4 ms·

The real problem with CNAME-tracking is that it provides the loaded adtech libraries the security privileges from the hosted domain. This means, tracking libs

by yayr 6y ago

The real problem with CNAME-tracking is that it provides the loaded adtech libraries the security privileges from the hosted domain. This means, tracking libs can now also access everything of the website they are hosted in, attach any event handlers etc. It is essentially the same as hosting the tracking library from the content server, except that the tracking provider can change the source code anytime without requiring any consent. This is a security nightmare imo.

temp667 6y ago
One asked for by folks on HN who said third party cookies should be blocked - well, the ad tech companies are making them first party. I'm surprised they even setup another domain, you could do path rewriting at load balancer level to route the /extras path to the ad tech software / provider.
- deleted 6y ago
  [deleted]
- JdeBP 6y ago
  The advertisement providers do not trust the content providers not to generate fake page fetches. This rules out any sort of mechanism where the advertisement providers trust reverse proxies or any other sort of request relaying on the content providers' parts.
tinus_hn 6y ago
Not much more of a security nightmare than loading Javascript from a random ad server, really. I think the main point is just to make it harder to block using pi-hole like solutions.
Natsu 6y ago
This makes me dream of making social media decentralized again. If there were some way to make it peer-to-peer so that it didn't require running servers and yet some way to make it so that visibility is reduced to only your actual connections or maybe sometimes one degree from your immediate connections so that you could get introductions from others and explicitly made impossible thereby to spider or otherwise hoover up all the data by any party, effectively making it part of the 'dark' web. So if you want to search it should be the small dataset from your own connections and local to you. At least that's the vision, to make the web "smaller" again like it was before Eternal September, and to create some protocol implementing a vision like that to take over and wrest things from giant oligarchs controlling all social media. I have no idea if making that is even feasible, though I've seen some attempts vaguely similar to that. I see tons of practical challenges with actually implementing such a thing, though, but the idea would be to make all the communication opaque and explicitly take it away from harvesters. Granted, there's no way that could end things... I'm sure clients might get subverted via various methods to re-enable harvesting but at least it would limit their scope and you could remove such folks as connections if you knew.

by yayr 6y ago

temp667 6y ago

One asked for by folks on HN who said third party cookies should be blocked - well, the ad tech companies are making them first party. I'm surprised they even setup another domain, you could do path rewriting at load balancer level to route the /extras path to the ad tech software / provider.

deleted 6y ago
[deleted]
JdeBP 6y ago
The advertisement providers do not trust the content providers not to generate fake page fetches. This rules out any sort of mechanism where the advertisement providers trust reverse proxies or any other sort of request relaying on the content providers' parts.

tinus_hn 6y ago

Not much more of a security nightmare than loading Javascript from a random ad server, really. I think the main point is just to make it harder to block using pi-hole like solutions.

Natsu 6y ago

This makes me dream of making social media decentralized again. If there were some way to make it peer-to-peer so that it didn't require running servers and yet some way to make it so that visibility is reduced to only your actual connections or maybe sometimes one degree from your immediate connections so that you could get introductions from others and explicitly made impossible thereby to spider or otherwise hoover up all the data by any party, effectively making it part of the 'dark' web. So if you want to search it should be the small dataset from your own connections and local to you. At least that's the vision, to make the web "smaller" again like it was before Eternal September, and to create some protocol implementing a vision like that to take over and wrest things from giant oligarchs controlling all social media. I have no idea if making that is even feasible, though I've seen some attempts vaguely similar to that. I see tons of practical challenges with actually implementing such a thing, though, but the idea would be to make all the communication opaque and explicitly take it away from harvesters. Granted, there's no way that could end things... I'm sure clients might get subverted via various methods to re-enable harvesting but at least it would limit their scope and you could remove such folks as connections if you knew.