Hacker News Reader

Bunch of strawmen here.

> Is it wrong if I sit on my porch and record in a notebook the hair color of different people?

If you only count the number of redheads, you are in the clear. If you follow them around, find out where else they go, where they live, how many people live in their household, the household income, etc., you might violate some laws.

> Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?

Of course not.

>Fraud? Malware? What does this have to do with adtech?

A lot, actually. There are many vectors in which adtech and fraud/malware intermingle:

> XSS Attacks:

When your website loads HTML into a page without encoding it first, someone can insert HTML script tags that your browser will parse successfully, allowing arbitrary Javascript to execute in your browser. Malicious actors will then usually redirect you to further unsafe pages that will initiate more downloads or (depending on circumstances) compromise your active user session or credentials. All you need is an ad network that didn't take precautions for a malicious ad and you're serving malware to all downstream users.

>True Clickbait with a malware payload:

Less common nowadays in the sense I mean: Ads that are literally designed for you to click on them, giving the same result as above. We're talking things like "Punch out Osama Bin Laden!" from the early 2000s or "Click here to win a prize!" affairs, where there's no reason a user ought to be clicking on the ad except that they were, quite literally, baited into doing so.

>Normal Clickbait with a malware payload

Create some "interesting content", that just happens to also do all of the above. Miracle cures, "BIG cost savings", poorly vetted porn-ads, and so on. A lot of internet chum is of this type, and there's a great article analyzing it [1]

>Literal Scams:

Many ads presented on websites prey on low information individuals, the elderly, or the young, all of whom are less likely to know any better.

My point is, all of the above is served, with some regularity, over many ad networks today. This means in some sense, many ad networks are responsible for the ads they serve and the damage they cause their users; if not legally, at least morally.

[1] https://www.theawl.com/2015/06/a-complete-taxonomy-of-intern...

> XSS Attacks

Not true with safeframes

The latter two can happen on the internet in general, third-party advertising is in no way a unique delivery vector.

>safeframes

Safe frames are not the general solution that you make them out to be.

First, site owners have to actively choose to use safeframes. My personal opinion, just based on people I've spoken with about this, is that most businesses and individuals who run websites treat their ads as a black box and their security as an afterthought. This means any solution for security that isn't by-default and that non-technical site owners have to turn on themselves, with near total certainty, isn't going to be protecting users.

Plus, not all ad networks support it as of June 2017 [1]. In my view, it's less a solution than a "literally-crafted-by-the-ad-industry" [2] externalization of responsibility for users getting hacked due to poor network policing.

[1]https://www.monetizemore.com/blog/should-you-use-dfp-safe-fr...

[2] Page two of https://www.iab.com/wp-content/uploads/2014/08/SafeFrames_v1...

>What a compelling argument /s. Is it wrong if I sit on my porch and record in a notebook the hair color of different people? Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?

As far as I know, there's an invasion of privacy tort in common law: https://torts.uslegal.com/intentional-torts/invasion-of-priv...

P.S. I am not a lawyer.

I do not see how that applies to observing people when they have no reasonable expectation of privacy. And when using all these websites I'm pretty sure they put at the top of the ToS that they will be using your information.

The laws would hopefully stop the tracking of users. IS there a good reason why you can't analyze the page you put your ad in and decide what category on ads will fit, so on tech pages put tech related ads. Tracking me and creating a profile on me should be illegal. Showing ads is perfectly fine

KYC.

Google almost rabidly doesn't want to connect who is sponsoring with what they're sponsoring.

I'm an ad network that does (some) tracking of users. I make it a point to connect advertisers with the publishers I work with because I know all of my publishers. I think this service has value.

Whilst I charge substantially more than Google does, I'm confident I don't participate in any ad fraud. If a Google rep. suggests they don't serve ad fraud, let me know, because I have proof otherwise.

Can't you start a new kind of targeting, instead of tracking and analyzing the users you use your past expertise plus your data from non EU countries and profile the content, so on cat pictures you know what ads work well, on car sites you know what ads work, it would make more sense then seeing an IDE ad on a porn site.

Sure, but I (as an advertiser) don't want to buy advertising on cat pages, but to reach people who like cat pages. Google tells me this is their interest; that they have exhibited behaviours that lead them to believe this is their interest, and because they can make self-driving cars, I believe them.

... but: The truth is, it's just a cookie that is held by people who visited pages about cats, and people who like money.

The funny thing to me is even at the height of me allowing tracking... Ads based on my data were never good. Is there really a value being lost if we make ads non-personalized, or is this just a myth perpetrated to ensure data collection houses control the ad market?

> IS there a good reason why you can't analyze the page you put your ad in and decide what category on ads will fit, so on tech pages put tech related ads.

There isn't and this is what many people do. But that isn't the argument is it? Can you tell me why observing what people do on my website is unethical and why it should be made illegal?

Also can you explain why information that is placed on my server belongs to someone else if I didn't enter into a contract with them specifying that was the case?

If someone has access to your laptop and downloads their photos onto it, who do those photos belong to? Put another way, if someone shows you a photo, who does the memory of that photo belong to?

> Also can you explain why information that is placed on my server belongs to someone

Isn’t this more or less the gist of GDPR and “right to be forgotten” laws? That my personal data doesn’t automatically “belong” to anyone else just because I entered it onto a server?

> If someone has access to your laptop and downloads their photos onto it, who do those photos belong to?

Rights to creative works, unlike personal data already has rather well functioning legal frameworks. The author of a creative work doesn’t give up any right to the photo without very specific circumstances.

>Isn’t this more or less the gist of GDPR and “right to be forgotten” laws? That my personal data doesn’t automatically “belong” to anyone else just because I entered it onto a server?

Yes the EU invented a new right for its citizens which is the prerogative of the EU because of their bastardized idea of what constitutes privacy. Privacy is a basic human right, that much is obvious. There is no human right however to be forgotten and there is no human right to not be observed when you are in public.

>Rights to creative works, unlike personal data already has rather well functioning legal frameworks. The author of a creative work doesn’t give up any right to the photo without very specific circumstances.

The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.

The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.

Maybe not technically, but in practice, yes. You may be able to keep them, but you can't actually open and view them. As per MAI Systems Corp. v. Peak Computer, Inc., loading something into RAM counts as copying, so you need a license to do that. And even if you had one once, it can be revoked (not all licenses are non-revokable).

This sounds like a US legal case however, so I wouldn’t extrapolate this to odds of it being illegal worldwide.

There are several cases of US copyright law applying worldwide

> The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.

A valid point - the rights only address the USE of the photos. You can use them privately all you want and would not have to delete them (unless ordered by a court for whatever odd legal reason such as if they were stolen not uploaded).

The difference with personal info is that the lawmakers saw two choices: prevent the use or the keeping of the data. They chose to outlaw the keeping of the data - which is why this law is huge, invasive and clumsy. But it’s also the only reason it makes a difference at all imho. I don’t trust anyone to keep the personal data of millions of people safe.

GDPR is focused a lot on regulating the use of the data. In particular, one of the key aspects is the limitation of processing to a particular use - very often business will have a reasonable GDPR-approved reason to get and have the data, but (since this was often used to circumvent earlier privacy legislation) now they'll be limited to using that data only for that reason.

For example, if I order pizza, the business (obviously) needs to have my delivery address; however, that obvious reason only applies for the actual delivery, and if they want to use that same address also for, say, direct marketing, then that's a separate use that's not covered and would (generally) need additional opt-in consent.

> They chose to outlaw the keeping of the data

Which is not true. Under the GDPR, you are not allowed to "process" any data unless you have a legal ground for doing it. One such legal ground is consent, but it can be withdrawn and so at that point you need to "stop processing". The thing is, "processing" is a broad term and includes not just storage but basically anything that happens to the data. So even use is not allowed.

> There is no human right however to be forgotten

I don’t see the connection between what’s a right and what’s a law here. If a majority of people want something they tell their lawmakers to turn it into law. It’s not a fundamental human right it’s a law like any other.

The distinction is that violating someone's rights is almost always unethical. Breaking the law is less so.

If someone has access to your laptop and downloads their photos onto it, who do those photos belong to?

Good analogy! They belong to the person who took them, as per copyright law, not to the owner of the laptop.

The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully. If a creator downloads their entire collection onto my laptop I can use that to train my models and target ads as I see fit.

Nope, as I mentioned in my other comment: https://news.ycombinator.com/item?id=17060447

Loading into RAM counts as copying, for which you need a license.

Ypu can track as much as you want but let me know that you are recording my browser screen, my mouse movement, you try to fingerprint my browser using maybe bugs in the browser, so basically inform me, we can see the tracking code so is better you explain on how you use the data then the users to guess.

I'm not arguing against consumer protection and asking for consent. I'm arguing against stupidly burdensome regulation that practically makes ads as a monetization scheme impossible.