4 ms·

So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google.

by r1ch 10y ago

iLoch 10y ago
To the people replying to this comment, he's not talking about the ads not being able to use the users location. Most don't. But plenty of ad networks don't work properly or the CPM is much lower for HTTPS enabled websites. I'm guessing r1ch is using a users' locations for his site, and it's ad supported. Hope everyone who is against ads is willing to pay for their content from now on!
- r1ch 10y ago
  Yes this was meant to be my point - I didn't even consider ads using gelocation (which explains the downvotes I guess :))). While we do use geolocation and ads on one of our sites, it's only a single page so this doesn't really affect us that much. I can see it causing big problems with ad-supported sites / services that use geolocation as a primary feature though as I've experienced first-hand the revenue drop that HTTPS causes.
- pdkl95 10y ago
  > he's not talking about the ads not being able to use the users location The reason for wanting the user's location doesn't matter. It's incredibly irresponsible to send the user's location (or any other user data) over the network unencrypted.
Brakenshire 10y ago
> So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google. Geolocation API is pretty powerful. It's one thing for a random website to know approximate location, but to be able to track location within 10m is something else.
- ry_ry 10y ago
  Perhaps a gentler interim solution would have been to only allow accuracy to town/city level over http.
  - poooogles 10y ago
    That's already mostly possible with geoip lookups.
    - ry_ry 10y ago
      Yeah, it's just the breaking changes thing - I like what Google are doing, and it's been alerted in the console for ages, but they're strong-arming it slightly. I'm weird, but it always grates slightly when companies throw their weight around - even if the endgame is a positive outcome. Plus the cynic in me assumes they have an advertising product in the works and this is facilitating it.
untog 10y ago
There is zero reason for an ad to be using the Geolocation API. IP-based geolocation is more than enough.
- coroutines 10y ago
  I hate to play Devil's Advocate but accuracy can be important. Geoip means they can serve me offers for businesses in the same city, but I'd [almost] love it if I were served offers for a taqueria down the street from my browsing location. More than likely they'll just correlate browsing habits with location and sell that information to third parties, though. High quality advertising is just not in this reality.
- cies 10y ago
  I'm sure advertising will find a use for it! Like "hyper-local ads" that can give you "just around the corner" deals in malls, etc. > There is zero reason for an ad to be using the Geolocation API. IP-based geolocation is more than enough. There was also zero reason for billboards by highways, before there were highways. :)
  - dexwiz 10y ago
    Location based advertising is powerful, but the issue here is privacy. We have no idea where that information is going.
  - untog 10y ago
    Advertising could find a use for my DNA profile but that doesn't mean they should have access to it. Obviously this is all a sliding scale and has nuance, but I'd say ads should not be using anything that is behind a permission prompt, like geolocation. Tremendously hostile to both the user and the site hosting their ad.
- poooogles 10y ago
  We have clients that are asking us to target down to street level, which IP doesn't even come close to offering. With IP you're stuck in the arms of whatever database you're using.
throwanem 10y ago
It's no concern of mine if someone else's business model is that badly broken.
tomjen3 10y ago
Just embed an iframe for a secure subdomain and use window.postMessage to communicate with it. Edit: never mind, that is apparently also "insecure", leading me to think they are doing this because they get a kickback from the SSL cert vampires somehow.
- finnn 10y ago
  Yes, they're probably getting massive kickbacks from those horrible vampires over Let's Encrypt, who list Chrome as a major sponsor.
  - tomjen3 10y ago
    If not, why should they do it? What is in it for them?
    - toyg 10y ago
      There has been a massive loss of confidence in web security since Snowden (and rightly so). Major players now have to look like they're not "helping the NSA", so to speak -- this goes double for Googlers, which try very hard to hide their relationships with the establishment. In a way, it's good -- privacy on the web improved more in the last 3 years than in the previous 15 -- but it's also a massive charade.
- JoshTriplett 10y ago
  HTTPS certificates are free these days: https://letsencrypt.org/ https://letsencrypt.org/
  - tomjen3 10y ago
    If you want to run their software. On your server. As root. And are happy with 3 month certificates. Do they support just downloading a file from them and then uploading it my server, as proof that I control the domain? That should be enough.

So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google.

by r1ch 10y ago

So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google.

iLoch 10y ago

To the people replying to this comment, he's not talking about the ads not being able to use the users location. Most don't. But plenty of ad networks don't work properly or the CPM is much lower for HTTPS enabled websites. I'm guessing r1ch is using a users' locations for his site, and it's ad supported. Hope everyone who is against ads is willing to pay for their content from now on!

r1ch 10y ago
Yes this was meant to be my point - I didn't even consider ads using gelocation (which explains the downvotes I guess :))). While we do use geolocation and ads on one of our sites, it's only a single page so this doesn't really affect us that much. I can see it causing big problems with ad-supported sites / services that use geolocation as a primary feature though as I've experienced first-hand the revenue drop that HTTPS causes.
pdkl95 10y ago
> he's not talking about the ads not being able to use the users location The reason for wanting the user's location doesn't matter. It's incredibly irresponsible to send the user's location (or any other user data) over the network unencrypted.

Brakenshire 10y ago

> So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google. Geolocation API is pretty powerful. It's one thing for a random website to know approximate location, but to be able to track location within 10m is something else.

ry_ry 10y ago
Perhaps a gentler interim solution would have been to only allow accuracy to town/city level over http.
- poooogles 10y ago
  That's already mostly possible with geoip lookups.
  - ry_ry 10y ago
    Yeah, it's just the breaking changes thing - I like what Google are doing, and it's been alerted in the console for ages, but they're strong-arming it slightly. I'm weird, but it always grates slightly when companies throw their weight around - even if the endgame is a positive outcome. Plus the cynic in me assumes they have an advertising product in the works and this is facilitating it.

untog 10y ago

There is zero reason for an ad to be using the Geolocation API. IP-based geolocation is more than enough.

coroutines 10y ago
I hate to play Devil's Advocate but accuracy can be important. Geoip means they can serve me offers for businesses in the same city, but I'd [almost] love it if I were served offers for a taqueria down the street from my browsing location. More than likely they'll just correlate browsing habits with location and sell that information to third parties, though. High quality advertising is just not in this reality.
cies 10y ago
I'm sure advertising will find a use for it! Like "hyper-local ads" that can give you "just around the corner" deals in malls, etc. > There is zero reason for an ad to be using the Geolocation API. IP-based geolocation is more than enough. There was also zero reason for billboards by highways, before there were highways. :)
- dexwiz 10y ago
  Location based advertising is powerful, but the issue here is privacy. We have no idea where that information is going.
- untog 10y ago
  Advertising could find a use for my DNA profile but that doesn't mean they should have access to it. Obviously this is all a sliding scale and has nuance, but I'd say ads should not be using anything that is behind a permission prompt, like geolocation. Tremendously hostile to both the user and the site hosting their ad.
poooogles 10y ago
We have clients that are asking us to target down to street level, which IP doesn't even come close to offering. With IP you're stuck in the arms of whatever database you're using.

throwanem 10y ago

It's no concern of mine if someone else's business model is that badly broken.

tomjen3 10y ago

Just embed an iframe for a secure subdomain and use window.postMessage to communicate with it. Edit: never mind, that is apparently also "insecure", leading me to think they are doing this because they get a kickback from the SSL cert vampires somehow.

finnn 10y ago
Yes, they're probably getting massive kickbacks from those horrible vampires over Let's Encrypt, who list Chrome as a major sponsor.
- tomjen3 10y ago
  If not, why should they do it? What is in it for them?
  - toyg 10y ago
    There has been a massive loss of confidence in web security since Snowden (and rightly so). Major players now have to look like they're not "helping the NSA", so to speak -- this goes double for Googlers, which try very hard to hide their relationships with the establishment. In a way, it's good -- privacy on the web improved more in the last 3 years than in the previous 15 -- but it's also a massive charade.
JoshTriplett 10y ago
HTTPS certificates are free these days: https://letsencrypt.org/ https://letsencrypt.org/
- tomjen3 10y ago
  If you want to run their software. On your server. As root. And are happy with 3 month certificates. Do they support just downloading a file from them and then uploading it my server, as proof that I control the domain? That should be enough.