@codinghorror @lispi314 @leymoo They may be well-intentioned* but they're not well-designed or doing everything right. They're tracking visitors without their consent.
* Normally I would not even call this well-intentioned, but as I said upthread, the fact that every web framework *automatically sets session cookies assuming you want to break the law and track users* even when the user has not indicated that they want to do something like log in or store a shopping cart, means a lot of people *don't even know they're doing it*. But this doesn't excuse it; it just makes them "well-intentioned".
Look, EU, it is difficult to take you seriously when you forced all this cookie notification bullshit on us. That feature a) should not exist and b) if it did, should be a BROWSER feature not "every website in the entire world now has to bother everyone forever about this stupid thing" blog.codinghorror.com/breaking…
Breaking the Web’s Cookie Jar
The Firefox add-in Firesheep caused quite an uproar a few weeks ago, and justifiably so. Here’s how it works: * Connect to a public, unencrypted WiFi network.Jeff Atwood (Coding Horror)
Questa voce è stata modificata (1 settimana fa)
Cassandrich
in reply to Jeff Atwood • • •like this
Klaus Weidenbach e Anban Govender like this.
reshared this
daniel:// stenberg://, Lars Wirzenius, Andrej Shadura, gregor herrmann e Anban Govender reshared this.
Jeff Atwood
in reply to Cassandrich • • •Enno T. Boland
in reply to Jeff Atwood • • •German here: the gist of GDPR is: people must know when someone collects personal data.
You can perfectly live without a cookie banner if you don't set one for arbitrary visitors. That was the intended result. But reality instead invented this UX nightmare, because we can't have nice things.
For me it just shows how fucked up today's web actually is.
Anban Govender reshared this.
Leroy
in reply to Enno T. Boland • • •also, by default a website complies with GDPR.
The choices by those in charge (collecting ad revenue or choosing a harmful technical library) is what then makes a website require needing consent.
punIssuer
in reply to Enno T. Boland • • •Cassandrich
in reply to Jeff Atwood • • •Anban Govender likes this.
Ashley Rolfmore (leymoo)
in reply to Cassandrich • • •@dalias in analogy:
EU made it illegal to “sucker punch people” ie collect personal data without consent. That’s not the same as legit personal data collection eg an online shop needs your delivery address to mail your order you just made to you.
Cookie banners are basically giving someone a quick “sorry” after punching them - it’s a loophole that shouldn’t exist. No sorry needed if you don’t punch anyone.
Cassandrich
in reply to Ashley Rolfmore (leymoo) • • •Ashley Rolfmore (leymoo)
in reply to Cassandrich • • •@dalias yeah fair. I see some progress has been made on allowing ad free meta product usage (with payment).
But the banners I think are harder to enforce because it’s just so many companies, large and small.
Cassandrich
in reply to Ashley Rolfmore (leymoo) • • •Irenes (many)
in reply to Cassandrich • • •yes indeed! before we joined Internet Safety Labs, the org published a spec for how that relationship between the visitor and the company should work, in an ideal world
not because anybody is going to follow that spec unless legally required to... just because sometimes you need to make your position clear
Irenes (many)
in reply to Irenes (many) • • •anyway: during our time at Google we were occasionally party to VP-level decision-making around privacy topics
we can attest, from our own direct knowledge, that tech companies habitually intentionally refuse to engage with public-policy debates so that they can later paint the laws and regulations that come out of those debates as uninformed by industry realities
Kristoffer Lawson
in reply to Cassandrich • • •Mark Koek
in reply to Kristoffer Lawson • • •Kristoffer Lawson
in reply to Mark Koek • • •@mkoek @dalias tell that to the thousands of startups desperately trying to balance with a billion other things they're trying to do. That's just not a practical suggestion when the third party analytics are much faster to set up, better understood, and generally superior too than some self-hosted thing cobbled together.
As mentioned, the reality we are in today with cookie popups everywhere was 100% predictable and the regulation was thus poorly considered.
Mark Koek
in reply to Kristoffer Lawson • • •Kristoffer Lawson
in reply to Mark Koek • • •@mkoek @dalias frankly, yes. The law hasn’t changed anything of substance. Companies still use the same analytics tools. But now users are constantly nagged at, and companies have increased costs and slower go to market times as they need to faff with these things.
Perfect example of regulation that is completely misguided, and is a nuisance to almost everyone, bar a few people on Mastodon. Wrong approach.
Mark Koek
in reply to Kristoffer Lawson • • •Jeff Atwood
in reply to Mark Koek • • •Liam Proven
in reply to Jeff Atwood • • •@mkoek @Setok @dalias
“Information wants to be free; information [also] wants to be expensive.” -- Stewart Brand
craphound.com/gbbt/Cory_Doctor…
Jeff Grigg
in reply to Liam Proven • • •@lproven @mkoek @Setok @dalias
Even being the "card-carrying Libertarian" that I am, I have long said that the most fundamental errors of Libertarian philosophy are to assume that
(1) reliable information is free
[It is not. It is expensive and difficult to obtain. There's no "want" about that; it's just reality.]
and
(2) people are rational.
[Like, do I really need to explain this? Especially in the context of current politics? 🙄 ]
Cassandrich
in reply to Cassandrich • • •Jeroen Baert
in reply to Cassandrich • • •@dalias This. All those banners tell you is "this website doesn't respect your privacy"
And there was a "Do Not Track"-flag, but respecting that was voluntary. :/
William Oldwin
in reply to Jeff Atwood • • •William Oldwin
in reply to William Oldwin • • •As for why this isn't a browser feature, it was and is! It is a *choice* by your industry to disregard this, by ignoring DNT and not implementing GPC in major browsers. Did your site honour DNT? Does it honour GPC in places where it is not legally obliged to?
developer.mozilla.org/en-US/do…
globalprivacycontrol.org/
Global Privacy Control — Take Control Of Your Privacy
globalprivacycontrol.orgJeff Atwood
in reply to William Oldwin • • •William Oldwin
in reply to Jeff Atwood • • •PAUL!!!
in reply to Jeff Atwood • • •Anban Govender likes this.
Anban Govender reshared this.
Jeff Atwood
in reply to PAUL!!! • • •Marcus Müller
in reply to Jeff Atwood • • •@luap42 the donottrack header is exactly that at the browser level; if it's set no need to ask the user about consent they're explicitly denying. For non-tracking, i.e., technically necessary (auth,user settings) cookies, that banner is not necessary
the browser setting exists, it's not honored by website operators, which choose to show banners instead, and is being torpedoed by google, who is earth's dominant ad network and browser supplier.
the EU (in that case) isn't at fault.
Marcus Müller
in reply to Marcus Müller • • •Pixelcode 🇺🇦
in reply to Marcus Müller • • •@funkylab @luap42 Well, akschualllly the Do-Not-Track header has been deprecated because it was widely disrespected for being enabled by default in some cases, so websites argued that DNT doesn't really reflect the users' choices.
Therefore, DNT has been replaced by the Global-Privacy-Control header which is required to be disabled by default. @funkylab's screenshot shows the GPC setting.
@codinghorror Not sure how GPC is not precisely the “at the browser level” you are describing.
Eric Vitiello
in reply to Jeff Atwood • • •Jeff Atwood
in reply to Eric Vitiello • • •karttu
in reply to Jeff Atwood • • •Consent-O-Matic
consentomatic.au.dkLauma Pret 🕸️
Unknown parent • • •Yeah, I managed to do it on waterfox now. Half a year ago on actual FF I couldn't.
Philip Kaludercic
Unknown parent • • •Jeff Atwood
in reply to Jeff Atwood • • •javier :vericol:
in reply to Jeff Atwood • • •Jeff Atwood
in reply to javier :vericol: • • •scy
in reply to Jeff Atwood • • •@javier Websites that don't use cookies are not involved. Neither are websites that only use cookies that are _required_ for the website to function, e.g. session tokens.
It's only when you'd like to use cookies to track users and deliver personalized ads that you have to deal with this stuff.
It's a choice.
Most websites simply don't choose the privacy-friendly option.
Anban Govender reshared this.
Claudius
in reply to scy • • •@scy @javier one of the big problems nobody talks about: tech is largely only explained by entities who have no incentive to explain it *well*.
Google, Meta, large ad networks are all like "stupid EU makes us do Cookie banner".
While the actual regulation is actually pretty good. The regulation is basically "don't fuck around with user data. But if you do, you at least need to tell the user".
Nik
in reply to Jeff Atwood • • •Nfoonf
in reply to Jeff Atwood • • •mhoye
in reply to Jeff Atwood • • •True, but my point remains. This shitty experience we're collectively having here this isn't "the EU forcing cookie notification on people", it's "the malicious compliance of companies that profit from user tracking."
Every company that shows you an cookie popup has made the choice to put a few fractions of pennies of possible future profit ahead of your experience.
gdpr.eu/cookies/
Cookies, the GDPR, and the ePrivacy Directive - GDPR.eu
Richie Koch (GDPR.eu)Anban Govender likes this.