/something, you would need to add a routing rule at the application level in whatever server is hosting visa.com.
No, this can be done in the loadbalancer before any application. You can load balance on L7. This would be a trivial thing.
Re: Visa Advertising Solutions (VAS) Opt Out
#186Earlier quoted context omitted.
Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.
Easily accommodated for. I can get the execution run-time and store in an average in memory for some time-period and have the sleep function top-up the difference between the two paths. Not sure what the "proper security" method is to prevent execution deltas.
Why not just run the thing (which takes some small fraction of time), then pad to five seconds, and respond. Since your work will be done in milliseconds, padding to nearest five seconds will remove any noise.
And it's not a thing anyone has a legitimate interest in submitting more than that per second.
Re: Visa Advertising Solutions (VAS) Opt Out
#187Earlier quoted context omitted.
I'd expect any submissions to this are just appended to a database without any actual validation beyond the trivial Luhn checksum and then there's a batch process once a day (maybe the same one that actually generates whatever marketing "insights" they claim to provide) that reads from there and ignores any card numbers from the opt-out DB.
Huh... create script to fill DB with all possible Visa numbers, tomorrow's "marketing insight" will suddenly be an empty file because everything will be excluded. Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database. Of course, no one should do this...
I think that millions of requests from a particular IP address might give the game away.
Re: Visa Advertising Solutions (VAS) Opt Out
#188Earlier quoted context omitted.
Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?
How is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it? Maybe I’m misunderstanding.
Not one submission. Hundreds or thousands of submissions could be seen as a DoS. Yes, it's a stretch. Yes, they will try to use this to get you. Do you really want to play legal chicken with Visa?
Re: Visa Advertising Solutions (VAS) Opt Out
#189Why does the cert say Cloudflare and not Visa? It says "Verified by: Cloudflare, Inc." AND Organization is also Cloudflare, Inc. Shouldn't the Organization be Visa? How do I know that this is Visa? Genuinely curious since I've not seen certs like this..
I believe it is the standard free level, "Universal SSL" cert that Cloudflare will provide sites on free tier, if they opt for proxying through Cloudflare.
It's the standard Cloudflare cert, the plan used for the site is irrelevant.
Source: Using CF Enterprise.
Re: Visa Advertising Solutions (VAS) Opt Out
#190Earlier quoted context omitted.
100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).
I just found a use-case for the sleep( rand(1000) ) function :-)
I would have gone for `sleep(1000)` and have it run in parallel with the actual function, so that every request takes 1000 milliseconds