7 ms·

How browsers get to know you in milliseconds

128 points by wallflower 12y ago

super_sloth 12y ago
As an aside, does anyone have any experience using Aerospike? Any impartial thoughts?
liotier 12y ago
Block ads & third party trackers to spare your browser the useless effort. Thanks Adblock & Ghostery !
- ljk 12y ago
  Or using hosts file to block those IPs!
  - PointerReaper 12y ago
    It would be interesting to see the same sort of diagram and discussion in the linked article that includes what happens when end users are using the AdBlock or Hosts block techniques.
    - kbuck 12y ago
      It's fairly simple: none of those steps happen, because since the advertiser's scripts and iframes are blocked, they don't even know you've loaded a page with an ad on it.
      - windsurfer 12y ago
        I've created code that test to see if ads are blocked based on failed-to-load scripts. I'm sure others have as well.
        walterbell 12y ago
        Are you a publisher or advertiser?
        windsurfer 12y ago
        Neither, just a coder.
      - PointerReaper 12y ago
        Based on end-user experience during accessibility testing, I'm pretty sure they do detect the presence of tools such as AdBlock, test to see if certain elements were successfully provided before continuing with a specific set of ads, and also make some assumptions about providing "errors" to end users that only people with something like AdBlock or NoScript _should_ see.
        hartator 12y ago
        They can't at all because nothing is loaded. Check the network tab of chrome with/without adblock enabled and you will see the difference.
        scholia 12y ago
        Nonetheless there are websites that give you a notice to say that you have AdBlock enabled, and some even tell you to disable it in order to use the site....
        hartator 12y ago
        Yes! But if you add the anti-Adblock script to Adblock, they won't work as well. (Doesn't mean the website will still work however!)
- switzer 12y ago
  The goal is for display ads to not suck to the point where Adblock, Adblock Plus, and Ghostery are required. For better or worse, advertising pays for the salaries of the people who write the stories and build the websites and apps that people use. The goal is not to remove ads altogether but to improve display advertising so that it is a positive improvement to a site rather than the negative effect that it has on user experience today (yes, advertising can be positive addition to content - ask anyone who reads Vogue magazine). Google won search advertising because ads were relevant, looked good, and it was simple for advertisers to reach the users they wanted. The major reason for Google's success is because they owned every piece in the advertising stack: - The content (e.g. google.com) - The adserver - The auction engine - Fraud detection (Google's quality team's success at removing fraud meant that advertisers trusted that their messages were reaching users) - Creative adserver (e.g. text ads and creatives are served by Google) In display advertising, each of these pieces is operated by a different party. This means that integration between each of the pieces is not a tight, giving users and advertisers a low quality experience. Here are some of the effects of this: 1. Ads generally cannot be tailored to the website where they run. Publishers do not have the ability to tailor ads to work within their environment like they can with Google Adsense (native advertising is starting to change this though) - so most websites look bad with display ads. 2. There is massive data leakage from ads. Because a 3rd party adserver is serving the ad on a publisher site, it is nearly impossible for publishers to keep their customer data from leaking to everyone in the ad stack, which quickly becomes everybody in the ad industry. Because ad networks that buy the publisher ad space from a publisher almost never actually serve the ad creative (they just serve an ad tag to another network), a massive circle of redirects where a single ad can be bought and sold over 100 times before an ad is displayed. This means that the publisher is giving their customer data to 100 companies before they get an ad on a page. 3. There is no industry wide coordinated ad fraud effort that is successful. There are so many ways for ad fraud to occur in many different parts of the ad stack, that a single company that tries to reduce fraud from a single point in the ad stack will only have limited success. 4. Ad creative does not have rigid controls where the publisher can let the advertiser know what can and cannot be done on their site. This means that either an ad seems to 'take over' the publisher page without adding to the user experience, or an ad is reduced to a backup image, which is not a pleasing experience. A reduced set of advertising features needs to be done much better in order for display advertising budgets grow from where they are now.
- bigbugbag 12y ago
  Don't you know that ghostery works for advertisers by providing them profiling info on people who black which ads so advertisers can better target them ? « Ghostery makes money by tracking the trackers while blocking them and selling data about third party trackers, which it calls Ghostrank. Disconnect takes a pay-what-you-want approach, but it is still developed by a for-profit company founded by a former Google engineer. Adblock is donation-supported, but many users confuse it with Adblock Plus, which has generated controversy for having advertisers pay to land on a whitelist. » http://finance.yahoo.com/news/not-ad-blockers-same-why-150015645.html http://finance.yahoo.com/news/not-ad-blockers-same-why-15001... see also: http://www.businessinsider.com/evidon-sells-ghostery-data-to-advertisers-2013-6 http://www.businessinsider.com/evidon-sells-ghostery-data-to... https://thetruthiswhere.wordpress.com/2014/11/30/ad-blocker-ghostery-actually-helps-advertisers-if-you-support-it/ https://thetruthiswhere.wordpress.com/2014/11/30/ad-blocker-... http://lifehacker.com/ad-blocking-extension-ghostery-actually-sells-data-to-a-514417864 http://lifehacker.com/ad-blocking-extension-ghostery-actuall... You may want to switch to eff's privacy badger: https://www.eff.org/privacybadger https://www.eff.org/privacybadger Also have a look into mozilla's ligthbeam: https://www.mozilla.org/en-US/lightbeam/ https://www.mozilla.org/en-US/lightbeam/ and request policy: https://www.requestpolicy.com/ https://www.requestpolicy.com/
  - scholia 12y ago
    > Don't you know that ghostery works for advertisers by providing them profiling info Don't you know that "Ghostrank is off by default, meaning you can use Ghostery without sharing anything ... if you'd prefer". https://www.ghostery.com/en/faq https://www.ghostery.com/en/faq
    - bigbugbag 12y ago
      Nope, I didn't know that. I have to admit my knowledge of ghostery is not current as I quit using it not long after the privacy extension got bought by an advertising company. I was shocked that the option to support the extension turned out to be a spying tool for advertisers to design ads that users wouldn't want to block. I tried installing ghostery just now and ghostrank is indeed opt-in now. It is a good thing they upped their PR and changed their faq less than 6 months ago to make it clear how they make money, but they have lost my trust long ago and there's no coming back from that. Then again I wouldn't trust a company whose business is advertising with protecting my privacy and I definitely don't want better advertising, I want advertising to disappear from the web altogether as it was when i first started using it.
realusername 12y ago
When I read articles like these, it always makes me sad to see the amount of incredibly complex technologies dedicated to advertising. I hate to be that guy but I'm sure these resources could have a better usage.
- nols 12y ago
  Advertising currently provides most of the revenue for many Internet sites. Until another major revenue source comes along a significant effort will still be put towards optimizing advertising.
  - realusername 12y ago
    Yeah I know... It's even worse than that actually, since advertising is not a zero sum game (if you have two companies with 50% market share, they will get less compared to a company with all the market), any alternative would just decrease significantly the value of advertising and therefore, no alternative can emerge. That is why there is no option to pay for Google services instead of the tracking. I don't think there is any solution to this, unless the share of AdBlock users would reach a tremendous level.
    - aiiane 12y ago
      https://www.google.com/contributor/welcome/ https://www.google.com/contributor/welcome/
      - hobs 12y ago
        Thats interesting, but it just seems like mining additional money out of people, they still get to keep all the data even if they are not displaying the advertising.
- shostack 12y ago
  It gets interesting when you think of it in relation to something like our space program (which was largely a war-driven effort) or even the internet itself. I'm sure someone somewhere said "wow, instead of all these eggheads working on better battlefield communications, we should really put those dollars to something meaningful. Not trying to be snide, but one can rarely predict where something like say...complex ad tech...might lead future technological innovations. It certainly has helped fuel a large tech industry.
anonu 12y ago
This stuff is always fascinating to me, especially the "capital markets" approach to buying/selling ads. I saw an article a few weeks back on how traders are arbitraging different ad exchanges in the same way high-frequency traders do so... You can buy ads for cheap in 1 place and sell them immediately at a higher price somewhere else. I'd be curious if anyone has a high-level idea of how this works.
- alphonse23 12y ago
  nope. no one can: http://www.slate.com/articles/technology/technology/2014/06/online_advertising_effectiveness_for_large_brands_online_ads_may_be_worthless.html http://www.slate.com/articles/technology/technology/2014/06/... Just another bubble in the making -- just be ready to pull out at the right time.
javery 12y ago
Quick poll - how many of you noticed this was a sponsored article brought to you by Aerospike?
- alphonse23 12y ago
  haha, after I read it I went ahead and bookmarked Aerospike (before I read this comment) -- their little tactic worked. :)
- queryly 12y ago
  I didn't notice it until you mentioned it. I didn't feel cheated though since I got good amount of info from the article and was curious about how Aerospike did it. I wish all ads were like this.
morgante 12y ago
Shame on O'Reilly for burying the sponsored content notice at the very bottom of the post. While native advertising & sponsored content is a great strategy these days, disclaimer is usually expected before people start reading. > This post is part of a collaboration between Aerospike and O’Reilly Media. Read our statement of editorial independence.
stblack 12y ago
Is it just me or do the times listed in this article seem implausible?
- nemothekid 12y ago
  The big question mark is the latency. The lookups are/should be really fast - as I guess that these guys either have lots of memory, and a random SSD read should be 1/10th of a millisecond. The article is an ad for database software, but I'd be interested to know in how they keep the latencies low enough when querying third party data. The article mentions that the data is colo'd, but I find it hard to believe that all 150 DSPs are colo'd.
PhantomGremlin 12y ago
Nobody has a problem with the title? Yes I know it's directly from the linked article. My browser already knows everything about me. It's the web server (and all the associated ad servers) that "get to know" visitors in milliseconds. Also, my browsing is much much faster than what the article mentions. That's because I don't bother with Adblock or Ghostery. Instead, I simply use NoScript on most websites. The (sponsored) article was fully readable w/o JavaScript. So, while the timeline discussed was interesting in the abstract, the flurry of backstage activity didn't occur when I viewed the article. Nor were any ads displayed. Thankfully.
Judgement 12y ago
Does anyone have any other reading recommendations on this topic, or advertising recommendation in general? How are different websites able to know what content you are interested- who is storing this data on people?
- ctrl_freak 12y ago
  > Does anyone have any other reading recommendations on this topic, or advertising recommendation in general? Sure. What's being discussed in this article is Real Time Bidding: http://en.wikipedia.org/wiki/Real-time_bidding http://en.wikipedia.org/wiki/Real-time_bidding . You can read up about the specifics of different Real Time Bidding exchanges, for example here's Google's AdExchange protocol: https://developers.google.com/ad-exchange/rtb/ https://developers.google.com/ad-exchange/rtb/ > How are different websites able to know what content you are interested- who is storing this data on people? The websites that host the actual content don't usually care about what ads are being shown to you. They just put code in from an ad exchange and let them handle the rest. The buyers (the ones who run the bidders) are the ones that are interested in figuring out what to show you. For example, many bidders are interested in doing what's called Behavioural Retargeting ( http://en.wikipedia.org/wiki/Behavioral_retargeting http://en.wikipedia.org/wiki/Behavioral_retargeting ). Say you visit a shoes website. Then later you go on Facebook. The moment you go on Facebook, their ad exchange FBX will send a bid request to all the bidders. If the shoes website has partnered with that ad exchange, when they receive the bid request, they can identify you by your cookie, and they can bid and try to show you an ad to get you to come back to their site. Typically a shoes website wouldn't have the infrastructure to do real time bidding so they get a third party to do the bidding on their behalf, e.g. AdRoll ( https://www.adroll.com/retargeting https://www.adroll.com/retargeting ).
  - Judgement 12y ago
    Thank you. And, they can identify you through other methods if you have cookies thoroughly disabled, as mentioned in the article? If they have no data on you, I assume ad exchanges supply default advertisements, or there are bidders on default ads?
known 12y ago
https://panopticlick.eff.org/ https://panopticlick.eff.org/

128 points by wallflower 12y ago

super_sloth 12y ago

As an aside, does anyone have any experience using Aerospike? Any impartial thoughts?

liotier 12y ago

Block ads & third party trackers to spare your browser the useless effort. Thanks Adblock & Ghostery !

ljk 12y ago
Or using hosts file to block those IPs!
- PointerReaper 12y ago
  It would be interesting to see the same sort of diagram and discussion in the linked article that includes what happens when end users are using the AdBlock or Hosts block techniques.
  - kbuck 12y ago
    It's fairly simple: none of those steps happen, because since the advertiser's scripts and iframes are blocked, they don't even know you've loaded a page with an ad on it.
    - windsurfer 12y ago
      I've created code that test to see if ads are blocked based on failed-to-load scripts. I'm sure others have as well.
      - walterbell 12y ago
        Are you a publisher or advertiser?
        windsurfer 12y ago
        Neither, just a coder.
    - PointerReaper 12y ago
      Based on end-user experience during accessibility testing, I'm pretty sure they do detect the presence of tools such as AdBlock, test to see if certain elements were successfully provided before continuing with a specific set of ads, and also make some assumptions about providing "errors" to end users that only people with something like AdBlock or NoScript _should_ see.
      - hartator 12y ago
        They can't at all because nothing is loaded. Check the network tab of chrome with/without adblock enabled and you will see the difference.
        scholia 12y ago
        Nonetheless there are websites that give you a notice to say that you have AdBlock enabled, and some even tell you to disable it in order to use the site....
        hartator 12y ago
        Yes! But if you add the anti-Adblock script to Adblock, they won't work as well. (Doesn't mean the website will still work however!)
switzer 12y ago
The goal is for display ads to not suck to the point where Adblock, Adblock Plus, and Ghostery are required. For better or worse, advertising pays for the salaries of the people who write the stories and build the websites and apps that people use. The goal is not to remove ads altogether but to improve display advertising so that it is a positive improvement to a site rather than the negative effect that it has on user experience today (yes, advertising can be positive addition to content - ask anyone who reads Vogue magazine). Google won search advertising because ads were relevant, looked good, and it was simple for advertisers to reach the users they wanted. The major reason for Google's success is because they owned every piece in the advertising stack: - The content (e.g. google.com) - The adserver - The auction engine - Fraud detection (Google's quality team's success at removing fraud meant that advertisers trusted that their messages were reaching users) - Creative adserver (e.g. text ads and creatives are served by Google) In display advertising, each of these pieces is operated by a different party. This means that integration between each of the pieces is not a tight, giving users and advertisers a low quality experience. Here are some of the effects of this: 1. Ads generally cannot be tailored to the website where they run. Publishers do not have the ability to tailor ads to work within their environment like they can with Google Adsense (native advertising is starting to change this though) - so most websites look bad with display ads. 2. There is massive data leakage from ads. Because a 3rd party adserver is serving the ad on a publisher site, it is nearly impossible for publishers to keep their customer data from leaking to everyone in the ad stack, which quickly becomes everybody in the ad industry. Because ad networks that buy the publisher ad space from a publisher almost never actually serve the ad creative (they just serve an ad tag to another network), a massive circle of redirects where a single ad can be bought and sold over 100 times before an ad is displayed. This means that the publisher is giving their customer data to 100 companies before they get an ad on a page. 3. There is no industry wide coordinated ad fraud effort that is successful. There are so many ways for ad fraud to occur in many different parts of the ad stack, that a single company that tries to reduce fraud from a single point in the ad stack will only have limited success. 4. Ad creative does not have rigid controls where the publisher can let the advertiser know what can and cannot be done on their site. This means that either an ad seems to 'take over' the publisher page without adding to the user experience, or an ad is reduced to a backup image, which is not a pleasing experience. A reduced set of advertising features needs to be done much better in order for display advertising budgets grow from where they are now.
bigbugbag 12y ago
Don't you know that ghostery works for advertisers by providing them profiling info on people who black which ads so advertisers can better target them ? « Ghostery makes money by tracking the trackers while blocking them and selling data about third party trackers, which it calls Ghostrank. Disconnect takes a pay-what-you-want approach, but it is still developed by a for-profit company founded by a former Google engineer. Adblock is donation-supported, but many users confuse it with Adblock Plus, which has generated controversy for having advertisers pay to land on a whitelist. » http://finance.yahoo.com/news/not-ad-blockers-same-why-150015645.html http://finance.yahoo.com/news/not-ad-blockers-same-why-15001... see also: http://www.businessinsider.com/evidon-sells-ghostery-data-to-advertisers-2013-6 http://www.businessinsider.com/evidon-sells-ghostery-data-to... https://thetruthiswhere.wordpress.com/2014/11/30/ad-blocker-ghostery-actually-helps-advertisers-if-you-support-it/ https://thetruthiswhere.wordpress.com/2014/11/30/ad-blocker-... http://lifehacker.com/ad-blocking-extension-ghostery-actually-sells-data-to-a-514417864 http://lifehacker.com/ad-blocking-extension-ghostery-actuall... You may want to switch to eff's privacy badger: https://www.eff.org/privacybadger https://www.eff.org/privacybadger Also have a look into mozilla's ligthbeam: https://www.mozilla.org/en-US/lightbeam/ https://www.mozilla.org/en-US/lightbeam/ and request policy: https://www.requestpolicy.com/ https://www.requestpolicy.com/
- scholia 12y ago
  > Don't you know that ghostery works for advertisers by providing them profiling info Don't you know that "Ghostrank is off by default, meaning you can use Ghostery without sharing anything ... if you'd prefer". https://www.ghostery.com/en/faq https://www.ghostery.com/en/faq
  - bigbugbag 12y ago
    Nope, I didn't know that. I have to admit my knowledge of ghostery is not current as I quit using it not long after the privacy extension got bought by an advertising company. I was shocked that the option to support the extension turned out to be a spying tool for advertisers to design ads that users wouldn't want to block. I tried installing ghostery just now and ghostrank is indeed opt-in now. It is a good thing they upped their PR and changed their faq less than 6 months ago to make it clear how they make money, but they have lost my trust long ago and there's no coming back from that. Then again I wouldn't trust a company whose business is advertising with protecting my privacy and I definitely don't want better advertising, I want advertising to disappear from the web altogether as it was when i first started using it.

realusername 12y ago

When I read articles like these, it always makes me sad to see the amount of incredibly complex technologies dedicated to advertising. I hate to be that guy but I'm sure these resources could have a better usage.

nols 12y ago
Advertising currently provides most of the revenue for many Internet sites. Until another major revenue source comes along a significant effort will still be put towards optimizing advertising.
- realusername 12y ago
  Yeah I know... It's even worse than that actually, since advertising is not a zero sum game (if you have two companies with 50% market share, they will get less compared to a company with all the market), any alternative would just decrease significantly the value of advertising and therefore, no alternative can emerge. That is why there is no option to pay for Google services instead of the tracking. I don't think there is any solution to this, unless the share of AdBlock users would reach a tremendous level.
  - aiiane 12y ago
    https://www.google.com/contributor/welcome/ https://www.google.com/contributor/welcome/
    - hobs 12y ago
      Thats interesting, but it just seems like mining additional money out of people, they still get to keep all the data even if they are not displaying the advertising.
shostack 12y ago
It gets interesting when you think of it in relation to something like our space program (which was largely a war-driven effort) or even the internet itself. I'm sure someone somewhere said "wow, instead of all these eggheads working on better battlefield communications, we should really put those dollars to something meaningful. Not trying to be snide, but one can rarely predict where something like say...complex ad tech...might lead future technological innovations. It certainly has helped fuel a large tech industry.

anonu 12y ago

This stuff is always fascinating to me, especially the "capital markets" approach to buying/selling ads. I saw an article a few weeks back on how traders are arbitraging different ad exchanges in the same way high-frequency traders do so... You can buy ads for cheap in 1 place and sell them immediately at a higher price somewhere else. I'd be curious if anyone has a high-level idea of how this works.

alphonse23 12y ago
nope. no one can: http://www.slate.com/articles/technology/technology/2014/06/online_advertising_effectiveness_for_large_brands_online_ads_may_be_worthless.html http://www.slate.com/articles/technology/technology/2014/06/... Just another bubble in the making -- just be ready to pull out at the right time.

javery 12y ago

Quick poll - how many of you noticed this was a sponsored article brought to you by Aerospike?

alphonse23 12y ago
haha, after I read it I went ahead and bookmarked Aerospike (before I read this comment) -- their little tactic worked. :)
queryly 12y ago
I didn't notice it until you mentioned it. I didn't feel cheated though since I got good amount of info from the article and was curious about how Aerospike did it. I wish all ads were like this.

morgante 12y ago

Shame on O'Reilly for burying the sponsored content notice at the very bottom of the post. While native advertising & sponsored content is a great strategy these days, disclaimer is usually expected before people start reading. > This post is part of a collaboration between Aerospike and O’Reilly Media. Read our statement of editorial independence.

stblack 12y ago

Is it just me or do the times listed in this article seem implausible?

nemothekid 12y ago
The big question mark is the latency. The lookups are/should be really fast - as I guess that these guys either have lots of memory, and a random SSD read should be 1/10th of a millisecond. The article is an ad for database software, but I'd be interested to know in how they keep the latencies low enough when querying third party data. The article mentions that the data is colo'd, but I find it hard to believe that all 150 DSPs are colo'd.

PhantomGremlin 12y ago

Nobody has a problem with the title? Yes I know it's directly from the linked article. My browser already knows everything about me. It's the web server (and all the associated ad servers) that "get to know" visitors in milliseconds. Also, my browsing is much much faster than what the article mentions. That's because I don't bother with Adblock or Ghostery. Instead, I simply use NoScript on most websites. The (sponsored) article was fully readable w/o JavaScript. So, while the timeline discussed was interesting in the abstract, the flurry of backstage activity didn't occur when I viewed the article. Nor were any ads displayed. Thankfully.

Judgement 12y ago

Does anyone have any other reading recommendations on this topic, or advertising recommendation in general? How are different websites able to know what content you are interested- who is storing this data on people?

ctrl_freak 12y ago
> Does anyone have any other reading recommendations on this topic, or advertising recommendation in general? Sure. What's being discussed in this article is Real Time Bidding: http://en.wikipedia.org/wiki/Real-time_bidding http://en.wikipedia.org/wiki/Real-time_bidding . You can read up about the specifics of different Real Time Bidding exchanges, for example here's Google's AdExchange protocol: https://developers.google.com/ad-exchange/rtb/ https://developers.google.com/ad-exchange/rtb/ > How are different websites able to know what content you are interested- who is storing this data on people? The websites that host the actual content don't usually care about what ads are being shown to you. They just put code in from an ad exchange and let them handle the rest. The buyers (the ones who run the bidders) are the ones that are interested in figuring out what to show you. For example, many bidders are interested in doing what's called Behavioural Retargeting ( http://en.wikipedia.org/wiki/Behavioral_retargeting http://en.wikipedia.org/wiki/Behavioral_retargeting ). Say you visit a shoes website. Then later you go on Facebook. The moment you go on Facebook, their ad exchange FBX will send a bid request to all the bidders. If the shoes website has partnered with that ad exchange, when they receive the bid request, they can identify you by your cookie, and they can bid and try to show you an ad to get you to come back to their site. Typically a shoes website wouldn't have the infrastructure to do real time bidding so they get a third party to do the bidding on their behalf, e.g. AdRoll ( https://www.adroll.com/retargeting https://www.adroll.com/retargeting ).
- Judgement 12y ago
  Thank you. And, they can identify you through other methods if you have cookies thoroughly disabled, as mentioned in the article? If they have no data on you, I assume ad exchanges supply default advertisements, or there are bidders on default ads?

known 12y ago

https://panopticlick.eff.org/ https://panopticlick.eff.org/