4 ms·

That is the problem of the ad network. If they have to deal with fraud then find a way to solve this but not at the cost of everyone.

charcircuit 5y ago
The problem with abuse is not special to ad networks. All sites (once they reach a certain size) have to deal with it. Surveillance is needed to handle abuse of your service.
- danbruc 5y ago
  Surveillance is needed to handle abuse of your service. Provide one example that can not be solved without surveillance.
  - charcircuit 5y ago
    Let's say you run a website with a sign on page. In order to log in a user typically you will run the password through an algorithm like argon2. Verifying a password for an account consumes CPU resources. A malicious may decide to DOS your site by just spamming this endpoint with bogus password to make you waste your time. An easy fix with surveillance is to rate limit people based off their IP address. Without surveillance though there is not much you can do. Scale up your infrastructure to try and out scale the attack? Implement a global rate limit that locks regular users from being able to sign in?
    - danbruc 5y ago
      Is is not surveillance - at the very least not in the relevant sense - if you maintain a temporary list of IPs you have seen in the past minute or hour. This is your best argument why we have to track and profile every human on the planet around the clock?
      - charcircuit 5y ago
        >if you maintain a temporary list of IPs you have seen in the past minute or hour. This is totally surveillance. Just because we delete data after a while, it doesn't mean I didn't surveil you, nor does it mean I haven't used that data I got from you for my own benefit. >This is your best argument why we have to track and profile every human on the planet around the clock? You just asked for an example. If you are suggesting that my argument is to prevent abuse of systems I would say that it justifies tracking every person on the planet.
        danbruc 5y ago
        This is totally surveillance. It is not. I connected from some IP because I wanted to use your website, at the very least you have to remember my IP address for some time to send me your website back. And if I want to access your website and it will be only available if you store my IP address for a few minutes to fight off attacks, then this is a use of my IP address that I welcome because it is for my benefit. And if you really want to, just store hashes of the IP addresses [1]. Just because we delete data after a while, it doesn't mean I didn't surveil you [...] Sure, surveillance is not defined by the amount of time you store some data. If you store my shipping address for years it is not surveillance, if you store my IP address for one second to add an entry to my record in your database that I just visited the website it might be surveillance even if you do not permanently record my IP address. But I never claimed that the amount of time you store some information is a or the relevant criterion [...] nor does it mean I haven't used that data I got from you for my own benefit. Also irrelevant. If you store my IP address for a short time or my shipping address for a long time in order to send me the website I requested or my order than this benefits you because you will make some profit from my order. Relevant for whether something is surveillance or not is whether I approve what you are doing. If you track my position day and night in order to show me ads for businesses nearby it is surveillance unless I specifically requested this. If you track my position because I am using a fitness app and requested to record my run, then it is not surveillance. [1] For IPv4 this is of course essentially pointless. But maybe you could come up with a more elaborate schema than simple hashes, maybe salt them and rotate the salt every few minutes or whatever. But you will probably not gain much besides added complexity.
    - buran77 5y ago
      If someone abuses your doorbell the solution isn't to install a hidden DNA and body scanner in front of your door. Also suggesting that an IP based rate limiter is the same as the surveillance in question is very disingenuous. Pick a more sensitive area than your IDE, say medicine targeting erectile dysfunction, sexual or religious preferences, etc. You may find that being allowed to collect that data, especially covertly, just to save some money suddenly doesn't look reasonble at all. But surely I should be allowed to covertly collect any data about you if it enables some savings for me. After 15 comments insiting it's OK you should only approve of this.
      - charcircuit 5y ago
        >If someone abuses your doorbell the solution isn't to install a hidden DNA and body scanner in front of your door. The first thing I would do is look outside to collect information on who in outside thereby infringing their privacy. >Also suggesting that an IP based rate limiter is the same as the surveillance in question is very disingenuous Recording people's IPs is definitely surveillance. >say medicine targeting erectile dysfunction, sexual or religious preferences, etc. We may be able to connect drug sellers or churches with people if we know that information. >But surely I should be allowed to covertly collect any data about you if it enables some savings for me. Sure you can. Go ahead.
        dkshdkjshdk 5y ago
        > The first thing I would do is look outside to collect information on who in outside thereby infringing their privacy. Looking at someone doesn't infringe on their privacy. Taking a picture of that someone and storing it in a permanent fashion, might. To prevent abuse/DOS you only need to do the first (which does not constitute "surveillance" or loss of privacy), not the second. > Recording people's IPs is definitely surveillance. It's not surveillance if you are not tracking anything else other than IPs (i.e. no other behavioural data associated to it). Either way, you still have not provided an example where surveillance is required to prevent abuse: I can simply store hashes of "bad IPs" (or ASNs) to blacklist... no need to store any information that could lead to an actual person (like an actual IP address).
    - coder543 5y ago
      An IP address being used in the course of providing the service is not surveillance. That's like saying "Amazon knowing where to ship my package is surveillance." It's a bad argument, in my opinion. Regardless, consider a DDoS attack. If every new request is coming from a different IP address, how do you continue providing service to your legitimate customers while blocking that malicious attack? Knowing the attacker's IP addresses doesn't do you any good... because they can just keep using new IP addresses, and blocking the old ones doesn't do any good. This is where heavily surveillance-based systems like Google CAPTCHA often come into play, and I have very mixed feelings about those. There are some non-surveillance-based captchas like this one[0] that I saw on HN awhile back, and I hope those become successful. [0]: https://friendlycaptcha.com/ https://friendlycaptcha.com/
      - charcircuit 5y ago
        >That's like saying "Amazon knowing where to ship my package is surveillance." To complete the metaphor Amazon would use the address you gave them to help improve their business in some sense without asking you if it's okay. Similar to how web masters don't ask if it's okay if they write what pages we access into logs is okay. >Knowing the attacker's IP addresses doesn't do you any good... because they can just keep using new IP addresses, and blocking the old ones doesn't do any good. Then we should try to find any patterns with the traffic that we can use to try and filter it out. This is a place where fingerprinting is useful. >friendlycaptcha This just slows down bot spam instead of testing if someone is a bot. Someone posting spam to your site once a minute is still annoying.
        coder543 5y ago
        I've read your other replies to this thread and your argument does not seem to be made in good faith. This whole thread is about surveillance based advertising being bad. In no way is using an IP address in a firewall a form of surveillance. It isn't. The IP address isn't being associated with any other data, it's just some numbers floating in space, disconnected from any human being. There is no association with that IP address of what you like and don't like, what you have purchased, what links you have clicked, or anything else. It's just in a firewall, and that firewall rule could be blocking an entire CIDR block, especially in the case of IPv6. But even if it were surveillance, that's irrelevant to this discussion about the ethics of surveillance-based advertising. I'm not going to waste my time further on this thread after making this one last point. > This just slows down bot spam instead of testing if someone is a bot. Someone posting spam to your site once a minute is still annoying. Google CAPTCHA is trivially bypassed all the time. Do you really think it isn't? Sometimes using services like Amazon Mechanical Turk, sometimes using simple computer vision. It doesn't test whether someone/something is a bot either... it just tests whether they can pass the CAPTCHA. It certainly doesn't test whether they're part of a DDoS, nor does it test their intentions to find whether they are good or malicious. It's just a CAPTCHA, but it also uses a lot of surveillance... and as I said, I have mixed feelings about that. I didn't mean for this to become the point of the thread, it is definitely off topic. The idea of Proof of Work CAPTCHAs is that you can actually make it more expensive for an attacker to solve those than it would be for the attacker to solve Google CAPTCHAs. Obviously, this is still an area of debate and research.

charcircuit 5y ago

The problem with abuse is not special to ad networks. All sites (once they reach a certain size) have to deal with it. Surveillance is needed to handle abuse of your service.

danbruc 5y ago
Surveillance is needed to handle abuse of your service. Provide one example that can not be solved without surveillance.
- charcircuit 5y ago
  Let's say you run a website with a sign on page. In order to log in a user typically you will run the password through an algorithm like argon2. Verifying a password for an account consumes CPU resources. A malicious may decide to DOS your site by just spamming this endpoint with bogus password to make you waste your time. An easy fix with surveillance is to rate limit people based off their IP address. Without surveillance though there is not much you can do. Scale up your infrastructure to try and out scale the attack? Implement a global rate limit that locks regular users from being able to sign in?
  - danbruc 5y ago
    Is is not surveillance - at the very least not in the relevant sense - if you maintain a temporary list of IPs you have seen in the past minute or hour. This is your best argument why we have to track and profile every human on the planet around the clock?
    - charcircuit 5y ago
      >if you maintain a temporary list of IPs you have seen in the past minute or hour. This is totally surveillance. Just because we delete data after a while, it doesn't mean I didn't surveil you, nor does it mean I haven't used that data I got from you for my own benefit. >This is your best argument why we have to track and profile every human on the planet around the clock? You just asked for an example. If you are suggesting that my argument is to prevent abuse of systems I would say that it justifies tracking every person on the planet.
      - danbruc 5y ago
        This is totally surveillance. It is not. I connected from some IP because I wanted to use your website, at the very least you have to remember my IP address for some time to send me your website back. And if I want to access your website and it will be only available if you store my IP address for a few minutes to fight off attacks, then this is a use of my IP address that I welcome because it is for my benefit. And if you really want to, just store hashes of the IP addresses [1]. Just because we delete data after a while, it doesn't mean I didn't surveil you [...] Sure, surveillance is not defined by the amount of time you store some data. If you store my shipping address for years it is not surveillance, if you store my IP address for one second to add an entry to my record in your database that I just visited the website it might be surveillance even if you do not permanently record my IP address. But I never claimed that the amount of time you store some information is a or the relevant criterion [...] nor does it mean I haven't used that data I got from you for my own benefit. Also irrelevant. If you store my IP address for a short time or my shipping address for a long time in order to send me the website I requested or my order than this benefits you because you will make some profit from my order. Relevant for whether something is surveillance or not is whether I approve what you are doing. If you track my position day and night in order to show me ads for businesses nearby it is surveillance unless I specifically requested this. If you track my position because I am using a fitness app and requested to record my run, then it is not surveillance. [1] For IPv4 this is of course essentially pointless. But maybe you could come up with a more elaborate schema than simple hashes, maybe salt them and rotate the salt every few minutes or whatever. But you will probably not gain much besides added complexity.
  - buran77 5y ago
    If someone abuses your doorbell the solution isn't to install a hidden DNA and body scanner in front of your door. Also suggesting that an IP based rate limiter is the same as the surveillance in question is very disingenuous. Pick a more sensitive area than your IDE, say medicine targeting erectile dysfunction, sexual or religious preferences, etc. You may find that being allowed to collect that data, especially covertly, just to save some money suddenly doesn't look reasonble at all. But surely I should be allowed to covertly collect any data about you if it enables some savings for me. After 15 comments insiting it's OK you should only approve of this.
    - charcircuit 5y ago
      >If someone abuses your doorbell the solution isn't to install a hidden DNA and body scanner in front of your door. The first thing I would do is look outside to collect information on who in outside thereby infringing their privacy. >Also suggesting that an IP based rate limiter is the same as the surveillance in question is very disingenuous Recording people's IPs is definitely surveillance. >say medicine targeting erectile dysfunction, sexual or religious preferences, etc. We may be able to connect drug sellers or churches with people if we know that information. >But surely I should be allowed to covertly collect any data about you if it enables some savings for me. Sure you can. Go ahead.
      - dkshdkjshdk 5y ago
        > The first thing I would do is look outside to collect information on who in outside thereby infringing their privacy. Looking at someone doesn't infringe on their privacy. Taking a picture of that someone and storing it in a permanent fashion, might. To prevent abuse/DOS you only need to do the first (which does not constitute "surveillance" or loss of privacy), not the second. > Recording people's IPs is definitely surveillance. It's not surveillance if you are not tracking anything else other than IPs (i.e. no other behavioural data associated to it). Either way, you still have not provided an example where surveillance is required to prevent abuse: I can simply store hashes of "bad IPs" (or ASNs) to blacklist... no need to store any information that could lead to an actual person (like an actual IP address).
  - coder543 5y ago
    An IP address being used in the course of providing the service is not surveillance. That's like saying "Amazon knowing where to ship my package is surveillance." It's a bad argument, in my opinion. Regardless, consider a DDoS attack. If every new request is coming from a different IP address, how do you continue providing service to your legitimate customers while blocking that malicious attack? Knowing the attacker's IP addresses doesn't do you any good... because they can just keep using new IP addresses, and blocking the old ones doesn't do any good. This is where heavily surveillance-based systems like Google CAPTCHA often come into play, and I have very mixed feelings about those. There are some non-surveillance-based captchas like this one[0] that I saw on HN awhile back, and I hope those become successful. [0]: https://friendlycaptcha.com/ https://friendlycaptcha.com/
    - charcircuit 5y ago
      >That's like saying "Amazon knowing where to ship my package is surveillance." To complete the metaphor Amazon would use the address you gave them to help improve their business in some sense without asking you if it's okay. Similar to how web masters don't ask if it's okay if they write what pages we access into logs is okay. >Knowing the attacker's IP addresses doesn't do you any good... because they can just keep using new IP addresses, and blocking the old ones doesn't do any good. Then we should try to find any patterns with the traffic that we can use to try and filter it out. This is a place where fingerprinting is useful. >friendlycaptcha This just slows down bot spam instead of testing if someone is a bot. Someone posting spam to your site once a minute is still annoying.
      - coder543 5y ago
        I've read your other replies to this thread and your argument does not seem to be made in good faith. This whole thread is about surveillance based advertising being bad. In no way is using an IP address in a firewall a form of surveillance. It isn't. The IP address isn't being associated with any other data, it's just some numbers floating in space, disconnected from any human being. There is no association with that IP address of what you like and don't like, what you have purchased, what links you have clicked, or anything else. It's just in a firewall, and that firewall rule could be blocking an entire CIDR block, especially in the case of IPv6. But even if it were surveillance, that's irrelevant to this discussion about the ethics of surveillance-based advertising. I'm not going to waste my time further on this thread after making this one last point. > This just slows down bot spam instead of testing if someone is a bot. Someone posting spam to your site once a minute is still annoying. Google CAPTCHA is trivially bypassed all the time. Do you really think it isn't? Sometimes using services like Amazon Mechanical Turk, sometimes using simple computer vision. It doesn't test whether someone/something is a bot either... it just tests whether they can pass the CAPTCHA. It certainly doesn't test whether they're part of a DDoS, nor does it test their intentions to find whether they are good or malicious. It's just a CAPTCHA, but it also uses a lot of surveillance... and as I said, I have mixed feelings about that. I didn't mean for this to become the point of the thread, it is definitely off topic. The idea of Proof of Work CAPTCHAs is that you can actually make it more expensive for an attacker to solve those than it would be for the attacker to solve Google CAPTCHAs. Obviously, this is still an area of debate and research.