tlibert

I actually think if he was more transparent the piece would have been significantly better. For example, "At BoingBoing we rely on these systems as well. Why? The simple fact is we have virtually no alternatives to the adtech status-quo and our choice is either to participate in the system as it is or go out of business. This is why I'm calling on likeminded publishers to...". Instead he passes himself off in a disingenuous way, and people reading his words could reasonably assume that his own site was perhaps better, when in reality it far exceeds the mean for the amount of tracking on a website.

When I loaded the BoingBoing version of the article my browser contacted 53 third-party domains and a grand total of 373 cookies were set. The BoingBoing privacy policy does not mention "Do Not Track", usually a signal it is ignored, and it discloses nearly none of the third-parties. The cookie opt-out link goes to the NAI site which does not work on Safari because Safari won't allow the third-party cookies required to opt-out by the NAI. BoingBoing's privacy policy lists nine types of advertising, none of which are behavioral.

The author of this article, Cory Doctorow, is an editor of BoingBoing and has some level of control of this.

In contrast, I got zero tracking from the EFF site. Exact same content, completely different privacy experience.

I'm not an absolutist that you can't criticize a system you benefit from (it's ok to criticize Apple's labour practices if you own an iPhone), but there is a big difference between admitting participation in a flawed system and passing yourself off as an objective critic of a system you benefit from.

Doctorow knows where his paycheck comes from.

This is true!

This is a big hit in my household, and also has light-up keys so I can learn the songs my kid likes and play them on the big synths. Likewise, it takes a lot of physical abuse (getting dropped, a lot) and is fine. https://www.amazon.com/VTech-Record-and-Learn-KidiStudio/dp/...

I imagine for the generation brought up on an infinite supply of cracked VST waReZ getting ahold of a physical piece of gear, and being forced to focus on a single piece of kit with limitations, is a revelation. Volcas have the right price point to make that happen and the right balance of features/limitations to make it interesting.

I like it quite a bit but the tuning has gotten wonky, and very sensitive to cold. I've got low confidence it will be working in ten years time whereas my ~18 year-old Nord 3 is a rock.

The Korg Monologue is a brilliant piece of kit with the demo patches and microtunings done by Aphex Twin (who worked very closely with Takahashi on the development).

If you are interested in what a deep, respectful, and meaningful relationship looks like between artist/engineers, this interview is a must-read: https://warp.net/editorial/richard-d-james-speaks-to-tatsuya...

According to OpenSecrets [0] the "Communications/Electronics" sector spends significantly more than "Energy/Natural Resources" on lobbying. SV has a big presence in DC.

https://www.opensecrets.org/lobby/top.php?indexType=c&showYe...

I fully agree, but people are often capable of knowing something abstract is true in general (web is full of tracking), but often fail to make the cognitive step to apply those facts to the specific case (there is tracking on porn sites).

Nearly 20 years ago I worked as a Dell phone support technician for a few months and it was the best learning experience I've ever had in terms of understanding what the "average" person can actually comprehend. I think many technical people have experience with non-technical people who are otherwise fairly educated and clever (eg parents/grandparents), but there are a lot of people who have difficulty with the concepts, let alone the details. I think those people still deserve privacy.

Second-author here. Details are in the paper, but yes, Google Analytics is highly prevalent. Google doesn't allow porn sites to use their ad networks so we didn't find much Double-click, but it is fairly hypocritical to say "we won't show ads on porn sites" while also having no problem allowing porn sites to install your tracking software.

Second-author here. Thanks! One reason I initiated this research was trying to find ways to reach people who may be jaded about privacy. Sex usually wakes people up. :-)

Second author here, see replies above. TDLR: biggest reason to single out porn is what you view may reveal your sexual orientation, depending on where you live that can get you killed.

IP address is a very strong signal and short of Tor you cannot do much about that. I'm hesitant to recommend VPNs just due to the high level of trust you need to have in your provider. It isn't that easy to avoid tracking.

Second author here. The paper is written for a social-science audience (I'm the CS person, hence ACM template), so it is written that way to help get non-experts on board. Otherwise, there is ample research people don't understand how private browsing works, and there are plenty of ways to track people during privacy sessions. There are some very creative people working in adtech today and I don't doubt there are numerous methods that are being used to get around every single protection out there.

I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.

Second author here. Many people carry over 'real world' privacy expectations to online interactions, often unwittingly. While this may be technically naive, I don't think it is wrong for people to assume established social norms around sex and privacy, which have existed for millennia, are suddenly null and void b/c they go online. Porn stores in real life often have curtains, dark windows, etc. to protect privacy, and some people likely have that mental model ingrained, even if they do have a suspicion they are being tracked.

Second-author here, I have a few rebuttals to these points.

First, there is also a wider pattern in the US when it comes to privacy/computer legislation. We tend to have sectoral-focused laws which are often a response to media events, real and fictional. For example, Computer Fraud and Abuse Act was a response to the movie War Games. Video Privacy Protection Act was in response to a supreme court nominee's video rental history being leaked to the press. Children's Online Privacy Protection Act was partially spurned by concerted reporting (sometimes sensational) on risks to children online. So the pattern you are seeing is part of a larger system which often does produce real change, it is just a slow process. The press is called the "fourth estate" because they play an important part in the democratic process, which is what you are observing here.

Second, it is the very ubiquity of the systems these companies deploy which makes it possible to choose a given context (health, sex, etc) and find a privacy-violating technology. I'd love it if when I did these scans I turned up nothing, but the same set of bad actors are always to be found. Likewise, the definition of "well-known" on hacker news is far, far, far different from what a normal Internet user has any clue of. We have 20+ years of research showing people fundamentally don't understand this stuff, and just because you don't have a CS degree doesn't mean you don't have privacy rights.

Last, there is very good reason for outrage for many people. There are many places in the world you can be killed for being LGBTQ. Likewise, there are many state intelligence agencies that piggy-back on online tracking (see NSA/Doubleclick cookie), and some governments actively go after LGBTQ people. Even without state intel there is a long history of sexual data being leaked online. People killed themselves as a direct result of the Ashely Madison leak, and if any of these tracking companies porn sites - many of which do not have the security team of a FAANG - get hacked, people who are already marginalized by their societies may be at extreme risk.

A large chunk of the traffic is Google Analytics and various APIs, so even if you pay you will almost certainly be tracked by Google. Piracy obviously has its own risks.

Second author here, I'm busy for the next couple hours, but happy to AMA. Put any questions here and I will reply as I'm able.

I first read the declaration back in the 90's when it seemed possible. Over time we have slowly drifted away from the grand vision and we're now in a dark place. That said, when I get really down about the state of the net/www/privacy I pull up the declaration to remind myself of what can be and what to fight for.

Today I feel invigorated, and there is work to be done.

I've heard good things but haven't learned docker, I'll look into it. Thanks for the suggestion.

Would love help building the org_domain.json list, please get in touch!

it thought I was spamming b/c replying quickly.

whois, detective work, crunchbase...also do work in china which is even tougher: http://www.theguardian.com/technology/2015/sep/21/google-is-...

yes! from the api docs:

onResourceRequested

Introduced: PhantomJS 1.2

This callback is invoked when the page requests a resource. The first argument to the callback is the requestData metadata object. The second argument is the networkRequest object itself.

The requestData metadata object contains these properties:

id : the number of the requested resource method : http method url : the URL of the requested resource time : Date object containing the date of the request headers : list of http headers The networkRequest object contains these functions:

abort() : aborts the current network request. Aborting the current network request will invoke onResourceError callback. changeUrl(newUrl) : changes the current URL of the network request. By calling networkRequest.changeUrl(newUrl), we can change the request url to the new url. This is an excellent and only way to provide alternative implementation of a remote resource. (see Example-2) setHeader(key, value)

sorry, it doesn't monitor links, it captures network-level requests, that's what I analyze.

I use phantomjs because it can run headless and is low resource. the request data is processed in python though.

I do a lot of research, advocacy, and editorial work which is very critical of many powerful companies; I have to be sure there is no accidental impression I am "for" or "against" anybody or benefitting financially in any way from my research. that is actually why I changed it.

any sane person can see that releasing my intellectual property for free wasn't an evil scheme to make $.25 from digital ocean. ;-)

it monitors third-party HTTP requests, not links: "webXray is a tool for detecting third-party HTTP requests on large numbers of web pages and matching them to the companies which receive user data...The core of webXray is a python program which ingests addresses of webpages, passes them to the headless web browser PhantomJS, and parses requests in order to determine those which go to domains which are exogenous to the primary (or first-party) domain of the site. This data is then stored in MySQL for later analysis."

in 2015 I'm not sure there is much of a difference between the two. ;-)

yes, but I don't own a windows license so I can't test it. linux is free so I can.