Hacker News Reader

Comment by bluesign | Hacker News Reader

I checked the sample log provided.

Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same person. Which is exactly what google describes. [1]

I don't understand what Brave claims.

  d.agkn.com          CAESEP-S3Zs5f0_kq11XTCZP_mE
  id.rlcdn.com          CAESEPpf2T4-2AsAR_4rer3RfNs
  image6.pubmatic.com          CAESEB9H3qdV26kxEiz-BJ_TY-M
  pippio.com          CAESEJyqG1Pg1j-_scqW8kDzTkg
  token.rubiconproject.com         CAESEE1DyZ245WggYaQZEWpQWI8
  us-u.openx.net          CAESEPIJ9jHcY2j4jK3-DPmfar4

[1] https://developers.google.com/authorized-buyers/rtb/cookie-g...

View on HN

This log [0], right? Did you miss in the article that it's the `google_push` identifier that's being used for syncing between adtech companies? If you search for it (AHNF13KKSmBxGD6oDK9GEw5O0kvgmFa3qM30zpNaKl72Og), you can see it being included in requests to lots of different adtech firms' domains.

[0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...

There is unfortunately no way to prevent that part.

BidRequest Data [0] and Request Time is already enough to fingerprint the user.

"Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based.

[0] Sample Data from Bid Request

  ip: "F\303\006"
  user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36"
  url: "http://www.myfitnesspal.com/food/calories/popeyes-buttermilk-biscuit-29980768"
  cookie_version: 1
  google_user_id: "CAESEIMlaNwMN-rtiDFzjwNIX6Y"
  timezone_offset: -360
  detected_content_label: 39
  mobile { is_app: false 3: "android" 8: 1 12: "google" 13: "pixel xl" 14 { 1: 7 2: 1 3: 1 } 15: 412 16: 732 18: 70092 19: 3500 }
  cookie_age_seconds: 12960000
  geo_criteria_id: 9023221
  device { device_type: HIGHEND_PHONE platform: "android" brand: "google" model: "pixel xl" os_version { major: 7 minor: 1 micro: 1 } carrier_id: 70092 screen_width: 412 screen_height: 732 screen_pixel_ratio_millis: 3500 }

> There is unfortunately no way to prevent that part.

“there is no way for google to operate under the GDPR and provide targeted advertising” ?

i’m inclined to agree :/

There is unfortunately no way to prevent that part.

Well there's absolutely a way: single-source JS and no CORS.

Lol.

>There is unfortunately no way to prevent that part.

It being technical impossible or infeasible does not give them license to not follow the law.

Either they comply with the law or they don't. I'm not a lawyer, but it certainly doesn't look like they're following the law here.

Like stopping? I do not do that and am surviving last I looked.

> There is unfortunately no way to prevent that part.

Couldn't each buyer get their own "auction ID" as well as their own "user ID"? Am I completely misunderstanding things?

Also another benefit of google_user_id vs Google's Ad Manager cookie is, it expires after 14 days. So after 14 days, you will get new google_user_id for same user. So syncing between adtech companies does not have much value.

You are implying that this mechanism is already used by adtech providers, we have no proof. Those players are often competitors that are not working together so they won’t share their user data (not a user identifier, only a “page load” identifier). If they want to sync their user ids (because one is buying inventory from the other), they can launch a cookie sync between themselves (same process as with google_gid, persistant user identifier, much more efficient)

which is the "workaround" to the gdpr the article badly describes (probably because brave upcoming ad network will do the same but more workaroundily)

now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways.

gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.

Well, the “right” workaround is an opt-in system. But that would drastically reduce the number of qualified ad prospects, reducing their wholesale value, killing the online ad business, drying up the websites themselves who exist for this revenue (some/many of which are trash, but not nearly all).

I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.

I don't think the EU, or consumers in general, are terribly interested in "compromising" with the ad-tech industry.

Not that I support the ad-tech industry, but those consumers probably are interested in having their favorite websites being kept alive. Which implies that they might indeed be interested in "compromising" with ad-tech industry.

Given the popularity of ad-blockers these days I'm not sure they're as interested as you think they are.

With current ad industry it's more about whether you are ok with being bullied or not.

Why should we give ad-tech their one millionth chance to "do the right thing"? They've proven time and time again they cannot be trusted.

it isn't about giving ad-tech any chance of anything, it is about websites that are liked and used by people (most of whom have either no means or no desire to support those websites with money directly) being able to sustain themselves in order to exist.

That's pretty much a false dichotomy: a site must either support itself via ads, or cease to exist.

There are other ways to get money to support your work, and if those ways are too painful right now, that's just an opportunity for disruption. Even better, it's an opportunity to prove that disruption doesn't have to be exploitative.

Not saying that it has to be ads only. If there comes a disruptive alternative revenue model that allows all those websites to self-support themselves, I will be one of the first people to jump the ship and advocate for the ban of ads in favor of that new model.

There are entire markets that cannot be accessed by publishers unless they subsidize content with ads. That is not a false dichotomy, that is a market requirement.

Not every website is the WSJ or Bloomberg, which cater to markets that are willing to pay for content.

Then maybe markets are the wrong tool to organized this kind of publishing.

If only there were other models for ad sales, say ones that were successfully used for decades prior to the advent of the internet and ubiquitous surveillance, that could be used instead of said ubiquitous surveillance...

But no. The internet enabled vast, invasive user tracking, therefore vast, invasive user tracking is the only conceivable way to sell advertising.

To be honest, that doesn't matter to me. I think that websites who inflict the ad-slingers on their readers are showing great disrespect to and disregard for their readers.

If consumers want it they will pay money, plus ads don't necessarily need to be targeted to readers.

More generally, if enough people (including the author) think the content has merit, they will choose to support it (by which I mean “collectively supply all the resources it needs to continue”).

The cost of running a basic website to publish text is modest. Tools like [dat][] and [scuttlebutt][] make it completely free (once you have a computer and any internet connection) to distribute content to people who actually want it.

[dat]: https://dat.foundation/

[scuttlebutt]: https://www.scuttlebutt.nz/

On the other hand, if you want to make a living out of producing content (rather than wanting to publish the content purely for its merit), that is harder — the content has to be that much more valuable to enough people.

As long as individuals can publish stuff, and others can see it and choose whether to support it financially (all without 3rd parties mediating/filtering), then I'm content. Our distributed tools make that possible; we just need to make them easier and more ubiquitous.

> but those consumers probably are interested in having their favorite websites being kept alive.

I'm one of "those consumers" and I'm actively looking for sustainable ways to pay content producers.

Here's what I do currently:

- subscribe to two newspapers in addition to the mandatory payments to the national news broadcaster.

- donate to the Guardian

- buy on Blendle

If there was a way to pay for single pay-walled stories I would probably use it a few times a week in addition to my current subscriptions.

I'm not interested in any more subscriptions (unless they are all inclusive like Spotify so I can cancel my current subscriptions, and even then I'm not sure since I actually want to support those two papers and think I do so better through direct payments than through revenue sharing through a huge international tech company. )

I know that I'm not interested in "compromising" with the ad-tech industry. They've been spending too much time and money attacking my defenses against their terrible practices for me to treat them as anything but an attacker.

> probably because brave upcoming ad network will do the same but more workaroundily

AFAICT Brave's plan is to send a block of potential ads to the client and use a client-side machine learning algorithm to choose specific ads. So the claim is that none of client events, inferences from the algo, nor ad choices travel from the client to the ad networks. (But ad networks retain their crazy microtargetting which I guess is the selling point.)

Even if Brave were to choose the blocks of ads based on geolocation and other install-time/runtime data which they then sell to third parties, it's still significantly less data leaking from the client's browser compared to, say, a default Chrome install. But them storing/selling that would be a clear GDPR violation as well as going directly against all their explicit public claims so far.

What is your understanding of Brave's upcoming ad network that leads you to believe it requires a surreptitious GDPR violation?

Reply on news.ycombinator.com