Need to let loose a primal scream without collecting footnotes first? Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid: Welcome to the Stubsack, your first port of call for learning fresh Awful youāll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cutānāpaste it into its own post ā thereās no quota for posting and the bar really isnāt that high.
The post Xitter web has spawned soo many āesotericā right wing freaks, but thereās no appropriate sneer-space for them. Iām talking redscare-ish, reality challenged āculture criticsā who write about everything but understand nothing. Iām talking about reply-guys who make the same 6 tweets about the same 3 subjects. Theyāre inescapable at this point, yet I donāt see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldnāt be surgeons because they didnāt believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I canāt escape them, I would love to sneer at them.
(Semi-obligatory thanks to @dgerard for starting this, and happy new year in advance.)
via this I just learned that googleās about[0] to open the taps on fingerprinting allowance for advertisers
thatāll go well.
I realize that a lot of people in the rtb space already spend an utterly obscene amount of effort and resources to try do this shit in the first place, but jesus, this isnāt even pretending. guess their projections for ad revenue must be looking real scary!
edit [0] - āaboutā, as in next month. and they announced it last month.
The Google post appears to be Updating our platform policies to reflect innovations in the ads ecosystem.
I have no idea what the heck those words mean (it appears to be some bizarro form of English), so I diffed the policy itself. Here are the parts I found notable.
This will be removed:
This will be removed:
This will be added:
I remember during my very very first job a security guy explaining to me why I canāt record work emails of people borrowing stuff from the companyās internal library because GDPR. In a company of like 100 people. I guess Google is too big to care.
Itās the same feeling as when itās reported some guy was able to defraud literal millions from public funds while I had to separately report and bring a receipt for the $5 I spent on a city bus while out on a business trip because it was funded from a public grant or Iād get fired and sued, in that order.
Iām not a gdpr person (nor even european) but this sounds like bullshit - was it?
I simplified , but:
The problem is that if someone leaves the company you should delete all of their PII you donāt need for compliance reasons. The emails were firstname.lastname@company.com, as is usual, so it was PII. So if someone borrowed something from the library and that record stayed in the database, when their company profile got deactivated we wouldāve had to have a flow that deleted that row or at least anonymised it. Needless to say, this was a minor side project with a time budget of one month, so we just ended up not storing any PII in the first place instead of bothering with archiving and removal.
you just gotta love how vacuously pointless the wording is
google-rfc āmustā: āwe want something we can bend you over a barrel with if youāre caught out by one, but thatās all weāll bother committing because otherwise it eats into our lovely extortion profitsā
Also Iām having a fun time imagining an accurate device fingerprinting disclosure from someone who was really really thorough.
Not-A-Cookie-I-Swear Technologies LTD may collect the following information:
Don't worry none of it is a cookie :D
Some stuff in this list is me being silly, but overall it shows that the talk about āprivacy-enhancing technologiesā is premature on the web platform. The web has been trying to have better privacy defaults over time; but thereās a long legacy of features from before this was considered as much, as well as Google tossing around their weight in the web standards and browser space.
now i wonder how much of that is blocked by firefox enhanced tracking protection. not all, of course, and itās probably much more than needed for unique identifier. thereās mozilla security blog post on this topic says that some anti-fingerprinting measures were built in all the way back in 2020 (firefox 72)
Above I listed a bunch of things which would help narrow down browser version, but thatās hopeless anyway ā an adversary will probably be able to figure out your rough browser version even if you fake the UA string, and that youāre running in anti-fingerprinting mode.
So assuming thatās out of scope I think these are probably the big categories:
That said while Iāve worked with browsers, Iām not in the biz of fingerprinting or anti-fingerprinting, so thereās surely stuff I havenāt thought of.
* Actually we should probably just disable non-HTTPS entirelyā¦
** Running under a VM is probably the minimum required to mitigate the chances of cutting-edge side-channel timing attacks from James Bond level adversaries, but at that point maybe you just want a dedicated browsing computer heh. I did chuckle at the idea of someone trying to apply cryptographic constant-time algorithm techniques to writing a browser though.