Nat's right: this IS a no brainer. SourceHut hasn't had any non-essential cookies since day one. If you're reading this, Nat - how about removing third-party resources entirely from your pages next?
No Cookie for You
21–30 of 634 posts
Re: No Cookie for You
#22Great move! Now that some big sites like Github curb their use of invasive third-party analytics I hope more will follow suit. For Github it's probably easy to do this as they can extract a lot of insights from the actions their users perform on the site that are visible in their backend, so they probably don't need event-based analytics so much.
Re: No Cookie for You
#23So, they do analytics looking only at the database data? I wonder if they built the analytics system themselves or are using a COTS.
You can still do analytics client side without the use of cookies. You just lack the view of a user and a session sice the cookie holds the primary key used to tie events into a session. You are basically just dispatching page views and events. Your reports will not look great but it's possible and probably will be a nice complement to a server side analytics solution.
Re: No Cookie for You
#24A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.
True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either.
Just don't include facebook like buttons or any of these widgets
Re: No Cookie for You
#25This should be the standard.
And, in a way, this is the standard by the fact that they are not required to show the banner if no non-essential cookies are being used :)
Right, what I meant is that only using essential cookies should be the default web development practice. Instead the default these days seems to be websites that are positively larded with third-party scripts, analytics tools, and other crap.
Re: No Cookie for You
#26I just block cookie banners with a combination of custom JS/CSS and uBlock Origin. I hate those abominations.
Ironically, these sites need to use additional cookies to remember that you clicked away the banner, and part of the problem is I also blanket block all cookies on sites that I don't need to log into, so they don't get to "remember" anything.
Re: No Cookie for You
#27Logging into Github lands me 10 cookies (5 of which have a 365 day expiry), and a row in local storage - are these all 'essential'?
Re: No Cookie for You
#28Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.
I can guarantee that you could throw a rock in your city’s business district and hit a lawyer that is in the process of doing incredible mental acrobatics to wrangle Google Analytics to be an “essential part of the offering”.
Re: No Cookie for You
#29Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.
There is no bright line, mostly as far as I can tell it’s session cookies and those you need to set to fulfill your contracts with the user.
Re: No Cookie for You
#30If they've gotten rid of 3rd party analytics, does this mean they're just using their own? Presumably session cookies count as "required", and could be used to track your actions at least on github.com.
Sure, but considering GitHub doesn't have advertising[1], and they're not sending it to a third party (like Google, who does), it's very hard to imagine any use for first party "tracking" that might harm you. Presumably the most they're using this for is recommending potentially interesting repos to you. [1] Potential concern would be if "Microsoft" was considered "their own", since Bing does have an ad network. But…
Remember that they have LinkedIn as well, and quite possibly could put together a fascinating view of software job profiles, candidates, and repo language/activity to gain value entirely within their own organization. Something like LinkedIn recruitment recommendations improved with GitHub contribution activity might be a fascinating recruitment product: ads are not the only way to gain value.