11 ms·

iOS 14 and Facebook Pixel causing increase in PSL inclusion requests

273 points by CameronBanga 6y ago

fotta 6y ago
> It is inappropriate for presence or absense in PSL to be used by Facebook as a means to include or reject entries due to the IOS14 change, as PSL is not any form of security screen whatsoever, and the volunteer team maintaining the PSL is receiving the burden of being a sieve for the changes on interaction between those systems, which is taxing our resources. > The ONLY validation performed by PSL volunteers and Github process to add listing in the PSL is to check that a DNS entry is added by the domain administrator that can be tied to, and this can be completely illusory and lite in reality in contrast to perhaps the deisred level of security that had been intended between Facebook Pixel and Apple. > We are freezing the approval of new submissions that cite the FB / IOS 14 interop issue in order to provide Facebook or Apple, with a much more robust set of resources, the opportunity to sort this out amongst/betwixt themselves. https://github.com/publicsuffix/list/issues/1245#issuecomment-812228981 https://github.com/publicsuffix/list/issues/1245#issuecommen... ~~Seems like FB was abusing the work of volunteers here as a reaction to changes in iOS 14.~~ I don't see why they can't run their own PSL a la NTP servers. edit: Seems like Apple was the one to declare PSL as canonical.
- marketingtech 6y ago
  Apple is the company that declared this the canonical Public Suffix List. Facebook is just directing their customers towards it. "If you need to be considered a public suffix for Apple's new policy, you'll need to send your pull request to this repo."
  - HappyTypist 6y ago
    Apple should be officially supporting this project and turn it into an independent, but full-time gig. If the maintainers decline, Apple should hire someone to manage their own.
  - fotta 6y ago
    Ah I just read the links in jefftk's comment and it seems like you're right.
- tialaramex 6y ago
  The existence of multiple independent definitions for eTLD+1 would be very likely to create security holes, via a Confused Deputy-type scenario. If I was a security researcher, or a blackhat, and I found that bar.example is on the Mozilla PSL, and so Firefox considers foo.bar.example and quux.bar.example to be separate sites - while it isn't on the Apple PSL and so Apple's APIs treat foo.bar.example and quux.bar.example as parts of the same site (or vice versa), then I know I'm going to find weird bugs where Apple and the Firefox browser understand things about these two names differently and I can likely exploit that. The preference from PSL team members is to do less with this hack over time, to put it behind us. But alas instead it motivates people to turn a hand-wavy notion "You know, a web site" into further reliance on the PSL instead of actually building a robust solution to their problem. This is particularly inexcusable from Apple because it's not like Apple is hurting for resources. If they actually wanted to solve problems, they could put the work in; so I think we can conclude they weren't much interested in solving the problem, only as usual in ensuring somebody else takes the blame.
- NovemberWhiskey 6y ago
  >edit: Seems like Apple was the one to declare PSL as canonical. Dependency on the Public Suffix List is already baked into essentially 100% of the global browser market for purposes like control of setting cookies - I'm not sure Apple made it any more 'canonical' by depending on it here.
  - user3939382 6y ago
    It kind of reminds me of the manually-shared HOSTS.TXT list of domain names before we had DNS, and seems like a problem we also need formal infrastructure to solve long term.
throw14082020 6y ago
What is a PSL inclusion request? Public Suffix List?
- pugworthy 6y ago
  Same question - what is PSL? My best guess at the moment is Public Suffix List.
gruez 6y ago
Can someone provide more context here? How does being added to the PSL affect tracking? Why are businesses adding themselves to the PSL en masse?
- twobitshifter 6y ago
  PSL is used to determine the level that a unique domain is registered at. This restricts cookies and privileges to that domain. It’s just a simple list because both .com and .co.uk are valid suffixes. Ios14 is using this list to prevent apps from tracking you across sites by limiting the data that can be stored per site. If you can get your domain recognized as a suffix as mysite.com then you can split information between all higher level domains. client1.mysite.com and client2.mysite.com. This allows you to store as much information as you want.
  - TechBro8615 6y ago
    The PSL has always been a giant hack and totally unmaintainable in the long term. It's only a matter of time before someone mistakenly relying on it for security purposes gets owned by a rogue PR. Also, as mentioned in some of these issues, browsers don't even update it on any sort of guaranteed schedule.
    - jakear 6y ago
      The fun thing is you can s/PSL/DNS/g and the statement still holds. Same for BGP
      - therealx 6y ago
        BGP and DNS survive due to relative obscurity, despite everyone using it in some way. Web devs do not give a shit about BGP (sadly.)
FemmeAndroid 6y ago
This followup issue seems to have a more clear writeup, especially for someone like me who is a bit out of the loop when it comes to the PSL: https://github.com/privacycg/private-click-measurement/issues/78 https://github.com/privacycg/private-click-measurement/issue...
- djrogers 6y ago
  While it does have quite a bit of details, this followup issue is clearly written by someone from FB or one of the other AdCos who wants to point the finger back at Apple. The tone and wording used here is rather rich and entitled.
  - wffurr 6y ago
    They seem to think that people can’t really “opt out” of “tracking” (scare quotes theirs). Talk about entitled.
    - dialtone 6y ago
      The quotes are entirely appropriate because adding some domain to the PSL makes the subdomains siloed cookie-wise so they can't share cookies and the PSL cannot use cookies anymore. Since they can't share cookies you can't track across even the same domain when added to the PSL. This is a feature needed for sites like Rakuten, Shopify, Alibaba that have multiple merchants under the same domains. Nothing to do with entitlement.
      - kelnos 6y ago
        FB seems to believe they are entitled to the ability to track people on iOS. Apple is under no obligation to allow that.
        dialtone 6y ago
        Apple literally built a feature that requires addition to PSL to support a usecase that was addressed multiple times in the PrivacyCG meetings. How is this entitlement, they are following the Apple requirements.
marketingtech 6y ago
This is a result of Apple limiting the entropy of marketing data that can be received from a domain (defined as an eTLD+1) to 6 bits. This causes problems for platforms like Shopify or marketplaces like Alibaba or eBay that may have multiple sellers trying to run ads on a domain and competing for the same small pool of entropy. This solution? Leverage the "public suffix" list to define your domain as an eTLD and give every seller a separate subdomain so that everyone gets their own data entropy namespace. Now every hosting provider or online marketplace is scrambling to re-architect their site into subdomains with public suffixes to maintain the status quo.
- tekstar 6y ago
  Pretty much all Shopify shops have their own domains, only a minority drive traffic to their .myshopify.com subdomain
  - bredren 6y ago
    I was a bit surprised that a shopify biz that could not be bothered to use its own domain would be very concerned about monitoring ad performance. Seems someone would first effect to have a better branded site. As in, a decent TLD. And that if anything, this is a kick in the pants of an ecommerce site to get its own domain(s) to deal with this. Do I have that right?
    - simlevesque 6y ago
      Well, I could own google.myshopify.com and be happy with it but have no way to buy the .com
      - Macha 6y ago
        Just suck it up and buy google-calculatorstore.com or whatever - if you're happy with the myshopify domain you clearly don't care _that_ much. Of course, that specific example, since Google is trademarked and well known might get you on the wrong end of Shopify's ToS or a UDRP request either way.
nsxwolf 6y ago
Paid Sick Leave?
- kapp_in_life 6y ago
  Public Suffix List. It's in the link.
- foolproofplan 6y ago
  Pumpkin Spice Latte
jefftk 6y ago
Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but could be appropriate for different shops. FB issued guidance suggesting domains like retail.example consider getting themselves added to the PSL, and now the PSL (a volunteer project) is getting a lot of requests. The PSL project has put these requests on hold, and asked FB and Apple to work this out. FB is talking to Apple in https://github.com/privacycg/private-click-measurement/issues/78 https://github.com/privacycg/private-click-measurement/issue... [1] https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/ https://webkit.org/blog/11529/introducing-private-click-meas...
- devrand 6y ago
  It sounds like there's two cases: 1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM. 2. Sites that want to abuse an eTLD to do something like give all users on their social network a custom subdomain so that they're not polluting the same pool. -- I think it was actually reasonable for Apple to consider the PSL as it's basically the most comprehensive eTLD list that we have and would allow them to match browser behavior. The problem now is that case (1) is sending a bunch of requests at once as something will now actually break for these sites. Before now it was really just them being lax with security and not considering that cookies should be siloed. This isn't a unique situation btw, PSL also saw a large increase in inclusion requests when LetsEncrypt added rate limits based on eTLDs. (2) is obviously bad and there's really no other justification for these sites being in the PSL. Therefore I think it's reasonable for PSL to deny inclusion requests that are solely for PCM reasons. This all being said, the PSL is a massive hack [1] and really needs to be replaced by something else. It probably is about time for these companies to invest in a replacement. [1]: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems
  - 6y ago
rectang 6y ago
PSL: Public Suffix List https://publicsuffix.org/ https://publicsuffix.org/ > A "public suffix" is one under which Internet users can (or historically could) directly register names. Some examples of public suffixes are .com, .co.uk and pvt.k12.ma.us. The Public Suffix List is a list of all known public suffixes. > The Public Suffix List is an initiative of Mozilla, but is maintained as a community resource.
lmb 6y ago
Seems like the right move from a volunteer run project, what will the future will hold though? Artificial scarcity is always a problem. On another note, for just 20k$ I can offer you exclusive use of the xxgfzrf.dinglebop.me Public Suffix so that you can keep tracking your users. Please reach out to sales@example.com if you are interested.
- dialtone 6y ago
  It's interesting because being added to the PSL reduces your ability to track users. So yeah, I have a bridge to sell you, interested?
  - djrogers 6y ago
    > being added to the PSL reduces your ability to track users Not really, in fact it can increase your ability to track users if it's (ab)used in specific ways - see use case #2 and #3 here: https://github.com/privacycg/private-click-measurement/issues/78#issuecomment-814498256 https://github.com/privacycg/private-click-measurement/issue...
    - dialtone 6y ago
      There's an approval process to be added to the PSL so abuses would be quite surprising and easy to remove when discovered.
      - iudqnolq 6y ago
        This entire discussion is literally about how that's not the case.
- devrand 6y ago
  To make things worse, it's basically impossible to remove a domain from the PSL as no one knows how software built against the PSL would handle it. A removal could break tremendous amount of software that people rely on.
kristofferR 6y ago
Is this actually a problem? From the Github page it seems like the rate of invalid inclusion requests is very low, less than one per day: https://github.com/publicsuffix/list/pulls?q=label%3Awontfix+ https://github.com/publicsuffix/list/pulls?q=label%3Awontfix...
- kelnos 6y ago
  That's not the issue; addition requests volume has suddenly gone way up because of this new Apple policy, and the volunteers that run the PSL are not prepared for it.
manzu 6y ago
I’m just here to point the finger at Facebook, or anyone, for finding this workaround of declaring your legitimate website as a domain suffix just for tracking entropy purposes this is so laughable. like my ford fiesta identifies as an apache attack helicopter
- tick_tock_tick 6y ago
  Apple is the one that declared this list to be the source of truth. Facebook is just information customers of Apple's decision.......
varispeed 6y ago
To be honest Facebook should offer a tracking free version with paid subscription. It is not acceptable that the only way to use Facebook and contact your family is to sacrifice your own and theirs privacy. When are we going to have a regulator step in and tackle this? It doesn't seem that GDPR has helped much, so I think more radical steps are needed. Such tracking that is being done online would be illegal offline (stalking), so I don't see how long this is going to go. It's not sustainable.
- echelon 6y ago
  iPhone users are probably among Facebook's most valuable advertising demographic (ie. lots of disposable income). Apple's decisions to block tracking are hurting them in a big way, and offering a paid subscription probably won't seem attractive to users if Facebook prices it at the full value lost. We've trained people that everything is free. We can't get away from that now that the genie is out of the bottle. Furthermore, people might just decide Facebook isn't worth it for them at the level of functionality they provide. As more churn happens, the overall value of the network decreases. Apple just checkmated Facebook.
  - dialtone 6y ago
    This has nothing to do with tracking to target ads. Facebook doesn't need Apple to execute that, people share data with FB voluntarily. This is about measuring the impact of advertising while following a standard published by Apple itself and covering the usecase of big marketplaces with sub stores in it.
- PeterisP 6y ago
  I don't think that such a paid subscription would be feasible. Facebook currently earns more than 150 $/year on ads for each of their US/Canada user on average; and iPhone users who would be willing to pay for such services probably are worth more than the average, so the appropriate market-determined fee to replace invasive ad targeting would be quite large. I don't think people would be willing to pay for tracking-free Facebook more than they pay for Netflix.
kogir 6y ago
Isn’t the easiest solution here for companies to register their own domain? Why be company.service.tld and not just company.tld? What are these businesses doing for email?
- mrweasel 6y ago
  In this case I think the issue is trackers. If you owned a retargeting or tracking service, you might have customer1.retargetting.com and customer2.retargetting.com. Apple will now see these as being the same site, unless individually registered in PSL. This limits the amount of data that can be aggregated by retargetting.com, unless each subdomain is added to PSL.
  - 3np 6y ago
    I think this is it - the only "small businesses" I see being actually hurt (as opposed to slightly inconvenienced) by this would be retargeting and tracking companies.
- donmcronald 6y ago
  Yes, it is. The main reason I can think of for using subdomains would be for super low value content that isn’t worth $10-30 / year for a real domain. There could also be a setup / maintenance angle I guess. Specifying a big list of custom domains is more work than *.example.com.
  - mangosquash 6y ago
    I work on digital advertising for a franchise where each individual store manages their own shopify site at location.franchise.com. Soon, these sites won't be able to run ads that track purchases, unless franchise.com is added to this list. I understand the PSL managers' position that this is an unfair burden to place on them though.
    - local_dev 6y ago
      >these sites won't be able to run ads that track purchases Isn't that part of the purpose of the changes that Apple is making? As a user, this seems like a great change. Less tracking is a positive.
deleted 6y ago
[deleted]
irrational 6y ago
>PSL is maintained by volunteers and there should be zero expectation of turnaround times on PR (and a respect for the labor burden shifted onto them by orgs using PSL as a bozofilter) What is to stop Facebook from assigning an engineering team to act as volunteers so the turnaround time drops to zero?
- seoaeu 6y ago
  Um, because those engineers don't have commit access to the repository? You can't just hire an engineering team and take over any open source project you want.
  - irrational 6y ago
    Oh, I was assuming the engineering team would lie a pretend like they did not work for Facebook. I assumed they would slowly work to gain the confidence of those in control and little by little they gain the access they required themselves. Maybe they could pretend not to know each other and use that to their advantage. Surely a company with the resources of Facebook could manufacture fake alternate lives for the engineering team to make them look completely legitimate and harmless.
    - willxinc 6y ago
      Do you mean Apple, whose usage of the PSL caused this?
      - irrational 6y ago
        No, Facebook. Facebook is telling companies to use the PSL. The PSL people are saying, “we give no guarantees about how long it will take us to add a domain to the PSL”. They could drag their feet so long as to make the PSL useless. To make sure it works, I could see Facebook wanting to get some of their people into position so that they can immediately approve PRs on the PSL. I can’t think of any reason Apple would want to support the PSL.
sergiotapia 6y ago
So much brain power and work wasted on this ad bullshit
- amelius 6y ago
  Yes and ads also stimulate over-consumption which hurts the planet. The solution is to block all ads, or even better, ban them.
layoutIfNeeded 6y ago
Why are we using a centralized list for determining who's an eTLD and who's not? Why don't we store this metadata in the actual DNS records?
pornel 6y ago
Reminder that the Public Suffix List is a non-scalable hack, and platforms should be reducing their reliance on it, not increase it: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems
- dwaite 6y ago
  It doesn't really propose an alternative to the PSL for 'same site' behavior, instead just pushes for 'same origin' (aka exact match) behavior. I would agree that e.g. Apple would be better to support both same-site and same-origin, and say, clobber PCM if it receives a request for one after it has already received a request for the other.
towaytie4567 6y ago
As an aside, it's insane that decisions of such import are being made by folks working at a couple of large US companies. This is going to impact users and small businesses across the world. Where is the representation from African/Indian/Chinese businesses and technologists? This would require the big tech cos to truly be interested in "diversity" of course, instead of the lip-service they pay to it in practice.
Aissen 6y ago
It's past time we use a better solution for the PSL side-effects (cookies partitionning, TLD detection) than a centralized list. A dedicated DNS record comes to mind.

273 points by CameronBanga 6y ago

> It is inappropriate for presence or absense in PSL to be used by Facebook as a means to include or reject entries due to the IOS14 change, as PSL is not any form of security screen whatsoever, and the volunteer team maintaining the PSL is receiving the burden of being a sieve for the changes on interaction between those systems, which is taxing our resources. > The ONLY validation performed by PSL volunteers and Github process to add listing in the PSL is to check that a DNS entry is added by the domain administrator that can be tied to, and this can be completely illusory and lite in reality in contrast to perhaps the deisred level of security that had been intended between Facebook Pixel and Apple. > We are freezing the approval of new submissions that cite the FB / IOS 14 interop issue in order to provide Facebook or Apple, with a much more robust set of resources, the opportunity to sort this out amongst/betwixt themselves. https://github.com/publicsuffix/list/issues/1245#issuecomment-812228981 https://github.com/publicsuffix/list/issues/1245#issuecommen... ~~Seems like FB was abusing the work of volunteers here as a reaction to changes in iOS 14.~~ I don't see why they can't run their own PSL a la NTP servers. edit: Seems like Apple was the one to declare PSL as canonical.

marketingtech 6y ago
Apple is the company that declared this the canonical Public Suffix List. Facebook is just directing their customers towards it. "If you need to be considered a public suffix for Apple's new policy, you'll need to send your pull request to this repo."
- HappyTypist 6y ago
  Apple should be officially supporting this project and turn it into an independent, but full-time gig. If the maintainers decline, Apple should hire someone to manage their own.
- fotta 6y ago
  Ah I just read the links in jefftk's comment and it seems like you're right.
tialaramex 6y ago
The existence of multiple independent definitions for eTLD+1 would be very likely to create security holes, via a Confused Deputy-type scenario. If I was a security researcher, or a blackhat, and I found that bar.example is on the Mozilla PSL, and so Firefox considers foo.bar.example and quux.bar.example to be separate sites - while it isn't on the Apple PSL and so Apple's APIs treat foo.bar.example and quux.bar.example as parts of the same site (or vice versa), then I know I'm going to find weird bugs where Apple and the Firefox browser understand things about these two names differently and I can likely exploit that. The preference from PSL team members is to do less with this hack over time, to put it behind us. But alas instead it motivates people to turn a hand-wavy notion "You know, a web site" into further reliance on the PSL instead of actually building a robust solution to their problem. This is particularly inexcusable from Apple because it's not like Apple is hurting for resources. If they actually wanted to solve problems, they could put the work in; so I think we can conclude they weren't much interested in solving the problem, only as usual in ensuring somebody else takes the blame.
NovemberWhiskey 6y ago
>edit: Seems like Apple was the one to declare PSL as canonical. Dependency on the Public Suffix List is already baked into essentially 100% of the global browser market for purposes like control of setting cookies - I'm not sure Apple made it any more 'canonical' by depending on it here.
- user3939382 6y ago
  It kind of reminds me of the manually-shared HOSTS.TXT list of domain names before we had DNS, and seems like a problem we also need formal infrastructure to solve long term.

throw14082020 6y ago

What is a PSL inclusion request? Public Suffix List?

pugworthy 6y ago
Same question - what is PSL? My best guess at the moment is Public Suffix List.

gruez 6y ago

Can someone provide more context here? How does being added to the PSL affect tracking? Why are businesses adding themselves to the PSL en masse?

twobitshifter 6y ago
PSL is used to determine the level that a unique domain is registered at. This restricts cookies and privileges to that domain. It’s just a simple list because both .com and .co.uk are valid suffixes. Ios14 is using this list to prevent apps from tracking you across sites by limiting the data that can be stored per site. If you can get your domain recognized as a suffix as mysite.com then you can split information between all higher level domains. client1.mysite.com and client2.mysite.com. This allows you to store as much information as you want.
- TechBro8615 6y ago
  The PSL has always been a giant hack and totally unmaintainable in the long term. It's only a matter of time before someone mistakenly relying on it for security purposes gets owned by a rogue PR. Also, as mentioned in some of these issues, browsers don't even update it on any sort of guaranteed schedule.
  - jakear 6y ago
    The fun thing is you can s/PSL/DNS/g and the statement still holds. Same for BGP
    - therealx 6y ago
      BGP and DNS survive due to relative obscurity, despite everyone using it in some way. Web devs do not give a shit about BGP (sadly.)

FemmeAndroid 6y ago

This followup issue seems to have a more clear writeup, especially for someone like me who is a bit out of the loop when it comes to the PSL: https://github.com/privacycg/private-click-measurement/issues/78 https://github.com/privacycg/private-click-measurement/issue...

djrogers 6y ago
While it does have quite a bit of details, this followup issue is clearly written by someone from FB or one of the other AdCos who wants to point the finger back at Apple. The tone and wording used here is rather rich and entitled.
- wffurr 6y ago
  They seem to think that people can’t really “opt out” of “tracking” (scare quotes theirs). Talk about entitled.
  - dialtone 6y ago
    The quotes are entirely appropriate because adding some domain to the PSL makes the subdomains siloed cookie-wise so they can't share cookies and the PSL cannot use cookies anymore. Since they can't share cookies you can't track across even the same domain when added to the PSL. This is a feature needed for sites like Rakuten, Shopify, Alibaba that have multiple merchants under the same domains. Nothing to do with entitlement.
    - kelnos 6y ago
      FB seems to believe they are entitled to the ability to track people on iOS. Apple is under no obligation to allow that.
      - dialtone 6y ago
        Apple literally built a feature that requires addition to PSL to support a usecase that was addressed multiple times in the PrivacyCG meetings. How is this entitlement, they are following the Apple requirements.

marketingtech 6y ago

This is a result of Apple limiting the entropy of marketing data that can be received from a domain (defined as an eTLD+1) to 6 bits. This causes problems for platforms like Shopify or marketplaces like Alibaba or eBay that may have multiple sellers trying to run ads on a domain and competing for the same small pool of entropy. This solution? Leverage the "public suffix" list to define your domain as an eTLD and give every seller a separate subdomain so that everyone gets their own data entropy namespace. Now every hosting provider or online marketplace is scrambling to re-architect their site into subdomains with public suffixes to maintain the status quo.

tekstar 6y ago
Pretty much all Shopify shops have their own domains, only a minority drive traffic to their .myshopify.com subdomain
- bredren 6y ago
  I was a bit surprised that a shopify biz that could not be bothered to use its own domain would be very concerned about monitoring ad performance. Seems someone would first effect to have a better branded site. As in, a decent TLD. And that if anything, this is a kick in the pants of an ecommerce site to get its own domain(s) to deal with this. Do I have that right?
  - simlevesque 6y ago
    Well, I could own google.myshopify.com and be happy with it but have no way to buy the .com
    - Macha 6y ago
      Just suck it up and buy google-calculatorstore.com or whatever - if you're happy with the myshopify domain you clearly don't care _that_ much. Of course, that specific example, since Google is trademarked and well known might get you on the wrong end of Shopify's ToS or a UDRP request either way.

nsxwolf 6y ago

Paid Sick Leave?

kapp_in_life 6y ago
Public Suffix List. It's in the link.
foolproofplan 6y ago
Pumpkin Spice Latte

jefftk 6y ago

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but could be appropriate for different shops. FB issued guidance suggesting domains like retail.example consider getting themselves added to the PSL, and now the PSL (a volunteer project) is getting a lot of requests. The PSL project has put these requests on hold, and asked FB and Apple to work this out. FB is talking to Apple in https://github.com/privacycg/private-click-measurement/issues/78 https://github.com/privacycg/private-click-measurement/issue... [1] https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/ https://webkit.org/blog/11529/introducing-private-click-meas...

devrand 6y ago
It sounds like there's two cases: 1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM. 2. Sites that want to abuse an eTLD to do something like give all users on their social network a custom subdomain so that they're not polluting the same pool. -- I think it was actually reasonable for Apple to consider the PSL as it's basically the most comprehensive eTLD list that we have and would allow them to match browser behavior. The problem now is that case (1) is sending a bunch of requests at once as something will now actually break for these sites. Before now it was really just them being lax with security and not considering that cookies should be siloed. This isn't a unique situation btw, PSL also saw a large increase in inclusion requests when LetsEncrypt added rate limits based on eTLDs. (2) is obviously bad and there's really no other justification for these sites being in the PSL. Therefore I think it's reasonable for PSL to deny inclusion requests that are solely for PCM reasons. This all being said, the PSL is a massive hack [1] and really needs to be replaced by something else. It probably is about time for these companies to invest in a replacement. [1]: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems
- 6y ago

rectang 6y ago

PSL: Public Suffix List https://publicsuffix.org/ https://publicsuffix.org/ > A "public suffix" is one under which Internet users can (or historically could) directly register names. Some examples of public suffixes are .com, .co.uk and pvt.k12.ma.us. The Public Suffix List is a list of all known public suffixes. > The Public Suffix List is an initiative of Mozilla, but is maintained as a community resource.

lmb 6y ago

Seems like the right move from a volunteer run project, what will the future will hold though? Artificial scarcity is always a problem. On another note, for just 20k$ I can offer you exclusive use of the xxgfzrf.dinglebop.me Public Suffix so that you can keep tracking your users. Please reach out to sales@example.com if you are interested.

dialtone 6y ago
It's interesting because being added to the PSL reduces your ability to track users. So yeah, I have a bridge to sell you, interested?
- djrogers 6y ago
  > being added to the PSL reduces your ability to track users Not really, in fact it can increase your ability to track users if it's (ab)used in specific ways - see use case #2 and #3 here: https://github.com/privacycg/private-click-measurement/issues/78#issuecomment-814498256 https://github.com/privacycg/private-click-measurement/issue...
  - dialtone 6y ago
    There's an approval process to be added to the PSL so abuses would be quite surprising and easy to remove when discovered.
    - iudqnolq 6y ago
      This entire discussion is literally about how that's not the case.
devrand 6y ago
To make things worse, it's basically impossible to remove a domain from the PSL as no one knows how software built against the PSL would handle it. A removal could break tremendous amount of software that people rely on.

kristofferR 6y ago

Is this actually a problem? From the Github page it seems like the rate of invalid inclusion requests is very low, less than one per day: https://github.com/publicsuffix/list/pulls?q=label%3Awontfix+ https://github.com/publicsuffix/list/pulls?q=label%3Awontfix...

kelnos 6y ago
That's not the issue; addition requests volume has suddenly gone way up because of this new Apple policy, and the volunteers that run the PSL are not prepared for it.

manzu 6y ago

I’m just here to point the finger at Facebook, or anyone, for finding this workaround of declaring your legitimate website as a domain suffix just for tracking entropy purposes this is so laughable. like my ford fiesta identifies as an apache attack helicopter

tick_tock_tick 6y ago
Apple is the one that declared this list to be the source of truth. Facebook is just information customers of Apple's decision.......

varispeed 6y ago

To be honest Facebook should offer a tracking free version with paid subscription. It is not acceptable that the only way to use Facebook and contact your family is to sacrifice your own and theirs privacy. When are we going to have a regulator step in and tackle this? It doesn't seem that GDPR has helped much, so I think more radical steps are needed. Such tracking that is being done online would be illegal offline (stalking), so I don't see how long this is going to go. It's not sustainable.

echelon 6y ago
iPhone users are probably among Facebook's most valuable advertising demographic (ie. lots of disposable income). Apple's decisions to block tracking are hurting them in a big way, and offering a paid subscription probably won't seem attractive to users if Facebook prices it at the full value lost. We've trained people that everything is free. We can't get away from that now that the genie is out of the bottle. Furthermore, people might just decide Facebook isn't worth it for them at the level of functionality they provide. As more churn happens, the overall value of the network decreases. Apple just checkmated Facebook.
- dialtone 6y ago
  This has nothing to do with tracking to target ads. Facebook doesn't need Apple to execute that, people share data with FB voluntarily. This is about measuring the impact of advertising while following a standard published by Apple itself and covering the usecase of big marketplaces with sub stores in it.
PeterisP 6y ago
I don't think that such a paid subscription would be feasible. Facebook currently earns more than 150 $/year on ads for each of their US/Canada user on average; and iPhone users who would be willing to pay for such services probably are worth more than the average, so the appropriate market-determined fee to replace invasive ad targeting would be quite large. I don't think people would be willing to pay for tracking-free Facebook more than they pay for Netflix.

kogir 6y ago

Isn’t the easiest solution here for companies to register their own domain? Why be company.service.tld and not just company.tld? What are these businesses doing for email?

mrweasel 6y ago
In this case I think the issue is trackers. If you owned a retargeting or tracking service, you might have customer1.retargetting.com and customer2.retargetting.com. Apple will now see these as being the same site, unless individually registered in PSL. This limits the amount of data that can be aggregated by retargetting.com, unless each subdomain is added to PSL.
- 3np 6y ago
  I think this is it - the only "small businesses" I see being actually hurt (as opposed to slightly inconvenienced) by this would be retargeting and tracking companies.
donmcronald 6y ago
Yes, it is. The main reason I can think of for using subdomains would be for super low value content that isn’t worth $10-30 / year for a real domain. There could also be a setup / maintenance angle I guess. Specifying a big list of custom domains is more work than *.example.com.
- mangosquash 6y ago
  I work on digital advertising for a franchise where each individual store manages their own shopify site at location.franchise.com. Soon, these sites won't be able to run ads that track purchases, unless franchise.com is added to this list. I understand the PSL managers' position that this is an unfair burden to place on them though.
  - local_dev 6y ago
    >these sites won't be able to run ads that track purchases Isn't that part of the purpose of the changes that Apple is making? As a user, this seems like a great change. Less tracking is a positive.

deleted 6y ago

[deleted]

irrational 6y ago

>PSL is maintained by volunteers and there should be zero expectation of turnaround times on PR (and a respect for the labor burden shifted onto them by orgs using PSL as a bozofilter) What is to stop Facebook from assigning an engineering team to act as volunteers so the turnaround time drops to zero?

seoaeu 6y ago
Um, because those engineers don't have commit access to the repository? You can't just hire an engineering team and take over any open source project you want.
- irrational 6y ago
  Oh, I was assuming the engineering team would lie a pretend like they did not work for Facebook. I assumed they would slowly work to gain the confidence of those in control and little by little they gain the access they required themselves. Maybe they could pretend not to know each other and use that to their advantage. Surely a company with the resources of Facebook could manufacture fake alternate lives for the engineering team to make them look completely legitimate and harmless.
  - willxinc 6y ago
    Do you mean Apple, whose usage of the PSL caused this?
    - irrational 6y ago
      No, Facebook. Facebook is telling companies to use the PSL. The PSL people are saying, “we give no guarantees about how long it will take us to add a domain to the PSL”. They could drag their feet so long as to make the PSL useless. To make sure it works, I could see Facebook wanting to get some of their people into position so that they can immediately approve PRs on the PSL. I can’t think of any reason Apple would want to support the PSL.

sergiotapia 6y ago

So much brain power and work wasted on this ad bullshit

amelius 6y ago
Yes and ads also stimulate over-consumption which hurts the planet. The solution is to block all ads, or even better, ban them.

layoutIfNeeded 6y ago

Why are we using a centralized list for determining who's an eTLD and who's not? Why don't we store this metadata in the actual DNS records?

pornel 6y ago

Reminder that the Public Suffix List is a non-scalable hack, and platforms should be reducing their reliance on it, not increase it: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems

dwaite 6y ago
It doesn't really propose an alternative to the PSL for 'same site' behavior, instead just pushes for 'same origin' (aka exact match) behavior. I would agree that e.g. Apple would be better to support both same-site and same-origin, and say, clobber PCM if it receives a request for one after it has already received a request for the other.

towaytie4567 6y ago

As an aside, it's insane that decisions of such import are being made by folks working at a couple of large US companies. This is going to impact users and small businesses across the world. Where is the representation from African/Indian/Chinese businesses and technologists? This would require the big tech cos to truly be interested in "diversity" of course, instead of the lip-service they pay to it in practice.

Aissen 6y ago

It's past time we use a better solution for the PSL side-effects (cookies partitionning, TLD detection) than a centralized list. A dedicated DNS record comes to mind.