4 ms·

Tracking pixels are just insane. I can't imagine a non-regulatory/legislative solution when the biggest companies on the planet will pay you money just to put a

Tracking pixels are just insane. I can't imagine a non-regulatory/legislative solution when the biggest companies on the planet will pay you money just to put a script on your page. How does that get outcompeted? Someone richer pays you to not sell out your users? Just ban this shit.

throwaway3306a 2y ago
How does the law differentiate that from jQuery on a CDN? The CDN is also doing some amount of tracking, and some of it is simply technically necessary. Google is actually using the Google Fonts service to track traffic.
- mdavidn 2y ago
  A CDN delivering something like jQuery will not receive cookies nor query parameters and will return a very generous max-age, allowing the browser to reuse the resource for any number of pages or sites without contacting the CDN again. The value of CDNs like this has diminished greatly with the advent of HTTP/2 and HTTP/3.
  - hunter2_ 2y ago
    But it could start delivering not-jQuery at some point. Far-fetched on the surface, but it's exactly what occurred with polyfill.io recently: https://blog.qualys.com/vulnerabilities-threat-research/2024/06/28/polyfill-io-supply-chain-attack https://blog.qualys.com/vulnerabilities-threat-research/2024... https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829
    - mdavidn 2y ago
      This is true, but there is a mitigation available: The site can require the resource to match a specified cryptographic hash before running. This did not work with polyfill.io because that CDN would dynamically return different resources based on the user agent. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
      - rvnx 2y ago
        Technically CDNs are not needed, we could just fully drop CDNs as well and cache files by content hash in the browser across multiple sites (<script hash="AAAAAAAAA" fallback="https://cdn..."></script> https://cdn..."></script>, instead of by path). It would make the web faster and reduce tracking. Now, is that really what Google Fonts or Cloudflare CDN wants ? Maybe, but it will reduce the amount of data shared to the intelligence groups.
        Lukas_Skywalker 2y ago
        Caching across sites is a privacy risk in itself, because scripts can measure the time required to load a resource and therefore detect if a visitor has visited another site with the same resource before. That‘s why modern browsers no longer cache across sites. https://news.ycombinator.com/item?id=24894135 https://news.ycombinator.com/item?id=24894135
        dotancohen 2y ago
        Why not add a random 1000-3000 ms delay to making the cached resource available? Timing attacks are not a new phenomenon.
        minitech 2y ago
        Because the point of cache is to save time, not waste it. Like most naïve delays in response to timing attacks, that also doesn’t solve the tracking problem – if there’s any detectable difference (consider a cross-site tracking server that serves the content with a controllable delay) under any circumstances (consider network and disk load and availability), the mitigation is defeated. Sites don’t share that many resources byte-for-byte anyway. The current solution is fine.
        dotancohen 2y ago
        Caches also save bandwidth - for the user, for the server, and for the potentially overloaded network as well.
    - digging 2y ago
      I mean I'm not writing a literal law, but that would be roughly illegal and punishable in my fantasy world where a right to digital privacy existed. Laws, as a rule, don't physically stop anyone from doing anything they want. Plenty of illicit things happen on the internet already.
- digging 2y ago
  > How does the law differentiate that from jQuery on a CDN? The CDN is also doing some amount of tracking, and some of it is simply technically necessary. I don't know, it might be an intractable problem. It sucks how there's no way to tell the difference between the payloads of two different 3rd party scripts when they're executed in the browser, huh?
- tmoertel 2y ago
  > Google is actually using the Google Fonts service to track traffic. According to https://developers.google.com/fonts/faq/privacy#when_i_embed_google_fonts_in_my_website_via_the_google_fonts_web_api_what_data_does_google_receive_from_my_website_visitors https://developers.google.com/fonts/faq/privacy#when_i_embed..., "For clarity, Google does not use any information collected by Google Fonts to create profiles of end users or for targeted advertising."
  - g15jv2dp 2y ago
    Ah, well, if it's written in a FAQ, then the most naive interpretation of the sentence must be true. No way they'd just lie or pull off a "trickster genie" interpretation of that sentence.
  - throwaway3306a 2y ago
    I'm sure they don't. That's also not the only thing you do with tracking.
- BeFlatXIII 2y ago
  > How does the law differentiate that from jQuery on a CDN? Functional utility for the end user
  - throwaway3306a 2y ago
    So the solution is to combine them?
Mountain_Skies 2y ago
Make possession of PII highly risky so the value of collecting this data becomes negative. Then you don't have to come up with cat-and-mouse regulations trying to chase down the latest workaround of the law as companies won't want the liability that comes with possession of the data in the first place.
- digging 2y ago
  Indeed that's a far preferable and more effective approach. PII should be radioactive. Let's see who really needs it to run their business.
roadbuster 2y ago
> when the biggest companies on the planet will pay you money just to put a script on your page AdTech companies don't pay you to install these on your websites. Their customers install them to help understand if the ads they're already paying for are leading to the outcomes they, the customers, care about. I posted a related comment here: https://news.ycombinator.com/item?id=41007679 https://news.ycombinator.com/item?id=41007679 <Customer> I want people to sign-up for my F2P game <Google> We can show ads to people who may be interested in your F2P game <Customer> How do I know if the ads I paid for actually led to installations? <Google> Install this script on your "thanks for signing-up" page <Customer> Cool thanks

throwaway3306a 2y ago

How does the law differentiate that from jQuery on a CDN? The CDN is also doing some amount of tracking, and some of it is simply technically necessary. Google is actually using the Google Fonts service to track traffic.

mdavidn 2y ago
A CDN delivering something like jQuery will not receive cookies nor query parameters and will return a very generous max-age, allowing the browser to reuse the resource for any number of pages or sites without contacting the CDN again. The value of CDNs like this has diminished greatly with the advent of HTTP/2 and HTTP/3.
- hunter2_ 2y ago
  But it could start delivering not-jQuery at some point. Far-fetched on the surface, but it's exactly what occurred with polyfill.io recently: https://blog.qualys.com/vulnerabilities-threat-research/2024/06/28/polyfill-io-supply-chain-attack https://blog.qualys.com/vulnerabilities-threat-research/2024... https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829
  - mdavidn 2y ago
    This is true, but there is a mitigation available: The site can require the resource to match a specified cryptographic hash before running. This did not work with polyfill.io because that CDN would dynamically return different resources based on the user agent. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
    - rvnx 2y ago
      Technically CDNs are not needed, we could just fully drop CDNs as well and cache files by content hash in the browser across multiple sites (<script hash="AAAAAAAAA" fallback="https://cdn..."></script> https://cdn..."></script>, instead of by path). It would make the web faster and reduce tracking. Now, is that really what Google Fonts or Cloudflare CDN wants ? Maybe, but it will reduce the amount of data shared to the intelligence groups.
      - Lukas_Skywalker 2y ago
        Caching across sites is a privacy risk in itself, because scripts can measure the time required to load a resource and therefore detect if a visitor has visited another site with the same resource before. That‘s why modern browsers no longer cache across sites. https://news.ycombinator.com/item?id=24894135 https://news.ycombinator.com/item?id=24894135
        dotancohen 2y ago
        Why not add a random 1000-3000 ms delay to making the cached resource available? Timing attacks are not a new phenomenon.
        minitech 2y ago
        Because the point of cache is to save time, not waste it. Like most naïve delays in response to timing attacks, that also doesn’t solve the tracking problem – if there’s any detectable difference (consider a cross-site tracking server that serves the content with a controllable delay) under any circumstances (consider network and disk load and availability), the mitigation is defeated. Sites don’t share that many resources byte-for-byte anyway. The current solution is fine.
        dotancohen 2y ago
        Caches also save bandwidth - for the user, for the server, and for the potentially overloaded network as well.
  - digging 2y ago
    I mean I'm not writing a literal law, but that would be roughly illegal and punishable in my fantasy world where a right to digital privacy existed. Laws, as a rule, don't physically stop anyone from doing anything they want. Plenty of illicit things happen on the internet already.
digging 2y ago
> How does the law differentiate that from jQuery on a CDN? The CDN is also doing some amount of tracking, and some of it is simply technically necessary. I don't know, it might be an intractable problem. It sucks how there's no way to tell the difference between the payloads of two different 3rd party scripts when they're executed in the browser, huh?
tmoertel 2y ago
> Google is actually using the Google Fonts service to track traffic. According to https://developers.google.com/fonts/faq/privacy#when_i_embed_google_fonts_in_my_website_via_the_google_fonts_web_api_what_data_does_google_receive_from_my_website_visitors https://developers.google.com/fonts/faq/privacy#when_i_embed..., "For clarity, Google does not use any information collected by Google Fonts to create profiles of end users or for targeted advertising."
- g15jv2dp 2y ago
  Ah, well, if it's written in a FAQ, then the most naive interpretation of the sentence must be true. No way they'd just lie or pull off a "trickster genie" interpretation of that sentence.
- throwaway3306a 2y ago
  I'm sure they don't. That's also not the only thing you do with tracking.
BeFlatXIII 2y ago
> How does the law differentiate that from jQuery on a CDN? Functional utility for the end user
- throwaway3306a 2y ago
  So the solution is to combine them?

Mountain_Skies 2y ago

Make possession of PII highly risky so the value of collecting this data becomes negative. Then you don't have to come up with cat-and-mouse regulations trying to chase down the latest workaround of the law as companies won't want the liability that comes with possession of the data in the first place.

digging 2y ago
Indeed that's a far preferable and more effective approach. PII should be radioactive. Let's see who really needs it to run their business.

roadbuster 2y ago

> when the biggest companies on the planet will pay you money just to put a script on your page AdTech companies don't pay you to install these on your websites. Their customers install them to help understand if the ads they're already paying for are leading to the outcomes they, the customers, care about. I posted a related comment here: https://news.ycombinator.com/item?id=41007679 https://news.ycombinator.com/item?id=41007679 <Customer> I want people to sign-up for my F2P game <Google> We can show ads to people who may be interested in your F2P game <Customer> How do I know if the ads I paid for actually led to installations? <Google> Install this script on your "thanks for signing-up" page <Customer> Cool thanks