Hacker News Reader

Comment by marvinblum | Hacker News Reader

As a website owner, you can opt out by setting the Permissions-Policy header to "interest-cohort=()". I rolled that out for pirsch.io today.

View on HN

Cmon, this is as backward as the "do not track" header... asking websites to explicitly opt out... in order to protect users from the users's own browser!?

No, just don't build stupid things into browsers.

Yeah, it's stupid, but the only option we have right now if the user does not disable FLoC in Chrome. We also honor the DNT header btw :)

Chrome users should just run a local proxy that inserts the header for them.

That is a good solution for corporate networks.

Chrome users should seriously reconsider switching to Firefox. We've created another Internet Explorer.

So, I was experimenting with this concept yesterday but couldn't get it to work...

How do you set up a local proxy to do this kind of stuff? I got up to the point of changing request/response headers but couldn't manage to actually edit the data going through, esp when dealing with ssl (which is the point really, of ssl).

mitmproxy

Let's say, Chrome has a bug that causes a crash unless you send Workaround-Chrome-Bug header. Why wouldn't you send the header until the bug is fixed in Chrome?

How is this situation in any way different?

Because the intent is the complete opposite, to add, not remove the bug... what else are they going to add, how many more headers are we going to end up with, what if the other browsers join in... this is not sustainable, but it's not supposed to be - they are betting on the fact that 99% of website owners will not even be aware of this issue let alone know how to configure their web server or be bothered to - it's purely for the purpose of saying "we allow you to opt out".

Saying "oh but we can thwart them with a header" is just naive, Google would like you to believe that. Look at the bigger picture.

How about sending random awkward cohorts to the browser ? If we are able to make targeted ads to be only about dildos and viagra, maybe we can increase Adblock usage drastically ? (While helping people with real erecting issues as a side effect)

If FLoC ever becomes standard in Chrome, I'm definitely going to search for a way to sabotage their statistics by giving fake or random data points.

Would it be viable to also add a pop-up asking users to toggle Chrome settings or use another browser? Something like Google has on its homepage for downloading Chrome when visiting from another browser.

I don't get it. Couldn't you also just... not record any cohort information that is sent to you? (Admittedly I have not looked very deeply into FLoC.)

GP seems to be misunderstanding how floc is implemented. If your site doesn't call document.interestCohort(), the site isn't factored into floc calculations.

https://news.ycombinator.com/item?id=26834624

Reply on news.ycombinator.com