4 ms·

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL

by jefftk 6y ago

Summary: Apple introduced PCM [1], and to keep people from using it for cross-site tracking it limits the bits available to a single site (as defined by the PSL). If shop-a.retail.example and shop-b.retail.example are completely separate, and don't want to compete for bits, Apple will still treat them as a single site unless retail.example is on the PSL. Being on the PSL is a big change (partitioned cookies, etc) but could be appropriate for different shops. FB issued guidance suggesting domains like retail.example consider getting themselves added to the PSL, and now the PSL (a volunteer project) is getting a lot of requests. The PSL project has put these requests on hold, and asked FB and Apple to work this out. FB is talking to Apple in https://github.com/privacycg/private-click-measurement/issues/78 https://github.com/privacycg/private-click-measurement/issue... [1] https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/ https://webkit.org/blog/11529/introducing-private-click-meas...

devrand 6y ago
It sounds like there's two cases: 1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM. 2. Sites that want to abuse an eTLD to do something like give all users on their social network a custom subdomain so that they're not polluting the same pool. -- I think it was actually reasonable for Apple to consider the PSL as it's basically the most comprehensive eTLD list that we have and would allow them to match browser behavior. The problem now is that case (1) is sending a bunch of requests at once as something will now actually break for these sites. Before now it was really just them being lax with security and not considering that cookies should be siloed. This isn't a unique situation btw, PSL also saw a large increase in inclusion requests when LetsEncrypt added rate limits based on eTLDs. (2) is obviously bad and there's really no other justification for these sites being in the PSL. Therefore I think it's reasonable for PSL to deny inclusion requests that are solely for PCM reasons. This all being said, the PSL is a massive hack [1] and really needs to be replaced by something else. It probably is about time for these companies to invest in a replacement. [1]: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems
- TechBro8615 6y ago
  Nice link to the GitHub issue which explains the problems clearly. Can anyone explain why something like this wasn't implemented in the first place via DNS TXT records or tied to SSL somehow?
  - deleted 6y ago
    [deleted]
  - gumby 6y ago
    > Can anyone explain why something like this wasn't implemented in the first place via DNS TXT records or tied to SSL somehow? The idea is to be able to use it without a network access, such as looking for unstructured URLs in text (e.g. "get a discount code at example.com/hn-reader"), formatting a URL in a browser bar (e.g. put the non-eDLD+1 in bold, or at least show the site name properly and not abbreviate all UK sites to "co.uk") or managing the cookie name properly (again, so everyone in co.uk doesn't share the same cookie). Presumption is that the eTLDs are a tiny fraction (by orders of magnitude) from the domains registered under them so this db doesn't have to get too large. I am not sure how to manage these strings automatically without them being spammed. They aren't all under the control of the TLD administrators (com.au is but cheapo-shop-hosting.com.au is not).
- merb 6y ago
  1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM. uff, well I did not know about that list and we have a domain that uses multi-tenacy. I mean I'm unsure to include it but it probably adds a security benefit, so that it is impossible to add bad cookies from subdomains. edit: can't add it anyway I'm not sure but our provider only allows to renew for 1 year (I'm not sure if that is a tld limit, since I also do not see other additional domains with de inside the list)
ghughes 6y ago
That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications: 1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains. 2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion process and institutes strict vetting to prevent abuse of PCM, which would presumably take months to implement. This looks like a serious design problem with no solution that could be implemented before ATT drops.
- donmcronald 6y ago
  The biggest problem is that no matter what “scale” of tracking is tolerable on a single domain / subdomain, Facebook still gets the aggregate. So if you fix it for small multi-tenant domains, nothing changes for Facebook and they still get all the aggregate data, right? There’s going to be a lot of collateral damage before ads and tracking get fixed IMO.
- cma 6y ago
  ATT?
  - Zelphyr 6y ago
    App Tracking Transparency
  - tony101 6y ago
    https://developer.apple.com/documentation/apptrackingtransparency https://developer.apple.com/documentation/apptrackingtranspa...
- 3np 6y ago
  > That would cause tremendous harm to all the small businesses who operate on subdomains of TLDs like myshopify, and for what? This was the giveaway that it was an FB person. Parts of that comment is verbatim from FB propaganda ads[0]. Maybe that awkward video from ~last month[1] was targeted more at aligning FB employees internally around the message, not the general public. [0] https://www.bloomberg.com/news/articles/2020-12-16/facebook-attacks-apple-s-ios-changes-in-full-page-newspaper-ads https://www.bloomberg.com/news/articles/2020-12-16/facebook-... [1] Which I can’t find now
wdb 6y ago
After limited reading on the subject only the quoted issue. Maybe shops like Etsy or Shopify should make tracking a premium benefit that is possible when getting your own domain :) Feels like a upsell opportunity to me

by jefftk 6y ago

devrand 6y ago

It sounds like there's two cases: 1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM. 2. Sites that want to abuse an eTLD to do something like give all users on their social network a custom subdomain so that they're not polluting the same pool. -- I think it was actually reasonable for Apple to consider the PSL as it's basically the most comprehensive eTLD list that we have and would allow them to match browser behavior. The problem now is that case (1) is sending a bunch of requests at once as something will now actually break for these sites. Before now it was really just them being lax with security and not considering that cookies should be siloed. This isn't a unique situation btw, PSL also saw a large increase in inclusion requests when LetsEncrypt added rate limits based on eTLDs. (2) is obviously bad and there's really no other justification for these sites being in the PSL. Therefore I think it's reasonable for PSL to deny inclusion requests that are solely for PCM reasons. This all being said, the PSL is a massive hack [1] and really needs to be replaced by something else. It probably is about time for these companies to invest in a replacement. [1]: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems

TechBro8615 6y ago
Nice link to the GitHub issue which explains the problems clearly. Can anyone explain why something like this wasn't implemented in the first place via DNS TXT records or tied to SSL somehow?
- deleted 6y ago
  [deleted]
- gumby 6y ago
  > Can anyone explain why something like this wasn't implemented in the first place via DNS TXT records or tied to SSL somehow? The idea is to be able to use it without a network access, such as looking for unstructured URLs in text (e.g. "get a discount code at example.com/hn-reader"), formatting a URL in a browser bar (e.g. put the non-eDLD+1 in bold, or at least show the site name properly and not abbreviate all UK sites to "co.uk") or managing the cookie name properly (again, so everyone in co.uk doesn't share the same cookie). Presumption is that the eTLDs are a tiny fraction (by orders of magnitude) from the domains registered under them so this db doesn't have to get too large. I am not sure how to manage these strings automatically without them being spammed. They aren't all under the control of the TLD administrators (com.au is but cheapo-shop-hosting.com.au is not).
merb 6y ago
1. Multi-tenant domains that probably should've always been in the PSL (ex. to provide cookie silos) but are only realizing now that they should be in it due to the arrival of PCM. uff, well I did not know about that list and we have a domain that uses multi-tenacy. I mean I'm unsure to include it but it probably adds a security benefit, so that it is impossible to add bad cookies from subdomains. edit: can't add it anyway I'm not sure but our provider only allows to renew for 1 year (I'm not sure if that is a tld limit, since I also do not see other additional domains with de inside the list)

ghughes 6y ago

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications: 1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains. 2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion process and institutes strict vetting to prevent abuse of PCM, which would presumably take months to implement. This looks like a serious design problem with no solution that could be implemented before ATT drops.

donmcronald 6y ago
The biggest problem is that no matter what “scale” of tracking is tolerable on a single domain / subdomain, Facebook still gets the aggregate. So if you fix it for small multi-tenant domains, nothing changes for Facebook and they still get all the aggregate data, right? There’s going to be a lot of collateral damage before ads and tracking get fixed IMO.
cma 6y ago
ATT?
- Zelphyr 6y ago
  App Tracking Transparency
- tony101 6y ago
  https://developer.apple.com/documentation/apptrackingtransparency https://developer.apple.com/documentation/apptrackingtranspa...
3np 6y ago
> That would cause tremendous harm to all the small businesses who operate on subdomains of TLDs like myshopify, and for what? This was the giveaway that it was an FB person. Parts of that comment is verbatim from FB propaganda ads[0]. Maybe that awkward video from ~last month[1] was targeted more at aligning FB employees internally around the message, not the general public. [0] https://www.bloomberg.com/news/articles/2020-12-16/facebook-attacks-apple-s-ios-changes-in-full-page-newspaper-ads https://www.bloomberg.com/news/articles/2020-12-16/facebook-... [1] Which I can’t find now

wdb 6y ago

After limited reading on the subject only the quoted issue. Maybe shops like Etsy or Shopify should make tracking a premium benefit that is possible when getting your own domain :) Feels like a upsell opportunity to me