Rally, a novel privacy-first data sharing platform • Hacker News Board

Re: Rally, a novel privacy-first data sharing platform

#71

Post by 9wzYQbTYsAIc » Fri, Jun 25, 2021, 4:57 PM UTC

cpeterso wrote: post #58

jonathanmayer wrote: post #35

Earlier quoted context omitted.

Common research methods have significant limitations. Web crawls, for instance, usually don't realistically simulate user activity and experiences. Lab studies often involve simplified systems that don't generalize to the real world. Surveys yield self-reported data, which can be very unreliable. Rally studies, by contrast, reflect real-world user activity and experiences. In science jargon, Rally enables field studi…

> Rally studies, by contrast, reflect real-world user activity and experiences. In science jargon, Rally enables field studies and intervention experiments with excellent ecological validity. Rally users are all opt-in. How does that impact the design of a Rally study and the conclusions you can draw from it?

Academic research in the social sciences is rigorously based on the concept of informed consent (i.e., opt-in), in the first place.

There would be no change in terms of research design and the ability to draw scientific conclusions.

edit: also, see https://news.ycombinator.com/item?id=27633212 for details on research design considerations when conducting social science.

Re: Rally, a novel privacy-first data sharing platform

#72

Post by skybrian » Fri, Jun 25, 2021, 4:57 PM UTC

jonathanmayer wrote: post #39

gopiandcode wrote: post #34

Looking through the FAQ, It seems like Rally requires users to send their raw data straight to the aggregation service, with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. IMO this seems to provide worse privacy than even Google and Micro$oft's telemetry, which at least use d…

> with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. There's much more than that, including: privacy and security review before a study launches, a data minimization requirement, a sandboxed data analysis environment with strict access controls, and IRB oversight for academi…

Interesting. I can see that RAPPOR seems to be deprecated in favor of something else called ukm (Url-keyed metrics) but not why this change is being made. Is there somewhere I can read more about it?

Re: Rally, a novel privacy-first data sharing platform

#73

Post by xpe » Fri, Jun 25, 2021, 5:06 PM UTC

elliekelly wrote: post #48

thombles wrote: post #7

Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. There seems to be an assumption that users will be gleeful to throw their data at legitimate researchers from legitimate institutions doing legitimate work. What "data"? Browsing history? Identity? Something else? Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivatio…

> privacy-preserving data collection system I hate this. Viscerally. Why, why, WHY does every “privacy first” system, platform, whatever, start with the presumption that some people should get your data and it’s just a matter of vetting the “good” groups from the “bad” groups. No. That isn’t privacy. No one should get my data. And it’s ridiculous that all of these companies try to position their data grabbing project…

I understand this is a sensitive area, and I understand that reasonable people have good reasons to be concerned. But it seems that you are directing your frustrations at Mozilla unfairly.

I find this to be a good definition of privacy:

> Privacy is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively. - Wikipedia

From what I've read, Mozilla's Rally gives people the ability to choose what research studies to participate in.

I think there is plenty of discussion to be had about what level of control and granularity works best for different people, but I have confidence that Mozilla has both the right incentives and technical capability to contribute meaningfully in this space.

Re: Rally, a novel privacy-first data sharing platform

#74

Post by 9wzYQbTYsAIc » Fri, Jun 25, 2021, 5:08 PM UTC

yyyk wrote: post #38

This is exactly the data a modern Cambridge Analytica would want (e.g. shares, time spent on each post, all correlated to demographics). I hope this platform has controls to ensure that study data isn't misused post-study for non-study purposes, because the FAQ answer isn't so encouraging[0]. [0] https://rally.mozilla.org/how-rally-works/faqs/#what-happens... "With Mozilla’s permission, researchers may retain aggrega…

> Shouldn't you ask the users for permission on using their aggregate data for purposes that could be different to the study they enrolled to?

They do, given that you’d have been informed of that before you provided your consent by opting in to Rally data crowdsourcing.

> This is exactly the data a modern Cambridge Analytica would want

Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it?

Re: Rally, a novel privacy-first data sharing platform

#75

Post by xpe » Fri, Jun 25, 2021, 5:09 PM UTC

9wzYQbTYsAIc wrote: post #68

thombles wrote: post #7

Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. There seems to be an assumption that users will be gleeful to throw their data at legitimate researchers from legitimate institutions doing legitimate work. What "data"? Browsing history? Identity? Something else? Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivatio…

> Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. It does appear that this piece was written by Mozilla, themselves… on their own blog.

>> Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here.

> It does appear that this piece was written by Mozilla, themselves… on their own blog.

Haha! Captain Obvious strikes again. Joking aside, I think the other commenter knew the post was written by someone at Mozilla on the Mozilla web site. Their point, I think, was that the author didn't do a good job of selling Rally.

Re: Rally, a novel privacy-first data sharing platform

#76

Post by bjt2n3904 » Fri, Jun 25, 2021, 5:12 PM UTC

Whenever someone says they want to study anything relating to "misinformation", it's almost a guarantee they're looking to solve human problems with technical solutions.

Oh look: "Rally has the potential to help address societal problems we could not solve before."

No, I don't think it does. Especially when the first thing you tout is a study on "misinformation about COVID".

The fact that American's are locked in a bitter political cold war with each other is not a technological problem, and does not have a technological solution.

It's like trying to help a couples on the brink of divorce by updating their phones with new firmware, and changing how Facebook's algorithm works. The reason the couple is threatening divorce is 1% what happens ON their phones, and 99% what happens off their phones.

We have to break away from this stupid idea that if only we studied what was happening on Twitter and Facebook we could fix our problems.

Re: Rally, a novel privacy-first data sharing platform

#77

Post by xpe » Fri, Jun 25, 2021, 5:12 PM UTC

JumpCrisscross wrote: post #44

thombles wrote: post #7

Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. There seems to be an assumption that users will be gleeful to throw their data at legitimate researchers from legitimate institutions doing legitimate work. What "data"? Browsing history? Identity? Something else? Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivatio…

Mozilla strikes me as an organisation with too many resources for its own good. They keep pursuing these random side gigs with limited unifying theme other than an excuse to spend money.

> Mozilla strikes me as an organisation with too many resources for its own good. They keep pursuing these random side gigs with limited unifying theme other than an excuse to spend money.

Why does this appear to be "random" to you? What is your definition of "random"?

Have you tried "putting on a Mozilla hat" and thinking about their priorities and goals? If you do, I think you'll likely see some connections. After you do this for a few minutes, I'm interested if perhaps you can see another point of view.

Re: Rally, a novel privacy-first data sharing platform

#78

Post by xpe » Fri, Jun 25, 2021, 5:16 PM UTC

9wzYQbTYsAIc wrote: post #18

Yaina wrote: post #16

It's not easy to understand, especially from the blog post alone, but as far as I understand it, the proposition is the following: Big companies have the ability to do research on users all the time, either by doing anonymous studies or by tracking you for their ad networks. This is a luxury many researchers that work outside of these big tech companies don't have, which creates a scientific power imbalance. Mozilla…

> Now you can opt-in to a a Rally study where independent researchers can examine the data. It would have been great if they’d invested the resources to use Solid, here.

Thanks for mentioning this. Two questions:

1. In your experience, what is the maturity level of Solid?

2. Would you mind sketching out how you would do the integration with Solid? I'm reading over https://solidproject.org/users/get-a-pod but haven't spend a lot of brain cycles on it yet.

Re: Rally, a novel privacy-first data sharing platform

#79

Post by jonathanmayer » Fri, Jun 25, 2021, 5:17 PM UTC

skybrian wrote: post #72

jonathanmayer wrote: post #39

Earlier quoted context omitted.

> with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. There's much more than that, including: privacy and security review before a study launches, a data minimization requirement, a sandboxed data analysis environment with strict access controls, and IRB oversight for academi…

Interesting. I can see that RAPPOR seems to be deprecated in favor of something else called ukm (Url-keyed metrics) but not why this change is being made. Is there somewhere I can read more about it?

I am not aware of any public announcement or explanation. Which is... probably intentional, since Google is removing a headline privacy feature from Chrome.

Re: Rally, a novel privacy-first data sharing platform

#80

Post by lucideer » Fri, Jun 25, 2021, 5:17 PM UTC

jonathanmayer wrote: post #24

thombles wrote: post #7

Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. There seems to be an assumption that users will be gleeful to throw their data at legitimate researchers from legitimate institutions doing legitimate work. What "data"? Browsing history? Identity? Something else? Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivatio…

Princeton research collaborator here. Glad to answer questions about Rally. > What "data"? Browsing history? Identity? Something else? That depends on the Rally study, since research questions differ and studies are required to practice data minimization. Each study is opt in, with both short-form and long-form explanations. Academic studies also involve IRB-approved informed consent. Take a look at our launch study…

I know you mean well but I think you completely missed the above commenters point.

You've replied here with answers to address their (our?) potential concerns, but the commenter never said they had concerns about the project itself, rather that this particular blog post doesn't "sell" or explain the value add well. That's feedback on the project's communication strategy, not on what it's actually doing.

> > Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivation presented here.

> The motivation is enabling crowdsourced scientific research that benefits society.

You seem to be confusing "theys". The question is what motivates participants, not what motivates researchers.