tlibert

If a user has an "opt-out" button or signal it should be wired up to a system that functions as such. This is just a software engineering, you could vibe-code a fix in ten minutes.

If you read the report this is why I say network traffic with a Sec-GPC: 1 (GPC opt-out) should return a 451 automatically instead of a cookie, and how the Meta Pixel code can wrap a GPC conditional around execution. That's why they are terrified - fines don't matter, code does.

This is a phenomenally stressful day, I pissed of Google, Microsoft, and Meta in one shot, and they will come after me again. We do it because we believe in our product, and we'll stand the test anybody - even BigTech - puts us to: https://webxray.ai/

The report is specifically ads cookies and includes links to primary source disclosures on the websites of the companies mentioned. We did not count things like DDoS cookies, login tokens, and the like. We operate with unparalleled precision in our domain.

Hi, I'm Dr Tim Libert, founder of webXray who did this audit. Happy to answer questions from YC'ers. [Note, stepping away for some mental health exercise, stressful day!]

I also want to push back on Google telling the press our California Privacy Audit is "is based on a fundamental misunderstanding of how [Google's] products work".

I'm the former head of Cookie Compliance at Google and I have the federal court filings that show their statements are not simply true, and Google knows it isn't true.

For the record, here are direct quotes from a federal court filing made by Google's "Data Protection Officer and Senior Director of Privacy", who stated that "If called to testify as a witness, [they] could and would testify competently to such facts under oath."

Here are those facts:

* "Due to Dr. Libert’s academic background focusing on cookies, he became one of the primary members of the team assisting with Google’s cookie compliance and governance efforts..."

* "Dr. Libert quickly assumed responsibility for aiding our in-house regulatory lawyers in addressing governmental investigations into cookies..."

* "Dr. Libert often worked under the guidance of in-house counsel to develop technical solutions to issues raised by privacy regulators..."

* "Dr. Libert was also responsible for the development of internal policies on cookies and web storage. He drafted Google’s internal cookie guidelines in 2021 and early 2022, which applies to all cookies or cookies-like objects, and outlines processes on managing cookies, storing cookies, logging data associated with cookies, server protocols, policies on data collection, and data linkage..."

* "By developing the policy and conducting the audit, Dr. Libert gained insight into every Google-owned cookie deployed across Google’s web properties..."

* "Dr. Libert also proposed changes to how Google interprets specific definitions across its products’ various privacy policies. This included work on policies relating to analytics and advertising services used by third-party apps and websites..."

--

TLDR: Google can say what they want about me in public, but when they are under oath in a federal court of law, this is what they really say.

If politicians are incentivized to protect jobs that’s a good thing, no?

Next stop: telepathy.

“Sold as” != “proven as”

Arthur C Clark has addressed this general point in his first law:

“ When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.”

Yeah, those morons at NASA'S Advanced Propulsion Physics Laboratory sure have no idea what is a good use of their time.

To pseudo-quote quote Clay Shirky: nothing will work, everything might.

Correct, apologies for being cryptic.

Well, the weavers did fight back on their own behalf.

Clearly one of us has more faith in automation.

We all can eventually be replaced and should be careful what precedents we establish now. “First they came for the warehouse workers...”

Got locked out of Amazon account weeks ago, requires a phone call to fix. That tiny bit of friction has gotten me off my last few Amazon purchases and I’m grateful for it.

They’ve had nukes for a while, unfortunately this could be viewed as the patient approach.

Electoral results speak conclusively to their relatively small numbers.

Lots of luck in academia, he’s taking a risk at assistant level.

Money is to fund research, not personal use. Job security highly dependent on bringing in grants.

So out law web scrapping entirely?

I’ve had several such burritos when I lived in NYC.

Real Solutions (tm) are indeed nice, but hackers get shit done - this is an utterly shameless hack, and I do it myself.

Faculty member at a top-tier CS school. For most of the faculty where I am, an hourly consulting fee in the range of $500-1000 is reasonable. If you take the low-end of that range ($500) x 3 hours of class time per week ($1500) x 12 weeks of class you get $18,000 worth of expert time. Multiply that by three classes and you get $54k of value each semester, so even with non-trivial tuition it is still a pretty good deal. Likewise, FAANG et al recruit very heavily from our school so there is additional value-add.

I personally came from modest means and have a ton of outstanding student debt and was hesitant to go the faculty route precisely because I think the higher education in the US can be financially exploitative, but there are places where the high tuition is in fact a bargain based on market rates for the expertise. Likewise, nearly all faculty at top-tier CS schools can make way more in the private sector - we do this job because we really enjoy mentoring and work hard to make sure our students get the best education possible.

They initially approached me and I pitched an idea I thought they'd reject out of hand (an op-ed about tracking on the page you're reading). I thought they wouldn't get back to me after that, but they did, and they were wonderful to work with.

Otherwise, I don't think process has changed, it's mainly about personal contacts, being accessible, and taking the time to talk to people and explain the tech in a way the target audience understands. My rule is if a journalist doesn't understand my research it's because I'm not explaining it the right way. I get annoyed when academics complain journalists get their work wrong without making an effort to actually talk to any.

also, they came up with the awesome title!

I wrote the op-ed and I give the NYTime a huge amount of credit for publishing this. On more than one occasion I've had reporters at other major papers be interested in doing a story on my news privacy research and had had the stories killed by editors. The Times actually came to me to ask about doing this and were hugely supportive the entire time.

I've made this point on here before, but what HN readers take as common knowledge is still pretty confusing and opaque to most people. To my knowledge a major newspaper has never published something like this, so I give them a ton of credit as they just went from a subset of their readers knowing about this to potentially all of them.

Author here, happy to answer questions about the op-ed or the research. Hugely impressed the NYTimes let me do this!

He utterly mangled it, but there is an experiment which proves the underlying concept (which I'm guessing was his intent, live testimony is hard):

Bottomless Bowls: Why Visual Cues of Portion Size May Influence Intake

Objective: Using self‐refilling soup bowls, this study examined whether visual cues related to portion size can influence intake volume without altering either estimated intake or satiation.

Research Methods and Procedures: Fifty‐four participants (BMI, 17.3 to 36.0 kg/m2; 18 to 46 years of age) were recruited to participate in a study involving soup. The experiment was a between‐subject design with two visibility levels: 1) an accurate visual cue of a food portion (normal bowl) vs. 2) a biased visual cue (self‐refilling bowl). The soup apparatus was housed in a modified restaurant‐style table in which two of four bowls slowly and imperceptibly refilled as their contents were consumed. Outcomes included intake volume, intake estimation, consumption monitoring, and satiety.

Results: Participants who were unknowingly eating from self‐refilling bowls ate more soup [14.7 ± 8.4 vs. 8.5 ± 6.1 oz; F(1,52) = 8.99; p < 0.01] than those eating from normal soup bowls. However, despite consuming 73% more, they did not believe they had consumed more, nor did they perceive themselves as more sated than those eating from normal bowls. This was unaffected by BMI.

https://onlinelibrary.wiley.com/doi/full/10.1038/oby.2005.12