News for hackers. Stuff that matters.
Re:Privacy-Preserving Ad Click Attribution for the Web by akersten on Wednesday May 22, 2019 @12:54PM (#19983066)
Can I get a "hell no"?

Why oh why would you want to normalize anything about online advertising by standardizing it as an HTML property? Why does anyone think it is the browser's responsibility to support this?

If ad companies are having trouble "attributing their campaigns" or whatever - that's tough? It's their responsibility to figure it out, not browser vendors, who should be on the user's side here (c.f. user agent).

This is a terrible idea, breaks the abstraction between markup and application, and should definitely not be added to HTML standard.

Re:Privacy-Preserving Ad Click Attribution for the Web by lmkg on Wednesday May 22, 2019 @01:46PM (#19983562)
The context for this proposal is NOT that, in a vacuum, ad-tracking is a desirable feature of HTML.

The context for this proposal is Apple has already been rolling out privacy protections for Safari and iOS, other players (like Big G) have had complaints, and this proposal undercuts those complaints. It's a negotiating tool, effectively.

Apple's privacy protections have made life harder for Google and other folks in the advertising space. Apple has basically tried to make it hard or impossible for anyone to stitch together user activity across different sites and build a profile of that user.

Advertisers have complained about losing ad attribution, and that complaint is legitimate. But, the existing techniques that are used to measure ad attribution also allow a excessive amount of additional data to be collected. Arguably, the ad attribution angle is just a PR-friendly fig leaf over what they're really worried about, which is user profiling.

So, Apple's counter-proposal: Here is a way to get ad attribution! Also, by the way, it doesn't allow user profiling, but that's ok, right? Of course it is. And now, ideally, we get to watch advertisers squirm as they try to come up with outlandish attribution scenarios that justify the collection of profiling data, while struggling to not admit what types of profiling they actually do and what fraction of their valuation that comprises.

Re:Privacy-Preserving Ad Click Attribution for the Web by Despegar on Wednesday May 22, 2019 @01:57PM (#19983667)
It also makes it easier to lobby for a privacy law with teeth (which Apple should absolutely be doing if they aren't already) when you can offer a solution to politicians who might have genuine concerns about the economic impact.
Re:Privacy-Preserving Ad Click Attribution for the Web by akersten on Wednesday May 22, 2019 @02:31PM (#19984054)
I don't think we need legislation that is overly prescriptive by saying "this is the particular feature of the current web that you need to use to be privacy compliant." That's what was wrong with the cookie law, and was one of the improvements the GDPR made - it didn't prescribe any particular solution for advertisers, just told them "you can't do this kind of thing."

That is the basis of a good law (prohibit a specific behavior, not the implementation thereof). In that lens though, Apple's proposal is a solution in search of legislation, which screams "regulatory capture" to me - another reason I'm against it.

Re:Privacy-Preserving Ad Click Attribution for the Web by Despegar on Wednesday May 22, 2019 @02:43PM (#19984158)
They wouldn't mandate any specific technology, but it makes it infinitely more likely that Congress would pass a GDPR clone when they are confident that doing so wouldn't just destroy every web publisher's business. And it certainly disarms any disingenuous arguments by the ad-tech lobbyists along those lines.
Re:Privacy-Preserving Ad Click Attribution for the Web by akersten on Wednesday May 22, 2019 @02:10PM (#19983815)
I still don't understand why Apple would be compelled to offer the olive branch at all. Sure, advertisers have complained their business model is getting harder - what motivates Apple to help fix that? What possible leverage could advertisers even have? Apple doesn't need a negotiating tool if there's nothing Apple wants from the advertisers, just block the nefarious tracking and move on.
Re:Privacy-Preserving Ad Click Attribution for the Web by eridius on Wednesday May 22, 2019 @03:32PM (#19984633)
Ad attribution is not inherently bad. The means by which people do ad attribution are typically evil, and due to the ease by which this data is collected, lead advertising companies down the dark path of becoming user data brokers.

But the simple act of "I placed an ad on this site, is that ad driving sales?" is perfectly benign, and if we can enable that use-case without enabling any privacy leakage, that's unambiguously a good thing because making the privacy-conscious approach easy and reliable means people will use it and won't resort to the more privacy-invasive techniques.

This is the same underlying justification as the "ping" attribute, which is basically, it enables in a privacy-conscious manner the basic functionality people want, and which they already have other less-privacy-conscious means to get, so let's make the most user-positive option the simplest and most reliable.

Also by standardizing how this works it enables content blockers to block these requests. This ad click attribute proposal even explicitly listed this as a feature. If you don't want ad click attribution, use a content blocker that blocks /.well-known/ad-click-attribution/ and you're done.

Re:Privacy-Preserving Ad Click Attribution for the Web by munk-a on Wednesday May 22, 2019 @04:24PM (#19985060)
I disagree, all advertising levies a cost on the advertisee, you are assuming an inherent right to attention that the person has not granted. I understand and agree that this is a graduated scale but the most benign on that scale is "only a minor annoyance" not "perfectly benign".
Re:Privacy-Preserving Ad Click Attribution for the Web by eridius on Wednesday May 22, 2019 @05:03PM (#19985470)
Advertising is the cost of access to the content. The content provider has the user's attention, and the advertiser is paying the content provider for a small slice of that attention. But that's all the cost should be, just a moment of attention. The cost should not be giving up your privacy.
Re:Privacy-Preserving Ad Click Attribution for the Web by munk-a on Wednesday May 22, 2019 @05:57PM (#19985996)
The cost shouldn't even be attention, we have little enough control over the silence of our minds in the modern world - we should fight against all those sources that feel falsely entitled to get a slice of our brains and time for themselves.

There is no implicit link between "stuff on the internet" and advertising, this "free service" isn't free, we're all paying a gateway fee to get into the internet to begin with, then many content providers have judged their content valuable enough to justify asking for payment, with others relying on soft/burst funding sources like crowdsourcing. The internet and most people's sites really aren't so expensive to maintain that we need this level of crazy marketing.

Re:Privacy-Preserving Ad Click Attribution for the Web by eridius on Wednesday May 22, 2019 @07:44PM (#19986819)
> we should fight against all those sources that feel falsely entitled to get a slice of our brains and time for themselves.

Why are they falsely entitled? You're choosing to give your attention to a site in exchange for its content. That was your choice. The site turns around and sells a tiny slice of your attention to an ad provider in order to actually make money. But make no mistake, this was the attention that you chose to give to the site in exchange for its content, and that site can spend your attention how it wishes. If you don't like how it spends your attention, don't patronize that site anymore.

Re:Privacy-Preserving Ad Click Attribution for the Web by munk-a on Wednesday May 22, 2019 @07:49PM (#19986864)
I reject this analogy, it's like saying "You walked into a supermarket to buy an apple for a dollar, it ended up costing you eight dollars because of taxes and fees and unfortunately those seven extra dollars were spent before you ever got the apple, so I guess the apple still costs a dollar but when you walk out of the store you'll be eight dollars poorer."

Advertising isn't voluntarily entered into by us, it's forced on the consumer. Personally I try to avoid patronizing sites that use heavy advertising (except interesting articles forwarded to me) but I am more speaking on the harm to us all. I suppose I could reword my comment above a bit more accurately to "I reject the normalization of advertising in society."

Re:Privacy-Preserving Ad Click Attribution for the Web by kitotik on Wednesday May 22, 2019 @04:38PM (#19985199)
Apple may want this so that they can have attribution for ad placements in their own products such as Apple News while still being to able market themselves as a corporation who cares about privacy.
Re:Privacy-Preserving Ad Click Attribution for the Web by comex on Wednesday May 22, 2019 @03:09PM (#19984421)
Not everyone believes that advertising is inherently bad, or that being able to track the effectiveness of particular advertising campaigns is bad – as opposed to tracking individual users.
Re:Privacy-Preserving Ad Click Attribution for the Web by ggthrowaway12 on Wednesday May 22, 2019 @02:47PM (#19984205)
Advertisers are not complaining - they can vote with their money. It's the publishers that are hit by making ads harder. Without allowing publishers to monetize, content will move behind paywalls or closed ecosystems (as opposed to open web) that do make ads easier. Also, over time, browsers that make it impossible to monetize will likely to be banned by publishers - this already started to happen, with some publishers not allowing incognito mode, etc.
Re:Privacy-Preserving Ad Click Attribution for the Web by vkou on Wednesday May 22, 2019 @02:35PM (#19984085)
Apple wants something from advertisers. Money.

They want 2 billion in revenue from advertising by 2020.

They are testing the waters, and there's no doubt a faction within the company that believes that in the long term, getting a slice of the firehose of ad revenue is worth a small loss in revenue from opinionated anti-ads users[1] leaving their ecosystem.

The best part about the Apple walled garden is that once ads become an important part of their revenue stream, they'll be able to ban ad-blockers on their platform.

[1] What are they going to do, switch to Android? Communicate by carrier pigeon?

Re:Privacy-Preserving Ad Click Attribution for the Web by threeseed on Wednesday May 22, 2019 @03:13PM (#19984456)
So Apple is going to do a 180 and suddenly switch to being anti-privacy and pro-advertising. Disable the Safari content blockers they only recently added, end the advertising campaigns they just started using. And all for a tiny 1% of their revenue ?

Privacy is a fundamental part of Apple's selling proposition and personal to Tim Cook given that in many cases gay and other minorities are killed due to privacy leaks.

Re:Privacy-Preserving Ad Click Attribution for the Web by craigsmansion on Wednesday May 22, 2019 @05:48PM (#19985909)
> Privacy is a fundamental part of Apple's selling proposition

From earlier today :

"Note: Though we cannot bring an official Tor Browser to iOS due to restrictions by Apple"

(https://blog.torproject.org/new-release-tor-browser-85)

Money is the only part of Apple's selling proposition. It's nice they cater to the privacy conscious for the time being, for the time being.

Re:Privacy-Preserving Ad Click Attribution for the Web by kalleboo on Wednesday May 22, 2019 @09:04PM (#19987323)
Here's the whole quote

> Note: Though we cannot bring an official Tor Browser to iOS due to restrictions by Apple, the only app we recommend is Onion Browser, developed by Mike Tigas with help from the Guardian Project.

Your truncated quote makes it sound like Apple doesn't allow private Tor browsing. There are other Tor browsers on the App store. What Apple doesn't allow is third-party HTML renderers and JavaScript engines (Tor Browser is based on Firefox)

Re:Privacy-Preserving Ad Click Attribution for the Web by vkou on Wednesday May 22, 2019 @04:38PM (#19985208)
> Privacy is a fundamental part of Apple's selling proposition and personal to Tim Cook given that in many cases gay and other minorities are killed due to privacy leaks.

Is it part of an immutable corporate charter? Is Tim Cook an immortal lich-king, with absolute authority, that will preside over Apple between now, and the heat death of the universe?

Company culture changes, company priorities change, company leaders change, and shareholders always want more money. If advertising will get Apple more money, it's just a matter of when, not if.

Re:Privacy-Preserving Ad Click Attribution for the Web by threeseed on Wednesday May 22, 2019 @07:02PM (#19986534)
Company culture isn't going to change much at Apple.

They have programs like Apple University and the memory of Steve Jobs will always loom large over the company.

And Apple could've focused primarily on advertising decades ago. But they didn't because it's just not in their DNA. They are and will forever be a widgets company.

Re:Privacy-Preserving Ad Click Attribution for the Web by vkou on Wednesday May 22, 2019 @08:21PM (#19987081)
20 years ago, they were an overpriced-computer vendor on their deathbed, with not a widget in sight, burdened with a trailing-edge OS, while Microsoft was an unstoppable behemoth that was eating the world (While convinced that this internet thing was just a fad.)

You have no idea what they will be 20 years from now.

Re:Privacy-Preserving Ad Click Attribution for the Web by FoxInBoxers on Wednesday May 22, 2019 @04:52PM (#19985363)
> Privacy is a fundamental part of Apple's selling proposition and personal to Tim Cook given that in many cases gay and other minorities are killed due to privacy leaks.

I love the privacy aspect, but is privacy really part of Apple's core strategy or are we just seeing them make use of the good position they were always in? Is there enough drive at Apple (Cook or otherwise) to keep privacy a focus, or is the topic just going to fall by the wayside when it suits the business?

Re:Privacy-Preserving Ad Click Attribution for the Web by threeseed on Wednesday May 22, 2019 @06:58PM (#19986496)
Look at the implementation of Secure Enclave, FaceID, Apple Pay and ML models.

They build these very carefully to keep your data secure, on-device and inaccessible to third parties. They definitely could've implemented these much quicker and arguably better (e.g. ML models) if they had a device-cloud hybrid.

Re:Privacy-Preserving Ad Click Attribution for the Web by bryan_w on Wednesday May 22, 2019 @10:07PM (#19987657)
Yeah but they still sell you out to Google as soon as you open safari. Apple cares more about $ than privacy
Re:Privacy-Preserving Ad Click Attribution for the Web by coldcode on Wednesday May 22, 2019 @02:52PM (#19984265)
2B to Apple is couch change.
Re:Privacy-Preserving Ad Click Attribution for the Web by vkou on Wednesday May 22, 2019 @04:37PM (#19985194)
Rome wasn't built in a day. I'm sure there's slide decks that float much bigger future numbers to decision-makers in the firm.
Re:Privacy-Preserving Ad Click Attribution for the Web by layoutIfNeeded on Wednesday May 22, 2019 @03:19PM (#19984520)
>Advertisers have complained about losing ad attribution, and that complaint is legitimate.

Ummm, no it’s not. My browser is my user agent, and I couldn’t care less about advertisers’ woes.

You know what makes attribution even harder? Ad blockers.

Re:Privacy-Preserving Ad Click Attribution for the Web by jlarocco on Wednesday May 22, 2019 @05:30PM (#19985742)
> Advertisers have complained about losing ad attribution, and that complaint is legitimate.

It's not legitimate at all.

No more legit than a ransomware author complaining that a Windows patch destroyed their revenue source.

Re:Privacy-Preserving Ad Click Attribution for the Web by CaveTech on Wednesday May 22, 2019 @01:05PM (#19983164)
You're being naive. Ad companies are not having trouble attributing campaigns. The problem is that small, uncoordinated "privacy" features cause Ad Tech companies to become far more aggressive in how they track users. It's not the companies that lose here, it's you.

A standardized, privacy-centric method for companies to accomplish attribution will help end the arms race and move back to a more consumer-friendly model. Small edges are worth a fortune in Ads. This is like the war on drugs. Clamping down and assuming ad companies will walk away is way too optimistic. Instead, they will move deeper into the shadows at whatever the cost.

Re:Privacy-Preserving Ad Click Attribution for the Web by akersten on Wednesday May 22, 2019 @01:09PM (#19983196)
If we do standardize this, why would an ad company stop using their existing tracking? This proposal allows them to collect more data about users, not less. It's just more entropy available to them, like the DNT header.

And I still don't think it's the browser's responsibility to help the ad company. This kind of stuff just doesn't belong in a markup standard. If ad company cannot exist with the way they currently track users due to GDPR or other regulations, and "need" some standard way for "privacy preserving tracking" - they can write their own browser that does it and give people incentives to use it.

Re:Privacy-Preserving Ad Click Attribution for the Web by CaveTech on Wednesday May 22, 2019 @01:19PM (#19983282)
This proposal collects far, far less data about about a user than any existing method. It doesn't add more entropy because any ad-tracking platform can (and does) already track this exact information.

By making it a standard that actually solves the needs of advertisers, the willingness to adopt it will increase because it's simpler.

That said, I think this proposal falls short of solving current tracking problems.

Re:Privacy-Preserving Ad Click Attribution for the Web by eridius on Wednesday May 22, 2019 @03:33PM (#19984650)
Safari is already trying to stop the existing tracking. This proposal allows Apple to say "look, we're giving you the actual functionality you need" and the advertisers completely lose any legitimacy whatsoever to their complaints, as all they're left with is asking for a way to violate user privacy.
Re:Privacy-Preserving Ad Click Attribution for the Web by Despegar on Wednesday May 22, 2019 @01:18PM (#19983262)
>why would an ad company stop using their existing tracking?

This can be addressed in law, but technical alternatives should exist. The alternative existing will also make it easier to pass it in law.

Re:Privacy-Preserving Ad Click Attribution for the Web by munk-a on Wednesday May 22, 2019 @02:58PM (#19984327)
Except we can actually win the war on advertising if we chose to do so. Making large swathes of the back-room tactics advertisers rely on illegal is absolutely do-able and provides more value to all of us - any companies that contract with bad actors can be punished and we could move into an age where we just forget what popups even were.
Re:Privacy-Preserving Ad Click Attribution for the Web by johnfactorial on Wednesday May 22, 2019 @04:30PM (#19985118)
What we need is a new paradigm for making money on the Internet. Advertisements are psychological tricks users are forced to experience, designed to make that person think they need to spend their money on something they didn't need before they saw the ad.

It's infected our news media, with ads masquerading as real news articles and news providers dripping with desperation to keep you frightened of the BREAKING IMPORTANT NEWS you MUST KNOW ABOUT right after this attempt to sell you razor blades.

It's infected our social media, where avatars that bear only the slightest of photoshopped similarity to the person they claim to be pretend to live a high-life, hiding their broke reality while trying to sell you herbal detox teas produced by failing corporations.

It's infected our telephone system, spammers trying to sell you a new rate on your student loan debt calling you 100 times more often than your own mother.

It's infected our email system, where no client without robust spam filtering is even usable, and you will delete 100 times more emails you never wanted to get than you will receive from your best friend.

Text messages. The postal system. Light polluting billboards on highways. You name it, if advertising has gotten its claws in it, it has either ruined or is ruining it.

Selling ads and selling users' PII are the two primary methods by which a website makes money. Both need to die.

Re:Privacy-Preserving Ad Click Attribution for the Web by wstuartcl on Wednesday May 22, 2019 @02:22PM (#19983947)
... I would argue that the standard by effect makes it far too easy to simply lock out attribution by normalizing the way that attribution works. It effectively makes it one super easy target for ad blockers and obfu plugins.

Billions of dollars are at stake for companies that need to understand how their ads are working across ecosystems and to realize the value (or lack thereof) for media buys. Many of the sites that place media also are doing so to offset the costs for users.

There are few ways to toss a grenade in this complex room that does not harm all parties and force each to defend their own needs/wants.

Re:Privacy-Preserving Ad Click Attribution for the Web by edmundsauto on Wednesday May 22, 2019 @01:08PM (#19983187)
Not everyone shares the belief that advertising and the user's interests need be adversarial. If this represents a compromise -- user maintains privacy, advertisers get attribution -- then what is your specific objection?
Re:Privacy-Preserving Ad Click Attribution for the Web by akersten on Wednesday May 22, 2019 @01:22PM (#19983308)
If we chalk up the "browser vendors should not help advertisers learn more about the user for no end-user benefit" as a difference in opinion, I specifically object to adding parameters to a markup language standard to support a domain-specific problem that a (possibly transient) industry faces. The markup language should not be facilitating this tracking, that's an application workflow - it should be way beyond the scope of concerns of the HTML.

If they really wanted to standardize something, why not make a Privacy Preserving Tracking as a Service endpoint and hit it with standard snippets of JS, instead of baking this controversial junk into the browser's core.

Re:Privacy-Preserving Ad Click Attribution for the Web by IX-103 on Wednesday May 22, 2019 @03:08PM (#19984415)
So HTML should not be concerned with supporting web application workflows? What should people be building web applications with if not HTML/CSS/etc.? If HTML doesn't support common use cases (by supporting additional markup) then everyone will have to roll their own. And if the only tools they have to do that are ugly privacy invasive monstrosities like fingerprinting, what will they use?

What should replace internet advertising as a way of funding content? This is not an advertising industry problem -- it also affects publishers. Will they have to start charging everyone micropayments to view their content? How will this affect the ability of third parties to index and archive content?

Re:Privacy-Preserving Ad Click Attribution for the Web by boomlinde on Thursday May 23, 2019 @04:39AM (#19989716)
> And if the only tools they have to do that are ugly privacy invasive monstrosities like fingerprinting, what will they use?

They use that because the privacy invasive monstrosities they previously relied on are becoming less reliable as public awareness of being spied on and manipulated grows and appropriate countermeasures are being taken. So now, every aware person is using an ad blocker and user-friendly privacy laws are being implemented. Sucks for the web advertising industry, but that's what they get for pissing upwards.

> What should replace internet advertising as a way of funding content? This is not an advertising industry problem -- it also affects publishers.

I will not be sad if platforms that so fundamentally rely on advertising that they can't find other means of funding their businesses die off completely. If people aren't willing to pay (users through donations and subscriptions or publishers out of their own pockets), maybe the content just isn't very valuable.

Re:Privacy-Preserving Ad Click Attribution for the Web by comex on Wednesday May 22, 2019 @03:02PM (#19984357)
The point of this feature is to provide limited access to data that webpage JS is not normally permitted to have – namely, information about the user’s interaction with other sites. (Although data sharing between different origins is not always forbidden, Safari’s “Intelligent Tracking Prevention” tries to block it for origins that are used for tracking.) Therefore, making it an “application workflow” implemented by the page JS would not work, whether or not a remote server is involved.
Re:Privacy-Preserving Ad Click Attribution for the Web by nicolaslem on Wednesday May 22, 2019 @01:05PM (#19983163)
Because the main browser vendors are literally ad companies?
Re:Privacy-Preserving Ad Click Attribution for the Web by threeseed on Wednesday May 22, 2019 @03:15PM (#19984469)
Only Google primarily is.

Apple, Microsoft and Mozilla do have advertising elements but are a very minor part of their business.