4 ms·

You're being ridiculous. This is like saying we shouldn't have a permissions system on mobile devices because that's just a way to save lazy users the trouble o

You're being ridiculous. This is like saying we shouldn't have a permissions system on mobile devices because that's just a way to save lazy users the trouble of having to vet what the app they just installed actually does.

Someone1234 8y ago
This isn't proposing user permissions, this is proposing site permissions. A better analogy would be, that app developers are too apathetic to review their own app's permissions, so they want a way to limit what permissions a third party ad library could add to their app. It is a way for people shirking responsibility for their own site, app, or content.
- Ajedi32 8y ago
  It doesn't matter who the permissions are for, the principle is the same. _Should_ users perform a through investigation of every app they install, checking that it does exactly what they expect and no more? Perhaps; but that's not really practical. The same applies for developers. Should these sites review the source code of every ad they embed in an iframe, whitelisting each ad individually? Maybe, but that's not going to happen. The other commenters are right, what you're suggesting is fantasy, not pragmatic reality. Permissions systems are better, because they prevent misbehavior even when manual review fails.
  - Someone1234 8y ago
    > It doesn't matter who the permissions are for, the principle is the same. It absolutely matters. Users should have minimal responsibility while consuming content. Site owners should have major responsibility while providing content. > Should these sites review the source code of every ad they embed in an iframe, whitelisting each ad individually? They absolutely should know who their ad platform is, what their policies are, and what is/isn't acceptable for an ad hosted by that platform. If their ad platform falls short, they should shop around for a better alternative.
    - prophesi 8y ago
      > They absolutely should know who their ad platform is, what their policies are, and what is/isn't acceptable for an ad hosted by that platform. If their ad platform falls short, they should shop around for a better alternative. ... Or you could choose a wholesome ad network (if such a thing exists), AND limit what features they can access just in case something goes awry and a malicious ad somehow makes it through.
    - Ajedi32 8y ago
      > If their ad platform falls short, they should shop around for a better alternative. That's like suggesting users not use the app store anymore because sometimes malware slips through the review process. All major ad networks will occasionally have ads which violate their written policies. Google, for example, bans millions of ads every year for that reason ( https://www.blog.google/technology/ads/how-we-fought-bad-ads-sites-and-scammers-2016/ https://www.blog.google/technology/ads/how-we-fought-bad-ads... ). The solution to that isn't to just ditch those ad platforms entirely.
      - phobosdeimos 8y ago
        The solution is to block all ads until site owners start to take responsibility. As a user I couldn't care less about the hardships of the site owner.
- stupidcar 8y ago
  What utter nonsense. Do you give every user and process on your machine root access? After all, if you trust them, then why restrict them? And if you don't trust them, why let them login / execute at all? In reality, trust can only ever be partial, and even honest actors can cause damage accidentally, or can be compromised by 3rd parties through no fault of their own. Permissions are how you overcome partial trust: You grant actors only those permissions to act in ways related to the task you want them to do. That way, if even if they are dishonest or compromised, the damage they can do is limited. This principle is the cornerstone of modern security. It's the only way that most systems can interact at all. It is isn't "apathetic" for apps or websites to restrict the permissions of ads. It's apathetic not to. It's the same apathy that causes users to click through warning screens and grant apps whatever permissions they want, even when a Sudoku game is requesting access to their microphone and camera.

Someone1234 8y ago

This isn't proposing user permissions, this is proposing site permissions. A better analogy would be, that app developers are too apathetic to review their own app's permissions, so they want a way to limit what permissions a third party ad library could add to their app. It is a way for people shirking responsibility for their own site, app, or content.

Ajedi32 8y ago
It doesn't matter who the permissions are for, the principle is the same. _Should_ users perform a through investigation of every app they install, checking that it does exactly what they expect and no more? Perhaps; but that's not really practical. The same applies for developers. Should these sites review the source code of every ad they embed in an iframe, whitelisting each ad individually? Maybe, but that's not going to happen. The other commenters are right, what you're suggesting is fantasy, not pragmatic reality. Permissions systems are better, because they prevent misbehavior even when manual review fails.
- Someone1234 8y ago
  > It doesn't matter who the permissions are for, the principle is the same. It absolutely matters. Users should have minimal responsibility while consuming content. Site owners should have major responsibility while providing content. > Should these sites review the source code of every ad they embed in an iframe, whitelisting each ad individually? They absolutely should know who their ad platform is, what their policies are, and what is/isn't acceptable for an ad hosted by that platform. If their ad platform falls short, they should shop around for a better alternative.
  - prophesi 8y ago
    > They absolutely should know who their ad platform is, what their policies are, and what is/isn't acceptable for an ad hosted by that platform. If their ad platform falls short, they should shop around for a better alternative. ... Or you could choose a wholesome ad network (if such a thing exists), AND limit what features they can access just in case something goes awry and a malicious ad somehow makes it through.
  - Ajedi32 8y ago
    > If their ad platform falls short, they should shop around for a better alternative. That's like suggesting users not use the app store anymore because sometimes malware slips through the review process. All major ad networks will occasionally have ads which violate their written policies. Google, for example, bans millions of ads every year for that reason ( https://www.blog.google/technology/ads/how-we-fought-bad-ads-sites-and-scammers-2016/ https://www.blog.google/technology/ads/how-we-fought-bad-ads... ). The solution to that isn't to just ditch those ad platforms entirely.
    - phobosdeimos 8y ago
      The solution is to block all ads until site owners start to take responsibility. As a user I couldn't care less about the hardships of the site owner.
stupidcar 8y ago
What utter nonsense. Do you give every user and process on your machine root access? After all, if you trust them, then why restrict them? And if you don't trust them, why let them login / execute at all? In reality, trust can only ever be partial, and even honest actors can cause damage accidentally, or can be compromised by 3rd parties through no fault of their own. Permissions are how you overcome partial trust: You grant actors only those permissions to act in ways related to the task you want them to do. That way, if even if they are dishonest or compromised, the damage they can do is limited. This principle is the cornerstone of modern security. It's the only way that most systems can interact at all. It is isn't "apathetic" for apps or websites to restrict the permissions of ads. It's apathetic not to. It's the same apathy that causes users to click through warning screens and grant apps whatever permissions they want, even when a Sudoku game is requesting access to their microphone and camera.