Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

421–430 of 634 posts

Re: No Cookie for You

#421

Post by belltaco »

pantalaimon wrote: post #380

Teams has so many bugs and crashes, I'm flabbergasted how Microsoft can deliver something like that. Especially given that they have shown that they are capable of delivering a good experience based on the Electron platform with VSCode. My only explanation would be that it was cobbled together by interns, never meant for public release, then some project manager discovered it and said "Ship it!".

Are you using it on OS X? Runs fine on Windows for me and haven't heard any complaints from any of my coworkers. Everyone says it's better than WebEx.

Re: No Cookie for You

#422

Post by harha »

mrtksn wrote: post #324

Somehow the rest of the internet was sold to the idea of "EU is forcing you to put cookie banners, these are nothing but annoyance" rhetoric. Whoever pulled that off, bravo! In reality, the idea was to make people aware that they are being tracked across the web and and give them options and somehow everyone pretended that "No tracking, no banners" is not an option. I am so glad that GitHub is coming forward and poin…

Meanwhile more and more websites are adding “legitimate interest” controls to ads and analytics, as a way to keep them activated. It’s so absurd from a user perspective, they even have separate controls for normal and legitimate interest ads.

I wouldn’t be surprised if the sales teams at Google, criteo etc told them to do so off the record.

Every time I see the banner I think is it really necessary to visit the website? So I’m also quite happy about this move by GitHub.

Re: No Cookie for You

#423

Post by BlueTemplar »

rlpb wrote: post #404
chubs wrote: post #393

Earlier quoted context omitted.

In this case, is github uncompliant now? They say they're not doing third-party tracking but the blog post seems to hint that they're doing their own tracking.

That depends on what personal data they're collecting and for what purpose, in the case that a person hasn't explicitly opted-in by giving consent freely. I don't think it's possible for us to figure those details out exhaustively merely by observation from the outside.

Yes, and it's not like the EU is going to send surprise inspections to go dig into Microsoft's code and databases to check whether they are violating this or not?

Re: No Cookie for You

#424

Post by BlueTemplar »

mrtksn wrote: post #382
BlueTemplar wrote: post #357

Earlier quoted context omitted.

I am pretty sure that they are still tracking you - but Microsoft can easily afford to do tracking in-house...

What do you mean by in house tracking?

Across Microsoft services like Github, Office365, Bing, LinkedIn, Windows...

Re: No Cookie for You

#426

Post by alkonaut »

rapht wrote: post #291

The problem with cookie banners is not their intrusive ubiquity: it's that they keep going against the spirit of the law, which was to make any "non essential" (whatever that means) data collection opt-in. If that were functioning, whereby the two buttons presented to you were a "Continue without cookies" and "I want to opt in", the annoyance would be worth it. But as it stands, most sites just _pretend_ their tracki…

It would indeed be glorious to see regulators pick 10 of the largest sites with the “Agree and continue” vs “let me uncheck 100 checkboxes” consent, and simply fine them a sum that is large enough to make all sites on the planet decide that it’s better to comply immediately than be in the next round of fines.

Right now I think a lot of sites are thinking “If we don’t use these tracking ads we aren’t going to be able to keep the lights on, so it’s better to use that pretend compliance banner everyone else is using, than to have to close”. And that’s the problem. The regulation should make bankruptcy or a massive risky change of business Model look attractive and low risk compared to “agree and continue”. Otherwise why would shady sites not try to do exactly what they are doing.

Tracking ads are unfair competition. It’s like a business not paying their taxes. The reason you can’t start a site paid by non-tracking ads, is that the competitor uses tracking ads.

When tracking ads aren’t an option, the money in “good” advertising goes up. (Or, all the money is concentrated to Apple and Facebook, the bad scenario).

Re: No Cookie for You

#427

Post by ghusbands »

nlh wrote: post #342
kayson wrote: post #9

If they've gotten rid of 3rd party analytics, does this mean they're just using their own? Presumably session cookies count as "required", and could be used to track your actions at least on github.com.

I presume this is indeed what they're doing given the wording of the post: "(And of course GitHub still does not use any cookies to display ads, or track you across other sites.)" That exactly leaves out "track you on our own site". But honestly, I have absolutely zero issue with them tracking my behavior on their own site. I know how valuable it is to be able to learn/see what users are doing, and they should absolu…

Tracking individual behaviour on their own site without notification is still illegal under the GDPR, so no, they should not absolutely be able to do that.

Re: No Cookie for You

#428

Post by wpietri »

mattlondon wrote: post #351
jedberg wrote: post #311

Earlier quoted context omitted.

To an extent, but there are easy ways to cut the search space. For example, you could make a unique request with garbage on it from a known IP every day, and then all you have to do is build a rainbow table for that one IP to find out what the salt is for each day, and then you can fully reconstruct the logs.

If the salt is a random 64bit number (for example) then "finding out" the salt is not trivial.

And unless I'm missing something, it seems easy to add plenty of bits to the salt until it's no longer practical to reverse.

Re: No Cookie for You

#429

Post by etaioinshrdlu »

Here's a cookie set in my browser from github in a fresh browser: Cookie:

_gh_sess=eAAHHEQEjZlQKwq8kaSMpTeHC7tyMGwhVexbpZMVfDbjWCf764z4UMG7S%2FeLZpE0ML5y8%2FnmSEd2ZhiDLBHlZyA08Dj8cGob%2BGXSbGSjztMyc5pdd8uxj8qgxc78SHYw01E6pnOnWHRo7XoeTjKje%2FktOx5wObpjZj8JhfOnngdIlhfxSc1EctIth6RDFIsr2HPw9pbDczMfDwwKuswMrkMIt1JEOglF2L%2BxAdscMjeuXu2zFei58AR%2FwRQ%2FGgY3RbQigWt2w%2BKHDIY7a6pISw%3D%3D--H9M6LNV7YPDc1Dvm--vbgFN9CpCkCxTdfhdlvJkg%3D%3D; _octo=GH1.1.770191202.1608243985; logged_in=no; tz=America%2FLos_Angeles

This could easily be used for tracking on the backend... It would be better to not store a large opaque string.

Post reply on HN