Brave disables Chromium FLoC features
github.com
github.com
But wait you say, how would the very useful internet ecosystem survive without advertising revenue? Well, there is nothing wrong with advertising per se, it's a natural part of a free market economy. It's ok to target ads to the user's search terms or social feed. The problem is that, in the pursuit of advertising revenue, a cutthroat economic competition pushed advertisers to mine more and more personal data simply to stay competitive. It's a low sum game: it doesn't bring much more money in advertising or make the internet significantly more useful, but it destroys the privacy of everyone. A spectacular market failure ripe for correction.
I ended up reaching the conclusion that we should ban paying money for your attention, but I haven’t thought of better alternatives for businesses to grow or expand online yet.
USPS becomes vehicle for junk mail Telco becomes vehicle for robocalls Television a ratio of value to ads that gets smaller and smaller Internet becomes vehicle for ad revenue
All of these things are companies abusing communication platforms for your attention and we seemingly are never willing to pay more than advertisers are, maybe because by the time that decision happens folks move to the next platform.
The meta thing is that the Internet is a meta platform and we can keep making new communication methods, but we are still stuck with Google.
I think western society struggles with banning things. But we've shown an aptitude for taxing vices. It's all about the money, right? Rather than banning, would taxing this economy achieve a compromised version of what you're seeking?
If the money isn't destroyed you will end up in smaller scale corruption. One example that comes to mind is HK zoning fees and the government's increasing dependency there of.
On some level, if the tax is there to "discourage" people, then the fact that they're willing to buy "smuggled" goods to save a bit of money shows you that they're not discouraged enough and they're not your target audience.
I don't think that's either possible or desirable. Attention seeking would simply take on sneakier forms that are indistinguishable from legitimate distribution of information and protected free speech.
Instead of somewhat independent ad funded publications, you would get publications that are owned by product companies (or political parties) themselves. The content they publish would be far more biased. Subscription based publications wouldn't stand a chance against those free and well funded company owned publications.
Advertising is very annoying, but I think it can be more transparent than almost any other form of influencing people.
Tracking for personalised advertising is an entirely separate issue. That's where I think a blanket ban could work.
Often progress is about eliminating one large negative externality, only to discover that there are others to handle too.
The 'submarine' type content you're referring to is somewhat addressed by trust networks, fact checking, link reputation, and various other techniques.
One large question is whether we're ready for all of the economically-motivated actors to start shifting into that space.
PS: You make a good point about transparency. It's nice that (at least the most honest) adverts are identified clearly as such.
Could we have similar transparency in content? ("I wrote this because I'd been thinking about it after reading an article by X about Y yesterday, and here is the source)
I believe it would happen on a far greater scale, because it would be the only way to get the message across and competition from independent ad funded publishers would cease to exist.
Today, it's more difficult for a product company to justify the expense of running their own large scale publishing and influencing operation because it would have to outcompete advertising in terms of effectiveness.
People will always try to get other people's attention for their own gain. Trying to stop this is a quixotic endavour. I think we should regulate to limit the negative impact of this social constant, not try to stop it altogether.
>Could we have similar transparency in content?
Yes, I do think we could. But I also think that people would still prefer high quality if biased company bloggers to paying for expensive subscriptions. Don't forget that most subscription based publications show adverts to their subscribers as well. Without advertising, subscription prices would rise steeply.
I'm not necessarily advocating either to stop it, or to limit the impacts - just to make it visible. Once the power/influence structures (and the associated leverage they use) are evident, the manipulative ones will be abandoned and the authentic ones will succeed.
On the contrary, users are consistently willing to pay more than advertisers when given the option.
Problem is after a while, the advertisers and middle men eyeball all that ad-free content, and decide you’ll accept just a little advertising ...
Next thing you know, you’re subscribing to ads.
Problem is: there is a huge difference between paying even one cent and not paying. If you ask for $0.01, you will probably get the same result as asking for $0.10 or even a dollar. And if the only thing you have to offer is a mildly interesting blog post, no one will give you a dollar, so, if you want that cent per view, putting an ad is the only option. Micro transactions turned out to be largely a failure.
Another option is to find an editor/platform that gives you a share of a larger subscription. But even then, most people don't want to pay. For example, the usual reaction when I mention YouTube Premium is "why would I pay for something free?". And it gives even more power to large platforms: YouTube can reasonably ask for $10/month given the amount of content, it is much harder for a small player.
So what is the solution? Braved tried something with BAT, but it is still an ad-based solution, and I don't really trust it. Carriers tried it with the equivalent of premium-rate phone numbers. Governments suggested tax-based solutions, none of them convincing.
The server fingerprints the user and shares this info with an ad network, fetches and injects a personalized ad. Same result, zero accountability: no way to delete server side PII, no way to know what information was collected, no way to know how it was actually used. Even worse, the server gets to read the ad delivered to you, which may leak even more information.
There is no purely technical solution which can replace regulation.
Without Google AdX and the mess of disturbing cross-site tracking, I can't see why advertisers wouldn't just spend 100% of their digital budgets in walled gardens. It would just be so much more effective.
That is, advertising camping gear on a camping review site (without tracking) still has some nonzero commercial value even if facebook tracking exists and works.
For a large site like Facebook, adblockers might have a small effect, but for smaller sites seeing 30-50% adblocked traffic, their choices might be direct ad sales, and likely little else. I saw a post about ethical-ad-server recently, and maybe such ad servers should be the ones default unblocked by adblockers.
Precisely this. Go back to the advertising model where you place the advertisements in relevant locations. It's like going into the local pizza parlor and seeing an advertisement for a local plumber.
"Joe's Pizza" in Somewhere, NY can still say "I only want advertisers who want their ads shown in 30 mile radius of Somewhere, NY".
Flip the entire thing on its head and go back to camping sites showing camping ads, and auto parts stores showing ads for the latest amazing oil filter. They don't need to know who the user is at all. They are on a camping related site, they probably want to see camping related advertisements.
If I wanted to be generous I could point to the fact that advertiser revenue allows companies to realise a revenue stream other than having to directly charge a customer, be that subscription or increased prices. And so it could be argued that as a consumer you get an indirect benefit from advertising dollars, it's not clear that it's actually exploitive in that sense.
Full disclosure, I run adblockers and used to work for an adtech company.
Take the camping example. If I sell camping equipment, I can try to reach out to blogs directly, but I will have to place hundreds of campaigns for $100 each, track and monitor them all separately, and count on each of the blogs to deliver them accurately in good positions with no fraud. Or I can just buy one massive campaign with Facebook that runs across Facebook and Instagram and targets people who are interested in camping and maybe even expressed purchase intent. That's the better option every time. The transactions costs of dealing with individual websites are prohibitive.
Google (and the other tracking companies) just distribute that same option across the open web. If you get rid of it, Facebook wins absolutely.
I like the idea, as one commenter expressed, that the open web would be better without advertising. But I think the reality of an infinitely powerful Facebook is that the open web would be a wasteland and afterthought.
It's a purely regulatory solution, though, not technical as the top level comment suggested :)
So you couldn't select 18-25 recently-single white female within 50km as a target category (or whatever else you come up with).
I think GDPR may already forbid such use (without consent), though the implementation is tricky.
Yes it is quite some work and overhead, but you are extracting information and use it in a way the person could not foresee or conceptualize even exists within the data.
I gave up on trying to maintain forks of web browsers, because their extension API deliberately doesn't allow modifying response bodies. It's just impossible to maintain any fork of any browser because of the sheer amount of features that rely on JS APIs for websites and the amount of commits upstream.
Ad Blockers are just a dirty hack that completely relies on Chromium respecting the Content-Security-Policy headers for all domains. If Google decides to blocklist their own domains for HTTP header modifications, we're fucked. Quite literally.
That's the reason why I kinda started to build my own browser (without a rendering engine for now) that focusses on filtering, parsing, and peer-to-peer offloading traffic and sees itself as a mixture between web browser, scraper and proxy that can be used as a cache for others. It has the idea to act as a web filter service + a webview to render its UI rather than being a render engine and document engine. [1]
I hope that with this market niche there's a way to make this kind of effort sustainable for the future, because all other web browser fork projects I've seen so far are dying off due to no funding and too much work to maintain the codebase.
It's just not feasible to compete in the everday user's browser market. Lots of companies have tried, and lots of companies have failed.
[1] https://github.com/tholian-network/stealth
Edit: Clarification of Chrome vs. libchromium
I mean, you could just stop using Chrome if this happened, if you haven’t already. All the other popular browsers would be unaffected, and I’m sure projects like ungoogled-chromium would patch a change like that out.
Also all the other popular Browsers are either based on Chromium or based on Gecko, an engine that has no developers anymore since last year.
When I wrote about sustainability, that's exactly what I was talking about.
There are still more than a hundred developers working on Gecko.
Because I think there's a difference in assumption vs reality here. External contributors work in their free time and are, as I'm trying to point out in my other comment, unsustainable as a work model [1] [2]
[1] https://hg.mozilla.org/mozilla-central/graph/06b1ac14775250a...
[2] https://github.com/mozilla/gecko-dev/graphs/contributors
The Gecko is drowning.
What we need is a social movement with funding for Adblock work and outreach. The entire advertising industry is a house of cards waiting to fall. Someone with a grudge and the money to back such a movement could singlehandedly wipe out the revenue of places like Google, Facebook, and most of traditional and print media in a year or two. A couple million in investment could wipe hundreds of billions of dollars in revenue out.
The web is built around the model that websites can create a session with remembered state (well ever since cookies were invented). You can't have that feature without also trusting the website with that shared state.
At least not with the level 9f interactivity expected. Maybe lynx could manage it, but you'll never get all the side channels out of an attack surface the size of a modern html5 browser.
But until then, please developers stop putting the damn shopping cart in cookies and local-state, just persist it on your damn DB and only allow me to have a cart after creating an account with you. That is your damn consent for you to track me, not your stupid GDPR popup that you spam me and every other visitor to your site.
I don't know, it's just a random thought and not fully fleshed out. I'm sure there are millions of much smarter individuals than me that could figure out the details and nuance. Point is that we need to think outside the box if we are to fix the web. But doing it incrementally with "input" from ad-companies such as google is not going to work.
The most should be a consent popup, similar to how websites request to use the camera.
/s
There is plenty wrong. Even Adam Smith's purely theoretical concept of "free market" requires buyers and sellers to be purely rational actors and be fully and correctly informed.
Advertising has one goal: making customers less rational and more biased towards a given product.
FLoC enables ad selection without sharing the browsing behaviour of individual users.
FLoC provides a privacy-preserving mechanism for interest-based ad selection.
As a user moves around the web, their browser uses the FLoC algorithm to work out its "interest cohort", which will be the same for thousands of browsers with a similar recent browsing history. The browser recalculates its cohort periodically, on the user's device, without sharing individual browsing data with the browser vendor or anyone else.
That's just how "new" works.
They can handle some theft, but if literally everyone stole their candy, the store would close down and nobody can have candy.
Perhaps it is time for an advertising model to die out as the default.
I will not render your ads. I’d be happy to put that in the first http request to your site. If that means no site for me, then quite honestly 90% of my browsing is a waste of time anyway.
They encourage people to believe their self worth is linked to the things they own. That a persons status in society is somehow associated with how much money they have to spend.
Who's pretending? Ads naturally and quite effectively price-discriminate, and so they do make internet content cheaper for people with less money.
You may have problems with excessive consumption, but many people in developing countries do not. They desperately need the free content (educational, informative, and otherwise) that the current internet model provides them.
Well funded public broadcasters like Australia ABC provide news and entertainment content free. (both text and video)
Well funded public libraries can provide a wide range of alternate content.
While I love libraries and public broadcasting, I learned to code as a poor kid through library books, they are not the full solution and they never provided free, instant, and any time international communication for people.
Also, the store isn't freakishly stalking me and noting down all my habits whilst sharing what it has collected with its friends, or indeed anyone who will buy the data.
Besides, candy is impossible to replicate in the same way that data is. Theft of physical objects is a materially different act from advert blocking and avoidance. I'm not obligated to view adverts in every public space because they fund the local government. I'm not denied access to the cinema because I arrive 10 minutes after the start time to avoid the adverts. Or back in the day when I taped TV shows and fast-forwarded the adverts, had I a responsibility to view them?
They're useless noise that contribute no value to anyone beyond whoever pays for them, and therefore I find it a moral responsibility to limit my exposure to them and restrain the harm they do to others. And curiously, I am much more content and much less impulsive in my spending habits since I installed uBlock.
Many retail stores do, actually, through wireless tracking, cameras, and/or purchase history. They will buy and sell consumer data through the likes of Acxiom.
It would be great to have a ublock equivalent for the physical world.
No one is under any obligation to accept advertising. Only since the modern web have advertisers and content providers made this an argument on ethics.
We could all go around in circles like this for hours.
I'm not really sure what crowd of us you think claims that ad-blocking is "morally responsible". I certainly don't see it as a moral issue at all. I just don't want so see ads, period. I think they're psychologically manipulative garbage, and I don't want them in front of my eyes, infecting my brain.
If someone wants to publish something behind a paywall, I'll pay if I think it's worth the price. If someone wants to put up an ad-blocker-blocker and refuse to serve that content to me, that's fine too; I'll live without their content.
If a server is going to send me bits over the wire, I am going to decide how I view those bits, and which bits I do and do not want to see.
It's a bad metaphor, a better metaphor would be reading a journal and covering ads with post it notes.
Nobody frames, say, taking a bathroom break when the ads play during a football game this way.
One might argue that you are then not entitled to view the content on ad-supported pages as well.
I use an ad blocker too because many ads are just horribly intrusive, but I honestly can’t blame any page circumventing ad blockers, nor do I believe that I am somehow morally entitled to an ad-free, compensation-free browsing experience.
Narrowing all of this down to CPU time misses the point entirely in my opinion.
> They're useless noise that contribute no value to anyone beyond whoever pays for them, and therefore I find it a moral responsibility to limit my exposure to them and restrain the harm they do to others.
They‘re literally paying for the content you get to view for free.
This is true, and websites are entitled to try to detect and block users who use adblockers. And users are entitled to use better adblockers that are harder to detect.
Then they shouldn't serve the page in a way that it can be viewed without also viewing the ads. Ad-blocker-blockers are a thing, and I am happy to close that tab and never visit the site again when I see one.
> They‘re literally paying for the content you get to view for free.
Hopefully someday they'll be forced to find a business model that doesn't include destroying the privacy of their website's visitors.
I suggest you are incorrect to assert that "no one is entitled to my CPU time." I agree, however, that advertisers do not have that moral claim right.
> I suggest you are incorrect to assert that "no one is entitled to my CPU time."
Very well, please elaborate. I'm always up to delve deeper into reason and philosophy (time-permitting of course).
I'll start with ~~a humorous point for an autistic person~~ the worst kind of pedantry. An object cannot be no one's and mine at the same time. If I own it, then it isn't no one's. To the degree the CPU is indeed yours, then it is someone's CPU. Obviously, there's some conversational implicature embedded in your claim here, and that's what we're here to clarify.
For the record, I'm on your side. Your overall argument is something everyone needs to hear. So, I'm not here to destroy your assertion, but I think it should be weakened. There's a lot packed in there.
I take your proposition to mean, roughly, that the CPU in your possession is something only you have a cluster of moral claim rights to (which corresponds to a cluster of moral obligations of others to you regarding that CPU), with no possibility of overriding reasons, caveats, or provisos. Now, you could be speaking about political claim rights, but I don't think that's the case here (correct me if I'm wrong). Is that a fair interpretation, and do you wish to maintain that? Can you think of any exceptions? Are there any adjacent possible worlds in which that is not the case?
These reductionist approaches don‘t really help with understanding ads (and communication in general).
However, I do run an ad blocker and I'm completely fine if every company that relies on ads for income goes out of business. In fact, I'd appreciate it.
If websites really find that ad blockers are killing their revenue, they will switch to a paywall model, and maybe micropayments will finally happen (or perhaps a service that allows users to subscribe to large numbers of websites at a time). Whether or not that is a good thing depends on who you ask.
Websites can move to more efficient and lighter methods of delivery to cover the absence of advertising revenue. Anyone skilled who works in the advertising industry is freed to offer his skills to better human endeavours. Everyone wins.
With harmful incentives removed, this would encourage websites to focus on good writing and less on being 'content farms' to drive up engagement for the advertisers.
All I want from most sites is the text. Not adverts, trackers and those damnable autoplaying videos that jump out and follow me down the page. I use the reader mode in most cases. Why is it necessary to use reader mode if not to cut the useless cruft? Why can't the web just be like that?
I don't want to be rude, but won't they just end up losing their livelihoods? If the advertising industry goes, most programmers will see their salaries drop hugely. Even those not working in advertising will see a drop due to the flood of supply.
(I do think advertising is net positive and prohibiting it would be a bad idea: https://www.jefftk.com/p/effect-of-advertising)
Consumer habits will just become more unpredictable- and small companies could compete with big companies that spend billions on marketing.
Even if you were not directly influenced by advertising, you probably were indirectly through word of mouth.
If blog or similar can finance part of their cost with Ad's, why not.
Sure on slow internet it's a somewhat different matter.
Anyway Ad's okay, but tracking for me is spying and should be treated like that, i.e. it should be illegal.
There are ways to have personalized ads without it, like local learning which then selects to get an add for a specific topic, with that a side could still track which ads you got, but it would be much less useful as FLoC, and then you add additional steps to even further decrees any chance of tracking.
Companies still get implicit feedback by what adds get selected more then others.
People can explicitly blacklist annoying (or offensive) adds making sure they don't see them ever again and if enough do so in turn making that app not seen much more at all etc. etc.
But the FLoC cohorts are WAY to small/identifiying to not allow you to be tracked fairly easy with it. Just combine it with other identifying aspects of browsers (there are a lot) and I wouldn't be surprised if it's often allows a 100% unique identification.
And given that you likely wont be able to "ad-block" FLoC this makes it way worse then the status quo.
Yeah, in that world, ads would be ok with me. Sure they're pointless because I won't click on them - but not really worse than having a blank spot in the page because of an ad blocker.
While I have no problem with the concept itself of advertising, I do have a problem with modern implementations of ads. Almost invariably, they are loud (vocally and visually), intrusive, obnoxious and almost coercive in their use of language. They are intended to dumb down the target audience, rather than enrich their targets' lives.
I do have a problem with everything that attacks my ability to think freely.
It's fair to believe that ads are 'ok' - it's also possible that people in general don't want them. Hosting low-traffic websites on a smartphone with cellular data is just-about-feasible now.
Rather than inventing very technically clever ways to continue on our existing path, as Apple and Google are doing, I think it'd be pleasant to simply move beyond the advertising model of content on the internet.
If asked, I don't believe people would want to be tracked or have ads mixed into their content.
Could we make it cheap enough to host a personal blog and/or wiki on a smartphone for, say, $10 a year?
The economics would be very different as sites scale up their traffic (compare with, for example, The New York Times).
I think the (relatively) small number of high-traffic sites would be able to find revenue streams to support their hosting - perhaps those would be where subscriptions would be effective.
This may of may not be good, but I’m a bit concerned that destroying the adtech industry may have ripple effects that end up being worse than some middle way like FLoC
A choice of least worst is not necessary.
You have no idea how hard people work. Ad browsing pays the same no matter how hard people are working.
That just seems like hyperbole actually, and from a biased opinion or vested interest.
Brave seems to handle privacy very well considering the choices available, and has made a number of good privacy decisions from what I can see after watching browsers evolve for 25 years. I have switched to using Brave and installing it for those I support.
The crypto thing is 1) easy to turn off, 2) an attempt at a possibly better business model where users aren't just sold with it. Regardless I simply turn the crypto setting off.
There’s over a million web creators accepting bat just from brave [1] and while that’s not everyone or even a big percentage it’s not “few web creators.” If you don’t want to give to web creators you’re free to cash out and donate cash to charities. So that’s a plus that’s not possible with other browsers.
Note, I don’t use the crypto feature in brave, I’m just annoyed by people spreading FUD about stuff.
[0] https://www.coinbase.com/price/basic-attention-token [1] https://batgrowth.com/
I’ve never done anything with the crypto part. I just use them as a clean, ad-free browsing experience. There’s ad blockers for other browsers but brave is the easiest for me to use.
where is the better part? is it the fact that this makes fingerprinting easier? or that floc makes more data available to advertisers than cookies?
It says it's about respecting the privacy of users better but in practice it fails very bad at doing so the only thing it archives is allowing Google to disable cookie based tracking and with that makes it harder for 3rd party trackers to be google independent (it not harder for 3rd party trackers if they use/abuse the FLoC Id and generay there are many ways to track users which are not cookie based so especially when it comes to the very bad offender of invasive tracking it doesn't make a difference or becomes even easier, but some of the smaller google ad (and analytic) alternatives will have it harder).
This sounded good when I first heard it, but by now I understand 'relevant' to mean 'tailored to optimally influence my behaviour', eg showing me articles about the futility of voting if my political preferences are likely to lean a particular way.
I really have enough projects, TODO lists, interesting things to buy to last for lifetime of 250 years.
Why I would want ads likely to influence me? There is basically no chance that ad will show me useful, worth using object or service to buy that I would not discover anyway.
It would be just another scam more effectively targeting me.
One day, you may have a need for a product, and someone who previously solved your need can’t afford to make the product anymore because only a small percentage of people realized it was a solved problem.
But overall risk of getting persuaded to buy worthless products or scammy "investments" seems to not be worth discovering real gems.
Overall I would prefer both scams and genuine offers to be as far as away from my interests as possible.
Obviously, I would prefer actually useful offers to be close to my interests and to have no scams/worthless trash/malware/porno in my ads, but it appears to not be an available option.
I've never had this experience, between Google, Facebook, and Amazon. Every "targeted" ad I've been exposed to has either been for something I already have, or for something that's insufficient to my needs.
Because of this, and because I dislike the invasiveness and anti-privacy of modern advertising, I started keeping a log of all of the ads I can remember. Then before I make a purchase, I lookup the product on that list and pick a different company to buy from. If you, as a company, use invasive advertising, I will not be your customer.
What do you mean irrelevant data? I am much better at choosing a product that suits my needs than Google and friends are. The only irrelevant data is the one provided by the ad companies.
> the company that paid for the advertisement likely won’t even miss your sale.
If that's true, then why do you think they advertised to me? Why would they possibly choose to advertise to people who they weren't interested in selling to?
This would all be ok if the tradeoff was a strong signal to the seller that advertising has a negative impact on sales, but I’m positing that the impact of that one sale is negligible and well within the noise threshold of an extremely noisy process. For all you know, if the seller notices at all, they might conclude that they didn’t advertise to you enough.
However I’m totally ignoring any utility you might gain from a principled approach and if it works for you, then more power to you.
Very true, I've considered this many times. What it comes down to is that I value companies that prioritize investing in their product rather than their advertising, so on the whole I'm more likely to get what I want if I stay away from products advertised to me.
> This would all be ok if the tradeoff was a strong signal to the seller that advertising has a negative impact on sales, but I’m positing that the impact of that one sale is negligible and well within the noise threshold of an extremely noisy process. For all you know, if the seller notices at all, they might conclude that they didn’t advertise to you enough.
This argument kind of ignores the whole underpinning of economics. Let's consider a different situation and apply your argument. Let's say a company sells a toothbrush that doesn't clear plaque away very well. Over time, as I use this toothbrush, I'll find that I'm getting cavities on my back teeth. So I stop buying that brand of toothbrush. Under your argument, my doing that would be a weak signal, because it's just one sale lost for X dollars spent on advertising. The seller doesn't notice, and keeps on pumping out toothbrushes, and lots of people get lots of cavities. I know this is not analogous to the situation you're talking about, but it's still a plausible situation, and if your argument is correct, it should be correct across most situations it's applicable to.
And thanks, I do enjoy your confirmation of my power.
Advertising is psychological manipulation at its worst, and we'd all be much better off without it.
Hyperbole is unbecoming.
Off the top of my head I'd say grooming someone for sexual abuse is a significantly worse form of psychological manipulation. I speak from having experienced both, and only one has had a catastrophic effect on my life.
But in reality, ads are always "relevant to seller/advertiser". Seller is almost never interested in selling you anything but what makes most profit from you. Eg. A decathlon might be better cost/benefit ratio wise, but you will always get an ad for Nike, because Nike is paying for the ad, not decathlon.
Such is the lie that was fed to us, and most of us accepted it. Tragedy of the commons indeed.
A philosophy blog is the first thing that comes to find but even then that can have ads for universities, textbooks, quirky t-shirts, etc.
Who knew that ship designers could buy special plugins for CAD environments? Even though I could have guessed it (In fact, I made this example up), it’s still fun and interesting to be surprised.
It's pretty obvious Apple doesn't have financially valuable properties on the web but they have plenty in their application ecosystem.
In Apple's view Apple News is how people consume news, not go to the web where the user experience isn't custom tailored by Apple. Apple News is barely different than Google AMP that everyone rages against, try to get someone to share a link to a piece of news from Apple News and it will come with the ask to subscribe or download it.
So in Apple's ideal plan almost every place where today ads are displayed will be inside Apple News.
And hey, I wasn't aware there exist another App Store where people can buy applications or in-app purchases on iOS.
And yeah you can turn FLoC off too both today and when it will be in production.
Lastly, when did the argument move from "advertising bad, tracking data always bad, targeted advertising terrible" to "if Apple does it then I'm good with it"?
when did the argument move from "advertising bad, tracking data always bad, targeted advertising terrible" to "if Apple does it then I'm good with it"?
It'd be a lot cooler if you could respond to my actual argument without namecalling and putting words in my mouth. For one thing, it's rude; for another, it doesn't contain much of a counter-argument.
You said the distinction between what Apple does and Google does is 'thin'. The distinction is Apple does this in two specific services of their own, one of which is completely optional and in both cases, the cohort bucketing and tracking can be turned off. Google is putting it in the browser people use to do just about everything on the internet. A roughly similar thing would be Apple adding cohort bucketing to Safari. They haven't. These seem, to me at least, some significant distinctions. Why do you think they aren't?
So your argument is maybe valid (I don't think so, tracking is tracking and this isn't just contextual targeting) only now, as time goes by and Apple accumulates more power your argument is back to being invalid again.
I have an Android phone: I use a non Google browser, non Google app store and non Google messaging app.
This shouldn't exist in your operating system at all.
But yes, looking at ads on the Google Play Store recently tells me I made the right decision to switch to an iPhone.
But - if the regular, more accurate/personalized, mechanisms work in Chromium - why use the less-accurate ones?
2. The more accurate ones are going away.
[1] https://ai.googleblog.com/2017/04/federated-learning-collabo...
There isn't really any hard bound on how much information could be leaked via these algorithms.
> There isn't really any hard bound on how much information could be leaked via these algorithms.
With ~33k cohorts, there is literally a hard bound of just above 15 bits per visit. That's still theoretically a lot if you have some other stable identifier, but practically speaking most users on most sites will have an identical cohort and it will drop off rapidly as cohorts stabilize into groups appropriate for ad targeting.
Barring the other considerations I've mentioned in the comments here, that's still immeasurably better for individual privacy than ~infinite bits per visit from stable third-party cookies.
Nevertheless it seems a formidable addition to a browser user fingerprint.
Which reality is better is up for debate but they won’t be doing both for the same client.
Fingerprinting already slows down websites, and websites still use it extensively. The cost is paid by the users and nobody cares enough to fix it.
"This API democratizes access to some information about an individual's general browsing history (and thus, general interests) to any site that opts into it. This is in contrast to today's world, in which cookies or other tracking techniques may be used to collate someone's browsing activity across many sites."
Can the user detemrine whether a site has opted in without sending an HTTP request the site (and thereby recording the access in her browsing history).
"Sites that know a person's PII (e.g., when people sign in using their email address) could record and reveal their cohort. This means that information about an individual's interests may eventually become public.
"As such, there will be people for whom providing this information in exchange for funding the web ecosystem is an unacceptable trade-off. Whether the browser sends a real FLoC or a random one is user controllable."
Can advertisers determine whether a FLoC sent is real or random.
I can imagine some FLoCs if sent would trigger ads that were undesirable, perhaps damaging to the user's reputation, embarassing, etc.
As described, this system compels users to accept targeted advertising (what Google and Facebook want every user to do). There is no opt-out. There is no such thing as non-targeted ads. Users of browsers that support FLoC can either send real FLoC or random FLoC, but they cannot send no FLoC. If they choose randomised FLoC, they might receive ads targeted to cohorts with which they do not want to be identified. As the next paragraph states, the FLoC when compbinaed with other data can indeed be used as an user identifier. Choosing "randomised FLoC" might mean being publicly identified with undesirable cohorts. For example, IP address might become associated with an undesirable cohort.
"A cohort could be used as a user identifier. It may not have enough bits of information to individually identify someone, but in combination with other information (such as an IP address), it might."
"The expectation is that the user's FLoC will be updated over time, so that it continues to have advertising utility. The privacy impacts of this need to be taken into consideration. For instance, multiple FLoC samples means that more information about a user's browsing history is revealed over time."
"Second, if cohorts can be used for tracking, then having more interest cohort samples for a user will make it easier to reidentify them on other sites that have observed the same sequence of cohorts for a user."
"A cohort might reveal sensitive information."
"Some people are sensitive to categories that others are not, and there is no globally accepted notion of sensitive categories."
"It should be clear that FLoC will never be able to prevent all misuse. There will be categories that are sensitive in contexts that weren't predicted."
"A site should be able to declare that it does not want to be included in the user's list of sites for cohort calculation. This can be accomplished via a new interest-cohort permissions policy. This policy will be default allow."
Default is no privacy. Nice.
"... a site can opt out of all FLoC cohort calculation by sending the HTTP response header:
Permissions-Policy: interest-cohort=()"
Proxy config:
http-response add-header Permissions-Policy "interest-cohort()"
"We will analyze the resulting cohorts for correlations between cohort and sensitive categories, including the prohibited categories defined here. This analysis is designed to protect user privacy by evaluating only whether a cohort may be sensitive, in the abstract, without learning why it is sensitive, i.e., without computing or otherwise inferring specific sensitive categories that may be associated with that cohort. Cohorts that reveal sensitive categories will be blocked or the clustering algorithm will be reconfigured to reduce the correlation."
Well, this appears to negate the claim that no browsing history is sent to the browser vendor. To conduct experiments and develop this system, Google needs to collect and process user browsing histories.
Why? I would expect a browser extension to be able to override document.interestCohort to throw an exception?
(Disclosure: I work at Google, speaking only for myself)
If that's an actual way to access it, "undefined" will have to be acceptable due to browsers that don't support it.
And undefined would still have to be handled anyway, as browsers without support wouldn't have the attribute at all (at least for several years after it was accepted, for everything to get the new feature).
The explainer indicates it's a Promise: "cohort = await document.interestCohort()" -- https://github.com/WICG/floc
One reason to make it async could be to give browsers the option to gate access behind a permissions prompt in some circumstances.
> And undefined would still have to be handled anyway, as browsers without support wouldn't have the attribute at all
Definitely. There are also browsers that are unlikely to add support (ex: Brave, as we're discussing)
For example if I visit a website that follows trends in computer hardware... advertisers may pay to put ads in this site to PC parts, etc. If I visit a site about popular camping locations.. advertisers can purchase ads that are relevant to camping,gear, travel etc.
The very idea that we need a tracking identity that monitors and identifies behavior from site to site is ridiculous.
If you get rid of user tracking, anyone or their brother can sell ads, and then why deal with Google?
That's what makes me wary of the whole Chromium fork concept. Every time Brave/Vivaldi/Edge/etc decide to take a different path from Google's they effectively add to their maintenance burden forever, even if like in this case they actually disable an unwanted feature.
How long until the list of patches to backport for every new version of Chromium becomes so large that they have to pick and choose which one to keep maintaining and which one to give up on? If tomorrow Google decides to push a very deep change to the way, say, extensions are handled that makes them less effective at ad blocking, will Brave accept the burden to suddenly have to maintain a very deep fork of the browser in order to maintain old functionality?
I'm effectively FUDing right now, but my concern is genuine. I'm very perplex that you can make an effectively anti-ad, pro-privacy browser based on the source code of one of the biggest ad companies in the world.
It's not zero effort, but pretty easy.
https://github.com/brave/brave-browser/wiki/Deviations-from-...
We have a pretty comprehensive patching system which you can read more about here: https://github.com/brave/brave-browser/wiki/Patching-Chromiu...
There is a small team of folks here constantly working on rebasing the next Chromium version on Brave. They fight these deviations and try to minimize the patching as much as possible- so future versions are easier and easier. We even have some clever UI patching for the Polymer pages
There definitely have been challenges - for example, with Chromium 69, the network delegates were moved over to NetworkService which broke our shields code. But I'm really proud of the work done to minimize things. For a long time, the team rebasing Chromium was just one person... and we've always delivered Chromium upgrades and updates to Brave users within 24-48 hours of Google's stable channel
document.interestCohort
Why? Because they just hate advertising. The whole "third party cookies are bad" thing has always been a sham: it was never about privacy. It's always been about killing advertising itself.
We had advertising before invasive tracking. The ad business can survive without tracking, they just don’t want to.
You misunderstand - Google is in the business of compromising your privacy. They have lots of teams of lots of very smart people figuring out how to compromise your privacy.
Further, they are in the real world business of doing it. They are not naïve as your comment was - they find the balance of how far they can push it, by a combination of monopoly power, and also cunning politics, PR and posturing - they are fighting tooth and nail and using every tactic and trick in the business, with an unlimited budget - specifically to compromise your privacy for their financial and political power gain. Any area where they 'seemingly' back away from compromising your privacy, is where they have done extensive cost benefit analysis, and come up with alternative trickier or less understood ways to get what they want but that is more politically acceptable.
This is the underlaying reality - the rest of the details of FLoC etc is an information battleground where you as a user are fighting unlimited budget teams that are highly motivated to exploit your privacy. Advertising is in fact just one slice of the power they wield by exploiting your privacy along with everyone else on the planet's.
If you try to look at just FLoC in isolation you will miss the forest for the trees, as the results of FLoC are correlated with many other sources of information.
FLoC's motivations are some balance of:
- reducing PR fallout due to increasing awareness of their exploitation of everyone's privacy
- keeping full access to information they already extract from you and everyone else, and in fact increasing it as possible
- reducing or hindering other parties access to the total information so they gain more relative power
The rest my dear chap is details and their teams and teams of analysts working on this have all day every year to outsmart you in the details of how this is implemented.
fetch("mycompany.com/" + mycompanyUsername + "/" + (await document.interestCohort()));
No one wants to consent to being spied on, so FLoC is circumnavigating the GDPR consent requirements, letting them spy on all Chrome-users without consent.
Your FLOC cohort is a summary of your web browsing activity. FLOC doesn't solve the privacy problems that trackers create - it just hands them your browsing history on a silver platter.
"Yes! You are unique among the 3387629 fingerprints in our entire dataset."
Browser fingerprinting already works fine without FLoC.
With Safari on macOS I get a score of ~1/8500. Not amazing, but certainly not catastrophic.
Id gladly pay for my content just to watch the ad-tech industry die, its not just about "ads", they are building the infrastructure for the surveillance police state.
But why?
> they are building the infrastructure for the surveillance police state.
But FLoC is explicitly about doing ads in a way that does not lead to a "surveillance police state". So why is it bad?
The bottom line is that you are giving them your browsing data, obfuscated by fancy algorithms. Unless you trust ad-tech to have the best interests about your privacy (ha!)
Because it effectively exposes your browsing history. If privacy is a concern that's not something you want.
Yeah, working on it.
> "But fingerprinting!" is yet another pretext for just trying to make advertising in general non-viable for aesthetic or ideological reasons.
It isn’t though.
Not sure why it is supposed to be significant improvement.
"FLoC cohorts will comprise thousands of users each, so a cohort ID alone shouldn’t distinguish you from a few thousand other people like you. However [a tracker now] only has to distinguish your browser from a few thousand others (rather than a few hundred million). In information theoretic terms, FLoC cohorts will contain several bits of entropy—up to 8 bits, in Google’s proof of concept trial. This information is even more potent given that it is unlikely to be correlated with other information that the browser exposes. This will make it much easier for trackers to put together a unique fingerprint for FLoC users."
"as your FLoC cohort will update over time, sites that can identify you in other ways will also be able to track how your browsing changes [...] a FLoC cohort is nothing more, and nothing less, than a summary of your recent browsing activity."
https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...
So to be clear, "Big Ad" is like, dentsu, Publicis, Omnicom, etc. Companies that don't show up on HN much (but do ultimately buy the services which pay a ton of HNer's salaries).
They don't like Google very much, but Google owns a ton of space to put ads on, lots of first-party traffic with interesting properties, and more accurate targeting models than most other companies combined. So they have to work together. Real Big Ad would all rather keep the third-party cookie and not have to deal with FLoC, because they know they're already trapped in dealing with Google based on market demands, and FLoC will give Google even more forceful technical leverage.
If you view the market through only this lens it becomes very easy for partisan interests (e.g. Brave, just as much an advertising company as Google) to trick you. Google is notable for how disintegrated it is from the rest of the ad business, between its technology monopolies and vertical integrations.
Cohort membership changes pretty frequently instead. So the system may put all people that browse mostly golf sites together in cohort 12345 that only the algorithm knows it's about golf sites, people enter and leave that cohort on a daily basis and you can only be a member of a single cohort at a time.
Also, even if I take for granted that everyone's cohort changes daily, how does that imply anonymity? Like say my habit is that I check emails a ton on Monday, go on YouTube on Saturday, read the news on Sunday, etc... so my habits are changing daily, okay, but not weekly, right? Or maybe I do them in a different order on another week, but I'm not going to develop 1000 different habits across 1000 days, right? Shouldn't some kind of frequency analysis provide fairly consistent results?
"as your FLoC cohort will update over time, sites that can identify you in other ways will also be able to track how your browsing changes [...] a FLoC cohort is nothing more, and nothing less, than a summary of your recent browsing activity."
https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...
There needs to exist a way to identify you in other ways and in the future cookies won't be one of those. So a site that has your information because you shared it with them will be able to see your cohort changing, otherwise you'll look like a new user each time.
And yeah I'm extremely familiar with FLoC, more so than the EFF.
this itself is already unwanted
> otherwise you'll look like a new user each time.
but you won’t, because the existence of a non-fingerprinting-based solution isn’t going to stop fingerprinting.
But IP alone is imperfect as well anyway for tracking.
If FLoC goes as they plan, there will be less tracking overall, but the tracking there is will be considerably more centralized, less technically transparent, and cement incumbent market advantages. (All totally coincidental unfortunate side-effects of Google's concern for your privacy.)
It is available to everyone:
cohort = await document.interestCohort();
(Disclosure: I work for Google, speaking only for myself)
What do you mean, create your own?
It's only being introduced because they're afraid of regulation.
--enable-blink-features=InterestCohortAPI --enable-features="FederatedLearningOfCohorts:update_interval/10s/minimum_history_domain_size_required/1,FlocIdSortingLshBasedComputation,InterestCohortFeaturePolicy"
Contextual advertising. Flip the entire thing upside down and let the sites declare to the advertisers what niche they fill, and let them get relevant advertisements.
Brave is a really, really great alternative to Chrome. I started using it about a year ago, and it is pretty much Chrome, with less ads and spyware in it. Great software.
You can do this by just setting up a new profile and visiting various pages, then checking what the FLoC ID is. See here for an example by Jonathan Foote: https://twitter.com/footePGH/status/1380568421490905088
It's based on your browsing history, so companies will now be able to get an aggregate of your interests without having to actually track you across other sites.
Content creators are not entitled to decide what ads I choose to see and not see.
When they serve content with ads, they are not demanding anything.
It's a particularly granular one, as well, placing users into manageable cohorts of only a few dozen thousands in size, or so is claimed.
Combine FLoC with a handful of other fingerprint bits and you can track an individual.
I don't see any other way and I can't see what these people at EFF are arguing for? It's easy to just keep saying no to everything.
To my knowledge, it's not yet available as a public web API.
>document.interestCohort()
>VM131:1 Uncaught TypeError: document.interestCohort is not a function at <anonymous>:1:10
"At Vivaldi, we are committed to protecting our users from online trackers, and we would not want to enable any kind of user behavioural profiling. The FLoC experiment does not work in Vivaldi, because it relies on several hidden preferences being set, and we do not enable these options in Vivaldi. Our future plan is to prevent the Floc component from functioning, no matter which way it is implemented."
Is this about users who are not logged into google? Is this to share information with vendors such as WPP? What is the point of this?
Federated Learning of Cohorts - Version: 1.0.6
Chrome : 89.0.4389.116 (Official Build) (64-bit)--disable-blink-features=InterestCohortAPI,InterestCohortFeaturePolicy
It's already happened with facebook targeting[0], imagine how much more specific the information at Google is.
[0]: https://medium.com/@MichaelH_3009/sniper-targeting-on-facebo...
> Brave is a free and open-source web browser developed by Brave Software, Inc. based on the Chromium web browser. It blocks ads and website trackers, and provides a way for users to send cryptocurrency contributions in the form of Basic Attention Tokens to websites and content creators along with the ability to keep the cryptocurrency they earned.
Quoting https://amifloced.org/ :
> Third-party cookies are the technology that powers much of the surveillance-advertising business today. But cookies are on their way out, and Google is trying to design a way for advertisers to keep targeting users based on their web browsing once cookies are gone. It's come up with FLoC.
> FLoC runs in your browser. It uses your browsing history from the past week to assign you to a group with other "similar" people around the world. Each group receives a label, called a FLoC ID, which is supposed to capture meaningful information about your habits and interests. FLoC then displays this label to everyone you interact with on the web.
FLoC stands for Federated Learning of Cohorts. The third party cookie is dying, and FLoC is a way for companies to group people together and track them, rather than tracking individuals. Here's more info about that [1] and here's an EFF article about why it's dangerous [2].
[0] https://brave.com/ [1] https://github.com/WICG/floc [2] https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...
Brave is an other ad network.
Company Overview & Core Offering
Brave is the first global digital ad platform built for privacy, offering advertisers the opportunity to participate in a premium, brand safe, and opt-in ad ecosystem, designed for a future without 3rd party cookies.
I run an online business. I depend on ads. I hate being tracked.
Here's the deal, Google is tracking you no matter what. Even if they aren't using your information for advertising, you still feed them all the best first party data in the world. You give them your search queries, emails, your phone location etc..
Your information is valuable. Even if you block online advertising, you are still going to be targeted in the real world the same way.
Facebook, yes they are shitty too, but again, they are fed all this information. Now, their information is 3rd party. They get pixel fires about you that allow them to coorelate data about you, but it isn't first part exactly.
In the advertising world you target the person or you target on page. The issue with on page is there just isn't enough content about a subject to target and frankly, just beacuse you read something, doesn't mean you are interested in buying it.
I don't care if it's a cookie, or FLoC, or what ever, people are going to be monitored, it's too large of a business. As an individual if you are afraid of it, you have the choice to use Brave or what ever. But at large scale, most people don't care. I believe that this tracking rhetoric is dangerous. At least we are having the conversation about tracking and allowing the people who don't want to be tracked to avoid it. If it were the inverse, these things would still happen behind closed doors, because it's extremely profitable.
Governements have been tracking people forever. Some choose to do evil, populations revolt. People can always beat governments.
Yes I am bias becuase my business does depend on paid advertising like many others. I understand the "big brother" effect. But I also know that other agencies (NSA/CIA) are already doing these things and are either forcing the tech companies to collect the data and share it or are willing to do it. The fact that we all focus on private companies being the crux of the problem and aren't focus on the 3 letter agencies.
Either way, we live in new uncertain times and the US economy has always been about consumerism. These ads have generated incredible amounts of wealth for indvidiaul companies and the tech companies. I do agree that Google makes too much money. As an advertiser, I know that their algorithm is essentially a black box and as an advertiser we are getting fucked. We have no real transparency that our bids are true. We are hoping to hit a CPA and just keep to it.
I can tell you that in the last 2 years, online advertising performance has dropped a lot. It's a combination of people having less money and our economy doing worse and there's a lot more competition. I suspect that these companies are inflating their bids artificially. We know that Facebook penalizes people it doesn't like but provides absolute no transparency on the system. These penalties also cost you more money - which is bullshit.
All of these companies have no support to contact and you are at the beck and whim of a 3rd world outsourced tech support agent that can't do anything.
To summerize. I agree tracking is bad. But you offer all of your data up every time you use email or a search engine. It's all collected and there is no better alterantive. At least these companies are providing a service for businesses to thrive. I think they make wayyyyy too much money. If you think disabling FLoC is going to stop anyting, you havn't looked at the big picture.
If people want to stop being tracked, get off the internet, don't use a search engine, don't use email. But that isn't practical. If you think any of these "Privacy Safe" companeis are doing anything other than just charging you and still handing your data over to what ever 3 letter agency requests it under an NSL, you're crazy.
True anonymity has no place on the clearnet. The sooner we come into acceptance with this fact, the better we'll be able to protect ourselves from this rigged game. [0]
Tor is the only place you can go to find anonymity. I agree, if your goal is not to be tracked, by any of the above adversaries, go offline. We tend to laugh at guys who attempt this and call them looney, but it won't be so funny in the not-so-far-away future given how communication tech is advancing at such a fast pace with things such as 5G and IoT. It's easy to see governments achieve total surveillance within the next half-century.
I also agree that not enough spotlight is shone on government's ability to coerce tech companies to hand over user data, whether live monitored or subpoena'd. These tech companies like to play-act all tough e.g Apple, but the reality is they apply for business licenses & other similar considerations from the govt. It wouldn't be far-fetched to deduce such favors esp ones that come with competitive advantage in an industry come with hidden strings attached. Am not surprised to see govts such as UK's brazenly attempt to put backdoors into encryption technologies. [1]
[0] https://www.washingtonpost.com/technology/2021/04/02/capitol... (LONG READ ALERT)
[1] https://www.wired.com/story/uk-trying-to-stop-facebook-end-t...
I think most people who are criticizing FLoC would challenge the idea that this class of functionality needs to or should exist at all.
All this FloC, third party cookies, etc. are efforts to make that advertisement route more efficient. So my question is what are the critics proposing instead? Get rid of ads and just ask the audience to pay per view or make everything a subscription? Not paying content creators (ad blocking) is certainly not a sustainable alternative.
Advertising was effective as an image or text that shows the reader a value proposition. What we have these days is stalkers and information rapists pretending to be advertisers.
Your daily paper didn't have a list of your interests yet succeeded in making money through advertising. Why can't they now?
Ad industry: "Look. We listened to your concerns about ad privacy. Here's a solution that gives you everything you want. Now we can serve interest-based ads without tracking you across the internet. You win."
Brave: "We don't want a solution. We want to be sanctimonious and angry!"
(Actually does nothing or the sort, continues tracking users while making user experience even worse and some crucial Web features unusable for indie devs.)
>Brave: "We don't want a solution. We want to be sanctimonious and angry!"
(Pushes "ad industry" out of the way and performs its own tracking and ads.)