361–370 of 656 posts
Earlier quoted context omitted.
Google cannot escape the US government agencies (CLOUD act) etc. It doesn't matter what the promise. They could sell their software stack to an independent European partner over whom they don't have any control and who doesn't transmit data back to the US.
If that was true, how does Google work within China?
Earlier quoted context omitted.
Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?
You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right? UK: https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)
Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.
If I host my website behind Google Cloud CDN they have logs of the visitors IP. If I host my site on S3 they log the IP.
Does this mean that a visitor must insteract only with services that I own until I can get concent to use "unnecessary" third party services?
I think it is pretty significant if "necessary" is reduced to "could have don't it without". Because sure I could avoid Google Fonts, but now I need to do splitting and per-browser detection myself. Ok sure, browser font support is pretty consistent these days and I know my site just uses English and emoji in some pages. But now I can't throw that site in cloud storage. I also can't use a VPS because there are traffic logs. So I buy a server in a datacenter. But what if they have some form of traffic logs? I guess my question is where does this definition of "unnecessary" stop.
Earlier quoted context omitted.
Google cannot escape the US government agencies (CLOUD act) etc. It doesn't matter what the promise. They could sell their software stack to an independent European partner over whom they don't have any control and who doesn't transmit data back to the US.
If that was true, how does Google work within China?
Earlier quoted context omitted.
What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?
Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.
I mean, IP address ranges are publicly known. If I now run a `for` loop over all IPv4 addresses and write them to my HDD, am I suddenly illegally storing personal data of all the people behind those IP addresses? Obviously no. An identifier by itself is not worth anything, unless it's connected to actual personal data.
EDIT: Never mind. GP's assumption that "there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?" does not seem to hold in my browser. So Google does not only receive the IP address but also the HTTP REFERER.
Earlier quoted context omitted.
Try making this argument with compiled code instead of HTML: "The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company." A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. T…
Yeah, I guess this stands. But HTML is not executable. It has to be parsed, like words in a book, not chemicals in a tube. Who is liable, the person who creates the poison, or the book (encyclopedia) which describes the process (and therefore the person who wrote it/distributes it)? Again, I'm not saying what is right and wrong, but I think this issue is fundamentally much, much more complex than the court may have t…
Earlier quoted context omitted.
I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.
Going further with this argument would all hacking also be ok?
Earlier quoted context omitted.
Try making this argument with compiled code instead of HTML: "The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company." A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. T…
Yeah, I guess this stands. But HTML is not executable. It has to be parsed, like words in a book, not chemicals in a tube. Who is liable, the person who creates the poison, or the book (encyclopedia) which describes the process (and therefore the person who wrote it/distributes it)? Again, I'm not saying what is right and wrong, but I think this issue is fundamentally much, much more complex than the court may have t…
I know as soon as you typed this, you probably thought "oh crap, what about Python?" so I won't go there.
I think the major underlying thing here that makes developers uncomfortable with this court ruling is that the whole industry of software development has a chronic and pervasive problem with the idea of consent. I'm not saying individual software engineers don't know what consent means, but we constantly put out software that does things without giving the user informed consent and control, and resist all efforts to force us to ask for this consent.
Imagine trying to use the Software Industry's idea of consent when dating: "Hey, Alice, do you want to go out on a date with me? I'll only accept the answers [Yes] or [Ask me again later]". Ridiculous! But software regularly does this! "Hey, Bob, I love you and I'm going to keep sending you text messages. Do you want [all my text messages] or [only essential text messages]?" Ridiculous, but look at the "consent" options when it comes to cookies.
Not to be crass, but when software wants to get users to do something, they need to treat it as if the software is trying to get laid: You need to ask for, and receive, informed consent at every step of the way, at every new and different request. This is an uncomfortable idea to developers who are used to just commanding the code to do things.
Earlier quoted context omitted.
> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.
I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be bloc…
Earlier quoted context omitted.
Try making this argument with compiled code instead of HTML: "The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company." A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. T…
Yeah, I guess this stands. But HTML is not executable. It has to be parsed, like words in a book, not chemicals in a tube. Who is liable, the person who creates the poison, or the book (encyclopedia) which describes the process (and therefore the person who wrote it/distributes it)? Again, I'm not saying what is right and wrong, but I think this issue is fundamentally much, much more complex than the court may have t…
Also by your logic machine code isn't executable either since it too has to be parsed (by the CPU which transforms it into microcode instructions).