iOS 14 and Facebook Pixel causing increase in PSL inclusion requests • Hacker News Board

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#61

Post by ghughes » Wed, Apr 07, 2021, 8:36 PM UTC

jefftk wrote: post #12

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but…

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications:

1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains.

2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion process and institutes strict vetting to prevent abuse of PCM, which would presumably take months to implement.

This looks like a serious design problem with no solution that could be implemented before ATT drops.

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#62

Post by donmcronald » Wed, Apr 07, 2021, 8:49 PM UTC

ghughes wrote: post #61

jefftk wrote: post #12

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but…

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications: 1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains. 2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion proces…

The biggest problem is that no matter what “scale” of tracking is tolerable on a single domain / subdomain, Facebook still gets the aggregate.

So if you fix it for small multi-tenant domains, nothing changes for Facebook and they still get all the aggregate data, right?

There’s going to be a lot of collateral damage before ads and tracking get fixed IMO.

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#63

Post by jakear » Wed, Apr 07, 2021, 8:54 PM UTC

TechBro8615 wrote: post #24

twobitshifter wrote: post #22

Earlier quoted context omitted.

PSL is used to determine the level that a unique domain is registered at. This restricts cookies and privileges to that domain. It’s just a simple list because both .com and .co.uk are valid suffixes. Ios14 is using this list to prevent apps from tracking you across sites by limiting the data that can be stored per site. If you can get your domain recognized as a suffix as mysite.com then you can split information be…

The PSL has always been a giant hack and totally unmaintainable in the long term. It's only a matter of time before someone mistakenly relying on it for security purposes gets owned by a rogue PR. Also, as mentioned in some of these issues, browsers don't even update it on any sort of guaranteed schedule.

The fun thing is you can s/PSL/DNS/g and the statement still holds. Same for BGP

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#64

Post by seoaeu » Wed, Apr 07, 2021, 8:56 PM UTC

irrational wrote: post #41

>PSL is maintained by volunteers and there should be zero expectation of turnaround times on PR (and a respect for the labor burden shifted onto them by orgs using PSL as a bozofilter) What is to stop Facebook from assigning an engineering team to act as volunteers so the turnaround time drops to zero?

Um, because those engineers don't have commit access to the repository? You can't just hire an engineering team and take over any open source project you want.

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#65

Post by mangosquash » Wed, Apr 07, 2021, 9:07 PM UTC

local_dev wrote: post #57

mangosquash wrote: post #55

Earlier quoted context omitted.

I work on digital advertising for a franchise where each individual store manages their own shopify site at location.franchise.com. Soon, these sites won't be able to run ads that track purchases, unless franchise.com is added to this list. I understand the PSL managers' position that this is an unfair burden to place on them though.

>these sites won't be able to run ads that track purchases Isn't that part of the purpose of the changes that Apple is making? As a user, this seems like a great change. Less tracking is a positive.

Apple is doing some cool things to make personally identifiable tracking from Facebook ads much less pervasive, while still providing advertisers/businesses data about whether or not their ads are working. These things include sending batches of data every 36-48 hours instead of data as it happens, etc. But in order for these tools to work, Apple is asking Facebook to rely on this list to see if subdomains would be able to set up conversion events to collect this anonymized batched data.

This system will make ads worse, but I think it's an alright balance. Not being able to have any conversion tracking will make ads dismal.

I wish that Apple would work to maintain their own list that served this purpose, or provided support to the volunteers that were tasked with keeping this updated.

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#66

Post by cma » Wed, Apr 07, 2021, 9:08 PM UTC

ghughes wrote: post #61

jefftk wrote: post #12

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but…

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications: 1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains. 2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion proces…

ATT?

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#67

Post by 43920 » Wed, Apr 07, 2021, 9:11 PM UTC

bredren wrote: post #54

tekstar wrote: post #8

Earlier quoted context omitted.

Pretty much all Shopify shops have their own domains, only a minority drive traffic to their .myshopify.com subdomain

I was a bit surprised that a shopify biz that could not be bothered to use its own domain would be very concerned about monitoring ad performance. Seems someone would first effect to have a better branded site. As in, a decent TLD. And that if anything, this is a kick in the pants of an ecommerce site to get its own domain(s) to deal with this. Do I have that right?

There's probably a decent number of sites that get most/all of their traffic from impulse purchases off of Facebook ads, and who have no actual branding. Obviously they should go ahead and just get a domain name, but they likely haven't had any reason to care up until this point either.

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#68

Post by Zelphyr » Wed, Apr 07, 2021, 9:17 PM UTC

cma wrote: post #66

ghughes wrote: post #61

Earlier quoted context omitted.

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications: 1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains. 2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion proces…

ATT?

App Tracking Transparency

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#69

Post by tony101 » Wed, Apr 07, 2021, 9:18 PM UTC

cma wrote: post #66

ghughes wrote: post #61

Earlier quoted context omitted.

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications: 1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains. 2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion proces…

ATT?

https://developer.apple.com/documentation/apptrackingtranspa...

Re: iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

#70

Post by irrational » Wed, Apr 07, 2021, 9:19 PM UTC

seoaeu wrote: post #64

irrational wrote: post #41

>PSL is maintained by volunteers and there should be zero expectation of turnaround times on PR (and a respect for the labor burden shifted onto them by orgs using PSL as a bozofilter) What is to stop Facebook from assigning an engineering team to act as volunteers so the turnaround time drops to zero?

Um, because those engineers don't have commit access to the repository? You can't just hire an engineering team and take over any open source project you want.

Oh, I was assuming the engineering team would lie a pretend like they did not work for Facebook. I assumed they would slowly work to gain the confidence of those in control and little by little they gain the access they required themselves. Maybe they could pretend not to know each other and use that to their advantage. Surely a company with the resources of Facebook could manufacture fake alternate lives for the engineering team to make them look completely legitimate and harmless.