Everybody Hates “FLoC” | Hacker News Reader

Everybody Hates “FLoC”

arstechnica.com

I find the visceral reaction against FLoC interesting. On paper it is an improvement over explicit 3rd party tracking cookies that are used to monitor the sites you visit and are ultimately used to categorize you. Just something about "we're gonna stamp you with some labels and broadcast them to every site you visit" really provokes people even though the end results are the same as before.

I think some of what you're seeing is that any of this kind of stuff exists at all. That any level of monitoring and tracking behavior exists without clear and explicit permission from the human/agent; The attempts at making this behavior the status quo and "just how things are" when in fact it is not; The gaslighting with threats of the Internet itself going away if we don't cede to the advertisers; the scolding those opposed as freeloading, small-business haters, as if ads are the only source of remuneration left to exist.

It's that sort of stuff that fuels some of the more pronounced objections, I suspect. It's what fuels mine.

Edit: I'm still bad at HN formatting.

> the end results are the same as before

Except it's not. In the old world, advertisers literally track you around the web and gather data about every single website you've visited, how long you've spent there, and so on.

In the new world, they basically just get an anonymized "group" you belong to that roughly gives them what you're interested in. They wouldn't know who you are or anything else about you, just that your in group 8123 and that group happens to generally visit a lot of websites related to fishing.

Old: Google collected data, kept it on their servers, and sold advertising against that data. They don't ask permission, they don't let you black out categories you don't want to see advertising against. Nor do they (effectively) prevent malicious actors from using that advertising to sell content to manipulate people.

Now: Exactly the same, only Google uses your hard drive to store the data.

There are some privacy issues addressed by this, but it doesn't address many of the issues with personalized targeting.

It's neat when you are talking about things like fishing, but targeted advertising has also been used in multiple countries to manipulate elections by outside governments. It's also been used to out gay people and racist marketing.

If your problem is targeted advertising, then yes, this definitely isn't trying to solve that. The goal here is to solve your data being leaked all over the internet.

We can have an entirely separate discussion on whether the value of targeted ads. You named a few downside but are completely ignoring the upsides. The fact that without them, anyone other than large corporations would be entirely cut out of advertising their product. Any small business or creator with a niche demographic is basically screwed.

If you make an app for some video game, a cure for some specific disease, gear for a specific sport, all those people would basically be locked out of advertising their products.

> The fact that without them, anyone other than large corporations would be entirely cut out of advertising their product

I don't follow your premise.

Big ad networks and targeting make advertising slicker, but that's different from making it possible at all.

In the world of Google ads and targeted profiles, you ask for demographic units, and buy a handful of impressions on a thousand random sites that you've been promised are to relevant viewers.

Without profiling, you'd have to focus on where you want the ads to appear-- either by negotiation with individual publishers, or using an ad network that lets you select publishers by category or requesting page-level keyword matches.

You can’t attack the problems online advertising presents one by one, any solution needs to think about the other issues around it. It isn’t just about privacy.

If there was a reasonable sized white list of fairly harmless “interests”, then maybe. The way things are now, interest groups are too fine grained and far too personal.

I’m not convinced at all that granting small businesses access to this kind of targeted advertising is worth the risks it introduces.

Safari and Firefox block 3rd party cookies already. And advertisers won't stop using other fingerprinting techniques just because FLoC exists.

There is no new world. There is only the old world with more tracking. It’s not like FLOC magically removes existing tracking tools, or that not having it stops existing tracking reduction efforts.

You contradict yourself. It's not any "improvement" if the results are the same as before.

The user realizes no "improvement" here at all. The bottom line is that 3rd party cookies were being successfully blocked --- and for good reasons --- so Google built a workaround --- which is now being blocked too.

The apparent plan being that most users are clueless lemmings who will continue to use Google Chrome --- for no good reason. Stupidity gets exploited --- a universal law of commerce.

the problem is that people don't like the status quo, and FLOC is advertised as solving that but it doesn't.

So it's a new technology, with new complexity, and unknown additional attack surface (in the sense of attacks on user privacy) that doesn't do anything to actually reduce the tracking of users.

The status quo is advertisers tracking every single website you visit, and keeping a personalized profile of you with all your data in there.

The system under FLoC means they don't see anything about you and which site you've visited, they only get a single cohort ID, which is group roughly representing your browsing behavior.

How are these the same?

The status quo is advertisers use every fingerprinting technique at their disposal. The system under FLoC is advertisers use every fingerprinting technique at their disposal including the FLoC header.

3rd party cookies aren't part of the status quo. Safari and Firefox block them already.

FLoC by itself doesn't solve fingerprinting, the but larger Privacy Sandbox effort does have changes such as Privacy Budget which aim to fix fingerprinting.

The changes that improve privacy don't depend on FLoC.

Who controls the cohorts? Can membership in the wrong one mean a death sentence in some countries?

Google does and the cohorts are opaque and data generated based on history. They're not actually using this specific approach but roughly what they're doing is like taking your browser history, representing it as some vector of numbers and then clustering nearby points together and giving each cluster a cohort id. Cohort ids are also updated periodically (roughly weekly). The clusters are most likely to be surface level interests. The id itself doesn't give you that though and you'd want many users with same cohort ids, correlate there behaviors, to try to guess what underlying browse trend it means which is a lot better than the current state of things of effectively having a user id with 3rd party cookie.

It seems to me that decoding FLoC IDs will be a big business, given their value. So people will do their best to reverse the system and keep an up-to-date table for at least some of the more valuable/interesting cohort IDs, if not all of them. In the worst case you can do this just by paying volunteers with known interests and recording their FLoC IDs. Presumably that will be done enough that at least some of the data is available for sale.

My further understanding is that FLoC IDs will be available to any website. So even if you’re too small to run a global tracking network, you can grab the FLoC ID from any visitor and, assuming that decoding services exist, turn that into useful data instantly.

The average person will also put ads on their blog to generate revenues.

FLoC is better tracking in a world where many people don't want to be tracked.

Or, in other words, perfect is the enemy of good?

We're talking about the mass erosion of privacy in order to tell whether to show someone an advert for fishing rods rather than PlayStation based on more than the content of the page they're viewing right now. Maybe perfect is actually achievable here. It is, after all, 'simply' a mechanism by which people can genuinely opt out of tracking that tech companies abide by.

Why is that so hard that we give up and accept tech companies ignoring people's freedom and liberty to choose not to be tracked?

FLoC only has benefits compared to 3rd party cookies. But other browsers block 3rd party cookies already.

Safari and Firefox block 3rd party cookies.

3rd party cookies will be removed from most browsers, including Chrome, by next year .

> the visceral reaction against FLoC

The article title contains the word "everybody" which is evidence of the authors tendency to deal in absolutes. He is claiming to speak for us all with this loose assimilation of words ("hates" further describes an emotional disposition towards idea proposal, and the tagline is equally charming). Let's make it our mission to be polite for a cleaner archive of Internet Interaction Instances. I will not match the negative energy and instead proceed to be cordial&calculated in the delivery of my opinion (I lost sleep over this last night).

Thiel on Weinstein's "Portal" ventured the "eye of Sauron" metaphor [0] to describe the effect of surveillance on generations developing during the Information Age. The "double-slit experiment" is also relevant here (modern scientific lore suggesting that the act of observation influences outcome - "spooky action"). Tolkien and Wagner both constructed epic "entertainment" sagas that describe elaborate human feud because of a "golden ring of power". Both of these works were written after the Industrial Age had fully (quickly) propelled civilization into a new form, with recent regional warfare fresh in the memories of the aforementioned authors (Wagner would have monitored Franco-Prussian conflict, Tolkien personally participated in the Somme).

The Völsunga saga could be considered the first instance of the same story ("... the ring Andvaranaut serves as a connection and explanation for the characters' troubles." [1] Fafnir turning into a dragon to protect the gold is just a metaphor for the military prowess of an organized fiefdom). Gold exchanging hands to influence the toil of entire populations goes back as far as Egyptian recognition of its malleability, ease of extraction, and resemblance to the Sun.

With Tolkien's childhood propensity for secrecy, enthusiasm for cryptoanalysis, and concern of the postal censorship of his wartime subordinates - it makes sense that he would associate a gold object with "invisibility", that is, anonymity. The "eye of Sauron" will only notice you if you've revealed your desire to move undetected among the ones that operate in your shared civilization. This results in the curse of a painfully long life and a corruption of an isolated mind (Gollum). Your enemy then becomes the people (Nazgul) who have already succumbed to this lust for amplification of their might because of the same "magical" inanimate object. Marvel's Thanos ring-adorned-gauntlet is the recently installed update of the same concept.

What does this have to do with the Federated Learning of Cohorts?

A single search request "cost" 7-10 grams of carbon emission in 2009 [2]. Running your computer or progressively chewing up the limited battery lifetime of your smartphone to locate something on the internet for "free" costs carbon output at some point in a transmission pathway. Soft/hardware engineers will reduce this footprint over time through clever organization of their employers' assets, but nothing is "free". You owe it to society to have your anonymized meta-interests understood&catalogued by the hand that feeds you a conveniently "free" Ranked Page of relevant information (digitally posted efforts of others automatically crawled). The pinnacle of modern technology is in your pocket (at a cost reduced on purpose so everyone can input their thoughts) - but you don't want to share your self with the world? A flock of various cohorts feeding the hive-mind with their intent is supposed to be valuable because this information can eventually generate paychecks and subsidies meant to satisfy the flock's apparent needs (or guide it away from corrosive wants). Regulated Money flow (not gold, aka invisibility) is meant to be documented so that a society can sort itself out.

Perhaps you are resisting FLoC because of distrust in who is pulling the levers? If your paranoia is valid, then the problem will be naturally solved by internal resolution ("Et tu, Brute?").

I am a node in the hive-mind with a duty to transmit new information as soon as it is discovered. Even if it's wrong - at least I said something. I am an open book and entertainer of an open source society.

"I don't care that they stole my idea... I care that they don't have any of their own." - Nikola Tesla

[0] https://youtu.be/nM9f0W2KD5s?t=9870

[1] https://en.wikipedia.org/wiki/V%C3%B6lsunga_saga

[2] https://searchengineland.com/calculating-the-carbon-footprin...

are 3rd parties legit? IMO not. I block them by default and whitelist in case.

Part of this must be related to the name, which I find obnoxious for some reason

I like FLoc because I've long wanted a local profile that I can control to some extent. I am aware that ads pay for all the free services I get, so I am not opposed to ads. I would like to edit this local profile to at least help them show me relevant ads when I do see them.

Does FLoC provide any control to the user? The articles and comments posted here recently give me the impression that it's 100% under the browser's control and hidden.

From the proposed spec [0], it's literally just:

    cohort = await document.interestCohort();

Seems pretty easy to override with a simple extension.

[0] https://github.com/WICG/floc

I'm assuming that people are good at prying into such things will jailbreak it

What? You don’t need to jailbreak anything to:

    document.interestCohort = null;

You are assuming it will be a read-write property but there are a few properties and methods in JavaScript that can't be overwritten and nothing prevents Google from making this one read-only.

Being a function, probably is safer to do:

    document.interestCohort = () => null;

so it does not cause error in Javascript execution.

I meant learning how to manipulate advertising data so it was more relevant, not disabling it

why don't you pick services you pay for in the first place?

I like GMail a lot. It has a fantastically good spam filter, a feature that I feel doesn't get enough appreciation.

FLoC provides zero control - it's just additional personally identifying data sent by your browser, making tracking easier. It does not actually prevent any existing tracking methods.

FLOC in the spec allows user to disable it. So even with chrome you can always go to the privacy settings and disable floc directly for yourself.

That's literally adding an additional privacy anti-feature, and claiming it "provides control" because it can be disabled, to bring you back to the state of privacy you had before.

FLoC itself does not prevent fingerprinting, but it's part of the Privacy Sandbox [0] where they are doing a bunch of things to mitigate those kinds of tracking, such as Privacy Budget [1]. Note that other browser suffer from the same issues.

[0] https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

[1] https://github.com/bslassey/privacy-budget

That's a good point. I want to learn more about it before I pass judgment

This is a disaster for ad tech outside Google, Apple, and Amazon: Google and Apple still have tons of targeting data in a world without FLoC, and smaller ad tech will wither on the vine. That's fine, or maybe it's not. There's always tradeoffs, but it's strange to me how little coverage there is of how this is exactly the end game the 'regulation is bad' crowd predicted.

Maybe the people regulating don't understand what they're regulating. Every time I click a cookie consent warning I wonder exactly what they are supposed to be achieving - I can't imagine casual users of the internet with no interest in technology have ever read them.

This is exactly what I thought. Google is using this to establish their already-majority share of the advertising market intoa monopoly by controlling the browser. Using privacy laws as an excuse and doing just the minimum to skirt those laws (complying with the letter but not the spirit of those)

I think this should be addressed with stronger privacy laws, but Google is capable of moving much faster than the EU government.

FLoC, much like AMP, was an honest and earnest try to extend the same benefits of Apple's closed ecosystem to actors outside it. Google is trapped between either not getting rid of 3p cookies and pissing us off, or trying something like FLoC, which I'm still a little surprised backfired. The only option they're left is to copy Apple's business model, exactly

This implies (as the article states) that we’re bound to accept whatever Google’s alternative solution is to their own problem. We as consumers and users are free to our own third preference: “I don’t want _any_ tracking”. That’s why it backfired. The effort may have been in earnest, but it’s just another expression of Google’s bravado.

The pain they’re facing is that people don’t want to be tracked, and tracking/cohorts are the only edge that Google has. Without that they’re must another advertising wholesaler.

They should really make an effort to support tracking-less ads instead. Context is often enough. Many websites want this, advertisers are fine with it. Users definitely want it.

They have some trackingless ad options but they don't support any kind of HTML5 as far as I've heard.

Why not make it opt in?

Hmm, this sounds like the opposite. FLoC actually gives any ad-tech company access to the same cohort information. If FLoC does not happen and cookies are banned, that would be the death of smaller ad-tech companies. I assume that's what the parent comment menat?

But Google is the one that controls the algorithms and the browser. They can steer it towards their interests. They will be the gatekeeper to the tech the whole industry relies on.

Also, adtech just needs to take a step down to less tracking and targeting. They just don't get it. This would be an ideal time for smaller adtech companies to introduce ethical advertising with no tracking at all.

> controls the algorithms

I'm not sure what about the algorithm can benefit them, they're just segmenting the population into cohorts, and again everyone has access to the exact same cohorts as Google does.

> gatekeeper to the tech

Won't the algorithm live in chromium and be open source?

> no tracking at all

People keep throwing that around but I honestly don't see how this works. All this does is benefit large companies like Coca Cola that blanket advertise to everyone, and screw over every small business who have niche specific demographic.

I have a friend who has a bicycle gear local shop, and he advertises specifically to local people who are into biking. There is no way in hell that non-targeted advertising could work for him. The majority of small products are made for a very niche demographic, so you're saying all of those should stop advertising entirely, except maybe on search results which have a query.

> Won't the algorithm live in chromium and be open source?

Of course, but Google decides what goes into Chrome. Chromium itself is a fringe phenomenon.

> I have a friend who has a bicycle gear local shop, and he advertises specifically to local people who are into biking. There is no way in hell that non-targeted advertising could work for him. The majority of small products are made for a very niche demographic, so you're saying all of those should stop advertising entirely, except maybe on search results which have a query.

He could advertise at a local news website, or a biking forum in the section for your town. Or sponsor a local initiative. Just like he probably did before ad tracking was pervasive. That way the money will also go straight to local people who can use it rather than dropping a large precentage in Google's (and other adtech) bucket.

It's not like this is actually a choice. Tracked advertising is going away one way or another. 47% of people are already using adblockers. https://www.digitalinformationworld.com/2019/04/global-ad-bl... (and that info is from 2019). Also, here in Europe it's got to be an opt-in mechanism now by law and there aren't many people who opt in.

If the industry doesn't quickly adapt there will be nobody left to view their ads :) And tracking is only one reason people block ads. A lot of people will be getting used to clean uncluttered websites right now and will find it hard to go back even when the original reason they installed the blocker has been removed.

I'm not sure no ads absolutism, from privacy to aesthetics, fits into the ground truth anymore: it's unclear to me how these assertions tie together or if they're grounded: ex. using an ad blocker doesn't mean anything about tracking, just means I don't see ads, and it's unclear how "no ads" leads to the bike shop running ads on a local news site.

On a more superficial level FLoC is also a terrible acronym. I'm sure whoever thought of it felt very clever but if the stated goal is protecting privacy they need to be able to communicate it in a way the layperson can understand.

Google has always abused Chrome's dominance by implementing features benefiting them. The real reason is no one trust Google no matter how they implement this.

Let us form a "Federated Learning of Cohorts Opposition for Freedom" and see if the FLOC OFF message reaches Google.

“Everybody” is too strong of a quantifier. The named companies (EFF, Mozilla, Brave, Vivaldi, and DuckDuckGo) are all well-known privacy advocates. Not included are user perceptions or competing adtech views.

As the article notes, there hasn't been a single company not named Google that came out in favor of FLoC.

it's less evil and easier to block than every other piece of shit vile scheme on the table, so just fake endorse it please.

That's a good point. Blocking it or feeding it with fake data will be trivial.

I wonder what Google is planning to prevent this. For a company with their resources I'm sure they planned many steps ahead.

I also wonder if this will really reduce the adblocking phenomenon. People are used to clean sites now. Privacy may have been the reason to sway people to install them but it's not the only benefit.

"Everybody".

Google doesn't have to listen to anyone, this is what having a browser market share of 70%+ grants you. Question is, will their move chip away at that market share? If people actually care, it should.

Switch to FireFox, it's way better than ever, and integrates so well across devices.

What holds one back is that Chrome has made itself indispensable. It's remembered your passwords, your credit cards, your addresses, etc. All part of a plan to keep you happily in its garden.

No conspiracy, just business.

> It's remembered your passwords, your credit cards, your addresses, etc.

That's the one of the first things I disable when I install a browser or create a new profile. Along with history, third party cookies, search prediction stuff, etc. Also clear all cookies and cache when I exit the browser.

Yeah I use other tools for passwords, etc and turn off a lot (though not history! that's serious business)

I also use a pihole to block ads and trackers more completely, but I do like having an additional browser-level feature with "enhanced tracking protection"[1] – if it did nothing else, I like simply having the list of attempted-tracker on every site easily available at all times.

[1] https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...

> Switch to FireFox, it's way better than ever, and integrates so well across devices.

I still use Firefox but it is not way better then ever... they keep removing useful features... especially on mobile where you can't even use most extensions anymore.

uBlock Origin works - everything else I can take or leave.

uBlock origin is one of the most useful, but I also need at least Redirector to fix Reddit, Keepass helper, Smart Referer, Theater mode Youtube to fix youtube and a few others that are very useful.

But it is Ridiculous that only about 15 out of the thousands of addons work with the latest version of Firefox Mobile.

All of them used to work in the previous engine of Firefox Mobile... nice downgrade.

I think it exposed exactly the reason why it's so bad to have a browser monopoly.

I hope it will also spur others like Microsoft to reconsider using Chrome's codebase and thus add to browser diversity. Because Google will keep making it harder to cut this stuff out.

I never understood why microsoft was suddenly so hell-bent on rebuilding edge. The engine they used had nothing to do with me not using it. I just didn't want to jump from one corporate toy to another. This still goes except they're marketing it so heavily to enterprises now that it's become the standard browser at work. I still use Firefox there when I can though :)

I want to say it's that they learned their lessons from history.

IE, and to a lesser-extent, pre-Chromium Edge became instruments of active developer hostility. I know people who still have to support an embedded IE7 component.

To truly fix Edge, they'd have to keep a constant and large development effort to match Chrome/Safari/Firefox point for point. For a product that even their strongest advocates will admit is basically a "pack in" product of relatively minor market share. It's like telling them "You've got to retool MS Paint to compete with Photoshop."

Of course they'll pick the easy road, slapping some paint and customizations on Blink. Although they could have at least bought into Gecko.

> I never understood why microsoft was suddenly so hell-bent on rebuilding edge.

They want a piece of the analytics pie.

Yes but they could have had that with the old Edge.. I just don't understand how the browser engine was a barrier to adoption. It didn't perform badly at all every time I tested, it worked just fine.

I think it was just the marketing effort that got Edge Chromium more adopted, not the move to chromium itself. Every time we had a call with a MS consultant (about any unrelated topic) they had to bring it up again, it was crazy.

It didn't have enough adoption despite the ads in Windows 10. Also it there was too much functionality to duplicate. So they decided to use Chromium instead, keep the Edge UI andthe ads. A good decision actually. Less bug to bug compatibility needed as most websites target Chrome anyway. I'm happy about it, there's one less browser engine to support that I dont care about. We target FF and Chromium. Safari is enough of a nuisance, only high impact bugs get fixed. It's the new IE.

ChakraCore was a cool JavaScript engine as well. I miss it being actively developed!

I suspect there will be a preference to turn it off by the time it launches for real. Then, maybe people who care will turn it off instead of switching?

This may change in near future, Chromium edge is biggest threat to them.

Chromium edge is best of all worlds

> Speed/UI of Chrome

> Firefox like privacy

> Backed by Big brand so cant be sold out(Opera/Vivandi/Brave)

>> Backed by Big brand so cant be sold out

I mean, it can, it just doesn't have to involve a sale

most users are clueless, why should they be included? and we already know what ad companies want... I bet you are working for some ad company?

Breaking the site guidelines like this will get you banned here. Please review https://news.ycombinator.com/newsguidelines.html and stick to the rules from now on.

We detached this subthread from https://news.ycombinator.com/item?id=26884504.

>I bet you are working for some ad company

"Please don't post insinuations about astroturfing"

https://news.ycombinator.com/newsguidelines.html

> most users are clueless, why should they be included?

Privacy groups, average users and ad-tech companies aren't the only 3 groups of relevant parties. What about the millions of websites that run on advertisement.

While the majority of HN would love to see ad-tech entirely disappear, the reality is that it pays for the majority of the web currently. I'm sure most websites wouldn't be happy seeing their ad-revenue slashed.

> While the majority of HN would love to see ad-tech entirely disappear, the reality is that it pays for the majority of the web currently. I'm sure most websites wouldn't be happy seeing their ad-revenue slashed.

This is the challenge, how do we pay sites for content?

Trouble with the current ads market is vendors like Google, FB etc extract most of the value leaving little for publishers

Personally, I think the Patreon model works great... except content creators charge too much for each tier. When you're subscribed to a hundred or more channels and want to compensate them for blocking their ads, $2 to $5 for each subscription adds up quick. In my case, I just overrode the Patreon subscription tier and limited each one to at most $1. I don't need exclusive Discord access and all that crap, it doesn't add too much value IMO.

So if content providers had monthly contribution systems (or better integration with third-party ones) to make it easier for viewers to donate), and if content creators were more sensible about what they charge (say, start at $0.25 a month) I could see this getting better traction.

Spotify shows you the problem with this.

People want access to "everything", that means dividing whatever they're comfortable paying by a massive amount, leaving crumbs for each creator except for the very biggest ones.

I believe any system that tries to scale up to support every creator will have this problem and I suspect the core problem is that consumers want to consume more and pay less than is sustainable.

The thing is, even most creators who are on Patreon are actually indirectly relying on the ad-funded system currently. Most of these people you're referring to are probably Youtube or Twitch creators for example. But why do you think Youtube/Twitch let's them freely upload as much content as they want and have millions of people watch it all for free?

You do realize than in an ad-free world, these creators would all have to pay to have their videos hosted in the first place, which is a huge barrier of entry before you even get enough followers to fund your content in the first place. The current variety and depth of creators we have wouldn't have been possible at all without free unlimited video hosting that Youtube has provided all this time.

A non-ad-based internet will be filled with rich people who can afford to put their content out there and will cut out everyone else. It's basically like the finance world today, where the rich get richer and the poor can't get their foot in the door.

Reply on news.ycombinator.com