Hacker News Reader

Comment by jefftk | Hacker News Reader

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but could be appropriate for different shops.

FB issued guidance suggesting domains like retail.example consider getting themselves added to the PSL, and now the PSL (a volunteer project) is getting a lot of requests. The PSL project has put these requests on hold, and asked FB and Apple to work this out. FB is talking to Apple in https://github.com/privacycg/private-click-measurement/issue...

[1] https://webkit.org/blog/11529/introducing-private-click-meas...

View on HN

It sounds like there's two cases:

1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM.

2. Sites that want to abuse an eTLD to do something like give all users on their social network a custom subdomain so that they're not polluting the same pool.

I think it was actually reasonable for Apple to consider the PSL as it's basically the most comprehensive eTLD list that we have and would allow them to match browser behavior.

The problem now is that case (1) is sending a bunch of requests at once as something will now actually break for these sites. Before now it was really just them being lax with security and not considering that cookies should be siloed. This isn't a unique situation btw, PSL also saw a large increase in inclusion requests when LetsEncrypt added rate limits based on eTLDs.

(2) is obviously bad and there's really no other justification for these sites being in the PSL.

Therefore I think it's reasonable for PSL to deny inclusion requests that are solely for PCM reasons.

This all being said, the PSL is a massive hack [1] and really needs to be replaced by something else. It probably is about time for these companies to invest in a replacement.

[1]: https://github.com/sleevi/psl-problems

Nice link to the GitHub issue which explains the problems clearly.

Can anyone explain why something like this wasn't implemented in the first place via DNS TXT records or tied to SSL somehow?

> Can anyone explain why something like this wasn't implemented in the first place via DNS TXT records or tied to SSL somehow?

The idea is to be able to use it without a network access, such as looking for unstructured URLs in text (e.g. "get a discount code at example.com/hn-reader"), formatting a URL in a browser bar (e.g. put the non-eDLD+1 in bold, or at least show the site name properly and not abbreviate all UK sites to "co.uk") or managing the cookie name properly (again, so everyone in co.uk doesn't share the same cookie).

Presumption is that the eTLDs are a tiny fraction (by orders of magnitude) from the domains registered under them so this db doesn't have to get too large.

I am not sure how to manage these strings automatically without them being spammed. They aren't all under the control of the TLD administrators (com.au is but cheapo-shop-hosting.com.au is not).

1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM.

uff, well I did not know about that list and we have a domain that uses multi-tenacy.

I mean I'm unsure to include it but it probably adds a security benefit, so that it is impossible to add bad cookies from subdomains.

edit: can't add it anyway I'm not sure but our provider only allows to renew for 1 year (I'm not sure if that is a tld limit, since I also do not see other additional domains with de inside the list)

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications:

1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains.

2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion process and institutes strict vetting to prevent abuse of PCM, which would presumably take months to implement.

This looks like a serious design problem with no solution that could be implemented before ATT drops.

> That would cause tremendous harm to all the small businesses who operate on subdomains of TLDs like myshopify, and for what?

This was the giveaway that it was an FB person. Parts of that comment is verbatim from FB propaganda ads[0]. Maybe that awkward video from ~last month[1] was targeted more at aligning FB employees internally around the message, not the general public.

[0] https://www.bloomberg.com/news/articles/2020-12-16/facebook-...

[1] Which I can’t find now

> This was the giveaway that it was an FB person.

I mean, they also say "Facebook finds itself in the position of trying to help advertisers navigate Apple’s ATT changes - answering a wide variety of questions. We ..." I think everyone involved knows this is an issue from FB?

Do you have an actual response to this point or are you just criticizing that multiple people made that same argument?

These people believe they’re lucky to work at a place like Facebook, and after reading some of these asinine comments, I'm inclined to agree.

The idea that they shit in the pool and get the swimmers to defend them sounds crazy, but people do defend Facebook’s doo-doo, and it makes sense that if you’re already covered in shit, it’s probably easier to pay people like this to walk around with shit all over themselves and say with a straight face “Apple should pay for our shit” than I ever thought.

The biggest problem is that no matter what “scale” of tracking is tolerable on a single domain / subdomain, Facebook still gets the aggregate.

So if you fix it for small multi-tenant domains, nothing changes for Facebook and they still get all the aggregate data, right?

There’s going to be a lot of collateral damage before ads and tracking get fixed IMO.

ATT?

https://developer.apple.com/documentation/apptrackingtranspa...

App Tracking Transparency

After limited reading on the subject only the quoted issue.

Maybe shops like Etsy or Shopify should make tracking a premium benefit that is possible when getting your own domain :) Feels like a upsell opportunity to me

Reply on news.ycombinator.com