Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

451–460 of 634 posts

Re: No Cookie for You

#451

Post by kelnos »

rlpb wrote: post #387
BlueTemplar wrote: post #357

Earlier quoted context omitted.

I am pretty sure that they are still tracking you - but Microsoft can easily afford to do tracking in-house...

Doing "tracking in-house" does not exempt you from GDPR requirements. The requirement is exactly the same: explicit and freely given consent is required to collect extra private information not specifically necessary to provide the service requested.

What "private information", though? If GH is putting in a database the order of clicks that you made to navigate around their site, is that "private information"?

Re: No Cookie for You

#452

Post by mumblemumble »

irrational wrote: post #343
dessant wrote: post #316

Earlier quoted context omitted.

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of…

What is the real value in a privacy policy? I assumed they were similar to EULAs - totally unenforceable. Are there actually any legal repercussions if they lie in their privacy policy? Or is it just ill will that might be accrued (and probably quickly forgotten) if they are found out to have violated their own privacy policy?

It sounds like you have misunderstood the purpose of a privacy policy. It is very rare that I encounter one that is designed to protect the user's privacy. Far more often, it's there to protect the company. "I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy."

Re: No Cookie for You

#453

Post by gcblkjaidfj »

dessant wrote: post #316
heroprotagonist wrote: post #141

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that…

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of…

> Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated

This is true to every advertiser or data seller, Including obvious ones like Google, FB, Amazon... and less obvious ones like your ISP, Apple, etc.

The industry call it persistent ID (as opposed to cookie, which are transient ID): https://digiday.com/marketing/wtf-persistent-id/ (random result, i do not endorse it)

The trick is: the publisher/intermediary have even more information about you, but they call you User-A instead of your name, so they can sell your history, zip, DNA, etc... just pretend not labeling the data with your name or some other personal identifiable information already listed in a Law somewhere makes everything fine.

Re: No Cookie for You

#454

Post by fmntf »

jedberg wrote: post #232
dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Part of the problem is that when it first passed, the advice was to just add a cookie banner no matter what to be safe, since no one really understood the law and exactly when it did or did not apply.

You are right, and that unfortunately happened because nobody even tried to read the law (which is quite clear regarding this). It's easier to just follow other sheep.

Re: No Cookie for You

#455

Post by kybernetikos »

BlueTemplar wrote: post #372
asimops wrote: post #106

Earlier quoted context omitted.

To my understanding of the GDPR, as soon as you track any identifier that makes those data non-anonymous you still need consent for that. It is not about the cookies per se.

Would that mean that you need consent for storing IP addresses in logs?

It depends on what you use them for, but I think you would need it documented that you do it and why.

Re: No Cookie for You

#456

Post by ancarda »

amgutier wrote: post #389
swiley wrote: post #307

Earlier quoted context omitted.

I really hate the lies you see on a lot of new sites that they will send cookies "necessary for basic functionality." You're serving articles, there's no reason for session tracking!

I can see a need for cookies to mitigate against things like DDoS attacks, session management for paywalled content or just to leave comments on articles, favoriting certain sections. There are several reasons why as a reader you would want the site to be stateful.

How would cookies help mitigate against DDoS attacks?

Re: No Cookie for You

#457

Post by xnyan »

pantalaimon wrote: post #380

Teams has so many bugs and crashes, I'm flabbergasted how Microsoft can deliver something like that. Especially given that they have shown that they are capable of delivering a good experience based on the Electron platform with VSCode. My only explanation would be that it was cobbled together by interns, never meant for public release, then some project manager discovered it and said "Ship it!".

I think your comparison to VSCode is very useful, but with regards to crashing - I’ve not had Teams crash even once after a year of heavy use.

VSCode was made with the explicit intent of attracting software developers, who not always but generally get to use whatever editor they want. If VSCode was not snappy and responsive, it would never have been a viable product for its target market.

Chat is the other way around. Slack is on my computer and there’s nothing stopping me from using it, but every org I’ve been at has mandated official communication channels, and for me it’s teams. Chat platform decisions are not made by the same metrics that software developers use for editors. I’m not excusing it, but I don’t see how it could work another way. I would assume teams project managers are incentivized to deliver a list of features and integrations that are targeted squarely at the desires of mid to senior level enterprise IT execs.

Re: No Cookie for You

#458

Post by ryukafalz »

nullsense wrote: post #366
ljm wrote: post #321

Earlier quoted context omitted.

To be fair, most of them probably do. It's not like the introduction of GDPR in Europe 2 years ago suddenly made all of the shit a marketing dept shoves into Google Tag Manager completely legit and above board. These third parties will take what you give them and _also_ take what they can get from your browser if you're embedding their script. Are you going to proxy those scripts as well to stop them getting the user…

It really shits me that a lot of them you can't even deny it. They just have a button like "I understand". WTF is that...

Or they treat continuing to use the site as consent. Some of them are really passive-aggressive about it too. I've seen cookie banners with wording like "We use cookies, because duh, who doesn't in 2020? Click here or keep using the site to accept."

Completely at odds with the whole "informed consent" thing.

Re: No Cookie for You

#459

Post by [deleted] »

caminocorner wrote: post #119
smarx007 wrote: post #41

Earlier quoted context omitted.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

What about former EU residents? (such as the Brits; or foreign residents)

[deleted]

Re: No Cookie for You

#460

Post by zamadatix »

rapht wrote: post #291

The problem with cookie banners is not their intrusive ubiquity: it's that they keep going against the spirit of the law, which was to make any "non essential" (whatever that means) data collection opt-in. If that were functioning, whereby the two buttons presented to you were a "Continue without cookies" and "I want to opt in", the annoyance would be worth it. But as it stands, most sites just _pretend_ their tracki…

What I don't get is if the intent of the law was truly to make non-essential data collection "opt-in"... why even bother with all of this instead of just banning it properly? Was there really a concern from people that they wouldn't be able to opt into being tracked by 3rd parties they aren't engaged with?
Post reply on HN