81–90 of 246 posts
I appreciate it when my browser takes the position that it acts as the user's agent, and not the advertising network's agent.
Imagine how powerful a paid browser could become on this front. As people slowly become more privacy-aware this might be feasible.
Earlier quoted context omitted.
Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?
In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Goog…
Earlier quoted context omitted.
The issue with emails is worse because spam is unsolicited and can be sent from anywhere. That means that basically anything can be used to send spam, from botnets to miss-configured SMTP servers. On the other hand your fingerprinting/mining JS has to be served by a website that people willingly browse. That's a much higher barrier of entry and means that you can't just change your server's domain every hour lest you…
malicious advertising networks and advertising/JS botnet things have used fast flux DNS for a long time now. It's fairly standard practice for hostnames and IPs of things serving malicious content to have extremely low DNS TTLs, the malicious actors have scripted/automated their changes. https://www.welivesecurity.com/2017/01/12/fast-flux-networks...
Earlier quoted context omitted.
I agree it sounds harsh, but I think for NOW it's the correct choice. Like any browser API that can be abused, the small number of valid sites are so overwhelmingly dwarfed by the dodgy ones. When I first heard about the "notifications" API I thought it was a great idea - so many valid use case! Now I want it to burn in a fire. Something with so few use cases as cryptomining should not be something that users blindly…
Could we make Javascript optional as well while we're at it? "This site tries to run Javascript. Normal news sites shouldn't need this. [Allow this session] [Allow 5 seconds] [Deny]" I'd be particularily interested in the second option since it would allow us to use sites that depend on JS for content while they roll back the craziness that is depending on scripting to show static content. While I'm at it: I want bad…
I have no-script on by default, and these days I need be convinced there's a REALLY good reason to temporarily whitelist a site.
Sure, a lot of the web is now either a blank page (or "you need to enable js to run this app") but on the positive side, I'm a lot more productive as I just close those sites and move on!
Earlier quoted context omitted.
This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.
I wholeheartedly agree that we need to progress beyond the ad-driven business model but is in-browser mining really a plausible replacement? For one thing it's probably not a good idea on battery-powered devices, so it's only useful for monetizing desktop browsing. It also means that the money you make out of it depends on the average power your "customer" has available to mine. Beyond that since mining is a zero-sum…
I am not trying to diminishing this post, just want to point out that a great way to increase adoption would be to make a better and simpler-looking UI. A great deal of users prefer Chrome for this reason.
> This is great but the average user doesn't even know about fingerprinting. So? They don't understand password hashing, either. Doesn't mean it shouldn't be implemented.
Earlier quoted context omitted.
Mozilla devs seem to take this into account whenever adding new JS features, at least on their mailing lists. For example, this discussion of a new API for gamepads immediately turned to a discussion of its fingerprinting risks and how they can be mitigated: https://groups.google.com/d/msg/mozilla.dev.platform/75GrJSP...
The www has an API for gamepads. I need a moment.
Earlier quoted context omitted.
In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Goog…
> Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.
Google doesn’t actually have a problem in serving contextual ads on their own properties, since they have plenty of context. The problem is with AdSense since there advertisers need some sort of user profile, plus in the EU bidding exchanges are in jeopardy due to the GDPR.
I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the…
I appreciate it when my browser takes the position that it acts as the user's agent, and not the advertising network's agent.
Imagine how powerful a paid browser could become on this front. As people slowly become more privacy-aware this might be feasible.