Hacker News Reader

Comment by blantonl | Hacker News Reader

FYI, if you are like me that has no idea what FLoC is until now, please see:

>Federated Learning of Cohorts

is there some competition where people try to come up with names as tricky as possible while being nowhere even close to simple english?

Sounds like a machine learning term that escaped from researchers into the wild. Machine learning people like to make up fun names for otherwise complicated and hard-to-summarize methods. See eg "BERT".

The name is actually descriptive. It is an algorithm for constructing semantically interesting cohorts of similar users, Locally on each user's machine.

It's actually a really good idea and certainly a lot more "privacy preserving" than anything that relies on sending fine-grained user data back to a central server for processing.

Of course there are problems with it, and I'm mixed as to whether it's something that non-Chrome browsers should even try to support.

The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm.

But the name makes sense and I think the core idea is a step in the right direction.

> The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm.

That's not the case, contrary to what Hacker News wants you to think with this massive opt-out campaign. FLoC cohort computation is only planned to include websites that themselves request cohort information. Unless your page calls document.interestCohort, it is not included in cohort computation [1]. The opt-out header does nothing unless you use FLoC.

There is an exception to this made for the pilot phase (aka. right now), where in order to bootstrap the system Google is extending cohort computation to include "all websites that show ads" [2]. My guess is that this is necessary so that early testers get useful data. This is not something that seems to be planned past the pilot. The standard also restricts this to only "while 3rd party cookies are still a thing".

Disclaimer: I work for Google, but not on advertising or Chrome. This is all from public information I researched in my own time.

[1] https://wicg.github.io/floc/#compute-eligibility §7.1.1 "By default, a page is eligible for the interest cohort computation if the interestCohort() API is used in the page."

[2] https://wicg.github.io/floc/#adoption-phase §7.1.4 "at the adoption phase, the page can be eligible to be included in the interest cohort computation if there are ads resources in the page, OR if the API is used."

> There is an exception to this made for the pilot phase

So all websites are, in fact, included by default.

> if there are ads resources in the page

Please read the full comment (or preferably, the standard) before spreading FUD.

Whether ads are being loaded is being determined by an opaque, ever-changing algorithm implemented in a closed source browser. We have no way to verify that this is how it's actually working, or when it will change. That doesn't even include how a good majority of the internet is monetized by ads, often Google's ads.

It's simply safest to assume that every page will be included.

I don't think calling Chrome a closed source browser is accurate unless you have a citation showing that Chromium is missing this code

Microsoft Edge is a closed source browser, for comparison

Chrome is a closed-source fork of Chromium that applies numerous proprietary patches to Chromium. There's no way to tell what has been modified in that process (short of decompilation, et.al.).

Pretty much the same process that Microsoft takes with Edge, really.

I don't think calling Chrome a closed source browser is accurate unless you have a citation showing that Chromium is missing this code

That's completely backwards. You would need some evidence showing that Chrome does not include proprietary patches, otherwise you pretty much have to conclude that it's closed-source, even if it includes a large % of code from an open-source product.

Is it well defined what "ads resources" is?

It doesn't seem to be defined in the standard, but it's partially documented in Chromium's docs how they determine what is an ad resource:

https://chromium.googlesource.com/chromium/src/+/master/docs...

https://chromium.googlesource.com/chromium/src.git/+/master/...

This seems to indicate the authoritative source of truth is EasyList. On my current machine, the list seems to be stored in "~/.config/google-chrome/Subresource Filter/Unindexed\ Rules/9.22.0" and should be easily inspectable.

I don't know if I've missed some documentation pointers related to this.

It is kind of hilarious that they use antitracking resource as part of their new malware infrastructure.

So only if the publisher opts-in (sort of), and what about the user, if this is all done client side surely I should be opt out by default too?

I assume I can set my browser to opt out easily?

I haven't heard about a global opt-out in the browser, but I haven't really looked for that info either. I think I've heard Chrome allows extensions to "easily" hook document.interestCohort and return any value the user wants (including random values). The standard also mentions "The user agent should offer a dedicated permission setting for the user to disallow sites from being included for interest cohort calculations." but that's only for blocking specific sites from contributing to cohort computations, not for disabling globally.

It is called academic publishing, and some people manage to make a career out of it!

But yes, all three parts of that name have a well established technical meaning. It is a very descriptive name, once you know all the parts.

This one stems from Google's bird-themed naming convention for initiatives related to working around 3rd party cookies going away.

What's another example?

PIGIN, TURTLEDOVE, SPARROW, SWAN, SPURFOWL, PELICAN, PARROT

not kidding

"Federated" is the only part of that I can see as not being simple. But even if all 3 words were generally unknown, I don't know if it's really a problem. You need to understand what FLoC is instead of what the individual words mean to know what the issues with it are.

So you think you're providing a service to others by copying and pasting a top Google search result link for this topic?

Reply on news.ycombinator.com