5 ms·

You can't reference Claude Shannon and information theory and then say a system to serve ads that preserves privacy can't exist. It's especially ironic because

You can't reference Claude Shannon and information theory and then say a system to serve ads that preserves privacy can't exist. It's especially ironic because they use a technique called Differential Privacy to prevent any actual bits of information from being leaked to advertisers: https://andrewmoore.ca/blog/post/mozilla-ppa/#user-content-fnref-7 https://andrewmoore.ca/blog/post/mozilla-ppa/#user-content-f... / https://arxiv.org/pdf/2405.16719 https://arxiv.org/pdf/2405.16719

eulgro 2y ago
It's information still, maybe not targeted to the individual, but it allows still identifying trends which will eventually result in an ad I will (maybe) see. The advertiser wastes its time trying to show me an ad I will likely block, requiring filter managers to spend time blocking the ad and requiring me to spend time installing the extension. The total utility of the system is negative, even if just slightly. Sure there are cases where an ad could inform me of something useful I actually need, but this has basically never occurred to me, ever. From there we can devise that the best solution for society is a global ban on advertisement.
- striking 2y ago
  I think the first order utility of the system is indeed negative. But the second order effect is to set a boundary with advertisers as to what is acceptable, which is positive. I don't think it actually allows advertisers to identify trends except in terms of conversion rates. Let me reproduce the paragraph I linked to: > Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad (published on source ) led number of people to a positive outcome for their customer over a period of time . Some amount of noise is also added to the information in order to further strengthen privacy[7]. Impressions without conversions aren't reported, so the only trends seen are over conversions as grouped by websites. If that's all it takes for advertisers to stop fingerprinting us, I'm open to something along those lines.
  - throwaway81523 2y ago
    > But the second order effect is to set a boundary with advertisers as to what is acceptable, which is positive. The idea of advertisers respecting boundaries or caring what other people think is acceptable seems hopelessly naive. As I remember, the Do Not Track (DNT) header was motivated by the same ideal, and it failed totally, as one should expect. Advertisers will take whatever they can pry loose. > Impressions without conversions aren't reported, so the only trends seen are over conversions as grouped by websites. If that's all it takes for advertisers to stop fingerprinting us, I'm open to something along those lines. They won't stop, and anyway fingerprinting is just one invasion out of many. If they also want information about trends, then of course I want to deny that to them as well. Thought experiment: instead of opting everyone in by default, suppose Mozilla does an A/B test. Opt in 50% of the users by default, and opt out the other 50%. Then see how many users in each group switch the setting away from the default. Do you expect more will opt in on purpose, or opt out on purpose? What does that make you think of Mozilla's actual choice of default?
    - striking 2y ago
      > As I remember, the Do Not Track (DNT) header was motivated by the same ideal, and it failed totally, as one should expect. Microsoft decided to turn on DNT by default in Windows 8 / MSIE 10, which led to a violation of the DNT standard and a complicated debacle which rendered the whole thing pointless. It was a silly idea and an even sillier outcome, but that does not make the ideal itself silly. > They won't stop Then we can rip this out later, or submit a patch to opt everyone out. I trust Mozilla to accept such a patch much more than I do Google. It's not irreversible, it's an ongoing negotiation. > Thought experiment: Your thought experiment ignores the rationale Mozilla provided. I think ideally we would be notified on first upgrade / out of box that we are opted in to sharing our preferences with advertisers in a limited way, with a nice obvious "Opt out" button in that notification. That way, legitimate advertisers get the limited conversion rate information they desperately want from enough people who aren't interested one way or the other, and those who are diametrically opposed to the entire concept are perfectly able to turn it off before their first browsing action. But I also don't think they'd build an interface this extensive for what they describe as a limited test run against a handful of allow-listed sites for exploratory and standards-determining reasons. I would have liked to at least see a heads-up upon the activation of this system in those cases, since that seems easy enough to build for a test run.
throwaway81523 2y ago
Differential privacy just means the info isn't linked to individual users. It is still information. Statistical information is information. If it was useless to advertisers, they wouldn't be willing to pay for it. And if it is useful to the advertisers, then extracting it without user permission is invasive.
- striking 2y ago
  Fine, but privacy is privacy. I'm no fan of advertisers either, but if you're going to invoke Shannon let's use the right terms and stay intellectually consistent.
  - throwaway81523 2y ago
    Do you understand Shannon's definition? Have I made a mistake somewhere? Differential privacy as I understood it is a statistical notion. It gives the advertiser a noisy average of the behaviour of a large group but not about the individual users in the group. Mozilla pulls a switcheroo saying that the individual info is protected so everything is fine. In fact the statistical info is invasive too, and that's Shannon's notion. The system is private if the information gained by the adversary is exactly zero. Also, "advertiser" is way too benign a term: in cryptography we generally use "adversary". Consider that in this election season, the Trump and Biden political campaigns will be among the biggest advertisers. Mozilla will sell them information and they will use it. Question: will they only use it to solicit votes, or will they also use it to help round up their enemies if they get into power? And yes, they can use statistical information for that. The first thing they will want to know about any specific class of enemy is how many of them there are, before worrying about identifying individuals. So Mozilla shouldn't help them with either.
    - striking 2y ago
      Does Shannon actually have a concrete definition of "privacy"? Maybe you're confusing it with "perfect secrecy", which is a cryptographic measure I'm not sure applies here. > Mozilla will give them information and they will use it. Let's just get on the same page about what information the advertisers get. I'll reproduce the paragraph I linked to: > Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad y (published on source x) led number of people to a positive outcome for their customer over a period of time p. Some amount of noise is also added to the information in order to further strengthen privacy[7]. I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience. Not to mention that as state actors I'm sure they would have other, more useful and reliable methods of doing... whatever you're accusing them of doing.
Tao3300 2y ago
> You can't reference Claude Shannon and information theory and then say a system to serve ads that preserves privacy can't exist. They didn't say that. They said this isn't it.

eulgro 2y ago

It's information still, maybe not targeted to the individual, but it allows still identifying trends which will eventually result in an ad I will (maybe) see. The advertiser wastes its time trying to show me an ad I will likely block, requiring filter managers to spend time blocking the ad and requiring me to spend time installing the extension. The total utility of the system is negative, even if just slightly. Sure there are cases where an ad could inform me of something useful I actually need, but this has basically never occurred to me, ever. From there we can devise that the best solution for society is a global ban on advertisement.

striking 2y ago
I think the first order utility of the system is indeed negative. But the second order effect is to set a boundary with advertisers as to what is acceptable, which is positive. I don't think it actually allows advertisers to identify trends except in terms of conversion rates. Let me reproduce the paragraph I linked to: > Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad (published on source ) led number of people to a positive outcome for their customer over a period of time . Some amount of noise is also added to the information in order to further strengthen privacy[7]. Impressions without conversions aren't reported, so the only trends seen are over conversions as grouped by websites. If that's all it takes for advertisers to stop fingerprinting us, I'm open to something along those lines.
- throwaway81523 2y ago
  > But the second order effect is to set a boundary with advertisers as to what is acceptable, which is positive. The idea of advertisers respecting boundaries or caring what other people think is acceptable seems hopelessly naive. As I remember, the Do Not Track (DNT) header was motivated by the same ideal, and it failed totally, as one should expect. Advertisers will take whatever they can pry loose. > Impressions without conversions aren't reported, so the only trends seen are over conversions as grouped by websites. If that's all it takes for advertisers to stop fingerprinting us, I'm open to something along those lines. They won't stop, and anyway fingerprinting is just one invasion out of many. If they also want information about trends, then of course I want to deny that to them as well. Thought experiment: instead of opting everyone in by default, suppose Mozilla does an A/B test. Opt in 50% of the users by default, and opt out the other 50%. Then see how many users in each group switch the setting away from the default. Do you expect more will opt in on purpose, or opt out on purpose? What does that make you think of Mozilla's actual choice of default?
  - striking 2y ago
    > As I remember, the Do Not Track (DNT) header was motivated by the same ideal, and it failed totally, as one should expect. Microsoft decided to turn on DNT by default in Windows 8 / MSIE 10, which led to a violation of the DNT standard and a complicated debacle which rendered the whole thing pointless. It was a silly idea and an even sillier outcome, but that does not make the ideal itself silly. > They won't stop Then we can rip this out later, or submit a patch to opt everyone out. I trust Mozilla to accept such a patch much more than I do Google. It's not irreversible, it's an ongoing negotiation. > Thought experiment: Your thought experiment ignores the rationale Mozilla provided. I think ideally we would be notified on first upgrade / out of box that we are opted in to sharing our preferences with advertisers in a limited way, with a nice obvious "Opt out" button in that notification. That way, legitimate advertisers get the limited conversion rate information they desperately want from enough people who aren't interested one way or the other, and those who are diametrically opposed to the entire concept are perfectly able to turn it off before their first browsing action. But I also don't think they'd build an interface this extensive for what they describe as a limited test run against a handful of allow-listed sites for exploratory and standards-determining reasons. I would have liked to at least see a heads-up upon the activation of this system in those cases, since that seems easy enough to build for a test run.

throwaway81523 2y ago

Differential privacy just means the info isn't linked to individual users. It is still information. Statistical information is information. If it was useless to advertisers, they wouldn't be willing to pay for it. And if it is useful to the advertisers, then extracting it without user permission is invasive.

striking 2y ago
Fine, but privacy is privacy. I'm no fan of advertisers either, but if you're going to invoke Shannon let's use the right terms and stay intellectually consistent.
- throwaway81523 2y ago
  Do you understand Shannon's definition? Have I made a mistake somewhere? Differential privacy as I understood it is a statistical notion. It gives the advertiser a noisy average of the behaviour of a large group but not about the individual users in the group. Mozilla pulls a switcheroo saying that the individual info is protected so everything is fine. In fact the statistical info is invasive too, and that's Shannon's notion. The system is private if the information gained by the adversary is exactly zero. Also, "advertiser" is way too benign a term: in cryptography we generally use "adversary". Consider that in this election season, the Trump and Biden political campaigns will be among the biggest advertisers. Mozilla will sell them information and they will use it. Question: will they only use it to solicit votes, or will they also use it to help round up their enemies if they get into power? And yes, they can use statistical information for that. The first thing they will want to know about any specific class of enemy is how many of them there are, before worrying about identifying individuals. So Mozilla shouldn't help them with either.
  - striking 2y ago
    Does Shannon actually have a concrete definition of "privacy"? Maybe you're confusing it with "perfect secrecy", which is a cryptographic measure I'm not sure applies here. > Mozilla will give them information and they will use it. Let's just get on the same page about what information the advertisers get. I'll reproduce the paragraph I linked to: > Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad y (published on source x) led number of people to a positive outcome for their customer over a period of time p. Some amount of noise is also added to the information in order to further strengthen privacy[7]. I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience. Not to mention that as state actors I'm sure they would have other, more useful and reliable methods of doing... whatever you're accusing them of doing.

Tao3300 2y ago

> You can't reference Claude Shannon and information theory and then say a system to serve ads that preserves privacy can't exist. They didn't say that. They said this isn't it.