Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open letter: Ban surveillance-based advertising

vivaldi.com

Post reply on HN
Print view View original

61–70 of 271 posts

Re: Open letter: Ban surveillance-based advertising

#61

Post by coder543 »

charcircuit wrote: post #54
coder543 wrote: post #48

Earlier quoted context omitted.

An IP address being used in the course of providing the service is not surveillance. That's like saying "Amazon knowing where to ship my package is surveillance." It's a bad argument, in my opinion. Regardless, consider a DDoS attack. If every new request is coming from a different IP address, how do you continue providing service to your legitimate customers while blocking that malicious attack? Knowing the attacker…

>That's like saying "Amazon knowing where to ship my package is surveillance." To complete the metaphor Amazon would use the address you gave them to help improve their business in some sense without asking you if it's okay. Similar to how web masters don't ask if it's okay if they write what pages we access into logs is okay. >Knowing the attacker's IP addresses doesn't do you any good... because they can just keep…

I've read your other replies to this thread and your argument does not seem to be made in good faith. This whole thread is about surveillance based advertising being bad. In no way is using an IP address in a firewall a form of surveillance. It isn't. The IP address isn't being associated with any other data, it's just some numbers floating in space, disconnected from any human being. There is no association with that IP address of what you like and don't like, what you have purchased, what links you have clicked, or anything else. It's just in a firewall, and that firewall rule could be blocking an entire CIDR block, especially in the case of IPv6. But even if it were surveillance, that's irrelevant to this discussion about the ethics of surveillance-based advertising.

I'm not going to waste my time further on this thread after making this one last point.

> This just slows down bot spam instead of testing if someone is a bot. Someone posting spam to your site once a minute is still annoying.

Google CAPTCHA is trivially bypassed all the time. Do you really think it isn't? Sometimes using services like Amazon Mechanical Turk, sometimes using simple computer vision. It doesn't test whether someone/something is a bot either... it just tests whether they can pass the CAPTCHA. It certainly doesn't test whether they're part of a DDoS, nor does it test their intentions to find whether they are good or malicious. It's just a CAPTCHA, but it also uses a lot of surveillance... and as I said, I have mixed feelings about that. I didn't mean for this to become the point of the thread, it is definitely off topic.

The idea of Proof of Work CAPTCHAs is that you can actually make it more expensive for an attacker to solve those than it would be for the attacker to solve Google CAPTCHAs. Obviously, this is still an area of debate and research.

Re: Open letter: Ban surveillance-based advertising

#62

Post by charcircuit »

Nextgrid wrote: post #59
charcircuit wrote: post #17

Earlier quoted context omitted.

>No, you don't have to spy on users to do it. Assuming you are running an ad network you kind of have to in order to prevent ad fraud. Also by reducing that data you know about someone's interests is the knowledge that they have visited a site at least you will not be able to pick as good of an ad compared to if you had more data.

Sell ads based on time periods. "Your ad displayed here for 1 week for this much $$$". Then the only thing that matters is the ROI and it doesn't matter how many bots have clicked on it.

This approach sounds much harder for an ad network to pull off and sounds like it would add a lot of risk and complication. For example, what if a web master decides they don't want to have ads on their site anymore. Whoever just paid for that space gets screwed.

Re: Open letter: Ban surveillance-based advertising

#63

Post by dkshdkjshdk »

charcircuit wrote: post #58
buran77 wrote: post #44

Earlier quoted context omitted.

If someone abuses your doorbell the solution isn't to install a hidden DNA and body scanner in front of your door. Also suggesting that an IP based rate limiter is the same as the surveillance in question is very disingenuous. Pick a more sensitive area than your IDE, say medicine targeting erectile dysfunction, sexual or religious preferences, etc. You may find that being allowed to collect that data, especially cov…

>If someone abuses your doorbell the solution isn't to install a hidden DNA and body scanner in front of your door. The first thing I would do is look outside to collect information on who in outside thereby infringing their privacy. >Also suggesting that an IP based rate limiter is the same as the surveillance in question is very disingenuous Recording people's IPs is definitely surveillance. >say medicine targeting…

> The first thing I would do is look outside to collect information on who in outside thereby infringing their privacy.

Looking at someone doesn't infringe on their privacy. Taking a picture of that someone and storing it in a permanent fashion, might. To prevent abuse/DOS you only need to do the first (which does not constitute "surveillance" or loss of privacy), not the second.

> Recording people's IPs is definitely surveillance.

It's not surveillance if you are not tracking anything else other than IPs (i.e. no other behavioural data associated to it).

Either way, you still have not provided an example where surveillance is required to prevent abuse: I can simply store hashes of "bad IPs" (or ASNs) to blacklist... no need to store any information that could lead to an actual person (like an actual IP address).

Re: Open letter: Ban surveillance-based advertising

#64

Post by danbruc »

charcircuit wrote: post #50
danbruc wrote: post #42

Earlier quoted context omitted.

Is is not surveillance - at the very least not in the relevant sense - if you maintain a temporary list of IPs you have seen in the past minute or hour. This is your best argument why we have to track and profile every human on the planet around the clock?

>if you maintain a temporary list of IPs you have seen in the past minute or hour. This is totally surveillance. Just because we delete data after a while, it doesn't mean I didn't surveil you, nor does it mean I haven't used that data I got from you for my own benefit. >This is your best argument why we have to track and profile every human on the planet around the clock? You just asked for an example. If you are su…

This is totally surveillance.

It is not. I connected from some IP because I wanted to use your website, at the very least you have to remember my IP address for some time to send me your website back. And if I want to access your website and it will be only available if you store my IP address for a few minutes to fight off attacks, then this is a use of my IP address that I welcome because it is for my benefit. And if you really want to, just store hashes of the IP addresses [1].

Just because we delete data after a while, it doesn't mean I didn't surveil you [...]

Sure, surveillance is not defined by the amount of time you store some data. If you store my shipping address for years it is not surveillance, if you store my IP address for one second to add an entry to my record in your database that I just visited the website it might be surveillance even if you do not permanently record my IP address. But I never claimed that the amount of time you store some information is a or the relevant criterion

[...] nor does it mean I haven't used that data I got from you for my own benefit.

Also irrelevant. If you store my IP address for a short time or my shipping address for a long time in order to send me the website I requested or my order than this benefits you because you will make some profit from my order.

Relevant for whether something is surveillance or not is whether I approve what you are doing. If you track my position day and night in order to show me ads for businesses nearby it is surveillance unless I specifically requested this. If you track my position because I am using a fitness app and requested to record my run, then it is not surveillance.

[1] For IPv4 this is of course essentially pointless. But maybe you could come up with a more elaborate schema than simple hashes, maybe salt them and rotate the salt every few minutes or whatever. But you will probably not gain much besides added complexity.

Re: Open letter: Ban surveillance-based advertising

#65

Post by Nextgrid »

charcircuit wrote: post #62
Nextgrid wrote: post #59

Earlier quoted context omitted.

Sell ads based on time periods. "Your ad displayed here for 1 week for this much $$$". Then the only thing that matters is the ROI and it doesn't matter how many bots have clicked on it.

This approach sounds much harder for an ad network to pull off and sounds like it would add a lot of risk and complication. For example, what if a web master decides they don't want to have ads on their site anymore. Whoever just paid for that space gets screwed.

This can all be sorted by contracts? The ad network pays out only after the ad has fully ran for 7 days, and if the webmaster removes the ad or similar they don't get paid and the advertiser gets refunded. Enforcing this is trivial by the ad network or a neutral third-party scraping the websites running the ads to confirm the ads are displayed properly.

Re: Open letter: Ban surveillance-based advertising

#66

Post by pjerem »

pasabagi wrote: post #55

I think there's a simpler way to achieve this. Force companies who leak personal data to pay reasonable damages to all the individuals involved, on the scale of 10-100 dollars, depending on how much personal info has been leaked. That would make businesses very quickly reassess how much data they need to keep, and how careful they need to be with it, without requiring any really radical legislation.

Yeah but what is a leak ? Do you consider it a leak when a data transfer to another company is intentional ?

Companies like Google are probably secured like fortress and will probably not leak data anytime soon (lets hope) so your idea wont have any effect against giants that takes security seriously.

However, I really like your point and you'll probably have a good side effect on middle size companies. But giants are a giant part of the problem.

Re: Open letter: Ban surveillance-based advertising

#67

Post by layoutIfNeeded »

charcircuit wrote: post #27
danbruc wrote: post #22

Earlier quoted context omitted.

This is ridiculous. If I am trying to advertise an Elixer IDE, then I don't want my advertisements shown to any random person on the internet. The majority of users on the internet are not even developers. I want to be able to advertise to a consumer segment which consists of people who are interested in Elixir. "Surveillance" is essential to internet advertising. This is ridiculous. And it is your problem. Why shoul…

Because I don't want to waste the time of people who aren't interested in my ad in seeing my ad. It's a waste of money for me. The ad network will not be able to make money from having them click the ad. The user's time will be wasted because they are not interested in what I am selling. It's a lose lose lose situation. I want to create more win win win situations where everyone benefits. Tracking and profiling is ne…

>The user's time will be wasted because they are not interested in what I am selling.

I'm not interested in what you're selling. In general, I'm 100% not interested in anything anyone is selling through advertisements. Where can I indicate this, so that advertisers stop wasting their money on me?

Re: Open letter: Ban surveillance-based advertising

#68

Post by datavirtue »

charcircuit wrote: post #27
danbruc wrote: post #22

Earlier quoted context omitted.

This is ridiculous. If I am trying to advertise an Elixer IDE, then I don't want my advertisements shown to any random person on the internet. The majority of users on the internet are not even developers. I want to be able to advertise to a consumer segment which consists of people who are interested in Elixir. "Surveillance" is essential to internet advertising. This is ridiculous. And it is your problem. Why shoul…

Because I don't want to waste the time of people who aren't interested in my ad in seeing my ad. It's a waste of money for me. The ad network will not be able to make money from having them click the ad. The user's time will be wasted because they are not interested in what I am selling. It's a lose lose lose situation. I want to create more win win win situations where everyone benefits. Tracking and profiling is ne…

Advertise on search. Someone searches for IDE or something similar...show the ad. It's better than running around profiling people and showing them ads for things based on that profile. No tracking needed.

Re: Open letter: Ban surveillance-based advertising

#69

Post by charcircuit »

coder543 wrote: post #61
charcircuit wrote: post #54

Earlier quoted context omitted.

>That's like saying "Amazon knowing where to ship my package is surveillance." To complete the metaphor Amazon would use the address you gave them to help improve their business in some sense without asking you if it's okay. Similar to how web masters don't ask if it's okay if they write what pages we access into logs is okay. >Knowing the attacker's IP addresses doesn't do you any good... because they can just keep…

I've read your other replies to this thread and your argument does not seem to be made in good faith. This whole thread is about surveillance based advertising being bad. In no way is using an IP address in a firewall a form of surveillance. It isn't. The IP address isn't being associated with any other data, it's just some numbers floating in space, disconnected from any human being. There is no association with tha…

>your argument does not seem to be made in good faith

I'm not exactly sure what this means. I used to be all for total privacy, but I found that future to not be sustainable. Perhaps I'm just jaded, but privacy just gets in the way.

>This whole thread is about surveillance based advertising being bad.

Well this part of the thread isn't. It's talking about how surveillance improves services by allowing them to deal with abuse.

>In no way is using an IP address in a firewall a form of surveillance. It isn't. The IP address isn't being associated with any other data, it's just some numbers floating in space, disconnected from any human being.

Wrong. I am using your IP as part of a scheme to fingerprint you. I want my rate limit to limit each person separately. An IP address is just a somewhat decent way to approximate that.

>The idea of Proof of Work CAPTCHAs is that you can actually make it more expensive for an attacker to solve those than it would be for the attacker to solve Google CAPTCHAs.

This has to be carefully balanced with the user experience. No user in going to want to wait 5 minutes to post when they can just have a Google account with a good reputation and just click a checkbox.

Re: Open letter: Ban surveillance-based advertising

#70

Post by charcircuit »

layoutIfNeeded wrote: post #67
charcircuit wrote: post #27

Earlier quoted context omitted.

Because I don't want to waste the time of people who aren't interested in my ad in seeing my ad. It's a waste of money for me. The ad network will not be able to make money from having them click the ad. The user's time will be wasted because they are not interested in what I am selling. It's a lose lose lose situation. I want to create more win win win situations where everyone benefits. Tracking and profiling is ne…

>The user's time will be wasted because they are not interested in what I am selling. I'm not interested in what you're selling. In general, I'm 100% not interested in anything anyone is selling through advertisements. Where can I indicate this, so that advertisers stop wasting their money on me?

Use an adblocker.
Post reply on HN