GitHub blocks FLoC across all of GitHub Pages

https://github.blog/changelog/2021-04-27-github-pages-permissions-policy-interest-cohort-header-added-to-all-pages-sites/

by pimterry • 5 years ago

555 212 5 years ago

github.blog

flixic2• 5 years ago

Remarkably short blog post. I would have appreciated a "why", to help build the voice of opposition.

Also, what about github.com itself?

progval• 5 years ago

Also, what about github.com itself?

Shouldn't matter. FLoC isn't enabled if they don't use the `document.interestCohort()` API and if Chromium doesn't detect ads; at least for now. https://seirdy.one/2021/04/16/permissions-policy-floc-misinf...

bugmen0t• 5 years ago

It would be if an (advertisement) iframe did, no?

paultopia2• 5 years ago

This is a bit confusing. That post seems to suggest that (1) adding the header is not necessary to prevent one's site from "leveraging" floc, ie, identifying users, unless one already runs ads, and hence (2) that the header isn't necessary in most cases.

But it also says:

What adding this header does is exclude your website from being used when calcualting a user’s cohort. A cohort is an identifier shared with a few thousand other users, calculated locally from browsing history; sites that send this header will be excluded from this calculation. The EFF estimates that a cohort ID can add up to 8 bits of of entropy to a user’s fingerprint.

Being excluded from cohort calculation has a chance to place a user in a different cohort, altering a user’s fingerprint. This new fingerprint may or may not have more entropy than the one derived without being excluded.

But is individual fingerprinting really the concern? What if I don't want google clustering people who visit my page with people who visit similar pages? In they case, the header still helps protect their privacy, right? By making Google's website visit interest based clustering less substantively accurate? Or am I misunderstanding how floc works?

youngtaff2• 5 years ago

Yeh, but what happens when Google Analytics adds `document.interestCohort` and ~90% of the web get opted in?

nnamtr• 5 years ago

Also, what about github.com itself?

Don't ask, try it. curl says: permissions-policy: interest-cohort=()

darkcha0s2• 5 years ago

FWIW the duckduckgo extension already shows the github.com website as tracker free, so they take a pretty strong stance on privacy. I think the why (ie. why does github take this stance on user pages) is pretty self explanatory in this situation.

jgrahamc2• 5 years ago

    $ curl -o /dev/null -v https://github.com/ 2>&1 | grep permissions-policy
    < permissions-policy: interest-cohort=()

est31• 5 years ago

Btw you can do this much shorter with the curl -I parameter which lists the return headers.

kenniskrag• 5 years ago

does -I not work? ;)

ocdtrekkie• 5 years ago

It's not really a blog post, even though it's pushed out over their "blog" endpoint. This post is part of https://github.blog/changelog/ which tends to lean closer to the "git commit message" length than blog post length. Just a statement of changes they've made users may notice or be affected by.

sanxiyn• 5 years ago

Thanks GitHub. Much appreciated.

_Understated_• 5 years ago

I've read recently about a fair few sites and browsers and whatnot that are not going to play along with FLOC.

Out of curiosity, what would be the kind of figure that would make Google stop using it? I mean, at what point does the data from a smaller pool become useless?

Any ideas?

Kovah• 5 years ago

I don't think that any decent figure would make Google stop using it. Floc is their try on locking more and more vendors in their ad ecosystem, it makes Google the superior ad provider because they now have an even bigger (and more unfair) advantage over other providers. My hypothesis: if you are blocking floc, you are not really dependent on Google's ad system, neither as a website hosting ads, nor being found through ads. Unfortunately, Google owns too much of the ad market and too many vendors are already dependent on Google.

geerlingguy2• 5 years ago

Just quit using Chrome and advocate for others to do the same. It's toxic to the web at this point.

encryptluks2• 5 years ago

Just like Microsoft building their own browser and then adopting Chromium, before long they'll be adopting FLoC.

darkcha0s2• 5 years ago

good news post about something MSFT owned on HN
comment(s) about how MSFT is inherently evil and doesn't deserve credit

The HN cycle continues.

j4yav• 5 years ago

Don’t forget meta comments about the grim predictability of it all, also an important part of the ecosystem.

numpad0• 5 years ago

Is hn crowd trying to manipulate M$...

severino• 5 years ago

You forgot a third one:

hn users trying to discredit the commenter and telling us the "new" Microsoft is so cool, like if we owed anything to them

BelenusMordred• 5 years ago

AMP faced far less of an onslaught and never really caught on the way they hoped it would. Time will tell how this turns out for them.

Jiejeing• 5 years ago

Never caught on? The vast majority of the news link I encounter are for the AMP version.

livre• 5 years ago

AMP was specifically opt-in and only websites with enough man power and interest to implement it did, if you wanted it you had to program an entirely different page using Google's JS framework and restricted subset of HTML. FLoC is opt-out and requires zero intervention from web devs, if your website shows ads it's already part of FLoC, it can catch on if people do nothing about it.

lucideer2• 5 years ago

Pages sites using a custom domain will not be impacted.

Not sure what % of Github Pages use custom domains but this appears to leave no mechanism for custom domains to optionally enable this header either.

I don't really understand the motivation here; if it was for the benefit of GH users, why wouldn't that apply to custom domain users? Is it purely to hamper Google (as Microsoft's competitor)?

gmueckl• 5 years ago

github.com is itself a social network and a tracker. They should know a lot more about the status and activities of the software projects hosted there and the users than the users themselves do. Enabling third parties to track users across their site would be the equivalent of opening the lid of this treasure chest.

lucideer2• 5 years ago

Oh no, I do understand that. It's just the excluding custom domains part I don't get. Why not keep Google out of all their data: why give them a portion?

HDMI_Cable2• 5 years ago

I've never thought of GitHub like that, but it makes so much sense. With all of the features (like the commit heat-map), GitHub is at this point 2 parts social network, and 2 parts social network for software.

vbsteven• 5 years ago

There could be a technical reason for it not to be available for custom domains (yet?).

The page mentions that the header is set for all pages served by github.io, which leads me to believe they add the header on the reverse-proxy/loadbalancer side for github.io pages.

Custom domains most likely use separate proxy/loadbalancing infrastructure where the same change could take longer to implement, or they might be exploring options to make it configurable.

madeofpalk• 5 years ago

Maybe there was more of a privacy concern they wanted to address by removing it from the github.io subdomains.

nerdponx5• 5 years ago

I agree with the other comments that Github doesn't allow users to control headers on Github Pages sites.

But my first guess was that this was a Msoft vs Google thing and not a privacy thing.

andrewnicolalde• 5 years ago

Same, I'd like a way to disable this on my GHPages site as well.

nindalf4• 5 years ago

The internet is split roughly into 3. The top 100 websites get a third of the page views, the remaining top 10k get another third and millions of websites get the last third.

The top 100 have dedicated engineering and policy teams teams that will disable FLoC because they're either not interested in ads (Wikipedia) or have their own first party implementation that doesn't need FLoC (Facebook). They'll ditch FLoC.

The next 10k might have engineering teams that can make the change, but might be more interested in finding out about their audience so they can monetize more easily. They'll keep FLoC.

As for the remaining millions, only a tiny minority of them will even know this is a thing, let alone care enough to make the change or contact a developer who can do it. These are the folks who have hosted their wordpress site with GoDaddy because it was cheap and quick when they needed a site. They'll keep FLoC.

So the upshot is that github.com, instagram.com and amazon.com might opt out, but the vast majority of the web will not. Me prediction is that at least half of all web pages loaded by users won't have this header.

dmitriid2• 5 years ago

Can't remember what article it was, but I remember that Facebook didn't even care about "top companies with top ads". The long tail trumped anything.

I wouldn't be surprised if it's the same in Google's case. A dozen big-name websites drop FLOC? Who cares, there's a billion more.

PeterisP• 5 years ago

IMHO it's far more unbalanced than "The top 100 websites get a third of the traffic, the remaining top 10k get another third and millions of websites get the last third." Purely from data traffic, youtube and netflix already get a third of the traffic (and that's just 2, not 100); and purely from pageview perspective, the top social media sites plus major media sites (again, a subset of the top100) get more than half IIRC.

I wouldn't be surprised if the top 100 websites get 80% of the traffic, the remaining top 10k get 10% and all the millions of other sites get the last 10%.

nindalf4• 5 years ago

I meant pageviews, not bandwidth consumed. Streaming websites are always going to dominate the latter.

This 100-10k-millions split statistic was pulled from a talk by Ilya Grigorik, who had worked on Web Performance at Google. I'm guessing they based it on data from Chrome.

account42• 5 years ago

The header is pointless anyway for the actual purpose of disabling FLoC as Chrome/Google will simply start ignoring it when enough websites add it.

james_pm• 5 years ago

WordPress may very well block FLoC which cuts off a good chunk, even when you eliminate those that don't update to the latest version. https://make.wordpress.org/core/2021/04/18/proposal-treat-fl...

onion2k• 5 years ago

That's probably accurate if you assume every website is equal, but if you measure by traffic the top 100 websites account for 95% of measurable tracking events. Won't that make FLoC rather ineffective if 95% of the data is missing?

buro93• 5 years ago

Cloudflare, Akamai, Fastly and other CDNs should disable FLoC by default for all customers, and provide a toggle to those customers who explicitly wish to enable it.

But until they do[1]:

Apache:

    Header always set Permissions-Policy: interest-cohort=()

Caddy:

    header Permissions-Policy "interest-cohort=()"

Cloudflare Workers (not free as there are limits):

    addEventListener('fetch', event=> {
        event.respondWith(handleRequest(event.request))
    })
    async function handleRequest(request) {
        let response=await fetch(request)
        let newHeaders=new Headers(response.headers)
        newHeaders.set("Permissions-Policy","interest-cohort=()")
        return new Response(response.body, {
            status: response.status,
            statusText: response.statusText,
            headers: newHeaders
        })
    }

Lighttpd:

    server.modules +=("mod_setenv")
    setenv.add-response-header=("Permissions-Policy"=>"interest-cohort=()")

Netlify:

    [[headers]] for="/*"
    [headers.values] Permissions-Policy="interest-cohort=()"

Nginx:

    add_header Permissions-Policy interest-cohort=();

[1] https://github.com/WICG/floc#opting-out-of-computation

woofcat• 5 years ago

Thanks, just disabled this on my tiny near zero traffic sites.

Hopefully if enough people disable it, it will become useless.

theideaofcoffee• 5 years ago

If you are using HAProxy you can use the following:

    http-response set-header Permissions-Policy interest-cohort=()

VWWHFSfQ• 5 years ago

Be sure to add `always` to the nginx header:

    add_header Permissions-Policy interest-cohort=() always;

buro93• 5 years ago

Unclear to me are what these headers do to the browser.

I mean... the docs say that they are a "site" header that you should apply to a "page". Does that mean that you must apply it to all pages to exclude a site? Is absence on one page taken as opting back in to FLoC?

If the scope is site, then it would be better as a DNS entry. I've a feeling the scope is truly page though and I've also a feeling that most people who choose to add this header will add it on all assets now - which is a bit of a waste of bytes (even with header compression in place) but would be the only way to guarantee that all pages have it.

protomyth• 5 years ago

Cloudflare, etc. should do what their customers want and not make these type of decisions for them. They are CDNs and not the owners of their customer's websites.

Seirdy2• 5 years ago

Excluding some portion of sites from a user’s cohort calculation doesn’t necessarily make a user less unique if a nontrivial number of sites doesn’t opt out.

I wrote more about this on my site: https://seirdy.one/2021/04/16/permissions-policy-floc-misinf...

mro_name• 5 years ago

thanks for lighttpd

idoubtit2• 5 years ago

This kind of post that provides no context will lead to cargo-cult, with people blindly copying and pasting these directives, and believing they have increased the privacy of their site...

If your web site does not include ads, FLoC is already disabled. Here, "ads" mean ads that EasyList can detect. This HTTP header will just make your config more complex and your responses slightly bigger, with no change of behaviour.

If you include external ads on your pages, then I doubt disabling FLoC will increase your visitors' privacy, but at least this header will have a real effect.

1_player• 5 years ago

Cloudflare, Akamai, Fastly and other CDNs should disable FLoC by default for all customers

And this is when Google will release their own Cloudflare competitor product.

BTW do they something as popular as Cloudflare already? I'm very unfamiliar with Google's offerings.

dheera• 5 years ago

NodeJS + express:

    app.use((req, res, next) => {
        res.setHeader("Permissions-Policy", "interest-cohort=()");
        return next();
    });

tyingq• 5 years ago

There may also be some uplift from various frameworks, CRMs, CDNs, etc, if any of them decide to make it the default.

akie• 5 years ago

According to their own numbers, WordPress accounts for 41% of the total number of websites, and they're considering switching off FLoC by default (https://core.trac.wordpress.org/ticket/53069 - discussion not settled yet though).

Guest42• 5 years ago

I think this is great news. Are there any paths towards supporting groups aligned with this position? I am aware of eff.

Goz3rr• 5 years ago

How many of those 41% are actually maintained and updated WordPress installs though

jefftk9• 5 years ago

will disable FLoC because they're either not interested in ads (Wikipedia)

Wikipedia does not need to take any action to disable FLoC; it's only active if the site opts in, on a per-pageview basis:

* If you call document.interestCohort() to get a FLoC id for a user, that pageview will be included in FLoC calculation.

* For the origin trial, to deal with the chicken-and-egg problem, a pageview is included you load ads (determined with EasyList)

See https://web.dev/floc/

(Disclosure: I work on ads at Google, speaking only for myself)

detaro• 5 years ago

EasyList is extremely broad, changes frequently, and e.g. has included communities having banners for community events as ads, and Google appears to give zero promises on the stability of this.

So relying on this requires continuous monitoring that Chrome doesn't randomly decide to tag something on some page as an ad, which is doing even more work just to cater to Google whims. Just blocking it is the sane choice here.

since you say it is about "chicken-and-egg problem" during the trial: is there a clear commitment somewhere that Google plans to not include pages that do not use the FLoC API in the future?

falcolas7• 5 years ago

So, every page with ads (as determined by an opaque and ever-changing method in a closed source browser), will be included while computing the cohort. Got it. It seems safest to assume that "it happens on every page" since so much of the internet is monetized with ads.

Please forgive us for not trusting Google's "we pinky swear it will change". We have no real reason to trust that Google will keep their word.

cesarb• 5 years ago

Wikipedia does not need to take any action to disable FLoC [...] If you call document.interestCohort() to get a FLoC id for a user

It is still a problem for Wikipedia, because the global Javascript for each language is editable by a subset of the editors for that language (https://en.wikipedia.org/wiki/MediaWiki:Common.js for instance), unlike the HTTP headers which can only be changed by the Wikimedia sysadmins.

drcongo• 5 years ago

Disclosure: I work on ads at Google

Can I ask why? I honestly can't understand how anyone could.

fps_doug• 5 years ago

It's kinda sad that you can't just run a web server and host your own homepage anymore. You need to mess with your webserver config to make it spam the client with a dozen HTTP headers to disable FLoC, enable HSTS, set this weird same site origin policy thing, disallow iframe embedding... Luckily enough someone had the idea to make it so HTTP headers will be compressed too, so we can add some more before the request header completely fills up the initial RWIN of the server.

aembleton• 5 years ago

Strange, I'm able to run my own webserver without worrying about any of that. Just a default deploy of Nginx.

Disable FLoC if you want, but Google could always change it in future and ignore the header.

coldpie2• 5 years ago

You don't have to do any of that. If the user wants to use a browser that sends all of their private data to Google, it's not my job to stop them.

colllectorof• 5 years ago

As for the remaining millions, only a tiny minority of them will even know this is a thing, let alone care enough to make the change or contact a developer who can do it. These are the folks who have hosted their wordpress site with GoDaddy because it was cheap and quick when they needed a site.

One company decides to do something stupid and you expect millions of website owners to scurry and add junk to their headers to create a "mitigation"? This is nuts.

This is a browser problem, not a website problem.

eCa2• 5 years ago

Their point was that that won’t happen.

Unfortunately, the other solution is to get billions of people to stop using a trojan horse of a browser.

pmurt7• 5 years ago

I have just switched to Brave (this browser blocks FLoC across all the web). I regret no trying this browser earlier. Also this IPFS stuff seems very interesting (kind of Bittorrent for the web).

Tom4hawk2• 5 years ago

FLoC is basically something implemented in a browser. Why website owner should be bothered by it? If client decided to use browser with FLoC than it's their decision. The only interesting thing might be to inform user that they are using shitty browser that doesn't respect their privacy and make sure that website works in other browsers.

What if Google decides that they will ignore that header? Is there anything preventing them from doing that? Do we know why they decided to even implement this "workaround" with header?

eCa2• 5 years ago

If client decided to use browser with FLoC than it's their decision.

For lots of people that’s not the case. Their work mandates which browser they can use, which is (partialy) why it took so long for IE to go away.

GordonS2• 5 years ago

If client decided to use browser with FLoC than it's their decision

Is it an informed decision?

Most normal users use Chrome because "everyone else does", and won't even have a clue what FLoC is.

littlestymaar• 5 years ago

Most normal users use Chrome because "everyone else does", and won't even have a clue what FLoC is.

“Because it was installed on my machine bundled with some third-party software” is also a big factor (but obviously, nobody will give you this answer, because they don't even know where Chrome came from)

Tom4hawk2• 5 years ago

It's definitely not an informed decision. That's why I mentioned that you can inform your users about this issue. I just think that this decision should not belong to webmasters/site-owners.

GuB-42• 5 years ago

Is there anything preventing them from doing that?

Potential privacy laws, competition, bad press,... but technically, nothing. Same as DoNotTrack.

In fact that's the whole idea behind FLoC. It is supposed to be a privacy improving feature! For now, the usual tracking methods based partly on third party cookies work for them, certainly better than FLoC would, and they are definitely more privacy invading.

But with things like GDPR, and with privacy being a bigger and bigger selling point, Google feels like it had to find something else and FLoC is their answer.

I don't know how the story will end but most likely in the same way as DoNotTrack, which started out badly, and turned into a joke when browsers started enabling it by default, disregarding the recommendation.

silverwind• 5 years ago

This new header seems like DoNotTrack 2.0 that Google will be forced to ignore once it gains some adoption to preserve their core business.

dbbk• 5 years ago

It's essentially virtue signalling.

matkoniecz3• 5 years ago

Why website owner should be bothered by it?

at least following cases would cause this:

(1) They are disliking tracking

(2) They are disliking Google

(3) Google is competing with them

(4) They want to be liked by people disliking tracking or Google

Flimm2• 5 years ago

(5) they don't want to help other competing websites to steal their customers using targetted ads

Flimm2• 5 years ago

Even if we only consider the direct self-interest of website owners, website owners may want to disable FLoC in order to prevent competing websites and adversaries from being able to target that website's visitors with ads. The more effective those ads are, the more they are taking away business from the websites that have not disabled FLoC.

thinkingemote• 5 years ago

Has anyone done the calculation of the amount of energy (and therefore co2) used and extra bandwidth cost for adding the opt-out header to most of the internet's traffic?

As I understand it, every response in a page has to have the header, not just a containing html or an initial options.

HDMI_Cable2• 5 years ago

I don't think it will be that much (spoiler alert: I was wrong), because only a negligible amount of web traffic will be the headers themselves vs. web--pages and streamed content. And the FLoC header itself will be a very small part of that header, maybe 40 bytes. Those 40 bytes could fit in a singular packet.

So, at most, FLoC will add 1 packet per header. I don't know how many headers are sent total each day, but I remember reading that the average person visits 100 websites per day (including reloads). Out of 4 billion people who use the internet, we're talking about 400 Billion response headers per day.

Assuming that each opt out of FLoC (a portion of this is Google, so that's unlikely), that means that an extra 400 Billion * 40 Bytes need to be sent. This is about 16 Trillion extra bytes that need to be sent (16E13). I've just checked, and it seems that the average Google Search is about 125kb, and I found that each releases approx. 7gCO2. So dividing this out, each kilobyte of traffic releases 0.056 grams of CO2. For each byte, that would be 0.000056 (5.6E-5) grams.

Multiplying that out by the 16 Trillion extra bytes, you have 8.96 Million (896E7) grams of CO2, or an extra 8960 tons of CO2 per day. So, I was totally wrong. Jeez, that's a lot of CO2.

But, my calculations were a badly-estimated, worst-case scenario. Also, since less websites will have third-party cookies as a result of this, we would have to subtract those now gone emissions. But, this is still a lot more CO2 than I expected, even if it was counteracted.

swyx• 5 years ago

alright 41 comments and everyone seems to know what FLoC is so i’ll be that guy.

What is FLoC and whats the big deal?

I googled https://www.theverge.com/2021/3/30/22358287/privacy-ads-goog... and it seems like an attempt by Google to add proprietary cohort based tracking to replace third party cookies. well intentioned but could have flaws. anything else i should know?

JackC• 5 years ago

I like the EFF's explainer:

https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...

the_lonely_road• 5 years ago

If you want to learn what Floc is for the first time you probably shouldn't start with an article titled "Google’s FLoC Is a Terrible Idea". I also don't know what it is but will just wait for a more neutral source hopefully.

chrisweekly2• 5 years ago

Me too, thanks for the link.

"FLoC is designed to help advertisers perform behavioral targeting without third-party cookies. A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group. Users with similar browsing habits—for some definition of “similar”—would be grouped into the same cohort. Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers. According to the proposal, at least a few thousand users should belong to each cohort (though that’s not a guarantee).

If that sounds dense, think of it this way: your FLoC ID will be like a succinct summary of your recent activity on the Web."

whatever_dude• 5 years ago

Great explanation indeed.

I didn't know much about it, and wow, sounds really terrible. I can even see it as an idea that started with good intentions, but the use cases explained (like linking floc ids to user ids in websites you signed in and potentially exposing browsing habits) make this thing really invasive; the whole idea is broken.

Tyr42• 5 years ago

It's an attempt at a replacement for third party cookies. Your browser look at your history and computes a "cohort" and if other people's browsers do the same things, people with similar history will have the same "cohort".

The upshot of this is advertisers only see the cohort_id, and not the history (which stays local on your browser). I think Google thinks it needs to give the advertisers something if third party cookies are going away, and this is attempting to preserve privacy.

Of course, just not sending third party cookies and not sending FLoC is the "ideal" solution if you don't have advertisers paying you, and some people were excited that third party cookies are going away, and hoped that nothing would replace them.

(Disclaimer, work on Gmail, this is my own opinion, I only really know what I read on HN)

nautilus12• 5 years ago

Hold up, doesn't something central still need to decide what cohort you are and store your individual data? How does it decide what cohort you are locally without pulling data about other users down locally or sending your individual data up? Is it comparing your behavior tensor with the cohorts or something like that?

woofie112• 5 years ago

This is not attempting to preserve privacy. This is attempting to give a pretense of preserving privacy, while completely deanonymizing the web.

This is browser fingerprinting on steroids. In addition to things like screen resolution and OS, you get a FLoC ID. Browser fingerprinting already works very well. FLoC supercharges it, and adds profiling information.

FLoC also gathers information from web sites which otherwise Google could not track. Since your browser is tracking you, they don't even need Google Analytics installed.

CivBase• 5 years ago

FLoC is Google's loophole after disabling third-party cookies in Chrome and promising they "will not build alternate identifiers to track individuals as they browse across the web"[0]. FLoC is a new tracker to replace third-party cookies, but it works by putting users in groups and tracking those groups, so they technically aren't tracking "individuals" this time. Except you can use FLoC to track individuals by identifying them as a unique intersection of many disparate groups[1].

[0] https://www.theverge.com/2021/3/3/22310332/google-privacy-re...

[1] https://github.com/WICG/floc/issues/100

pwm• 5 years ago

Over time everyone will be in their very own singleton group :)

poundofshrimp2• 5 years ago

The GH issue is interesting. Suppose each user belongs to two flocks, and each website gets randomly shown one of the two. Will this solve the problem? I’d imagine the number of possibilities after a certain while will make it impossible that cohort histories collected by two different websites will match for the same user.

geoduck142• 5 years ago

Thanks for being that guy. I thought HN had decided FLoC was good, but I guess not.

blantonl• 5 years ago

FYI, if you are like me that has no idea what FLoC is until now, please see:

https://github.com/WICG/floc

tester34• 5 years ago

Federated Learning of Cohorts

is there some competition where people try to come up with names as tricky as possible while being nowhere even close to simple english?

nerdponx5• 5 years ago

Sounds like a machine learning term that escaped from researchers into the wild. Machine learning people like to make up fun names for otherwise complicated and hard-to-summarize methods. See eg "BERT".

The name is actually descriptive. It is an algorithm for constructing semantically interesting cohorts of similar users, Locally on each user's machine.

It's actually a really good idea and certainly a lot more "privacy preserving" than anything that relies on sending fine-grained user data back to a central server for processing.

Of course there are problems with it, and I'm mixed as to whether it's something that non-Chrome browsers should even try to support.

The fact that all websites are included by default, and it's up to the individual website to opt out of inclusion, makes me squirm.

But the name makes sense and I think the core idea is a step in the right direction.

317070• 5 years ago

It is called academic publishing, and some people manage to make a career out of it!

But yes, all three parts of that name have a well established technical meaning. It is a very descriptive name, once you know all the parts.

chrisweekly2• 5 years ago

This one stems from Google's bird-themed naming convention for initiatives related to working around 3rd party cookies going away.

ziml77• 5 years ago

"Federated" is the only part of that I can see as not being simple. But even if all 3 words were generally unknown, I don't know if it's really a problem. You need to understand what FLoC is instead of what the individual words mean to know what the issues with it are.

soheil2• 5 years ago

So you think you're providing a service to others by copying and pasting a top Google search result link for this topic?

ourmandave• 5 years ago

This EFF article explains FloC pretty well.

https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...

tl;dr; 3rd party cookies are dying so google has come up with this way to replace them. EFF says 3rd party cookies suck but the choice shouldn't be a those or FLoC. How about neither where the user decides what to share, with who, and when.

hnbad• 5 years ago

This isn't meant as a dunk on MSFT but it's worth keeping in mind that MSFT owns GitHub before celebrating this as GitHub taking a stance. MSFT, FB and Google all heavily employ "analytics", although to slightly different degrees and in different forms. Them not cooperating is a good thing, but not surprising enough to warrant celebration.

kseistrup• 5 years ago

FLoC ought to be opt-in, not opt-out.

jackson1442• 5 years ago

From what I've heard elsewhere on hn, only sites that use `document.interestCohort()` contribute to a FLoC identifier.

ttt02• 5 years ago

Which can be done by any of the dozens of obfuscated javascript files people embed on their websites for some reason.

rogual• 5 years ago

It's exciting when the megacorps make these kinds of plays against each other. I feel like I'm watching my abusive partner get smacked in the mouth by my abusive ex.

hashkb• 5 years ago

Yes, the title should be "Microsoft blocks FLoC..."

commandertso• 5 years ago

You mock my FLoC, I’ll clean your clock!

With apologies to Bill Watterson

oblio• 5 years ago

What's FLoC?

brianzelip• 5 years ago

How to set this header if you use a custom domain with gh pages?

severak_cz• 5 years ago

I actually have an idea for browser extension:

implement document.interestCohort() and return some useless junk or better fake data (e.g. this user cats pictures and nothing else). However I run into that there is no documentation of how cohort ID is specified. This lead to another question - how are ad companies supposed to actually target their audience with it if there is no translation between cohorts and target groups? (I assume Google already has some translation)

jefftk9• 5 years ago

how are ad companies supposed to actually target their audience with it if there is no translation between cohorts and target groups?

Even as an opaque identifier it's still useful. Imagine you run a store and you log the FLoC cohorts of your customers. You could then target ads at the most common cohorts you've seen as a way to say "show my ads to more people similar to my existing customers".

(Disclosure: I work on ads at Google, speaking only for myself)

jerrygoyal• 5 years ago

FloC can be disabled at browser level also. Check if your browser has FloC enabled: https://amifloced.org

supergirl• 5 years ago

does FLOC even follow EU laws? it's tracking without consent right? it's basically a cookie that you can never delete?

morganms• 5 years ago

I've made a tool to check if a site blocks FLoC: https://ewatchers.org/floc?lang=en

heywherelogingo• 5 years ago

But it's not a problem, right? Because we've had countless conversations about google and chrome, discussed them ad nauseam, and we're so sick of this tedious, incessant topic that we've all stopped using chrome, right? Except for, yes, yes, the people who have to use it at work, but who don't use it at home, right? Floc is only a problem if you deserve it.

Kipters3• 5 years ago

Is there any browser extension to automatically disable FLoC on every visited site?

flixic2• 5 years ago

DuckDuckGo made one. https://spreadprivacy.com/block-floc-with-duckduckgo/

WorldMaker2• 5 years ago

Switch to Firefox?

Kipters3• 5 years ago

I've been using Firefox exclusively for the past 6 years, but I know people who don't want to switch from Chrome (less and less luckily)

coldpie2• 5 years ago

Use a browser that isn't made by an ad company.

Havoc2• 5 years ago

Bingo. Wish more people got this rather simple insight

Kipters3• 5 years ago

That's why I use Firefox, but I know people who aren't willing to switch from Chrome :)

yewenjie• 5 years ago

I have been seeing a lot of FLoC articles recently. Can someone please ELI5 for me what FLoC is and why is it bad?

joana035• 5 years ago

Microsoft is pushing for their own version of FLoC AFAIK

skaul• 5 years ago

In case folks are interested, I wrote an open source Chrome extension that removes the FLoC API on every page load so websites can't get your FLoC cohort ID: https://chrome.google.com/webstore/detail/floc-block/amoljng...

29athrowaway• 5 years ago

Let's expand the title a bit:

Iteration #1: Microsoft blocks FLoC across all of GitHub Pages.

Iteration #2: Microsoft blocks Google's FLoC across all of GitHub Pages.

captaincaveman3• 5 years ago

If FLoC is opt out by default as many here claim, is this news saying that Github did nothing?

Also if it is opt-out by default I guess it will be simple to see who has opted-in, a nice list of shame.

Does this circumvent the EU cookie laws?

soheil2• 5 years ago

For those who want to know why FLoC may be a bad idea see https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...

How much monopolistic behavior does Google have to engage in before antitrust laws have enough teeth? It also seems to me that Google has been more aggressive in its monopolistic behavior in different areas the more there is talks of regulations raining down on it. Maybe they know the end is near and are trying to get away with as much as possible before that happens.

Havoc2• 5 years ago

I wonder if floc can be selectively enabled to distort results. Eg only for cat videos

GitHub blocks FLoC across all of GitHub Pages

Related Stories