Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

111–120 of 634 posts

Re: No Cookie for You

#111

Post by coldpie »

louhike wrote: post #38
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

Or, don't do any tracking. I'm convinced that 99% of all analytics is discarded without ever being reviewed, analyzed, or acted upon.

Re: No Cookie for You

#112

Post by saghm »

sildur wrote: post #48
fluidcruft wrote: post #34

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

The website at my college we used to register for classes and some other stuff used this method. For whatever reason though, the logic was wonky, and the site would give an error if you used the "back" button in the browser, and you'd have to go back to the home page.

Re: No Cookie for You

#113

Post by dathinab »

beardbound wrote: post #74
smarx007 wrote: post #41

Earlier quoted context omitted.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

I read that and it said that it applies to data not processed in the EU. I always interpreted that as applying to data centers and such in something like an was availability zone in the US. It said “ the monitoring of their behaviour as far as their behaviour takes place within the Union.” I never thought that applied to EU citizens all over the world. EU citizens living in another jurisdiction would be subject to th…

Yes, but if you reside in Spain and use a VPN with Thai exit node to access a site in Thailand you are stil residing in the EU and in turn the Thai website needs to comply with GDPR.

Through non compliance can only be enforced if the entity behind the website/app or similar does enter the EU or does business with the EU.

Re: No Cookie for You

#114

Post by marvinblum »

tuna-piano wrote: post #54
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?

Probably like we do it for pirsch.io, by calculating a hashed fingerprint and throwing away the individual page hits once per day: https://github.com/pirsch-analytics/pirsch

Re: No Cookie for You

#115

Post by scrollaway »

coldpie wrote: post #111
louhike wrote: post #38

Earlier quoted context omitted.

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

Or, don't do any tracking. I'm convinced that 99% of all analytics is discarded without ever being reviewed, analyzed, or acted upon.

Much like logging though, it's the 1 percent that isn't discarded that's important.

I agree with you by the way, but ...

Re: No Cookie for You

#117

Post by ronjouch »

ddevault wrote: post #21

Nat's right: this IS a no brainer. SourceHut hasn't had any non-essential cookies since day one. If you're reading this, Nat - how about removing third-party resources entirely from your pages next?

Why, and which third-party resources are you referring to? Looking at uBlock Origin in a GitHub PR page now, I see the following domains:

- github.com

- githubusercontent.com, DNS pointing at github.map.fastly.net

- githubapp.com

- githubassets.com

All these are GitHub-owned, so from a privacy / customer relationship standpoint it looks fine (except github.map.fastly.net , which is probably for CDN purposes), isn't it? I mean: there is zero googleanalytics / zendesk / tracking saas nonsense here. Or are you making this point from a performance standpoint?

By the way, I haven't used SourceHut yet, but thanks a lot for your opensource work.

Re: No Cookie for You

#118

Post by baxtr »

munchbunny wrote: post #99
baxtr wrote: post #72

Earlier quoted context omitted.

I really wonder genuinely if the regulation has improved anything at all. I just click through the banners without even thinking. It has become so annoying. The value I get is below zero. I wonder if the majority is like me.

I take the time to check what I'm agreeing to. By law it's default opt out for non-essential usages specifically to deal with people who are annoyed, but not everyone plays by the rules.

Yeah, maybe. But not by clever design. The opt-out boxes are usually designed as secondary buttons. The opt-in is designed as primary button. So if you want to change something you have to really think and make a deliberate choice, whereas most people in that moment just want to see the damn content of the site.

Re: No Cookie for You

#119

Post by caminocorner »

smarx007 wrote: post #41
dheera wrote: post #33

Earlier quoted context omitted.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

What about former EU residents? (such as the Brits; or foreign residents)

Re: No Cookie for You

#120

Post by munchbunny »

austinl wrote: post #19

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

There isn't an obvious bright line, and that's probably intentional.

This is not legal language or legal advice, but the gist of it is "if you don't have it, can your website still do what it claims to do?"

For a site like Github, if you can't use cookies to maintain session state, you'd have trouble implementing login sessions, so that's pretty squarely on the essential side of the fence.

But moving into murkier territory, how about logging the IP addresses you signed in from? If you're using it to detect new login locations or new devices as a security alerting thing, then I think you can make a strong enough claim that this is essential. (Again, not a lawyer, this is not legal advice.)

What if a PM wants to look in these logs for how many unique users show up in each country? That's pretty squarely on the side of analytics, and is probably not essential.

But... muddying the waters more, what about if an engineer wants to query unique users to figure out how many more racks of servers to buy? I have no idea. I'd be asking a lawyer.

Post reply on HN