Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

621–630 of 634 posts

Re: No Cookie for You

#621

Post by pstch »

niutech wrote: post #617
Yaggo wrote: post #586

Earlier quoted context omitted.

Sure, there exists an extension for pretty much everything, but it's not an ideal situation that you need to install an extension for stuff like this. Also, having too many extensions slows down the browser (because they need to parse/manipulate DOM) and extensions themselves are also a security/privacy risk and finding the good ones for every browser can be tedious. Besides, my mom has no idea what's "a browser exte…

So tell her what it is :) Most people just need one extension: uBlock Origin (or built-in Opera/Brave adblock) with a filter list from prebake.eu. No more ads and cookie banners. Easy as that.

I'm using this setup, and I still get cookie/ToS banners all the time, especially using Google (I think I'm accepting their new terms of service 4/5 times each day).

Re: No Cookie for You

#622

Post by niutech »

pstch wrote: post #621
niutech wrote: post #617

Earlier quoted context omitted.

So tell her what it is :) Most people just need one extension: uBlock Origin (or built-in Opera/Brave adblock) with a filter list from prebake.eu. No more ads and cookie banners. Easy as that.

I'm using this setup, and I still get cookie/ToS banners all the time, especially using Google (I think I'm accepting their new terms of service 4/5 times each day).

Just add these filters to uBlock Origin:

    www.google.com###lb
    www.google.com##html:style(overflow-y: visible !important;)

Re: No Cookie for You

#623

Post by iliasbartolini »

natfriedman wrote: post #527
spinningslate wrote: post #280

Earlier quoted context omitted.

Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…

This is all detailed in our updated privacy policy: https://github.com/github/site-policy/pull/336

Hi natfriedman, thanks for the transparency.

Removing Google Analytics is a good thing, thanks for that. I also appreciate that you use DoNotTrack to give users a choice (even if this is not available on Safari any more).

As it is explained the privacy policy. Basically you now use the same cookie "_octo" both for session management and first part tracking: https://github.com/github/site-policy/pull/336/files#diff-8b...

EU guidelines require that you offer granularity of choice for different “processing purposes”. See in this "Guidelines on consent under Regulation 2016/679" https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

In section "3.1.3 Granularity" paragraph #44. "If the controller has conflated several purposes for processing and has not attempted to seek separate consent for each purpose, there is a lack of freedom. [...] When data processing is done in pursuit of several purposes, the solution to comply with the conditions for valid consent lies in granularity, i.e. the separation of these purposes and obtaining consent for each purpose"

You grouped cookies together and removed granularity of choice. I think this is against the spirit of the regulation.

Overall I think the the change is positive, but grouping cookies to avoid a banner is still against the regulation.

Re: No Cookie for You

#624

Post by oauea »

Wowfunhappy wrote: post #595
M2Ys4U wrote: post #566

Earlier quoted context omitted.

You need to notify users, and give them an opt-out, if the cookies are not strictly necessary for the provision of the service. Analytics cookies are not strictly necessary.

All I want to see are pageviews. That shouldn’t require cookies/fingerprints.

It shouldn't, but nowadays it always does.

Alternatively your pagecount will shoot to the millions if you have someone holding f5.

Re: No Cookie for You

#625

Post by manigandham »

merijnv wrote: post #591
manigandham wrote: post #544

Earlier quoted context omitted.

GDPR has lots of issues and this is one of the major ones. It can be easily argued that companies cannot be forced to service users and there has been no real precedent or enforcement around this.

You aren't forced to service users. You just cannot make consent the currency for your service. Either don't require consent or don't operate in the EU.

> "don't require consent "

That's meaningless. Usage is already a form of consent. The discrepancy is between the user and the company in what is consented. Forcing the company to provide service to the user even if the user disagrees with an upfront description of what the company requires to provide that service is a completely valid objection.

Also GDPR applies to any organization providing to citizens of the EU, not companies operating there, but that's yet another example of poor design which results in GDPR having little enforcement.

Re: No Cookie for You

#626

Post by manigandham »

FeepingCreature wrote: post #581
manigandham wrote: post #544

Earlier quoted context omitted.

GDPR has lots of issues and this is one of the major ones. It can be easily argued that companies cannot be forced to service users and there has been no real precedent or enforcement around this.

A company cannot be forced to service users. It can also decide to stop operating entirely, and die. A company can be forced to not use particular criteria to decide to service specific users, an idea with a long history - a common example is skin color.

This has nothing to do with immutable physical characteristics and such comparisons only highlight how silly the argument is.

Consent is a voluntary action. Usage itself is a form of consent. However a user disagreeing with what the company requires to provide that service but still being entitled to and actively using that service is not workable. User can decide to stop using a service entirely though, if they don't agree with the requirements.

Re: No Cookie for You

#628

Post by [deleted] »

BlueTemplar wrote: post #540
kelnos wrote: post #451

Earlier quoted context omitted.

What "private information", though? If GH is putting in a database the order of clicks that you made to navigate around their site, is that "private information"?

If there's an identifier that can be tied to you (like an IP address), then yes?

[deleted]

Re: No Cookie for You

#629

Post by p410n3 »

privacylawthrow wrote: post #244
p410n3 wrote: post #200

Earlier quoted context omitted.

Finally someone who knows this! Even (some) "SEO advice" blogs have suggested to just use local storage instead of cookies. Just no. Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique's, technologies or anything like that. A good example is gdpr article 32. Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and…

>Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and technically you don't need cookie banners how they are now. Purely informational banners would be enough, but the directive already _should_ have passed but was delayed, and since gdpr spooked everyone, everything and everyone is using cookie banners now anyway The ePrivacy Directive passed in 2002. It was amended in 200…

My bad. Thanks!

Re: No Cookie for You

#630

Post by p410n3 »

M2Ys4U wrote: post #582
p410n3 wrote: post #200

Earlier quoted context omitted.

Finally someone who knows this! Even (some) "SEO advice" blogs have suggested to just use local storage instead of cookies. Just no. Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique's, technologies or anything like that. A good example is gdpr article 32. Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and…

You're confusing the upcoming ePrivacy regulation with the existing ePrivacy directive - one that's been in force for 18 years. Just like people thought that the data protection was a new concept when the GDPR was created, ignoring the fact that the Data Protection Directive had been around for decades.

My bad. Thanks!
Post reply on HN