7 ms·

> The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm. That's not the case, cont

> The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm. That's not the case, contrary to what Hacker News wants you to think with this massive opt-out campaign. FLoC cohort computation is only planned to include websites that themselves request cohort information. Unless your page calls document.interestCohort, it is not included in cohort computation [1]. The opt-out header does nothing unless you use FLoC. There is an exception to this made for the pilot phase (aka. right now), where in order to bootstrap the system Google is extending cohort computation to include "all websites that show ads" [2]. My guess is that this is necessary so that early testers get useful data. This is not something that seems to be planned past the pilot. The standard also restricts this to only "while 3rd party cookies are still a thing". Disclaimer: I work for Google, but not on advertising or Chrome. This is all from public information I researched in my own time. [1] https://wicg.github.io/floc/#compute-eligibility https://wicg.github.io/floc/#compute-eligibility §7.1.1 "By default, a page is eligible for the interest cohort computation if the interestCohort() API is used in the page." [2] https://wicg.github.io/floc/#adoption-phase https://wicg.github.io/floc/#adoption-phase §7.1.4 "at the adoption phase, the page can be eligible to be included in the interest cohort computation if there are ads resources in the page, OR if the API is used."

falcolas 5y ago
> There is an exception to this made for the pilot phase So all websites are, in fact, included by default.
- delroth 5y ago
  > if there are ads resources in the page Please read the full comment (or preferably, the standard) before spreading FUD.
  - falcolas 5y ago
    Whether ads are being loaded is being determined by an opaque, ever-changing algorithm implemented in a closed source browser. We have no way to verify that this is how it's actually working, or when it will change. That doesn't even include how a good majority of the internet is monetized by ads, often Google's ads. It's simply safest to assume that every page will be included.
    - mdaniel 5y ago
      I don't think calling Chrome a closed source browser is accurate unless you have a citation showing that Chromium is missing this code Microsoft Edge is a closed source browser, for comparison
      - falcolas 5y ago
        Chrome is a closed-source fork of Chromium that applies numerous proprietary patches to Chromium. There's no way to tell what has been modified in that process (short of decompilation, et.al.). Pretty much the same process that Microsoft takes with Edge, really.
      - nerdponx 5y ago
        I don't think calling Chrome a closed source browser is accurate unless you have a citation showing that Chromium is missing this code That's completely backwards. You would need some evidence showing that Chrome does not include proprietary patches, otherwise you pretty much have to conclude that it's closed-source, even if it includes a large % of code from an open-source product.
  - matkoniecz 5y ago
    Is it well defined what "ads resources" is?
    - delroth 5y ago
      It doesn't seem to be defined in the standard, but it's partially documented in Chromium's docs how they determine what is an ad resource: https://chromium.googlesource.com/chromium/src/+/master/docs/ad_tagging.md https://chromium.googlesource.com/chromium/src/+/master/docs... https://chromium.googlesource.com/chromium/src.git/+/master/components/subresource_filter/README.md https://chromium.googlesource.com/chromium/src.git/+/master/... https://chromium.googlesource.com/chromium/src.git/+/master/components/subresource_filter/FILTER_LIST_GENERATION.md https://chromium.googlesource.com/chromium/src.git/+/master/... This seems to indicate the authoritative source of truth is EasyList. On my current machine, the list seems to be stored in "~/.config/google-chrome/Subresource Filter/Unindexed\ Rules/9.22.0" and should be easily inspectable. I don't know if I've missed some documentation pointers related to this.
      - matkoniecz 5y ago
        It is kind of hilarious that they use antitracking resource as part of their new malware infrastructure.
captaincaveman 5y ago
So only if the publisher opts-in (sort of), and what about the user, if this is all done client side surely I should be opt out by default too? I assume I can set my browser to opt out easily?
- delroth 5y ago
  I haven't heard about a global opt-out in the browser, but I haven't really looked for that info either. I think I've heard Chrome allows extensions to "easily" hook document.interestCohort and return any value the user wants (including random values). The standard also mentions "The user agent should offer a dedicated permission setting for the user to disallow sites from being included for interest cohort calculations." but that's only for blocking specific sites from contributing to cohort computations, not for disabling globally.

falcolas 5y ago

> There is an exception to this made for the pilot phase So all websites are, in fact, included by default.

delroth 5y ago
> if there are ads resources in the page Please read the full comment (or preferably, the standard) before spreading FUD.
- falcolas 5y ago
  Whether ads are being loaded is being determined by an opaque, ever-changing algorithm implemented in a closed source browser. We have no way to verify that this is how it's actually working, or when it will change. That doesn't even include how a good majority of the internet is monetized by ads, often Google's ads. It's simply safest to assume that every page will be included.
  - mdaniel 5y ago
    I don't think calling Chrome a closed source browser is accurate unless you have a citation showing that Chromium is missing this code Microsoft Edge is a closed source browser, for comparison
    - falcolas 5y ago
      Chrome is a closed-source fork of Chromium that applies numerous proprietary patches to Chromium. There's no way to tell what has been modified in that process (short of decompilation, et.al.). Pretty much the same process that Microsoft takes with Edge, really.
    - nerdponx 5y ago
      I don't think calling Chrome a closed source browser is accurate unless you have a citation showing that Chromium is missing this code That's completely backwards. You would need some evidence showing that Chrome does not include proprietary patches, otherwise you pretty much have to conclude that it's closed-source, even if it includes a large % of code from an open-source product.
- matkoniecz 5y ago
  Is it well defined what "ads resources" is?
  - delroth 5y ago
    It doesn't seem to be defined in the standard, but it's partially documented in Chromium's docs how they determine what is an ad resource: https://chromium.googlesource.com/chromium/src/+/master/docs/ad_tagging.md https://chromium.googlesource.com/chromium/src/+/master/docs... https://chromium.googlesource.com/chromium/src.git/+/master/components/subresource_filter/README.md https://chromium.googlesource.com/chromium/src.git/+/master/... https://chromium.googlesource.com/chromium/src.git/+/master/components/subresource_filter/FILTER_LIST_GENERATION.md https://chromium.googlesource.com/chromium/src.git/+/master/... This seems to indicate the authoritative source of truth is EasyList. On my current machine, the list seems to be stored in "~/.config/google-chrome/Subresource Filter/Unindexed\ Rules/9.22.0" and should be easily inspectable. I don't know if I've missed some documentation pointers related to this.
    - matkoniecz 5y ago
      It is kind of hilarious that they use antitracking resource as part of their new malware infrastructure.

captaincaveman 5y ago

So only if the publisher opts-in (sort of), and what about the user, if this is all done client side surely I should be opt out by default too? I assume I can set my browser to opt out easily?

delroth 5y ago
I haven't heard about a global opt-out in the browser, but I haven't really looked for that info either. I think I've heard Chrome allows extensions to "easily" hook document.interestCohort and return any value the user wants (including random values). The standard also mentions "The user agent should offer a dedicated permission setting for the user to disallow sites from being included for interest cohort calculations." but that's only for blocking specific sites from contributing to cohort computations, not for disabling globally.