14 ms·
GitHub blocks FLoC across all of GitHub Pages
- flixic 6y agoRemarkably short blog post. I would have appreciated a "why", to help build the voice of opposition. Also, what about github.com itself?
- progval 6y ago> Also, what about github.com itself? Shouldn't matter. FLoC isn't enabled if they don't use the `document.interestCohort()` API and if Chromium doesn't detect ads; at least for now. https://seirdy.one/2021/04/16/permissions-policy-floc-misinfo.html https://seirdy.one/2021/04/16/permissions-policy-floc-misinf...
- bugmen0t 6y agoIt would be if an (advertisement) iframe did, no?
- paultopia 6y agoThis is a bit confusing. That post seems to suggest that (1) adding the header is not necessary to prevent one's site from "leveraging" floc, ie, identifying users, unless one already runs ads, and hence (2) that the header isn't necessary in most cases. But it also says: What adding this header does is exclude your website from being used when calcualting a user’s cohort. A cohort is an identifier shared with a few thousand other users, calculated locally from browsing history; sites that send this header will be excluded from this calculation. The EFF estimates that a cohort ID can add up to 8 bits of of entropy to a user’s fingerprint. Being excluded from cohort calculation has a chance to place a user in a different cohort, altering a user’s fingerprint. This new fingerprint may or may not have more entropy than the one derived without being excluded. But is individual fingerprinting really the concern? What if I don't want google clustering people who visit my page with people who visit similar pages? In they case, the header still helps protect their privacy, right? By making Google's website visit interest based clustering less substantively accurate? Or am I misunderstanding how floc works?
- SamBam 6y agoI'm also interested in understanding this. My company is a non-profit and doesn't serve ads on our website. Should we ensure this header exists for our site?
- merb 6y agoyes
- Seirdy 6y ago(Am author) Google's FLoC cohorts are determiend by browsing history. If your page is excluded thereby giving other pages a higher weight, it doesn't necessarily reduce the bits of entropy in a user's fingerprint. Cohorts will still have roughly the same number of people and thus make it about as easy to identify users. If you add the header to your site, do it for the right reason. It could mess with unsophisticated ad targeting, but it won't necessarily make a difference wrt. privacy. Energy is better spent getting users off of any browser that supports FLoC (Chrome, probably Chromium too).
- paultopia 6y agoI guess the question here is what you mean by "privacy." It seems to me that privacy goes beyond merely avoiding the risk of fingerprinting, or individualized identification. Collective identification is also a privacy problem: if I get advertisements targeted at people with similar political beliefs to mine because I've labelled as a member of a cohort that has visited a cluster of X-leaning news sites, that seems objectionable independent of whether the owner of some website can also distinguish me as an individual from every other member of the cohort.
- youngtaff 6y agoYeh, but what happens when Google Analytics adds `document.interestCohort` and ~90% of the web get opted in?
- shawnz 6y agoIf you are already embedding Google Analytics on your page, then surely all bets are off for your users' privacy?
- SamBam 6y agoYes, but aren't they different? If we have GA, we're getting some information and Google is getting some information, but are they sharing this information about users directly with advertisers? The premise of FLoC is that they are explicitly tagging you in a group specifically for advertisers.
- youngtaff 6y agoIt's not just GA though it's any analytics or other 3rd-party that decides it wants to collect the cohort data
- nnamtr 6y ago> Also, what about github.com itself? Don't ask, try it. curl says: permissions-policy: interest-cohort=()
- darkcha0s 6y agoFWIW the duckduckgo extension already shows the github.com website as tracker free, so they take a pretty strong stance on privacy. I think the why (ie. why does github take this stance on user pages) is pretty self explanatory in this situation.
- jgrahamc 6y ago$ curl -o /dev/null -v https://github.com/ 2>&1 | grep permissions-policy < permissions-policy: interest-cohort=()
- est31 6y agoBtw you can do this much shorter with the curl -I parameter which lists the return headers.
- jgrahamc 6y agoShows how often I use curl.
- johncolanduoni 6y agoThat also causes curl to change the underlying request to a HEAD request. Though according to the spec they should return the same headers, it’s not uncommon for sites to fail to do so (some web frameworks leave this responsibility to the user) or to cache these responses differently. Personally I reflexively use the verbose version they used for these kind of investigations of server behavior after being bit a few times.
- StavrosK 6y agoSame here, I thought it caused cURL to do a GET request and throw away the body, but it doesn't, and I've gotten different results more than once.
- ocdtrekkie 6y agoIt's not really a blog post, even though it's pushed out over their "blog" endpoint. This post is part of https://github.blog/changelog/ https://github.blog/changelog/ which tends to lean closer to the "git commit message" length than blog post length. Just a statement of changes they've made users may notice or be affected by.
- sanxiyn 6y agoThanks GitHub. Much appreciated.
- _Understated_ 6y agoI've read recently about a fair few sites and browsers and whatnot that are not going to play along with FLOC. Out of curiosity, what would be the kind of figure that would make Google stop using it? I mean, at what point does the data from a smaller pool become useless? Any ideas?
- Kovah 6y agoI don't think that any decent figure would make Google stop using it. Floc is their try on locking more and more vendors in their ad ecosystem, it makes Google the superior ad provider because they now have an even bigger (and more unfair) advantage over other providers. My hypothesis: if you are blocking floc, you are not really dependent on Google's ad system, neither as a website hosting ads, nor being found through ads. Unfortunately, Google owns too much of the ad market and too many vendors are already dependent on Google.
- geerlingguy 6y agoJust quit using Chrome and advocate for others to do the same. It's toxic to the web at this point.
- encryptluks2 6y agoJust like Microsoft building their own browser and then adopting Chromium, before long they'll be adopting FLoC.
- darkcha0s 6y ago>good news post about something MSFT owned on HN >comment(s) about how MSFT is inherently evil and doesn't deserve credit The HN cycle continues.
- j4yav 6y agoDon’t forget meta comments about the grim predictability of it all, also an important part of the ecosystem.
- omneity 6y agoThis just made me realize something: Once a pattern becomes a meme (or close), it becomes possible to notice a higher level meta pattern which itself becomes memetized ad infinitum(?). I predict the parent observation will itself eventually become a meme to be "complained" about. Maybe this one too.
- prepend 6y agoAnd of course we must consider the meta comments complaining about the meta comments. These all contribute to the je ne sais quoi of HN.
- numpad0 6y agoIs hn crowd trying to manipulate M$...
- severino 6y agoYou forgot a third one: > hn users trying to discredit the commenter and telling us the "new" Microsoft is so cool, like if we owed anything to them
- BelenusMordred 6y ago
- lucideer 6y ago> Pages sites using a custom domain will not be impacted. Not sure what % of Github Pages use custom domains but this appears to leave no mechanism for custom domains to optionally enable this header either. I don't really understand the motivation here; if it was for the benefit of GH users, why wouldn't that apply to custom domain users? Is it purely to hamper Google (as Microsoft's competitor)?
- gmueckl 6y agogithub.com is itself a social network and a tracker. They should know a lot more about the status and activities of the software projects hosted there and the users than the users themselves do. Enabling third parties to track users across their site would be the equivalent of opening the lid of this treasure chest.
- lucideer 6y agoOh no, I do understand that. It's just the excluding custom domains part I don't get. Why not keep Google out of all their data: why give them a portion?
- HDMI_Cable 6y agoI've never thought of GitHub like that, but it makes so much sense. With all of the features (like the commit heat-map), GitHub is at this point 2 parts social network, and 2 parts social network for software.
- vbsteven 6y agoThere could be a technical reason for it not to be available for custom domains (yet?). The page mentions that the header is set for all pages served by github.io, which leads me to believe they add the header on the reverse-proxy/loadbalancer side for github.io pages. Custom domains most likely use separate proxy/loadbalancing infrastructure where the same change could take longer to implement, or they might be exploring options to make it configurable.
- madeofpalk 6y agoMaybe there was more of a privacy concern they wanted to address by removing it from the github.io subdomains.
- nindalf 6y agoThe internet is split roughly into 3. The top 100 websites get a third of the page views, the remaining top 10k get another third and millions of websites get the last third. The top 100 have dedicated engineering and policy teams teams that will disable FLoC because they're either not interested in ads (Wikipedia) or have their own first party implementation that doesn't need FLoC (Facebook). They'll ditch FLoC. The next 10k might have engineering teams that can make the change, but might be more interested in finding out about their audience so they can monetize more easily. They'll keep FLoC. As for the remaining millions, only a tiny minority of them will even know this is a thing, let alone care enough to make the change or contact a developer who can do it. These are the folks who have hosted their wordpress site with GoDaddy because it was cheap and quick when they needed a site. They'll keep FLoC. So the upshot is that github.com, instagram.com and amazon.com might opt out, but the vast majority of the web will not. Me prediction is that at least half of all web pages loaded by users won't have this header.
- dmitriid 6y agoCan't remember what article it was, but I remember that Facebook didn't even care about "top companies with top ads". The long tail trumped anything. I wouldn't be surprised if it's the same in Google's case. A dozen big-name websites drop FLOC? Who cares, there's a billion more.
- PeterisP 6y agoIMHO it's far more unbalanced than "The top 100 websites get a third of the traffic, the remaining top 10k get another third and millions of websites get the last third." Purely from data traffic, youtube and netflix already get a third of the traffic (and that's just 2, not 100); and purely from pageview perspective, the top social media sites plus major media sites (again, a subset of the top100) get more than half IIRC. I wouldn't be surprised if the top 100 websites get 80% of the traffic, the remaining top 10k get 10% and all the millions of other sites get the last 10%.
- deleted 6y ago[deleted]
- 6y ago
- pmurt7 6y agoI have just switched to Brave (this browser blocks FLoC across all the web). I regret no trying this browser earlier. Also this IPFS stuff seems very interesting (kind of Bittorrent for the web).
- Tom4hawk 6y agoFLoC is basically something implemented in a browser. Why website owner should be bothered by it? If client decided to use browser with FLoC than it's their decision. The only interesting thing might be to inform user that they are using shitty browser that doesn't respect their privacy and make sure that website works in other browsers. What if Google decides that they will ignore that header? Is there anything preventing them from doing that? Do we know why they decided to even implement this "workaround" with header?
- eCa 6y ago> If client decided to use browser with FLoC than it's their decision. For lots of people that’s not the case. Their work mandates which browser they can use, which is (partialy) why it took so long for IE to go away.
- GordonS 6y ago> If client decided to use browser with FLoC than it's their decision Is it an informed decision? Most normal users use Chrome because "everyone else does", and won't even have a clue what FLoC is.
- littlestymaar 6y ago> Most normal users use Chrome because "everyone else does", and won't even have a clue what FLoC is. “Because it was installed on my machine bundled with some third-party software” is also a big factor (but obviously, nobody will give you this answer, because they don't even know where Chrome came from)
- Tom4hawk 6y agoIt's definitely not an informed decision. That's why I mentioned that you can inform your users about this issue. I just think that this decision should not belong to webmasters/site-owners.
- GordonS 6y agoI certainly do see your point here. But the reality is that Google doesn't have users' best interest at heart, and is not going to be the one to responsibly inform user so they can make an informed decision on their own.
- thinkingemote 6y agoHas anyone done the calculation of the amount of energy (and therefore co2) used and extra bandwidth cost for adding the opt-out header to most of the internet's traffic? As I understand it, every response in a page has to have the header, not just a containing html or an initial options.
- HDMI_Cable 6y agoI don't think it will be that much (spoiler alert: I was wrong), because only a negligible amount of web traffic will be the headers themselves vs. web--pages and streamed content. And the FLoC header itself will be a very small part of that header, maybe 40 bytes. Those 40 bytes could fit in a singular packet. So, at most, FLoC will add 1 packet per header. I don't know how many headers are sent total each day, but I remember reading that the average person visits 100 websites per day (including reloads). Out of 4 billion people who use the internet, we're talking about 400 Billion response headers per day. Assuming that each opt out of FLoC (a portion of this is Google, so that's unlikely), that means that an extra 400 Billion * 40 Bytes need to be sent. This is about 16 Trillion extra bytes that need to be sent (16E13). I've just checked, and it seems that the average Google Search is about 125kb, and I found that each releases approx. 7gCO2. So dividing this out, each kilobyte of traffic releases 0.056 grams of CO2. For each byte, that would be 0.000056 (5.6E-5) grams. Multiplying that out by the 16 Trillion extra bytes, you have 8.96 Million (896E7) grams of CO2, or an extra 8960 tons of CO2 per day. So, I was totally wrong. Jeez, that's a lot of CO2. But, my calculations were a badly-estimated, worst-case scenario. Also, since less websites will have third-party cookies as a result of this, we would have to subtract those now gone emissions. But, this is still a lot more CO2 than I expected, even if it was counteracted.
- swyx 6y agoalright 41 comments and everyone seems to know what FLoC is so i’ll be that guy. What is FLoC and whats the big deal? I googled https://www.theverge.com/2021/3/30/22358287/privacy-ads-google-chrome-floc-cookies-cookiepocalypse-finger-printing https://www.theverge.com/2021/3/30/22358287/privacy-ads-goog... and it seems like an attempt by Google to add proprietary cohort based tracking to replace third party cookies. well intentioned but could have flaws. anything else i should know?
- JackC 6y agoI like the EFF's explainer: https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...
- the_lonely_road 6y agoIf you want to learn what Floc is for the first time you probably shouldn't start with an article titled "Google’s FLoC Is a Terrible Idea". I also don't know what it is but will just wait for a more neutral source hopefully.
- hungryforcodes 6y agoMind you from the EFF, I'll take it.
- Igelau 6y agoStill holding out for an article about the benefits of Covid before you find out what that is?
- wccrawford 6y agoI don't care if I'm tracked by advertisers, and I'm also not advertising, so I guess I'm pretty neutral? FLoC is Google's new way to target "cohorts" of users with advertising. The idea is that Google will classify each user into a cohort (and that classification will change over time as the user visits more web pages, and perhaps other data is acquired) and only that cohort is reported to the advertiser, which can then use it to serve appropriate ads. On the flip side, this is obviously still targeted advertising, and some people have a strong negative outlook towards that idea in general. Also, it's been said that if you can manage to track a person across just a few cohort changes, you can personally identify them, which is contrary to the entire idea about FLoC protecting a person's privacy. In short, proponents think it's better than tracking cookies, and opponents think it's still privacy invasion, and not much better than tracking cookies.
- blantonl 6y agoFYI, if you are like me that has no idea what FLoC is until now, please see: https://github.com/WICG/floc https://github.com/WICG/floc
- tester34 6y ago>Federated Learning of Cohorts is there some competition where people try to come up with names as tricky as possible while being nowhere even close to simple english?
- nerdponx 6y agoSounds like a machine learning term that escaped from researchers into the wild. Machine learning people like to make up fun names for otherwise complicated and hard-to-summarize methods. See eg "BERT". The name is actually descriptive. It is an algorithm for constructing semantically interesting cohorts of similar users, Locally on each user's machine. It's actually a really good idea and certainly a lot more "privacy preserving" than anything that relies on sending fine-grained user data back to a central server for processing. Of course there are problems with it, and I'm mixed as to whether it's something that non-Chrome browsers should even try to support. The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm. But the name makes sense and I think the core idea is a step in the right direction.
- delroth 6y ago> The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm. That's not the case, contrary to what Hacker News wants you to think with this massive opt-out campaign. FLoC cohort computation is only planned to include websites that themselves request cohort information. Unless your page calls document.interestCohort, it is not included in cohort computation [1]. The opt-out header does nothing unless you use FLoC. There is an exception to this made for the pilot phase (aka. right now), where in order to bootstrap the system Google is extending cohort computation to include "all websites that show ads" [2]. My guess is that this is necessary so that early testers get useful data. This is not something that seems to be planned past the pilot. The standard also restricts this to only "while 3rd party cookies are still a thing". Disclaimer: I work for Google, but not on advertising or Chrome. This is all from public information I researched in my own time. [1] https://wicg.github.io/floc/#compute-eligibility https://wicg.github.io/floc/#compute-eligibility §7.1.1 "By default, a page is eligible for the interest cohort computation if the interestCohort() API is used in the page." [2] https://wicg.github.io/floc/#adoption-phase https://wicg.github.io/floc/#adoption-phase §7.1.4 "at the adoption phase, the page can be eligible to be included in the interest cohort computation if there are ads resources in the page, OR if the API is used."
- ourmandave 6y agoThis EFF article explains FloC pretty well. https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-... tl;dr; 3rd party cookies are dying so google has come up with this way to replace them. EFF says 3rd party cookies suck but the choice shouldn't be a those or FLoC. How about neither where the user decides what to share, with who, and when.
- hnbad 6y agoThis isn't meant as a dunk on MSFT but it's worth keeping in mind that MSFT owns GitHub before celebrating this as GitHub taking a stance. MSFT, FB and Google all heavily employ "analytics", although to slightly different degrees and in different forms. Them not cooperating is a good thing, but not surprising enough to warrant celebration.
- kseistrup 6y agoFLoC ought to be opt-in, not opt-out.
- jackson1442 6y agoFrom what I've heard elsewhere on hn, only sites that use `document.interestCohort()` contribute to a FLoC identifier.
- ttt0 6y agoWhich can be done by any of the dozens of obfuscated javascript files people embed on their websites for some reason.
- rogual 6y agoIt's exciting when the megacorps make these kinds of plays against each other. I feel like I'm watching my abusive partner get smacked in the mouth by my abusive ex.
- hashkb 6y agoYes, the title should be "Microsoft blocks FLoC..."
- commandertso 6y agoYou mock my FLoC, I’ll clean your clock! With apologies to Bill Watterson
- oblio 6y agoWhat's FLoC?
- brianzelip 6y agoHow to set this header if you use a custom domain with gh pages?
- severak_cz 6y agoI actually have an idea for browser extension: implement document.interestCohort() and return some useless junk or better fake data (e.g. this user cats pictures and nothing else). However I run into that there is no documentation of how cohort ID is specified. This lead to another question - how are ad companies supposed to actually target their audience with it if there is no translation between cohorts and target groups? (I assume Google already has some translation)
- jefftk 6y ago> how are ad companies supposed to actually target their audience with it if there is no translation between cohorts and target groups? Even as an opaque identifier it's still useful. Imagine you run a store and you log the FLoC cohorts of your customers. You could then target ads at the most common cohorts you've seen as a way to say "show my ads to more people similar to my existing customers". (Disclosure: I work on ads at Google, speaking only for myself)
- jerrygoyal 6y agoFloC can be disabled at browser level also. Check if your browser has FloC enabled: https://amifloced.org https://amifloced.org
- supergirl 6y agodoes FLOC even follow EU laws? it's tracking without consent right? it's basically a cookie that you can never delete?
- morganms 6y agoI've made a tool to check if a site blocks FLoC: https://ewatchers.org/floc?lang=en https://ewatchers.org/floc?lang=en
- heywherelogingo 6y agoBut it's not a problem, right? Because we've had countless conversations about google and chrome, discussed them ad nauseam, and we're so sick of this tedious, incessant topic that we've all stopped using chrome, right? Except for, yes, yes, the people who have to use it at work, but who don't use it at home, right? Floc is only a problem if you deserve it.
- deleted 6y ago[deleted]
- Kipters 6y agoIs there any browser extension to automatically disable FLoC on every visited site?
- flixic 6y agoDuckDuckGo made one. https://spreadprivacy.com/block-floc-with-duckduckgo/ https://spreadprivacy.com/block-floc-with-duckduckgo/
- WorldMaker 6y agoSwitch to Firefox?
- Kipters 6y agoI've been using Firefox exclusively for the past 6 years, but I know people who don't want to switch from Chrome (less and less luckily)
- coldpie 6y agoUse a browser that isn't made by an ad company.
- yewenjie 6y agoI have been seeing a lot of FLoC articles recently. Can someone please ELI5 for me what FLoC is and why is it bad?
- joana035 6y agoMicrosoft is pushing for their own version of FLoC AFAIK
- skaul 6y agoIn case folks are interested, I wrote an open source Chrome extension that removes the FLoC API on every page load so websites can't get your FLoC cohort ID: https://chrome.google.com/webstore/detail/floc-block/amoljnglfkpjdjhmeaocffefmhppmane https://chrome.google.com/webstore/detail/floc-block/amoljng...
- 29athrowaway 6y agoLet's expand the title a bit: Iteration #1: Microsoft blocks FLoC across all of GitHub Pages. Iteration #2: Microsoft blocks Google's FLoC across all of GitHub Pages.
- captaincaveman 6y agoIf FLoC is opt out by default as many here claim, is this news saying that Github did nothing? Also if it is opt-out by default I guess it will be simple to see who has opted-in, a nice list of shame. Does this circumvent the EU cookie laws?
- soheil 6y agoFor those who want to know why FLoC may be a bad idea see https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-... How much monopolistic behavior does Google have to engage in before antitrust laws have enough teeth? It also seems to me that Google has been more aggressive in its monopolistic behavior in different areas the more there is talks of regulations raining down on it. Maybe they know the end is near and are trying to get away with as much as possible before that happens.
- Havoc 6y agoI wonder if floc can be selectively enabled to distort results. Eg only for cat videos