Proposal: Treat FLoC as a security concern • Hacker News Board

Re: Proposal: Treat FLoC as a security concern

#111

Post by ocdtrekkie » Sun, Apr 18, 2021, 8:09 PM UTC

jefftk wrote: post #101

ocdtrekkie wrote: post #92

Earlier quoted context omitted.

If we kill FLoC, my hope would be that Google still finds it untenable to backpedal on removing third party cookies... or that public awareness about Google's antiprivacy stance kills Chrome if they do backpedal. It's simple: We force Google to stop tracking us, or we stop using Google products.

Chrome is not the only browser working on more advertising-specific APIs as more-private replacements for third-party cookies. For example, Edge is proposing PARAKEET [1] for remarketing, and Safari has implemented an initial conversion tracking API [2]. [1] https://github.com/WICG/privacy-preserving-ads/blob/main/Par... [2] https://webkit.org/blog/8943/privacy-preserving-ad-click-att...

Yeah, I've heard of PARAKEET, and imagine concerns are quite similar to FLoC. Thankfully, Microsoft doesn't have the capability to push web standards, so as long as Google doesn't adopt it, we are good there. =)

Apple's solution doesn't look like it provides user interests or demographics, does it?

Re: Proposal: Treat FLoC as a security concern

#112

Post by dstaley » Sun, Apr 18, 2021, 8:12 PM UTC

kevingadd wrote: post #108

toomim wrote: post #97

The intro lost me: > WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code:" function disable_floc($headers) { $headers['Permissions-Policy'] = 'interest-cohort=()'; return $headers; } add_filter('wp_headers', 'disable_floc'); If you seriously think this is going to make…

FLoC exists to group users down into behavioral targeting categories, it should be obvious that some of those will end up corresponding to gender or race or other traits that are protected statuses. We've repeatedly had incidents where big companies were caught accidentally letting (for example) landlords filter advertisements by race or recruiters filter listings by age, both of which are illegal.

Yup, from the linked EFF article:

> Observers may learn that in general, members of a specific cohort are substantially likely to be a specific type of person. For example, a particular cohort may over-represent users who are young, female, and Black; another cohort, middle-aged Republican voters; a third, LGBTQ+ youth. This means every site you visit will have a good idea about what kind of person you are on first contact, without having to do the work of tracking you across the web.

Re: Proposal: Treat FLoC as a security concern

#113

Post by jefftk » Sun, Apr 18, 2021, 8:13 PM UTC

ocdtrekkie wrote: post #111

jefftk wrote: post #101

Earlier quoted context omitted.

Chrome is not the only browser working on more advertising-specific APIs as more-private replacements for third-party cookies. For example, Edge is proposing PARAKEET [1] for remarketing, and Safari has implemented an initial conversion tracking API [2]. [1] https://github.com/WICG/privacy-preserving-ads/blob/main/Par... [2] https://webkit.org/blog/8943/privacy-preserving-ad-click-att...

Yeah, I've heard of PARAKEET, and imagine concerns are quite similar to FLoC. Thankfully, Microsoft doesn't have the capability to push web standards, so as long as Google doesn't adopt it, we are good there. =) Apple's solution doesn't look like it provides user interests or demographics, does it?

PARKEET is much more like Chrome's TURTLEDOVE/FLEDGE than it is like FLoC ;)

There's a lot of cooperation here, and similar goals; I'm not sure why you think Microsoft and Google can't find an API they both like?

Re: Proposal: Treat FLoC as a security concern

#114

Post by Closi » Sun, Apr 18, 2021, 8:17 PM UTC

dstaley wrote: post #112

kevingadd wrote: post #108

Earlier quoted context omitted.

FLoC exists to group users down into behavioral targeting categories, it should be obvious that some of those will end up corresponding to gender or race or other traits that are protected statuses. We've repeatedly had incidents where big companies were caught accidentally letting (for example) landlords filter advertisements by race or recruiters filter listings by age, both of which are illegal.

Yup, from the linked EFF article: > Observers may learn that in general, members of a specific cohort are substantially likely to be a specific type of person. For example, a particular cohort may over-represent users who are young, female, and Black; another cohort, middle-aged Republican voters; a third, LGBTQ+ youth. This means every site you visit will have a good idea about what kind of person you are on first c…

To further back up the post - we have previously seen targeted advertisement used specifically to disenfranchise black voters, so there is definitely precedent.

Re: Proposal: Treat FLoC as a security concern

#115

Post by rmccue » Sun, Apr 18, 2021, 8:19 PM UTC

dang wrote: post #44

The submitted title was "WordPress Proposal to Treat Google's FLoC as a Security Concern". That makes it sound like Wordpress itself is officially making this proposal. Is it? The page doesn't look like that to me. We've reverted the title in keeping with the site rule: " Please use the original title, unless it is misleading or linkbait; don't editorialize. " ( https://news.ycombinator.com/newsguidelines.html ).

I’m a WordPress committer and (somewhat former) owner of some large parts of WordPress. This is correct; the Make blogs can be posted to by many members of the project, and this does not indicate a decision or “official” word by any means. (I could create a Make post right now with a counter-proposal if I wanted.) It’s not a proposal by the WordPress Foundation, nor by any of the project’s leads.

However, this does have more gravitas than a random blog post elsewhere, as those with the ability to publish are contributors to the project who have made significant contributions.

Take this post as if it’s an emailed proposal to a project’s mailing list.

Re: Proposal: Treat FLoC as a security concern

#116

Post by rmccue » Sun, Apr 18, 2021, 8:20 PM UTC

NotEvil wrote: post #81

r1ch wrote: post #70

Earlier quoted context omitted.

The page does seem to be the official wordpress development blog, linked from wordpress.org's "get involved" page. "The WordPress core development team builds WordPress! Follow this site for general updates, status reports, and the occasional code debate."

This is make.wordpress.org kinda like a issue tracker for WordPress core

It’s closer to a mailing list than an issue tracker; Trac (https://core.trac.wordpress.org) is the issue tracker.

Re: Proposal: Treat FLoC as a security concern

#117

Post by rmccue » Sun, Apr 18, 2021, 8:21 PM UTC

neolog wrote: post #109

dang wrote: post #99

Earlier quoted context omitted.

It looks like it to some and not to others, which is already confusing if it's an official proposal.

Clicking on the author's user profile [1] says they're a "Core Contributor". So maybe not the Wordpress org itself making the proposal but a core team member. [1] https://profiles.wordpress.org/carike/

“Core Contributor” indicates they have contributed patches to WordPress previously and received acknowledgement (props) in the commit message, or have otherwise contributed to the Core component (i.e. the codebase, as opposed to Support/etc). It doesn’t indicate commit access or project leadership necessarily.

That said, only significant contributors get access to post to Make.

Re: Proposal: Treat FLoC as a security concern

#118

Post by Closi » Sun, Apr 18, 2021, 8:23 PM UTC

x0x0 wrote: post #71

cortesoft wrote: post #64

Earlier quoted context omitted.

So if suddenly all tracking stopped, advertisers would just stop spending money on advertising? That doesn't seem right... advertisers published ads before tracking was a thing, they would still do it if tracking becomes impossible.

Huge amounts of it, yes -- particularly since the anti-floc people (which, to be blunt, I'm not in love with, particularly Google just deciding to do this on their own) tend to also be in the break 3rd party cookies camp. With respect to eg brand advertising: even if you get past an inability to measure impact, once you break most of the ad infra, ad buyers simply aren't going to negotiate / buy with small sites. It'…

Of course you can track ad impact and conversion - you just direct the ad to a certain url and see how many hits you get.

And banning extensive user tracking doesn’t mean “ending the ad supported internet”, that’s sensationalist to the max!

To suggest that ending tracking would mean that sites have to individually negotiate ads with individual websites isn’t true either - ad networks have and will always be a thing, regardless of the ability to track.

Re: Proposal: Treat FLoC as a security concern

#119

Post by hansoolo » Sun, Apr 18, 2021, 8:25 PM UTC

Proposal: use Firefox

Re: Proposal: Treat FLoC as a security concern

#120

Post by cortesoft » Sun, Apr 18, 2021, 8:30 PM UTC

x0x0 wrote: post #71

cortesoft wrote: post #64

Earlier quoted context omitted.

So if suddenly all tracking stopped, advertisers would just stop spending money on advertising? That doesn't seem right... advertisers published ads before tracking was a thing, they would still do it if tracking becomes impossible.

Huge amounts of it, yes -- particularly since the anti-floc people (which, to be blunt, I'm not in love with, particularly Google just deciding to do this on their own) tend to also be in the break 3rd party cookies camp. With respect to eg brand advertising: even if you get past an inability to measure impact, once you break most of the ad infra, ad buyers simply aren't going to negotiate / buy with small sites. It'…

First, you could still track a direct response conversion by including information in the url for if they click on it. You can still even track impressions by measuring requests.

Second, if this will truly cause a drop in advertising spend.... then that money will be spent somewhere else, which might boost a different industry.

I don't think this would really change advertising spend, though... it would just change the type of advertising and how it is tracked/paid for.

Advertisers still want to get their ads in front of people, and the amount of content to advertising demand wouldn't change.

In fact, I think a change to content based advertising will help with content quality. With user based advertising, an advertiser doesn't care if the valuable person is viewing good content or not. Content creators just need to attract the valuable eyeballs, and can use as much click bait and useless content as possible to get them.

With content based advertising, the advertiser will spend on quality content, because that is the only metric they have to try to reach quality users.