8 ms·

Anyone in the ad-tech industry that can comment on the ITP changes? It's the thing I look forward to the most. >Updates to Intelligent Tracking Prevention add

Anyone in the ad-tech industry that can comment on the ITP changes? It's the thing I look forward to the most. >Updates to Intelligent Tracking Prevention add new restrictions to cookies, further reducing the ability of hidden third parties to track users across websites they visit. To do that, support for partitioned cookies was removed for domains Intelligent Tracking Prevention identifies as having cross-site tracking capabilities. Going a step further, Intelligent Tracking Prevention now also limits long-term tracking for JavaScript first-party cookies.

manigandham 8y ago
It further entrenches Facebook and Google's monopoly on adtech and solves nothing against the companies that people worry about most (and ironically give up the most data too). It also does nothing to stop the wild-west of mobile app tracking. The ideal solution would be to offer up the device's Advertising ID to the browser, just like it is available to mobile apps. That would remove all the tracking pixels and workarounds and improve privacy as the user can easily reset their ID whenever they want to.
- saagarjha 8y ago
  > It further entrenches Facebook and Google's monopoly on adtech How so?
  - manigandham 8y ago
    They have 1st party connections to their users through both apps and websites and will always know who the person is. ITP does nothing to stop them. Amazon will be the 3rd major adtech company soon and ISPs will also be unaffected as they're starting to build up more adtech businesses themselves. ITP is mostly a PR play for Apple's "privacy" marketing push that again hurts publishers and smaller independent internet companies.
    - matt4077 8y ago
      Quote: „Going a step further, Intelligent Tracking Prevention now also limits long-term tracking for JavaScript first-party cookies.“
      - manigandham 8y ago
        That means nothing in practice. These companies have the data, reach, and 1st party connection for those cookies to be constantly replaced and augmented with plenty of other signals.
        manigandham 8y ago
        Since this is downvoted, I'll be extra clear: these companies have websites and network traffic that billions of people use directly which means they can serve HTTP cookies and other signals which are not touched at all by ITP.
    - taf2 8y ago
      While also completely ignoring the real issue native apps.
- atticmanatee 8y ago
  How can Safari 12.1 impact mobile apps?
  - manigandham 8y ago
    The point is that mobile apps are 1000x more intrusive than anything on the web (which was always designed for anonymous users). Apple does not do anything to stop mobile apps tracking even with the app store review and the ability to scan them both on submission and as they're running in the OS. Mobile apps are 90% of the source of adfraud and privacy issues on iOS. Meanwhile Mobile Safari (even without ITP) has caused numerous problems with apps trying to offer webviews for content while trying to keep users signed in. There are numerous effective improvements to be made instead of messing with cookies.
    - hombre_fatal 8y ago
      Somewhat aside: After discovering mitmproxy, I checked out various apps on my Macbook. Found plenty that at least phoned home to Google Analytics on boot. Some even phoned on every action/keypress. Not sure why HN has such a hard-on for native/mobile apps. You get performance at the expense of basically everything else. There's no dev toolbar. No extension system. No customization. No uBlock. You take it all or nothing. And you need intrusive tools like mitmproxy or Little Snitch just to get insight into their network traffic.
      - kitsunesoba 8y ago
        Native apps often (not always) get you not just performance, but also efficiency, no annoying browser chrome, adherence to platform UI conventions, and utilization of platform-specific features (no lowest common denominator syndrome). Electron apps can get rid of the browser chrome at least, but it comes with the cost of a redundant copy of Chromium for each app, which is worse than running in-browser in terms of resource consumption. Web apps would be great if they could deliver the things mentioned in the first paragraph on top of their security/privacy benefits, but I don’t see that happening any time soon.
  - 8y ago
- jen729w 8y ago
  > It further entrenches Facebook and Google's monopoly on adtech Just don’t use those sites. I don’t.
  - Simon_says 8y ago
    I don't use those sites either, but a rather large fraction of websites include javascript from Google. You can try to avoid those sites, too, but it's a lesser Internet.
    - NetOpWibby 8y ago
      And a better Internet IMO.
  - manigandham 8y ago
    Are you being sarcastic? Or seriously suggesting the billions of users of Google and Facebook should just stop using them? If it was that easy then why all this trouble with ITP in the first place?
    - jen729w 8y ago
      Why would this be sarcastic? I haven’t used Facebook for about 10 years now. I stopped using Google last year. DDG is great. What’s so hard?
      - manigandham 8y ago
        >> What's so hard? Ah the classic HN comment. The problem is you don't speak for the billions of people use various Facebook and Google services to live their lives without easy alternatives. When someone is using Gmail to run their small business or using Facebook to keep in touch with their distant relatives, I'm sure saying "what's so hard" is all it takes to get them to see the error of their ways.
lmkg 8y ago
Adobe has a write-up about the impact this has on the Adobe Marketing Cloud: https://medium.com/adobetech/safari-itp-2-1-impact-on-adobe-experience-cloud-customers-9439cecb55ac https://medium.com/adobetech/safari-itp-2-1-impact-on-adobe-...
- blakesterz 8y ago
  This was super interesting. I like how they keep saying something like "Adobe respects consumer privacy options."
  - manigandham 8y ago
    >> Adobe respects consumer privacy options. They do. Is that a problem?
0x0 8y ago
All this talk about tracking prevention, but it also seems like safari 12.1 REMOVES link tracking (<a ping>) prevention: https://lapcatsoftware.com/articles/Safari-link-tracking.html https://lapcatsoftware.com/articles/Safari-link-tracking.htm...
- sitharus 8y ago
  Interesting, but given it’s a link already controlled by the website I don’t see the difference between ping and simply linking to a tracking URL like google already does. This just allows websites to retain proper semantics. Feel free to educate me though :)
  - 0x0 8y ago
    document.cookie is also already controlled by the website, but due to everyone <script src>'ing 3rd party trackers like GA it looks like they felt the need to limit this api. So why remove the possibility for blocking the same scripts from doing foreach('a').attr('ping','3rdpartytracker/uniqueId/'+this.href)?
    - eridius 8y ago
      Nothing's stopping those scripts today from converting all links to bouncing through a redirect domain for tracking, and yet scripts aren't doing that.
      - 0x0 8y ago
        That has UX implications, with the mouseover statusbar link target popup and the right/middle mouse click to copy-url/open-in-new-tab features making it much more obvious.
        acdha 8y ago
        Okay, so imagine it’s adding click event handlers which use XHR/Beacon to avoid the user-visible rewriting. That’s the same impact but everything is slower and you have edge cases where navigation fails with no user feedback at all.
codezero 8y ago
I'm in analytics, not ad tech, though they are pretty well coupled. This is a pretty concerning move. One week is super aggressive. There are several ways around their restrictions, but I really wish I didn't have to consider them. Long story short, if you reflect a client-side cookie back from the server-side (by having the host site set up a CNAME to your collection servers), then it sets an HttpOnly cookie that will last as long as you tell it. This technique is pretty effective at also skirting adblockers, which is why I really wish it weren't the easiest solution, as my company has been very conscious of not trying to work around ad blockers and the intent of web site visitors. This is going to surprise and confuse a lot of customers in the analytics world, but ultimately, they'll adapt and we'll make do.
- manigandham 8y ago
  It will ultimately also accomplish nothing except hurting publishers and giving people less relevant ads.
  - lawnchair_larry 8y ago
    People want less relevant ads, that’s the point.
    - manigandham 8y ago
      They want less ads, not irrelevant ones. Relevancy is the #2 complaint by consumers about ads.
      - stephenr 8y ago
        If ads were relevant to the topic of the site, and had no creepy follow-you-around-the-web behaviour they’d be a lot less offensive.
        manigandham 8y ago
        We agree. The problem isn't advertising, it's the implementation of online ads.
mobilio 8y ago
Well here is workaround: http://peter.nikolow.me/safari-itp-2-1-demo/ http://peter.nikolow.me/safari-itp-2-1-demo/

manigandham 8y ago

It further entrenches Facebook and Google's monopoly on adtech and solves nothing against the companies that people worry about most (and ironically give up the most data too). It also does nothing to stop the wild-west of mobile app tracking. The ideal solution would be to offer up the device's Advertising ID to the browser, just like it is available to mobile apps. That would remove all the tracking pixels and workarounds and improve privacy as the user can easily reset their ID whenever they want to.

saagarjha 8y ago
> It further entrenches Facebook and Google's monopoly on adtech How so?
- manigandham 8y ago
  They have 1st party connections to their users through both apps and websites and will always know who the person is. ITP does nothing to stop them. Amazon will be the 3rd major adtech company soon and ISPs will also be unaffected as they're starting to build up more adtech businesses themselves. ITP is mostly a PR play for Apple's "privacy" marketing push that again hurts publishers and smaller independent internet companies.
  - matt4077 8y ago
    Quote: „Going a step further, Intelligent Tracking Prevention now also limits long-term tracking for JavaScript first-party cookies.“
    - manigandham 8y ago
      That means nothing in practice. These companies have the data, reach, and 1st party connection for those cookies to be constantly replaced and augmented with plenty of other signals.
      - manigandham 8y ago
        Since this is downvoted, I'll be extra clear: these companies have websites and network traffic that billions of people use directly which means they can serve HTTP cookies and other signals which are not touched at all by ITP.
  - taf2 8y ago
    While also completely ignoring the real issue native apps.
atticmanatee 8y ago
How can Safari 12.1 impact mobile apps?
- manigandham 8y ago
  The point is that mobile apps are 1000x more intrusive than anything on the web (which was always designed for anonymous users). Apple does not do anything to stop mobile apps tracking even with the app store review and the ability to scan them both on submission and as they're running in the OS. Mobile apps are 90% of the source of adfraud and privacy issues on iOS. Meanwhile Mobile Safari (even without ITP) has caused numerous problems with apps trying to offer webviews for content while trying to keep users signed in. There are numerous effective improvements to be made instead of messing with cookies.
  - hombre_fatal 8y ago
    Somewhat aside: After discovering mitmproxy, I checked out various apps on my Macbook. Found plenty that at least phoned home to Google Analytics on boot. Some even phoned on every action/keypress. Not sure why HN has such a hard-on for native/mobile apps. You get performance at the expense of basically everything else. There's no dev toolbar. No extension system. No customization. No uBlock. You take it all or nothing. And you need intrusive tools like mitmproxy or Little Snitch just to get insight into their network traffic.
    - kitsunesoba 8y ago
      Native apps often (not always) get you not just performance, but also efficiency, no annoying browser chrome, adherence to platform UI conventions, and utilization of platform-specific features (no lowest common denominator syndrome). Electron apps can get rid of the browser chrome at least, but it comes with the cost of a redundant copy of Chromium for each app, which is worse than running in-browser in terms of resource consumption. Web apps would be great if they could deliver the things mentioned in the first paragraph on top of their security/privacy benefits, but I don’t see that happening any time soon.
- 8y ago
jen729w 8y ago
> It further entrenches Facebook and Google's monopoly on adtech Just don’t use those sites. I don’t.
- Simon_says 8y ago
  I don't use those sites either, but a rather large fraction of websites include javascript from Google. You can try to avoid those sites, too, but it's a lesser Internet.
  - NetOpWibby 8y ago
    And a better Internet IMO.
- manigandham 8y ago
  Are you being sarcastic? Or seriously suggesting the billions of users of Google and Facebook should just stop using them? If it was that easy then why all this trouble with ITP in the first place?
  - jen729w 8y ago
    Why would this be sarcastic? I haven’t used Facebook for about 10 years now. I stopped using Google last year. DDG is great. What’s so hard?
    - manigandham 8y ago
      >> What's so hard? Ah the classic HN comment. The problem is you don't speak for the billions of people use various Facebook and Google services to live their lives without easy alternatives. When someone is using Gmail to run their small business or using Facebook to keep in touch with their distant relatives, I'm sure saying "what's so hard" is all it takes to get them to see the error of their ways.

lmkg 8y ago

Adobe has a write-up about the impact this has on the Adobe Marketing Cloud: https://medium.com/adobetech/safari-itp-2-1-impact-on-adobe-experience-cloud-customers-9439cecb55ac https://medium.com/adobetech/safari-itp-2-1-impact-on-adobe-...

blakesterz 8y ago
This was super interesting. I like how they keep saying something like "Adobe respects consumer privacy options."
- manigandham 8y ago
  >> Adobe respects consumer privacy options. They do. Is that a problem?

0x0 8y ago

All this talk about tracking prevention, but it also seems like safari 12.1 REMOVES link tracking (<a ping>) prevention: https://lapcatsoftware.com/articles/Safari-link-tracking.html https://lapcatsoftware.com/articles/Safari-link-tracking.htm...

sitharus 8y ago
Interesting, but given it’s a link already controlled by the website I don’t see the difference between ping and simply linking to a tracking URL like google already does. This just allows websites to retain proper semantics. Feel free to educate me though :)
- 0x0 8y ago
  document.cookie is also already controlled by the website, but due to everyone <script src>'ing 3rd party trackers like GA it looks like they felt the need to limit this api. So why remove the possibility for blocking the same scripts from doing foreach('a').attr('ping','3rdpartytracker/uniqueId/'+this.href)?
  - eridius 8y ago
    Nothing's stopping those scripts today from converting all links to bouncing through a redirect domain for tracking, and yet scripts aren't doing that.
    - 0x0 8y ago
      That has UX implications, with the mouseover statusbar link target popup and the right/middle mouse click to copy-url/open-in-new-tab features making it much more obvious.
      - acdha 8y ago
        Okay, so imagine it’s adding click event handlers which use XHR/Beacon to avoid the user-visible rewriting. That’s the same impact but everything is slower and you have edge cases where navigation fails with no user feedback at all.

codezero 8y ago

I'm in analytics, not ad tech, though they are pretty well coupled. This is a pretty concerning move. One week is super aggressive. There are several ways around their restrictions, but I really wish I didn't have to consider them. Long story short, if you reflect a client-side cookie back from the server-side (by having the host site set up a CNAME to your collection servers), then it sets an HttpOnly cookie that will last as long as you tell it. This technique is pretty effective at also skirting adblockers, which is why I really wish it weren't the easiest solution, as my company has been very conscious of not trying to work around ad blockers and the intent of web site visitors. This is going to surprise and confuse a lot of customers in the analytics world, but ultimately, they'll adapt and we'll make do.

manigandham 8y ago
It will ultimately also accomplish nothing except hurting publishers and giving people less relevant ads.
- lawnchair_larry 8y ago
  People want less relevant ads, that’s the point.
  - manigandham 8y ago
    They want less ads, not irrelevant ones. Relevancy is the #2 complaint by consumers about ads.
    - stephenr 8y ago
      If ads were relevant to the topic of the site, and had no creepy follow-you-around-the-web behaviour they’d be a lot less offensive.
      - manigandham 8y ago
        We agree. The problem isn't advertising, it's the implementation of online ads.

mobilio 8y ago

Well here is workaround: http://peter.nikolow.me/safari-itp-2-1-demo/ http://peter.nikolow.me/safari-itp-2-1-demo/