Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opting Your Website Out of Google's FLoC Network

paramdeo.com

Post reply on HN
Print view View original

161–170 of 264 posts

Re: Opting Your Website Out of Google's FLoC Network

#161

Post by bryanrasmussen »

Ideas -

if all it takes to block is adding header `permissions-policy: interest-cohort=()

1. Github has all those bots that suggest security improvements to your code - maybe they should also suggest privacy improvements to your code.

2. Governmental sites should be changed to always require this.

3. How about a plugin that when it gets a site without the header informs user via colored tab or similar solution. I suppose Google would try to remove it from add-ons, but then that would be fuel for the inevitable lawsuits complaining this whole thing was anti-competitive and monopolistic behavior on Google's part.

Re: Opting Your Website Out of Google's FLoC Network

#162

Post by pbhjpbhj »

EMM_386 wrote: post #112
jedwhite wrote: post #83

Earlier quoted context omitted.

According to the W3C Federated Learning of Cohorts Draft Community Group Report, 13 April 2021, Paragraphs 3 & 7.1.1: "The interest cohort API lives under the Document interface since the access permission is tied to the document scope, and the API is only available if the document is in secure context." and "The page can opt itself out of the interest cohort computation through the "interest-cohort" policy-controlle…

Did you intentionally leave out the first sentence of 7.1.1? > By default, a page is eligible for the interest cohort computation if the interestCohort() API is used in the page. I'm certainly not defending FLoC, I've been using Firefox for 20 years. But creative editing isn't called for.

It sounds like you're reading in an "only" that isn't in the text.

As written that quoted part gives a reason for inclusion, but not a requirement (ie the condition might be 'sufficient but not necessary').

Re: Opting Your Website Out of Google's FLoC Network

#163

Post by ognarb »

sanxiyn wrote: post #61
edent wrote: post #7

Why isn't this opt-in? I'm sick of having to add yet another config option every time some Web giant decides it is OK to abuse my website and my visitors.

We should make this opt-in, by emitting the header by default in Apache and nginx and requiring special configuration to remove the header.

Yeah that should be the default configuration shipped with Apache httpd. If apache is refuse to add the header, I'm sure it will be possible to convince many distros to add it

Re: Opting Your Website Out of Google's FLoC Network

#164

Post by darekkay »

bryanrasmussen wrote: post #161

Ideas - if all it takes to block is adding header `permissions-policy: interest-cohort=() 1. Github has all those bots that suggest security improvements to your code - maybe they should also suggest privacy improvements to your code. 2. Governmental sites should be changed to always require this. 3. How about a plugin that when it gets a site without the header informs user via colored tab or similar solution. I sup…

There are also tools that check your HTTP headers. While securityheaders checks for Permission-Policy being used, I can imagine it will be improved to check for the "interest-cohort" value in the future.

- https://securityheaders.com

- https://observatory.mozilla.org

Re: Opting Your Website Out of Google's FLoC Network

#165

Post by pbhjpbhj »

girvo wrote: post #143
jahewson wrote: post #68

Earlier quoted context omitted.

It is. If you’re not calling ‘document.interestCohort()’ or serving ads from an ad network on your page then FLoC does nothing. The purpose of this permission is to prevent embedded third-party content from using FLoC.

Genuine question: any ads from any network? Not just googles? Because if so, I fully expect someone to mess up and have that detection mark sites with zero ads as having them, thus tracking their users. Detection is never 100%. Never ever. Unless I’m misunderstanding, which is likely (and I hope I am)

I'm sure it will be a rigorous test: ads use words and/or images so any website with either of those is probably ads. /s

Re: Opting Your Website Out of Google's FLoC Network

#166

Post by pbhjpbhj »

jedwhite wrote: post #8

Add a simple header to block FLoC on your website (fortunately): `permissions-policy: interest-cohort=()` It's only deployed on a test set of Chrome browsers so far, and it does create a warning message on browsers that don't support it. [1] [1] https://stackoverflow.com/questions/66997942/error-with-perm... Edit to note support for blocking this!

Isn't this the sort of thing .well-known is for? Presumably Google are doing it this way because less people can create headers than can make a text file.

Re: Opting Your Website Out of Google's FLoC Network

#167

Post by zwaps »

kristopolous wrote: post #88
heavyset_go wrote: post #85

Earlier quoted context omitted.

Before Android killed them, webOS existed, as did Maemo.

Would you be willing to entertain that maybe they died because most people who used phones found those platforms to be weaker product offerings with the things they cared about and that your value system may have fundamentally differences? Would you further entertain that the inability to perceive such realities and differences and manufacturers inability to navigate these preferences is a major determinant of succes…

Webos was better than Android is now

Re: Opting Your Website Out of Google's FLoC Network

#169

Post by donmcronald »

martius wrote: post #160
bigiain wrote: post #107

Earlier quoted context omitted.

> if Chrome detects that the page load ads or ads-related resources. Let me guess, “ads-related resources” are not defined, but in a court case in 5-10 years time it’ll be accidentally revealed that internally Google considers this to include “JavaScript, css, or HTML files”...

It's a good idea to read the article: > During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. (Ad Tagging in Chromium explains how Chrome's ad detection mechanism works.) Ad tagging? https://chromium.googlesource.com/chromium/src/+/master/docs... > Ad Tagging works by matching resource requests against a filter list (..…

> Ad Tagging works by matching resource requests against a filter list (...) to determine if they’re ad requests.

This list should be shared with UBlock Origin. Let the people decide what they want IMO.

Re: Opting Your Website Out of Google's FLoC Network

#170

Post by nirui »

Curious.

How many of you actually brought something just because a machine/stranger recommended it to you? For me, it's almost never.

I watch YouTube a lot, as a free tier user, of course. When a video starts to play, all my focus is automatically dead-locked on the "Skip Ad" button, and sometimes "Skip trial". It's a game for me now to see how fast I can tap the "Skip". As for the content of the Ad, well, usually I ignored it all together.

Sometimes, when I'm away from the phone and suddenly a some 50 hours long Ad starts to play, I'll just continue finishing what's on hand first, and then go to my phone to tap "Skip" or switch to Twitter or Telegram to see whats fun over there -- all without notice what the Ad was saying.

Yes, sometime, some annoying Ad got into my head anyway, but ... why should I buy something that annoys me?

For me, the most effective Ad are those what I'm actively looking for. For example, if I'm looking for a running shoes, I'll click the Ad on the search page and/or listings page to see if there is a good product/deal. And I'll stop click those as soon as I made the purchase.

So personally, I don't really understand the idea of Tracking Your Every Move So We Can Sell You Stuff. How it even works?

Now if you remember this: https://news.ycombinator.com/item?id=14879204

Post reply on HN