Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

71–80 of 634 posts

Re: No Cookie for You

#71

Post by MaurizioPz »

owaislone wrote: post #50
shuckles wrote: post #42

Earlier quoted context omitted.

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.

part of the GDPR law is the intent of the information you are storing, not the method. Cookie is just a technology. If you track your users using a DB it still applies and you need consent if the tracking is not necessary

Re: No Cookie for You

#72

Post by baxtr »

dheera wrote: post #33
dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

I really wonder genuinely if the regulation has improved anything at all. I just click through the banners without even thinking. It has become so annoying. The value I get is below zero. I wonder if the majority is like me.

Re: No Cookie for You

#74

Post by beardbound »

smarx007 wrote: post #41
dheera wrote: post #33

Earlier quoted context omitted.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

I read that and it said that it applies to data not processed in the EU. I always interpreted that as applying to data centers and such in something like an was availability zone in the US. It said “ the monitoring of their behaviour as far as their behaviour takes place within the Union.” I never thought that applied to EU citizens all over the world. EU citizens living in another jurisdiction would be subject to that jurisdictions laws right? For instance GDPR wouldn’t apply to a Spanish expat that lives in Thailand, as far as I understand it.

Re: No Cookie for You

#75

Post by tannhaeuser »

notJim wrote: post #49

I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

By looking at http access logs, like since the beginning of times? Note if by modern sites you mean SPAs, you could still make HTTP pings for those features; might not make much sense to use SPAs for content-driven sites though.

Re: No Cookie for You

#76

Post by jarofgreen »

shuckles wrote: post #42
louhike wrote: post #38

Earlier quoted context omitted.

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

IANAL!!!! But I think, yes, there are still implications. GDPR makes no distinction about back end and front end AFAIK, it's just about what data you collect and why/purpose.

But note there are other reasons you can have for collecting data other than consent (something often overlooked) - for example I would guess GitHub would log IP addresses in the back end for a limited time for spam fighting reasons, and I think that would be fine.

Re: No Cookie for You

#77

Post by p410n3 »

sildur wrote: post #48
fluidcruft wrote: post #34

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

That would break the "remember me" feature for sure, unless you explicitly bookmark the site with the get parameter attached.

It also poses a security / opsec issue if anyone non-technical wants to send a link to a friend / co-worker. You may compromise yourself.

If people share their screen people would be able to hijack the session too.

You won't be able to distinguish device sessions from one another reliably neither. Think of "log out all other devices".

These are what I can think of. There's probably a handful more reasona NOT to do that.

Re: No Cookie for You

#78

Post by Spivak »

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

“And we would rather not have this crap but nobody pays for content are there only two types of ad networks: privacy preserving and paying so we’re stuck. Please call your congressperson to complain [here].”

Re: No Cookie for You

#79

Post by outside1234 »

smarx007 wrote: post #41
dheera wrote: post #33

Earlier quoted context omitted.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

They can't apply EU law to citizens residing outside of the union.

Re: No Cookie for You

#80

Post by distantsounds »

I literally proposed this solution in a previous HN thread, discussing the cookie situation. I'm glad a large business such as GH is able to take the _extremely_ painless route of just outright removing them entirely.
Post reply on HN