Hacker News Reader

Comment by r1ch | Hacker News Reader

So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google.

It's no concern of mine if someone else's business model is that badly broken.

There is zero reason for an ad to be using the Geolocation API. IP-based geolocation is more than enough.

I'm sure advertising will find a use for it! Like "hyper-local ads" that can give you "just around the corner" deals in malls, etc.

> There is zero reason for an ad to be using the Geolocation API. IP-based geolocation is more than enough.

There was also zero reason for billboards by highways, before there were highways. :)

Location based advertising is powerful, but the issue here is privacy. We have no idea where that information is going.

Advertising could find a use for my DNA profile but that doesn't mean they should have access to it.

Obviously this is all a sliding scale and has nuance, but I'd say ads should not be using anything that is behind a permission prompt, like geolocation. Tremendously hostile to both the user and the site hosting their ad.

I hate to play Devil's Advocate but accuracy can be important. Geoip means they can serve me offers for businesses in the same city, but I'd [almost] love it if I were served offers for a taqueria down the street from my browsing location.

More than likely they'll just correlate browsing habits with location and sell that information to third parties, though. High quality advertising is just not in this reality.

We have clients that are asking us to target down to street level, which IP doesn't even come close to offering. With IP you're stuck in the arms of whatever database you're using.

So tell them no. I don't want your clients knowing my street address.

I mean, for all you know, I'm in a domestic abuse shelter. Are you going to take responsibility for my well-being if your clients' database gets leaked? And are you confident that your clients know how to competently secure a database if they can't even use HTTPS?

We don't store any PII, so I don't see what the problem is here?

Any data about the user - even simple timestamps - that is leaked is an increasingly-serious problem. Just because you don't have interesting data doesn't mean other people cannot correlate your data with other aggregated personally identifiable data.

edit: Sorry, partial post due to accidentally hitting enter.

If you have clients pressing you to use code that requires a permission prompt in an ad then you need to have a very straightforward conversation with them about the effect such prompts have on conversion rates.

I'm just engineering side so I don't have any word on that. All we agree to do is zip code as the most granular level of geo targeting.

> So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google.

Geolocation API is pretty powerful. It's one thing for a random website to know approximate location, but to be able to track location within 10m is something else.

Perhaps a gentler interim solution would have been to only allow accuracy to town/city level over http.

That's already mostly possible with geoip lookups.

Yeah, it's just the breaking changes thing - I like what Google are doing, and it's been alerted in the console for ages, but they're strong-arming it slightly.

I'm weird, but it always grates slightly when companies throw their weight around - even if the endgame is a positive outcome.

Plus the cynic in me assumes they have an advertising product in the works and this is facilitating it.

To the people replying to this comment, he's not talking about the ads not being able to use the users location. Most don't. But plenty of ad networks don't work properly or the CPM is much lower for HTTPS enabled websites. I'm guessing r1ch is using a users' locations for his site, and it's ad supported. Hope everyone who is against ads is willing to pay for their content from now on!

Yes this was meant to be my point - I didn't even consider ads using gelocation (which explains the downvotes I guess :))).

While we do use geolocation and ads on one of our sites, it's only a single page so this doesn't really affect us that much. I can see it causing big problems with ad-supported sites / services that use geolocation as a primary feature though as I've experienced first-hand the revenue drop that HTTPS causes.

> he's not talking about the ads not being able to use the users location

The reason for wanting the user's location doesn't matter. It's incredibly irresponsible to send the user's location (or any other user data) over the network unencrypted.

Just embed an iframe for a secure subdomain and use window.postMessage to communicate with it.

Edit: never mind, that is apparently also "insecure", leading me to think they are doing this because they get a kickback from the SSL cert vampires somehow.

Yes, they're probably getting massive kickbacks from those horrible vampires over Let's Encrypt, who list Chrome as a major sponsor.

If not, why should they do it? What is in it for them?

There has been a massive loss of confidence in web security since Snowden (and rightly so). Major players now have to look like they're not "helping the NSA", so to speak -- this goes double for Googlers, which try very hard to hide their relationships with the establishment.

In a way, it's good -- privacy on the web improved more in the last 3 years than in the previous 15 -- but it's also a massive charade.

HTTPS certificates are free these days: https://letsencrypt.org/

If you want to run their software. On your server. As root. And are happy with 3 month certificates.

Do they support just downloading a file from them and then uploading it my server, as proof that I control the domain? That should be enough.

You do not have to use their software.

You can use one of the alternate clients people have written, or write your own:

https://github.com/xenolf/lego

https://github.com/ericchiang/letsencrypt

Or use this web interface:

https://gethttpsforfree.com/

Also you can configure it to give you longer lasting certs.

Reply on news.ycombinator.com