5 ms·

> will disable FLoC because they're either not interested in ads (Wikipedia) Wikipedia does not need to take any action to disable FLoC; it's only active if th

by jefftk 6y ago

> will disable FLoC because they're either not interested in ads (Wikipedia) Wikipedia does not need to take any action to disable FLoC; it's only active if the site opts in, on a per-pageview basis: * If you call document.interestCohort() to get a FLoC id for a user, that pageview will be included in FLoC calculation. * For the origin trial, to deal with the chicken-and-egg problem, a pageview is included you load ads (determined with EasyList) See https://web.dev/floc/ https://web.dev/floc/ (Disclosure: I work on ads at Google, speaking only for myself)

detaro 6y ago
EasyList is extremely broad, changes frequently, and e.g. has included communities having banners for community events as ads, and Google appears to give zero promises on the stability of this. So relying on this requires continuous monitoring that Chrome doesn't randomly decide to tag something on some page as an ad, which is doing even more work just to cater to Google whims. Just blocking it is the sane choice here. since you say it is about "chicken-and-egg problem" during the trial: is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future?
- jefftk 6y ago
  > is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future? Not something as clear as I'd like. The closest I see is: A page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page loads ads or ads-related resources. -- https://web.dev/floc/#do-websites-have-to-participate-and-share-information https://web.dev/floc/#do-websites-have-to-participate-and-sh...
falcolas 6y ago
So, every page with ads (as determined by an opaque and ever-changing method in a closed source browser), will be included while computing the cohort. Got it. It seems safest to assume that "it happens on every page" since so much of the internet is monetized with ads. Please forgive us for not trusting Google's "we pinky swear it will change". We have no real reason to trust that Google will keep their word.
- jefftk 6y ago
  > every page with ads (as determined by an opaque and ever-changing method in a closed source browser) Chrome'a ad detection code is open source; https://chromium.googlesource.com/chromium/src/+/master/docs/ad_tagging.md https://chromium.googlesource.com/chromium/src/+/master/docs... is a good place to start.
  - falcolas 6y ago
    No, Chromium's ad detection code is open source. Chrome's is closed source. It may very well be the same code, but there is no (practical) way to verify that, other than trusting Google. But as I already indicated, I have trust issues with Google.
    - mcpherrinm 6y ago
      Reverse engineering of binaries is a well-understood field. Ensuring a binary and source code align is not a fully automated task at this time as far as I know, but is well within the capabilities of our industry.
      - falcolas 6y ago
        Capability and practicality are distinct concepts. Especially since it's fairly well known that Chrome will not align 100% with Chromium thanks to closed source additions and modifications, so it becomes a question of "what is different" instead of "are they different". It's certainly not practical for me, when I can just avoid chrome for personal usage (and I'm thankful for the capability). Of course, I can't avoid it entirely, thanks to my company deciding that Chrome is the only supported browser for our product. So even though FLoC is a non-issue for me personally, it is still something I need to worry about professionally.
cesarb 6y ago
> Wikipedia does not need to take any action to disable FLoC [...] If you call document.interestCohort() to get a FLoC id for a user It is still a problem for Wikipedia, because the global Javascript for each language is editable by a subset of the editors for that language (https://en.wikipedia.org/wiki/MediaWiki:Common.js https://en.wikipedia.org/wiki/MediaWiki:Common.js for instance), unlike the HTTP headers which can only be changed by the Wikimedia sysadmins.
- jefftk 6y ago
  If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is a far bigger risk than that they might add a call to document.interestCohort() and opt that page into FLoC?
  - vineyardmike 6y ago
    Does Google Analytics do this?
    - jefftk 6y ago
      Sorry, what are you asking?
      - vineyardmike 6y ago
        Google Analytics is arbitrary JS and JS can turn on floc... so using GA is a potential point to add you to floc. Obviously its probably a small overlap of "doesn't trust floc" and "still trusts GA" but still a Trojan horse. PS. Wow kudos for being so responsive, especially/despite less than stellar comments regarding your openness about working for G-Ads.
        jefftk 6y ago
        It doesn't look like Google Analytics does this today: $ curl -sS https://www.google-analytics.com/analytics.js \ | grep interestCohort [no results] On the other hand, I could imagine them or other analytics services adding it since sites installing analytics services generally want to be able to slice their traffic by as many dimensions as possible. I would hope that any service considering reading FLoC implements it as opt-in, however, since sites probably didn't consider whether their pages are sensitive in choosing whether to add analytics (though perhaps they should have!) (Still speaking only for myself)
drcongo 6y ago
> Disclosure: I work on ads at Google Can I ask why? I honestly can't understand how anyone could.
- edoceo 6y ago
  money.
- jefftk 6y ago
  I think advertising is positive [1] and the role of ads in funding freely-available sites is very important. My current work is primarily on how browsers can allow more private and secure advertising [2][3][4] which I think most people will agree is valuable even if they are less in favor of advertising in general. At a lower level, I do this job because I'm paid, which allows me to donate. [5] But I wouldn't do this work if I thought it was harmful; there are lots of different kinds of jobs I could take. [1] https://www.jefftk.com/p/effect-of-advertising https://www.jefftk.com/p/effect-of-advertising [2] https://github.com/google/fledge-shim https://github.com/google/fledge-shim [3] https://github.com/WICG/turtledove/issues/161 https://github.com/WICG/turtledove/issues/161 [4] https://github.com/WICG/webpackage/issues/624 https://github.com/WICG/webpackage/issues/624 [5] https://www.jefftk.com/donations https://www.jefftk.com/donations
  - tedivm 6y ago
    Google, and it's method for advertising, basicaly destroyed the news industry. If you don't think your work is harmful it simply means you haven't looked into the repercussions enough.
    - nindalf 6y ago
      Internet advertising and the internet in general has made newspapers less profitable. But this was happening regardless of what Google did. 92% of the decline came from loss of classified revenue (https://mumbrella.com.au/de-classified-what-really-happened-to-newspapers-641959 https://mumbrella.com.au/de-classified-what-really-happened-...). Obviously it makes no sense to vilify Craigslist, because someone else would have provided free, searchable classifieds if Craigslist hadn't. That's the nature of the internet, which has reduced the cost of publishing to nearly nothing. A parallel to the demise of the newspaper classifieds is the once thriving industry of people who would copy books by hand in the 14th century. Then Gutenberg created a printing press that could make copies of books in a fraction of the time. Life didn't get better for those folks who's skills were no longer needed, but maybe it did for society as a whole. But for sure it didn't and doesn't make sense to vilify people who work at printing presses. You're looking for a "bad guy" when maybe none exists.

by jefftk 6y ago

detaro 6y ago

EasyList is extremely broad, changes frequently, and e.g. has included communities having banners for community events as ads, and Google appears to give zero promises on the stability of this. So relying on this requires continuous monitoring that Chrome doesn't randomly decide to tag something on some page as an ad, which is doing even more work just to cater to Google whims. Just blocking it is the sane choice here. since you say it is about "chicken-and-egg problem" during the trial: is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future?

jefftk 6y ago
> is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future? Not something as clear as I'd like. The closest I see is: A page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page loads ads or ads-related resources. -- https://web.dev/floc/#do-websites-have-to-participate-and-share-information https://web.dev/floc/#do-websites-have-to-participate-and-sh...

falcolas 6y ago

So, every page with ads (as determined by an opaque and ever-changing method in a closed source browser), will be included while computing the cohort. Got it. It seems safest to assume that "it happens on every page" since so much of the internet is monetized with ads. Please forgive us for not trusting Google's "we pinky swear it will change". We have no real reason to trust that Google will keep their word.

jefftk 6y ago
> every page with ads (as determined by an opaque and ever-changing method in a closed source browser) Chrome'a ad detection code is open source; https://chromium.googlesource.com/chromium/src/+/master/docs/ad_tagging.md https://chromium.googlesource.com/chromium/src/+/master/docs... is a good place to start.
- falcolas 6y ago
  No, Chromium's ad detection code is open source. Chrome's is closed source. It may very well be the same code, but there is no (practical) way to verify that, other than trusting Google. But as I already indicated, I have trust issues with Google.
  - mcpherrinm 6y ago
    Reverse engineering of binaries is a well-understood field. Ensuring a binary and source code align is not a fully automated task at this time as far as I know, but is well within the capabilities of our industry.
    - falcolas 6y ago
      Capability and practicality are distinct concepts. Especially since it's fairly well known that Chrome will not align 100% with Chromium thanks to closed source additions and modifications, so it becomes a question of "what is different" instead of "are they different". It's certainly not practical for me, when I can just avoid chrome for personal usage (and I'm thankful for the capability). Of course, I can't avoid it entirely, thanks to my company deciding that Chrome is the only supported browser for our product. So even though FLoC is a non-issue for me personally, it is still something I need to worry about professionally.

cesarb 6y ago

> Wikipedia does not need to take any action to disable FLoC [...] If you call document.interestCohort() to get a FLoC id for a user It is still a problem for Wikipedia, because the global Javascript for each language is editable by a subset of the editors for that language (https://en.wikipedia.org/wiki/MediaWiki:Common.js https://en.wikipedia.org/wiki/MediaWiki:Common.js for instance), unlike the HTTP headers which can only be changed by the Wikimedia sysadmins.

jefftk 6y ago
If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is a far bigger risk than that they might add a call to document.interestCohort() and opt that page into FLoC?
- vineyardmike 6y ago
  Does Google Analytics do this?
  - jefftk 6y ago
    Sorry, what are you asking?
    - vineyardmike 6y ago
      Google Analytics is arbitrary JS and JS can turn on floc... so using GA is a potential point to add you to floc. Obviously its probably a small overlap of "doesn't trust floc" and "still trusts GA" but still a Trojan horse. PS. Wow kudos for being so responsive, especially/despite less than stellar comments regarding your openness about working for G-Ads.
      - jefftk 6y ago
        It doesn't look like Google Analytics does this today: $ curl -sS https://www.google-analytics.com/analytics.js \ | grep interestCohort [no results] On the other hand, I could imagine them or other analytics services adding it since sites installing analytics services generally want to be able to slice their traffic by as many dimensions as possible. I would hope that any service considering reading FLoC implements it as opt-in, however, since sites probably didn't consider whether their pages are sensitive in choosing whether to add analytics (though perhaps they should have!) (Still speaking only for myself)

drcongo 6y ago

> Disclosure: I work on ads at Google Can I ask why? I honestly can't understand how anyone could.

edoceo 6y ago
money.
jefftk 6y ago
I think advertising is positive [1] and the role of ads in funding freely-available sites is very important. My current work is primarily on how browsers can allow more private and secure advertising [2][3][4] which I think most people will agree is valuable even if they are less in favor of advertising in general. At a lower level, I do this job because I'm paid, which allows me to donate. [5] But I wouldn't do this work if I thought it was harmful; there are lots of different kinds of jobs I could take. [1] https://www.jefftk.com/p/effect-of-advertising https://www.jefftk.com/p/effect-of-advertising [2] https://github.com/google/fledge-shim https://github.com/google/fledge-shim [3] https://github.com/WICG/turtledove/issues/161 https://github.com/WICG/turtledove/issues/161 [4] https://github.com/WICG/webpackage/issues/624 https://github.com/WICG/webpackage/issues/624 [5] https://www.jefftk.com/donations https://www.jefftk.com/donations
- tedivm 6y ago
  Google, and it's method for advertising, basicaly destroyed the news industry. If you don't think your work is harmful it simply means you haven't looked into the repercussions enough.
  - nindalf 6y ago
    Internet advertising and the internet in general has made newspapers less profitable. But this was happening regardless of what Google did. 92% of the decline came from loss of classified revenue (https://mumbrella.com.au/de-classified-what-really-happened-to-newspapers-641959 https://mumbrella.com.au/de-classified-what-really-happened-...). Obviously it makes no sense to vilify Craigslist, because someone else would have provided free, searchable classifieds if Craigslist hadn't. That's the nature of the internet, which has reduced the cost of publishing to nearly nothing. A parallel to the demise of the newspaper classifieds is the once thriving industry of people who would copy books by hand in the 14th century. Then Gutenberg created a printing press that could make copies of books in a fraction of the time. Life didn't get better for those folks who's skills were no longer needed, but maybe it did for society as a whole. But for sure it didn't and doesn't make sense to vilify people who work at printing presses. You're looking for a "bad guy" when maybe none exists.