4 ms·

Great but I would be really interested if someone could demonstrate an application deriving some real world use out of these information. Seen many demos of thi

Great but I would be really interested if someone could demonstrate an application deriving some real world use out of these information. Seen many demos of this browser sniffing but is any one using it for real?

vaksel 17y ago
it could be useful in targeting ads, i.e. tracking users other website habits to show them much more relevant ads. Let's say HN has ads. And it sees that you just came from a Python tutorial site. Instead of showing you a random programming book, the ad would show you a series of Python books.
- tptacek 17y ago
  Let's say you're a staffer for a Republican congressman, and I'm an innocuous web page you've visited. Oh, look! You've visited a lot of gay pornography sites! I think I'd like you to start paying me $50 a month now, so I can "protect" you from negative publicity.
  - bunn 17y ago
    Funny, I thought that only the left could be gay.
    - pstuart 17y ago
      No both sides can, it's the Left that admits it.
      - bunn 17y ago
        I can't say I've ever met a gay republican... Anyways you simply aren't a republican if you're gay.
  - johnnybgoode 17y ago
    Because a Democratic congressman wouldn't have any political problems whatsoever if found to have visited gay porn sites. :)
    - tptacek 17y ago
      I didn't give much thought to this example but I think it makes the point OK.
- paraschopra 17y ago
  Actually, in targeting, user's short term interests are much more valuable than the long term interests. If a visitor is on HN, you would already know his immediate interests. Knowing that he came from a Python tutorial site, that too you can't say if he is regular there or one and off, would provide marginal value which is hard to justify.
  - CGamesPlay 17y ago
    Is there any A/B testing that backs this notion up?
tptacek 17y ago
You may have missed the point. Building an application around this would be a mistake, since this is a vulnerability that needs to be fixed. There is no way it can be OK for random site visitors to disclose a profile of other URLs they've visited.
- jdbeast00 17y ago
  just because it shouldn't be done...doesn't mean people aren't going to use it to make money. and how long have browser people known about this and done nothing? this will be a privacy issue for many years to come.
  - tptacek 17y ago
    It's hard to fix without breaking things, so, unfortunately, we're going to have to wait for something very bad to happen before it gets fixed.
  - bunn 17y ago
    That's not the point. He is warning not to build an application on this vulnerability as it will be patched soon, rendering the application useless and your time wasted.
JimmyL 17y ago
I saw someone made a version of one of those "Share It!" links that only showed ones it sniffed (with others accessible by a one-click menu).
ojilles 17y ago
Can work great for competitor analysis as well...
wmf 17y ago
I suggested using it for OpenID IDP discovery. e.g. if a site knows that you use Yahoo, it could show you a "log in with Yahoo" button.

vaksel 17y ago

it could be useful in targeting ads, i.e. tracking users other website habits to show them much more relevant ads. Let's say HN has ads. And it sees that you just came from a Python tutorial site. Instead of showing you a random programming book, the ad would show you a series of Python books.

tptacek 17y ago
Let's say you're a staffer for a Republican congressman, and I'm an innocuous web page you've visited. Oh, look! You've visited a lot of gay pornography sites! I think I'd like you to start paying me $50 a month now, so I can "protect" you from negative publicity.
- bunn 17y ago
  Funny, I thought that only the left could be gay.
  - pstuart 17y ago
    No both sides can, it's the Left that admits it.
    - bunn 17y ago
      I can't say I've ever met a gay republican... Anyways you simply aren't a republican if you're gay.
- johnnybgoode 17y ago
  Because a Democratic congressman wouldn't have any political problems whatsoever if found to have visited gay porn sites. :)
  - tptacek 17y ago
    I didn't give much thought to this example but I think it makes the point OK.
paraschopra 17y ago
Actually, in targeting, user's short term interests are much more valuable than the long term interests. If a visitor is on HN, you would already know his immediate interests. Knowing that he came from a Python tutorial site, that too you can't say if he is regular there or one and off, would provide marginal value which is hard to justify.
- CGamesPlay 17y ago
  Is there any A/B testing that backs this notion up?

tptacek 17y ago

You may have missed the point. Building an application around this would be a mistake, since this is a vulnerability that needs to be fixed. There is no way it can be OK for random site visitors to disclose a profile of other URLs they've visited.

jdbeast00 17y ago
just because it shouldn't be done...doesn't mean people aren't going to use it to make money. and how long have browser people known about this and done nothing? this will be a privacy issue for many years to come.
- tptacek 17y ago
  It's hard to fix without breaking things, so, unfortunately, we're going to have to wait for something very bad to happen before it gets fixed.
- bunn 17y ago
  That's not the point. He is warning not to build an application on this vulnerability as it will be patched soon, rendering the application useless and your time wasted.

JimmyL 17y ago

I saw someone made a version of one of those "Share It!" links that only showed ones it sniffed (with others accessible by a one-click menu).

ojilles 17y ago

Can work great for competitor analysis as well...

wmf 17y ago

I suggested using it for OpenID IDP discovery. e.g. if a site knows that you use Yahoo, it could show you a "log in with Yahoo" button.