6 ms·

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many time

> FLoC is premised on a compelling idea: enable ad targeting without exposing users to risk The second you open your browser you are exposed to risk. Many times I have had to tweak the default settings of my browser to comply with my (non paranoid) requirements. Basic things like putting DuckDuckGo as the default search engine, turning off various JS APIs like HTML5 Canvas, WebGL, using AD-blockers and other addons, tweaking about:config and hardening it, etc Call me a power user if you want, but all this hardening stuff should ship out-of-the-box.

SimeVidas 5y ago
> all this hardening stuff should ship out-of-the-box. I mean, Brave kinda does that. It’s much more “hardened” by default.
- LeoPanthera 5y ago
  "No, you shouldn't use Brave": https://web.archive.org/web/20210531085250/https://aspenuwu.me/blog/dont-use-brave/ https://web.archive.org/web/20210531085250/https://aspenuwu....
slver 5y ago
Disabling canvas...
vlovich123 5y ago
The funny thing is that customizing your browser in this way can be its own kind of fingerprint.
- tylersmith 5y ago
  That's the number 1 reason it should be the default.
  - freebuju 5y ago
    Not happening. All those anti-tracking measures break websites more often than not.
    - kevin_thibedeau 5y ago
      They break sites that are broken by design. If a site isn't usable with html and css it's the devs fault. They don't get to dictate my browser's capability or assume I don't have special accessibility needs.
    - throwaway2048 5y ago
      "more often than not" is a vast overstatement, it breaks a tiny handful of sites at best.
    - wearywanderer 5y ago
      That is flat wrong in my experience. I browse with javascript and CSS both disabled by default, using uMatrix. Only a minority of sites I browse require me to whitelist JS or CSS; maybe 1-in-10. Most newspapers and blogs do not require JS or CSS.
      - pabs3 5y ago
        I note that uMatrix is archived, do you have a plan for when it stops working? (I'm also a user)
        wearywanderer 5y ago
        I fear I don't. Probably I'll end up using the web in general a lot less.
- ______- 5y ago
  Yes but disabling JS as a default wipes out whole classes of attacks against your browser. On top of disabling JS, just a simple AD blocker like uBlock Origin greatly diminishes the amount of profiling. There is no silver bullet however. It depends on your threat model. If you really don't want to be tracked and profiled, using the Tor Browser Bundle is worthwhile, but even that is problematic since it's heavily surveilled (both at the entry node and exit nodes).
passivate 5y ago
Realistically, can you ship a website where everything happens client side? - reflow, adjusting layout, computing locations/sizes and whatnot. I am not a web person so my thinking may be outdated on this. I'm imagining something like a stand-alone self-contained "docker" type thing.
- freeone3000 5y ago
  That's how most websites work. The JavaScript code that runs on the browser then reports back to a server, because it makes money for the people who wrote the app.
  - passivate 5y ago
    Yeah, I meant without the 'reporting back to a server'. Like for e.g., the website sends a 'package' to the browser - The package is built on the fly and contains all the dependencies. The package is then unarchived and files are opened in the browser w/o the server being involved.
    - yoz-y 5y ago
      That is the standard static html + css + JavaScript without further requests. Aka Web 1.0. (Should you make all in one page with inline images that is)
    - freeone3000 5y ago
      Then how are the people who wrote the app supposed to make money by selling your personal information to advertisers?
thanhhaimai 5y ago
Opinions are my own. I'm not sure if we're being led to focus on a wrong problem. I hate intrusive Ads as much as everyone else. However, it's not only that "when you open your browser, you are exposed to risk". It's also: - Every time you use Windows (without turning off all the bad settings) - Every time you connect to a Cell tower (telcos openly sell your location data) - Every time you use your credit cards Now, I'm not saying those are OK, or to justify intrusive Ads. However, I see a magnitude difference in the "violation of my privacy" for the above cases. The media and certain communities keep focusing on Ads tech because it drives clicks. But then we let the Telcos, Insurance, and Credit Card companies establish a creeping normality on our privacy violation. We don't spend as much effort to stop Telco from directly selling our location data [1], but we have daily threads about companies indirectly use our location data for targeting Ads. Are we having our priority wrong? I couldn't shake the feeling that we're being led by a different narrative. The best situation of course is when we have good privacy laws and practices. However, focusing on the wrong priority like this is how we let other (much more severe) violators (Insurance, Telcos) get away with their creeping normality. [1] https://www.marketplace.org/2020/02/28/fcc-set-to-fine-big-telecom-companies-for-selling-location-data-is-200-million-enough/ https://www.marketplace.org/2020/02/28/fcc-set-to-fine-big-t...
- aboringusername 5y ago
  It doesn't matter anymore. The world is literally covered in tracking technologies from satellites orbiting the earth to radiowaves that are invisible to us but are monitoring our interactions within the world. By existing in 2021 (whether you use computers/tech or not) you need to accept your data will be collected, analyzed and sold. It will be leaked, combined/processed and abused in many different ways. I would be surprised if there was a single human on earth Facebook did not have a profile on at this point. I'd suspect the NSA can bring up the profiles of all 7 billion humans and recollect their entire lives from the digital/physical breadcrumbs they leave every day. Now that we can collect so much data, so rapidly (at the speed of light) and can analyze it in real time and store it forever it seems every digital application is focused on obtaining that valuable information and storing it to use in some way (usually, for profit). Even electric cars require apps and digital connectivity before they can be used/charged. Data is the new gold.

SimeVidas 5y ago

> all this hardening stuff should ship out-of-the-box. I mean, Brave kinda does that. It’s much more “hardened” by default.

LeoPanthera 5y ago
"No, you shouldn't use Brave": https://web.archive.org/web/20210531085250/https://aspenuwu.me/blog/dont-use-brave/ https://web.archive.org/web/20210531085250/https://aspenuwu....

slver 5y ago

Disabling canvas...

vlovich123 5y ago

The funny thing is that customizing your browser in this way can be its own kind of fingerprint.

tylersmith 5y ago
That's the number 1 reason it should be the default.
- freebuju 5y ago
  Not happening. All those anti-tracking measures break websites more often than not.
  - kevin_thibedeau 5y ago
    They break sites that are broken by design. If a site isn't usable with html and css it's the devs fault. They don't get to dictate my browser's capability or assume I don't have special accessibility needs.
  - throwaway2048 5y ago
    "more often than not" is a vast overstatement, it breaks a tiny handful of sites at best.
  - wearywanderer 5y ago
    That is flat wrong in my experience. I browse with javascript and CSS both disabled by default, using uMatrix. Only a minority of sites I browse require me to whitelist JS or CSS; maybe 1-in-10. Most newspapers and blogs do not require JS or CSS.
    - pabs3 5y ago
      I note that uMatrix is archived, do you have a plan for when it stops working? (I'm also a user)
      - wearywanderer 5y ago
        I fear I don't. Probably I'll end up using the web in general a lot less.
______- 5y ago
Yes but disabling JS as a default wipes out whole classes of attacks against your browser. On top of disabling JS, just a simple AD blocker like uBlock Origin greatly diminishes the amount of profiling. There is no silver bullet however. It depends on your threat model. If you really don't want to be tracked and profiled, using the Tor Browser Bundle is worthwhile, but even that is problematic since it's heavily surveilled (both at the entry node and exit nodes).

passivate 5y ago

Realistically, can you ship a website where everything happens client side? - reflow, adjusting layout, computing locations/sizes and whatnot. I am not a web person so my thinking may be outdated on this. I'm imagining something like a stand-alone self-contained "docker" type thing.

freeone3000 5y ago
That's how most websites work. The JavaScript code that runs on the browser then reports back to a server, because it makes money for the people who wrote the app.
- passivate 5y ago
  Yeah, I meant without the 'reporting back to a server'. Like for e.g., the website sends a 'package' to the browser - The package is built on the fly and contains all the dependencies. The package is then unarchived and files are opened in the browser w/o the server being involved.
  - yoz-y 5y ago
    That is the standard static html + css + JavaScript without further requests. Aka Web 1.0. (Should you make all in one page with inline images that is)
  - freeone3000 5y ago
    Then how are the people who wrote the app supposed to make money by selling your personal information to advertisers?

thanhhaimai 5y ago

Opinions are my own. I'm not sure if we're being led to focus on a wrong problem. I hate intrusive Ads as much as everyone else. However, it's not only that "when you open your browser, you are exposed to risk". It's also: - Every time you use Windows (without turning off all the bad settings) - Every time you connect to a Cell tower (telcos openly sell your location data) - Every time you use your credit cards Now, I'm not saying those are OK, or to justify intrusive Ads. However, I see a magnitude difference in the "violation of my privacy" for the above cases. The media and certain communities keep focusing on Ads tech because it drives clicks. But then we let the Telcos, Insurance, and Credit Card companies establish a creeping normality on our privacy violation. We don't spend as much effort to stop Telco from directly selling our location data [1], but we have daily threads about companies indirectly use our location data for targeting Ads. Are we having our priority wrong? I couldn't shake the feeling that we're being led by a different narrative. The best situation of course is when we have good privacy laws and practices. However, focusing on the wrong priority like this is how we let other (much more severe) violators (Insurance, Telcos) get away with their creeping normality. [1] https://www.marketplace.org/2020/02/28/fcc-set-to-fine-big-telecom-companies-for-selling-location-data-is-200-million-enough/ https://www.marketplace.org/2020/02/28/fcc-set-to-fine-big-t...

aboringusername 5y ago
It doesn't matter anymore. The world is literally covered in tracking technologies from satellites orbiting the earth to radiowaves that are invisible to us but are monitoring our interactions within the world. By existing in 2021 (whether you use computers/tech or not) you need to accept your data will be collected, analyzed and sold. It will be leaked, combined/processed and abused in many different ways. I would be surprised if there was a single human on earth Facebook did not have a profile on at this point. I'd suspect the NSA can bring up the profiles of all 7 billion humans and recollect their entire lives from the digital/physical breadcrumbs they leave every day. Now that we can collect so much data, so rapidly (at the speed of light) and can analyze it in real time and store it forever it seems every digital application is focused on obtaining that valuable information and storing it to use in some way (usually, for profit). Even electric cars require apps and digital connectivity before they can be used/charged. Data is the new gold.