4 ms·

What do you think of FLoC (https://github.com/jkarlin/floc https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove https://

by jefftk 7y ago

What do you think of FLoC (https://github.com/jkarlin/floc https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove https://github.com/michaelkleber/turtledove)?

Nextgrid 7y ago
FLoC is a decent idea and similar to something I thought of where there would be a standardised list of categories and the browser would just have an UI in its settings where you can select the categories you're interested in and the browser would send them in an "Accept" header. Unfortunately back when I thought of this I wasn't aware of browser fingerprinting or all the other nefarious things the advertising industry is doing. Fingerprinting turns both FLoC and my idea into tracking vectors, so that's out of the question. The authors acknowledge this problem in the readme. Turtledove is a longer spec and I haven't had the time to read it thoroughly, but while the idea is good, I see some potential problems - first off, this still involves executing JS to do the "ad auction" on the browser which could have security implications (they explicitly mention that JS should be prevented from talking to the outside, leaks would be vulnerabilities in this case, and I don't trust the ad industry to be nice and not attempt to exploit them); there's also the issue that I just don't want my device to expend processing power and expose me to potential security vulnerabilities for ads; I want ads to be served as static images from the website without the whole bidding thing. From an advertiser's perspective, I'm not sure how fetching the potential ads in advance and moving the auction on the client device would work - my understanding is that auctions are in real-time. I'm also not sure whether exposing all the ads to the public (even the ones that ultimately don't get chosen at the auction) and the auction details would reveal information that advertisers consider sensitive. Finally, if you look at my other post here: https://news.ycombinator.com/item?id=22680559 https://news.ycombinator.com/item?id=22680559 you'll see that I have other problems with online and targeted ads besides the privacy and security aspect. Unlike print and TV ads, there little-to-none human review, no accountability (Google isn't liable if they serve me a scam ad if I fall for it), and targeting allows to target scams to only the people most likely to fall for them while hiding these ads from the savvy people who would recognise the scam and report it. At the core, this isn't a tech problem but a law problem, but short of a law it can be solved by tech if we heavily block the current model of ads (targeted and served from a central ad network) so it becomes unprofitable and publishers & advertisers have no choice but to host static ads on their own domain, thus becoming liable if they host malware or something illegal (this would hopefully encourage human review).

by jefftk 7y ago

What do you think of FLoC (https://github.com/jkarlin/floc https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove https://github.com/michaelkleber/turtledove)?

Nextgrid 7y ago

FLoC is a decent idea and similar to something I thought of where there would be a standardised list of categories and the browser would just have an UI in its settings where you can select the categories you're interested in and the browser would send them in an "Accept" header. Unfortunately back when I thought of this I wasn't aware of browser fingerprinting or all the other nefarious things the advertising industry is doing. Fingerprinting turns both FLoC and my idea into tracking vectors, so that's out of the question. The authors acknowledge this problem in the readme. Turtledove is a longer spec and I haven't had the time to read it thoroughly, but while the idea is good, I see some potential problems - first off, this still involves executing JS to do the "ad auction" on the browser which could have security implications (they explicitly mention that JS should be prevented from talking to the outside, leaks would be vulnerabilities in this case, and I don't trust the ad industry to be nice and not attempt to exploit them); there's also the issue that I just don't want my device to expend processing power and expose me to potential security vulnerabilities for ads; I want ads to be served as static images from the website without the whole bidding thing. From an advertiser's perspective, I'm not sure how fetching the potential ads in advance and moving the auction on the client device would work - my understanding is that auctions are in real-time. I'm also not sure whether exposing all the ads to the public (even the ones that ultimately don't get chosen at the auction) and the auction details would reveal information that advertisers consider sensitive. Finally, if you look at my other post here: https://news.ycombinator.com/item?id=22680559 https://news.ycombinator.com/item?id=22680559 you'll see that I have other problems with online and targeted ads besides the privacy and security aspect. Unlike print and TV ads, there little-to-none human review, no accountability (Google isn't liable if they serve me a scam ad if I fall for it), and targeting allows to target scams to only the people most likely to fall for them while hiding these ads from the savvy people who would recognise the scam and report it. At the core, this isn't a tech problem but a law problem, but short of a law it can be solved by tech if we heavily block the current model of ads (targeted and served from a central ad network) so it becomes unprofitable and publishers & advertisers have no choice but to host static ads on their own domain, thus becoming liable if they host malware or something illegal (this would hopefully encourage human review).