6 ms·

Can Mozilla also respond with their position on their own IPA proposal[1] for tracking users across the Internet? If you are shown a product ad whilst browsing

by dhx 3y ago

Can Mozilla also respond with their position on their own IPA proposal[1] for tracking users across the Internet? If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example. Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished. [1] https://github.com/patcg-individual-drafts/ipa/ https://github.com/patcg-individual-drafts/ipa/

CaliforniaKarl 3y ago
Given TFA, it looks like you can ask Mozilla for a position by opening a GitHub issue at https://github.com/mozilla/standards-positions https://github.com/mozilla/standards-positions
- dhx 3y ago
  A position request was raised in February for both Mozilla[1] and WebKit[2] and neither have been responded to. [1] https://github.com/mozilla/standards-positions/issues/753 https://github.com/mozilla/standards-positions/issues/753 [2] https://github.com/WebKit/standards-positions/issues/142 https://github.com/WebKit/standards-positions/issues/142
kmeisthax 3y ago
Attribution is necessary for advertising to work at all. If you don't have attribution that is independent of the ad platform you bought ads from, then the ad platform will defraud you[0]. This is separate from ad tracking where you build up interest profiles on users, or ad remarketing where sites can buy ads from people who have visited them in the past[1]. Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs. Whether or not user-agents should care about this sort of thing is an orthogonal question. [0] https://www.theregister.com/2023/06/29/google_trueview_skepticism/ https://www.theregister.com/2023/06/29/google_trueview_skept... [1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week
- deely3 3y ago
  > Attribution is necessary for advertising to work at all. Something strange. So, radio advertisement, billboards, video panels, and absolutely any other type of advertisement is a scam that exists for few decades and still going good?
  - arghwhat 3y ago
    Those ads existed regardless of observers. The buyer of a billboard can go see that the ad is on the billboard, or that it plays on the radio. This is quite different than the current design of online ads, where which ad to show is only decided when the ad loads and reloads. Not that it matters that much - online ads are a total scam anyway. Particularly google's search ads, which 9 times out of 10 is just a copy of the first search result - but now in a version where they get money for the click.
    - zo1 3y ago
      So it's a conveniently self-imposed "problem", because websites could also just "sell adspace" like a billboard that anyone could confirm was displaying what was paid for. But instead of that, they created a problem of showing ads "dynamically" thereby necessitating the need to track users. Interesting.
      - arghwhat 3y ago
        Partly true - but it might also have been seen as a better way to utilize the "random" ad spaces available. I do recall it being common for internet ads to be sold directly like billboards back in the day, before the action model took over, especially for higher value sites that could be likened to the prime real estate of a billboard on a city square or key highway with their guaranteed literal traffic. But such direct deals probably didn't scale well, and definitely left smaller sites wanting to earn some extra revenue in the dust. There was a time when ads weren't as shit as they are now - most wouldn't worry about a banner ad or two on their favorite forum.
      - warkdarrior 3y ago
littlestymaar 3y ago
No matter how bad the mozilla proposal is, what you're doing here is whataboutism, which eventually serves Google's interest, and defend their much more dystopian proposal…
- mardifoufs 3y ago
  That's not what whataboutism is.
  - littlestymaar 3y ago
    - Mozilla says “WEI is bad”. - OP responds with “what about IPA” It's litteral whataboutism.
    - kup0 3y ago
      It's only whataboutism if it's irrelevant / changing the subject / etc. OP's criticisms are very relevant, in that, I believe OP is just wanting to see consistency out of Mozilla's positions. This is all still about Mozilla and standards proposals. I'm sure OP is glad that Mozilla takes a negative position on WEI, but when they take other positions simultaneously that seem to counter their WEI positioning, that is a legitimate criticism. I share in that view. I'm glad to see Mozilla push back in a case like this, but they need to do more, and more consistently so.
    - dhx 3y ago
      I think you're attempting to frame the discussion in a very narrow way that is inconsistent with the public backlash. Public backlash is largely due to browser vendors demonstrating a very strong motivation to prioritise the needs of advertisers over users through their contributions to WEI and similar W3C proposals. Were you expecting only responses of praise for Mozilla, that users have been heard on WEI and therefore everyone can move on? Mozilla has invested resources together with Meta into developing the IPA proposal that also prioritises the needs of advertisers over users. The problem that IPA seeks to solve is: "Advertisers need accurate reporting about how their ad campaigns are performing. Currently, businesses use data about the people who viewed their ads and bought their products to determine ‘return on ad spend’. But the ecosystem is moving towards more privacy and less personal data sharing."[1] In Mozilla's response on WEI they've reiterated a commitment to working on solutions to the "invalid traffic" (e.g. ad click fraud) problem, a commitment which necessarily requires user needs to be suppressed. "Detecting fraud and invalid traffic is a challenging problem that we're interested in helping address." Mozilla's response on IPA is therefore directly relevant to the discussion of public backlash for advertiser needs being prioritised over user needs. Mozilla is demonstrating inconsistency with RFC8890[2] and the priority of constituencies from the W3C Web Platform Design Principles[3] and numerous Ethical Web Principles[4]. Whilst these aren't adopted standards, they are a reflection of values of contributors to these standards organisations. A further error of your framing is assuming WEI and IPA proposals can be meaningfully discussed in isolation of each other. With such framing, there is an avoidance of discussion of the combined impact of proposals if they were implemented together, or whether proposals such as IPA still make sense to pursue without WEI (or future equivalent proposal). [1] https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0yCjq4Tw2qPgeezhMfS0-P-TY/edit#slide=id.gf972808ea5_0_0 https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0y... [2] https://www.rfc-editor.org/rfc/rfc8890.html https://www.rfc-editor.org/rfc/rfc8890.html [3] https://www.w3.org/TR/design-principles/#priority-of-constituencies https://www.w3.org/TR/design-principles/#priority-of-constit... [4] https://www.w3.org/TR/ethical-web-principles/#control https://www.w3.org/TR/ethical-web-principles/#control, https://www.w3.org/TR/ethical-web-principles/#multi https://www.w3.org/TR/ethical-web-principles/#multi, https://www.w3.org/TR/ethical-web-principles/#render https://www.w3.org/TR/ethical-web-principles/#render [5] https://en.wikipedia.org/wiki/Whataboutism#Defense https://en.wikipedia.org/wiki/Whataboutism#Defense
onion2k 3y ago
your Mozilla browser will send all of these events to one or more aggregation services ...if you let it.
mindslight 3y ago
To be fair, "Web Integrity" (aka remote attestation aka a corporate surveillance agent built into "your" hardware) is much more fundamental as it would prevent the running of forked browsers that remove deliberate security vulnerabilities like IPA. It's unfortunate that Mozilla "plays ball" on garbage like IPA, but at least as things stand users are free to disable/remove/fork/etc. Whereas remote attestation is fundamentally game over for the idea of user representing agents altogether.

by dhx 3y ago

CaliforniaKarl 3y ago

Given TFA, it looks like you can ask Mozilla for a position by opening a GitHub issue at https://github.com/mozilla/standards-positions https://github.com/mozilla/standards-positions

dhx 3y ago
A position request was raised in February for both Mozilla[1] and WebKit[2] and neither have been responded to. [1] https://github.com/mozilla/standards-positions/issues/753 https://github.com/mozilla/standards-positions/issues/753 [2] https://github.com/WebKit/standards-positions/issues/142 https://github.com/WebKit/standards-positions/issues/142

kmeisthax 3y ago

Attribution is necessary for advertising to work at all. If you don't have attribution that is independent of the ad platform you bought ads from, then the ad platform will defraud you[0]. This is separate from ad tracking where you build up interest profiles on users, or ad remarketing where sites can buy ads from people who have visited them in the past[1]. Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs. Whether or not user-agents should care about this sort of thing is an orthogonal question. [0] https://www.theregister.com/2023/06/29/google_trueview_skepticism/ https://www.theregister.com/2023/06/29/google_trueview_skept... [1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week

deely3 3y ago
> Attribution is necessary for advertising to work at all. Something strange. So, radio advertisement, billboards, video panels, and absolutely any other type of advertisement is a scam that exists for few decades and still going good?
- arghwhat 3y ago
  Those ads existed regardless of observers. The buyer of a billboard can go see that the ad is on the billboard, or that it plays on the radio. This is quite different than the current design of online ads, where which ad to show is only decided when the ad loads and reloads. Not that it matters that much - online ads are a total scam anyway. Particularly google's search ads, which 9 times out of 10 is just a copy of the first search result - but now in a version where they get money for the click.
  - zo1 3y ago
    So it's a conveniently self-imposed "problem", because websites could also just "sell adspace" like a billboard that anyone could confirm was displaying what was paid for. But instead of that, they created a problem of showing ads "dynamically" thereby necessitating the need to track users. Interesting.
    - arghwhat 3y ago
      Partly true - but it might also have been seen as a better way to utilize the "random" ad spaces available. I do recall it being common for internet ads to be sold directly like billboards back in the day, before the action model took over, especially for higher value sites that could be likened to the prime real estate of a billboard on a city square or key highway with their guaranteed literal traffic. But such direct deals probably didn't scale well, and definitely left smaller sites wanting to earn some extra revenue in the dust. There was a time when ads weren't as shit as they are now - most wouldn't worry about a banner ad or two on their favorite forum.
    - warkdarrior 3y ago

littlestymaar 3y ago

No matter how bad the mozilla proposal is, what you're doing here is whataboutism, which eventually serves Google's interest, and defend their much more dystopian proposal…

mardifoufs 3y ago
That's not what whataboutism is.
- littlestymaar 3y ago
  - Mozilla says “WEI is bad”. - OP responds with “what about IPA” It's litteral whataboutism.
  - kup0 3y ago
    It's only whataboutism if it's irrelevant / changing the subject / etc. OP's criticisms are very relevant, in that, I believe OP is just wanting to see consistency out of Mozilla's positions. This is all still about Mozilla and standards proposals. I'm sure OP is glad that Mozilla takes a negative position on WEI, but when they take other positions simultaneously that seem to counter their WEI positioning, that is a legitimate criticism. I share in that view. I'm glad to see Mozilla push back in a case like this, but they need to do more, and more consistently so.
  - dhx 3y ago
    I think you're attempting to frame the discussion in a very narrow way that is inconsistent with the public backlash. Public backlash is largely due to browser vendors demonstrating a very strong motivation to prioritise the needs of advertisers over users through their contributions to WEI and similar W3C proposals. Were you expecting only responses of praise for Mozilla, that users have been heard on WEI and therefore everyone can move on? Mozilla has invested resources together with Meta into developing the IPA proposal that also prioritises the needs of advertisers over users. The problem that IPA seeks to solve is: "Advertisers need accurate reporting about how their ad campaigns are performing. Currently, businesses use data about the people who viewed their ads and bought their products to determine ‘return on ad spend’. But the ecosystem is moving towards more privacy and less personal data sharing."[1] In Mozilla's response on WEI they've reiterated a commitment to working on solutions to the "invalid traffic" (e.g. ad click fraud) problem, a commitment which necessarily requires user needs to be suppressed. "Detecting fraud and invalid traffic is a challenging problem that we're interested in helping address." Mozilla's response on IPA is therefore directly relevant to the discussion of public backlash for advertiser needs being prioritised over user needs. Mozilla is demonstrating inconsistency with RFC8890[2] and the priority of constituencies from the W3C Web Platform Design Principles[3] and numerous Ethical Web Principles[4]. Whilst these aren't adopted standards, they are a reflection of values of contributors to these standards organisations. A further error of your framing is assuming WEI and IPA proposals can be meaningfully discussed in isolation of each other. With such framing, there is an avoidance of discussion of the combined impact of proposals if they were implemented together, or whether proposals such as IPA still make sense to pursue without WEI (or future equivalent proposal). [1] https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0yCjq4Tw2qPgeezhMfS0-P-TY/edit#slide=id.gf972808ea5_0_0 https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0y... [2] https://www.rfc-editor.org/rfc/rfc8890.html https://www.rfc-editor.org/rfc/rfc8890.html [3] https://www.w3.org/TR/design-principles/#priority-of-constituencies https://www.w3.org/TR/design-principles/#priority-of-constit... [4] https://www.w3.org/TR/ethical-web-principles/#control https://www.w3.org/TR/ethical-web-principles/#control, https://www.w3.org/TR/ethical-web-principles/#multi https://www.w3.org/TR/ethical-web-principles/#multi, https://www.w3.org/TR/ethical-web-principles/#render https://www.w3.org/TR/ethical-web-principles/#render [5] https://en.wikipedia.org/wiki/Whataboutism#Defense https://en.wikipedia.org/wiki/Whataboutism#Defense

onion2k 3y ago

your Mozilla browser will send all of these events to one or more aggregation services ...if you let it.

mindslight 3y ago

To be fair, "Web Integrity" (aka remote attestation aka a corporate surveillance agent built into "your" hardware) is much more fundamental as it would prevent the running of forked browsers that remove deliberate security vulnerabilities like IPA. It's unfortunate that Mozilla "plays ball" on garbage like IPA, but at least as things stand users are free to disable/remove/fork/etc. Whereas remote attestation is fundamentally game over for the idea of user representing agents altogether.