Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

271–280 of 634 posts

Re: No Cookie for You

#271

Post by asimops »

privacylawthrow wrote: post #255

Much of the statements about cookie requirements in this thread are wrong. The rule is simple: If a website uses non-essential cookies, it must inform users and, in most EU jursidctions, collect consent prior to placing a cookie on the user's machine. The rationale behind the rule is that companies should not store company information on end-user devices without the user's consent. The rule applies to all non-essenti…

In fact, a trade-off has to happen. A cookie - or in terms of the GDPR, storing data on the end device - does not necessarily have to be technically required for it to be stored without consensus. A shopping cart, for example, can technically be coded as a GET parameter in the URL. However, since a cookie is the technically more sensible way to persist the shopping cart, a cookie can be used. This only needs to be explained - ideally in simple language - in the data processing statement.

Re: No Cookie for You

#272

Post by drzaiusapelord »

Animats wrote: post #224
thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

My favorite of the week: Doordash. Doordash does not use two-factor authentication, except for one thing: opting out of having your data sold. For that, it sends an SMS message to your phone. Since I signed up for them using a landline, the SMS message is lost.

Its a shame the EU became laser focused on cookies, which can be managed technically by browser settings, and not on dark patterns like these. Or how US consumers complain about being able to subscribe to a service via the web but must call a customer service person to cancel, often with a lengthy wait, dropped calls, and being transferred to a sometimes rude 'retention specialist.'

There's so much more pressing than just cookies imo.

Re: No Cookie for You

#273

Post by rndgermandude »

outside1234 wrote: post #79
smarx007 wrote: post #41

Earlier quoted context omitted.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

They can't apply EU law to citizens residing outside of the union.

Sure they can, at least in theory. US citizens have to pay taxes no matter where they reside. Most countries will prosecute certain crimes abroad if those crimes were committed by their citizens or against their citizens or against the state.

The practical question is just if they can get hold of the people acting unlawfully.

Re: No Cookie for You

#274

Post by gowld »

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

Why does that matter? If the advertisers delivered cookied via the main site server, would that change your experience?

Re: No Cookie for You

#276

Post by Dirlewanger »

firloop wrote: post #63
notJim wrote: post #49

I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

I’m sure that GitHub certainly has analytics; they just don’t use third-party analytics. This means that either they’ve built their own tool or are self hosting someone else’s. I imagine that GitHub has some amount of internal tooling here out of necessity, e.g for metrics about how people use GitHub over SSH.

Or they just send the data to the 3rd parties on the back-end.

Re: No Cookie for You

#277

Post by lqet »

sildur wrote: post #48
fluidcruft wrote: post #34

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Those were great. I hung around a forum around 2004 where someone posted a link to jeans he just bought from a smallish online store - the URL contained the PHP session identifier. Thousands of people had instant access to his address + bank information + purchase history, and could place orders for him.

Re: No Cookie for You

#278

Post by alexchamberlain »

Wowfunhappy wrote: post #147
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…

I thought that tracking cookies needed permissions regardless of whether they were first party or 3rd party?

Re: No Cookie for You

#279

Post by Vinnl »

Seems like a good way to differentiate themselves from GitLab: while GitLab is open source whereas GitHub likely will never be, GitLab.com contains many third-party trackers and GitHub now none.

Re: No Cookie for You

#280

Post by spinningslate »

dessant wrote: post #217

Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data. The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com. The privacy policy page which lists third part…

Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A.

But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwise - then the score is down to D-. The intent of EU cookie regulation is to make tracking and data collection transparent and opt in. Changing the implementation to server side might comply with the letter of the law but it violates the spirit.

It would be good if GitHub would clarify their position.

Post reply on HN