3 ms·

I think you're falling into the same trap. Some things are not solved in the appropriate manner through a technological solution. They are misuses (and abuses

I think you're falling into the same trap. Some things are not solved in the appropriate manner through a technological solution. They are misuses (and abuses) of a perfectly acceptable system. Don't undo the system, address the misuse. Take your example: >Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow them!"), and we'd be right back here. The only reason this is the case is because this misuse has zero consequences. Make them declare their domains, if they choose to include tracking domains, fine the ever-loving shit out of them. Not the ".05% of yearly profit" bullshit - I'm talking 200% of daily revenue for the top controlling company for every day that domain was on the list after it was declared a bad actor. If the company can't pay? Fucking nationalize them, remove the tracking domain, sell it to the highest bidder.* Watch how fucking fast these companies will scramble to fix the problem when the stakes are real. When the stakes are trivial - it doesn't matter what technology you try to put in place to block this, they will just work around it. * I understand this is ridiculously extreme, but I'm done playing with these fucks. We've had the gloves on for the last 20 years, it's time they come off.

jrochkind1 4y ago
What is the definition of what is "really" "my" domain? If I put a custom domain on an S3/cloudfront that's part of my system, so it appears as `storage.mysystem.com`, is there something nefarious going on? Who decides what is allowable declaration of a domain to be mine? And who enforces this with fines? Is there currently any way to fine someone on the internet for violating a rule? What would you imagine this looking like, an organization that has the ability to fine people globally, and enforce the payment of those fines (by... taking domains back I guess?), and who would control it? (and who would pay for it, how?) It's a lot of global legal infrastructure we don't really have now, I think. It would be a pretty huge step.
- jrockway 4y ago
  > Who decides what is allowable declaration of a domain to be mine? Basically, there is a list included in all browsers: https://wiki.mozilla.org/Public_Suffix_List https://wiki.mozilla.org/Public_Suffix_List. That's why you.github.io can't read other github.io cookies, but if you make your own domain, you can share cookies between a.example.com and b.example.com. (Also why example.com can't read .com cookies.) > Is there currently any way to fine someone on the internet for violating a rule? Many governments do this. In the US, the FTC has fined a number of companies for things like supercookies: https://www.ftc.gov/business-guidance/blog/2012/08/milking-cookies-ftcs-225-million-settlement-google https://www.ftc.gov/business-guidance/blog/2012/08/milking-c...
  - jrochkind1 4y ago
    I don't think we're talking about the same thing. I understood that the conversation was about attesting that, for instance, googleusercontent.com was owned by the same entity as google.com so could share cookies. A) I don't see any way that the list included in browsers of public suffixes makes it possible to decide that google.com really owns googleusercontent.com. If it did, we would already be there and woudln't be discussing this. B) Who do you think makes the public suffix list in the first place, where do you think it comes from exactly?

jrochkind1 4y ago

What is the definition of what is "really" "my" domain? If I put a custom domain on an S3/cloudfront that's part of my system, so it appears as `storage.mysystem.com`, is there something nefarious going on? Who decides what is allowable declaration of a domain to be mine? And who enforces this with fines? Is there currently any way to fine someone on the internet for violating a rule? What would you imagine this looking like, an organization that has the ability to fine people globally, and enforce the payment of those fines (by... taking domains back I guess?), and who would control it? (and who would pay for it, how?) It's a lot of global legal infrastructure we don't really have now, I think. It would be a pretty huge step.

jrockway 4y ago
> Who decides what is allowable declaration of a domain to be mine? Basically, there is a list included in all browsers: https://wiki.mozilla.org/Public_Suffix_List https://wiki.mozilla.org/Public_Suffix_List. That's why you.github.io can't read other github.io cookies, but if you make your own domain, you can share cookies between a.example.com and b.example.com. (Also why example.com can't read .com cookies.) > Is there currently any way to fine someone on the internet for violating a rule? Many governments do this. In the US, the FTC has fined a number of companies for things like supercookies: https://www.ftc.gov/business-guidance/blog/2012/08/milking-cookies-ftcs-225-million-settlement-google https://www.ftc.gov/business-guidance/blog/2012/08/milking-c...
- jrochkind1 4y ago
  I don't think we're talking about the same thing. I understood that the conversation was about attesting that, for instance, googleusercontent.com was owned by the same entity as google.com so could share cookies. A) I don't see any way that the list included in browsers of public suffixes makes it possible to decide that google.com really owns googleusercontent.com. If it did, we would already be there and woudln't be discussing this. B) Who do you think makes the public suffix list in the first place, where do you think it comes from exactly?