Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Put a Fork in Caddy; It's Done

neflabs.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Put a Fork in Caddy; It's Done

#81

Post by rrdharan »

josteink wrote: post #78
TimothyBJacobs wrote: post #40

Earlier quoted context omitted.

It sounds like it is collecting User Agent strings which depending on who you ask is personal data.

That identifies browser version and operating system combinations in a way which is aggregated and 100% decoupled in a irreversible way from the actual browsing session as conducted by the user(s), given by the browser, automatically, to everyone by default on every request. You won’t find a single lawyer anywhere who considers this to be privacy sensitive and definitely not covered by the GDPR.

I'm not convinced.

https://www.iubenda.com/blog/device-fingerprinting-and-cooki...

My understanding is that anything that enables fingerprinting is potentially covered.

[EDIT] So, here's a better link that specifically discusses fingerprinting and user agents in a post-GDPR world:

https://www.connectedpath.com/all-posts/2018/3/3/gdpr-and-fi...

My assumption was that the GDPR was attempting to be sufficiently broad such as to cover these kind of fingerprinting techniques but I guess not?

At least the second link makes it sound like at least some portion of people are likely to turn more towards device fingerprinting techniques specifically because they are GDPR-safe.

Re: Put a Fork in Caddy; It's Done

#82

Post by tatersolid »

stevekemp wrote: post #30
ezekg wrote: post #28

Earlier quoted context omitted.

I'm personally happy Matt is charging for his work. More open-source devs should charge for commercial use a la Sidekiq, ngrok, and Caddy. Free OSS is great, but for these types of tools, so is paid OSS. There's a large pool of small, useful dev tools that could be making money instead of begging for it. And I'm glad Matt is a part of the much smaller group that makes money.

I have no qualms about commercial services either, it's just a very different model here compared to nginx (which is about the closest comparison project I can think of).

Huh? Nginx also has a commercial license, Nginx Plus.

https://www.nginx.com/products/nginx/

Re: Put a Fork in Caddy; It's Done

#83

Post by josteink »

rrdharan wrote: post #81
josteink wrote: post #78

Earlier quoted context omitted.

That identifies browser version and operating system combinations in a way which is aggregated and 100% decoupled in a irreversible way from the actual browsing session as conducted by the user(s), given by the browser, automatically, to everyone by default on every request. You won’t find a single lawyer anywhere who considers this to be privacy sensitive and definitely not covered by the GDPR.

I'm not convinced. https://www.iubenda.com/blog/device-fingerprinting-and-cooki... My understanding is that anything that enables fingerprinting is potentially covered. [EDIT] So, here's a better link that specifically discusses fingerprinting and user agents in a post-GDPR world: https://www.connectedpath.com/all-posts/2018/3/3/gdpr-and-fi... My assumption was that the GDPR was attempting to be sufficiently broad su…

I think trying to frame something you give away to everyone, always, without anyone asking for it can legally be framed as privacy sensitive information. That would simply be absurd.

The GDPR regulations largely represents common sense and decensy and this über-paranoid consideration about what “may” be covered or not is not really productive use of time.

Example: if you explicitly email someone, according to the GDPR the recipient has been given an implicit right to store your email and email-address. Because there’s no way for them not to. Because that’s just how email and computers works.

I can’t imagine a fucking user-agent string shared by billion of other users enjoys higher protection.

The GDPR is not insane. Chill.

Re: Put a Fork in Caddy; It's Done

#84

Post by stevekemp »

tatersolid wrote: post #82
stevekemp wrote: post #30

Earlier quoted context omitted.

I have no qualms about commercial services either, it's just a very different model here compared to nginx (which is about the closest comparison project I can think of).

Huh? Nginx also has a commercial license, Nginx Plus. https://www.nginx.com/products/nginx/

I was suggesting the drama caused previously was due to the confusing way it was handled - pay to avoid a header, or to use "official" binaries.

I'm well aware that nginx has a commercial side, which is why I mentioned it as a comparison.

Re: Put a Fork in Caddy; It's Done

#85

Post by Whitestrake »

josteink wrote: post #78
TimothyBJacobs wrote: post #40

Earlier quoted context omitted.

It sounds like it is collecting User Agent strings which depending on who you ask is personal data.

That identifies browser version and operating system combinations in a way which is aggregated and 100% decoupled in a irreversible way from the actual browsing session as conducted by the user(s), given by the browser, automatically, to everyone by default on every request. You won’t find a single lawyer anywhere who considers this to be privacy sensitive and definitely not covered by the GDPR.

IANAL, but I could set my own completely custom user agent - I don't even need much technical expertise, a simple browser add-on would suffice - and by logging that string, I could be (depending on how unique I made my own user agent) uniquely identified.

Out of all the metrics Caddy plans to collect, it's the only one I think has some merit to its complainants. It might be simpler to only keep user agents that conform to common browser standards. But this has all been discussed in the Caddy forum thread itself, and we'd welcome your input there!

Re: Put a Fork in Caddy; It's Done

#86

Post by yuhong »

AdmiralAsshat wrote: post #75
mholt wrote: post #62

Earlier quoted context omitted.

> His own reply elsewhere in this thread reads more like a PR response than a real reply. What would you like me to say?

Hello, Matt! To be clear, I am not a Caddy user and have no horse in this race. I tend to sympathize with the privacy-conscious, however, having been a user who turned off telemetry in Firefox after the Mr. Robot scandal. Let me see if I can explain why your response comes across as tone-deaf: 1) Your first response is "I haven't actually watched the video," which immediately suggests that you're not going to actuall…

This completely ignores that the definition of open source code is that it can be audited.

Re: Put a Fork in Caddy; It's Done

#87

Post by shevegen »

mholt wrote: post #26

Hey everyone -- Matt here. Not quite sure why this is news; we've been discussing telemetry for a long[1] time[2]. I haven't actually watched the video because I've been really busy finishing my last semester of graduate school and switching research labs to start my masters thesis this week. Several of us in the research community have agreed that telemetry can be a net good for the Web. Similar to how Firefox, the…

> Similar to how Firefox, the privacy-focused browser, > has telemetry on by default to help improve

This is just Mozilla propaganda. See how they inject and use Google anti-privacy to spy on people.

https://twitter.com/nicolaspetton/status/884694176515936256?...

They use telemetry to spy on people, allegedly to "improve their products" but god knows what they do with this mass surveillance data. Since Google also pays to Mozilla (funding agreement; I don't know the actual percentage share but it is a LOT), Mozilla is dependent on Google.

So we have a network of spying going on here, with Evil corporations and Evil organizations claiming that they "only spy for the greater good".

> I hope you love using Caddy, and if you don't, > you don't have to use it.

I don't use it, but the topic of privacy, spying, net neutrality etc.. is important.

Why should we accept any organization that spies on people, no matter how they call it? Be it "telemetry" or any other fancy propaganda term that is coined by them for this malicious activity.

Re: Put a Fork in Caddy; It's Done

#88

Post by shevegen »

onewhonknocks wrote: post #46
neflabs wrote: post #37

Earlier quoted context omitted.

Matt, your response here is a very nice advertisement for Caddy, and a glimpse into your academic life, but you aren't addressing the very real privacy concerns of your users.

One can easily opt-out. What's the issue here?

The issue is that you SHOULD NOT HAVE TO OPT OUT.

Nobody forces you or them to spy on mankind, so stop it already.

Re: Put a Fork in Caddy; It's Done

#89

Post by rouzh »

josteink wrote: post #83
rrdharan wrote: post #81

Earlier quoted context omitted.

I'm not convinced. https://www.iubenda.com/blog/device-fingerprinting-and-cooki... My understanding is that anything that enables fingerprinting is potentially covered. [EDIT] So, here's a better link that specifically discusses fingerprinting and user agents in a post-GDPR world: https://www.connectedpath.com/all-posts/2018/3/3/gdpr-and-fi... My assumption was that the GDPR was attempting to be sufficiently broad su…

I think trying to frame something you give away to everyone, always, without anyone asking for it can legally be framed as privacy sensitive information. That would simply be absurd. The GDPR regulations largely represents common sense and decensy and this über-paranoid consideration about what “may” be covered or not is not really productive use of time. Example: if you explicitly email someone, according to the GDP…

> I think trying to frame something you give away to everyone, always, without anyone asking for it can legally be framed as privacy sensitive information. That would simply be absurd…The GDPR is not insane. Chill.

Isn't it? Just one particularly absurd example: logging IP addresses in your httpd's access logs can be considered a violation of GDPR. [1][2][3]

[1]: https://www.whitecase.com/publications/alert/court-confirms-...

[2]: https://www.gdpr360.com/gdpr-ip-addresses-and-classification...

[3]: https://www.smashingmagazine.com/2018/02/gdpr-for-web-develo...

Re: Put a Fork in Caddy; It's Done

#90

Post by rouzh »

neflabs wrote: post #41
AdmiralAsshat wrote: post #33

Linking to the Caddy dev's Mormon profile in the third sentence seems like a really sleazy low-blow.

We think his public statement, "Earning your trust is my most important interpersonal goal" is both relevant and good. We're not attacking his religion - we want Matt to stick to his publicly stated principles.

If it's just about the statement "Earning your trust is my most important interpersonal goal", why include the remainder of the comment? If it's not part of your commentary, why reference it all? You've already seen fit to elide most of the rest of the profile - your thinly-veiled attempts to publically shame him for his Christianity are as shameful as your verbal diarrhea while pontificating that the only IMAGINABLE reasons for collecting telemetry are because he's going to sell the data.

Collecting telemetry is a decades-old method of getting real data about the behaviour of a program in real-world environments. This is why web browsers, smartphones, and OSes all have telemetry collection routines.

Post reply on HN