Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proposal: Treat FLoC as a security concern

make.wordpress.org

Post reply on HN
Print view View original

71–80 of 274 posts

Re: Proposal: Treat FLoC as a security concern

#71

Post by x0x0 »

cortesoft wrote: post #64
x0x0 wrote: post #60

Earlier quoted context omitted.

Also, nearly $125B was spent on internet advertising in the US in 2020, per the first estimate I found on the internet [1]. While Google and Facebook keep huge chunks of that, my guess is at least 40% flows through to publishers. So that's a $50B revenue stream to publishers (all sorts of web sites, including news; apps, musicians (via spotify and so forth)) that we're talking about breaking. I really don't believe p…

So if suddenly all tracking stopped, advertisers would just stop spending money on advertising? That doesn't seem right... advertisers published ads before tracking was a thing, they would still do it if tracking becomes impossible.

Huge amounts of it, yes -- particularly since the anti-floc people (which, to be blunt, I'm not in love with, particularly Google just deciding to do this on their own) tend to also be in the break 3rd party cookies camp.

With respect to eg brand advertising: even if you get past an inability to measure impact, once you break most of the ad infra, ad buyers simply aren't going to negotiate / buy with small sites. It's not worth their time or money. Small here is probably less than millions of uniques per day.

With respect to direct response advertising, you've mostly lost the ability to track a conversion. So it becomes pointless.

The advertising before extensive tracking was a different time: way way less money, way fewer ads, way less ad blindness amongst viewers, way way way fewer publishers, etc.

Will some advertising persist? Absolutely. eg the branded / source trackable referral codes that podcast advertising uses. But there will be an enormous falloff in dollars pointed at publishers.

And to be clear, I'm not a fan of 3rd party tracking. But we should be deliberate before we end the ad-supported internet.

Re: Proposal: Treat FLoC as a security concern

#72

Post by redwall_hp »

gruez wrote: post #29
meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

>WordPress is 41% of the web By domains or by visits?

As far as I'm aware, it's flawed in the same way as the PHP popularity stat: domains that report it in an HTTP header. I don't know about you, but I don't put a header advertising that I built a site with Python and Flask or whatever.

Re: Proposal: Treat FLoC as a security concern

#73

Post by redwall_hp »

geocrasher wrote: post #45
mritzmann wrote: post #38

Earlier quoted context omitted.

You don't need a plugin for this (every plugin is a security risk). You only need to send one single http header.

True, but modifying core files to send the header isn't good either because you'll have to redo the change at every update. Also, most security plugins such as Wordfence will choke on a modified core file, and rightly so.

You can chuck the same hook (as seen in the original link) into your theme's functions.php file. Or make your own plugin to hold miscellany.

Re: Proposal: Treat FLoC as a security concern

#74

Post by pm90 »

takeda wrote: post #59

I just love the Google's way of thinking. Users: We hate cookies, because they are abused to hurt our privacy by allowing advertisers to build a profile about us Google: We have a great idea! We can get rid of 3rd party cookies and instead make your browser build profile about you and share it with everyone.

IIUC while floc does indeed build a profile browser side it isn’t something that advertisers can track with the same precision as they can with 3p cookies.

So while it’s not the holy grail it does appear to be a small step in the right direction from the status quo.

Do I understand the situation correctly? Genuinely curious.

Re: Proposal: Treat FLoC as a security concern

#75

Post by spockz »

codegeek wrote: post #18
enlyth wrote: post #7

Earlier quoted context omitted.

This assumes the majority of these Wordpress websites will update to the latest version in a timely manner

If added as a security patch, lot of websites will auto update.

I’m not sure whether that would be wise to do for WP. It will show that WP can and is willing to basically push any update to sites running WP just to further a cause of the company.

Mweh if it doesn’t break anything. But terrible if it breaks something.

Re: Proposal: Treat FLoC as a security concern

#76

Post by quotemstr »

SpicyLemonZest wrote: post #21

I think this is starting to get to the level of a moral panic. I respect that these developers think FLoC is bad, but what does it have to do with the WordPress project?

In the age of social media, the loudest voices are frequently intolerant minorities who've virtue-spiraled themselves into extreme positions. The current opposition to FLoC is a great example of this phenomenon in action.

Re: Proposal: Treat FLoC as a security concern

#77

Post by clankyclanker »

blakesterz wrote: post #8

I am hopeful that this will help get rid of FLoC but I worry about two things. One, this will end up being treated like the "no track" headers. That's just totally ignored after IE (was it IE?) enabled it be default. That gave all the trackers a reason to just ignore it and track everyone. I don't know if that exact same thing can happen here, but something similar maybe? The other thing I worry about is that FLoC 2.…

What's to say Chrome will actually respect the opt-out headers in the first place? It could easily go like the DNT-headers, which was just interpreted as a signal to please-track-harder.

Re: Proposal: Treat FLoC as a security concern

#78

Post by mindslight »

SpicyLemonZest wrote: post #48
outside1234 wrote: post #40

Earlier quoted context omitted.

Just have everyone spoof Chrome then

A substantial amount of modern Internet infrastructure relies on the fact that major actors are behaving in good faith. This isn't a chain of escalation anyone would benefit from going down.

The surveillance companies have started us down the path of bad faith by nonconsentually tracking us via protocol and implementation bugs that leak identifying information. IMO Firefox et al need to keep working towards a better-specified JS runtime without these security vulns, so that when the layperson complains about big tech surveillance an easy answer is "Stop using Chrome".

Re: Proposal: Treat FLoC as a security concern

#79

Post by idreyn »

x0x0 wrote: post #71
cortesoft wrote: post #64

Earlier quoted context omitted.

So if suddenly all tracking stopped, advertisers would just stop spending money on advertising? That doesn't seem right... advertisers published ads before tracking was a thing, they would still do it if tracking becomes impossible.

Huge amounts of it, yes -- particularly since the anti-floc people (which, to be blunt, I'm not in love with, particularly Google just deciding to do this on their own) tend to also be in the break 3rd party cookies camp. With respect to eg brand advertising: even if you get past an inability to measure impact, once you break most of the ad infra, ad buyers simply aren't going to negotiate / buy with small sites. It'…

The ad infrastructure can still exist -- it would just have a restricted set of data (IP, device fingerprint, the surrounding content, and whatever info the first-party publisher voluntarily submits about you) to decide what ad to serve. Small, niche websites may do better than big news sites under this regime since you can infer more about their visitors by the fact that they chose to visit.

I could see bigger sites expending a lot of energy trying to bring the tracking and inference in-house, and even federating these efforts, creating a kind of soft-paywall that requires you to "pay" by validating an email address or some other stable identity marker in exchange for temporary access to content, so they can watch what you browse and build a shared model of you that they can feed back into the ad networks. I could see the NYT continuing to manipulate and fine-tune its headlines and graphics, trying to sort its visitors into cohorts based on what appeals to them to squeeze every last cent out of a pageview.

At the same time, so much content discovery and consumption happens in the belly of the beast (Facebook, Google, Youtube) that most ads will continue to be targeted based on the considerable information those websites have about you, regardless of what browsers do or what happens to third-party tracker networks.

Re: Proposal: Treat FLoC as a security concern

#80

Post by ognarb »

meattle wrote: post #2

WordPress is 41% of the web. If this goes through and FLoC is disabled by default by WordPress, will FLoC be dead on arrival?

My fear is that it will end up exactly like the do not track headers and that at some point Google won't listen to the disable Floc header.
Post reply on HN