16 ms·

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the s

by jefftk 8y ago

> In the coming months, we will start testing these protections with small groups of users and will continue to work with Disconnect to improve and expand the set of domains blocked by Firefox. We plan to enable these protections by default for all Firefox users in a future release. While lots of people here already have uMatrix or other blockers running, blocking fingerprinting and cryptomining domains by default would be a big step! (Disclosure: I work on ads at Google.)

wurst_case 8y ago
Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?
- asdff 8y ago
  Google ads has the engineering to work around this, competitors might not and would therefore loose market share to Google ads. Of course he is supportive, his stock options just improved.
- tialaramex 8y ago
  In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Google Ads doesn't need those to be profitable. It would suit them if those went away.
  - JohnFen 8y ago
    > Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.
    - bad_user 8y ago
      Google’s primary revenue source is AdWords, meaning ads served on their own properties, the bulk of it being in Google Search and most if that is contextual, most ads being served based on the search you’re making. Google doesn’t actually have a problem in serving contextual ads on their own properties, since they have plenty of context. The problem is with AdSense since there advertisers need some sort of user profile, plus in the EU bidding exchanges are in jeopardy due to the GDPR.
    - jimmaswell 8y ago
      I don't understand this new position (that GDPR follows) that consent is required for information to be gathered on someone. If someone sees me wearing a blue shirt and writes in their notebook that I wore a blue shirt then I don't feel like I have some inherent right to coerce them to erase it or prevent them from selling that information to Blue Shirt Emporium.
      - arthur_pryor 8y ago
        sometimes it is right to treat scenarios that are fundamentally similar as different beasts in practice when those scenarios are actually happening at very different scales. i (and many others) believe that surveillance is like this. the effort that it takes to do what your describing does not scale, and cannot be used to implement dragnet surveillance and data collection (unless it's a police state and you have a lot of notetakers). lots of people (myself and many others) think dragnet surveillance (whether by private entities or governments) is a thing to be avoided (because it creates really bad power asymmetries, which i think are inherently a bad thing). also, i don't think that large companies should be granted the same rights as individuals. just because a person can do a thing on their own doesn't mean that a large entity should be able to do something similar in spirit at thousands or millions of times the scale.
      - bravoetch 8y ago
        If they wrote 'person wearing blue shirt', fine. But if they followed you home, took note of the address, cross referenced that to find your name and other personal info, then stored all that data to a company that decides who gets loans based on shirt color - not fine. Etc.
  - darkpuma 8y ago
    Untargeted advertising is very often more egregious than merely telling people a product exists. Traditional pre-digital advertising runs the gamete from "Come to me and I'll fix your car" to "You are ugly and unpopular, but you can fix that by drinking our caramel colored sugar water." Advertising that tries to induce then exploit self esteem issues is a plague.
    - ogre_codes 8y ago
      This little bit of misdirection Google and Facebook have propagated about how much better the advertising you get with tracking is the slimiest piece of bait-and-switch in history. Seeing people repeat it like it's fact is testament to just how insidious it is. Targeted advertising is not designed to serve the viewer, it's designed to serve the advertiser. So advertisements you get are even sleazier than non-targeted advertising because they have by definition more information about the reader. So instead of generically exploiting people's self esteem, it exploits people's self esteem armed with much more information about the users. Targeting and tracking is a plague and should be discouraged and blocked to oblivion.
      - mindcrime 8y ago
        Targeted advertising is not designed to serve the viewer, it's designed to serve the advertiser. Advertising doesn't help the advertiser unless it helps you. Showing you an ad for something you don't want, can't use, and would never buy, benefits nobody.
        gnud 8y ago
        Advertising helps the advertiser if it results in a sale - it doesn't matter if the sale helps the viewer. If the ad results in the viewer getting an eating disorder, for example, that's fine for the advertiser if it also results in a sale.
        ogre_codes 8y ago
        Advertising helps the advertiser if it results in a sale - it doesn't matter if the sale helps the viewer. Exactly this. Often it doesn't even require a sale. A lot of Facebook & Google advertising is for bullshit sites which push increasingly sketchy content backed by even sketchier advertising. Sometimes the goal isn't even profit, the Russians paid for advertising to influence politics.
  - rurp 8y ago
    An ad for a golf ball hat is a pretty benign use case but that exact same approach could be used in much more distasteful ways. For example, suppose depressed people are more likely to buy expensive impulse item X. Person A is depressed. Lets show them ads for item X! That would be a nicely profitable strategy that could emerge organically out of a sophisticated ML ad targeting model, something like... AdWords.
  - packet_nerd 8y ago
    > "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!" The implicit message here is buy buy buy. "There's cool hats shaped like golf balls. Everyone's getting one! I need one too!" Do I really need a hat shaped like a gold ball? Do I need any of the crap our materialistic society says I need? Ads like this are trying to shape my expectations about myself, the meaning and purpose of my life, and what I need to feel fulfilled; and all for someone else's benefit, not my own. I have made it a personal goal to reject consumerism, and instead live a simple, sustainable, and efficient life. Rejecting ads (electronically blocking where possible, mentally blocking everywhere) is part of how I'm trying to achieve that goal. Any company trying to sell me something that I didn't seek out myself is my enemy.
    - crummy 8y ago
      You can imagine a company that has come up with a product that helps people live more sustainably, and they want to figure out how to tell people about it. You didn't seek them out though; are they your enemy?
      - packet_nerd 8y ago
        Yes. So they are trying to tell me how to be more sustainable, and make a profit on the side? Which objective is more important to them? Edit: I believe that analyzing the biases and incentives underlying the choices and abstractions presented to us is an important part of what it means to be an intelligent human being. Ads are not reliable sources of information, as the company is incentivized not to inform you, but to sell to you. There are many better sources of good ideas than ads.
  - nukeop 8y ago
    The purpose of advertising is to manipulate you into buying things you don't need, not to inform you about a product that is useful. Turn on the TV, or the radio, or any website, and show me one advert that is purely informative.
- manigandham 8y ago
  Google and Facebook have 1st-party direct connections to users that are signed in. They can already set cookies freely. They already know who you are. This only hurts their competitors.
- pluma 8y ago
  Optimistic answer: working on ads doesn't mean you agree with the level of privacy violations analytics involve these days, making those invasions of privacy technically impossible or illegal means you can avoid them without having to defend your stance against business interests (e.g. "but our competitors are already doing this and not doing it puts us at a disadvantage"). Pessimistic answer: technical countermeasures don't prevent these invasions of privacy but they make them significantly harder, putting companies with less technical skills at a disadvantage. Anti-fingerprinting protections hurt the bottom feeders while larger companies like Google can likely work around them. Pragmatic answer: this wasn't really about the fingerprinting but the crypto miners. Ad networks don't like crypto miners either but blocking them is difficult so browser vendors are really just solving the ad networks' problem for them.
- jefftk 8y ago
  The two main ways ads have of tracking users are: * Cookies: ads ask the browser to store something, later they can ask what the stored value is. * Fingerprinting: ads collect enough information about the browser that they can distinguish it from other users' browsers. While cookies aren't ideal, I think an ad industry that uses them is a lot better than one that uses fingerprinting. The key differences are user control and visibility. If you clear your browsing history, or close an incognito tab, your cookies are gone but your fingerprint is unchanged. Similarly, you can see who's setting cookies but you have no idea who is trying to fingerprint you.
oftenwrong 8y ago
>(Disclosure: I work on ads at Google.) Is that relevant?
- Bonooru 8y ago
  I'd rather that people disclose when tangentially related than not at all. I'd say it's a good thing.
- kevingadd 8y ago
  Tracking is one of Google's services and it's widely used
- smadurange 8y ago
  Didn't see your comment but I said the same thing. Just goes to show arrogance of Google right now they are sisaying in many fields. Because they probably think only they will have the capacity to effectively fingerprint if browsers fought back, because you know, its Google. Most weaker plays will drop out.
- dblohm7 8y ago
  How do you know whether someone works at Google? Don’t worry, they’ll tell you.
jimmaswell 8y ago
Cryptomining seems like a fine alternative to ads to me. Or just the general idea of making the client do some computation work for you.
- lrem 8y ago
  I like my battery to last a whole day, pretty please. Whenever on mobile and AMP is not an option, I'll try Firefox Focus. If that doesn't work, I'm as likely to move on as to revert to letting the site's affiliates run Javascript on my phone.
  - jimmaswell 8y ago
    I think you'd optimally be able to choose between ads, mining, or paying some kind of token, maybe linked to your (Firefox/Google/etc) account so it could be mined on your desktop and used on mobile, or the tokens are just bought. Anecdotally my phone is about 4 years old maybe and the battery still does fine browsing with JS on in Firefox mobile. That is with ublock though.
  - russh 8y ago
    I too do not like spending a $1 so somebody can earn $0.0002.
smadurange 8y ago
Why the disclosure? Are you saying this in a personal capacity or is this the stance of Google Ads team? Like, hey we love and embrace any technology that fights our team's fingerprinting efforts...
- jefftk 8y ago
  > Why the disclosure? Are you saying this in a personal capacity or is this the stance of Google Ads team? I'm commenting as myself, and not for the company. But my perception is likely colored by working for an ads company and it seems fair to let people know that. > Like, hey we love and embrace any technology that fights our team's fingerprinting efforts... While I don't know for certain, I don't believe Google Ads uses fingerprinting. Firefox/Disconnect doesn't seem to think so either, since Google ad domains are on the "Google" list but not the "Fingerprinting" list: https://github.com/mozilla-services/shavar-prod-lists/blob/7eaadac98bc9dcc95ce917eff7bbb21cb71484ec/disconnect-blacklist.json#L9316 https://github.com/mozilla-services/shavar-prod-lists/blob/7...

by jefftk 8y ago

wurst_case 8y ago

Since you work on ads, may I ask why you support this? Won't this make most of your features ineffective?

asdff 8y ago
Google ads has the engineering to work around this, competitors might not and would therefore loose market share to Google ads. Of course he is supportive, his stock options just improved.
tialaramex 8y ago
In principle advertising is fine. Telling people that a product exists is useful. "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!". Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. But an advert that steals from you, or harms you is neither of those things. Google Ads doesn't need those to be profitable. It would suit them if those went away.
- JohnFen 8y ago
  > Targeting this advert to most likely be seen by people who actually had been thinking of buying a hat shaped like sporting equipment is still a good idea too. Not if that targeting is done using data gathered about me without my consent -- as it almost universally is. Targeting based on context (what sort of website the ad is on, for instance), is fine.
  - bad_user 8y ago
    Google’s primary revenue source is AdWords, meaning ads served on their own properties, the bulk of it being in Google Search and most if that is contextual, most ads being served based on the search you’re making. Google doesn’t actually have a problem in serving contextual ads on their own properties, since they have plenty of context. The problem is with AdSense since there advertisers need some sort of user profile, plus in the EU bidding exchanges are in jeopardy due to the GDPR.
  - jimmaswell 8y ago
    I don't understand this new position (that GDPR follows) that consent is required for information to be gathered on someone. If someone sees me wearing a blue shirt and writes in their notebook that I wore a blue shirt then I don't feel like I have some inherent right to coerce them to erase it or prevent them from selling that information to Blue Shirt Emporium.
    - arthur_pryor 8y ago
      sometimes it is right to treat scenarios that are fundamentally similar as different beasts in practice when those scenarios are actually happening at very different scales. i (and many others) believe that surveillance is like this. the effort that it takes to do what your describing does not scale, and cannot be used to implement dragnet surveillance and data collection (unless it's a police state and you have a lot of notetakers). lots of people (myself and many others) think dragnet surveillance (whether by private entities or governments) is a thing to be avoided (because it creates really bad power asymmetries, which i think are inherently a bad thing). also, i don't think that large companies should be granted the same rights as individuals. just because a person can do a thing on their own doesn't mean that a large entity should be able to do something similar in spirit at thousands or millions of times the scale.
    - bravoetch 8y ago
      If they wrote 'person wearing blue shirt', fine. But if they followed you home, took note of the address, cross referenced that to find your name and other personal info, then stored all that data to a company that decides who gets loans based on shirt color - not fine. Etc.
- darkpuma 8y ago
  Untargeted advertising is very often more egregious than merely telling people a product exists. Traditional pre-digital advertising runs the gamete from "Come to me and I'll fix your car" to "You are ugly and unpopular, but you can fix that by drinking our caramel colored sugar water." Advertising that tries to induce then exploit self esteem issues is a plague.
  - ogre_codes 8y ago
    This little bit of misdirection Google and Facebook have propagated about how much better the advertising you get with tracking is the slimiest piece of bait-and-switch in history. Seeing people repeat it like it's fact is testament to just how insidious it is. Targeted advertising is not designed to serve the viewer, it's designed to serve the advertiser. So advertisements you get are even sleazier than non-targeted advertising because they have by definition more information about the reader. So instead of generically exploiting people's self esteem, it exploits people's self esteem armed with much more information about the users. Targeting and tracking is a plague and should be discouraged and blocked to oblivion.
    - mindcrime 8y ago
      Targeted advertising is not designed to serve the viewer, it's designed to serve the advertiser. Advertising doesn't help the advertiser unless it helps you. Showing you an ad for something you don't want, can't use, and would never buy, benefits nobody.
      - gnud 8y ago
        Advertising helps the advertiser if it results in a sale - it doesn't matter if the sale helps the viewer. If the ad results in the viewer getting an eating disorder, for example, that's fine for the advertiser if it also results in a sale.
        ogre_codes 8y ago
        Advertising helps the advertiser if it results in a sale - it doesn't matter if the sale helps the viewer. Exactly this. Often it doesn't even require a sale. A lot of Facebook & Google advertising is for bullshit sites which push increasingly sketchy content backed by even sketchier advertising. Sometimes the goal isn't even profit, the Russians paid for advertising to influence politics.
- rurp 8y ago
  An ad for a golf ball hat is a pretty benign use case but that exact same approach could be used in much more distasteful ways. For example, suppose depressed people are more likely to buy expensive impulse item X. Person A is depressed. Lets show them ads for item X! That would be a nicely profitable strategy that could emerge organically out of a sophisticated ML ad targeting model, something like... AdWords.
- packet_nerd 8y ago
  > "Do you need a hat shaped exactly like a golf ball? At Dave's Golf Ball Hats we sell six sizes!" The implicit message here is buy buy buy. "There's cool hats shaped like golf balls. Everyone's getting one! I need one too!" Do I really need a hat shaped like a gold ball? Do I need any of the crap our materialistic society says I need? Ads like this are trying to shape my expectations about myself, the meaning and purpose of my life, and what I need to feel fulfilled; and all for someone else's benefit, not my own. I have made it a personal goal to reject consumerism, and instead live a simple, sustainable, and efficient life. Rejecting ads (electronically blocking where possible, mentally blocking everywhere) is part of how I'm trying to achieve that goal. Any company trying to sell me something that I didn't seek out myself is my enemy.
  - crummy 8y ago
    You can imagine a company that has come up with a product that helps people live more sustainably, and they want to figure out how to tell people about it. You didn't seek them out though; are they your enemy?
    - packet_nerd 8y ago
      Yes. So they are trying to tell me how to be more sustainable, and make a profit on the side? Which objective is more important to them? Edit: I believe that analyzing the biases and incentives underlying the choices and abstractions presented to us is an important part of what it means to be an intelligent human being. Ads are not reliable sources of information, as the company is incentivized not to inform you, but to sell to you. There are many better sources of good ideas than ads.
- nukeop 8y ago
  The purpose of advertising is to manipulate you into buying things you don't need, not to inform you about a product that is useful. Turn on the TV, or the radio, or any website, and show me one advert that is purely informative.
manigandham 8y ago
Google and Facebook have 1st-party direct connections to users that are signed in. They can already set cookies freely. They already know who you are. This only hurts their competitors.
pluma 8y ago
Optimistic answer: working on ads doesn't mean you agree with the level of privacy violations analytics involve these days, making those invasions of privacy technically impossible or illegal means you can avoid them without having to defend your stance against business interests (e.g. "but our competitors are already doing this and not doing it puts us at a disadvantage"). Pessimistic answer: technical countermeasures don't prevent these invasions of privacy but they make them significantly harder, putting companies with less technical skills at a disadvantage. Anti-fingerprinting protections hurt the bottom feeders while larger companies like Google can likely work around them. Pragmatic answer: this wasn't really about the fingerprinting but the crypto miners. Ad networks don't like crypto miners either but blocking them is difficult so browser vendors are really just solving the ad networks' problem for them.
jefftk 8y ago
The two main ways ads have of tracking users are: * Cookies: ads ask the browser to store something, later they can ask what the stored value is. * Fingerprinting: ads collect enough information about the browser that they can distinguish it from other users' browsers. While cookies aren't ideal, I think an ad industry that uses them is a lot better than one that uses fingerprinting. The key differences are user control and visibility. If you clear your browsing history, or close an incognito tab, your cookies are gone but your fingerprint is unchanged. Similarly, you can see who's setting cookies but you have no idea who is trying to fingerprint you.

oftenwrong 8y ago

>(Disclosure: I work on ads at Google.) Is that relevant?

Bonooru 8y ago
I'd rather that people disclose when tangentially related than not at all. I'd say it's a good thing.
kevingadd 8y ago
Tracking is one of Google's services and it's widely used
smadurange 8y ago
Didn't see your comment but I said the same thing. Just goes to show arrogance of Google right now they are sisaying in many fields. Because they probably think only they will have the capacity to effectively fingerprint if browsers fought back, because you know, its Google. Most weaker plays will drop out.
dblohm7 8y ago
How do you know whether someone works at Google? Don’t worry, they’ll tell you.

jimmaswell 8y ago

Cryptomining seems like a fine alternative to ads to me. Or just the general idea of making the client do some computation work for you.

lrem 8y ago
I like my battery to last a whole day, pretty please. Whenever on mobile and AMP is not an option, I'll try Firefox Focus. If that doesn't work, I'm as likely to move on as to revert to letting the site's affiliates run Javascript on my phone.
- jimmaswell 8y ago
  I think you'd optimally be able to choose between ads, mining, or paying some kind of token, maybe linked to your (Firefox/Google/etc) account so it could be mined on your desktop and used on mobile, or the tokens are just bought. Anecdotally my phone is about 4 years old maybe and the battery still does fine browsing with JS on in Firefox mobile. That is with ublock though.
- russh 8y ago
  I too do not like spending a $1 so somebody can earn $0.0002.

smadurange 8y ago

Why the disclosure? Are you saying this in a personal capacity or is this the stance of Google Ads team? Like, hey we love and embrace any technology that fights our team's fingerprinting efforts...

jefftk 8y ago
> Why the disclosure? Are you saying this in a personal capacity or is this the stance of Google Ads team? I'm commenting as myself, and not for the company. But my perception is likely colored by working for an ads company and it seems fair to let people know that. > Like, hey we love and embrace any technology that fights our team's fingerprinting efforts... While I don't know for certain, I don't believe Google Ads uses fingerprinting. Firefox/Disconnect doesn't seem to think so either, since Google ad domains are on the "Google" list but not the "Fingerprinting" list: https://github.com/mozilla-services/shavar-prod-lists/blob/7eaadac98bc9dcc95ce917eff7bbb21cb71484ec/disconnect-blacklist.json#L9316 https://github.com/mozilla-services/shavar-prod-lists/blob/7...