In the Future Everything Will Be A Coffee Shop - <AUTHOR> http://blog.speculist.com/scenarios/the-coffee-shop-take-over.html <comment><USER2> tl;dr - I shop a lot on Amazon. Therefore we no longer need shops. We have the internet. Therefore we no longer need universities.

The nice thing about "in the future" kind of statements is that they are impossible to disprove - especially when it is not specified how far in the future we are talking about. However, I think we are a long way from having gasoline delivered to your door and I always need to pop out for eggs, bread and milk. I also might need a hair cut in the future. Clothes are unlikely to be optional. My wife and I like to go to the movies. The kids like all kinds of shops...

Sure, the internet is affecting retail sales and education. To what extent is very difficult to predict but it is unlikely to be as drastic as the OP suggests.

<comment><USER3> There's also the problem of what will you do with the millions of people working in retail economy, and with the assorted collapsed buying ability of the middle to lower class.

We don't just keep jobs because we need them. We also keep them because we need the distribution of wealth that they make possible --without a way to ensure that, everything collapses. There can't be a billionaire without millions of wage slaves.

<comment><USER4> Guaranteed income. If the economy doesn't require everyone's labor, a bunch of people just shouldn't work, so make sure they can eat and you're done. I don't understand all this American obsession with jobs for everyone.

<comment><USER5> Promise free food, and suddenly way more people are demanding it than the economy can support. Even if the economy can afford to give away food, society stagnates because there is no incentive to produce nor advance anything of value - be it making widgets, sweeping floors, or writing sonnets. Those who do produce the wealth unproductive others live on will decide to not bother (look up "go Galt"). We Americans are obsessed with jobs because we realize to not work leads to death, be it individual or cultural.

<comment><USER6> > Those who do produce the wealth unproductive others live on will decide to > not bother (look up "go Galt").

Has this ever happened? Has anyone at any wealth level ever simply stopped making money because he was upset about taxes? I hear a lot of small-time sole proprieters talk about it, but I've never heard reliable reports of it actually happening.

<comment><USER7> pg has a great essay on this: <http://www.paulgraham.com/inequality.html>.

A quick summary is that yes, people probably do choose not to do certain kinds of work when taxes are too high, but not in the way that Bill O'Reilly tends to advertise it - it's unlikely that someone is going to quit a high-paying job because their marginal tax rate went up a point. However, if you're undertaking an endeavor with a 5% chance of success, and a 30x tax-free payout in case of success (relative to a safe option), your expected payout is 1.5x with no taxes; 1.35x with a 10% tax rate; and 0.9x with a 40% tax rate. Whether or not you'd take the risk in the first two cases varies from person to person, but in the latter scenario, most people wouldn't bother; you'd have better expectancy at a roulette table.

<comment><USER6> I appreciate the EV calculation. That would probably raise the marginal value at which someone like Warren Buffett would buy a company, fix its problems, and make it productive again. I doubt he'd shut down Berkshire Hathaway, or that it would even slow down people intent on creating a startup; but it would have a marginal effect.

Still a bit different from the classic "going galt," though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Universities will shrink to coffeshops? That's a very CS/math-centric viewpoint. How are you going to do MITx with with Chemsitry? Physics? Biology? Med School? Anything that requires specialized equipment? How will you do team projects that require people to be in physical proximity to one another (building complicated things, for instance).

Universities aren't going away. At most, some programs may become "virtualized" but even then there's a lot of value add with college. They have specialized libraries and librarians to help you find information that may not be on the internet. They can afford expensive equipment and the people to take care of them. It's often useful just to be around people in your same program to talk about projects and learn from each other. It may not be $100k value add, but that just means college will get less expensive and possibly shrink, not that it will go away all together.

</comment><comment><USER9> I'd love it if my office could be the coffee shop, or wherever I happen to be, but so far I've found that after a certain level of complexity and team size you pretty much have to be in the same room to make constant progress. I'm not sure if this is a problem with software development in general or just in the niche that I work within.

<comment><USER10> My company does a SAAS product aimed at banks. Everybody except the office manager telecommutes... sometimes. And everybody is in the office a large chunk of the time.

It's good to be able to concentrate alone, AND it's good to be able to collaborate in person.

</comment></comment><comment><USER11> "Coffee shop" as in "gathering place".

We have GitHub (social coding!) and now MITx (social learning?) I like the idea. It's like the whole point of the Internet -- bringing people together -- has reached brick and mortar.

</comment><comment><USER12> The comparison between the local state university and MITx is noteworthy. One of the big arguments that I hear continuously for traditional colleges is that they provide opportunities for research and are a place to make social connections. While these opportunities are a very real incentive for top schools, there are a ton of colleges and universities that add little value on these fronts (especially relative to the cost).

</comment><comment><USER13> This whole scenario is kind of silly. I can understand the simplification in order to debate the merits of a free mass scale online education. However it's not realistic. No two candidates will ever be the same. Everyone has different levels of communication, most will think a little differently. If they're programmers, there's probably different levels of understanding of language concepts, or OOP concepts. In the scenario of one entry level candiate from a brick and mortar institution vs the candidate from MITx. I'm going to choose the person answers my questions most coherently, and writes the better code on my sample problem.

I'm going to hire the employee who i believe will work with me better, and who will produce a higher quality product. I don't care which school he/she went to.

<comment><USER14> It's a gedankenexperiment and he's invoking ceteris paribus. It's no different than isolating the velocity of two balls rolling down a slope by opting to ignore things like friction & drag in a physics problem.

</comment></comment><comment><USER15> This post raises a bigger question for the US: What will we do with all of the vacant retail space that is abandoned as shopping continues to go online?

I wonder if there are companies out there working on innovative ways to fill this space. After all, not _everything_ will be a coffee shop...right?

<comment><USER16> There are many, many businesses other than retail shops that need space.

</comment></comment><comment><USER17> "Book Stores Will Shrink to Coffee Shops"

This could turn out to be true, i just hope that as paper books turn into history, we dont lose the quality associated with something going into print. The process of having enough confidence to "Print it" is pretty intense, and therefore the quality of a printed book v's any e-book or website will not match up without a significant amount of effort (which i suspect for business reasons wont get as much attention, because for business reasons you dont want to screw up a paper book)

Its an interesting concept, i think we're just not there yet. People like paper books, the only way they'll go away is if they become unaffordable or just stop being produced (in which case i'm starting a publishing company focusing on paper books!)

</comment><comment><USER18> Hopefully of the Amsterdam variety.

</comment><comment><USER19> This somewhat assumes that the purpose of universities is to gain knowledge useful to employers. While that might be _a_ purpose of it, universities are also screening mechanisms.

This is something by people in educational economics. While I think the author has a great point that we're looking to get workers who can get the job done, that isn't necessarily how businesses hire. The benefits from education don't just come in the form of increased human capital. Basically, you get bonus points for having the degree regardless of what it means to your human capital (there's a term for it that I can't come up with right now).

For a long time, we've heard of jobs that don't need a college degree, but that you won't get hired for without it. In fact, that's the reasoning behind getting a college degree in many majors where one doesn't have the intention of working in that area.

College is also a place where people get sorted into social groups according to smartness - social groupings that can continue well past college. After college, you meet friends of friends you had in college who also went to schools similar to your own and you get to build a network of people like you somewhat regardless of your success in life.

Finally, the appeal of letters is great. If you're "John Smith, BS", you will always be that. You will get the respect of being a college grad for the rest of your life. In a world where things seem in flux, items that we place undue weight on are comforting. Heck, the same can be said of going to a good school. If you went to Harvard, you will always have gone to Harvard - something very few people can say. No matter how much you fail at life in the future, you have proven that you're the top by having gone there.

Getting a certificate of completion from MITx isn't the same for many of these things. The fact that there aren't entrance requirements or limitations means that it isn't a certification that you're the top rung of society - just that you've learned some knowledge. Because it's so broadly available, it isn't sorting you into a social grouping. If universities are for knowledge transmission, the author is right - that these new offerings are wonderful. While maybe they _should_ be for that purpose, I think that universities play a broader role in our society (I'm not saying it's a good or desirable role, just a role). They prove to others that I was accepted as not just someone they could transmit knowledge to, but a really smart person well above what would be needed to pass the courses. They connect me to other smart people who will become my social group as well as professional networking group. They make sure that no matter what I do in the future, I've proven that I'm one of the smart ones - one of the elite. My neighbor with a high-school diploma may make millions as a real-estate agent, but I'm a college grad! I can still feel proud (and maybe a little smug) because someone has certified that I'm part of the top of society - and no one has done that for him!

<comment><USER20> _This is something by people in educational economics. While I think the author has a great point that we're looking to get workers who can get the job done, that isn't necessarily how businesses hire. The benefits from education don't just come in the form of increased human capital. Basically, you get bonus points for having the degree regardless of what it means to your human capital (there's a term for it that I can't come up with right now)._

I believe it's called signaling.

<comment><USER21> Yup - its a general economics type of theory: <http://en.wikipedia.org/wiki/Signalling_(economics)>

</comment></comment></comment><comment><USER22> Could this be extended to a need for startups or meetups that focus entirely on internet-based education?

Something akin to a formal book club with paid/volunteer instruction. I'm thinking about events like, "MyAwesomeEduStartup sponsors instructor [someone]'s coverage of [some MIT xCourse]."

It would definitely be cool as a community service or meetup event. I think it would be hard to get people to pay for this just yet, but maybe in the near future.

</comment><comment><USER23> Just because he prefers to buy online doesn't mean other people do. Google tried to sell phones online and it just didn't work, for example...

<comment><USER24> Currently there is a complex and non-transparent pricing for phones purchased bundled with a service. This is used maximize profit share, disguise cost and create market power etc.

Google tried to challenge this model. This has nothing to do with whether people buy from brick and mortar stores or online.

I bought my phone online disentangled:

        http://www.clove.co.uk/

But I could have bought it online entangled:

        http://www.virginmobile.com.au/shop

There are many things where I currently prefer buying online. And others where I prefer brick and mortar. The online stores are getting better more quickly than the brick and mortar stores.

</comment></comment><comment><USER25> I certainly hope not. I _hate_ coffee.

</comment><comment><USER3> _There are two candidates: one from the local state school with an appropriate college degree, a second with relevant MITx certificates of completion. Let's say all other things between the candidates are equal. Which should be chosen? It's true that an online education is not the same as the college experience. The candidate who went to college probably enjoyed his experience more, but how much is that experience worth to a potential employer? Unless he's a member of the same fraternity, probably not as much as the college candidate would hope. And here's the reality: the student debt of the college candidate controls, to some extent, his salary requirements. Since the MITx candidate appears to have the knowledge required, and has no student debt, he probably can be hired cheaper._

Actually it's the inverse. The student debt accumulated will make the college graduate more desperate to accept any wage offer, and more fearful of keeping the job once there.

People hiring love this kind of dependance.

<comment><USER26> The debt burden makes the college graduate more desperate to work, but not for any wage. There is a hard line below which the student is unable to make payments and a softer line above that allowing for various qualities of life. The key in the analysis is if the non-grad can under-price the college grad near (or even below) that hard line for long enough to get entry level experience and thus be treated as another experienced hire.

There is also something to be said for a self-starter who drives himself through an online programme and comes out with a working understanding of a topic.

</comment></comment><comment><USER27> People romanticize coffee shops too much.

<comment><USER28> Could you explain what you mean? I've done my best work in coffee shops, hands down. I've also had the most enjoyable time doing it. It's way nicer than a library or an office or a chair at home. When you have a collection of other caffinated people working near you on different projects, you are often more motivated to work yourself. The atmosphere is ambient and doesn't offer much distraction, unless you want it to.

I only get to spend about 3 or 4 hours / week in cafes these days (I have an office job) but those are some of the best work hours I get. I wish I could transition full-time to coffeeshops, and if I get a startup going I might try it.</comment></comment>


Writing on LeanPub – $0.21 per word - <AUTHOR> https://servercheck.in/blog/writing-leanpub-021-word

<comment><USER2> Thanks for sharing!

If you have time to out into it, also do some active marketing around it.

I'm at .27 per word on the first day of selling my ebook (today as it just so happens).

Value your work more! Your book is worth way more then $10. (I know, I've bought and read it!)

<comment><AUTHOR> Thanks for the feedback; I've been hoping to give people on LeanPub a great deal, since they're basically funding my writing (well, at least motivating me to finish the book!). Depending on royalty rates elsewhere, I'll likely end up charging more on Kindle and other marketplaces, and I hope to have at least a paperback available at some point.

And good luck with your book, too!</comment></comment>


Researchers Demonstrate 100° Dynamic Focus AR Display with Membrane Mirrors - <AUTHOR> http://www.roadtovr.com/researchers-demonstrate-100-degree-dynamic-focus-ar-display-membrane-mirror-vergence-accommodation-conflict/ <comment><USER2> This is effectively the same physical setup as Steve Mann's eyetap developed long ago, with some changes in lensing.

[http://www.eyetap.org/research/eyetap.html](http://www.eyetap.org/research/eyetap.html)</comment>


I Bet My 40s Are Totally Going To Rock - <AUTHOR> http://www.theonion.com/content/opinion/i_bet_my_40s_are_totally_going

<comment><USER2> Despite only being 24 and having a life nothing like that, I felt suddenly motivated to do more than I already am after reading that...

<comment><AUTHOR> That's why I submitted it.</comment></comment>


The World's Richest People Lost $511B in 2018 - <AUTHOR> https://www.bloomberg.com/news/articles/2018-12-21/world-s-richest-lost-511-billion-in-a-year-of-market-turmoil <comment><USER2> In fictional paper wealth.

If I own 1 billion Chuck-E-Cheese tokens, and you pay me $1 for one of them, current market cap formulas say I'm a billionaire.

It is thus no wonder that personal fortunes can crash 30-50% in one month when everyone stops bidding on stocks that are valued at 60x earnings.</comment>


Customers, Product, and then VC - <AUTHOR> http://blog.rafaelcorrales.com/2010/03/three-things-that-matter-in-startup.html

<comment><AUTHOR> Is the order really customer, product, and then venture capital (or angel)?

I do know these are the three big things that matter in an early startup, but it's the order that's a big debate.</comment>


As US states use less coal for electricity, driving EVs becomes even cleaner - <AUTHOR> https://www.greencarcongress.com/2020/04/20200403-sivak-1.html <comment><AUTHOR> Highlights:

* The number of states that generated at least 75% of electricity from coal decreased from 9 in 2008 to 3 in 2018

* The percentage of electricity generated from coal decreased from 2008 to 2018 in 49 states

* The most significant decreases were in Massachusetts (from 25% to 0%)

* Connecticut and New York were both down from 14% to 1%

* Delaware decreased from 70% to 5%

* The slight increases occurred only in Alaska and in Wyoming

From [https://www.commondreams.org/views/2020/02/14/are- electric-v...](https://www.commondreams.org/views/2020/02/14/are-electric- vehicles-really-better-climate-yes-heres-why):

* Based on where EVs have been sold, driving the average EV produces global warming pollution equal to a gasoline vehicle that gets 88 miles per gallon (mpg) fuel economy.

* That's significantly better than the most efficient gasoline car (58 mpg) and far cleaner than the average new gasoline car (31 mpg) or truck (21 mpg) sold in the US.

* And our estimate for EV emissions is almost 10 percent lower than our previous estimate two years ago. Now 94 percent of people in the US live where driving an EV produces less emissions than using a 50 mpg gasoline car.</comment>


Google starts testing its replacement for third-party cookies - <AUTHOR> https://www.engadget.com/google-tests-ad-trust-tokens-223104543.html <comment><USER2> Google leading this effort is completely ridiculous.

Whatever comes out of it is bound to either not be great for privacy or it will be an improvement but hit the smaller players. ie everyone not google. eg take away Cookies to prevent tracking. Leaving them the only one company with sight of near everything (google analytics & Adsense & Chrome). And we already know from recent revelations that google isn't above peeking under the hood of data sources they shouldn't.

Whole thing seems insanely monopolistic to me.

<comment><USER3> Do you have any actual technical counterpoints?

<comment><USER4> I think the problem is the hens are watching the fox design the coop. They've been invited to participate, but the fox has unlimited resources at its disposal for research and planning while the hens are of meager means.

So yes, it may be unkind to prejudge the fox, but based on years of prior malice towards all poultry in the yard, and without fully understanding its plans, we have to assume it won't turn out well for us chickens.

Cluck.

</comment></comment></comment><comment><USER5> I'm really confused. I'm reading the spec[0], which seems to explicitly state that it's not possible (modulo some possible vulnerabilities with mitigations that they later list) to track a user across the web using these tokens. Yet many of the comments I read here are talking about this being a way for websites to track users?

This spec document also doesn't really list use cases for this. Why would I want this? The linked article seems to suggest it's so Google can reduce ad fraud, which of course I don't give a damn about, and don't want my user agent doing anything that helps advertisers, ever.

Hopefully Firefox does not implement this, and hopefully if they don't, websites don't somehow penalize browsers that don't support it.

[0] [https://github.com/WICG/trust-token- api#overview](https://github.com/WICG/trust-token-api#overview)

<comment><USER6> Trust tokens are only one of several separate proposals to remove third-party cookies. The so-called Privacy Sandbox will also include other technologies. Tracking cookies are planned to be replaced with Turtledove and FLoC. The latter is about running machine learning algorithms _in your browser_ to infer your interests.

[https://www.chromium.org/Home/chromium-privacy/privacy- sandb...](https://www.chromium.org/Home/chromium-privacy/privacy-sandbox)

<comment><USER7> > The latter is about running machine learning algorithms in your browser to > infer your interests.

Oh nice, sounds like my information will now not only be sent to someone else, I even will be doing the computation for them to increase their margins and pay with reduced battery life. Awesome!

<comment><USER8> Do we think this will use javascript? Perhaps we can just block javascript.

</comment></comment></comment></comment><comment><USER9> Much better article: [https://www.zdnet.com/article/google-launches-chrome- extensi...](https://www.zdnet.com/article/google-launches-chrome-extension- for-ad-transparency-trust-token-api/)

Trust Token Github page: [https://github.com/WICG/trust-token- api](https://github.com/WICG/trust-token-api)

I'm glad to see it uses Privacy Pass as a basic mechanism.

</comment><comment><USER10> From [https://github.com/WICG/trust-token-api](https://github.com/WICG/trust- token-api)

> Token Exhaustion Attack

> Issuers issue many tokens at once, so users have a large supply of tokens.

> When the issuer detects a site is attacking its trust token supply, it can > fail redemption (before the token is revealed) based on the referring > origin, and prevent browsers from spending tokens there.

I think there's an interesting trade-off between attack surface and specificity of the token here. A token meaning "This user has only accessed 6 sites in this network" is meaningful only if there's a single token, as the next access can cause the token to be inconsistent with reality (It states a falsity now).

At the same time, it states the issuer can block redemption based on the referrer. I think that'll be interesting, as an allow list format will lead to only "big players" being able to use this API (As they are the only ones who they trust to not adversarially redeem tokens) whereas a deny list you're playing a game of whack-a-mole where new domains can be popped up for this purpose.

edit: added the last part of the quote for completeness

</comment><comment><USER11> "Trust tokens are meant to foster user trust across sites"

Can anyone shed light on what exactly this "trust token" mechanism is? It sounds to me like some sort of cryptographic identifier that will enable Google to track our every move (to the limited extent we use Chrome and Google's websites) but this would be contradictory to their claim of non- identifying privacy.

<comment><USER12> [https://github.com/WICG/trust-token- api#overview](https://github.com/WICG/trust-token-api#overview)

For what I understand, a provider who trust a user, stores in her browser a set of kind of certificates, that basically declare "I "provider NNN", states that this user has been authenticated by me".

Another party will ask for one trusted token, verifies that it is really signed by provider NNN, and can trust that each time this token is resent, it is the same user.

The privacy is respected on the user side has the third party has no idea who is this user. The trusted tokens could even have a short life. Third parties therefore should have great trust in the trust token provider.

It is as if Google authorized other parties to use its own cookies.

Indeed this means that other parties trust "provider NNN". I guess that Google wants to become a more central identity provider than today, where it has to share this role with Facebook and a few other companies.

<comment><USER13> Sounds like something I still will expect my privacy-respecting browser to block in its entirety. It's not meant to benefit me, it's designed to prevent "ad fraud".

<comment><USER14> >Sounds like something I still will expect my privacy-respecting browser to block in its entirety

prepared to get penalized by recaptcha for not having it enabled.

<comment><USER15> So nothing will change then?

ReCaptcha already appears to have some grudge against me, presumably by virtue of running Firefox and comprehensive ad-blocking, so blocking yet another google thing isn't going to make my life substantially worse.

<comment><USER16> May I ask what kind of setup you're running with Firefox? I'm having Firefox on a MBP with only uBlock but I rarely get any recaptcha. Am I mistaken in thinking I'm securing my privacy?

<comment><USER17> Are you logged into Google? Not on Firefox itself, just in one of their properties. I have the same setup and don't get recaptcha either, I think it's probably because I'm either logged into my personal long-standing gmail or my work g suite account. My guess is if I used the container stuff to isolate Google like I do Facebook then it would start triggering it.

I do get recaptcha all the time in Safari on iOS despite being logged into Google there too, not sure what that's about.

<comment><USER18> I only login to Google in a dedicated Firefox Container, and yes I'm getting really sick of ReCaptcha. It's amazingly user hostile at this point, and I suppose that it doesn't help that I need two or three attempts at this point to "pass" its challenges, because its machine learning algorithm and I disagree on what constitutes a "street sign" or something dumb like that. It's making me want to avoid websites that use ReCaptcha challenges altogether.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> And, let me guess, you can't block "trust tokens" in Chrome.

<comment><USER20> You cant disable service workers either (except using hack with uBO)

</comment></comment><comment><USER21> Well, how can we tell Google that they shouldn't have a say on this topic?

<comment><USER22> Stop using the invasive malware that is Chrome.

<comment><USER21> That will do nothing I'm afraid. I already don't use Chrome, and even if I spend all my free time asking people to stop using Chrome for weird technical reasons from their point of view, I'm afraid that will do nothing compared to the advertising power of Google.

<comment><USER23> Indeed: it is far past the time when individual action would make a difference to Google. The only way to actually get them to listen is going to be to consistently vote for people who a) have a reasonable chance of winning their election, and b) support modernizing and enforcing our antitrust regime. (It is likely that this will need to be done incrementally, and it may require first replacing (b) with increasing levels of support for getting corporate money out of politics.)

</comment></comment></comment></comment><comment><USER24> So this will be used entirely for invasive tracking by Google's advertising arms. Calling it a "trust token" is gaslighting, since the data being collected and distributed to advertising companies is not properly disclosed nor easy to disable.

Google has a habit of obscuring such practices, like the hard-coded "X-Client- Data" tracking backdoor header they send to DoubleClick and is _impossible to disable_ , and _never disclosed to anyone_.

If they'll do "X-Client-Data", you can be sure this backdoor will be even larger.

<comment><USER25> So I think we've had this conversation before, but what do you believe that header is used for?

Are you claiming that Google uses it for things beyond what they claim to and that Google is lying when it claims to not be using the header for ad tracking?

<comment><USER24> Without repeating the same arguments, it's possible that Google is using it for tracking purposes because their public statements were ambiguous. That aside though, this behavior is never disclosed to users and is __impossible to disable __.

Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? Of course not, it was never disclosed and they were never given the option to disable it.

<comment><USER25> Can you explain what is ambiguous about "This information helps us measure server-side metrics for large groups of installations; it is not used to identify or track individual users."

> Do you think the average user knows that Chrome is sending unique > identifiers to DoubleClick?

What's your actual concern? What you've described here applies to nefarious data like the IP address.

<comment><USER24> Okay I presume you've never worked in the ad or tracking industry, because the data being sent to DoubleClick without notification is __gold __for tracking purposes.

This can also be considered anti-competitive behavior. DoubleClick has access to orders of magnitude more tracking data than its competitors.

IP Addresses cannot be used to differentiate devices. X-Client-Data can, easily.

My concerns are:

\- Their statement is ambiguous, and does not rule out use for tracking or advertising purposes, nor does it rule out future use for individual user tracking.

\- This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent.

\- It __cannot be disabled __. This is the key point. _Why can 't it be disabled?_

\- DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and __not __GTM or GA must be vanishingly small. So the argument that you want to collect the most data is disingenuous. 87%(!!!) of the top 100,000 websites globally make calls to GA.

My concern is Google has sneakily added a feature that can be used for tracking purposes while refusing to disclose it to end users and making it __impossible to disable __.

<comment><USER25> > Okay I presume you've never worked in the ad or tracking industry

Yes and no. I work on tooling very similar to the actual, intended, use of the x-client-data header (aggregate performance analysis).

> because the data being sent to DoubleClick without notification is gold for > tracking purposes

What does it provide that other data that is accessible does not?

> IP Addresses cannot be used to differentiate devices.

Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here?

> \- This "feature" was added sneakily. No notification, there's no user > disclosure. Nothing. That just screams suspicious, given the value of the > data being sent.

Sure, sort of, in 2012[0]. Doubleclick was added a bit later, in 2014[1]. The reasoning, at the time, is provided in the linked bug[2]. Sure looks nefarious. So was this an 8+ year scheme?

Now, there are (at least) two possible ways to look at this, either it's an almost decade long scheme, or alternatively no one on chrome had any intent of ever tracking individual users, and it wasn't even considered.

The bug also provides some more insight, doubleclick and GA serve different types of data, and that might matter for measuring things about QUIC.

> DoubleClick is in the whitelist for no reason other than ad tracking > purposes. The amount of websites who make calls to DoubleClick and not GTM > or GA must be vanishingly small.

Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell).

> and does not rule out use for tracking or advertising purposes

I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. It seems like you're claiming that Google is attempting to split hairs and say that tracking individual devices is different from tracking individual users.

I've explained before why something like x-client-data can actually be a useful privacy-preserving tool elsewhere[3] (since it allows you to join across a quasi-identifier instead of a PII-identifier).

[0]: [https://chromium.googlesource.com/chromium/src.git/+/f89fdab...](https://chromium.googlesource.com/chromium/src.git/+/f89fdab13152123f737dc84f5910362fa6569f7f%5E%21/chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc)

[1]: [https://chromium.googlesource.com/chromium/src.git/+/64d617e...](https://chromium.googlesource.com/chromium/src.git/+/64d617ec7c502ea5ce5ec8f6f97580000541a854)

[2]: [https://bugs.chromium.org/p/chromium/issues/detail?id=379341](https://bugs.chromium.org/p/chromium/issues/detail?id=379341)

[3]: [https://news.ycombinator.com/item?id=22244282](https://news.ycombinator.com/item?id=22244282)

<comment><USER24> >Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell).

I can see they're preloading GTM scripts, which means those requests are absolutely made. I can't tell if the script is executed, but that doesn't even matter since it's requested.

Just open up your network console and filter by "Google". There are numerous requests to Google services, including Google.com and GoogleTagServices.com.

>I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users.

Tracking groups of users.

>So was this an 8+ year scheme?

Even worse. Google had 8 years to adequately disclose to users the DoubleClick tracking or allow them to disable it. To this day, disabling is not possible (not even via config).

>Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here?

Yes, this is why ad networks tend to run fingerprinting scripts.

Tracking specific devices is huge. That's partially why the ad industry took a huge hit when Safari cracked down on third-party tracking.

<comment><USER25> > Tracking groups of users.

I asked for a scheme. How are they differentiating between individual devices without tracking individual users. Again: you seem to be claiming that Google is using some form of linguistic trickery here, but you're unwilling to describe exactly what that trickery is. I content this is because it'll sound ridiculous when you actually say it, so you resort to dancing around it instead.

This isn't good for _anyone_ by the way, it is a disincentive for companies to use clear language to communicate with consumers (which is a pet peeve of mine). Assuming Google isn't actively trying to mislead, which is more useful to the average consumer, the statement they made, or the legalese they'd need to assuage your concerns?

> Even worse. Google had 8 years to adequately disclose to users the > DoubleClick tracking or allow them to disable it.

Sort of. No one cared until March of 2020. Not like only the privacy wonks, I mean like literally no one, I can't find reference to the x-client-data string on the internet prior to 2020 except in [https://unsearcher.org/more-on- chrome-updates-and-headers](https://unsearcher.org/more-on-chrome-updates-and- headers), which found it _in the Chrome whitepaper_. So is your contention that explicitly describing a header and how it is used in the whitepaper on privacy is not adequate disclosure? Or even that including it in the whitepaper is somehow "the deliberate decision to not disclose this tracking"?

That seems pretty far a reach to me.

> Yes, this is why ad networks tend to run fingerprinting scripts.

But does Google? Did Google ever? As far as I know the answer is no, Google doesn't claim to use any advanced fingerprinting techniques, which means your accusation, when fully fleshed out is

"In the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole, to better fingerprint devices in a a way that Google has never attempted to do before, and this was intentionally never disclosed."

Because if you're logged in, the x-client data doesn't matter, you have the user id. And if you're one person per household, it doesn't matter. So the only groups this matters for are the people who don't use any Google products but who use chrome but also aren't privacy conscious enough to use an ad- blocker. I can't imagine that group is very big.

And the only way to reach this conclusion is to

1\. Assume that this was _intentionally_ not disclosed, as opposed to accidentally not disclosed. There's evidence that it was and is disclosed, just not in ways you personally feel are enough. There's evidence that it was not intentionally hidden.

2\. Assume that Google is intentionally misleading you with sneaky wording, in ways that are more reminiscent of freeman-of-the-land style legal tomfoolery than actual things that businesses, even unethical ones, do.

3\. Assume that all of this was done to continue to do a thing that there's no evidence that Google has ever done.

The amount of bad faith you have to assume is staggering.

> Additionally, Google could be compelled to use this data to track users and > lie about it publicly through the use of National Security Letters or other > nation state mechanisms.

Which leaves us with this, which I'd consider perhaps plausible, but unlikely. My understanding is that NSL-style mechanisms can compel companies to provide data, but not to build infrastructure. So if the data isn't joinable, an NSL couldn't compel a company to modify things so that it _is_ joinable.

There are fair concerns about why this isn't opt-out. But your concerns go so far beyond anything reasonable that they deserve pushback.

<comment><USER26> You're not finding earlier discussions since the header was renamed at some point. It was originally X-Chrome-Variations.

<comment><USER25> Which provides one additional hit: this stackoverflow question, which also references the whitepaper[0].

[0]: [https://stackoverflow.com/questions/12183575/what-is- followi...](https://stackoverflow.com/questions/12183575/what-is-following- header-for-x-chrome-variations)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Is there a good article/video explaining how third party cookies work and then how the ad fraud itself works in this context?

I would like to send it to someone with very little knowledge of this world and what problem this feature intends to solve.

</comment><comment><USER28> will I be forced into this even if I use firefox?

<comment><USER29> Probably not since this is chrome specific. If it becomes a standard and publishers start blocking/restricting browsers that don't support it well, that would be a different story.

<comment><USER30> That is the only logical endgame, otherwise why bother pushing this?

</comment></comment></comment><comment><USER31> > the company hoped to phase out third-party cookies in Chrome once it could > meet the needs of both users and advertisers.

Chrome, the browser, can't change how web servers are implemented. Users needs are met as long as web servers behave as they should. I've disabled 3rd party cookies and haven't seen any issues (I'd suggest others try it as well).

I suspect mostly advertisers are affected at this point.

If this becomes a thing, I'll block it in my browser.

<comment><USER32> I do the same - there are a number of Google properties that get broken.

Usually because they try to provide named-users-only access to user-generated content, then exile user-generated content to other domains (like googleusercontent.com ) and one can't be logged in on the other domain without cookies.

I've filed bugs with Google about this behaviour, and had them accepted as valid, but they don't seem in a hurry to fix them - I assume because third- party tracking is google's core business.

</comment></comment><comment><USER33> They must have the most atrocious, darkest, GDPR confirmation dialog. It's absolutely impossible to understand what you opt-in to.

</comment><comment><USER34> Archived copy without GDPR nag screen:

[https://archive.md/U4axx](https://archive.md/U4axx)

<comment><USER33> Thanks, doing the gods' work here.

</comment></comment><comment><USER35> So how do I block this in uBlock?

</comment><comment><USER36> This, like AMP, looks like a blatant attempt by Google to lock in users/advertisers into the Google ecosystem. If you're going to leverage your monopoly to harm end users, then the time for lax government regulations is over.

<comment><USER37> Google needs to be stripped of its ad business. They need to lose Chrome and Android. They can't embrace, extend, extinguish the Internet. They're seriously harming the web with Chrome, AMP, and other initiatives.

Apple needs to be strictly hardware or software. They can't continue to run an exclusive app store and tax 30%. When you buy the device, it's yours. You should be able to upgrade and change the software.

Facebook can't be allowed to acquire any more social media companies. They need to be mandated to provide account data export, and they can't create shadow profiles without consent.

Amazon can't be allowed to compete with its sellers. Every act of espionage needs to be confirmed and awarded $100M or more. Out of all the companies, their behavior is the most gut-wrenchingly evil and steps on the upstarts.

Call your representatives and demand this.

Microsoft, surprisingly, is acting like a trillion dollar company that isn't run like a monopoly. Their tools and ecosystem play nice with others.

<comment><USER38> Let's dive into this. But first, we need to update the anti-competitive rules so we have a general theory that makes sense. The current rules allow for non- competitive behavior as long as you have low prices which are good for consumers. That's why Amazon is safe. The hole is that this doesn't protect against predatory pricing where you kill all competitors and then can charge anything.

Google is certainly a problem. I'm not personally against divesting chrome and amp and some others. But I can see people disagreeing.

Apple's DNA is that by combining hardware and software, they make high quality products. Don't kill the magic. The tax on the ecosystem seems usurious. The app store could be a target for some action imo.

I probably disagree the least with your ideas on FB.

I doubt strongly that Amazon systematically uses espionage to steal good ideas. It's such a monster that it's bound to start a product similar to what they were informed about. And maybe a rogue employee here and there, but I doubt this is a big problem. They have a million other issues, but I don't think you hit the nail on the head.

These are just my personal take. Strong opinion, weakly held.

<comment><USER39> Just out of curiosity, what's wrong with Chrome and Amp?

<comment><USER37> Chrome and Amp are Google lock-in web killers.

Google is pushing ahead in the browser space, ignoring standards committees. They're doing things that deepen their moat.

Google made choices in HTML5 to make it less semantic, ensuring their search engine wins.

Google is trying to remove the URL bar, which makes Google homepage and AOL- like keywords the dominant way to access information. It lowers awareness of brands and websites as 3rd party entities.

AMP hosts content on Google's servers. You never actually access the original publisher's website. Guess how you get higher search rankings?

I should compile a list sometime. It's actually quite astonishing how much they're eroding the commons to entrench themselves.</comment></comment></comment></comment></comment>


I hate the X11 ICCCM selection system - <AUTHOR> http://www.call-with-current-continuation.org/rants/icccm.txt <comment><USER2> Everything in the X11 ecosystem seems to be a pile of hacks on top of hacks on top of hacks. It sometimes works pretty well and that's amazing! It's kind of beautiful in a silly way to realize how many layers of hacks are used to build the desktop experience on Linux.

I don't think terminals are much better. Fun fact about terminal escape sequences: some of them are timing-dependent. If a byte arrives too slowly, it will do something different.

The web is also a pile of hacks but at least we have multiple independent implementations and some standards.

The mess is beautiful. Keep adding layers.

<comment><USER3> > The mess is beautiful. Keep adding layers.

No, it's really not. In many ways X11 is behind what the other operating systems offer, and the emphasis on backwards compatibility above all else is the reason. For example, Windows has the notion of window privilege, in which lower-privilege windows are isolated from higher-privilege windows. X11 technically has the XSECURITY extension, but nobody uses it as it breaks everything, so in practice every X11 app can keylog your browser. It's really unfortunate that the Linux community is so divided over Wayland, as from a technical perspective Wayland is sorely needed.

<comment><USER4> Wayland is problematic as it goes entirely the opposite direction of X11, which means, for example, that screenshot programs and custom key binding daemons will not work.

<comment><USER3> We now understand that a program that can secretly take screenshots at will can spy on all your conversations and steal your credit card number. That isn't _quite_ as bad as root, but, honestly, for most users it's pretty close.

Wayland is absolutely doing the sensible, conservative thing when it comes to screenshots.

<comment><USER4> No, I'm pretty sure that was always understood. What Wayland is doing -- breaking expected desktop functionality -- is not sensible at all. Window's permission model is more sensible as it actually _accomplishes_ something.

Wayland's "fix" isn't one because on the vast, vast majority of systems any compromised program running under your uid can begin debugging another under your uid, completely circumventing any permission system Wayland tries to create. Have a root terminal logged in, or maybe open one later? Any program under your account now has root if it tries hard enough.

People started freaking out about the _completely normal and expected things_ you could do under X11 and kneejerked themselves into the current Wayland. Maybe it will eventually be relaxed. If it isn't, I can't expected it to replace X11.

</comment></comment></comment></comment></comment><comment><USER5> (2001)

Aside, why the few X11 related articles recently?

Has something happened? Is there a debate?

Correction - the author is Conrad Parker aka kfish. Dunno why that is elided in this version. Conrad has some good rants.

Complete version at [https://raw.githubusercontent.com/kfish/xsel/1a1c5edf0dc1290...](https://raw.githubusercontent.com/kfish/xsel/1a1c5edf0dc129055f7764c666da2dd468df6016/rant.txt)

Trivia, JW here is jdub and was an early Canonical/Ubuntu employee and their evangelist.

[https://en.wikipedia.org/wiki/Jeff_Waugh](https://en.wikipedia.org/wiki/Jeff_Waugh)

</comment><comment><USER6> Well, it's certainly a rant.

Honestly, I can see why you might want two kinds of objects to pass via selection: strings, and blobs. But two is an odd number; it ought to be zero, one, or infinite. Zero doesn't help, and one would be hijacked by incompatible systems that would have to guess "are they going to want a JSON representation of this, or a MIME type followed by base64 encoded data?", so I guess that an updatable registry of types would be ok, just really unwieldy, and ... nightmares to follow.

<comment><USER7> > But two is an odd number

This is very tangential, but I was very confused when I read this at first due to the arithmetic meaning of "odd".

<comment><USER8> Horses have an even number of legs. Behind they have two legs, and in front they have fore-legs. This makes six legs, which is certainly an odd number of legs for a horse. But the only number that is both even and odd is infinity. Therefore, horses have an infinite number of legs. (from fortune).

</comment></comment></comment><comment><USER9> I use a program with multiple selection every day: my text editor. And not only does it have that, it has multiple cursors, too!

<comment><USER10> The icccm uses selection for what we call clipboard. A lot of x11 software used to put what you selected on the clipboard automatically.</comment></comment>