Live data from Hacker News

Proposal: Treat FLoC as a security concern

make.wordpress.org

91–100 of 274 posts

Re: Proposal: Treat FLoC as a security concern

#91
post #29

Earlier quoted context omitted.

>WordPress is 41% of the web By domains or by visits?

As far as I'm aware, it's flawed in the same way as the PHP popularity stat: domains that report it in an HTTP header. I don't know about you, but I don't put a header advertising that I built a site with Python and Flask or whatever.

I guess those go in the "None" bucket, so I think they are counted.

https://w3techs.com/technologies/overview/content_management

Re: Proposal: Treat FLoC as a security concern

#92
post #54

Earlier quoted context omitted.

Safari and Firefox already block them by default, and Chrome is set to block them before 2022: https://www.wired.co.uk/article/google-chrome-cookies-third-... The FLoC proposal (and others) are happening now because of the coming cookiepocalypse.

The causality is more complex: Chrome's approach from the beginning was that they would remove third-party cookies and replace them with more private alternatives like FLoC: https://blog.chromium.org/2020/01/building-more-private-web-... (Disclosure: I work on ads at Google, speaking only for myself)

If we kill FLoC, my hope would be that Google still finds it untenable to backpedal on removing third party cookies... or that public awareness about Google's antiprivacy stance kills Chrome if they do backpedal.

It's simple: We force Google to stop tracking us, or we stop using Google products.

Re: Proposal: Treat FLoC as a security concern

#93
post #54

Earlier quoted context omitted.

Safari and Firefox already block them by default, and Chrome is set to block them before 2022: https://www.wired.co.uk/article/google-chrome-cookies-third-... The FLoC proposal (and others) are happening now because of the coming cookiepocalypse.

The causality is more complex: Chrome's approach from the beginning was that they would remove third-party cookies and replace them with more private alternatives like FLoC: https://blog.chromium.org/2020/01/building-more-private-web-... (Disclosure: I work on ads at Google, speaking only for myself)

If Chrome wants to be the only browser with third-party cookies, they're welcome to, I suppose. Breaking down Chrome's dominance has to start somewhere, and having a straightforward, easily verifiable reputation as the single least private browser on the market is a decent start. I already know what the headlines from most sites will look like if Chrome decides to reverse course.

If only Firefox was removing cookies, that would be a problem, because Chrome could just ignore them. But with Safari on board as well, and with the entire iOS market at stake for sites that try to ignore the policy...

If Chrome doesn't remove third-party cookies, they will be the only browser anywhere not to do so. Chrome's original stance might have been conditional on finding a replacement, but I'm not sure they still have a choice at this point. I don't think Google is going to hand that selling point to Apple, and you're seeing yourself in these comments that a lot of the people following this issue didn't accept Chrome's original promise as conditional.

And maybe Chrome is confident enough in their market position that they're willing to take that hit and they think it won't matter. Maybe they're even right. From my perspective, breaking Chrome's dominance on the web is a necessary thing that needs to happen eventually for the health of the web, so every time that Chrome makes their browser worse in a highly public way, that's a win.

Remember that Firefox and Safari are already blocking the majority of third-party cookies online, and those browsers still work today, the web hasn't broken for them. So every year that Chrome spends delaying that deprecation is another year where people like me can point out that they're lagging behind literally the entire market on privacy.

Re: Proposal: Treat FLoC as a security concern

#94
post #52

Earlier quoted context omitted.

These are strategies that are being aggressively restricted. Chrome has not started preventing third party cookies yet , but they're the last holdout and have already stated they will kill them shortly. If you're using a non-user-hostile browser, these strategies are already heavily limited by default and are already not a concern. Every Firefox release is making significant improvements on reducing the fingerprintin…

> Chrome has not started preventing third party cookies yet, but they're the last holdout and have already stated they will kill them shortly. Chrome's original announcement about phasing out third-party cookies is explicit about new technologies like Privacy Sandbox (which includes FLoc) being how third-party cookies will no longer be needed: "After initial dialogue with the web community, we are confident that with…

Rhetorical thought question: How long could Chrome survive as the only browser which refuses to stop tracking users? The idea that Chrome was the fastest or best browser has fallen pretty far out and behind those which block tracking scripts and ad content, and two alternatives to Google straight up pay users to use them, where's the carrot for using Chrome?

Re: Proposal: Treat FLoC as a security concern

#95
post #54

Earlier quoted context omitted.

The causality is more complex: Chrome's approach from the beginning was that they would remove third-party cookies and replace them with more private alternatives like FLoC: https://blog.chromium.org/2020/01/building-more-private-web-... (Disclosure: I work on ads at Google, speaking only for myself)

If Chrome wants to be the only browser with third-party cookies, they're welcome to, I suppose. Breaking down Chrome's dominance has to start somewhere, and having a straightforward, easily verifiable reputation as the single least private browser on the market is a decent start. I already know what the headlines from most sites will look like if Chrome decides to reverse course. If only Firefox was removing cookies,…

> If only Firefox was removing cookies, that would be a problem, because Chrome could just ignore them. But with Safari on board as well, and with the entire iOS market at stake for sites that try to ignore the policy.

nit: Safari was ahead of Firefox here, with ITP 1.0 blocking most third-party cookies by default in 2017.

Re: Proposal: Treat FLoC as a security concern

#97
The intro lost me:

> WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code:"

    function disable_floc($headers) {
        $headers['Permissions-Policy'] = 'interest-cohort=()';
        return $headers;
      }
    add_filter('wp_headers', 'disable_floc');
If you seriously think this is going to make a difference in racism, of all things... I mean... do people seriously think that? Do you know what racism is anymore?

Re: Proposal: Treat FLoC as a security concern

#98
post #75

Earlier quoted context omitted.

If added as a security patch, lot of websites will auto update.

I’m not sure whether that would be wise to do for WP. It will show that WP can and is willing to basically push any update to sites running WP just to further a cause of the company. Mweh if it doesn’t break anything. But terrible if it breaks something.

It's the WordPress Foundation and the code is driven by a community, not really a company with a chain of command...

Re: Proposal: Treat FLoC as a security concern

#99
post #87
post #44

The submitted title was "WordPress Proposal to Treat Google's FLoC as a Security Concern". That makes it sound like Wordpress itself is officially making this proposal. Is it? The page doesn't look like that to me. We've reverted the title in keeping with the site rule: " Please use the original title, unless it is misleading or linkbait; don't editorialize. " ( https://news.ycombinator.com/newsguidelines.html ).

> That makes it sound like Wordpress itself is officially making this proposal. Is it? Seems like it is to me.

It looks like it to some and not to others, which is already confusing if it's an official proposal.

Re: Proposal: Treat FLoC as a security concern

#100
post #97

The intro lost me: > WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code:" function disable_floc($headers) { $headers['Permissions-Policy'] = 'interest-cohort=()'; return $headers; } add_filter('wp_headers', 'disable_floc'); If you seriously think this is going to make…

I mean I'd be willing to listen to an argument that FLoC will contribute to systemic racism. I accept that it's plausible.

But it really makes me distrustful of the whole proposal when people make wild claims like that and don't feel like they need to make even the briefest attempt to back it up. It seems a lot more like they're just taking the currently trending social cause and co-opting it to support their own unrelated agenda.

Post reply on HN