Ad-tech setting 'Privacy-Preserving Attribution' is opt-out in Firefox 128
gladtech.social
gladtech.social
A: the main problem with ads is tracking and privacy invasion
B: the main problem with ads is manipulation and seizure of my attention
If you only care about A, you might like this approach, as in principle if it works and becomes standard, then the pressure from the ad industry to track everything will be easier to resist, as 1) they will have less incentive, and 2) the argument that tracking is essential is undermined, so it may be possible eventually to ban it.
Of course, that assumes that you trust that this is better for your privacy than tracking. After all, it does feel a bit like tracking... If it's done properly then your individual data is not sprayed to a thousand dodgy ad brokers, but only to one company who tells advertisers not about you personally, but just whether their ad is working.
The question is, does it work? Are they doing it properly? Do they have the correct incentives to keep doing it properly in the long term? Can advertisers just undermine it by giving everyone's ads a different ID? Also, your threat model may include that this aggregator company is hacked, or that the government secretly forces it to share the data with them.
Nevertheless, I think that Mozilla probably genuinely think this is better for privacy. And there is a case that there is.
A big issue however its that at present the constituency for Firefox includes people who care about B. This doesn't undermine that directly, but it does mean that Mozilla have an incentive not to care about it.
Mozilla assumes ads are required.
Ad blockers assume ads are not required.
Ad blockers are probably more popular than Firefox.
The original web did not have targeted ads and did not require ads to exist. It has never faced an existential threat due to "not enough data collection and targeted advertising".
Ad blockers are correct.
I mean, we call social media companies social media companies despite them being ad funded.
We call newspapers newspapers despite them being ad funded.
We call sports teams sports teams despite them being ad funded.
There are other business models out there.
https://en.wiktionary.org/wiki/news_hole
We could just return to a culture of paying for things (that are conspicuously not tracked) and this whole imposition of advertising in our daily consumption can go away. But the vast majority of people simply don't care.
People say how can new products reach people, but the solution to that problem isn't ads but platforms/websites that catalog new products and allow for easy discovery.
Ads actually make the problem of finding new products worse because you only see a fraction of new products if you consume ads, primarily those from companies that already have lots of money to invest into ads.
Temporarily, before they inevitably add the ads back in even for paying users.
If Mozilla produce software, funded by search engines, funded by ads, funded by laundry detergent manufacturers, are they a laundry detergent company?
And exactly: I reject C. I reject the monetization of the web. It didn't need to happen; we just wanted it to happen in our greed. We bit the apple. Money is the root of all evil. It ruins everything.
This means that the standard information wants to be free/free software arguments ultimately have costs to cover (like, you used to need to pay for GNU tools to cover the cost of postage and storage).
Any approach that ignores this economics is just gonna fail (and that would be sad).
Ads are the wrong monetization model for the web. Instead of paying for information directly, you are now paying for information by buying something physical (most ads are about physical items). In this resource-limited world, this is clearly ridiculous.
Yes! If our culture(s) weren't so damned full of pure consumerism, forgetting the first 'R' in Reduce, Reuse, Recycle, we'd potentially be living in a healthier ecosystem.
And honestly, having gone from living with a hoarder to living with a tad more than essentials where I can see the damned floor in my house, it's such a f-ing relief.
The main problem with ads is... I do not want them.
My computer, my electricity, my network, my ISP contract, my privacy, my life and my decision.
This is a fork of Firefox that I support:
The original web is irrelevant because it didn't sustain large economies. It's like comparing radio hobbyists to the central TV station, the economics change when you have to actually pay employees and serve a mass market.
A large number of us wish that we could go back to a web that didn't exist primarily to sustain large economies. Back to a web that existed for academics and enthusiasts, a web where modern HN discussions would have been ranked in the lower half of quality instead of the top 5%.
That web existed as late as 2010 (already as a bit of an enclave, but a thriving one). It was killed by ad-funded social media and some of us are still bitter about it.
But it also strikes me as very odd if not elitist to say you'd wish for a web when it consisted of academics and enthusiasts. Because for everyone who doesn't come from money or academia, like me, the fact that there's a real economy underpinning the web now means I have a job that actually feeds my family. (I in particular don't work for an ad company for what it's worth).
It's one major business model that keeps the lights on in a lot of places and to say we should all be enthusiasts, who in this industry do a lot of work and get almost no compensation just doesn't work for most people. And is also just bad for software in general.
The web is not TV. At least it did not begin that way. The above is from the mid-1990s when the web was nothing like TV, not even close. The first paragraph is prophetic.
For a "non-profit" organisation, Mozilla is extremely focused on making/keeping the web a source of profits for a selected few.
Giant websites calling themselves "tech companies" are nothing like newspapers. Newspapers sold a product: journalism. Readers paid for newspapers. These giant websites do not sell a product. They do not hire journalists to produce news. These websites are free. If they chanrged for access few people would pay. They use the products of other peoples' labor as bait to lure in ad targets because the product of their own labor has no such value, it draws no significant audience. They are intermediaries, middlemen.
Mozilla wants to encourage and protect this behaviour, not change it. Make ads "private". Mozilla is along for the ride. Keep the money flowing.
If newspapers are your model of a better alternative - pre internet, newspapers were funded largely by advertising. Yes, they also took subs and sales, but they could not operate on that alone. A very large amount of product and service discovery -not just consumer, but B2B -happened by means of ads (including classifieds) in newspapers and professional magazines. Have a look at a 19th century issue of "The Engineer" or "The Builder", it's very enlightening.
If we want to get rid of the current internet giants, we need to figure out what can replace them so effectively that businesses dump them like they did the newspapers.
It's also possible to use a computer network for advertising. For example, putting ads one every page of every website so when a www user is reading some noncommercial page, ads are everywhere. Or when a www user is communicating about noncommercial topics over someone else's website,^1 ads are everywhere.
1. A dumb idea because of "tech" company surveillance and ads
IMHO, the two are not mutually inclusive. Perhaps there are only so many widgets that can be sold over the web. But with ads, there is no limit. The ads are not there to provide "free" services despite the messaging from Silicon Valley. The ads are there so that so-called "tech" companies can make money. They do not even have any widgets to sell. They have nothing that web users will pay for. Thus, surveillance and ads.
A common retort every time someone mentions that the original web had no ads usually goes something like "The early web sucked" or "I don't wan't to go back to the early web". But that is not the point of mentioning the original web. With today's hardware, there is no going back. The internet is incredibly fast now. It does not have to suck anymore.
The point of mentioning the early web without all the ads is that bogus claims by entities like Mozilla that "the web needs ads to survive" or by Google that they are "making the web faster" while still delivering same/more ads are pure nonsense. The web does not need ads. Ads are what makes the web slow. Google deliberately adds delay to webpages when they "load" so ad auctions can take place.
At the same time, it is common to HN commenters reminiscing about the early web and complaining about the current web.
We're talking about Firefox here. Advertisers care about browsers that most people use, and Firefox isn't one of them.
No, they don't have the right to show them. They don't own my computer and my display, what's show on my display is entirely up to me and my browser that I own and control.
However they have every right to choose what data they send my way, including their main content.
If a company is adamant that ads should always be seen alongside the main content and they know the target computer is capable of doing this filtering, then their only solution is not send anything at all (pay to view instead of ad-supported).
I agree to absolutely nothing. I consent to absolutely nothing. That they insist on showing me their noise puts them in malware category and they should be treated as such.
The incentives are all wrong for ad networks to address the issue. As long as websites use third-party networks which themselves let anyone sign up and buy ads, it will continue. Doing too much vetting of ads or KYC on advertisers cuts into the bottom line. I don’t think all that much about privacy issues with ad measurement, because all of my browsers, those of the friends and family I advise, and those of the companies whose security policies I am responsible for, will block ads for the foreseeable future.
I use Qubes OS [0] and open random websites in its auto-configured disposable VMs. Makes this problem irrelevant.
The tracking and seizure of attention are of lesser concern to me personally.
One of these is that they use your power, and waste your network bandwidth, to try to force to display them and to track you and other stuff. Their use of your power in this way is like theft; they are stealing your power for their own use (even though such theft is not being done directly).
Although you could (at least sometimes) block them, they often make it unnecessarily inefficient and difficult.
Other problems include both A and B above, but these are separate problems. There are additional problems as well, such as deceptive advertising, and others. (TV shows that display advertising within the show is also a problem, but again that is a separate problem than any of the above.)
We would like to do Windows eventually, but it's not a priority at the moment. "
Or I need PowerPoint and Affinity on Linux.
Tried dual boot for some time, found it too cumbersome.
Yes, it's called WSLg. Uses Wayland, so many apps are a bit messed up. I think there's a way to install X11. Last time I tried it over a year ago it was a bit rough.
Additionally and unlike Mozilla, this volunteer community is also very unlikely to care about non-enthusiasts who may complain the browser doesn't support Encrypted Media Extensions (EME), Web Environment Integrity (WEI) or whatever anti-features ad-tech companies are trying to force onto mainstream users. This volunteer community is also unlikely to care too much about whether web sites containing 10MB of obfuscated JavaScript that was developed and tested solely against Chromium-based browsers works well. I think you'd find that the community would rather spend time working on projects such as yt-dlp to just re-implement front-ends for horribly broken websites, or would simply prefer to use non-broken alternative websites.
Linux is also the easiest kernel to develop against too for reasons that include _much_ better sandboxing features being available, better debugging tools and availability of source code to learn from and debug with. Contrast to Windows with undocumented or poorly documented kernel and other system library APIs, lack of source code (particularly examples of APIs being used in other software), and having to do more work to opt-in to security features that are enabled by default on a Linux system.
30 years ago in 1994 you could have been using Linux (v0.99/1.0/1.1), Apple System 7 (not OSX), and Windows (3.2) - but not with Firefox.
You might have used Lynx or NCSA Mosaic, or by the end of 1994 Mosaic Netscape (later Netscape Navigator) or beta Opera.
I still despise Gtk 3 or whatever it is that is killing menus and sticking controls into the title bar etc. but it's fine. You don't need to use Gtk apps much these days anyway.
"Servo is faaaar from ready for general use yet, but it's picking up development speed. Definitely an option to keep an eye on for the future. "
Already a good way through CSS and WPT test suites: https://servo.org/about/
That's two seperate lines of not-Chrome not-Mozilla dev in the pipeline.
These pre-built nightly snapshots allow developers to try Servo and report issues without building Servo locally.
Please don’t log into your bank with Servo just yet!
There a few longish tech talks on youtube, the initial focus was on bringing documentation up to date in order to draw third party dev's in. Now there's more focus on more coverage of test suite.
It's in a decent sweet spot for certain types to get on board; new funding, new energy, room to change the guide rails and a milestone to work towards.
So there still needs to be some browser project like the Ladybird mentioned, or a Brave, or whatever that decides to use Servo instead of WebKit, is my understanding.
(A bit of a tangent since not a browser, but I assume Tauri will be keen to use it.)
https://youtu.be/n4YBMjlGWRc?t=77
I imagine a lot people won't accept that. Especially not as we're shipping more and more JavaScript.
Modern websites and the standards they rely on are overcomplicated. The problem lies with the standards, and the way they are used. The browser can't control that. I could never work on such a project without quickly losing motivation.
Also, that link says "The main community hub is our Discord server." That doesn't inspire confidence in anything.
(E.g, Dolphin emulator, who seem to have largely moved away from IRC)
That picture of the laptop is the most blatant part. Is that just one contributor phoning it in for the landing page, or does that culture run deeper through the Ladybird project?
I use an adblocker, I have no need for "Privacy preserving ads".
Any idea what a transaction will look like. Who will pay them for this and how? I guess ad networks would pay so they can still attribute and do retain their customers better? I wonder what the fee is per
It's actually developed together with Meta/Facebook: https://blog.mozilla.org/en/mozilla/privacy-preserving-attri...
> Anonym was founded in 2022 by former Meta executives Brad Smallwood and Graham Mudd.
https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t...
It is plausible for example that you could form a statistical cohort around people that work in an organization and determine that they have become interested in a topic that reveals internal plans.
Even as an individual, I can only see more accurate modeling of my interests as a tool to be used against me. I do not consent to sharing those correlations. They are private.
The ad agency is only able to see: their add (y), published on source z, led to x conversions, over a period of time (p).
The only way to get them to stop using the old mechanisms is to block those mechanisms.
If you can't block those mechanisms then you're just giving more ways for advertisers to track people, not taking away the old ones.
And if you can block those mechanisms, then just block them, you're done, stop there.
Whether it's worthwhile and/or will help reduce industry tracking practices is a good & separate question, but it's not reasonable to describe this as anything akin to a attack on privacy.
It's an attack surface with no redeeming value for end users. There is no value gained by compromising with advertisers.
And of course the data is useful. That's why this is being done. That in itself is not a argument against it.
What is the reason this is good for users? It's not "this is better than other tracking", because this does nothing to take away other tracking so it's not an either-or. Other tracking won't go away until it's blocked. There is no requirement to provide a replacement.
"We've should eliminate toxic waste being dumped in the water!" "What do you propose to replace the toxic wastewith? Why don't we provide a less toxic waste? Maybe if we offer the option of dumping a less toxic waste, that'll incentivize factories to dump that instead of the more toxic waste?"
GP was very clear in what he considered "black and white thinking" and you very clearly avoided addressing what GP wrote.
> What is the reason this is good for users?
Did GP said it was good, no. So why are you even asking this question?
I never said this proposal is any good. I don't know if is as I just looked at the general overview, and that's not really enough to make a judgement one way or the other. As a general point I do think it's a problem with solving.
What I am saying your case for "it's bad" is entirely without substance and seems to be based on axiomatic black/white thinking.
Once you have a non-zero number of bits flowing from the browser to advertisers, that's a path to try to extract more bits of identifying information than the browser intended to provide, by any number of means.
There will be lots of people trying to deanonymize users from the data. There will be warrants served to the intermediary. There will be attempted security breaches on the intermediary. Those are just a few bits of potential attack surface, all of which is entirely unnecessary.
I mean, there's the part where advertisers pay for a huge chunk of the web? Maybe you're ideologically opposed to that and think websites should only have crowdsourcing-type revenue sources, but in the meantime website owners need to pay the bills.
They don't. Most of the web is unpaid UGC.
> Maybe you're ideologically opposed to that and think websites should only have crowdsourcing-type revenue sources, but in the meantime website owners need to pay the bills.
That's up to those website operators to figure out and not the concern of the user's browser. It only becomes the browser's concern when those website operators try to enrich themselves by manipulating the user into acting against their best interest via ads, in which case the only correct response is to block those ads. For the most part, the website operators that are in it to make a living are simply scammers that will not be missed.
Ad supported content is worth something and eliminating that business model overnight would be bad as a bunch of things would be less accessible.
"competition law" is a problem for Chrome; as a browser run by a massive advertising company, interfering with other advertising companies raises antitrust concerns. It is not a problem Firefox needs to care about. (Also, it's not a problem that a browser with a tiny fraction of market share needs to worry about.)
"web ecosystem issues" is a fascinating euphemism. Let's cause more "issues" for advertisers.
> Ad supported content is worth something and eliminating that business model overnight would be bad as a bunch of things would be less accessible.
It's not going to go away overnight; it will take a long lingering time to die, and that time gets longer every time someone hesitates to kill it. In the meantime, as it becomes less effective, other models will become more effective.
Could this advertiser be Google who also pays their salary?
Why are Firefox doing it, how does it relate to similar features in other browsers? If it leads to direct revenue, how? If there are relationship reasons for doing it, what are the forces at play?
Just the actual background, not opinions on whether it is good or bad before understanding that background.
You do this when you want to hide something. This does not inspire trust.
Edit: instead, if they believe this to be a way out of the ongoing data thievery that is the ad industry, they could have announced this openly and boldly. "You want privacy, they want ads, here's a middle-ground." It could have been scrutinized by members of the community beforehand. Now, it'll just tarnish the reputation of Firefox and go down with it.
From reading around their documents ...
https://blog.mozilla.org/en/mozilla/privacy-preserving-attribution-for-advertising/
https://github.com/mozilla/explainers/tree/main/ppa-experiment
https://datatracker.ietf.org/doc/draft-ietf-ppm-dap/
... our DAP service, which is a Multiparty
Compute (MPC) system based on Prio ...
Our DAP deployment is jointly run by
Mozilla and ISRG. Privacy is lost if
the two organizations collude
(In the first version, I asked who is involved in proxying the data)
It's also rather suspicious that the setting to disable this seems to be somewhat hidden. If I go to settings and search for "advertising" then I get:
> Sorry! There are no results in Settings for "advertising".
But if I browse to it manually in then the setting is there, in the section named "Website Advertising Preferences". And the search definitely includes section titles, because if I search for "collection" then it shows that section of the Privacy & Security settings, with a highlight on the text on the title.
Not long and we'll see the same game as Chrome + ad blockers.
Hard to see their repeated reversion of specific controversial user settings as accidental.
It seems almost that mozilla's leadership is intentionally trying to ruin it.
Limit online advertising to contextual ads, and to the same attribution methods advertisers have access to with traditional (TV, print and billboard) ads.
Is your browser a user agent or an advertiser agent?
But I do agree that it's a string of bad news for Firefox users over the years.
And yes, for those of you on distributions, you might say that your distribution maintainers will just patch out or customize out, and the nefarious changes that Mozilla makes upstream. But the thing you have to remember is that distribution maintainers are handling, by a whole lot of other things, tens of thousands of other packages, and an entire operating system, and its upkeep, go through them. So they will often just not patch out or patch things out inconsistently or not really pay attention. I think it's much better to rely on a project whose whole purpose and explicit mission is making Mozilla more privacy-friendly and secure and who have a dedicated community of a few developers consistently working on it. Especially since distribution maintainers don't really make any specific mission statement promises with regards to specific packages, but something like LW does. It does a lot more than just this one thing. It's essentially equivalent to having a arkenfox config maintained for you and always applied to your browser and updated in lockstep with your browser, as well as a set of patches that they maintain to remove things like Pocket.
"If informed consent is used as the lawful basis for processing, consent must have been explicit for data collected and each purpose data is used for"
I don't see the word "personal" in this sentence, only "any data collection". It's clearly not in the users' interest/benefit to activate this data collection, and not required for the normal functioning of the browser/websites. So activating this silently is minimum _very unethical_ and probably illegal, but I'm not a lawyer.
I fucking hate this.
Just switch to Librewolf.
I feel the same way about debugging telemetry... it's so valuable for developers and yet people want to see you hang if it's not (at best) a manual opt-in, but they don't care that it won't be used by anyone in that case.
Reliability ratings, notifying of fixed reported crashes, improvements in performance telemetry etc
There will be users that perceive any feature of the application to have no value. I think developers should not only consider the opinions and wishes of the user but also what's best for the application itself.
So if this is something that is so undesirable that no one would opt it to it, then maybe it's not a feature that should be included the the browser at all - especially when Mozilla's slogan is "Internet for people, not profit".
As to it being opt out instead of opt in: consider the fact that only a small number of websites are involved in the experiment; if it was opt in then it seems quite likely that there could potentially be no intersection between users who opt in and users who visit those specific websites, rendering the entire experiment pointless.
[Edit: fixed spelling error]