Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First-party isolation in Firefox: what breaks if you enable it?

ctrl.blog

Post reply on HN
Print view View original

61–70 of 120 posts

Re: First-party isolation in Firefox: what breaks if you enable it?

#61

Post by azernik »

jstanley wrote: post #60
d2wa wrote: post #58

Earlier quoted context omitted.

Native advertising trying to pretend its journalism by association is a much bigger problem than display advertising. Websites informing you about “great deals” with the voice normally reserved for actual journalistic endeavors (or even opinion pieces) in between their normal articles isn’t in any way desirable. Even big publishers don’t come clean about when articles are ads or not. E.g. https://www.ctrl.blog/entry/…

That's completely orthogonal to what is being suggested.

"Native advertising" has a very specific definition; GP assumed that standard usage. If GGP was intending to refer to advertising without tracking, that would be a non-standard definition.

https://en.m.wikipedia.org/wiki/Native_advertising

Re: First-party isolation in Firefox: what breaks if you enable it?

#63

Post by user3359 »

d2wa wrote: post #57
Doctor_Fegg wrote: post #43

Earlier quoted context omitted.

I’m curious - could you explain that impact? I use Matomo and had not noticed it.

Lets just say their best-practices was last updated sometime in the early 2000s. It’s 2018 and their client-side tracker is synchronously executed and holds up the entire page.

This seems to contradict Findus23 claim that it loads async. Regardless, asnyc="async" can be manually added to script tags.

Re: First-party isolation in Firefox: what breaks if you enable it?

#64

Post by ytjohn »

clumsysmurf wrote: post #4
wodenokoto wrote: post #3

> I’m not sure whether that is because Mozilla consider it unsafe, unpractical, or don’t want to commit to maintain the feature in future releases. I imagine it was implemented for the container tabs.

The main problem I see with account containers — still — is that you can't say "this container can only have certain websites in it". For example, if you put reddit in a "social" container, but click on links to the stories, then you have all of your cookies and stuff polluting the social container.

The Facebook Container Extension does this. The maintainers hard code the list, but it really makes me think that someone can make an extension to let a user manage a list themselves. As an early adopter of Facebook Container, I had to live through when I couldn't log into messenger.com (the only part of facebook I really used). For that specific project, they maintainers wanted to control the list of domains as opposed to allowing users to maintain their own list and "dilute" the effectiveness of the container for "everyone else". Ie, if something was missing, they wanted to fix it upstream and push it down.

I would like to see an extension like this for google. I do use google and I have set the various google apps I use to only open in the google container. But the main google.com/search domain does open in any container. I have to be careful if google prompts me to login to not login.

https://github.com/mozilla/contain-facebook/issues/45#issuec...

https://github.com/mozilla/contain-facebook/blob/1e37bc677ac...

Re: First-party isolation in Firefox: what breaks if you enable it?

#65

Post by cdubzzz »

d2wa wrote: post #57
Doctor_Fegg wrote: post #43

Earlier quoted context omitted.

I’m curious - could you explain that impact? I use Matomo and had not noticed it.

Lets just say their best-practices was last updated sometime in the early 2000s. It’s 2018 and their client-side tracker is synchronously executed and holds up the entire page.

This is just plain wrong. Matomo is async by default[0].

I appreciate the difficulty of considering how to monetize content that you put a lot of effort in to, but spreading misinformation on the very same topics you are writing about is harmful and short-sighted. Your responses here moved me from “this seems like an interesting blog to follow” to “nope”.

[0] https://developer.matomo.org/guides/tracking-javascript-guid...

Re: First-party isolation in Firefox: what breaks if you enable it?

#66

Post by TeMPOraL »

jstanley wrote: post #38
d2wa wrote: post #37

Earlier quoted context omitted.

Because technology alone can’t protect your privacy. You need to trust people. Google says they don’t track ads when configured to not-track. They provide technical details on what this means. It’s designed around the General Data Protection Regulation (GDPR). At some point there has to be trust. I trust that Google won’t risk millions of Euros in fines over lying about not tracking people.

> Because technology alone can’t protect your privacy. Technology alone actually does allow us to choose between "send data to Google and trust that they won't do anything bad" vs. "don't send data to Google and know that they won't do anything bad". EDIT: I appreciate that you care about privacy. You care about it a lot more than most websites seem to, so it does seem unfair that you're getting more flak in this thr…

> I notice this pattern a lot, in myself and others. When there's a choice between a solution that solves no problems, and a solution that tries to solve the problems but only manages half of them, the latter solution tends to get criticised for the half of the problems it doesn't solve, and the first solution doesn't get criticised at all.

It's called "Copenhagen Interpretation of Ethics", and it's a problem.

https://blog.jaibot.com/the-copenhagen-interpretation-of-eth...

TL;DR: "The Copenhagen Interpretation of Ethics says that when you observe or interact with a problem in any way, you can be blamed for it. At the very least, you are to blame for not doing more. Even if you don’t make the problem worse, even if you make it slightly better, the ethical burden of the problem falls on you as soon as you observe it. In particular, if you interact with a problem and benefit from it, you are a complete monster."

Re: First-party isolation in Firefox: what breaks if you enable it?

#67

Post by jefftk »

d2wa wrote: post #23
icebraining wrote: post #20

Earlier quoted context omitted.

The third-party can handle HTTPS just for that particular subdomain, using a separate certificate.

Yes, but this would significantly increase complexity.

It it really that bad, with automated certificate issuing via Let's Encrypt?

Re: First-party isolation in Firefox: what breaks if you enable it?

#68

Post by kibwen »

mehrdadn wrote: post #15
clumsysmurf wrote: post #4

Earlier quoted context omitted.

The main problem I see with account containers — still — is that you can't say "this container can only have certain websites in it". For example, if you put reddit in a "social" container, but click on links to the stories, then you have all of your cookies and stuff polluting the social container.

I feel like the cause is most likely that there are just too many darn websites for a user to be willing to specify them all. Solving this would seem to require some global database of "all sites run by company X" that undergoes constant maintenance.

How far would the WHOIS records go toward providing that info?

Re: First-party isolation in Firefox: what breaks if you enable it?

#69

Post by known »

stephengillie wrote: post #56
erinnh wrote: post #50

Earlier quoted context omitted.

If its just search engines, you dont exactly have to be logged in to use Google. Also, there are Google search-proxies like startpage.com

http://duckduckgoose.com/

site:news.ycombinator.com About 91,000 results (0.38 seconds)

site:news.ycombinator.com in google.com About 11,90,000 results (0.25 seconds)

Re: First-party isolation in Firefox: what breaks if you enable it?

#70

Post by jedberg »

I've been doing this the hard way for years -- running four browsers at all times, each for different things. Chrome is logged into Google, Firefox is logged into Facebook, Safari is for HN/Reddit, and Chrome canary is for other random sites that I don't want to have already logged in, like when I use the AWS console. And then I also use incognito windows for going to forums and deal sites and all those sites known for having 25 tracking bugs.

Overall it's not too bad, but there are definitely annoyances around not being logged into Google everywhere for example.

Post reply on HN