Hacker News Reader

In other words the Chrome team doesn't care about users, it cares about ads. If it put users first, as it should, third party cookies would have been blocked a long time ago and they would be working on blocking other fingerprinting techniques now.

This is a great reason to not use Chrome.

Users don't care about ads, but users care about the things that ads fund. If publishers go out of business, users will be worse off.

Do you think the browsers should block all ads by default?

Yes.

(i am a user; i don't presume to know what is best for others; speaking as a user that talks to others like me; i don't need to speak about 'users' as a third party entity; i am a significant sample of the set)

Are you ready to pay every website you visit, then? With actual money that you yourself own?

As if ads is the only possible business model on the web.

At best the ad revenue is taking money away from other web business models by instituting that kind of mentality that drives people away from donations and paid accounts.

Please, consider a paid account/membership when you read the guardian, the intercept, or look for the donation page of quality content articles in wikipedia or any of the loads of blogs written by authors with patreon accounts.

Yeah, people will not collect subscriptions to content publishers like they collect emojis on their phones.

Estimate how many websites you visit each month; people would need dozens of monthly subscriptions if such a system was set up.

Instead, they will rather go to and pay google news, facebook press or apple information to get all their news content. Where would money be taken away then? Content publishers.

Donations exist, LMAO.

Why do you think Edge, Firefox, and Safari have chosen not to block all ads by default?

Thus Spoke The Googler

I mean MS makes money from their ad network, Firefox has always gotten their money from the largest online advertiser, and Apple can’t risk the potential lawsuit from pissed off ad networks.

The web shouldn't block ads, it should block JS entirely. There should be a 'global' permission system (similar to Android) that allows me to control exactly what information websites are allowed to access from my browser.

For example, I want to disable WebRTC as it can be used to collect my IP address, or disable WebGPU APIs or anything that can be used to finger print me.

JS has far, far, far too much broad access to information that might seem mundane but can be used to profile a user.

Android is the same - you can get the entire list of installed packages on the system and various other pieces of information to build a unique, persistable tracking ID.

There's also a lack of accountability: What information is being sent to what servers? I want a detailed JSON formatted breakdown of EVERY single piece of data that is being sent from my device.

I should be able to block anything that is outside my own determined comfort zone.

But most OS' just make requests to US IP's without much thought now - just turn on Windows 10 in a VM and watch as it sends so many requests with no insight into the data, which many companies (including Google) don't tell you about.

Ask me about a recent GDPR request to Google which I just got a generic response about (and they didn't action my request to delete information, so now I need to complain to the regulator because it was also late).

So yes, blocking ALL tracking by default is sensible.

Do you hold your mobile native apps to the same standard? As a former iOS developer I guarantee you there's a lot more of your data getting collected from those than you'd think and you can't do anything about it.

Maybe free newspapers go out, and free blog platforms go out, but that means that physical local papers don't go out of business and stop having to rely on clickbait. Losing some things means gaining others.

Sorry, clarifying: your prediction is that if internet ads became much less valuable we would see (a) the return of paper newspaper delivery and (b) the end of clickbait?

I doubt it'll go as far as that, but I'd expect at least that if people had had to pay for news all along, the news ecosystem would have been less devastated by the pay-per-click internet than they have been in reality.

Today's ads are what we used to call "spyware" back in the day and we used to purchase dedicated antispyware products that protected against them, so yes, browsers should block malware (so ads in their current state).

Browsers, after all, are user-agents designed to serve the user and not corporate interests. Technology as a whole should be there to make our lives easier, not waste our time.

Publishers will not go out of business don't worry. Clickbait will die off because the cheap nasty ads that currently make it viable will disappear. Tasteful, pleasant ads tailored to the current content, negotiated directly between the publisher and the advertiser will remain, and will be harder to block because they are just content served just like the rest of the content on the page instead from a nasty ad network domain.

> Do you think the browsers should block all ads by default?

Resounding yes. Such a thing would be the single greatest security improvement a browser could implement. It would also completely destroy pretty much the only vector online scammers have to reach you.

Most forms of advertising are totally fine. Hell I’m even favor of targeted advertising so long as it’s targeted to the content demographics instead the literal individual following them around.

I'm confused why you would say both that browsers should block all ads by default and that most forms of advertising are totally fine?

> I’m even favor of targeted advertising so long as it’s targeted to the content demographics instead the literal individual following them around

Then you might like FLoC (https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove). These are both ways of implementing targeted advertising without letting the advertiser or ad network follow you around.

Because internet ads are not most ads. If it's attached to an ad exchange or runs any code client side we're firmly in the "not fine category."

Types of ads that I don't like but I won't be up in arms about from a security perspective.

* Paying for sponsored reviews.

* Affiliate links and partnerships.

* Paying promoters and influences to push your product.

* "One way broadcasts" like billboards, commercials, magazines.

* In house ads like Kroger sending you coupons based on your purchase history at Kroger.

* Corporate press events like E3.

* Paying to post on the community billboard.

* Paying have a booth at professional/enthusiast conferences/trade shows.

* Stuff like E3/NintendoDirect/PAX/BlizzCon.

* Selling air time on radio, podcasts, online videos.

* Sponsored articles/announcements on blogs/news sites.

* Native advertising a la Buzzfeed where they would get paid to write a listical "top 10 things you should order off the secret menu at Taco Bell."

* Generic direct mailings and coupon books.

* Paying employees to suggest and guide customers through the sale provided they're upfront about it. I've seen Lululemon do it somewhat tastefully on Reddit when people post topics looking for recommendations.

But ads that come from ad networks/exchanges are nothing like these while simultaneously being the bulk of what ad blockers actually block.

So I don't see it as a contradiction. The kinds of ads that ad blockers block aren't usually these and are instead are the spyware/malware kind.

Nobody cares about users else apple would have allowed users to install others browser engines.

> a) Publishers lose about half their revenue because ads aren't personalized anymore: https://services.google.com/fh/files/misc/disabling_third-pa....

I am on the demand side, and the thesis and testing methodology seems extremely flawed.

If you disable third party cookies on a test group of certain publishers our (demand side) bidders will start optimizing towards the control group; this is very obvious.

Also, was this analysis conducted on other ad exchanges? For example, Google ADX makes only ~30% of the global traffic we get, and the traffic has very different characteristics from the traffic we get from APPNEXUS, Rubicon, etc.

I believe this is an analysis for Google's internal conclusions, and not for the industry in general. Has this been made public before?

> If you disable third party cookies on a test group of certain publishers

It says "turned off the availability of personalized data for a small fraction of randomly selected users" and "The experiment was applied to a small fraction of each publisher’s traffic because we did not want to materially affect publisher revenue, though in aggregate the amount of traffic evaluated as part of the experiment was significant". It sounds like you're responding to a version of the experiment that was run on a per-publisher basis?

> was this analysis conducted on other ad exchanges?

It says the experiment was conducted "through the programmatic arm of Google Ad Manager’s serving system". I'm not sure what this means, but I don't think it includes AppNexus or Rubicon.

I believe any publisher could run their own version of this experiment by picking a slice of traffic and telling all their bidders to only show non-personalized ads.

> Has this been made public before?

This document was released in August: https://www.blog.google/products/ads/next-steps-transparency...

> Using this system, we ran an experiment where we turned off the availability of personalized data for a small fraction of randomly selected users through the programmatic arm of Google Ad Manager’s serving system, thus effectively disabling access to cookies

This means the cookies for the auctions of a control group of users were not exposed. The experiment is still wrong, the bidders will still react in real time discarding the traffic without identifiers; specially since it comes from ADX where the identifier is the key to evaluating the model.

Not taking any other ad exchange into account is a huge flaw if you want to extrapolate the conclusions into conclusions for the whole industry. Other exchanges provide different identifying properties such as the 4th octet of the ip_address with each auction. Google ADX doesn't send this bit of information, they obfuscate the ip_address always. It's obvious that if you remove cookies from ADX, there is no reason to use ADX since the cookie is the proxy for your model on that exchange, but on the other ad exchanges you could survive just fine.

There is no way I read this experiment in which it makes sense as a conclusion for the whole ad industry.

The trouble is Apple shows this compromise is unnecessary. They work hard to block fingerprinting (especially on iOS) and it WORKS. iOS devices are mostly indistinguishable. Notoriously impossible to fingerprint.

Granted desktop fingerprinting is more of a challenge due to differing OS's, screens, GPUs for WebGL, etc. But it doesn't seem impossible.

They have also blocked third party cookies for so many years. The world did not catch on fire.

They use an advertising ID the user can reset.

I don't know very much about fingerprinting, but it sounds like the reason iOS devices are hard to fingerprint is that the hardware has very little variation?

I believe they also have an "identifier for vendor" that persists even after app uninstalls/reinstalls and is the same across all the apps from the same developer, so Apple are not ideal either. Still better than the competition though.

For an alternate empirical take:

https://weis2019.econinfosec.org/wp-content/uploads/sites/6/...

They find publishers only have a 4% premium on programatic ads that involve behavioral targeting.

Given the history of advertising on the web and advertising in general, I am hugely skeptical of anyone who claims that ethical personalized advertising is even possible.

It was critical to election tampering in 2016, it's been used for racism, sexism, and every imaginable sort of scam.

The only way personalized advertising would be remotely ethical is if it were explicitly opt-in. I notice that's not a thing on your list of steps Google is planning on doing. No surprise.

If you think personalized advertising is harmful and shouldn't exist anywhere across society you're going to need to pursue that through legislation and not technology. Otherwise platforms people log into (ex: Facebook) will continue personalizing regardless of what browsers implement.

As an aside, I appreciate you candidly discussing this.

Thanks!

I second that. It shows bravery. (Pun not intended)

I don't actually mind platforms personalising ads & content based on information I explicitly provide. I just don't want them stalking me around the web and trying to collect information behind my back.

What do you think of FLoC (https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove)?

FLoC is a decent idea and similar to something I thought of where there would be a standardised list of categories and the browser would just have an UI in its settings where you can select the categories you're interested in and the browser would send them in an "Accept" header.

Unfortunately back when I thought of this I wasn't aware of browser fingerprinting or all the other nefarious things the advertising industry is doing. Fingerprinting turns both FLoC and my idea into tracking vectors, so that's out of the question. The authors acknowledge this problem in the readme.

Turtledove is a longer spec and I haven't had the time to read it thoroughly, but while the idea is good, I see some potential problems - first off, this still involves executing JS to do the "ad auction" on the browser which could have security implications (they explicitly mention that JS should be prevented from talking to the outside, leaks would be vulnerabilities in this case, and I don't trust the ad industry to be nice and not attempt to exploit them); there's also the issue that I just don't want my device to expend processing power and expose me to potential security vulnerabilities for ads; I want ads to be served as static images from the website without the whole bidding thing. From an advertiser's perspective, I'm not sure how fetching the potential ads in advance and moving the auction on the client device would work - my understanding is that auctions are in real-time. I'm also not sure whether exposing all the ads to the public (even the ones that ultimately don't get chosen at the auction) and the auction details would reveal information that advertisers consider sensitive.

Finally, if you look at my other post here: https://news.ycombinator.com/item?id=22680559 you'll see that I have other problems with online and targeted ads besides the privacy and security aspect.

Unlike print and TV ads, there little-to-none human review, no accountability (Google isn't liable if they serve me a scam ad if I fall for it), and targeting allows to target scams to only the people most likely to fall for them while hiding these ads from the savvy people who would recognise the scam and report it. At the core, this isn't a tech problem but a law problem, but short of a law it can be solved by tech if we heavily block the current model of ads (targeted and served from a central ad network) so it becomes unprofitable and publishers & advertisers have no choice but to host static ads on their own domain, thus becoming liable if they host malware or something illegal (this would hopefully encourage human review).

Why not both? Any time somebody suggests a legislative solution, people come out of the woodwork to say that bad actors will continue being bad actors despite legislation. Privacy should be enshrined both in legislation and in practice.

My parent comment wasn't arguing for privacy, they were arguing against personalization.

Specifically, I referenced two proposals for privacy-preserving ad personalization, FLoC (https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove), and their response was that privacy wasn't the issue, the effects of personalization are harmful in themselves.

For privacy I do agree that you can't just do it with legislation and you also need technology. But if you think the issue is personalization itself, regardless of how privately it is implemented, then legislation is the critical playing field. Blocking personalization on the open web through technical means while allowing it in walled gardens means you (a) still have most of the claimed harms of personalization but also (b) massively disadvantage the open web.

Ah, I see. For me, the privacy-breaking aspects that are required to personalize ads are the primary negative aspect, and are what I focused on. While the parent comment only explicitly mentioned personalization of ads, tracking by ad companies for the sake of ad personalization is so ubiquitous that unless one explicitly makes a distinction, it is reasonable to take a reference to one as a reference to the other.

Reading through those links on FLoC and TURTLE-DOV, those are interesting concepts. My worry is that even though the ad selection is done in the browser, it will still leak significant information. For image/video ads, it would require bloating the amount of bandwidth used to serve the ads, or would leak information about which ad was selected by the client.

> For me, the privacy-breaking aspects that are required to personalize ads are the primary negative aspect, and are what I focused on.

The two are more or less intertwined. "Personalization" leaks information about people. It has also allowed advertisers to promote material targeting (or eliminating) otherwise protected groups.

People have been outed for being pregnant and for being gay, by outside observers noticing what promotions they were getting.

As I said previously, I think personalizing should be opt-in and under the users control. If I don't want my race/ political beliefs/ religion/ or sexual orientation tracked, that should be my choice, not under the control of a corporation.