3 ms·

Does Shannon actually have a concrete definition of "privacy"? Maybe you're confusing it with "perfect secrecy", which is a cryptographic measure I'm not sure a

Does Shannon actually have a concrete definition of "privacy"? Maybe you're confusing it with "perfect secrecy", which is a cryptographic measure I'm not sure applies here. > Mozilla will give them information and they will use it. Let's just get on the same page about what information the advertisers get. I'll reproduce the paragraph I linked to: > Since the DAP server acts as a middleman, and reports are only generated at conversion times (impressions without conversions are not reported), ad networks have no way through this method of collecting your personal information (such as your user information or your IP address/browser client info). All they receive is an aggregate that informs them that their ad y (published on source x) led number of people to a positive outcome for their customer over a period of time p. Some amount of noise is also added to the information in order to further strengthen privacy[7]. I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience. Not to mention that as state actors I'm sure they would have other, more useful and reliable methods of doing... whatever you're accusing them of doing.

throwaway81523 2y ago
> Does Shannon actually have a concrete definition of "privacy"? Maybe you're confusing it with "perfect secrecy", which is a cryptographic measure I'm not sure applies here. Perfect secrecy is the standard that a browser calling itself privacy preserving should use. It should give the adversary no information that they don't already have. The concept of browser privacy of course didn't exist when Shannon wrote his paper. > I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience. The adversary can make a statistical estimate before getting the conversion rate, and another one that has been conditioned on the conversion rate. If the two estimates aren't the same, they have gained information, so Shannon secrecy has failed. Why do you make this so complicated? Mozilla runs this program and if you participate in it, your adversaries benefit from your participation. So do you want to participate? More concretely, what do you think of Mozilla opting you in by default? Which side did they say they were on?
- striking 2y ago
  > Perfect secrecy is the standard that a browser calling itself privacy preserving should use. I'm not convinced. It sounds nice, but why? We already know Mozilla's counterargument, and in my personal experience of having thrown chaff in the way of annoying interlopers before, it seems reasonable. > If the two estimates aren't the same, they have gained information Okay, so by my understanding, now the goalposts are all the way out to being unable to capture the count of enemies but being able to verify the count? I feel like this is a long way from the original argument (in either intention or phrasing). > Why do you make this so complicated? Because I have at least a passing interest in nuance. It's not great that Mozilla hasn't learned from the Pocket debacle, and I am glad that folks like yourself are understandably angry about being opted into something that benefits others without not just consent but even notification, because pushing back on stuff like this even on principle is commendable. We don't disagree on that being wrong. I would just prefer we discuss facts based in reality and focus our conversation, because that makes change more effective. If you want a blanket ban on advertisers across the web, I'm in agreement with you. If you want Mozilla to stop shipping potentially privacy-affecting changes without consent or notification, I'm in agreement with you. But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound.
  - throwaway81523 2y ago
    > Okay, so by my understanding, now the goalposts are all the way out to being unable to capture the count of enemies but being able to verify the count? I don't think the goalposts have moved, at least for me. I've always had them set at Mozilla not turning any info over to advertisers. They spout a mathematical formalism (differential privacy) so I point out that a better formalism (Shannon secrecy) already existed 70 years earlier and they should stay with it. > If you want Mozilla to stop shipping potentially privacy-affecting changes without consent or notification, I'm in agreement with you. But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound. "Without consent or notification" is more misdirection, since they did give notice and arguably obtained consent, knowing perfectly well that almost nobody actually reads the notifications and conditions, and instead uses the defaults. If they have default opt-out and a true affirmative opt-in then that is more acceptable. We went through this with email spam more than a decade ago, and currently acceptable practice is DOUBLE opt-in. > But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound. I can believe that in technical terms, their system does what it says it does. Their reasoning for implementing it is that it brings in money, and that reasoning is probably sound too (i.e. it really does bring in money). Their reasoning that it preserves user privacy is self-serving and obnoxious. They too successfully obfuscate how real privacy protection would work.

throwaway81523 2y ago

> Does Shannon actually have a concrete definition of "privacy"? Maybe you're confusing it with "perfect secrecy", which is a cryptographic measure I'm not sure applies here. Perfect secrecy is the standard that a browser calling itself privacy preserving should use. It should give the adversary no information that they don't already have. The concept of browser privacy of course didn't exist when Shannon wrote his paper. > I'm not aware of how you "round up your enemies" using conversion rate information on websites. It doesn't even tell you how many "specific class of enemy" there is, it's too muddled by the variable of the click rate of the audience. The adversary can make a statistical estimate before getting the conversion rate, and another one that has been conditioned on the conversion rate. If the two estimates aren't the same, they have gained information, so Shannon secrecy has failed. Why do you make this so complicated? Mozilla runs this program and if you participate in it, your adversaries benefit from your participation. So do you want to participate? More concretely, what do you think of Mozilla opting you in by default? Which side did they say they were on?

striking 2y ago
> Perfect secrecy is the standard that a browser calling itself privacy preserving should use. I'm not convinced. It sounds nice, but why? We already know Mozilla's counterargument, and in my personal experience of having thrown chaff in the way of annoying interlopers before, it seems reasonable. > If the two estimates aren't the same, they have gained information Okay, so by my understanding, now the goalposts are all the way out to being unable to capture the count of enemies but being able to verify the count? I feel like this is a long way from the original argument (in either intention or phrasing). > Why do you make this so complicated? Because I have at least a passing interest in nuance. It's not great that Mozilla hasn't learned from the Pocket debacle, and I am glad that folks like yourself are understandably angry about being opted into something that benefits others without not just consent but even notification, because pushing back on stuff like this even on principle is commendable. We don't disagree on that being wrong. I would just prefer we discuss facts based in reality and focus our conversation, because that makes change more effective. If you want a blanket ban on advertisers across the web, I'm in agreement with you. If you want Mozilla to stop shipping potentially privacy-affecting changes without consent or notification, I'm in agreement with you. But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound.
- throwaway81523 2y ago
  > Okay, so by my understanding, now the goalposts are all the way out to being unable to capture the count of enemies but being able to verify the count? I don't think the goalposts have moved, at least for me. I've always had them set at Mozilla not turning any info over to advertisers. They spout a mathematical formalism (differential privacy) so I point out that a better formalism (Shannon secrecy) already existed 70 years earlier and they should stay with it. > If you want Mozilla to stop shipping potentially privacy-affecting changes without consent or notification, I'm in agreement with you. But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound. "Without consent or notification" is more misdirection, since they did give notice and arguably obtained consent, knowing perfectly well that almost nobody actually reads the notifications and conditions, and instead uses the defaults. If they have default opt-out and a true affirmative opt-in then that is more acceptable. We went through this with email spam more than a decade ago, and currently acceptable practice is DOUBLE opt-in. > But the actual system they describe and their reasoning for implementing it is, in my mind, relatively sound. I can believe that in technical terms, their system does what it says it does. Their reasoning for implementing it is that it brings in money, and that reasoning is probably sound too (i.e. it really does bring in money). Their reasoning that it preserves user privacy is self-serving and obnoxious. They too successfully obfuscate how real privacy protection would work.