5 ms·

We're willing to do specifically targeted mitigations, but only if we have to. So far, nearly everything we've done has been universal or algorithmic. The one e

by om2 7y ago

We're willing to do specifically targeted mitigations, but only if we have to. So far, nearly everything we've done has been universal or algorithmic. The one exception I know of was to delete tracking data that had already been planted by known circumventers, at the same time as the mitigation to stop anyone else from using that particular hole (HTTPS super cookies). This is in contrast to Mozilla and Edge tracking protections, which are based on block lists to a significant extent. The disconnect.me list is likely to be trustworthy, but ultimately it is manually curated. We've tried to stay away from using lists like that.

anoncareer0212 7y ago
You're manually curating a specifically targeted mitigation list, but it's non-public. Mozilla/Edge's approach seems preferable, not problematic
- om2 7y ago
  We are not presently manually curating a specifically targeted mitigations list. Just saying we might in the future. We did do a one shot rollback of HSTS super cookie abuse in the past, but that’s it.
  - hermanradtke 7y ago
    But it needs to be public. “Trust, but verify.”
    - nofunsir 7y ago
      Why does it NEED to be public? So the bad actors can know how they are being caught and mitigated and can circumvent again and again?
      - abdullahkhalids 7y ago
        The bad actors just need to open their own website in webkit to check if they are being blocked in some way. They will always know if a particular tracking strategy they are using is not working. So there is no harm in making the list public. The benefit of making the list public is that blocking tech is in some sense of the word censorship. The public needs to know who is being blocked to ensure transparency and to ensure that WebKit is not using their blocking technology nefariously.
        mstade 7y ago
        Isn't WebKit open source though, including this tech?
        majewsky 7y ago
        An open-source program can easily use a closed-source blocking list. For example, the blocking list could be distributed as a list of hashes, and the program hashes the domain name to search for it in the list.
        mstade 7y ago
        Sure but that's why I asked if the blocking tech was open source as well, but I probably didn't ask it very clearly. I couldn't tell from the linked page whether the tech (whether lists or algorithms) were closed or open, but if it's the latter wouldn't that be enough disclosure?
        om2 7y ago
        The linked page is primarily based on tech in the WebKit open source tree. However, some protections depend on support in underlying layers. WebKit's strategy is to use the platform-native versions of things like the network stack and font loading.
        om2 7y ago
        This is roughly how the Google safe browsing list for anti-phishing/malware is distributed (except with chunks and multiple levels of hashing).
    - om2 7y ago
      OK, that's good feedback if we ever need targeted mitigations in the future.
davedx 7y ago
Thank you for doing this work. I don’t know what effect it has on Apple as a whole but for customers like me it reinforces my loyalty to Apple.
- auslander 7y ago
  Totally true. Thanks.
vinay_ys 7y ago
This is all good, but I'm not a fan of my browser being remotely controlled by anyone to modify any of its expected behavior to do special/specific things on different websites without my informed consent. Even the browser vendor has to be held to the same high standard (or even higher) of being completely open and transparent about what they and when they do it.
- _jal 7y ago
  Your requirements are already not being met. All the major browsers self-update, employ lists of sites for special handling, and fail to ask you when those are updated. Of course, you can disable auto-update, and then you're likely to be remote-controlled by someone you didn't choose.
w1nst0nsm1th 7y ago
It’s hard to swallow but after switching from Windows to Debian to Macbook, from Android to iOS, I'm now an unwillingly Apple Fan. Knowing Apple is willing to protect my privacy is one of the main reason I stick to it and not to Android (despise the fact I love the unix/linux like ecosystem) or (f@ck@ng) Windows.

by om2 7y ago

anoncareer0212 7y ago

You're manually curating a specifically targeted mitigation list, but it's non-public. Mozilla/Edge's approach seems preferable, not problematic

om2 7y ago
We are not presently manually curating a specifically targeted mitigations list. Just saying we might in the future. We did do a one shot rollback of HSTS super cookie abuse in the past, but that’s it.
- hermanradtke 7y ago
  But it needs to be public. “Trust, but verify.”
  - nofunsir 7y ago
    Why does it NEED to be public? So the bad actors can know how they are being caught and mitigated and can circumvent again and again?
    - abdullahkhalids 7y ago
      The bad actors just need to open their own website in webkit to check if they are being blocked in some way. They will always know if a particular tracking strategy they are using is not working. So there is no harm in making the list public. The benefit of making the list public is that blocking tech is in some sense of the word censorship. The public needs to know who is being blocked to ensure transparency and to ensure that WebKit is not using their blocking technology nefariously.
      - mstade 7y ago
        Isn't WebKit open source though, including this tech?
        majewsky 7y ago
        An open-source program can easily use a closed-source blocking list. For example, the blocking list could be distributed as a list of hashes, and the program hashes the domain name to search for it in the list.
        mstade 7y ago
        Sure but that's why I asked if the blocking tech was open source as well, but I probably didn't ask it very clearly. I couldn't tell from the linked page whether the tech (whether lists or algorithms) were closed or open, but if it's the latter wouldn't that be enough disclosure?
        om2 7y ago
        The linked page is primarily based on tech in the WebKit open source tree. However, some protections depend on support in underlying layers. WebKit's strategy is to use the platform-native versions of things like the network stack and font loading.
        om2 7y ago
        This is roughly how the Google safe browsing list for anti-phishing/malware is distributed (except with chunks and multiple levels of hashing).
  - om2 7y ago
    OK, that's good feedback if we ever need targeted mitigations in the future.

davedx 7y ago

Thank you for doing this work. I don’t know what effect it has on Apple as a whole but for customers like me it reinforces my loyalty to Apple.

auslander 7y ago
Totally true. Thanks.

vinay_ys 7y ago

This is all good, but I'm not a fan of my browser being remotely controlled by anyone to modify any of its expected behavior to do special/specific things on different websites without my informed consent. Even the browser vendor has to be held to the same high standard (or even higher) of being completely open and transparent about what they and when they do it.

_jal 7y ago
Your requirements are already not being met. All the major browsers self-update, employ lists of sites for special handling, and fail to ask you when those are updated. Of course, you can disable auto-update, and then you're likely to be remote-controlled by someone you didn't choose.

w1nst0nsm1th 7y ago

It’s hard to swallow but after switching from Windows to Debian to Macbook, from Android to iOS, I'm now an unwillingly Apple Fan. Knowing Apple is willing to protect my privacy is one of the main reason I stick to it and not to Android (despise the fact I love the unix/linux like ecosystem) or (f@ck@ng) Windows.