7 ms·

Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't c

Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...

0xy 6y ago
Why is DoubleClick in the whitelist?
- joshuamorton 6y ago
  Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general. [I work at Google, but don't work anywhere near chrome, and I know basically nothing about it] Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.
  - 0xy 6y ago
    This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. [1] That leaves... ad tracking. Chrome will send a tracking ID to DoubleClick with every request to that host. Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? [1] https://twitter.com/jonathansampson/status/1165493206441779200 https://twitter.com/jonathansampson/status/11654932064417792...
    - joshuamorton 6y ago
      > This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. Wait what? You don't think there's analytics that can be done about the browser itself? Let's say chrome ships a new experiment, that when enabled on certain devices uses 100% of the CPU until chrome is closed. Analytics sent on browser startup would provide insight into that. If you're asking why they need both: having analytics in the context of a given page is also useful. If you can see that different experiments in chrome cause different performance impacts when loading the same page, that's also useful data that you can't get from analytics sent on startup. Nor could you centralize the logging of that information, as it would essentially be sending your browser history to Google all in one request, which is even easier to track. > Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? Bluntly, no.
      - 0xy 6y ago
        Let me put it another way. Do you think the average user knows of or would approve of Google Chrome itself sending information to an advertising network that could be used to track their behaviors and identity? Do you think this "feature" is adequately disclosed to customers downloading Google Chrome, that it includes a DoubleClick tracking backdoor that no other ad network or website receives.
        joshuamorton 6y ago
        Given that > that it includes a DoubleClick tracking backdoor that no other ad network or website receives. is false, yes, I think the disclosures are reasonable. Your standard of disclosure is that companies need to disclose things that they aren't actually doing. That's ridiculous.
        0xy 6y ago
        How do you know they're not using it for tracking, beyond an ambiguous PR statement that actually doesn't even say they aren't using it for tracking? What makes you sure of that? There are literally billions of dollars on the line. Does Safari or Firefox implement a similar tracking header? If it's so needed for experiments, why is Chrome literally the only browser sending this data to their advertising network (or any site)? If Google were using it for tracking purposes, they'd never confirm that unless forced to. Hence the ambiguous PR statement.
  - bigiain 6y ago
    You do know the history of the name doubleclick, right? Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? (The answer, so far as I can work out, is that Google thinks "The stupid cattle won't even notice mostly, and the ones that do - we'll just get our stooges on social media to claim they're being paranoid, and that everybody should just keep fattening up on the delicious delicious free browser/email/search we so generously give them out of the kindness of our cold and black corporate heart. Then we harvest everything as per the plan.")
    - joshuamorton 6y ago
      > we'll just get our stooges on social media to claim they're being paranoid Accusing people of being shills is a violation of the HN guidelines, please don't. > You do know the history of the name doubleclick, right? I honestly have no clue what you're implying here. > Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? So that it can pass analytics information to requests including to the advertising domain. Occam's razor and all.
      - commoner 6y ago
        You're a Google employee, and you're vociferously defending Google's use of a tracking header in Chrome. Others deserve to know your conflict of interest so that they can read your arguments in the right context.
        joshuamorton 6y ago
        I disclosed that in the comment this user was commenting in response to, before they commented. In other words, they accused me of shilling in reply to a comment where I openly and willingly clarified my relationship with Google. It is possible to ask someone to, or disclose for someone, a conflict of interest, without breaking the HN guidelines. The comment did neither.
        6y ago

0xy 6y ago

Why is DoubleClick in the whitelist?

joshuamorton 6y ago
Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general. [I work at Google, but don't work anywhere near chrome, and I know basically nothing about it] Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.
- 0xy 6y ago
  This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. [1] That leaves... ad tracking. Chrome will send a tracking ID to DoubleClick with every request to that host. Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? [1] https://twitter.com/jonathansampson/status/1165493206441779200 https://twitter.com/jonathansampson/status/11654932064417792...
  - joshuamorton 6y ago
    > This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. Wait what? You don't think there's analytics that can be done about the browser itself? Let's say chrome ships a new experiment, that when enabled on certain devices uses 100% of the CPU until chrome is closed. Analytics sent on browser startup would provide insight into that. If you're asking why they need both: having analytics in the context of a given page is also useful. If you can see that different experiments in chrome cause different performance impacts when loading the same page, that's also useful data that you can't get from analytics sent on startup. Nor could you centralize the logging of that information, as it would essentially be sending your browser history to Google all in one request, which is even easier to track. > Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? Bluntly, no.
    - 0xy 6y ago
      Let me put it another way. Do you think the average user knows of or would approve of Google Chrome itself sending information to an advertising network that could be used to track their behaviors and identity? Do you think this "feature" is adequately disclosed to customers downloading Google Chrome, that it includes a DoubleClick tracking backdoor that no other ad network or website receives.
      - joshuamorton 6y ago
        Given that > that it includes a DoubleClick tracking backdoor that no other ad network or website receives. is false, yes, I think the disclosures are reasonable. Your standard of disclosure is that companies need to disclose things that they aren't actually doing. That's ridiculous.
        0xy 6y ago
        How do you know they're not using it for tracking, beyond an ambiguous PR statement that actually doesn't even say they aren't using it for tracking? What makes you sure of that? There are literally billions of dollars on the line. Does Safari or Firefox implement a similar tracking header? If it's so needed for experiments, why is Chrome literally the only browser sending this data to their advertising network (or any site)? If Google were using it for tracking purposes, they'd never confirm that unless forced to. Hence the ambiguous PR statement.
- bigiain 6y ago
  You do know the history of the name doubleclick, right? Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? (The answer, so far as I can work out, is that Google thinks "The stupid cattle won't even notice mostly, and the ones that do - we'll just get our stooges on social media to claim they're being paranoid, and that everybody should just keep fattening up on the delicious delicious free browser/email/search we so generously give them out of the kindness of our cold and black corporate heart. Then we harvest everything as per the plan.")
  - joshuamorton 6y ago
    > we'll just get our stooges on social media to claim they're being paranoid Accusing people of being shills is a violation of the HN guidelines, please don't. > You do know the history of the name doubleclick, right? I honestly have no clue what you're implying here. > Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? So that it can pass analytics information to requests including to the advertising domain. Occam's razor and all.
    - commoner 6y ago
      You're a Google employee, and you're vociferously defending Google's use of a tracking header in Chrome. Others deserve to know your conflict of interest so that they can read your arguments in the right context.
      - joshuamorton 6y ago
        I disclosed that in the comment this user was commenting in response to, before they commented. In other words, they accused me of shilling in reply to a comment where I openly and willingly clarified my relationship with Google. It is possible to ask someone to, or disclose for someone, a conflict of interest, without breaking the HN guidelines. The comment did neither.
        6y ago