News for hackers. Stuff that matters.
Re:The opt-out illusion: how we have acquiesced to losing ou... by jwr on Tuesday March 10, 2020 @05:06AM (#22533905)
Oh, the irony of this article slamming me in the face with a sleazy "We need your consent" dialog with intentionally confusing options and sub-dialogs...

My "consent" is being forced out of me so that roughly ~100 (at a first glance) "partners" can invade my privacy and learn about my browsing habits.

By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.

Re:The opt-out illusion: how we have acquiesced to losing ou... by lightswitch05 on Tuesday March 10, 2020 @09:36AM (#22535303)
I took a look the domains being used for the consent and saw an interesting JavaScript name: 'messagingWithoutDetection.js'. Looking into it more, I found the documentation [1], there is this disgusting paragraph:

> The Dialogue Javascript communicates with the Sourcepoint messaging server on a subdomain of the site. The benefit of doing that is to allow messaging cookies to be “first party” and thus, circumventing Safari’s web browser Intelligent Tracking Prevention (ITP). This creates a discrete messaging channel between the publisher’s messaging subdomain and the Dialogue messaging server. Once you have created the subdomain, you should create a DNS CNAME record to direct traffic to the Sourcepoint messaging endpoint message<account id>.sp-prod.net where the account id refers to you account ID in the Sourcepoint user interface

Luckily uBlock Origin now supports blocking on CNAME records and PiHole is rolling support out for it as well. I maintain a blocklist that I use with the PiHole: https://www.github.developerdan.com/hosts/

[1] https://documentation.sourcepoint.com/web-implementation/sou...

Re:The opt-out illusion: how we have acquiesced to losing ou... by rndomsrmn on Tuesday March 10, 2020 @09:44AM (#22535373)
dnscrypt-proxy is already supporting CNAME blocking and full domain based blocking (*.adhost.com), something that is still missing in Pi-Hole.
Re:The opt-out illusion: how we have acquiesced to losing ou... by lightswitch05 on Tuesday March 10, 2020 @09:46AM (#22535387)
Pi-Hole does support regex and wildcard based blocking
Re:The opt-out illusion: how we have acquiesced to losing ou... by rndomsrmn on Tuesday March 10, 2020 @09:51AM (#22535423)
regex is _extremely_ resource inefficient and should not be used with large sets of rules. Dnsmasqs domain redirecting feature (address=/adhost.com/#) is not supported by pihole.

Is there any other way to wildcard block full domains in Pi-Hole?

Look for example in your list: d41.co, admaster.com.cn, mixmarket.biz chances are extremely slim that all (current) hostnames of those type of domains are currently being blocked.

Re:The opt-out illusion: how we have acquiesced to losing ou... by lightswitch05 on Tuesday March 10, 2020 @09:58AM (#22535464)
It is resource inefficient, which is why PiHole supports it, but does not allow you to subscribe to list containing regex, as that would quickly make it unusable. I'm not sure how Dnsmasqs would be accomplishing this feature without some sort of pattern matching logic - which would have the same inefficiencies. Basically O(N) where N is the number of domains/patterns that should be blocked. There could certainly be a cache to keep track of matched/unmatched queries, but I would imagine with the modern web the average case would still be very close to O(N). Just speculation.
Re:The opt-out illusion: how we have acquiesced to losing ou... by rndomsrmn on Tuesday March 10, 2020 @10:07AM (#22535537)
Dnsmasq 'address=' function is just a substr() call, which is as fast as 'normal' hostname blocking (host == "adhost.com"). No regex magic is required there.

You are not able to block something like 'ads.%.adhost.com', but only (prepending wildcard) '%.ads.adhost.com', which in practice will cover almost all scenarios where random subdomains are used by adhosts.

Re:The opt-out illusion: how we have acquiesced to losing ou... by lightswitch05 on Tuesday March 10, 2020 @10:18AM (#22535617)
Pihole uses a forked version of dnsmasq they named 'Pi-hole FTL engine'. I don't believe there are any features of dnsmasq that cannot be used with the PiHole - but how to configure it to work alongside of PiHole might not be as obvious.
Re:The opt-out illusion: how we have acquiesced to losing ou... by rndomsrmn on Tuesday March 10, 2020 @10:49AM (#22535891)
It is possible to use this feature 'in' Pi-Hole, see: https://github.com/notracking/hosts-blocklists/wiki/Install-...
Re:The opt-out illusion: how we have acquiesced to losing ou... by johndough on Tuesday March 10, 2020 @02:08PM (#22537891)
If the regex rules do not require backreferences, it should be possible to implement them in such a way that they run in constant time with respect to the number of rules.
Re:The opt-out illusion: how we have acquiesced to losing ou... by MaxBarraclough on Friday March 13, 2020 @07:20AM (#22566379)
<pedantry> Regex with backreferences isn't really regex at all, in that it no longer corresponds to the regular languages. </pedantry>
Re:The opt-out illusion: how we have acquiesced to losing ou... by MaxBarraclough on Friday March 13, 2020 @07:16AM (#22566364)
> regex is _extremely_ resource inefficient

No, it's not. Is there something wrong with their implementation?

Re:The opt-out illusion: how we have acquiesced to losing ou... by fmajid on Tuesday March 10, 2020 @06:26AM (#22534262)
On the positive side, the Quantcast cookie popups now offer a choice between "Accept All" and "Reject All".

Previously they offered "Accept All" or "Click here to enter our deliberately confusing rat's warren of options".

I wonder if the French DPA's announcement that they will start cracking down on dark patterns like this was the impetus for the change.

Re:The opt-out illusion: how we have acquiesced to losing ou... by jwr on Tuesday March 10, 2020 @07:00AM (#22534419)
Well, it's true that this popup was slightly less sleazy and misleading, but it wasn't that great, either.

Just for reference (since it is obviously needed), if someone really DOES want to slam readers in the face with a popup as the first thing they see, here is some non-confusing wording:

"Do you agree to be tracked using cookies by 134 advertising companies (link to full list)?"

Two large buttons: "Yes" "No".

Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no.

Re:The opt-out illusion: how we have acquiesced to losing ou... by Xelbair on Tuesday March 10, 2020 @08:00AM (#22534665)
>Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no.

Even worse when the switches are made in such way that you have no idea whether you are opting-in or out.

Re:The opt-out illusion: how we have acquiesced to losing ou... by thebudgie on Tuesday March 10, 2020 @08:06AM (#22534698)
Then you click it to test and you've opted in for just a second and it's already too late to go back...
Re:The opt-out illusion: how we have acquiesced to losing ou... by lima on Tuesday March 10, 2020 @09:17AM (#22535154)
What about "accept cookies or pay" like some newspapers do? Is that okay?
Re:The opt-out illusion: how we have acquiesced to losing ou... by Nursie on Tuesday March 10, 2020 @09:23AM (#22535200)
No, one must provide the same service with or without tracking.
Re:The opt-out illusion: how we have acquiesced to losing ou... by kouh on Tuesday March 10, 2020 @09:23AM (#22535203)
Re:The opt-out illusion: how we have acquiesced to losing ou... by SkyBelow on Tuesday March 10, 2020 @10:48AM (#22535879)
>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.

I think the logic underlying this sentiment is never consistently applied. Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? Do we call out the other negative results of a person's job (tax money going to a war machine is pretty common for those in the US)? Do we call out the person cooking burgers at the local fast food joint for the effects our fast food consumption has on our health as a whole? Do we call out doctors who are members of groups that limit the supply of doctors, thus increasing prices and resulting in people getting less healthcare coverage?

What about the people who are against unions, which may be a factor in why some choose not to risk their job opposing implementing data gathering on their own website?

Re:The opt-out illusion: how we have acquiesced to losing ou... by hutzlibu on Tuesday March 10, 2020 @01:16PM (#22537330)
" Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? "

I am pretty sure, they thought alotabout the pros and cons of their work and decided a long time ago that the positive outweight the negative a lot. But what is the social positive in intentional programming dark pattern UI? I don't see any.

Re:The opt-out illusion: how we have acquiesced to losing ou... by SkyBelow on Tuesday March 10, 2020 @03:39PM (#22538798)
A few possibilities:

Disagreeing it is a dark pattern to begin with. For example, see how many people love opt out consent for organ donation and overlook the consent implications it has in that case. Another example is requiring email address at signup, is that actually needed and is it a dark pattern to not allow a person to sign up until they provide one, even though a more industrial user could give you a fake/temporary email address?

Seeing the data as not actually worth protecting and not having an issue with opt out or the like.

Thinking those who do care will already be using adblockers and the like.

Thinking it would be done regardless if they do it, so why burn what social/political capital they have achieving no difference when they can save it for something that might have an actual impact.

Re:The opt-out illusion: how we have acquiesced to losing ou... by hutzlibu on Wednesday March 11, 2020 @05:25AM (#22544322)
Does that really convince yourself? It stays the same to me. Intentionally misleading.
Re:The opt-out illusion: how we have acquiesced to losing ou... by 3733782263 on Tuesday March 10, 2020 @08:32AM (#22534839)
>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.

I'm sure this stern talking to really made them evaluate their life choices. We need more people on HN to take a stand like this, downvotes be damned. We all have to be the change we want to see.

Re:The opt-out illusion: how we have acquiesced to losing ou... by aguyfromnb on Tuesday March 10, 2020 @09:17AM (#22535157)
>We need more people on HN to take a stand like this, downvotes be damned.

As the funding dries up the community will close ranks even more so. We are already getting to the point on this forum where anything not outwardly positive (not even "negative") said about certain subjects is instantly donwvoted. Being as how downvoting is something that requires 500 karma, these are not bots or spam accounts; they are veteran members, preventing balanced discourse from occurring ("slow down").

Re:The opt-out illusion: how we have acquiesced to losing ou... by allendoerfer on Tuesday March 10, 2020 @10:01AM (#22535486)
Working with an analytics team, a sentiment I get is:

"We have a contract with [analytics company]. They are not allowed to look at the data."

When you suggest that a contract might not be as good as physical limitations hosting it yourself give you, they follow up with something like:

"Well, then AWS/Azure/etc. could look at it!"

What I found drives the increase of tracking on the web in big corporations, is simply the number of teams, who want data. Data is used to play internal politics. And it is easier to get a new vendor in, than to get data from a hostile team.

Re:The opt-out illusion: how we have acquiesced to losing ou... by rezeroed on Tuesday March 10, 2020 @09:09AM (#22535095)
Isn't that what the back button is for? We read too much shit anyway. My preferred method for handling theses popups now is the back button.
Re:The opt-out illusion: how we have acquiesced to losing ou... by raxxorrax on Tuesday March 10, 2020 @09:21AM (#22535189)
Sorry, that has be acquiesced

Times Literary Supplement:

[...] Reviews were normally anonymous until 1974 [...]