Welcome to Friendica.Eskimo.Com

Home of Censorship Free Hosting

 Eskimo North Linux Shells, E-mail, Virtual Machines, Web Hosting.

E-mail, Web Hosting, Linux Shell Accounts terminal or full remote desktops.

Sign Up For A Free Trial Here

Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!

mastodon - Link to source

Look, Jeff Atwood, it is difficult to take you seriously when you write authoritatively on a subject you clearly don’t understand.

GDPR doesn’t mandate cookie notices.

Cookie notices are *malicious compliance* by the surveillance-driven adtech industry.

If you’re not tracking people, you do not need a cookie notice, period.

If you’re only using first-party cookies for functional reasons, you do not need a cookie notice, period.

If you’re using third-party cookies to track people – i.e., if you’re sharing their data with others – then *you must have their consent to do so*. Because, otherwise, you are violating their privacy. Even then, the law doesn’t mandate a cookie notice.

How would you conform to EU law without a cookie notice if your aim wasn’t malicious compliance?

You would not track people by default and you would make it so they have to go your site’s settings to turn on third-party tracking if, for some inexplicable reason, they wanted that “feature”.

Boom!

No cookie notice necessary.

What’s that?

But that would destroy your business because your business is founded on the fundamental mechanic of violating people’s privacy?

Good.

Your business doesn’t deserve to exist.

Because the real bullshit here isn’t EU legislation that protects the human right to privacy, it’s the toxic Silicon Valley/Big Tech business model of farming people for data that violates everyone’s privacy and opens the door to technofascism.

infosec.exchange/@codinghorror…

Jeff Atwood

2025-08-30 22:54:27

mastodon - Ссылка на источник

Look, EU, it is difficult to take you seriously when you forced all this cookie notification bullshit on us. That feature a) should not exist and b) if it did, should be a BROWSER feature not "every website in the entire world now has to bother everyone forever about this stupid thing" blog.codinghorror.com/breaking…


Breaking the Web’s Cookie Jar

The Firefox add-in Firesheep caused quite an uproar a few weeks ago, and justifiably so. Here’s how it works: * Connect to a public, unencrypted WiFi network.
Jeff Atwood (Coding Horror)
This entry was edited (3 days ago)

Gerry McGovern reshared this.

in reply to Aral Balkan

mastodon - Link to source

Writing Slowly

whether or not this is technically correct it totally nails how I feel about cookie notices. They're obviously compliance theatre. I hate them all, especially when you have to accept 'necessary cookies' or else you get them all (you probably get them all anyway). Plus which data privacy gaslighter even needs cookies now? They've probably moved on to even more invasive methods. Oh, did I mention I hate cookies and their stupid fake notices?
in reply to Writing Slowly

mastodon - Link to source

Aral Balkan

@writingslowly There’s an easy solution to that. We pass a GDMR and effectively outlaw their business model (don’t hold your breath).

ar.al/2018/11/29/gdmr-this-one…


GDMR: this one simple regulation could end surveillance capitalism in the EU

GDMR: The regulation EU citizens deserve. No, you didn’t misread it and, no, it’s not a typo. GDMR – the General Data Minimisation Regulation – can end surveillance capitalism in the EU. The problem is that no such regulation exists.
Aral Balkan
in reply to Aral Balkan

mastodon - Link to source

Georg Weissenbacher

@writingslowly There’s a problem with point 1 - who decides what “can be built”? For instance: Many legislators want companies to implement encrypted communication in a way such that they - and only they - can listen in. Numerous experts believe such a system can’t be built (at least not securely).

If I’d run a company I’d rather not end up in court where a lawyer explains to me what can be built and what not.

in reply to Georg Weissenbacher

mastodon - Link to source

Aral Balkan

@GeorgWeissenbacher @writingslowly I’m one of those experts.

Yes, regulation, like any legislation can be good or bad. That said, if you run, say a construction company, a lawyer does explain to you what can and can’t be built. You don’t just get to dig up a park and put in luxury apartments because you feel like it. You don’t get to construct a factory and dump your sewage into the sea. Or, more to the point, if you run a cinema, you don’t get to put cameras in the bathrooms. There are many things you don’t get to do if you run a company because they would infringe on the rights of others and your right to make a profit doesn’t supersede that.

I hope you’re teaching your students that they should be thoughtful in what they build so that it benefits humanity. We don’t need more things, we need more things that improve human welfare. And the last thing we need are more libertarian techbros who think they can do whatever they want in pursuit of their gluttonous profiteering and that rules don’t apply to them. That’s how we end up with technofascism.

in reply to Aral Balkan

mastodon - Link to source

Florian Zumkeller-Quast

@yahe @marix yes, we would. The mentioned ePD covers also non-personal data, thus is not necessarily lex specialis to the GDPR. This is why the ePD e.g. covers all cookies, not only tracking (or browser fingerprinting, or ..., and also responsive Design (but does not mandate aquiring consent for that as it is functional for the service requested by the user)).
in reply to Aral Balkan

mastodon - Link to source

Michael T. Richter

@codinghorror Are we sure that Jeff Atwood isn't an early LLM experiment? The straight-up overconfidence as he spouts completely incorrect and ignorant shit feels an awful lot like ChatGPT and its coterie of concussed digital parrots.

Oh, wait. The "voice" of these is modelled after what techbrodudes think sounds smart. I may have put the teleological cart before the horse.

Unknown parent

mastodon - Link to source

michel v

@jenesuispasgoth @knud I work in e-commerce in Europe. Mostly the banners are there because such websites do use a lot of third party services for purposes that range from marketing campaign monitoring to user session recordings (for debugging). Apart from developing everything in house or hosting the tools, there aren’t a lot of ways to avoid the banners.
in reply to Aral Balkan

mastodon - Link to source

Sass, David

this is why #GitHub was able to remove the banner back in 2020 - the good old days.

github.blog/news-insights/comp…

Funny enough, 5 years later the banner is back on $GitHub Blog, I guess being owned by $MSFT changes things...


No cookie for you - The GitHub Blog

The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.
Nat Friedman (The GitHub Blog)
in reply to Aral Balkan

mastodon - Link to source

Rune

I didn't read the 🦷 from Jeff. I fully understand the no tracking and I'm glad I live in the eu and privacy is taken seriously. But I also understand the need for cookies , at least for analytics and I think the cookie consent ux is awful. I get cookie consent blind and click allow all ... Usually the default.. to get to the content. It could be super nice if the cookie-banners could steered by request accept headers as standard. In that way I would only need to set the browser settings
in reply to Rune

mastodon - Link to source

Aral Balkan

@praerien 1. You don’t need third-party cookies for analytics. Services exist that provide analytics without third-party tracking.

2. The “UX” (design) of cookie consent banners is anti-pattern implemented by the adtech industry exactly to invoke this reaction and misdirect your ire from the tracking itself to the law meant to protect your rights.

3. Your suggested solution would, indeed, nip this in the bud. This is why the surveillance industry made sure to remove Do Not Track the moment they realised it could be used for this purpose. (After all, it has served Mozilla/Silicon Valley’s purpose of delaying regulation for a decade and now had become a liability.)

in reply to Aral Balkan

mastodon - Link to source

Pino Carafa

exactly. The EU needs to mandate that

1. Every browser needs to, by default, be set to allow "strictly necessary cookies" only.
2. Every site that wants to serve EU users must honour this setting.
3. Impose massive fines on sites that don't do this or that choose to interpret "strictly necessary only" in "creative" ways.

So that anybody who does not want other cookies has to do exactly nothing to achieve that.

This entry was edited (3 days ago)

Aral Balkan reshared this.

in reply to Pino Carafa

mastodon - Link to source

Aral Balkan

@rozeboosje That would work. ar.al/2018/11/29/gdmr-this-one…

GDMR: this one simple regulation could end surveillance capitalism in the EU

GDMR: The regulation EU citizens deserve. No, you didn’t misread it and, no, it’s not a typo. GDMR – the General Data Minimisation Regulation – can end surveillance capitalism in the EU. The problem is that no such regulation exists.
Aral Balkan
in reply to Aral Balkan

mastodon - Link to source

Loïc Denuzière

Really the main problem of this enforcement is that it came too late, when (almost) everyone was already dependent on collecting private data. That made it easy for the industry to collectively decide that intrusive popups would be the simplest way to comply.

What were people going to do, take their business to the competition? Doesn't matter, they do it too.

If regulation had come earlier, then the first ones to use popups would have been seen as obnoxious assholes and lost visitors.

in reply to Simon Eilting

mastodon - Link to source

Aral Balkan

@eseilt Couldn’t agree more.

ar.al/2018/11/29/gdmr-this-one…


GDMR: this one simple regulation could end surveillance capitalism in the EU

GDMR: The regulation EU citizens deserve. No, you didn’t misread it and, no, it’s not a typo. GDMR – the General Data Minimisation Regulation – can end surveillance capitalism in the EU. The problem is that no such regulation exists.
Aral Balkan
in reply to NKT

mastodon - Link to source

Aral Balkan

@Dss In my world, which the same world you live in, if a person provides their phone number to have a sales person call them, they are consenting to have the sales person call them and you can use their phone number for the purpose of having a sales person call them which is what the person has given you permission to do.

Do you need a cookie notice for that?

No.

(That said, it’s not my job to fix toxic business models.)

in reply to Aral Balkan

mastodon - Link to source

Don Marti

Lin et al. found that ad blocker users are more satisfied with the products and services they buy than non-users. There _is_ a theoretical economic role of advertising but surveillance advertising is failing at it

Lots of pro-surveillance advocacy from academics, but they don't cite some of the best sources in their own field, or some of the best points in the body copy of the papers they do cite—even Google refers to de-personalizing the ads as a "protection" blog.zgp.org/advertising-perso…

advertising personalization: good for you?

blog.zgp.org
This entry was edited (3 days ago)
in reply to Aral Balkan

mastodon - Link to source

disorderlyf

What I *do* think should be a browser feature if we're really serious about doing away with cookie notices is having an option to either auto-accept, auto-deny, or for you to actually have to click every single gods damned notice. Since most of them already have a "necessary cookies only" option, that alone would get rid of 90% of the banners. And even then, devs could write something to parse more needlessly complicated menus for that. The only way to get around that, which I don't even know if this is in compliance with GDPR, is for websites to en masse get rid of the option and do what some have done where it's just a popup that says "We use third party cookies. Don't like it? Hit the road then." But again, I'm not even sure if those actually comply with the GDPR
in reply to disorderlyf

mastodon - Link to source

Hannah

@disorderlyf This feature already exists. It is just that ad-tech ignored that users were sending a do-not-track request and instead they opted for trying to nudge everyone into accepting their surveillance, by making obnoxious cookie banners.

en.wikipedia.org/wiki/Do_Not_T…

proposed HTTP header field that requests web applications to disable individual user tracking

Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)
in reply to Hannah

mastodon - Link to source

Aral Balkan

@uncanny_static @disorderlyf It’s worse than that: this was a feature spearheaded by Mozilla (Silicon Valley’s acceptable face) and it had the very real effect of staving off regulation for a decade (“look, we are self regulating”). The moment people realised it could be used to communicate consent within the framework of GDPR, the feature was deprecated.

Sadly, some folks still think Mozilla are the good guys.

in reply to Aral Balkan

mastodon - Link to source

Queen Calyo Delphi

Genuine question:

If I hosted my own private analytics tracker (something like Matomo (née Piwik), e.g.) just so I could have funny numbers to look at because I like to look at numbers but do nothing meaningful with them, would that require a cookie banner?

I'd pondered about just having a static notice in the footer of my site that just says "This site uses some functional cookies and one (1) tracking cookie for a self-hosted analytics dashboard because I like to look at Numbers™."

Unknown parent

mastodon - Link to source

David Chisnall (*Now with 50% more sarcasm!*)

@urlyman
It's often not even malicious compliance. Most of these banners don't even meet the requirements of the GDPR, specifically that you must be able to withdraw consent at any time and that you mist give informed consent (i.e. that you must know what you have consented to to be able to grant consent).

@noybeu is doing a great job going after some of these people.

in reply to Aral Balkan

mastodon - Link to source

craignicol

if GitHub doesn't need a cookie banner, there's no technical reason for a site to have them, it's always a privacy reason

techcrunch.com/2020/12/17/gith…


GitHub says goodbye to cookie banners | TechCrunch

Microsoft-owned GitHub today announced that it is doing away with all non-essential cookies on its platform. Thanks to this, starting today, GitHub.com
Frederic Lardinois (TechCrunch)
This entry was edited (1 day ago)
Unknown parent

mastodon - Link to source

Aral Balkan

@codinghorror @andrewrk I think what people are trying to tell you is that you’re part of the problem.

You’re not just any “user of the internet”, you’re a developer. You have agency. Don’t like cookie banners? Great! Lead by example: remove them from the sites you own and control (i.e., stop tracking people on the sites you own and control. Find other ways to make money.)

in reply to Aral Balkan

mastodon - Link to source

Mike Sax

@codinghorror Look, Aral Balkan, we could have a very juicy and polarizig conversation about this, but it wouldn’t help the cause. 🤓 And the cause, as I understand it, is to advance the privacy of citizens, with fully informed consent and as little hassle as needed. I believe that a large portion of the cookie banners on the web are presented just because that’s the default. 1/4
⇧