161–170 of 217 posts
Earlier quoted context omitted.
Is this even GDPR-compliant?
> Rather than count unique IP addresses (requiring storing state about each visitor), we simply count page views that originate from a distinct referral or navigation event, avoiding the need to store information that might be considered personal data. They don't store IP addresses (but other referral ids that identify users in a different way) ; and they exclude EU visitors by default. You do your opinion
GDPR is applicable on EU citizens, disregarding where they browse from. So either they have to track whether you're an EU citizen/EU visitor or they track EU visitors when browsing from outside of EU. This makes it not GDPR compliant.
The main issue is that your privacy policy is most likely not mentioning this third-party tracking because you were not even aware of it. Who is going to be responsible? Who is going to be fined for not mentioning this tracking in _your_ privacy policy? You. (Your company)
Earlier quoted context omitted.
Wow, this is ridiculous. Sites that have been running on Cloudflare for a decade+ silently got the treatment. Why the hell was there never a big banner telling me about this? I frequently log into the console. I get it that by being on the free plan (well I do pay for Registrar), I'm the product, but I also converted employers to paying customers of yours based on goodwill. This just destroyed about all of that, amon…
You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.
Earlier quoted context omitted.
You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.
> they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.
Earlier quoted context omitted.
An “orange cloud” with no other indication to represent a feature that is enabled-by-default (with implicitly enabled analytics) sounds like quite the dark pattern. The UI makes the DNS record seem to point to A (your entry) but actually points to B (Cloudflare). This isn’t an oversight, it’s an attempt to obfuscate. Even if the choice to enable it by default makes sense for Cloudflare’s userbase, the implications ar…
It's essentially the entire reason to use Cloudflare. As sibling mentions it is indeed labeled and not just some icon. People just refer to the orange cloud UI for it for convenience and because it makes it easy to spot whether you have it on or not. But regarding the icon, the icon is their company logo, it really is the primary feature. It's also not like you have to go find it in settings to turn it off after addi…
The "reason" to use cloudflare is hype.
Earlier quoted context omitted.
You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.
> they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.
This is unacceptable
Why do people care? This is hardly anything malicious.
One day the delivery service starts adding free sausages to every delivery on an opt-out basis.
By the time you realize, they'll already have delivered adulterated meals. You won't have a lot of customers left!
People are often vegetarian for ethical reasons. In a similar way, many people have Ethical Opinions (tm) about Analytics as well. They don't like it when other people collect private information about themselves, and refuse to Do Unto Others.
But even if you're fine with analytics in general: When intermediaries and other transitive dependencies (like software libraries) start injecting analytics on an opt-out basis, you simply can't control what's going on. And that's before we talk about the ethics and legality of third parties modifying content in-flight.
In the EU, the law actually codifies the ethics at play here (GDPR). Several people point out that cloudflare disables this 'feature' for the EU. This makes a lot of sense, because it would have been a huge mess for everyone impacted to have to go to their customers with a "sorry, we leaked your PII, here's how we'll make you whole"; as well as possibly lawsuits against cloudflare to recover those damages upstream.
Earlier quoted context omitted.
GDPR very much applies. As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR. Sibling comment says data collection is disabled in EU.
Cool, so you went from > Cloudflare needs the data. [...] If someone is mad, maybe they should pay or use a different architecture. To "they would violate GDPR". Are you ok with that behavior then? And are you basing your ethical decision solely on the current legislation?
When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their solutions to my websites.
Earlier quoted context omitted.
This is a tangent, but your setup sounds interesting to me — would you share more about how to configure such for myself?
Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_ But this is what Cloudflare does and no one seems to mind Large companies also do this to protect their LANs I'm not running a CDN, only a small home LAN. I'm only procesing…
I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs
I process response bodies, using own software, into SQL, CSV, simple HTML or plain text
I'm not using a graphical web browser to make HTTP requests
This design isn't for everybody, but it's what I strongly prefer
As such, in the way I use it, for the majority of HTTP traffic, no speed is sacrificed
There are a variety of proxies that can be used to forward traffic. I use only a small selection. The largest one I use is haproxy, the smallest one I use is tinyproxy. Personal preference will vary
The local DNS setup is just habit. I have been using djbdns and a custom root.zone for a very long time, before "privacy" was the issue it is today, and I have own particular prefetences. Every user is different. Using a firewall to send traffic to the proxy is an alternative
The motivation for me was always experimentation, learning and control, not "privacy"
"Privacy" is something one could aim for, if one has _control_. But IMHO without control, "privacy" is nothing more than marketing
Earlier quoted context omitted.
If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?
Just guessing. * Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me * Paid customers are usually business that have different needs, on average, than free customers
Only if they make it clear what they’re taking in return.
It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.