Hacker News Reader

Cloudflare, Akamai, Fastly and other CDNs should disable FLoC by default for all customers, and provide a toggle to those customers who explicitly wish to enable it.

But until they do[1]:

Apache:

    Header always set Permissions-Policy: interest-cohort=()

Caddy:

    header Permissions-Policy "interest-cohort=()"

Cloudflare Workers (not free as there are limits):

    addEventListener('fetch', event=> {
        event.respondWith(handleRequest(event.request))
    })
    async function handleRequest(request) {
        let response=await fetch(request)
        let newHeaders=new Headers(response.headers)
        newHeaders.set("Permissions-Policy","interest-cohort=()")
        return new Response(response.body, {
            status: response.status,
            statusText: response.statusText,
            headers: newHeaders
        })
    }

Lighttpd:

    server.modules +=("mod_setenv")
    setenv.add-response-header=("Permissions-Policy"=>"interest-cohort=()")

Netlify:

    [[headers]] for="/*"
    [headers.values] Permissions-Policy="interest-cohort=()"

Nginx:

    add_header Permissions-Policy interest-cohort=();

[1] https://github.com/WICG/floc#opting-out-of-computation

Thanks, just disabled this on my tiny near zero traffic sites.

Hopefully if enough people disable it, it will become useless.

Yes, it will become useless. The header that is..

Google already has shown bad faith in opt-out headers like this when they immediately started ignoring Do-Not-Track as soon as non-Chrome browsers made it a default. The fact that the spec for this awful project uses an opt-out instead of an opt-in header seems a pretty clear signal to me that Google may not have any intention of following it in the long run.

If you are using HAProxy you can use the following:

    http-response set-header Permissions-Policy interest-cohort=()

Be sure to add `always` to the nginx header:

    add_header Permissions-Policy interest-cohort=() always;

For those wondering: this causes the header to be set on all responses. By default it will not be set on some error responses.

Unclear to me are what these headers do to the browser.

I mean... the docs say that they are a "site" header that you should apply to a "page". Does that mean that you must apply it to all pages to exclude a site? Is absence on one page taken as opting back in to FLoC?

If the scope is site, then it would be better as a DNS entry. I've a feeling the scope is truly page though and I've also a feeling that most people who choose to add this header will add it on all assets now - which is a bit of a waste of bytes (even with header compression in place) but would be the only way to guarantee that all pages have it.

Cloudflare, etc. should do what their customers want and not make these type of decisions for them. They are CDNs and not the owners of their customer's websites.

GP is proposing that they give their customers the option — just that the default state should be "off".

Cloudflare's mission is to "help build a better internet", and to that end have made a lot of opinionated decisions to increase security and performance. Where possible options are given to customers, but the opinionated way wins by default.

Examples: Turned on HTTPS for all customers, gave image compression and optimisation to all customers, moved customers to the latest TLS as soon as possible (help drive adoption), provide tools to obscure email addresses on web pages to minimise harvesting, 1.1.1.1 privacy focused DNS, etc.

FLoC is something that an opinion can easily be formed on, and where Google have said to each site operator "you must opt-out", Cloudflare can hold an opinion that default opt-out is bad for the internet and that opt-in is better... and if they make an option that defaults to adding this header but granting customers a means to toggle it off... then all Cloudflare will have done is what Google should have done... made this opt-in by default.

Then their customers should have the option to opt in. Is that fine with you?

the opt-in is choosing CF who's known to make many decisions for you. its not a new pattern for CF clients

Excluding some portion of sites from a user’s cohort calculation doesn’t necessarily make a user less unique if a nontrivial number of sites doesn’t opt out.

I wrote more about this on my site: https://seirdy.one/2021/04/16/permissions-policy-floc-misinf...

Thank you, this was informative.

thanks for lighttpd

This kind of post that provides no context will lead to cargo-cult, with people blindly copying and pasting these directives, and believing they have increased the privacy of their site...

If your web site does not include ads, FLoC is already disabled. Here, "ads" mean ads that EasyList can detect. This HTTP header will just make your config more complex and your responses slightly bigger, with no change of behaviour.

If you include external ads on your pages, then I doubt disabling FLoC will increase your visitors' privacy, but at least this header will have a real effect.

> If your web site does not include ads, FLoC is already disabled

Citation? Here's what the FLoC explainer says:

> All sites with publicly routable IP addresses that the user visits when not in incognito mode will be included in the POC cohort calculation.

https://github.com/WICG/floc#sites-which-interest-cohorts-wi...

This sounds to me like all sites, whether they contain ads are not, are used to cluster users into cohorts.

From https://web.dev/floc/ in section "Do websites have to participate and share information?"

> For pages that haven't been excluded, a page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page.

> During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page loads ads or ads-related resources.

> Cloudflare, Akamai, Fastly and other CDNs should disable FLoC by default for all customers

And this is when Google will release their own Cloudflare competitor product.

BTW do they something as popular as Cloudflare already? I'm very unfamiliar with Google's offerings.

GCP does have a CDN product: https://cloud.google.com/cdn/

But at this point in time I think it'd be unfair to call Cloudflare "just a CDN" so not really equivalent.

From what I've heard through the technical operations jungle. Google has been pushing their CDN product hard for a long time, which isn't a shock since they've been trying to push GCP hard for a long time. But it's a little like AWS's Cloudfront CDN. It's very very rare to see someone using an AWS Cloudfront or GCP CDN... that isn't on said cloud platform already.

NodeJS + express:

    app.use((req, res, next) => {
        res.setHeader("Permissions-Policy", "interest-cohort=()");
        return next();
    });

According to their own numbers, WordPress accounts for 41% of the total number of websites, and they're considering switching off FLoC by default (https://core.trac.wordpress.org/ticket/53069 - discussion not settled yet though).

I think this is great news. Are there any paths towards supporting groups aligned with this position? I am aware of eff.

How many of those 41% are actually maintained and updated WordPress installs though

In a lot of cases, it automatically updates.

It's kinda sad that you can't just run a web server and host your own homepage anymore. You need to mess with your webserver config to make it spam the client with a dozen HTTP headers to disable FLoC, enable HSTS, set this weird same site origin policy thing, disallow iframe embedding... Luckily enough someone had the idea to make it so HTTP headers will be compressed too, so we can add some more before the request header completely fills up the initial RWIN of the server.

Strange, I'm able to run my own webserver without worrying about any of that. Just a default deploy of Nginx.

Disable FLoC if you want, but Google could always change it in future and ignore the header.

I think that parent meant that default should be the most secure and least privacy invading, and allow people to explicitly soften the restrictions.

You don't have to do any of that. If the user wants to use a browser that sends all of their private data to Google, it's not my job to stop them.

IMHO it's far more unbalanced than "The top 100 websites get a third of the traffic, the remaining top 10k get another third and millions of websites get the last third." Purely from data traffic, youtube and netflix already get a third of the traffic (and that's just 2, not 100); and purely from pageview perspective, the top social media sites plus major media sites (again, a subset of the top100) get more than half IIRC.

I wouldn't be surprised if the top 100 websites get 80% of the traffic, the remaining top 10k get 10% and all the millions of other sites get the last 10%.

I meant pageviews, not bandwidth consumed. Streaming websites are always going to dominate the latter.

This 100-10k-millions split statistic was pulled from a talk by Ilya Grigorik, who had worked on Web Performance at Google. I'm guessing they based it on data from Chrome.

Searches and time spent browsing are very different. Google likely doesn’t have visibility over how much time people spend on TikTok. Or perhaps Android collects that data.

Unless you view it in their browser, then they are more than likely to have that visibility.

And Chrome is the most popular browser last I checked, so probably a fairly good indication of overall trends can be drawn from such statistics

The header is pointless anyway for the actual purpose of disabling FLoC as Chrome/Google will simply start ignoring it when enough websites add it.

> will disable FLoC because they're either not interested in ads (Wikipedia)

Wikipedia does not need to take any action to disable FLoC; it's only active if the site opts in, on a per-pageview basis:

* If you call document.interestCohort() to get a FLoC id for a user, that pageview will be included in FLoC calculation.

* For the origin trial, to deal with the chicken-and-egg problem, a pageview is included you load ads (determined with EasyList)

See https://web.dev/floc/

(Disclosure: I work on ads at Google, speaking only for myself)

EasyList is extremely broad, changes frequently, and e.g. has included communities having banners for community events as ads, and Google appears to give zero promises on the stability of this.

So relying on this requires continuous monitoring that Chrome doesn't randomly decide to tag something on some page as an ad, which is doing even more work just to cater to Google whims. Just blocking it is the sane choice here.

since you say it is about "chicken-and-egg problem" during the trial: is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future?

> is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future?

Not something as clear as I'd like. The closest I see is:

A page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page loads ads or ads-related resources. -- https://web.dev/floc/#do-websites-have-to-participate-and-sh...

So, every page with ads (as determined by an opaque and ever-changing method in a closed source browser), will be included while computing the cohort. Got it. It seems safest to assume that "it happens on every page" since so much of the internet is monetized with ads.

Please forgive us for not trusting Google's "we pinky swear it will change". We have no real reason to trust that Google will keep their word.

> every page with ads (as determined by an opaque and ever-changing method in a closed source browser)

Chrome'a ad detection code is open source; https://chromium.googlesource.com/chromium/src/+/master/docs... is a good place to start.

No, Chromium's ad detection code is open source. Chrome's is closed source. It may very well be the same code, but there is no (practical) way to verify that, other than trusting Google.

But as I already indicated, I have trust issues with Google.

Reverse engineering of binaries is a well-understood field. Ensuring a binary and source code align is not a fully automated task at this time as far as I know, but is well within the capabilities of our industry.

Capability and practicality are distinct concepts. Especially since it's fairly well known that Chrome will not align 100% with Chromium thanks to closed source additions and modifications, so it becomes a question of "what is different" instead of "are they different".

It's certainly not practical for me, when I can just avoid chrome for personal usage (and I'm thankful for the capability). Of course, I can't avoid it entirely, thanks to my company deciding that Chrome is the only supported browser for our product. So even though FLoC is a non-issue for me personally, it is still something I need to worry about professionally.

> Wikipedia does not need to take any action to disable FLoC [...] If you call document.interestCohort() to get a FLoC id for a user

It is still a problem for Wikipedia, because the global Javascript for each language is editable by a subset of the editors for that language (https://en.wikipedia.org/wiki/MediaWiki:Common.js for instance), unlike the HTTP headers which can only be changed by the Wikimedia sysadmins.

If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is a far bigger risk than that they might add a call to document.interestCohort() and opt that page into FLoC?

Does Google Analytics do this?

Sorry, what are you asking?

Google Analytics is arbitrary JS and JS can turn on floc... so using GA is a potential point to add you to floc.

Obviously its probably a small overlap of "doesn't trust floc" and "still trusts GA" but still a Trojan horse.

PS. Wow kudos for being so responsive, especially/despite less than stellar comments regarding your openness about working for G-Ads.

It doesn't look like Google Analytics does this today:

    $ curl -sS https://www.google-analytics.com/analytics.js \
       | grep interestCohort
    [no results]

On the other hand, I could imagine them or other analytics services adding it since sites installing analytics services generally want to be able to slice their traffic by as many dimensions as possible. I would hope that any service considering reading FLoC implements it as opt-in, however, since sites probably didn't consider whether their pages are sensitive in choosing whether to add analytics (though perhaps they should have!)

(Still speaking only for myself)

> Disclosure: I work on ads at Google

Can I ask why? I honestly can't understand how anyone could.

money.

I think advertising is positive [1] and the role of ads in funding freely-available sites is very important. My current work is primarily on how browsers can allow more private and secure advertising [2][3][4] which I think most people will agree is valuable even if they are less in favor of advertising in general.

At a lower level, I do this job because I'm paid, which allows me to donate. [5] But I wouldn't do this work if I thought it was harmful; there are lots of different kinds of jobs I could take.

[1] https://www.jefftk.com/p/effect-of-advertising

[2] https://github.com/google/fledge-shim

[3] https://github.com/WICG/turtledove/issues/161

[4] https://github.com/WICG/webpackage/issues/624

[5] https://www.jefftk.com/donations

Google, and it's method for advertising, basicaly destroyed the news industry. If you don't think your work is harmful it simply means you haven't looked into the repercussions enough.

Internet advertising and the internet in general has made newspapers less profitable. But this was happening regardless of what Google did. 92% of the decline came from loss of classified revenue (https://mumbrella.com.au/de-classified-what-really-happened-...). Obviously it makes no sense to vilify Craigslist, because someone else would have provided free, searchable classifieds if Craigslist hadn't. That's the nature of the internet, which has reduced the cost of publishing to nearly nothing.

A parallel to the demise of the newspaper classifieds is the once thriving industry of people who would copy books by hand in the 14th century. Then Gutenberg created a printing press that could make copies of books in a fraction of the time. Life didn't get better for those folks who's skills were no longer needed, but maybe it did for society as a whole. But for sure it didn't and doesn't make sense to vilify people who work at printing presses.

You're looking for a "bad guy" when maybe none exists.

Disagree.

The number one newspaper killer is... Craigslist.

Also the general move away from paper printed and delivered every day to internet news delivery.

Hmm what about Murdoch in News TV?

I'm simply blown away by that donations link. Here was me feeling happy about the little I give, but it really puts into perspective how much I keep for myself.

Like wise!

> I think advertising is positive [1]

That link only works if we buy into the premise: "One way to think about this is, what would the world would be like if we didn't allow advertising? No internet ads, TV ads, magazine ads, affiliate links, sponsored posts, product placement, everything."

However, no. I don't buy that premise at all. The state of ads as it is now is actively harmful with very little to show for in terms of "new non-stickier products" etc.

Yeah, the all-or-nothing approach is pretty hard to buy into.

What about ads, but static and not-tracking? Is that still equally negative? Is that still equally positive?

> What about ads, but static and not-tracking?

Coincidentally, my current project involves this Chrome proposal for supporting self-contained remarketing ads without individual tracking: https://github.com/WICG/turtledove

> supporting self-contained remarketing ads without individual tracking:

Yeah, but what about no tracking at all? What about getting rid of "remarketing"?

---

Since you are here:

> The question is, what is the alternative? I see two main funding models: Paywalls. You pay with your money. Ads. You pay with your attention.

How about:

- people pay what they feel like? - the patreon model, where some enthusiasts pay for the content producer, but everyone get access to the product of the work? - (for social media): "influencers", power-users and media companies pay for the service and get a quota of "free accounts" they can bring along?

> producing most of what there is to read requires more money.

Wikipedia does not pay its editors and it seems to work without being only a "hobby".

Also: is most the content "that is there to read" worthy of the money and resources they receive? Content farms, celeb-gossip and listicle "journalism" only gets to exist because the are playing for quantity, not quality. Remove ads from the equation and they will certainly die a well-deserved death.

> Micropayments (...) many proposals and startups, but nothing has really worked out.

Brave is growing (over 30 MAU already, projecting to get 50M by year's end, over 1M registered content creators) and it is showing that a tipping economy can work. Would you go work on it?

---

People defending an "ad-funded internet" think they are enabling democratized access to good quality content, but in fact what happens is that they are enabling a whole lot of people to make a living of essentially producing sewage. It's as if McDonalds was able to actually offer their crappy food for free and people were applauding it for fighting hunger. It artificially creates externalities and makes it next to impossible for people to pick winners that "should" win in the market.

I know you believe that you have the best intentions at heart, but at this scale there simply is no way to make anything more efficient than a direct, transaction-based market that could match producers and consumers.

WordPress may very well block FLoC which cuts off a good chunk, even when you eliminate those that don't update to the latest version. https://make.wordpress.org/core/2021/04/18/proposal-treat-fl...

>As for the remaining millions, only a tiny minority of them will even know this is a thing, let alone care enough to make the change or contact a developer who can do it. These are the folks who have hosted their wordpress site with GoDaddy because it was cheap and quick when they needed a site.

One company decides to do something stupid and you expect millions of website owners to scurry and add junk to their headers to create a "mitigation"? This is nuts.

This is a browser problem, not a website problem.

Their point was that that won’t happen.

Unfortunately, the other solution is to get billions of people to stop using a trojan horse of a browser.

Can't remember what article it was, but I remember that Facebook didn't even care about "top companies with top ads". The long tail trumped anything.

I wouldn't be surprised if it's the same in Google's case. A dozen big-name websites drop FLOC? Who cares, there's a billion more.

That's probably accurate if you assume every website is equal, but if you measure by traffic the top 100 websites account for 95% of measurable tracking events. Won't that make FLoC rather ineffective if 95% of the data is missing?

There may also be some uplift from various frameworks, CRMs, CDNs, etc, if any of them decide to make it the default.