Draft: draft-ietf-mops-streaming-opcons

Commentary: One note about this edit : My local build failed with this ( from a fresh clone ): In line 255 of the xml , it has the xref here : Thus the issue in my local build went away when I made the above change . I 'm not sure why this passed build in the repo , it looks to me like it 's expected to fail ? But anyway , that 's why I have that part , and I 'm not sure we wanted a reference in the title anyway . Probably should be in a different PR , but I 'm rushing out the door and wanted the reviews , but also wanted to make it build first ... 
 - My apologies for driving you a little bit nuttier . I tend to add cross - ref targets on pretty much everything , but ( of course ) that one should have been 
 I tried that , but it also failed since IABcovid was already a named reference in the reference section , and the one place it was used seemed to be referring to that . So I thought it better to remove the tag . 
 Maybe , but on my reading of 7258 , making the collection overt instead of covert and requiring consent is one of the mitigations , but does not change the notion of the pervasive monitoring behavior matching the technical definition of the attack as they describe it . I landed on this text after looking for something softer but then considering a few quotes like these from 7258 : I 'm happy to take suggestions but it seemed to me that if there are broad segments of people who do not realize that agreeing to cookie use means agreeing to expose much of their browsing history to multiple parties , then the best description based on existing terms is to call it a PM attack . Yeah , good point . Maybe this ? Yes , that 's better . Thanks . That 'll be in the rev ... 
 A couple of things here : I agree with your reading of RFC 7258 ( and , looking back at , I actually balloted on it - 2014 was a long time ago , so I 'd forgotten ) . I think it 's consistent with RFC 7258 to say " This provides a strong incentive for advertisers to gain access to the data necessary to perform behavioral targeting , leading some to engage in what is indistinguishable from a pervasive monitoring attack (     } ) based on user tracking in order to collect the relevant data , " I understand you to say that since everyone accepts cookies , whether they should do so or not , so that does n't count as informed consent , and the use of cookies to indicate consent does n't change the characterization of what advertisers are doing - it 's still indistinguishable from an attack , Is that right ? If I 'm tracking you correctly , perhaps that 's a point worth making ( not in those words , perhaps ) . But let 's wait and see what says - he is , after all , the  holder . That 's EXACTLY what I was hoping for ! 
 - thanks for pushing back and making me think about my suggestion on RFC 7258 . I reviewed your changes and they look fine . 
 - have you had a chance to look at this PR ? 
 From 
 We think the points to make are : media operators , your media is part of an arms race aiming to track users for more effective advertisers There are some efforts , such as , to get the ecosystem to reduce its reliance on individual tracking while still achieving targeted ads , which are worth a lot of money ( pick out a reference or 2 from e.g. [ 1 ] https://www2012.universite- ) As an initial idea , we 're thinking perhaps to add a paragraph after the first mention of targeting , and we 're wondering if this is in the right direction , and whether you can suggest any specific improvements ? : Traditionally , targeted ads have relied on user tracking , which involves a relatively large privacy exposure for end users . At the time of this writing some proposals such as have been made in an effort to reduce that exposure without losing the effects of targeting ( ref from [ 1 ] that measures a high impact ) . We found a few references touching on the risks , like : But maybe someone knows a better reference ? 
 Just wondering when we could expect some PR to address  's DISCUSS . 
 Hi ,  had asked for guidance , the Wednesday before this document was on the telechat . I have n't seen a response yet . The authors are meeting later today to coordinate our continued comment resolution , so we may be smarter after that . 
 While this is true , as of last week I stopped waiting and am working on a PR to address this , basically trying to tighten up the rough proposed direction I outlined in the request for guidance in hopes that direction is close to right . That timing came with a number of other outside distractions , which is the reason I 'm not done yet . Most of the time on this topic so far has gone toward looking for good references , and a bit toward angst on whether and how to add something about pervasive monitoring to the original sketch of the proposed text . So maybe within the next day or so , if I can land on something I 'm happy with . 
 is my first attempt to address this , please let me know what you think and 
 - this PR looks plausible to me , but we 'll see what says - he is , after all , the  holder : stuckouttonguewinkingeye : . I do have a couple of nits . In this text , Is " what amounts to " the right phrase ? It seems quite direct . Perhaps " can be considered " ? it might be worth mentioning explicitly that collecting this information without user consent is the problem . So , insert " without user consent " at the appropriate place ? In this text ( which existed before the PR ) , is there a decent reference that could be ? In this text , I 'd suggest
Paragraph (version A):
Additionally, this market historically has had incidents of ad fraud
(misreporting of ad delivery to end users for financial gain).  As a
mitigation for concerns driven by those incidents, some SSPs have
required the use of players with features like reporting of ad
delivery, or providing information that can be used for user
tracking.  Some of these and other measures have raised privacy
concerns for end users.
Paragraph (version B):
Another major source of competing objectives comes from user privacy
considerations vs. the advertiser's incentives to target ads to user
segments based on behavioral data.  Multiple studies, for example
BEHAVE and BEHAVE2, have reported large improvements in ad
effectiveness when using behaviorally targeted ads, relative to
untargeted ads.  This provides a strong incentive for advertisers to
gain access to the data necessary to perform behavioral targeting,
leading some to engage in what is indistinguishable from a pervasive
monitoring attack (RFC7258) based on user tracking in order to
collect the relevant data, A more complete review of issues in this
space is available in BALANCING.
Paragraph (version B):
On top of these competing objectives, this market historically has
had incidents of ad fraud (misreporting of ad delivery to end users
for financial gain) ADFRAUD.  As a mitigation for concerns driven by
those incidents, some SSPs have required the use of specific media
players that include features like reporting of ad delivery, or
providing additional user information that can be used for tracking.