Live data from Hacker News

No Cookie for You

github.blog

61–70 of 634 posts

Re: No Cookie for You

#61

That was an unexpected nice gesture. I wonder what they’re using to track user activity instead, probably just a mix of server logs and the other goings on of the backend.

Your user session. It can even be a cookie still, because that session cookie will be required for it to work.

Right, I meant to imply that the user session is used by “backend goings on”, and I understand that that is stored in a cookie still

Re: No Cookie for You

#62
post #48

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Would this mean that if you shared a URL with someone you would be sharing your session as well?

Re: No Cookie for You

#63
post #49

I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

I’m sure that GitHub certainly has analytics; they just don’t use third-party analytics. This means that either they’ve built their own tool or are self hosting someone else’s. I imagine that GitHub has some amount of internal tooling here out of necessity, e.g for metrics about how people use GitHub over SSH.

Re: No Cookie for You

#65
This is great. My experience is that many people claim to want analytics for their website but end up looking at it a couple of times and then never using it again. Meanwhile they're sponsoring and bolstering the position of internet tracking giants who - despite their claims - have no regard for user privacy.

Just sell your product instead of wasting time and money on bike shedding your website with whatever you believe is going to "skyrocket your sales".

Re: No Cookie for You

#66
post #33

Earlier quoted context omitted.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

Yes it apply to residents in the EU, but not EU citizens outside of the EU. Unless I misread the link.

Re: No Cookie for You

#67
post #58
post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Right but it still seems like this could violate the GDPR, right? They say: >>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services. But you’re still only allowed to use the cookies for the purpose the user gave you them for , right? So, if: a) the cookies are essential for the user session, and b) you collect the cookies, w…

Yes.

Re: No Cookie for You

#68
post #25
post #8

Earlier quoted context omitted.

And, in a way, this is the standard by the fact that they are not required to show the banner if no non-essential cookies are being used :)

Right, what I meant is that only using essential cookies should be the default web development practice. Instead the default these days seems to be websites that are positively larded with third-party scripts, analytics tools, and other crap.

It is standard development practice. But sometimes development is done in service of a business plan, in which case those requirements would apply.

Re: No Cookie for You

#69
post #33
post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

Except that if the sites don't do annoying things there is no need for annoying popups.

The EU law:

- doesn't require opt-in permission for essential cookies and similar. So basic non-personalized website usage statistics (analytics) do not need a opt-in only if it's tracking people in any way are such opt-ins needed

- if you login you are known to have accepted the terms of service and as such after login no opt-in pop-up is needed either

- is not limited to cookies btw.

All in all this means that for any site not based on ad-revenue they fully can get away without needing any annoying popups, if they don't do some sneaky questionable things.

Even for ad's there are ways to do them without annoying popups, you just need to not track people, tracking the number of times a website was loaded doesn't require annoying popups, just tracking who opened it does.

Similar if you track people only after they clicked on the ad you don't need annoying popups on the site the add is one but only on the site the app navigates to (through only start tracking after opt-in). Which given that many adds try to sell you stuff and buying thinks only requires a account isn't that big of a problem as it might seem.

In the end you can say the only reason there are so many annoying popups is because most companies have not intention to respect the privacy of their users. Actually if you look into it and realize that many popups are not legally conform or borderline illegal it becomes clear that they do not only not respect the users privacy but the users themself.

Through I have to note, that while many (most?) companies can switch to respectable advertisement, some companies can't as easily do so.

Re: No Cookie for You

#70
post #49

I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

It doesn’t mean no analytics, it’s about including third-party analytics scripts. You can still do analytics.
Post reply on HN