Twitter abandons 'Do Not Track' privacy protection
zdnet.com
zdnet.com
Was there ever a honest belief by anyone (except the Ayn Rand fanboys) this could work?
5%? Nah, I'll pass; I don't want to spend my last six months in agony, so it's not worth it (i.e., bad trade-off). 95%? Hell yes, sign me up. Your own analogy supports what I said earlier.
On a side note, the statement "Chemotherapy will probably cure your cancer" is also not true and shows a bit of ignorance re cancer therapies in general.
It is trash, but at least it is something.
Compelling arguments in favor.
His comment in no way responds to the main argument, here, which is that there exist many scummy companies who ignore DNT.
Can I or a neutral third party audit your internal database to verify that my browsing history is not being recorded by you? Do you provide a list of all third parties with which you share information with so I can attempt to audit them as well?
What dispute resolution procedures do you support if I have reason to believe that you do, in fact, hold some of my personal information despite my express request? How would you respond to a request to purge an individual's records from your logs?
--------------------------------------------------------
I don't mean to put you, personally, on the spot. I'm sure your firm is perfectly ethical, and that you do listen for and take some action to honor DNT requests as far as you see fit. I'm also sure that were I at an advertising firm I wouldn't have any better policies. It's not your fault this is a stupid feature.
That said, to almost anyone outside the webdev community "Do Not Track" doesn't mean, "Track, but Anonymize" or "Track, but Don't Personalize", it means "Don't Create A Record I Was Here". I've yet to run across a single company, advertising or otherwise, that interprets it that way, though.
I'd bet nobody respects dnt like that, but you can still check. Obviously if they want to be shady they can get around this too.
However, I'm more concerned about the hundreds of other services that might not. My point was that DNT requires cooperation from a huge number of actors to be effective, with the actors having no incentive to play along and nothing to fear if they don't.
I keep seeing this recently and this time I can't even imagine how it could be relevant.
https://www.salon.com/2016/12/14/fountainhead-of-bad-ideas-a...
Make your own conclusions.
I seriously doubt that Donald Trump is really a fan of Ayn Rand. Her books may be juvenile and shallow, but they’re way too deep for him.
Make your own conclusions, indeed.
Heather Digby Parton, also known as "Digby," is a contributing writer to Salon. She was the winner of the 2014 Hillman Prize for Opinion and Analysis Journalism.
Um, I only hope they don't give awards for that.
It's glorified trash talking really.
This was probably the best response of all because it provides a plausible explanation why this started only recently. I mean, I swear I have never seen Rand mentioned on HN by anyone in any way until lots of people suddenly started making fun of her few weeks ago.
No, a group of people have been posting about Rand for years. Here's a thread from 8 years ago people on both sides of the like/dislike divide. https://news.ycombinator.com/item?id=427292
Here's a post with over 40 points that's just a quote from Atlas Shrugged: https://news.ycombinator.com/item?id=5860250#5860696
I'm not saying that it never happened but that it wasn't the case that she was mentioned in every other flamewar about politics.
From hn.algolia.com, excerpts from all "Ayn Rand" posts in the last 10 days, except replies to these posts:
Was there ever a honest belief by anyone (except the Ayn Rand fanboys) this could work?
Yeah, that would be great in the Ayn Rand's fantasy land
I had a coworker who was a hardcore Ayn Rand type who had a real harsh point of view like this, until his infant was born with a congenital heart defect that resulted in hospitalization for 3-4 months. [this one actually isn't dumb]
HN is nothing but startup bros, armchair economists, and card-carrying Ayn Rand fan club members.
For an entire generation community-oriented principles, egalitarianism, collectivist ideas, and far-left leaders were demonized as Soviet sympathizers, replaced with rah rah unregulated capitalism, Ayn Rand-ian individualist, and military might. [tl;dr, might be reasonable]
Nobody cares about your Ayn Rand pablum anymore. Argue on morals that have any grounding at all in the real world.
In this case, it sounds like it's mocking the idea that the market-based voluntary agreements could solve this problem. Lots of people seem to think you can solve any problem by just "letting the market work."
I fully expect we'll look back on Internet advertising as a bootstrapper for the early Internet economy as opposed to a lasting model.
Of course at some point there might be ad-blocker-blocker-blockers which will postpone the problem to another round. But do we really want an economy based on an arms race?
An ad-blocker-blocker-blocker is just an ad-blocker.
An ad-blocker removes ads.
An ad-blocker-blocker detects ad-blockers and refuses to serve content if one is detected. (Instead a "disable your ad-blocker if you want to use this site" message is shown)
An ad-blocker-blocker-blocker masks the ad-blocker against detection, so content can still be consumed.
Etc...
Some people live in a political/cultural "tribe", and see the entire world through a prism where everything they dislike is linked to "the other tribe". They often punctuate every paragraph with some meme jab at the other tribe, even if it's seemingly irrelevant for everyone else who doesn't share the same prism.
On Reddit, this results in imaginary Internet points (i.e. upvotes), which reinforces the behavior and the underlying mindset. The HN community is better, but still not immune to this. I'm convinced that the "gamification" of online discussion over the past ten years has pretty deep impacts that future generations will look back on someday.
My gamer and geek friends have been spewing libertarian flavored Randian nonsense since middle school, circa 1983. I never imagined that worldview would prevail. It was just so puerile. Not so different than the tortured coming of age fantasies embraced by the other subcultures (stoners, metalheads, preppies). Though maybe the nerds were more aggrieved, seeing themselves as an oppressed minority.
Of course, none of us knew about the well funded propaganda machine pushing the whole Austrian/Chicago school of economics. Young Republicans, trickle-down economics, John Birch Society, Hertitage Foundation, disaster capitalism, Grover Norquist, etc.
Edit: TL;DR: Mockery is the only appropriate response.
You could add in the Mont Pelerin Society,Foundation for Economic Freedom, Atlas Network, and Cato Institute, Mercatus Center, Adam Smith Institute, Mercatus Center.
And personnel: Ludwig von Mises, Leonard Read, Murray Rothbard, Friedrich Hayek, the Kochs (Fred, Charles, David), for completeness.
Mark Ames has an excellent general summary: http://www.alternet.org/visions/true-history-libertarianism-...
https://en.m.wikipedia.org/wiki/Mont_Pelerin_Society
https://en.m.wikipedia.org/wiki/Atlas_Network
https://www.atlasnetwork.org/partners/global-directory
https://en.m.wikipedia.org/wiki/Foundation_for_Economic_Educ...
https://en.m.wikipedia.org/wiki/Cato_Institute
https://en.m.wikipedia.org/wiki/Mercatus_Center
See, e.g., Philip Mirowski's The Road From Mont Pelerin:
http://www.worldcat.org/title/road-from-mont-pelerin-the-mak...
I recently read a magazine article that covers same history as Mirowski's book. Hayek's motivations and strategy for pushing his ideas (take over economics depts in higher ed) are fascinating, instructive. Sadly, I can't imagine how the left could replicate that effort for reality-based polcies.
On mobile, sorry no link handy. I'll edit if I can find it.
https://en.m.wikipedia.org/wiki/Lewis_F._Powell_Jr.#Powell_M...
I'm not immediately recalling or coming up with a Hayek reference, though it wouldn't surprise me in the least, and I'd very much like to see what you're thinking of if you can find it.
At least someone on the Internet recognizes the Mercatus Center for the Koch propaganda machine that they are. It's unfortunate, the influence they have on the GMU graduates.
During the aughts, I attended many of our local political parties. Socialists, Dems, GOP, Libertarians, etc.
All these cliques, for lack of a better word, are mostly defined by what they're not (in opposition to other cliques).
The exception was our local Green Party. Their members were defined affirmatively, by what they stood for, vs in opposition to some other group.
The Libertarians were especially mushy in their supposedly beliefs, and no two agreed on anything other than everyone else was wrong. Kinda like the various Christian sects.
I've been re-reading John Henry Newman's Apologia pro Vita Sua, published in 1864, describing the author's conversion from the Church of England (where he was one of the most visible clergymen of the time) to Roman Catholicism. It was written in response to another clergyman making accusations that, not only was Newman being dishonest, that dishonesty was an inherent characteristic of Catholics, and that (based on an uncharitable reading of Alphonsus Liguori) it was Catholic doctrine that Catholics could lie about anything to preserve their faith, and therefore Newman had been a Catholic sleeper agent his whole life, tricking his fellow conservative Anglicans into adopting papist positions until he was ready to reveal himself as a Catholic to convince others to jump ship.
He sets out his response in the introduction, and in it he introduces the term "poisoning the well" to name a logical fallacy: he asserts that his ideological opponent has made it impossible for him to say anything in self-defense, and hopes his readers will recognize it.
This all strikes me as extremely reminiscent of Internet arguments. The uncharitable clergyman is very tribal, and defecting from the Anglican tribe to the Roman Catholic one is an unforgivable offense. And Newman responds by saying, look, you have used a logical fallacy against me. They'd fit so well on Slashdot! But it was over 100 years before the Internet.
(On a side note, the phrase "imaginary Internet points" to describe upvotes strikes me as a thought-killing meme jab itself. The descriptor "imaginary" makes no sense: what would real Internet points look like?)
Do Not Track was an attempt to give users a voice and the overwhelming response to it by the trackers was to ignore it. DoNotTrack wasn't an effective anti-tracking solution, but for every opt-in, it was a clear message from users. It's why Microsoft's auto-opt in, while probably well meaning, really screwed the whole thing. It had to be a choice.
It was a message, and it's still a very strong argument when it comes to the discussion about dishonesty among trackers and advertising networks.
I might be overly cynical, but I think that was pure covert corporate warfare on Microsoft's part: it could reduce Google's income and was good PR.
A number of websites formulate this as "By continuing to use this website, you agree that we will access your cookies," accompanied with a "Dismiss" button, but that's not really what the spirit of the law is.
DNT didn't change anything to this, as it was meant for a completely different use. I'd even say using DNT for this is a complete hack, which sort of misses the point of both the cookie law and DNT. You are, however, completely right that it is stupid beyond ridicule that you technically can't store the fact that a user doesn't want cookies on the browser.
Edit: paragraph formatting.
[1]: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...
Yes you can, it's pretty simple to do. Add a timestamped entry into your database to not show that notification to the IP address the user comes from, then run a script every minute that clears out entries older than an hour. Granted, if you go back to the website an hour later, it would still pop up the request to access cookies but it certainly beats having it pop up on every page load.
If you now mandated them to respect some special HTTP header instead, most of them would simply 403 all browsers with this header set and you would have to disable it to access these sites. So same thing as with JavaScript and cookies - either tolerate crap or stop using a dozen websites or install yet another extension for management of per-site exceptions.
This law is silly and completely detached from reality. They should either prohibit tracking by law or do nothing.
How about a browser extension that hides any overlay divs with the string 'cookies' and input buttons?
Google might listen to DNT, or it might ignore DNT, but I don't think they'd ever pretend to listen to DNT and then do something different. They'd get sued for sure.
On the contrary, it was (generally) those in favor of government-mandated privacy and security who heavily supported the DNT efforts. The "Ayn Rand fanboys" just told people to install uBlock Origin
At least that's what parent's claim was, which you seem to disagree with but failed to actually argue against.
Once they made it the default, it was all over. It was so obvious that doing so would kill DNT that I have to wonder if they did that on purpose.
It's definitely an interesting way of stopping something you don't like - support it to such a degree that those who asked for it don't want it anymore.
If any Good citizen site ever thought about honoring DNT they got their plans crushed when Microsoft did this.
It was a silly proposal from the start but a hopeful one. Hopeful that people would do the right thing. The web was always built on assumptions that the other side would do the right thing in that context DNT was not so silly.
This one failed. Because Microsoft didn't do the right thing. They decided to use DNT as a marketing platform instead.
Shouldn't not being tracked be the default? Shouldn't we be opting into targeted ads, not out of them? Seems reasonable, if DNT weren't garbage, to have it be on by default. But it was garbage and so it was never really any help to anyone anyway.
Really, everyone should just install an adblocker, and whitelist sites that are non-invasive, don't track, and that you want to support. Then the responsibility isn't on advertisers not to track us, it's on citizens to whitelist sites that they genuinely should be supporting.
On the other hand, DNT is intended to be an opt-in polite request for other agents to change their usual behavior. An adblocker or tracking blocker at the browser/user-agent level does nothing to change how the servers that I do connect to behave. It just alters the behavior of my browser to not contact at all unrelated third parties.
With DNT, my user-agent still contacts those third parties, but with a request to alter their default behavior. "Please, give me adco.com/somead, but please don't correlate this request with other information you have on me, etc."
I do think there's a possible place for something like that, but it has to be opt-in or nobody will listen to it. Trivial examples of other "please deviate from your default behavior" requests are things like "show desktop version" on mobile browsers, Accept/Accept-Language (where supported), etc.
On the gripping hand, it's also yet another bit to differentiate me from everyone else, and expecting polite and ethical behavior from advertising corporations probably really is doomed to failure.
Yeah, I considered bringing this up in my original post - DNT is garbage for a lot of reasons. One of the big ones being that it actually sucks for privacy, especially if it's not used a ton. It's one more thing that can make you trackable.
https://www.cnet.com/news/microsoft-ticks-off-advertisers-wi...
The other side of this coin is that when you voluntarily send data to the server, what they do with it is generally their business (complying with local laws etc).
If you want to "block tracking" you should prevent your computer from sending trackable data to the server. Complaining that theyre keeping data about you is tilting at windmills: good luck preventing it.
Privacy standard thay works as long as people are not using it and fails the moment they start to, is just a lie.
1. https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish
I actually had my adblocker turned off on websites I knew at least tried to respect DNT (reddit, medium and twitter), guess twitter's getting completely adblocked now.
It used to be ads had to be clearly labelled as not to confuse with regular content. Twitter buries their "promoted" label at the bottom in light grey text, so you only know it's an ad after you've read it and asked "WTF? Why is this in here?"
Scrolling through my feed I swipe past the ads faster than the other tweets.
*.facebook.com 0.0.0.0
But... This only works if you're willing to entirely live without Facebook/Twitter. Probably not the best choice for the majority of people.
Blocking domains at the DNS level is a partial solution at best.
This is true, which is why you need a better list. Like one of these:
https://github.com/StevenBlack/hosts
(There are lots of others out there if one of those doesn't suit your fancy.)
These things will never be perfectly inclusive, but they whack the vast bulk of the commercial surveillance shops, and have the great benefit of not being prone to bypass from browser/extension exploits.
They also cut the flood of garbage down to a point where it is possible to individually see what bugs are getting through and do something about them.
You're right that they're a partial solution, but they are a massively helpful one.
If you're going to use one, do glance over the list to make sure you understand what you're blocking.
Some interesting examples where it didn't work: 1. wowhead.com: this site hides the source of all of its assets behind its own proxy, so the content you want, and the ads you dont want come from the same place. A traditional ad blocker works fine here. 2. Google: it is really hard to block google's ad domain, but still use google's services if you are doing it at the DNS level.
There is an argument to be made for DNS blocking though. If you want to take the moral high ground, then it is a good method. IE, if you don't like google spying on you, why do you use their services at all?
I run it at home and it blocks the ads on my entire network. Work exactly like your method.
I thought 'do not track' was on and I was OK but trackingprotection is a separate option in Firefox configuration.
Could someone build a privacy-respecting browser that "spews" super-generic metadata that doesn't vary from installation to installation? It's probably have fewer "features," but I'd honestly kinda welcome a simpler browser experience.
It had the exact opposite effect it intended to have.
No, DNT seemed like a stupid idea right from the beginning. It's nothing but an "evil bit" that websites were always free to ignore (and what's more, ignore silently). I never understood the outrage when Microsoft had IE set DNT to True as default, all they were doing was making explicit what a useless, feel-good piece of nonsense it was while everyone else was just ignoring the elephant in the room out of motivated self-interest.
So, good riddance. DNT was always an attempt by advertisers to distract people from the fact that the only real solutions to privacy problems are legislative, and they don't want that. Twitter abandoning it might be one tiny step closer to broad awareness of that.
What do you mean by this? The "opposite" of what you're replying to isn't really obvious to me. :)
Let me just check the public registry of what companies track me and what they're tracking.
Does not surprise me at all.
As a very early adopter of Twitter, I have to say I thought this platform had a lot of promise at one time. Unfortunately, it's becoming a textbook case of how massive ego corrupts and destroys a product, a company, and now even a country. It started with the lockout of developers' ability to write frameworks around the APIs and is ending, naturally, with these massive political bots owning 10K+ followers, spam that always ends up on the top layer of search.
My disenchantment had been growing for a long while. Finally shut down my accounts earlier this week after they refused to offer "verification" my ecosteader account. Ten years I've been waiting it out, promoting this company for free, adding Twitter links to websites I build for customers and clients... and they do not even grant a courtesy gesture to show people that yes, the owner of these Twitter accounts is indeed associated with these websites.
Instead, like everything else on the Internet these days, it's all about popularity and ego and bribery.
Apparently, the rumor that the best way for a small company or org to get verified is to cash-bribe somebody who works there is true? If that's what you wanna do, go for it... but at least document your corrupt dollars needed and standards for bribery somewhere, so people can have some reference before they waste their time. The echo chamber and circlejerk thing has gone on for far too long.
Given that is was a centralized, proprietary service from day one, so it necessarily would follow the interests of the owners, and that also has a strong network effect that locks people in ... how did you come to that wild conclusion?
What followed was a series of terribly bad decisions to turn it into a marketing platform, rather than what it what it was organically becoming, which was a real-time market research tool + analytics API.
As a result of bad direction and big ego, today it is just an extremely noisy, mostly irrelevant, echo chamber.
Would anybody be interested in a local DNS server that automatically updated its list of black-holed domains through a mechanism that preserved your privacy? (Assuming, of course, a decentralized representation of the block lists.)
Would anybody be willing to sell their attention by accepting payment (BTC), perhaps through a dutch auction, to re-enable a black-holed domain for a time-limited period? (Hand-waving the mechanism for ensuring that the domain was actually whitelisted.)
I'd personally be interested in the former, and would likely use the latter - even though I find it hilariously unlikely that Ad Networks or Web Sites would participate in bidding for my attention directly.
I'm not totally clear on where their blacklist comes from but their mainpage claims "Known ad-serving domains are pulled from third party sources and compiled into one list"
This is pretty much exactly your first suggestion and seems like it would be an excellent platform on which to launch your second suggestion.
The most comprehensive of the lists appears to be https://github.com/StevenBlack/hosts , which is the same list I use for DNS filtering on my DD-WRT router. Seems to work pretty well.
Ghostery has a nice little library of stubs for e.g. ga that are injected in each page. I think any good solution will need to have such shims. Doing it on the network level (like redirecting to a stub hosting webserver) has problems with SSL
Serving video is pretty expensive. How big are the ad networks' margins? Let's see who blinks first.
Remember that it is possible to track users without the use of ads.
A browser written by an organization that profits from ad revenue or collecting user information (hereafter "well-known browser") will load elements, e.g., images, in a web page automatically.
No user interactivity is required. The user need not "click" anything. The user may not even be able to see the element loaded.
Email clients supporting HTML email can do the same thing, loading images automatically, hence suporting a method of tracking.
This is a very old method but still widely used.
What if the user is not using a "well-known browser"? What if those elements will not be loaded automatically? Will these methods of tracking still work?
All methods of tracking, other than IP addresses in access logs, rely on assumptions. Many rely on assumptions about usage of a "well-known browser".
The assumption re: automatically loaded elements, "beacons" or whatever one wants to call them, is that the user is using a "well-known browser" that will load elements automatically. If the user is not using a "well-known browser", all bets are off?
Another example is the HTTP header "fingerprint". HTTP headers are tied to "well-known browsers". What if suddenly all users decided to only send the same minimal headers? In the way that some server software might try to hide its version (e.g., BIND) imagine that users decided to hide their client software version.
Aside from IP addresses, many methods of web tracking are heavily reliant on assumptions about use of "well-known browsers" and the behavior of those browsers. Could these assumptions ever fail to be true? Can users think for themselves?
The www as a medium for exchanging information or even doing commerce does not necessarily require the use of any particular browser. That "requirement" is only imposed by certain sites on the www, for reasons that may ultimatley benefit the site owner more than its users. No such "requirement" is imposed by the www itself.
Thinking of this in terms of "a carrot and a stick", as far as I have seen using the www since 1993 there is only a carrot in the form of a "well-known browser". There is no stick. Users are free to make HTTP requests using any client they choose, including ones that do not expose them to advertising or tracking. Such clients may not require an "adblocker" because they do not requests elements automatically.
There used to be and perhaps there still is a never-ending battle between commercial entities over which is the "default browser" in a graphical OS. Certain companies tried to coax users into using certain "well-known browsers". There was even a large antitrust case in the US over this issue.
The implication seemed to be that if not set by default users might otherwise choose some other HTTP client to interact with the www. In those days one company wanted to sell a browser as enterprise software. Today that browser is owned by a "non-profit" organization of salaried employees. Other well-known browsers are owned by "for profit" (subject to taxation) commercial entities with thousands of employees.
Today, these well-known browsers are "free". And yet these browsers are written by salaried employees, not open-source project volunteers. These entities continue to market their "free" browsers aggressively to users.
As a user, ask yourself why.
Ads? Tracking?
What motivation does Mozilla have to want to "undermine online privacy?" Of all the major browser vendors, they seem the least coupled to the privacy-invading ad ecosystem.
That gets hundreds of millions of dollars a year from Google & Yahoo/Microsoft in search revenues without pushing them to provide a genuine private search?
Yeah it's the least coupled, because the major alternatives (e.g. Google) literally run the privacy-invading ad networks.
Mozilla walked back from the tab-page ads more than a year ago.
> without pushing them to provide a genuine private search?
How much leverage do you think Mozilla has with the search engines? Google canceled their deal with them because they are so dominant and Chrome has been so successful. Mozilla needs revenue to keep the lights on, and the search engines are the source of it.