No Cookie for You • Hacker News Board

Re: No Cookie for You

#321

Post by ljm » Thu, Dec 17, 2020, 7:53 PM UTC

ghego1 wrote: post #308

oauea wrote: post #258

Earlier quoted context omitted.

> not self hosted you'll need a cookie banner then

Not necessarily. Only if personal data is collected by the third party.

To be fair, most of them probably do. It's not like the introduction of GDPR in Europe 2 years ago suddenly made all of the shit a marketing dept shoves into Google Tag Manager completely legit and above board.

These third parties will take what you give them and _also_ take what they can get from your browser if you're embedding their script. Are you going to proxy those scripts as well to stop them getting the user's IP address and then geolocating it to grab even more info?

The cookie warning banner is bullshit only in the sense that it achieves nothing. Accept it or deny it, it won't change a thing. Same with the tracking consent popups: despite the law saying they should be opt-in by default, they're still treated as opt-out by default, meaning that all of these sites _still_ collect your data because you're blacklisting individual sites from tracking, as opposed to whitelisting them. You need to set a cookie to say that you don't want tracking and not thousands of cookies to say you do want it?

That's being tracked... it's all wrong. Literally everything you offer as information, or don't offer, is another node in their graph.

Re: No Cookie for You

#322

Post by belval » Thu, Dec 17, 2020, 7:53 PM UTC

einpoklum wrote: post #300

buckmar wrote: post #233

Earlier quoted context omitted.

That's a good point. Microsoft has been much less heavy handed than I expected. But your point about how the data is used, I am very curious too. I wonder if they'd be willing to make the privacy policy readable?..

Microsoft would like for you to adopt an image of GitHub as an upright corporate endeavor - but remember they blocks/censor developers from world states that the US doesn't like.

Microsoft/GitHub as businesses incorporated in the United States are bound by the law of the United States. I am not sure of what you are insinuating here.

Re: No Cookie for You

#323

Post by Bakary » Thu, Dec 17, 2020, 7:55 PM UTC

robgibbons wrote: post #254

Bakary wrote: post #180

Earlier quoted context omitted.

That's like blaming the flashlight for revealing rats under the kitchen sink

I'm not blaming the popups. I'm lamenting the fact that every damn site opens with a pop-up now. They are the negative consequence of an otherwise well-meaning bill. As good as GDPR was for privacy, it's equally bad for UX.

The bill is well meaning precisely because it exposes a systemic problem not just with UX but with a ton of other aspects of the web. It's a bit like having your kitchen smeared in rat shit. There is a moment of annoyance when you realize that, but it's the first step towards being able to clean it up. It's not so much negative consequences as a problem that was there to begin with whether we noticed it or not. It's subjectively negative in the moment, but to ignore it would have been far more of a problem.

Re: No Cookie for You

#324

Post by mrtksn » Thu, Dec 17, 2020, 7:56 PM UTC

Somehow the rest of the internet was sold to the idea of "EU is forcing you to put cookie banners, these are nothing but annoyance" rhetoric. Whoever pulled that off, bravo!

In reality, the idea was to make people aware that they are being tracked across the web and and give them options and somehow everyone pretended that "No tracking, no banners" is not an option.

I am so glad that GitHub is coming forward and point out the elephant in the room: You don't need cookie banners or tracking consent forms if there's nothing to consent.

Re: No Cookie for You

#325

Post by jlokier » Thu, Dec 17, 2020, 7:58 PM UTC

type0 wrote: post #305

jeanjogr wrote: post #299

Earlier quoted context omitted.

I typed "cnil fines" (the CNIL being the French data watchdog) on google which led me to their sanction page [0] which features 100M€ fines to Google and 35M€ to Amazon _last week_. It is surely not much in the grand scheme of thing but surely this is more than a mere Potemkin village. [0] https://www.cnil.fr/fr/tag/sanctions

good that at least in one country they do something, but everywhere else it's wild wild web and the bandits are not threatened.

In the UK, BA was fined £20M recently, although that was for egregiously failing to protect customer data.

Re: No Cookie for You

#326

Post by bcrosby95 » Thu, Dec 17, 2020, 8:00 PM UTC

spinningslate wrote: post #280

dessant wrote: post #217

Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data. The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com. The privacy policy page which lists third part…

Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…

Isn't using the data for product improvement still tracking? I don't personally care, but I'm not sure if the GDPR does.

Re: No Cookie for You

#327

Post by swyx » Thu, Dec 17, 2020, 8:03 PM UTC

firloop wrote: post #16

I'm an American that's currently in Europe, and I recently downloaded a mobile ad-blocker for the purpose of blocking cookie popups. I was already blocking most tracking at the DNS level, so this was mostly for cosmetic purposes. Blocking consent banners has made browsing the mobile web so much more pleasant.

was this mobile adblocker on android or can you also get it for iOS? am interested.

Re: No Cookie for You

#328

Post by an_opabinia » Thu, Dec 17, 2020, 8:04 PM UTC

heroprotagonist wrote: post #141

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that…

If you don’t have to actually make money though, there isn’t really a point to the analytics third parties enable - eliminating bots and click fraud. Microsoft managers are incentivized to not identify bot or noise traffic, since their performance metrics do not separate those.

Re: No Cookie for You

#329

Post by SilasX » Thu, Dec 17, 2020, 8:05 PM UTC

munchbunny wrote: post #292

SilasX wrote: post #210

Earlier quoted context omitted.

Whether they complied in other ways is irrelevant to whether this case is non-compliant, and the point was about reuse of cookies for analytics, not marketing.

I don’t understand your point. You’re asking whether they’re trying to work a loophole or a clever hack, and I said that I don’t think they are and that I think it’s credible because they don’t have profit motives that would drive them to take that legal risk.

You don't think they do analytics on users based on these cookies session? Because doing that without the consent pop-up is (I claim above) illegal, and so the clever workaround fails.

I would be really, really surprised if Github were the only Bay Area unicorn that lacked a product manager nagging them for more analytics. The fact that they don't need to sell the analytics is irrelevant.

Re: No Cookie for You

#330

Post by slowwriter » Thu, Dec 17, 2020, 8:08 PM UTC

madjam002 wrote: post #319

geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

IANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This…

My understanding is that this kind of active consent that we see as popups everywhere on the web nowadays applies to cookies only. So I would assume that if you can track user activity without a cookie you wouldn't need it. It should probably be stated in the privacy policy though.

I'm not an expert in this even though I'm a webdev from the EU, so I'm also interested in other people's input.