6 ms·

Jonathan Mayer Threatens To End “Do Not Track” Talks

85 points by shill 13y ago

nostromo 13y ago
I love the intention here -- but it seems obvious that this will just push advertisers to set up a subdomain that points to advertisers -- and advertisers will use ip address and/or browser fingerprinting to track across domains. ... and we'll end up right where we are today.
- throwaway125 13y ago
  Giving another company the ability to serve content (javascript) on a subdomain would make ad companies prime targets for all kinds of hacking campaigns. Their ability to serve javascript and probably access session cookies on a large number of domains would turn them in some kind of skeleton key. This is bad for both the advertisers, the websites serving their ads and the visitors of those websites. I certainly hope people would think twice about actually implementing something like that.
  - nodata 13y ago
    "Well we either run the ads with subdomains, or say goodbye to funding and our jobs."
- cinquemb 13y ago
  >and advertisers will use ip address and/or browser fingerprinting to track across domains. and people will come up with ways to set and spoof what kind of headers their browser sends. but your right, where we are today is where people that care enough to circumvent tracking, do circumvent it.
nthitz 13y ago
Wikipedia says 85% of Mozilla's revenue is from Google. Mayer's moves are sure to ruffle some feathers at the search giant if they go through with it in Firefox.
- jonursenbach 13y ago
  Aren't Google's ads already served via a first-party cookie?
  - eclipticplane 13y ago
    What about the remarketing / retargeting / adwords conversion cookies?
  - handsomeransoms 13y ago
    Indeed - in fact, one little-discussed concern over 3rd-party cookie blocking is whether it would consolidate the power to track users into the hands of a few already powerful online companies (Google, Facebook, anybody that serves cookies on the domain that you also visit...)
eggbrain 13y ago
This can only play out a few ways, right? A) Firefox holds its ground, Advertisers hold their ground as well. Advertisers refuse to work with websites that support the version of Firefox with "Do Not Track", unless the websites add some code to tell their visitors to use another browser/refuse to load the site. This leads to two scenarios: Ai) Developers agree and implement advertiser strategy, Firefox becomes an unreliable browsing experience, market share slips. Firefox possibly reverses position. Aii) Developers refuse to implement advertiser strategy (by using either another ad partner or moving to a different monetization strategy), and advertisers finally reverse position. B) Firefox holds its ground, advertisers cave: websites start seeing less revenue from ads as targeting isn't as effective anymore, websites that get most of their money from ad revenue either start panicking and blocking Firefox users, or start putting up paywalls. C) Firefox yields, advertisers get their way: pretty much the status quo. D) Firefox yields, advertisers yield: some sort of compromise between the two camps.
- anologwintermut 13y ago
  E) Firefox holds its ground. Advertisers start finding more invasive ways to track people (flash cookies, user-agent strings, font packages ... "super cookies").
  - c0ur7n3y 13y ago
    What do you mean start? All of those methods are already being used. Regular cookies are so five-years-ago.
- tomjen3 13y ago
  How many sites block you for using adblock? Yeah, that is likely the same number of issues you will have with no third-party cookies.
  - eggbrain 13y ago
    Not many now, but if websites start feeling the squeeze from ad revenue, it will become more common (see Hulu making commercials 2-3x as long if Adblock is enabled). It's also an unfair comparison because Adblock is opt-in -- you have to download the add-on to get it to work, which not many people are willing to do (what percentage of Firefox users use AdBlock -- maybe 5%?). DNT, on the other hand, is something all Firefox users will have enabled by default -- Imagine 20% of the worldwide browsing market suddenly blocking all tracking cookies.
handsomeransoms 13y ago
This is one of the worst pieces of tech/business journalism I have ever had the misfortune to read. The overwhelming desire to paint Jonathan Mayer as David to the digital advertising industry's Goliath completely distorts the reality of the negotiations and misrepresents how decisions about both code and policy are made at Mozilla. It is insulting to Mozilla, which has been working in good faith on these negotiations from the beginning, and to Mayer, who it patronizingly describes as "just a volunteer who hangs around the offices of Mozilla." It is also riddled with technical errors that suggest this journalist lacks even the basic understanding of technology that should be a prerequisite for working in this space. This is all especially frustrating because, for some strange reason, these Business Insider pieces get a lot of traction online. This piece is on the HN front page at the moment, and their last, similarly asinine, piece about the proposal to block 3rd Party Cookies in Firefox has over 3,000 comments on Reddit. [1] For a more accurate representation of the current state of Mayer's 3rd party cookie blocking patch, read Brendan Eich's recent post [2]. [1] http://www.reddit.com/r/technology/comments/1dy74c/jonathan_mayer_the_guy_who_just_turned_off_3rd/ http://www.reddit.com/r/technology/comments/1dy74c/jonathan_... [2] https://brendaneich.com/2013/05/c-is-for-cookie/ https://brendaneich.com/2013/05/c-is-for-cookie/
- driverdan 13y ago
  Not only that but if you use privacy protecting plugins the site won't even load the article. It just shows a link that goes to the homepage.
- pyrocat 13y ago
  Yeah the part that got was me where they said that cookies "also help web sites handle logins and other basic functions" without making the distinction between domain cookies and 3rd party cookies. And then followed it up with "Currently, Apple's Safari blocks cookies;".
- AJ007 13y ago
  I would suggest Business Insider is banned from HN, there is no quality control, it is Demand Media's content farm model applied to news. If this was my responsibility I would also look very closely at who is upvoting Business Insider stories.
rosser 13y ago
The irony of this article appearing on Business Insider, a site which won't work if you try to load it with Ghostery or AdBlock enabled, is rather piquant. EDIT: Maybe I'm doing something wrong, but the only way I can get an article to show up on this site is to disable all plugins, and load it in an incognito window. Up-to-date Chrome on up-to-date Lion.
- josephg 13y ago
  Business Insider works fine with 3rd party cookies disabled. (Edit: Chrome on a mac, no plugins. I've enabled 'Block 3rd party cookies and site data' and Click to play for flash)
  - prg318 13y ago
    Every time I click the "Continue to business insider" link I am redirected to the same page with the "Continue to business insider" link. I'm using Firefox and Ghostery on XP. Weirdly enough after four of five clicks it finally directed me to the article.
    - rosser 13y ago
      Exactly the behavior I see, except that I've never gone more than three clicks before giving up and trying in an incognito window (where I have all plugins disabled). Since that tends to work, first try, it's become my default.
- usea 13y ago
  It loads fine with adblock enabled.
- ronaldx 13y ago
  Business Insider is one of few sites which won't load any content with strict script/third party blocking, agreed. Luckily, I don't generally find its content worth unblocking.
hammerzeit 13y ago
I do think there's something to the argument that any reasonable implementation of "Do Not Track" would just further entrench the companies who already have large consumer traffic (Google, Facebook, et al), by virtue of the substantial privileging of first-party cookies over third-party cookies at that point. Now, you could argue, this is desirable -- after all, companies with large consumer brands have much more at risk in terms of doing unethical things with data (yes, I'm aware of the irony of saying that after the PRISM issue, but I think that only affirms my point). At the same time, does Google/FB/etc need any more help in dominating advertising than they already do?
ChuckMcM 13y ago
There has been some talk that the reason Chrome stopped gaining share against IE and Firefox was because of the do-not-track situation. IE9 had it and then turned it back off by default, Firefox was the first to implement it and it is considering making it the default. This is what I predict will happen, should Mozilla begin shipping with it turned on by default. Advertisers will modify their contracts such that they pay $x if tracking is enabled on the browser and $y if it is not. $y will be much less than $x, perhaps 1/10th the amount because the Advertiser will argue it is harder to detect and prevent fraud without the tracking cookies. Web sites will then these do not track (DNT) sessions as "low value" sessions and will either refuse to display content, or force some difficult to subvert captcha movie watching thing with survey in order to establish the low fraud barrier and get the 'good' price for ads. The result will be that 'free' web sites will become even more obnoxious and subscription sites where they actually reduce or eliminate the advertisements altogether will become more practical.
rsync 13y ago
The more alarming piece of the article is this: "The move might also invite legislation from Congress." So ... presumably a govt body would define what a web browser is, then define what tracking is, and then ... what ? Legislate browser code ? Would wget need defaults built in for the code that comes over ? What if I 'nc' to port 80 and redirect to a file ? What is a "web browser" anyway ? What constitutes consumption of tracking codes ? Are there punishments involved ? Is the curl library at fault if it is misused in this government mandated way ? Terrible, depressing, and predictable.
- x0x0 13y ago
  Governments already (and appropriately) legislate all sorts of things about software. * Some governments require windows to present a choice of web browsers. * Some governments require websites, operating systems, or programs to provide for accessibility to the disabled. Some governments also regulate information collection and sharing: * Some governments (including the US) regulate what information credit card companies must provide to consumers. * Some governments (including the US) regulate what info credit bureaus can collect, sell, require them to provide free copies on demand to those surveilled, and set up a framework for a dispute process. It's perfectly reasonable for governments, as an agent of the people, to create laws and regulations around what can be collected and how. And yes, code may have to go into browsers to comply.
  - handsomeransoms 13y ago
    The long history of the interactions between relatively slow-moving governments and relatively fast-moving technology suggests that we should only legislate software as a last resort. One of the nice things about the proposed Do Not Track standard is that it requires no additional legislation. Once advertising bodies agree to some meaningful definition of DNT, any violations could be prosecuted using existing laws that protect consumers from deceptive advertising. Online tracking is a difficult problem without a purely technical solution available. Even with 3rd party cookies blocked, advertisers will still use first party cookies (Google, Facebook), or more sneaky and difficult to mititgate mechanisms (browser fingerprinting, evercookies) to track Internet users. Legislating is slow, uncertain, full of compromise, and riddled with conflicts of interest (hold the comparisons to the current DNT negotiations, please). While it is sometimes appropriate, or required as the only remaining recourse, it is far from an ideal solution - especially with a problem such as this where there is such an imbalance of influence between parties in Washington.
deleted 13y ago
[deleted]
steveklabnik 13y ago
Doesn't Apache not support DNT, so it's my this lately moot anyway?
lifeisstillgood 13y ago
I have just never realised there are people like johnathon on our side out there. Thank you. I also just realised that there are sites in the US, UK, Europe to watch and follow debates on each parliament, but the debates on the important workings of these groups seem to be sporadically reported, even here on HN. Anyone want to help me setup a "theyworkforyou" for w3c working groups? (I mean if congress rules how a browser should behave in the US, does it affect me here? If not then frankly these groups overrule each individual parliament in fairly significant ways )
bokglobule 13y ago
It's made me consider going back to Firefox from Chrome.
thezilch 13y ago
Jonathan and Firefox have yet to explain how embedded modules like Disqus, Stripe, or similar are meant to go about their business and without resorting to the EverCookie-like tactics? Facebook or similar apps requiring stateful sessions? I guess we'll all just setup 2nd party sub-domains for advertisers, or serve our ads off a Google domain (or <insert entrenched advertiser>).
chris_mahan 13y ago
Just block the cookies already, and allow the users to turn them back on on a per-site basis.
tehwalrus 13y ago
As long as I'm still allowed to block 3rd party cookies with a few exceptions (like Disqus), I don't really care. If we (e.g. Mozilla, others, open web supporters) want to educate users about 3rd party cookies can't we just create a new startup wizard or something, like the windows "choose a browser" popup?
fredsanford 13y ago
I would suggest that advertisers and their cronies stop acting like scumbags unless they want to be treated like scumbags.

85 points by shill 13y ago

I love the intention here -- but it seems obvious that this will just push advertisers to set up a subdomain that points to advertisers -- and advertisers will use ip address and/or browser fingerprinting to track across domains. ... and we'll end up right where we are today.

throwaway125 13y ago
Giving another company the ability to serve content (javascript) on a subdomain would make ad companies prime targets for all kinds of hacking campaigns. Their ability to serve javascript and probably access session cookies on a large number of domains would turn them in some kind of skeleton key. This is bad for both the advertisers, the websites serving their ads and the visitors of those websites. I certainly hope people would think twice about actually implementing something like that.
- nodata 13y ago
  "Well we either run the ads with subdomains, or say goodbye to funding and our jobs."
cinquemb 13y ago
>and advertisers will use ip address and/or browser fingerprinting to track across domains. and people will come up with ways to set and spoof what kind of headers their browser sends. but your right, where we are today is where people that care enough to circumvent tracking, do circumvent it.

nthitz 13y ago

Wikipedia says 85% of Mozilla's revenue is from Google. Mayer's moves are sure to ruffle some feathers at the search giant if they go through with it in Firefox.

jonursenbach 13y ago
Aren't Google's ads already served via a first-party cookie?
- eclipticplane 13y ago
  What about the remarketing / retargeting / adwords conversion cookies?
- handsomeransoms 13y ago
  Indeed - in fact, one little-discussed concern over 3rd-party cookie blocking is whether it would consolidate the power to track users into the hands of a few already powerful online companies (Google, Facebook, anybody that serves cookies on the domain that you also visit...)

eggbrain 13y ago

This can only play out a few ways, right? A) Firefox holds its ground, Advertisers hold their ground as well. Advertisers refuse to work with websites that support the version of Firefox with "Do Not Track", unless the websites add some code to tell their visitors to use another browser/refuse to load the site. This leads to two scenarios: Ai) Developers agree and implement advertiser strategy, Firefox becomes an unreliable browsing experience, market share slips. Firefox possibly reverses position. Aii) Developers refuse to implement advertiser strategy (by using either another ad partner or moving to a different monetization strategy), and advertisers finally reverse position. B) Firefox holds its ground, advertisers cave: websites start seeing less revenue from ads as targeting isn't as effective anymore, websites that get most of their money from ad revenue either start panicking and blocking Firefox users, or start putting up paywalls. C) Firefox yields, advertisers get their way: pretty much the status quo. D) Firefox yields, advertisers yield: some sort of compromise between the two camps.

anologwintermut 13y ago
E) Firefox holds its ground. Advertisers start finding more invasive ways to track people (flash cookies, user-agent strings, font packages ... "super cookies").
- c0ur7n3y 13y ago
  What do you mean start? All of those methods are already being used. Regular cookies are so five-years-ago.
tomjen3 13y ago
How many sites block you for using adblock? Yeah, that is likely the same number of issues you will have with no third-party cookies.
- eggbrain 13y ago
  Not many now, but if websites start feeling the squeeze from ad revenue, it will become more common (see Hulu making commercials 2-3x as long if Adblock is enabled). It's also an unfair comparison because Adblock is opt-in -- you have to download the add-on to get it to work, which not many people are willing to do (what percentage of Firefox users use AdBlock -- maybe 5%?). DNT, on the other hand, is something all Firefox users will have enabled by default -- Imagine 20% of the worldwide browsing market suddenly blocking all tracking cookies.

handsomeransoms 13y ago

This is one of the worst pieces of tech/business journalism I have ever had the misfortune to read. The overwhelming desire to paint Jonathan Mayer as David to the digital advertising industry's Goliath completely distorts the reality of the negotiations and misrepresents how decisions about both code and policy are made at Mozilla. It is insulting to Mozilla, which has been working in good faith on these negotiations from the beginning, and to Mayer, who it patronizingly describes as "just a volunteer who hangs around the offices of Mozilla." It is also riddled with technical errors that suggest this journalist lacks even the basic understanding of technology that should be a prerequisite for working in this space. This is all especially frustrating because, for some strange reason, these Business Insider pieces get a lot of traction online. This piece is on the HN front page at the moment, and their last, similarly asinine, piece about the proposal to block 3rd Party Cookies in Firefox has over 3,000 comments on Reddit. [1] For a more accurate representation of the current state of Mayer's 3rd party cookie blocking patch, read Brendan Eich's recent post [2]. [1] http://www.reddit.com/r/technology/comments/1dy74c/jonathan_mayer_the_guy_who_just_turned_off_3rd/ http://www.reddit.com/r/technology/comments/1dy74c/jonathan_... [2] https://brendaneich.com/2013/05/c-is-for-cookie/ https://brendaneich.com/2013/05/c-is-for-cookie/

driverdan 13y ago
Not only that but if you use privacy protecting plugins the site won't even load the article. It just shows a link that goes to the homepage.
pyrocat 13y ago
Yeah the part that got was me where they said that cookies "also help web sites handle logins and other basic functions" without making the distinction between domain cookies and 3rd party cookies. And then followed it up with "Currently, Apple's Safari blocks cookies;".
AJ007 13y ago
I would suggest Business Insider is banned from HN, there is no quality control, it is Demand Media's content farm model applied to news. If this was my responsibility I would also look very closely at who is upvoting Business Insider stories.

rosser 13y ago

The irony of this article appearing on Business Insider, a site which won't work if you try to load it with Ghostery or AdBlock enabled, is rather piquant. EDIT: Maybe I'm doing something wrong, but the only way I can get an article to show up on this site is to disable all plugins, and load it in an incognito window. Up-to-date Chrome on up-to-date Lion.

josephg 13y ago
Business Insider works fine with 3rd party cookies disabled. (Edit: Chrome on a mac, no plugins. I've enabled 'Block 3rd party cookies and site data' and Click to play for flash)
- prg318 13y ago
  Every time I click the "Continue to business insider" link I am redirected to the same page with the "Continue to business insider" link. I'm using Firefox and Ghostery on XP. Weirdly enough after four of five clicks it finally directed me to the article.
  - rosser 13y ago
    Exactly the behavior I see, except that I've never gone more than three clicks before giving up and trying in an incognito window (where I have all plugins disabled). Since that tends to work, first try, it's become my default.
usea 13y ago
It loads fine with adblock enabled.
ronaldx 13y ago
Business Insider is one of few sites which won't load any content with strict script/third party blocking, agreed. Luckily, I don't generally find its content worth unblocking.

hammerzeit 13y ago

I do think there's something to the argument that any reasonable implementation of "Do Not Track" would just further entrench the companies who already have large consumer traffic (Google, Facebook, et al), by virtue of the substantial privileging of first-party cookies over third-party cookies at that point. Now, you could argue, this is desirable -- after all, companies with large consumer brands have much more at risk in terms of doing unethical things with data (yes, I'm aware of the irony of saying that after the PRISM issue, but I think that only affirms my point). At the same time, does Google/FB/etc need any more help in dominating advertising than they already do?

ChuckMcM 13y ago

There has been some talk that the reason Chrome stopped gaining share against IE and Firefox was because of the do-not-track situation. IE9 had it and then turned it back off by default, Firefox was the first to implement it and it is considering making it the default. This is what I predict will happen, should Mozilla begin shipping with it turned on by default. Advertisers will modify their contracts such that they pay $x if tracking is enabled on the browser and $y if it is not. $y will be much less than $x, perhaps 1/10th the amount because the Advertiser will argue it is harder to detect and prevent fraud without the tracking cookies. Web sites will then these do not track (DNT) sessions as "low value" sessions and will either refuse to display content, or force some difficult to subvert captcha movie watching thing with survey in order to establish the low fraud barrier and get the 'good' price for ads. The result will be that 'free' web sites will become even more obnoxious and subscription sites where they actually reduce or eliminate the advertisements altogether will become more practical.

rsync 13y ago

The more alarming piece of the article is this: "The move might also invite legislation from Congress." So ... presumably a govt body would define what a web browser is, then define what tracking is, and then ... what ? Legislate browser code ? Would wget need defaults built in for the code that comes over ? What if I 'nc' to port 80 and redirect to a file ? What is a "web browser" anyway ? What constitutes consumption of tracking codes ? Are there punishments involved ? Is the curl library at fault if it is misused in this government mandated way ? Terrible, depressing, and predictable.

x0x0 13y ago
Governments already (and appropriately) legislate all sorts of things about software. * Some governments require windows to present a choice of web browsers. * Some governments require websites, operating systems, or programs to provide for accessibility to the disabled. Some governments also regulate information collection and sharing: * Some governments (including the US) regulate what information credit card companies must provide to consumers. * Some governments (including the US) regulate what info credit bureaus can collect, sell, require them to provide free copies on demand to those surveilled, and set up a framework for a dispute process. It's perfectly reasonable for governments, as an agent of the people, to create laws and regulations around what can be collected and how. And yes, code may have to go into browsers to comply.
- handsomeransoms 13y ago
  The long history of the interactions between relatively slow-moving governments and relatively fast-moving technology suggests that we should only legislate software as a last resort. One of the nice things about the proposed Do Not Track standard is that it requires no additional legislation. Once advertising bodies agree to some meaningful definition of DNT, any violations could be prosecuted using existing laws that protect consumers from deceptive advertising. Online tracking is a difficult problem without a purely technical solution available. Even with 3rd party cookies blocked, advertisers will still use first party cookies (Google, Facebook), or more sneaky and difficult to mititgate mechanisms (browser fingerprinting, evercookies) to track Internet users. Legislating is slow, uncertain, full of compromise, and riddled with conflicts of interest (hold the comparisons to the current DNT negotiations, please). While it is sometimes appropriate, or required as the only remaining recourse, it is far from an ideal solution - especially with a problem such as this where there is such an imbalance of influence between parties in Washington.

deleted 13y ago

[deleted]

steveklabnik 13y ago

Doesn't Apache not support DNT, so it's my this lately moot anyway?

lifeisstillgood 13y ago

I have just never realised there are people like johnathon on our side out there. Thank you. I also just realised that there are sites in the US, UK, Europe to watch and follow debates on each parliament, but the debates on the important workings of these groups seem to be sporadically reported, even here on HN. Anyone want to help me setup a "theyworkforyou" for w3c working groups? (I mean if congress rules how a browser should behave in the US, does it affect me here? If not then frankly these groups overrule each individual parliament in fairly significant ways )

bokglobule 13y ago

It's made me consider going back to Firefox from Chrome.

thezilch 13y ago

Jonathan and Firefox have yet to explain how embedded modules like Disqus, Stripe, or similar are meant to go about their business and without resorting to the EverCookie-like tactics? Facebook or similar apps requiring stateful sessions? I guess we'll all just setup 2nd party sub-domains for advertisers, or serve our ads off a Google domain (or <insert entrenched advertiser>).

chris_mahan 13y ago

Just block the cookies already, and allow the users to turn them back on on a per-site basis.

tehwalrus 13y ago

As long as I'm still allowed to block 3rd party cookies with a few exceptions (like Disqus), I don't really care. If we (e.g. Mozilla, others, open web supporters) want to educate users about 3rd party cookies can't we just create a new startup wizard or something, like the windows "choose a browser" popup?

fredsanford 13y ago

I would suggest that advertisers and their cronies stop acting like scumbags unless they want to be treated like scumbags.