17 ms·

A privacy war is raging inside the W3C

376 points by bpierre 5y ago

nokya 5y ago
What it says: "a privacy war is raging inside the W3C. What I read: "why you should keep your ad-blockers and script-blockers properly configured and updated".
MeteorMarc 5y ago
It seems only fair that big tech engineers also feel the pain of idyllic places on the internet being overrun by commercial interests.
ricopags 5y ago
A small side note in case anyone from protocol.com is reading: In chrome, with adblock disabled, unable to click the button to sign up for email list.
- the-dude 5y ago
  This must be the most positive HN comment about sign up CTAs ever.
- amberj8 5y ago
  I have Firefox, ghostery, adblock, and no 3rd party cookies and I get a completely blank page.
tomc1985 5y ago
I don't care how big this man's business is, Rosewell is a parasite bent on preserving the established order of datamining the shit out of everyone for his own personal profit. He is gumming up the works with pointless philosophical bloviating, using the anti-big-tech argument as a cudgel of convenience for bludgeoning a nascent privacy movement that has taken decades to get off the ground. I've sat in a large audience hall listening to assholes like these guys talk about their businesses, and when they are called out publicly for not caring about individual privacy and desire not to be tracked, and they shrug their shoulders. He and the rest of this datamining gold rush needs to be stopped.
- mistrial9 5y ago
  agree with the sentiment but the vulgarity dilutes the weight of the message.. centuries of privacy rights are drained and drowning right now IMO
  - You-Are-Right 5y ago
    The vulgarity of the choosen life path of some people can not be matched by any words.
  - tomc1985 5y ago
    My vulgarity is an expression of frustration in their overall apathy to the consequences of their actions. Forcing people to smother their feelings in the name of 'genteel' discussion does a disservice to those who feel oppressed or misheard. Some things in this world are quite ugly and it is important to portray them as such. Perhaps you should evaluate why you let mere words affect you so much.
    - andrewzah 5y ago
      I agree with you on vulgarity but life isn't really fair about this. Just like how wearing a suit unfairly makes a presentation more potent than casual wear. It is what it is. Being vulgar (even if technically justified) weakens the message for many people, especially when the other party is very polite and professional in return. edit: I would prefer if people weren't like that, but that's just one of the many flaws that humans have. Trying to change that instead of acknowledging it and adapting is an exercise in frustration. I'm not "affected by mere words", but I do prefer well worded arguments to mere expletives. And I'm not alone in that.
      - tomc1985 5y ago
        I understand your point but I think that emotional suppression is a much greater crime than failing to be polite. After all, politeness has quite a storied history in being used to suppress and control people that are used to being 'othered', many of which feel things that are much stronger than I am expressing here
3gg 5y ago
I thought Korean soap operas were good until I read this article. What a whole bunch of unnecessary drama. The W3C always appeared to be one of the most dysfunctional entities in existence, and now the article leaves no question as to why. Funny this Rosewell guy. "Should web browsers really become implementation mechanisms of specific government regulation?" -- Isn't everything a mechanism of specific government regulation? We seem to have an autocrat in the making here who would prefer the Web existed in isolation of civilization and where he could squeeze out that ad cash unhindered by government regulations. Given that he likes to ask philosophical questions, perhaps he could ask himself why the Web is being regulated in the first place. It's also funny how in the article, the only people who seem to actually care about privacy are the non-profits advocating for it and the government regulators fighting antitrust.
- pdonis 5y ago
  > Isn't everything a mechanism of specific government regulation? Um, no?
  - haecceity 5y ago
    GDPR?
    - EGreg 5y ago
      Ah yes that is everything !
  - 3gg 5y ago
    Sorry, I did not mean that literally. Point is Rosewell wants to preserve the status quo for his own personal benefit and, unsurprisingly, any kind of legislation that attempts to constrain his greed appears to him as an inconvenience.
    - pdonis 5y ago
      > Point is Rosewell wants to preserve the status quo for his own personal benefit and, unsurprisingly, any kind of legislation that attempts to constrain his greed appears to him as an inconvenience. I agree with this.
tenebrisalietum 5y ago
Want a Web run by human beings again? Want tracking methods impossible to implement in any meaningful fashion by design? Try Gemini. Gemini is here and can be used TODAY. https://gemini.circumlunar.space/ https://gemini.circumlunar.space/ The only thing standing between you and the next web is... a lot, but try it anyway, things have to start somewhere.
- cusenses 5y ago
  What prevents Gemini from being taken over and utilized just like the current web has been?
  - hkt 5y ago
    Governance is the only thing that can. There are no technical measures that can prevent it.
  - skymt 5y ago
    The Gemini protocol is intended to exclude features that could be used for tracking. It has no cookies, user-agent, referer, etc and the protocol is not extensible enough that such features could be easily added. Also, frankly, the spartan design of native Gemini pages (very limited formatting, no scripts or even inline images!) means that the circle of nerds who use Gemini will almost certainly remain too small to catch the eye of ad-tech. It's hostile to commerce in a way I find kind of delightful. https://gemini.circumlunar.space/docs/faq.gmi https://gemini.circumlunar.space/docs/faq.gmi
    - cesarb 5y ago
      > It has no cookies, user-agent, referer, etc and the protocol is not extensible enough that such features could be easily added. For now. The original HTTP (now retroactively called HTTP/0.9) also had none of these, and also wasn't extensible enough; it had no headers at all, just the verb (GET) and the path. Yet somehow, it was later extended to include all of these. > very limited formatting, no scripts or even inline images! The original HTML was also like that, even inline images came later.
baybal2 5y ago
Another thing are all kinds of standard boards, and committees like IETF, W3C, IEEE becoming very secretive themselves. A decade, or more ago IEEE had a rule that anything said in a standard board meeting cannot be be expected to not be public, or be subject to any disclosure limit post-factum. In 2019, after years of relentless pressure from Google, Cisco, Amazon, the rule was effectively reversed, and now IEEE standard board meetings can be made super duper secret, so members can now conspire to break antitrust laws in every imaginable way in complete privacy, free of recordings, and stenography.
tannhaeuser 5y ago
> On the other side are companies that use cross-site tracking for things like website optimization and advertising, and are fighting for their industry's very survival. That includes small firms like Rosewell's, but also giants of the industry, like Facebook. The Rosewell guy may not be a saint, but omitting Google from the list as the ones standing to win from privacy features, through ga and the usage they have over the Web via Chrome anyway is completely missing the point of a single party having monopolistic control over click data. Can't also agree with the characterization of the W3C in TFA.
- IX-103 5y ago
  How does Google win? Their business is search -- advertising on other sites is more of a side gig for them, and from their own description of their privacy sandbox, even they would not be able to track people across sites. The changes to the web platform necessary to protect user privacy will require reinventing the industry (which will naturally pick winners and losers). I expect that Google will come out in the end doing well, but that's not because they have a competitive advantage here, but instead because these changes don't really affect their core business (at least no where near as much as the proliferation of paywalls and app-ification have).
  - rdsnsca 5y ago
    Googles business is advertising.. take away their ad revenue and see what happens to them.
    - IX-103 5y ago
      Yes, but their business is search advertising. You can get really good targeting with just 1st party data (what the current user has searched for). That's completely different from display advertising. For most sites on the web there's not enough information about a user's interests on that site alone to get a lot of different bidders for the ad slot. Fewer bidders generally means the a list auction price, so less money for the publisher.
otterley 5y ago
In this story: engineers can't come to a conclusion because they are trying to solve a political problem instead of an engineering problem.
- IX-103 5y ago
  Better summary: Browser companies try to implement X individually. Browser developers get together and try to standardize a way to do X. Other people come and complain why they aren't doing Y or Z instead. Eventually all the extra people are talking so loudly that no one can work on X.
- salawat 5y ago
  It's the song that never ends/ it just goes on and on/ my friend...
coldtea 5y ago
W3C being basically Google and a couple of other 10000-pound gorilla companies at this point...
- IX-103 5y ago
  Is Mozilla also one of the 10000 pound Gorillas?
  - wvenable 5y ago
    In comparison, Mozilla is just a 1,087 pound Gorilla.
    - IX-103 5y ago
      Really? I've been following along some of the W3c work on privacy and they seem to have about as much political power there as Apple. Part of that seems to be from their first-mover advantage in the privacy space relative to Microsoft or Google, but the rest seems to be because they aren't seen as acting in their own interests (like say Google or Apple). As an aside: In some ways it's kind of funny to hear a bunch of engineers talk about technology while all casting shade at the other participant's motivations.
  - otterley 5y ago
    Wait till you find out where most of Mozilla's funding comes from! (Hint: it starts with a G and rhymes with frugal.)
- eqvinox 5y ago
  Well, the gorillas chose to come to a table and open a discussion. These decisions might as well be made in closed rooms at Google and Mozilla, and there wouldn't be much you could do about it. By the power of browser market share, they could just skip W3C and implement whatever they want. What they'd get away with is only limited by the point where someone with a different agenda starts funding their own browser fork (and can convince users to use it.)
marketingtech 5y ago
It's easy to mock the pettiness of all parties described here, and it's common for people on this forum to take absolutist stances with regards to privacy/advertising, but it's also important to recognize that these arguments will actually define the future of the internet for the average user. There are trillion dollar companies on both sides of the argument, and their eventual compromise will establish the defaults for billions of users. There are also two fundamental components of the Big Tech debate at odds with each other here - privacy and competition. Increasing privacy decreases competition by strengthening the Big Tech companies that engage with users at the platform/browser/OS/hardware level. See: Google's removal of third-party cookies from Chrome in the name of privacy was just blocked by EU competition regulators, because it would cripple competing advertising companies[1]. [1] https://arstechnica.com/tech-policy/2021/06/eu-antitrust-regulators-launch-probe-into-googles-floc-plan/ https://arstechnica.com/tech-policy/2021/06/eu-antitrust-reg...
- api 5y ago
  > Increasing privacy decreases competitions, strengthening the Big Tech companies that engage with users at the platform/browser/OS/hardware level. What about products that people actually pay for directly instead of products that are "free" but funded under the table through surveillance and manipulation? Why can't those compete just fine?
  - splitstud 5y ago
    Would be nice but they'd have to compete as beggars on gated app stores. Face it, big tech is robber baron territory.
- deleted 5y ago
  [deleted]
- wbl 5y ago
  Users pick browsers and their OS. They don't pick the latest iteration of Bonsai Buddy.
  - 5y ago
1vuio0pswjnm7 5y ago
Funny how there is no (meaningful) user representation at W3C. Perhaps Wendy Seltzer is the closest to a user representative. A lawyer who is a Perl programmer, according to her Wikipedia profile. The arguments against Big Tech the smaller ad tech folks are raising sound legit, but obviously they are not being made in good faith. Big Tech has no more respect for user privacy than companies like Rosewell's. They are all a threat to user privacy. Companies that make browsers should not also be taking in online ad services revenue. It is a clear conflict of interest. 51degrees provides the public with a CSV list of user-agents, e.g., for use in browser fingerprinting (or perhaps user defence against browser fingerprinting). What does Google provide. We know they are fingerpringing on a mass scale. There is zero transparency. https://raw.githubusercontent.com/51Degrees/Device-Detection/master/data/20000%20User%20Agents.csv https://raw.githubusercontent.com/51Degrees/Device-Detection... Just for fun, I periodically compile w3c-libwww. It still compiles and it still works today. I use it through a TLS-enabled proxy. It reminds me of all the potential for experimetation the www once had. Today the web just looks like a Big Tech-led surveillance dystopia slowly coming together. Unless someone stops it. Lina Khan, godspeed. The disputes described in the article with lawyers from W3C and IAPP looking on reminds me a little of the formation of ICANN back in the 1990's and the disputes over domain names versus trademarks.
- jefftk 5y ago
  > What does Google provide. We know they are fingerpringing on a mass scale. Why do you say that? I'm not aware of any situations where Google targets ads based on fingerprinting, and if they did I probably would have come across it. And in March, Google Ads committed that "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products" -- https://blog.google/products/ads-commerce/a-more-privacy-first-web/ https://blog.google/products/ads-commerce/a-more-privacy-fir... (Speaking only for myself)
  - hedora 5y ago
    “Instead, our web products will be powered by privacy-preserving APIs which prevent individual tracking while still delivering results for advertisers and publishers.” Still unacceptable. This implies psychological manipulation, price discrimination, automated racism, etc, are all still in scope. Also, if you log into google, they’ll still track you for ad targeting. Finally, this wording implies the privacy preserving profile can be linked to your primary identity if you momentarily log in.
syshum 5y ago
W3C surrendered to Google during the EME fight. So there is not war... it is Google way, or Google renders W3C irrelevant...
pentagrama 5y ago
> One of Google's proposed standards — Federated Learning of Cohorts, or FLoC for short — would eliminate the ability for advertisers to track specific users' web behavior with cookies. No, Floc will not "eliminate the ability for advertisers to track specific users with cookies", the phase out of third party cookies on Chrome will do that, Google needs something to replace the current tracking method for his ad business and is trying to push Floc to do that. But this are two separate things that OP seems to mix up, Google needs something to keep tracking and is painting the notion that third party cookies can not be phased out without implement Floc before, and is not the case.
- IX-103 5y ago
  What do you call it when a company makes a change to its product in one market where it has large market share that drives its competitors in another market out if business? Or put another way, do you really think Google could get rid of third party cookies tomorrow and not get sued out existence? IANAL, but even I can see that making changes to Chrome that impact advertising is risky even if you ignore Google's own advertising interests. So far they're trying to push things along, but they need buy-in from most of the rest of the advertising industry before they feel they can do anything too radical. So as far as Google is concerned the elimination of third party cookies (and bounce tracking protection, browser fingerprinting, etc) is definitively tied to something that replaces it. One of those things is FLOC.
  - raxxorrax 5y ago
    > could get rid of third party cookies tomorrow and not get sued out existence? I don't think people abusing cookies have a standing as I see it. On what grounds, that their predatory business model is obsolete? On the contrary, even if many web services are financed by ads, most customers of advertising just care about having the same possibilities to advertise their products. So a more healthy ad world would remain. "Legal" advertising has eclipsed spam with its toxicity.
  - pitdicker 5y ago
    > do you really think Google could get rid of third party cookies tomorrow and not get sued out existence? Not disagreeing, but ad companies attempting to sue Google out of existence would be worth watching.
lumost 5y ago
I used to be of the mind that ad tech et. al. weren’t really hurting anyone, and that the more extreme examples of privacy offenses were simple edge cases. That is until I switched to iOS and was given the option to hide my true email address, tell an app not to track me, and otherwise get visibility into just how much my data is getting sniffed for stupid reasons that have nothing to do with the service I’m using.
- rodgerd 5y ago
  My tipping point was noticing that about 30% of my DNS traffic on my home network was Android devices calling out to tracking and advertising networks. Moving to iOS has dropped that dramatically, more than an order of magnitude. The fact that we're now seeing multiple lawsuits, PR campaigns, and lobbying to damage Apple since they put a requirement to disclose privacy details in the App Store shows how much surveillance capitalism has twisted the world.
  - samplatt 5y ago
    An alternative to giving your money to one of the largest tax-dodgers on the planet is a $30 raspberry pi with "pi-hole" installed. Browsing on my phone at home with all those ad networks blocked okay... until you go outside your home network and get all the ads again. It's almost made my stop using my phone outside of my home network.
    - hellcow 5y ago
      I set up Tailscale on Android to use my Pihole from anywhere. Works pretty well.
    - Helmut10001 5y ago
      That is why I have an IPSEC connection back to my home from work, so I can use my internal DNS with DNSBL blocklist. (be careful, few employers will allow such a setup). The top list seems like a reflection of market share: fls-eu.amazon.de, sessions.bugsnag.com, googleads.g.doubleclick.net, data.mistat.intl.xiaomi.com, app-measurement.com, in.treasuredata.com ..
dhosek 5y ago
>companies that use cross-site tracking for things like website optimization OK, I was hoping someone already addressed this, but apparently not. What "website optimization" requires cross-site tracking? Is there any real application for cross-site tracking besides advertising? I honestly would like to know.
- xdennis 5y ago
  CDNs maybe? Back when people used jQuery, an enormous amount of traffic went to Google, ripe for tracking, and you got the small benefit of not having to download the same version of jQuery so often.
- sdflhasjd 5y ago
  It's referring to things like analytics, hotjar etc. Optimisation as in conversion optimisation. Imo, a lot of this stuff ends up being just as bad.
  - nr2x 5y ago
    Considering many of those read first party auth tokens they are particularly bad.
- haecceity 5y ago
  Optimize you buying things.
- miki123211 5y ago
  Yes, when one website relies on the fact that you're logged in somewhere else. Thing easily being able to add embedded Youtube videos to your watchlist, adding favorite articles to Pocket, being able to pay with 1 click using a payment method saved somewhere else, and so on.
  - dhosek 5y ago
    I'm thinking that there are better ways to do this than relying on potentially fragile or hackable cross-site cookies. Certainly for payment, I'd prefer that communication to be handled server-side.
hboon 5y ago
Feels like if Chrome isn’t operated and controlled by Google, some of these problems would go away.
trothamel 5y ago
Does the W3C even matter anymore? I thought WHAT-WG did most of the standardization nowadays, and W3C was left deciding what to rubber stamp and what not to.
- pjmlp 5y ago
  Actually Google does most of the standardization nowadays, and then Apple adopts what it feels like.
gwbas1c 5y ago
Honestly, this makes me wonder if the browser manufacturers will just "take their ball and go home." It's probably easier for them to just get together outside of the W3C and make up a new standards committee. From what I understand, nothing in the W3C is binding, so there would be no repercussions whatsoever.
- notriddle 5y ago
  They already did that, forming WHATWG.
  - gwbas1c 5y ago
    But the browser vendors are actively participating in the W3C. That's clearly described in the article. What I'm referring to is the browser vendors leaving the W3C and forming an alternate group.
spoonjim 5y ago
The W3C is not a relevant institution anymore so this raging privacy war will be wholly inconsequential. Google and Apple decide what desktop and mobile browsers will behave like.
- 3gg 5y ago
  Their petty war for how to exploit people online is pathetic to watch. The more general fight for privacy _is not_ inconsequential. It would indeed be mistaken to think that these corporations are the ones carrying the privacy fight. That is what the likes of Apple are basing their PR on these days; pure marketing trash.
evancox100 5y ago
‘Perhaps it should have been a clear sign Do Not Track was doomed when, Tene wrote, the group tried to settle its dispute over the definition of tracking by seeing which side could hum loudest. "Addressing this method, one participant complained, 'There are billions of dollars at stake and the future of the Internet, and we're trying to decide if one third-party is covered or didn't hum louder!'" Tene wrote.’ I thought this had to have been a joke or some sort of analogy, but no they were literally humming.
- edent 5y ago
  https://tools.ietf.org/id/draft-resnick-on-consensus-01.html https://tools.ietf.org/id/draft-resnick-on-consensus-01.html
croes 5y ago
>It was January 2020, and Google had just announced key details of its plan to increase privacy in its Chrome browser by getting rid of third-party cookies and essentially breaking the tools that businesses use to track people across the web. Good one. Google doesn't care about privacy, it just wants to monopolize the tracking with FLOC.
oakpond 5y ago
Murphy's law on the web: what can be tracked, will be tracked.
mola 5y ago
The so called small players abused their power, and the users had enough of being exploited. Now that the big players are mitigating this with the old American tradition of self regulation and kicking away the ladder, the same small players who abused our freedom to choose who to share our information with, are whining about freedom of choice. Bah
jokoon 5y ago
It really seems that online privacy will trigger some sort of second internet bubble. There is soooo much money involved with online advertising, but it's not popular among consumers, so it seems that something is going to break in this business model. One technical solution would be to decentralize internet even more, but it's pretty complex to do.
- ExtraE 5y ago
  I suspect the answer will be paying a bit more for internet and having ISPs forward that fee onto websites.
  - akshaybhalotia 5y ago
    You do realize that your answer is based on the premise that your ISP knows what and when are you visiting and the duration of that, right?
    - ExtraE 5y ago
      I mean for websites to get paid at all this has to be the case. It could by your browser, os, whatever.
- elric 5y ago
  I'm still convinced that the internet would benefit from a standard for (micro)payments straight from the browser, without all the friction that comes with current online payments. "Read this article, pay €0.05 [OK] [Cancel]". And for everything else, I really wish we would go back to smaller websites which are run out of a desire to share. I don't get why every blog has to have ads and affiliate links. Web hosting is cheaper than dirt in 2021. I colocated a server out of my allowance when I was 13, simply because I had a desire to share some of the things I was tinkering with. If you can't afford the €1/month it costs to host something in 2021, maybe you just shouldn't.
totetsu 5y ago
"one one side is google, apple, microsoft" on the other side "companies that use cross-site tracking for things like ... advertising" .. I had to stop reading at this point.
favorited 5y ago
I'm glad we're finally humanizing the metaphorical David in the online privacy debate. The guy who built his business on [checks notes] tracking your online behavior. Where would we be if not for this stick-it-to-em person, who wants to defend his life's work of fingerprinting our web browsing to assist in targeted advertising?
favorited 5y ago
> Apple decided to "blow up" the world of web advertising and only started "thinking about what to replace it with later." https://i.imgur.com/eIzXgaL.png https://i.imgur.com/eIzXgaL.png
antattack 5y ago
I recently bought my first Android device and found Google Play infested with apps that want my location, access to network, list all my apps AND send adverts. Google is assisting them by adding extra steps to find out what permissions app requests. Also, it appears, that Android is opting you in, unless permissions are configured before starting the app. Because of that, there are apps with sole purpose of tricking you into installing it so it can get your data. I found that many Android apps, that are also available on IOS, insist on location data and refuse to run, whereas they run fine w/o it enabled on IOS.
- tialaramex 5y ago
  > want my location Location access attempts result in a prompt, asking whether you want the app to have access to your location. You can give it access once, only when it's active, or even in the background (the latter might make sense for a fitness app/ mileage tracking app/ that sort of thing). It's your choice.
  - antattack 5y ago
    I had an app (that did not need location to function) that refused to continue if location was not enabled fully.
    - 3np 5y ago
      Was it a Google app? If not I hardly think Google's to blame for that. There's a lot I'm concerned of with Google and I'm not happy with a lot of ways they're doing things, but it's really up to ourselves not to use such apps. At least they have to explicitly ask for your permission. If you buy a Pixel, I don't think there should be such crap? A lot of times it's the manufacturers. Samsung is a terrible offender in this category, I regret my most recent Galaxy phone and will not make that mistake again. Unless you run a self-flashed OSS OS, the least invasive choices for mobile seem to be Apple, followed by vanilla Android on Google Pixel (but then you might as well run GrapheneOS).
mooreds 5y ago
One thing that was a surprise to me when I looked into this was that these changes to promote privacy (which seem pretty good to me) will also affect federated identity on the web. Things like single sign-on are done with the same tech (cookies, redirects) that are used by advertisers, and in some cases are indistinguishable. This is a common use case, though of course small fry compared to the privacy vs ad tracking folks. If you'd like to learn more about this aspect, here's a video from one of the Auth0 folks: https://identiverse.gallery.video/detail/videos/architecture-deployment/video/6184443037001/browser-features-vs-identity-protocols?utm_source=1st%20Day%20of%20Identity&utm_medium=Social&utm_campaign=12%20Days%20of%20Identity https://identiverse.gallery.video/detail/videos/architecture... (The video is from 2020. He gave an update at the same conference in 2021, but they haven't posted those videos yet.) There's also a Federated ID Community Group at the W3C on the same issue: https://www.w3.org/community/fed-id/ https://www.w3.org/community/fed-id/
- Vinnl 5y ago
  Yep, we're seeing the same challenges with Solid [1], where users bring their own backend. That said, that just means there's a problem to solve here: we need to enable such use cases while combating undesirable tracking. [1] https://solidproject.org https://solidproject.org
jl2718 5y ago
A slightly orthogonal way to see this debate is that the standards that became dominant (tcp/ip, http, html, cookies, smtp, js, etc) became that way specifically because they were inferior in specific ways, such as privacy. This gave the opportunity to build varying levels of user exploitation into any desirable application without explicit consent or decision to pay for it. An Internet built on superior user-empowering technologies (there were and are plenty) would never have attracted the amount of investment that the exploitive web did. If the main metric that matters is growth, it doesn’t matter where it comes from; even highly exploitive use cases like spam and scams were some of the most aggressive accelerators of early usage.
- salawat 5y ago
  Ding, ding, ding. Go to a convention. ask people about why we don't make software im a way that empowers users without a crippling dependence being created, or inflicting on users a leaky or otherwise insecire experience, and watch the room clam up.

376 points by bpierre 5y ago

What it says: "a privacy war is raging inside the W3C. What I read: "why you should keep your ad-blockers and script-blockers properly configured and updated".

MeteorMarc 5y ago

It seems only fair that big tech engineers also feel the pain of idyllic places on the internet being overrun by commercial interests.

ricopags 5y ago

A small side note in case anyone from protocol.com is reading: In chrome, with adblock disabled, unable to click the button to sign up for email list.

the-dude 5y ago
This must be the most positive HN comment about sign up CTAs ever.
amberj8 5y ago
I have Firefox, ghostery, adblock, and no 3rd party cookies and I get a completely blank page.

tomc1985 5y ago

I don't care how big this man's business is, Rosewell is a parasite bent on preserving the established order of datamining the shit out of everyone for his own personal profit. He is gumming up the works with pointless philosophical bloviating, using the anti-big-tech argument as a cudgel of convenience for bludgeoning a nascent privacy movement that has taken decades to get off the ground. I've sat in a large audience hall listening to assholes like these guys talk about their businesses, and when they are called out publicly for not caring about individual privacy and desire not to be tracked, and they shrug their shoulders. He and the rest of this datamining gold rush needs to be stopped.

mistrial9 5y ago
agree with the sentiment but the vulgarity dilutes the weight of the message.. centuries of privacy rights are drained and drowning right now IMO
- You-Are-Right 5y ago
  The vulgarity of the choosen life path of some people can not be matched by any words.
- tomc1985 5y ago
  My vulgarity is an expression of frustration in their overall apathy to the consequences of their actions. Forcing people to smother their feelings in the name of 'genteel' discussion does a disservice to those who feel oppressed or misheard. Some things in this world are quite ugly and it is important to portray them as such. Perhaps you should evaluate why you let mere words affect you so much.
  - andrewzah 5y ago
    I agree with you on vulgarity but life isn't really fair about this. Just like how wearing a suit unfairly makes a presentation more potent than casual wear. It is what it is. Being vulgar (even if technically justified) weakens the message for many people, especially when the other party is very polite and professional in return. edit: I would prefer if people weren't like that, but that's just one of the many flaws that humans have. Trying to change that instead of acknowledging it and adapting is an exercise in frustration. I'm not "affected by mere words", but I do prefer well worded arguments to mere expletives. And I'm not alone in that.
    - tomc1985 5y ago
      I understand your point but I think that emotional suppression is a much greater crime than failing to be polite. After all, politeness has quite a storied history in being used to suppress and control people that are used to being 'othered', many of which feel things that are much stronger than I am expressing here

3gg 5y ago

I thought Korean soap operas were good until I read this article. What a whole bunch of unnecessary drama. The W3C always appeared to be one of the most dysfunctional entities in existence, and now the article leaves no question as to why. Funny this Rosewell guy. "Should web browsers really become implementation mechanisms of specific government regulation?" -- Isn't everything a mechanism of specific government regulation? We seem to have an autocrat in the making here who would prefer the Web existed in isolation of civilization and where he could squeeze out that ad cash unhindered by government regulations. Given that he likes to ask philosophical questions, perhaps he could ask himself why the Web is being regulated in the first place. It's also funny how in the article, the only people who seem to actually care about privacy are the non-profits advocating for it and the government regulators fighting antitrust.

pdonis 5y ago
> Isn't everything a mechanism of specific government regulation? Um, no?
- haecceity 5y ago
  GDPR?
  - EGreg 5y ago
    Ah yes that is everything !
- 3gg 5y ago
  Sorry, I did not mean that literally. Point is Rosewell wants to preserve the status quo for his own personal benefit and, unsurprisingly, any kind of legislation that attempts to constrain his greed appears to him as an inconvenience.
  - pdonis 5y ago
    > Point is Rosewell wants to preserve the status quo for his own personal benefit and, unsurprisingly, any kind of legislation that attempts to constrain his greed appears to him as an inconvenience. I agree with this.

tenebrisalietum 5y ago

Want a Web run by human beings again? Want tracking methods impossible to implement in any meaningful fashion by design? Try Gemini. Gemini is here and can be used TODAY. https://gemini.circumlunar.space/ https://gemini.circumlunar.space/ The only thing standing between you and the next web is... a lot, but try it anyway, things have to start somewhere.

cusenses 5y ago
What prevents Gemini from being taken over and utilized just like the current web has been?
- hkt 5y ago
  Governance is the only thing that can. There are no technical measures that can prevent it.
- skymt 5y ago
  The Gemini protocol is intended to exclude features that could be used for tracking. It has no cookies, user-agent, referer, etc and the protocol is not extensible enough that such features could be easily added. Also, frankly, the spartan design of native Gemini pages (very limited formatting, no scripts or even inline images!) means that the circle of nerds who use Gemini will almost certainly remain too small to catch the eye of ad-tech. It's hostile to commerce in a way I find kind of delightful. https://gemini.circumlunar.space/docs/faq.gmi https://gemini.circumlunar.space/docs/faq.gmi
  - cesarb 5y ago
    > It has no cookies, user-agent, referer, etc and the protocol is not extensible enough that such features could be easily added. For now. The original HTTP (now retroactively called HTTP/0.9) also had none of these, and also wasn't extensible enough; it had no headers at all, just the verb (GET) and the path. Yet somehow, it was later extended to include all of these. > very limited formatting, no scripts or even inline images! The original HTML was also like that, even inline images came later.

baybal2 5y ago

Another thing are all kinds of standard boards, and committees like IETF, W3C, IEEE becoming very secretive themselves. A decade, or more ago IEEE had a rule that anything said in a standard board meeting cannot be be expected to not be public, or be subject to any disclosure limit post-factum. In 2019, after years of relentless pressure from Google, Cisco, Amazon, the rule was effectively reversed, and now IEEE standard board meetings can be made super duper secret, so members can now conspire to break antitrust laws in every imaginable way in complete privacy, free of recordings, and stenography.

tannhaeuser 5y ago

> On the other side are companies that use cross-site tracking for things like website optimization and advertising, and are fighting for their industry's very survival. That includes small firms like Rosewell's, but also giants of the industry, like Facebook. The Rosewell guy may not be a saint, but omitting Google from the list as the ones standing to win from privacy features, through ga and the usage they have over the Web via Chrome anyway is completely missing the point of a single party having monopolistic control over click data. Can't also agree with the characterization of the W3C in TFA.

IX-103 5y ago
How does Google win? Their business is search -- advertising on other sites is more of a side gig for them, and from their own description of their privacy sandbox, even they would not be able to track people across sites. The changes to the web platform necessary to protect user privacy will require reinventing the industry (which will naturally pick winners and losers). I expect that Google will come out in the end doing well, but that's not because they have a competitive advantage here, but instead because these changes don't really affect their core business (at least no where near as much as the proliferation of paywalls and app-ification have).
- rdsnsca 5y ago
  Googles business is advertising.. take away their ad revenue and see what happens to them.
  - IX-103 5y ago
    Yes, but their business is search advertising. You can get really good targeting with just 1st party data (what the current user has searched for). That's completely different from display advertising. For most sites on the web there's not enough information about a user's interests on that site alone to get a lot of different bidders for the ad slot. Fewer bidders generally means the a list auction price, so less money for the publisher.

otterley 5y ago

In this story: engineers can't come to a conclusion because they are trying to solve a political problem instead of an engineering problem.

IX-103 5y ago
Better summary: Browser companies try to implement X individually. Browser developers get together and try to standardize a way to do X. Other people come and complain why they aren't doing Y or Z instead. Eventually all the extra people are talking so loudly that no one can work on X.
salawat 5y ago
It's the song that never ends/ it just goes on and on/ my friend...

coldtea 5y ago

W3C being basically Google and a couple of other 10000-pound gorilla companies at this point...

IX-103 5y ago
Is Mozilla also one of the 10000 pound Gorillas?
- wvenable 5y ago
  In comparison, Mozilla is just a 1,087 pound Gorilla.
  - IX-103 5y ago
    Really? I've been following along some of the W3c work on privacy and they seem to have about as much political power there as Apple. Part of that seems to be from their first-mover advantage in the privacy space relative to Microsoft or Google, but the rest seems to be because they aren't seen as acting in their own interests (like say Google or Apple). As an aside: In some ways it's kind of funny to hear a bunch of engineers talk about technology while all casting shade at the other participant's motivations.
- otterley 5y ago
  Wait till you find out where most of Mozilla's funding comes from! (Hint: it starts with a G and rhymes with frugal.)
eqvinox 5y ago
Well, the gorillas chose to come to a table and open a discussion. These decisions might as well be made in closed rooms at Google and Mozilla, and there wouldn't be much you could do about it. By the power of browser market share, they could just skip W3C and implement whatever they want. What they'd get away with is only limited by the point where someone with a different agenda starts funding their own browser fork (and can convince users to use it.)

marketingtech 5y ago

It's easy to mock the pettiness of all parties described here, and it's common for people on this forum to take absolutist stances with regards to privacy/advertising, but it's also important to recognize that these arguments will actually define the future of the internet for the average user. There are trillion dollar companies on both sides of the argument, and their eventual compromise will establish the defaults for billions of users. There are also two fundamental components of the Big Tech debate at odds with each other here - privacy and competition. Increasing privacy decreases competition by strengthening the Big Tech companies that engage with users at the platform/browser/OS/hardware level. See: Google's removal of third-party cookies from Chrome in the name of privacy was just blocked by EU competition regulators, because it would cripple competing advertising companies[1]. [1] https://arstechnica.com/tech-policy/2021/06/eu-antitrust-regulators-launch-probe-into-googles-floc-plan/ https://arstechnica.com/tech-policy/2021/06/eu-antitrust-reg...

api 5y ago
> Increasing privacy decreases competitions, strengthening the Big Tech companies that engage with users at the platform/browser/OS/hardware level. What about products that people actually pay for directly instead of products that are "free" but funded under the table through surveillance and manipulation? Why can't those compete just fine?
- splitstud 5y ago
  Would be nice but they'd have to compete as beggars on gated app stores. Face it, big tech is robber baron territory.
deleted 5y ago
[deleted]
wbl 5y ago
Users pick browsers and their OS. They don't pick the latest iteration of Bonsai Buddy.
- 5y ago

1vuio0pswjnm7 5y ago

Funny how there is no (meaningful) user representation at W3C. Perhaps Wendy Seltzer is the closest to a user representative. A lawyer who is a Perl programmer, according to her Wikipedia profile. The arguments against Big Tech the smaller ad tech folks are raising sound legit, but obviously they are not being made in good faith. Big Tech has no more respect for user privacy than companies like Rosewell's. They are all a threat to user privacy. Companies that make browsers should not also be taking in online ad services revenue. It is a clear conflict of interest. 51degrees provides the public with a CSV list of user-agents, e.g., for use in browser fingerprinting (or perhaps user defence against browser fingerprinting). What does Google provide. We know they are fingerpringing on a mass scale. There is zero transparency. https://raw.githubusercontent.com/51Degrees/Device-Detection/master/data/20000%20User%20Agents.csv https://raw.githubusercontent.com/51Degrees/Device-Detection... Just for fun, I periodically compile w3c-libwww. It still compiles and it still works today. I use it through a TLS-enabled proxy. It reminds me of all the potential for experimetation the www once had. Today the web just looks like a Big Tech-led surveillance dystopia slowly coming together. Unless someone stops it. Lina Khan, godspeed. The disputes described in the article with lawyers from W3C and IAPP looking on reminds me a little of the formation of ICANN back in the 1990's and the disputes over domain names versus trademarks.

jefftk 5y ago
> What does Google provide. We know they are fingerpringing on a mass scale. Why do you say that? I'm not aware of any situations where Google targets ads based on fingerprinting, and if they did I probably would have come across it. And in March, Google Ads committed that "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products" -- https://blog.google/products/ads-commerce/a-more-privacy-first-web/ https://blog.google/products/ads-commerce/a-more-privacy-fir... (Speaking only for myself)
- hedora 5y ago
  “Instead, our web products will be powered by privacy-preserving APIs which prevent individual tracking while still delivering results for advertisers and publishers.” Still unacceptable. This implies psychological manipulation, price discrimination, automated racism, etc, are all still in scope. Also, if you log into google, they’ll still track you for ad targeting. Finally, this wording implies the privacy preserving profile can be linked to your primary identity if you momentarily log in.

syshum 5y ago

W3C surrendered to Google during the EME fight. So there is not war... it is Google way, or Google renders W3C irrelevant...

pentagrama 5y ago

> One of Google's proposed standards — Federated Learning of Cohorts, or FLoC for short — would eliminate the ability for advertisers to track specific users' web behavior with cookies. No, Floc will not "eliminate the ability for advertisers to track specific users with cookies", the phase out of third party cookies on Chrome will do that, Google needs something to replace the current tracking method for his ad business and is trying to push Floc to do that. But this are two separate things that OP seems to mix up, Google needs something to keep tracking and is painting the notion that third party cookies can not be phased out without implement Floc before, and is not the case.

IX-103 5y ago
What do you call it when a company makes a change to its product in one market where it has large market share that drives its competitors in another market out if business? Or put another way, do you really think Google could get rid of third party cookies tomorrow and not get sued out existence? IANAL, but even I can see that making changes to Chrome that impact advertising is risky even if you ignore Google's own advertising interests. So far they're trying to push things along, but they need buy-in from most of the rest of the advertising industry before they feel they can do anything too radical. So as far as Google is concerned the elimination of third party cookies (and bounce tracking protection, browser fingerprinting, etc) is definitively tied to something that replaces it. One of those things is FLOC.
- raxxorrax 5y ago
  > could get rid of third party cookies tomorrow and not get sued out existence? I don't think people abusing cookies have a standing as I see it. On what grounds, that their predatory business model is obsolete? On the contrary, even if many web services are financed by ads, most customers of advertising just care about having the same possibilities to advertise their products. So a more healthy ad world would remain. "Legal" advertising has eclipsed spam with its toxicity.
- pitdicker 5y ago
  > do you really think Google could get rid of third party cookies tomorrow and not get sued out existence? Not disagreeing, but ad companies attempting to sue Google out of existence would be worth watching.

lumost 5y ago

I used to be of the mind that ad tech et. al. weren’t really hurting anyone, and that the more extreme examples of privacy offenses were simple edge cases. That is until I switched to iOS and was given the option to hide my true email address, tell an app not to track me, and otherwise get visibility into just how much my data is getting sniffed for stupid reasons that have nothing to do with the service I’m using.

rodgerd 5y ago
My tipping point was noticing that about 30% of my DNS traffic on my home network was Android devices calling out to tracking and advertising networks. Moving to iOS has dropped that dramatically, more than an order of magnitude. The fact that we're now seeing multiple lawsuits, PR campaigns, and lobbying to damage Apple since they put a requirement to disclose privacy details in the App Store shows how much surveillance capitalism has twisted the world.
- samplatt 5y ago
  An alternative to giving your money to one of the largest tax-dodgers on the planet is a $30 raspberry pi with "pi-hole" installed. Browsing on my phone at home with all those ad networks blocked okay... until you go outside your home network and get all the ads again. It's almost made my stop using my phone outside of my home network.
  - hellcow 5y ago
    I set up Tailscale on Android to use my Pihole from anywhere. Works pretty well.
  - Helmut10001 5y ago
    That is why I have an IPSEC connection back to my home from work, so I can use my internal DNS with DNSBL blocklist. (be careful, few employers will allow such a setup). The top list seems like a reflection of market share: fls-eu.amazon.de, sessions.bugsnag.com, googleads.g.doubleclick.net, data.mistat.intl.xiaomi.com, app-measurement.com, in.treasuredata.com ..

dhosek 5y ago

>companies that use cross-site tracking for things like website optimization OK, I was hoping someone already addressed this, but apparently not. What "website optimization" requires cross-site tracking? Is there any real application for cross-site tracking besides advertising? I honestly would like to know.

xdennis 5y ago
CDNs maybe? Back when people used jQuery, an enormous amount of traffic went to Google, ripe for tracking, and you got the small benefit of not having to download the same version of jQuery so often.
sdflhasjd 5y ago
It's referring to things like analytics, hotjar etc. Optimisation as in conversion optimisation. Imo, a lot of this stuff ends up being just as bad.
- nr2x 5y ago
  Considering many of those read first party auth tokens they are particularly bad.
haecceity 5y ago
Optimize you buying things.
miki123211 5y ago
Yes, when one website relies on the fact that you're logged in somewhere else. Thing easily being able to add embedded Youtube videos to your watchlist, adding favorite articles to Pocket, being able to pay with 1 click using a payment method saved somewhere else, and so on.
- dhosek 5y ago
  I'm thinking that there are better ways to do this than relying on potentially fragile or hackable cross-site cookies. Certainly for payment, I'd prefer that communication to be handled server-side.

hboon 5y ago

Feels like if Chrome isn’t operated and controlled by Google, some of these problems would go away.

trothamel 5y ago

Does the W3C even matter anymore? I thought WHAT-WG did most of the standardization nowadays, and W3C was left deciding what to rubber stamp and what not to.

pjmlp 5y ago
Actually Google does most of the standardization nowadays, and then Apple adopts what it feels like.

gwbas1c 5y ago

Honestly, this makes me wonder if the browser manufacturers will just "take their ball and go home." It's probably easier for them to just get together outside of the W3C and make up a new standards committee. From what I understand, nothing in the W3C is binding, so there would be no repercussions whatsoever.

notriddle 5y ago
They already did that, forming WHATWG.
- gwbas1c 5y ago
  But the browser vendors are actively participating in the W3C. That's clearly described in the article. What I'm referring to is the browser vendors leaving the W3C and forming an alternate group.

spoonjim 5y ago

The W3C is not a relevant institution anymore so this raging privacy war will be wholly inconsequential. Google and Apple decide what desktop and mobile browsers will behave like.

3gg 5y ago
Their petty war for how to exploit people online is pathetic to watch. The more general fight for privacy _is not_ inconsequential. It would indeed be mistaken to think that these corporations are the ones carrying the privacy fight. That is what the likes of Apple are basing their PR on these days; pure marketing trash.

evancox100 5y ago

‘Perhaps it should have been a clear sign Do Not Track was doomed when, Tene wrote, the group tried to settle its dispute over the definition of tracking by seeing which side could hum loudest. "Addressing this method, one participant complained, 'There are billions of dollars at stake and the future of the Internet, and we're trying to decide if one third-party is covered or didn't hum louder!'" Tene wrote.’ I thought this had to have been a joke or some sort of analogy, but no they were literally humming.

edent 5y ago
https://tools.ietf.org/id/draft-resnick-on-consensus-01.html https://tools.ietf.org/id/draft-resnick-on-consensus-01.html

croes 5y ago

>It was January 2020, and Google had just announced key details of its plan to increase privacy in its Chrome browser by getting rid of third-party cookies and essentially breaking the tools that businesses use to track people across the web. Good one. Google doesn't care about privacy, it just wants to monopolize the tracking with FLOC.

oakpond 5y ago

Murphy's law on the web: what can be tracked, will be tracked.

mola 5y ago

The so called small players abused their power, and the users had enough of being exploited. Now that the big players are mitigating this with the old American tradition of self regulation and kicking away the ladder, the same small players who abused our freedom to choose who to share our information with, are whining about freedom of choice. Bah

jokoon 5y ago

It really seems that online privacy will trigger some sort of second internet bubble. There is soooo much money involved with online advertising, but it's not popular among consumers, so it seems that something is going to break in this business model. One technical solution would be to decentralize internet even more, but it's pretty complex to do.

ExtraE 5y ago
I suspect the answer will be paying a bit more for internet and having ISPs forward that fee onto websites.
- akshaybhalotia 5y ago
  You do realize that your answer is based on the premise that your ISP knows what and when are you visiting and the duration of that, right?
  - ExtraE 5y ago
    I mean for websites to get paid at all this has to be the case. It could by your browser, os, whatever.
elric 5y ago
I'm still convinced that the internet would benefit from a standard for (micro)payments straight from the browser, without all the friction that comes with current online payments. "Read this article, pay €0.05 [OK] [Cancel]". And for everything else, I really wish we would go back to smaller websites which are run out of a desire to share. I don't get why every blog has to have ads and affiliate links. Web hosting is cheaper than dirt in 2021. I colocated a server out of my allowance when I was 13, simply because I had a desire to share some of the things I was tinkering with. If you can't afford the €1/month it costs to host something in 2021, maybe you just shouldn't.

totetsu 5y ago

"one one side is google, apple, microsoft" on the other side "companies that use cross-site tracking for things like ... advertising" .. I had to stop reading at this point.

favorited 5y ago

I'm glad we're finally humanizing the metaphorical David in the online privacy debate. The guy who built his business on [checks notes] tracking your online behavior. Where would we be if not for this stick-it-to-em person, who wants to defend his life's work of fingerprinting our web browsing to assist in targeted advertising?

favorited 5y ago

> Apple decided to "blow up" the world of web advertising and only started "thinking about what to replace it with later." https://i.imgur.com/eIzXgaL.png https://i.imgur.com/eIzXgaL.png

antattack 5y ago

I recently bought my first Android device and found Google Play infested with apps that want my location, access to network, list all my apps AND send adverts. Google is assisting them by adding extra steps to find out what permissions app requests. Also, it appears, that Android is opting you in, unless permissions are configured before starting the app. Because of that, there are apps with sole purpose of tricking you into installing it so it can get your data. I found that many Android apps, that are also available on IOS, insist on location data and refuse to run, whereas they run fine w/o it enabled on IOS.

tialaramex 5y ago
> want my location Location access attempts result in a prompt, asking whether you want the app to have access to your location. You can give it access once, only when it's active, or even in the background (the latter might make sense for a fitness app/ mileage tracking app/ that sort of thing). It's your choice.
- antattack 5y ago
  I had an app (that did not need location to function) that refused to continue if location was not enabled fully.
  - 3np 5y ago
    Was it a Google app? If not I hardly think Google's to blame for that. There's a lot I'm concerned of with Google and I'm not happy with a lot of ways they're doing things, but it's really up to ourselves not to use such apps. At least they have to explicitly ask for your permission. If you buy a Pixel, I don't think there should be such crap? A lot of times it's the manufacturers. Samsung is a terrible offender in this category, I regret my most recent Galaxy phone and will not make that mistake again. Unless you run a self-flashed OSS OS, the least invasive choices for mobile seem to be Apple, followed by vanilla Android on Google Pixel (but then you might as well run GrapheneOS).

mooreds 5y ago

One thing that was a surprise to me when I looked into this was that these changes to promote privacy (which seem pretty good to me) will also affect federated identity on the web. Things like single sign-on are done with the same tech (cookies, redirects) that are used by advertisers, and in some cases are indistinguishable. This is a common use case, though of course small fry compared to the privacy vs ad tracking folks. If you'd like to learn more about this aspect, here's a video from one of the Auth0 folks: https://identiverse.gallery.video/detail/videos/architecture-deployment/video/6184443037001/browser-features-vs-identity-protocols?utm_source=1st%20Day%20of%20Identity&utm_medium=Social&utm_campaign=12%20Days%20of%20Identity https://identiverse.gallery.video/detail/videos/architecture... (The video is from 2020. He gave an update at the same conference in 2021, but they haven't posted those videos yet.) There's also a Federated ID Community Group at the W3C on the same issue: https://www.w3.org/community/fed-id/ https://www.w3.org/community/fed-id/

Vinnl 5y ago
Yep, we're seeing the same challenges with Solid [1], where users bring their own backend. That said, that just means there's a problem to solve here: we need to enable such use cases while combating undesirable tracking. [1] https://solidproject.org https://solidproject.org

jl2718 5y ago

A slightly orthogonal way to see this debate is that the standards that became dominant (tcp/ip, http, html, cookies, smtp, js, etc) became that way specifically because they were inferior in specific ways, such as privacy. This gave the opportunity to build varying levels of user exploitation into any desirable application without explicit consent or decision to pay for it. An Internet built on superior user-empowering technologies (there were and are plenty) would never have attracted the amount of investment that the exploitive web did. If the main metric that matters is growth, it doesn’t matter where it comes from; even highly exploitive use cases like spam and scams were some of the most aggressive accelerators of early usage.

salawat 5y ago
Ding, ding, ding. Go to a convention. ask people about why we don't make software im a way that empowers users without a crippling dependence being created, or inflicting on users a leaky or otherwise insecire experience, and watch the room clam up.