It's important to note that the Do-Not-Stab header has been deprecated because one browser engine switched it on by default and requiring users to opt into stabbing hurt the bottom line of the stabbing industry, so it's no longer respected. Luckily someone came up with General Assault Control, a non-standard alternative, which also only has one value, so you can set Sec-GAC to 1 to request websites not to assault you. By design, this header cannot be extended, so it cannot be used to distinguish brutal stabbings from a comedic pie to the face in the future.
Because of legal requirements, the General Assault Control header may not be enabled by default, as American states like Colorado require explicit opt-out (rather than explicit opt-in). This protects Colorado's thriving stabbing and shooting industry as most users will never want to opt into being stabbed.
Despite the feature being forced to be disabled by default, the organisation behind the spec is pushing hard for customers to download fringe browsers that implement the feature (though you may need about:config to enable it). Because of the small user base, the request not to be assaulted can be used by websites not willing to follow the standard to make their stabbings and shootings more precise. End users can request a JSON file from the web server containing the supposed support for the GAC header, but requesting this URL may be used to kick the user in the teeth by non compliant servers.
It’s great satire, but it really does mirror a larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users. Do-Not-Stab, Do-Not-Track, whatever it might be, any sort of “voluntary compliance” is a non-starter in the face of financial pressures
IMO we need to start normalizing being militant about this stuff again, to aggressively and adversarially defend the freedom to use your computer the way you choose to use it
> aggressively and adversarially defend the freedom to use your computer the way you choose to use it
Sadly even if you’re inclined to do this, it’s always a war of attrition, and corporations seem to realize they can just up the cost of your resistance in terms of time/frustration, and that’s enough for them to win in the long term. The history and trajectory of platforms, from browsers to AppStore’s to SaaS-all-the-things, is just tragic, with the amount of user control on a downward slide at each stage. The big question now is whether / how / to what extent AI is going to be corporate or democratized, but it’s hard to be optimistic.
Or, you know, if Clicking do-not-stab for 60 more years sounds like it sucks, you can try to become a shepherd or something. Works great for ~10 years, and then you can’t use cars, dishwashers or light switches without clicking do-not-stab, at which point they finally win and you say, you know what? I should be grateful they asked before they stabbed me, I practically owe it to them anyway, and I can’t wait to see all the love/cash rolling in after I’m a big shot shepherd influencer. Like and subscribe y’all and as always, hail corporate
Worth noting the times where you have the choice to engage or not with a company with bad practices. Make it unprofitable for them to provide horrible service. Particularly applicable to tech, because most of it is useless rubbish we don't really need anyway!
Is this a case where monopoly actually benefits the cause? The last great uprising in the public interest, imo, was Microsoft against the open source movements at the turn of the century. It was a heady time to be involved in software. I miss it frankly.
But perhaps it really only succeeded, because that Microsoft was like the Boeing of today, a company where Pournelles second type (the institutionalists) had taken over and was just riding out the momentum, allowing the upstart unfunded open source hippies to actually have success.
I wonder if there is some way to DoS the tracking services by basically accepting third party cookies but then immediately discarding them so every page load generates a new cookie and presumably state stored on the other end to match it. Or are these tracking cookies typically self-contained so that no state is stored server-side?
> larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users.
If anything the shift is going the other way, with some of the more busy-body jurisdictions trying to take things that are properly enforced by the user's user-agent and instead making them officially the responsibility of the other party.
Yeah and the fuss about it being enabled by default is not really relevant. In the EU tracking must be opt-in anyway. So this is expected behaviour.
However the EU dropped the ball by not making it mandatory to respect this flag. If they had we wouldn't have had the huge cookiewall mess we have now.
I'm registering my elderly relatives for dmachoice.org, to prevent them from getting junk mail. These clowns create the problem and then have the audacity to charge you to be added to the opt out list. I was really skeptical about the GDPR when it was passed and I am now fully on board for an American version.
I'm still extremely skeptical of it because in practice it basically added a cookie banner to every every website I visit infrequently with no particular benefit to me.
The cookie banner is there to punish people who have cookies turned off or set to be deleted upon browser/tab close - and generally annoy everyone else.
Think about how obsessive companies are about "UX" and how disruptive the banner is. Bitch-slapping people for fighting against tracking is more important to them than the user being able to access or use the site at all.
Most EU national government websites have cookie banners. Even the European Commission website has a cookie banner!
This should have been implemented at the browser level. Let the browser generate a nice consistent UI to nag EU users when visiting websites about accepting cookies and let the rest of us opt out.
The standard for cookies should be updated with a way to include or retrieve a description of each cookie separately. Then, require sites to provide that description, and let users choose per cookie in the browser.
Or if the legal department is concerned that someone could claim a cookie is non-functional, so to save the uncertainty and expense they advise always showing the banner. Especially since everyone else does.
It seems like there should be a parallel to “tragedy of the commons” that talks about how a good idea coupled with extreme penalties can lead to a bad outcome by making any risk calculation result in “jesus we just can’t take any chances here”.
> ... "it basically added a cookie banner to every every website I visit" ...
Yeah, no. Hostile advertising companies added that cookie banner as a form of "malicious compliance" with the law purely to annoy everyone like a buncha spoil't little brats who didn't get their way, so now they're gonna make everyone suffer... If we get a similar law in the USA, you can expect to see annoyances just like it (and probably worse) on sites hosted here, too.
The worst part is that it wasn’t even malicious compliance: the cookie banners they added seldom even satisfied law, in ways completely obvious if you just read the law (which is pretty easy reading, only a few thousand words for the relevant parts). I don’t understand why relevant commissions didn’t make more noise about that, because it was obvious that major players were deliberately poisoning public perception.
Can you source your claim? Because it seems like it would create a competitive advantage for a non-hostile advertising company. Websites aren’t any happier about cookie banners than users are. If it’s just an emotional, spiteful reaction, the grownups should be able to make a fortune.
You'd think there'd be some "competitive advantage" to be had, but when their entire industry is built upon tracking and profiling everyone they possibly can, they'll do anything they can, fighting tooth-and-nail to the very end against any legislation that somehow interferes with their tracking, even if it means resorting to childish and petty temper tantrums that further enshittify the web. What little "competition" exists in that industry all fully believe that building massive profiles on everyone is the only way to make any money at advertising. They've been allowed to get away with it for so long that they can't even remember there was a time when tracking everyone all the time everywhere wasn't even a thing (and yet advertisers still managed to advertise back then, somehow)...
When GDPR was first going through the public circuit I remember reading the proposed laws and being pleasantly surprised to find that they specifically called out and forbade the likely workarounds, including the obnoxious banners we now see everywhere.
I would love to know what happened. Did the laws get "revised" to re-open the loophole? Was superseding legislation passed? Did the courts reject it? Are there enforcement issues?
That sounds like a legal minefield - I would point out that GDPR-style legislation exists because the legislators don't trust the industry to assess what is reasonable. So the industry would be in a position where:
1) They aren't trusted to be reasonable about user consent.
2) They are only to take action when they judge it is reasonable to check user consent.
It'd probably be a very rocky process to nail down what those words like "loophole" and "workaround" mean as the advertisers start abusing prescribed no-banner situations.
Clearly you don't have a browser plugin that simply opts out of all cookie banners. Ultimately, the webs ites have a financial interest in malicious compliance, so you either work within the system as given or throw your hands in the air and let every and all sites rape your data.
It is, however worth at least considering restrictions on continuously following a person in public places and reporting all their observed activities to a third party.
Of course there are practical limitations on that kind of physical surveillance. It's expensive, tends to attract attention, and even nation states can only do it to a few people at a time. Information technology allows it to scale to almost everyone, almost all the time, for a small fraction of a corporate budget.
Perhaps it's worth at least considering restrictions on that.
> It is, however worth at least considering restrictions on continuously following a person in public places and reporting all their observed activities to a third party.
I don’t see any difference between online “tracking” and real world stalking. If some one was following you every where you went taking notes on everything you did, interrupting you and preventing you from actually doing what your were actually wanting to do, you’d be able to have the police intercede in your behalf. Only now we think it is different because “on a computer”.???
You are the culmination of your life's experiences. Going by your definition, one could infer an individual has zero intrinsic ownership of any non-health data. Which I categorically object to.
You have ownership over your own memories and records.
Other people also own their own memories and records - some of which may be about you.
At least, this is how it was for most of human history.
Now some people think they should be able to demand everyone destroy records about them. If it was possible, no doubt they'd also demand people destroy any memories about them as well.
ePD in 2002 mandated cookie banners well before GDPR in 2018. But yes, point taken that well intentioned regulation can be poorly implemented and have negative repercussions.
I know of no regulation that mandated cookie banners. I just know a lot of sites who chose to use banners because the operators are somewhere between weasely and malicous.
On the internet, it started as the user's responsibility.
For netizens, the idea that the use should be able to opt out of logs about their interaction with the service the operator owns is novel (because they always had the option of not using the service if they found the pattern distasteful).
There's a bit of a difference between normal logging of access to services to protect your devices / network (and to understand your users' access to your services), and using every nasty trick in the book to build extensive detailed profiles of everyone's browsing footprint across the entire web, often without their knowledge or consent (hence the laws, because it's the only way to convince some folks to not do bad things). The first should be expected behavior, whereas the second should be considered unacceptable and abusive, but has somehow been "normalized" in modern society.
The internet started with decentralized protocols like NNTP, so you could just choose a different news server if the one you were using started tracking + selling your download logs.
Centralizing the serving of third party (or even first party) content is already way outside the original norms of the internet.
Heck, back in the day, HTTP caching would be enough to block tracking. (No javascript, and only the ISP sees which users pulled the document from cache.)
The internet/arpanet started largely with centralized protocols like various file transfer protocols, telnet, finger, various networked filesystem protocols, network printer protocols, network graphics protocols, echo, QOTD, etc.
This is such transparent EU Bureaucracy shilling. No wonder Europe doesn't have any large SaaS companies with their stabbing unfriendly business climate.
I think you are factually wrong: Skype, Spotify, Revolut, Zendesk, Transferwise... There are quite many European unicorns too (less though than US and Chinese companies) which are operating as SaaS. Some of them got acquired or re-based to other countries though
For the low price of $20/1000 clicks, I will provide you with a stabbing consent banner, fully compliant with upcoming EU and CA regulations on web-based stabbing.
I'm sold, the distinctions between "necessary", "targeting", "performance" and "functional" stabbings are such a minefield. Not to mention how I'm supposed to properly disclose the 846 different stabbing brokers I work with. How's a man supposed to make a living stabbing people with all of this red tape in the way?
The Do Not Track header was originally proposed in 2009 by researchers Christopher Soghoian and Sid Stamm.[2] Mozilla Firefox became the first browser to implement the feature.
I wonder how many web developers actually honour Do Not Track. I do, in all the websites I've made for my employer too, but I think I'm only getting away with it because my employer doesn't know. I've even made it so that browsing with Do-Not-Track enabled also skips the cookie consent banner and just assume the user wants no cookies other than the strictly necessary ones (like their session/login cookie), and doesn't include Google Analytics, instead just upping a single view counter on the page, with no PII in there.
Relax, folks, entities have plenty of other options, there still won't be support for Do-Not-Shoot, Do-Not-Rape, Do-Not-Stone, fun for the whole family.
A bit of lore that I learned in my networking class in college was that the RFC name was chosen as tongue in cheek in that by the time a proposal gets to the RFC stage, comments are very much not appreciated. You're supposed to comment well before that point.
No idea if that bit of lore is true but it is certainly the case that RFCs are usually the final word on the relevant standard. In fact, once they get their ID, RFCs cannot be modified or rescinded; only superseded by another RFC.
> The early RFCs were, in fact, requests for comments on ideas and proposals; the goal was to start conversations rather than to create an archival record of a standard or best practice. This goal changed over time, as the formality of the publication process evolved and the community consuming the material grew. Today, over 8500 RFCs have been published, ranging across best practice guidance, experimental protocols, informational material, and, of course, Internet standards.
RFC's operate under the IETF. RFC's are developed under some specific group, and you can join that group, the business is generally conducted on email. There are (well, were back when I participated) in-person meetings, but attendance there was not mandatory.
No, they love the money they can make about you. I don’t know anybody giving their money to these people. It is other shady companies buying the data about for, shady companies that have collected. All of this is offered to you free of charge.
Maybe it’s just me, but I fundamentally disagree with the mentality that we should prioritize the “feeling of being special” among those who already get the joke (and corresponding point) at the expense of those who have yet to appreciate the message.
You can still laugh at the joke with the section there, you’ll just have fewer confused people to correct, and be in one less elite club.
Sure, but the point of critical thinking club isn’t really its exclusivity. In this case if you don’t know which specific header this is parodying that’s completely understandable. But if you really think this is about computers stabbing people and can’t laugh at yourself about it when you find out that it isn’t then I don’t think we will be able to engage on this topic in a mutually rewarding manner.
I don’t think it’s about computers stabbing people, but that’s not relevant. The issue is your willingness to keep people in the dark so you can feel good that you got a reference without it being explained.
> it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more
For Microsoft this also rings true from the opposite direction. Any specification that Microsoft technically abides is implemented in an egregiously dark way (at least for anything consumable at an enterprise level).
They go to great lengths to exercise every bit of leeway permitted by the spec, even when it doesn't make economical sense, because what are you gonna do about it? Vote with your wallet? Against the vendor that runs all your workstations and manages your directories and databases and deployments and authentication and authorization and business intelligence and and and?
No, you're gonna accommodate their absurd counter-requirements because what other choice do you have? The decision then becomes:
1. branch your code to shit with `vendor == microsoft` clauses
2. branch your project/architecture to shit and effectively maintain a Microsoft version alongside the "normal" core version
3. use Microsoft's bespoke library that solves the problem they created
A project that selects option 3 will face the least resistance integrating with Microsoft products, but will also become beholden to arbitrary rules that complicate integration with every other vendor who benevolently implements the standard.
I'd love for Please-Do-Stab header to exist so I can just set it and with it opt out of any stabbing-anti-stabbing wars and politics.
I fully understand that it's absence wouldn't meant that people won't get stabbed, but it would save time and mental space of all people like me who really don't care about being stabbed or not.
Honestly if anything, I'd like to be stabbed more.
By analogy to current situation about tracking ... Ad companies know too much about me? I think they know too little. For example for half a year they still haven't figured out that I know barely any words in German and are serving me German advertisements all the time just because I happen to be living in Germany currently.
I couldn’t tell if it was intended to be a note-for-note parody of an RFC about the do-not-track header, but I couldn’t find one that would qualify. The closest would be this[1], but it doesn’t cleanly match up (in part because [1] is more verbose and its points scattered).
Another satire RFC in the same spirit is the one about the evil bit[2] (designate one bit in packets to indicate whether it’s intended for evil), with the same subtext as the linked post: no, you can’t trust malicious entities to change their behavior to make it easier to stop.
> it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more, because every company out there fucking hates you and would sell you out to make a bit more money if they legally could. and even if they couldn’t, who’s going to stop them?
Certainly not any government. If you think the EU's regulation are of any help to the consumer you are gravely mistaken. The EU is quickly becoming a fucking nightmare to live in. "The more corrupt the state, the more numerous the laws". The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.
That's what the EU is: probably that some politicians or bureaucrats with enough brain cells to recognize a bottle cap on the ground thought "I've got an idea to make the EU better, let's mandate every bottle to have a cap that cannot be separated from the bottle".
As a result you lay horizontally a plastic bottle of sugary drink in your fridge (because you've been used to do that for decades) and now all your fridge is sticky due to the bottle leaking.
It's all that is wrong with the EU bureaucrats in one example.
Also hailing the EU as the savior vs Microsoft when our lives becames miserable with EU consent cookie popups virtually everywhere is a bit thick.
Honestly yeah. The EU is run entirely by PMC people who don't understand or care about the effect on lower-class and frankly less intelligent people's lives.
Good grief if you’re biggest complaint about why the EU is a nightmare to live in because sometimes you get nasty soda all over your fridge then I think you might need to touch some grass.
> The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.
I haven't encountered that meme, but if it exists, it's like most memes seem to be: Wrong. The bottle caps work just fine.
The authors are [redacted] Google. Are they actually Google? They seem to unironically complain about what Microsoft is doing, but Google is guilty of the same.
It's important to note that the Do-Not-Stab header has been deprecated because one browser engine switched it on by default and requiring users to opt into stabbing hurt the bottom line of the stabbing industry, so it's no longer respected. Luckily someone came up with General Assault Control, a non-standard alternative, which also only has one value, so you can set Sec-GAC to 1 to request websites not to assault you. By design, this header cannot be extended, so it cannot be used to distinguish brutal stabbings from a comedic pie to the face in the future.
Because of legal requirements, the General Assault Control header may not be enabled by default, as American states like Colorado require explicit opt-out (rather than explicit opt-in). This protects Colorado's thriving stabbing and shooting industry as most users will never want to opt into being stabbed.
Despite the feature being forced to be disabled by default, the organisation behind the spec is pushing hard for customers to download fringe browsers that implement the feature (though you may need about:config to enable it). Because of the small user base, the request not to be assaulted can be used by websites not willing to follow the standard to make their stabbings and shootings more precise. End users can request a JSON file from the web server containing the supposed support for the GAC header, but requesting this URL may be used to kick the user in the teeth by non compliant servers.
It’s great satire, but it really does mirror a larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users. Do-Not-Stab, Do-Not-Track, whatever it might be, any sort of “voluntary compliance” is a non-starter in the face of financial pressures
IMO we need to start normalizing being militant about this stuff again, to aggressively and adversarially defend the freedom to use your computer the way you choose to use it
To be extremely pedantic, it's great satire precisely because it mirrors that shift. Owes a lot to the OG, A Modest Proposal.
Best time to do that would've been 19 days ago, but here we are. Buckle up.
> aggressively and adversarially defend the freedom to use your computer the way you choose to use it
Sadly even if you’re inclined to do this, it’s always a war of attrition, and corporations seem to realize they can just up the cost of your resistance in terms of time/frustration, and that’s enough for them to win in the long term. The history and trajectory of platforms, from browsers to AppStore’s to SaaS-all-the-things, is just tragic, with the amount of user control on a downward slide at each stage. The big question now is whether / how / to what extent AI is going to be corporate or democratized, but it’s hard to be optimistic.
Or, you know, if Clicking do-not-stab for 60 more years sounds like it sucks, you can try to become a shepherd or something. Works great for ~10 years, and then you can’t use cars, dishwashers or light switches without clicking do-not-stab, at which point they finally win and you say, you know what? I should be grateful they asked before they stabbed me, I practically owe it to them anyway, and I can’t wait to see all the love/cash rolling in after I’m a big shot shepherd influencer. Like and subscribe y’all and as always, hail corporate
Worth noting the times where you have the choice to engage or not with a company with bad practices. Make it unprofitable for them to provide horrible service. Particularly applicable to tech, because most of it is useless rubbish we don't really need anyway!
Is this a case where monopoly actually benefits the cause? The last great uprising in the public interest, imo, was Microsoft against the open source movements at the turn of the century. It was a heady time to be involved in software. I miss it frankly.
But perhaps it really only succeeded, because that Microsoft was like the Boeing of today, a company where Pournelles second type (the institutionalists) had taken over and was just riding out the momentum, allowing the upstart unfunded open source hippies to actually have success.
I wonder if there is some way to DoS the tracking services by basically accepting third party cookies but then immediately discarding them so every page load generates a new cookie and presumably state stored on the other end to match it. Or are these tracking cookies typically self-contained so that no state is stored server-side?
Isn't that the reason cookies were invented in the first place? To keep servers stateless?
If the server can recognize you then it is not stateless, cookies make http stateless
Given that web industry uses no-server-state for *authentication* (with all the issues it implies), i would expect tracking also be no-server-state.
> larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users.
If anything the shift is going the other way, with some of the more busy-body jurisdictions trying to take things that are properly enforced by the user's user-agent and instead making them officially the responsibility of the other party.
Yeah and the fuss about it being enabled by default is not really relevant. In the EU tracking must be opt-in anyway. So this is expected behaviour.
However the EU dropped the ball by not making it mandatory to respect this flag. If they had we wouldn't have had the huge cookiewall mess we have now.
I'm registering my elderly relatives for dmachoice.org, to prevent them from getting junk mail. These clowns create the problem and then have the audacity to charge you to be added to the opt out list. I was really skeptical about the GDPR when it was passed and I am now fully on board for an American version.
I'm still extremely skeptical of it because in practice it basically added a cookie banner to every every website I visit infrequently with no particular benefit to me.
I'm just going to click "yes," stop asking.
No,.all the companies running the sites chose to add a cookie banner. And you choose to keep going there
The cookie banner is only there because the website in question uses non-functional cookies (e.g. targeted advertising)
The cookie banner is there to punish people who have cookies turned off or set to be deleted upon browser/tab close - and generally annoy everyone else.
Think about how obsessive companies are about "UX" and how disruptive the banner is. Bitch-slapping people for fighting against tracking is more important to them than the user being able to access or use the site at all.
It's gotten entirely out of hand.
Most EU national government websites have cookie banners. Even the European Commission website has a cookie banner!
This should have been implemented at the browser level. Let the browser generate a nice consistent UI to nag EU users when visiting websites about accepting cookies and let the rest of us opt out.
The standard for cookies should be updated with a way to include or retrieve a description of each cookie separately. Then, require sites to provide that description, and let users choose per cookie in the browser.
Or if the legal department is concerned that someone could claim a cookie is non-functional, so to save the uncertainty and expense they advise always showing the banner. Especially since everyone else does.
It seems like there should be a parallel to “tragedy of the commons” that talks about how a good idea coupled with extreme penalties can lead to a bad outcome by making any risk calculation result in “jesus we just can’t take any chances here”.
I click no to all of them, but it would be really nice if the Do-Not-Track header essentially let you pick in advance — for you (0) or for me (1)
> ... "it basically added a cookie banner to every every website I visit" ...
Yeah, no. Hostile advertising companies added that cookie banner as a form of "malicious compliance" with the law purely to annoy everyone like a buncha spoil't little brats who didn't get their way, so now they're gonna make everyone suffer... If we get a similar law in the USA, you can expect to see annoyances just like it (and probably worse) on sites hosted here, too.
The worst part is that it wasn’t even malicious compliance: the cookie banners they added seldom even satisfied law, in ways completely obvious if you just read the law (which is pretty easy reading, only a few thousand words for the relevant parts). I don’t understand why relevant commissions didn’t make more noise about that, because it was obvious that major players were deliberately poisoning public perception.
Can you source your claim? Because it seems like it would create a competitive advantage for a non-hostile advertising company. Websites aren’t any happier about cookie banners than users are. If it’s just an emotional, spiteful reaction, the grownups should be able to make a fortune.
You'd think there'd be some "competitive advantage" to be had, but when their entire industry is built upon tracking and profiling everyone they possibly can, they'll do anything they can, fighting tooth-and-nail to the very end against any legislation that somehow interferes with their tracking, even if it means resorting to childish and petty temper tantrums that further enshittify the web. What little "competition" exists in that industry all fully believe that building massive profiles on everyone is the only way to make any money at advertising. They've been allowed to get away with it for so long that they can't even remember there was a time when tracking everyone all the time everywhere wasn't even a thing (and yet advertisers still managed to advertise back then, somehow)...
Other replier believes that competition is a system that works toward consumer needs and betterments. Advertising is extractive
Not if we ban third-party ads.
And if the regulators didn't predict such compliance they should be replaced with competent actors in their jobs.
That was the obvious outcome. What did people predict: site owners leaving money on the table? Who pays for operating the sites then?
When GDPR was first going through the public circuit I remember reading the proposed laws and being pleasantly surprised to find that they specifically called out and forbade the likely workarounds, including the obnoxious banners we now see everywhere.
I would love to know what happened. Did the laws get "revised" to re-open the loophole? Was superseding legislation passed? Did the courts reject it? Are there enforcement issues?
That sounds like a legal minefield - I would point out that GDPR-style legislation exists because the legislators don't trust the industry to assess what is reasonable. So the industry would be in a position where:
1) They aren't trusted to be reasonable about user consent.
2) They are only to take action when they judge it is reasonable to check user consent.
It'd probably be a very rocky process to nail down what those words like "loophole" and "workaround" mean as the advertisers start abusing prescribed no-banner situations.
All the sites that need advertising like that can just die off and leave the internet a better place.
Clearly you don't have a browser plugin that simply opts out of all cookie banners. Ultimately, the webs ites have a financial interest in malicious compliance, so you either work within the system as given or throw your hands in the air and let every and all sites rape your data.
Yes, the second one. I don't really care; it's not "my" data. It's data about me.
When I walk down the street and sometime sees me go by, those aren't my photons they caught. By analogy, same with my browsing history.
It is, however worth at least considering restrictions on continuously following a person in public places and reporting all their observed activities to a third party.
Of course there are practical limitations on that kind of physical surveillance. It's expensive, tends to attract attention, and even nation states can only do it to a few people at a time. Information technology allows it to scale to almost everyone, almost all the time, for a small fraction of a corporate budget.
Perhaps it's worth at least considering restrictions on that.
> It is, however worth at least considering restrictions on continuously following a person in public places and reporting all their observed activities to a third party.
I don’t see any difference between online “tracking” and real world stalking. If some one was following you every where you went taking notes on everything you did, interrupting you and preventing you from actually doing what your were actually wanting to do, you’d be able to have the police intercede in your behalf. Only now we think it is different because “on a computer”.???
> interrupting you and preventing you from actually doing what your were actually wanting to do
This is the part that would get the police involved, and no-one online is doing anything like this.
Doris the curtain-twitcher compiles a dossier on everyone, maybe shares it in her gossip circles. No-one cares.
You are the culmination of your life's experiences. Going by your definition, one could infer an individual has zero intrinsic ownership of any non-health data. Which I categorically object to.
You have ownership over your own memories and records.
Other people also own their own memories and records - some of which may be about you.
At least, this is how it was for most of human history.
Now some people think they should be able to demand everyone destroy records about them. If it was possible, no doubt they'd also demand people destroy any memories about them as well.
That's not how it's been for the bulk of modern history. What absolute absurdity. It's an ancap mentality taken to the notion of privacy.
ePD in 2002 mandated cookie banners well before GDPR in 2018. But yes, point taken that well intentioned regulation can be poorly implemented and have negative repercussions.
I know of no regulation that mandated cookie banners. I just know a lot of sites who chose to use banners because the operators are somewhere between weasely and malicous.
On the internet, it started as the user's responsibility.
For netizens, the idea that the use should be able to opt out of logs about their interaction with the service the operator owns is novel (because they always had the option of not using the service if they found the pattern distasteful).
There's a bit of a difference between normal logging of access to services to protect your devices / network (and to understand your users' access to your services), and using every nasty trick in the book to build extensive detailed profiles of everyone's browsing footprint across the entire web, often without their knowledge or consent (hence the laws, because it's the only way to convince some folks to not do bad things). The first should be expected behavior, whereas the second should be considered unacceptable and abusive, but has somehow been "normalized" in modern society.
It's a difference of degree, not kind, which is how it became normalized.
The internet started with decentralized protocols like NNTP, so you could just choose a different news server if the one you were using started tracking + selling your download logs.
Centralizing the serving of third party (or even first party) content is already way outside the original norms of the internet.
Heck, back in the day, HTTP caching would be enough to block tracking. (No javascript, and only the ISP sees which users pulled the document from cache.)
The internet/arpanet started largely with centralized protocols like various file transfer protocols, telnet, finger, various networked filesystem protocols, network printer protocols, network graphics protocols, echo, QOTD, etc.
This is such transparent EU Bureaucracy shilling. No wonder Europe doesn't have any large SaaS companies with their stabbing unfriendly business climate.
Yeah, why can't the EU just leave the stabtech industry stab in peace?...
I downvoted before I read the end of the comment and realized this was satire.
Good to know HN will be the same in 100 years. /s
I think you are factually wrong: Skype, Spotify, Revolut, Zendesk, Transferwise... There are quite many European unicorns too (less though than US and Chinese companies) which are operating as SaaS. Some of them got acquired or re-based to other countries though
Can confirm, got stabbed by a spammer on Skype yesterday.
Skype is fully American these days though.
For the low price of $20/1000 clicks, I will provide you with a stabbing consent banner, fully compliant with upcoming EU and CA regulations on web-based stabbing.
I'm sold, the distinctions between "necessary", "targeting", "performance" and "functional" stabbings are such a minefield. Not to mention how I'm supposed to properly disclose the 846 different stabbing brokers I work with. How's a man supposed to make a living stabbing people with all of this red tape in the way?
The Do Not Track header was originally proposed in 2009 by researchers Christopher Soghoian and Sid Stamm.[2] Mozilla Firefox became the first browser to implement the feature.
https://en.wikipedia.org/wiki/Do_Not_Track#:~:text=The%20Do%....
I wonder how many web developers actually honour Do Not Track. I do, in all the websites I've made for my employer too, but I think I'm only getting away with it because my employer doesn't know. I've even made it so that browsing with Do-Not-Track enabled also skips the cookie consent banner and just assume the user wants no cookies other than the strictly necessary ones (like their session/login cookie), and doesn't include Google Analytics, instead just upping a single view counter on the page, with no PII in there.
Relax, folks, entities have plenty of other options, there still won't be support for Do-Not-Shoot, Do-Not-Rape, Do-Not-Stone, fun for the whole family.
Don't forget robots.txt
I’ve always wondered, since an RFC is a request for comment, how does one leave a comment? And who?
A bit of lore that I learned in my networking class in college was that the RFC name was chosen as tongue in cheek in that by the time a proposal gets to the RFC stage, comments are very much not appreciated. You're supposed to comment well before that point.
No idea if that bit of lore is true but it is certainly the case that RFCs are usually the final word on the relevant standard. In fact, once they get their ID, RFCs cannot be modified or rescinded; only superseded by another RFC.
Finally I understand why RFCs are served with the Do-Not-Comment header!
Then they should be renamed CFCs (closed for comments).
But CFCs are banned!
> The early RFCs were, in fact, requests for comments on ideas and proposals; the goal was to start conversations rather than to create an archival record of a standard or best practice. This goal changed over time, as the formality of the publication process evolved and the community consuming the material grew. Today, over 8500 RFCs have been published, ranging across best practice guidance, experimental protocols, informational material, and, of course, Internet standards.
> https://www.rfc-editor.org/rfc/rfc8700.html
Nowadays you're supposed to comment before it gets to "Internet standard"
RFC's operate under the IETF. RFC's are developed under some specific group, and you can join that group, the business is generally conducted on email. There are (well, were back when I participated) in-person meetings, but attendance there was not mandatory.
"request for compliance" is the alternative interpretation.
> because every company out there fucking hates you
They don't actually hate you. Rather, they love your money and they have a depraved indifference for you.
They don't hate you, but they're Out To Get You (https://www.lesswrong.com/posts/ENBzEkoyvdakz4w5d/out-to-get...)
No, they love the money they can make about you. I don’t know anybody giving their money to these people. It is other shady companies buying the data about for, shady companies that have collected. All of this is offered to you free of charge.
Mind you, some companies will take your money and still track the shit out of you, show you ads, and sell your data to the highest bidder.
> and sell your data to the highest bidder.
Do they provide a guaratee to only sell once, instead of selling to everyone?
Wouldn’t this header just be another bit of entropy used by companies that are going to stab you anyway?
Without legal backing, yes. If it had that it would have been a very different story.
Well that's one way to take a stab at this problem.
I see someone needs to teach their user-agent how to say "no".
Maybe they could get advice on the best way to do that from these people?: https://news.ycombinator.com/item?id=42169027
Sounds like handlers of the “UPGRADE” verb SHOULD have taken the “WOCK” to Poland.
For some reason, I'm reminded of a particular comic strip from Achewood - https://achewood.com/2007/01/11/title.html.
"Fools! I have invented a usb device which can collect votes from the Internet and drive a knife through your heart!"
This is going to wipe out the saas market
(Sutures As A Service) which is a additional somewhat often used service once Stabbing As A Service has occurred.
unrelated, but pretty cool pronouns, 522
https://www.5snb.club/pronouns/
A big shoutout to those reading the comments who are the direct subjects of this satire.
For those who only skim things, it might be worth scrolling down to read the "Editor Comments" section which is the actual article.
I feel like that section ruins the joke.
Maybe it’s just me, but I fundamentally disagree with the mentality that we should prioritize the “feeling of being special” among those who already get the joke (and corresponding point) at the expense of those who have yet to appreciate the message.
You can still laugh at the joke with the section there, you’ll just have fewer confused people to correct, and be in one less elite club.
Sure, but the point of critical thinking club isn’t really its exclusivity. In this case if you don’t know which specific header this is parodying that’s completely understandable. But if you really think this is about computers stabbing people and can’t laugh at yourself about it when you find out that it isn’t then I don’t think we will be able to engage on this topic in a mutually rewarding manner.
I don’t think it’s about computers stabbing people, but that’s not relevant. The issue is your willingness to keep people in the dark so you can feel good that you got a reference without it being explained.
I bailed before that so thanks for pointing it out. I couldn't agree more, both with the point implied by the RFC and with that directly stated below.
Right. This was just too on point. Thank you for making my night!
> it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more
For Microsoft this also rings true from the opposite direction. Any specification that Microsoft technically abides is implemented in an egregiously dark way (at least for anything consumable at an enterprise level).
They go to great lengths to exercise every bit of leeway permitted by the spec, even when it doesn't make economical sense, because what are you gonna do about it? Vote with your wallet? Against the vendor that runs all your workstations and manages your directories and databases and deployments and authentication and authorization and business intelligence and and and?
No, you're gonna accommodate their absurd counter-requirements because what other choice do you have? The decision then becomes:
1. branch your code to shit with `vendor == microsoft` clauses
2. branch your project/architecture to shit and effectively maintain a Microsoft version alongside the "normal" core version
3. use Microsoft's bespoke library that solves the problem they created
A project that selects option 3 will face the least resistance integrating with Microsoft products, but will also become beholden to arbitrary rules that complicate integration with every other vendor who benevolently implements the standard.
Why a header?
Do a sidedoor as a /do-not-stab.txt
Do-Not-Stab: 1
I'd love for Please-Do-Stab header to exist so I can just set it and with it opt out of any stabbing-anti-stabbing wars and politics.
I fully understand that it's absence wouldn't meant that people won't get stabbed, but it would save time and mental space of all people like me who really don't care about being stabbed or not.
Honestly if anything, I'd like to be stabbed more.
By analogy to current situation about tracking ... Ad companies know too much about me? I think they know too little. For example for half a year they still haven't figured out that I know barely any words in German and are serving me German advertisements all the time just because I happen to be living in Germany currently.
I couldn’t tell if it was intended to be a note-for-note parody of an RFC about the do-not-track header, but I couldn’t find one that would qualify. The closest would be this[1], but it doesn’t cleanly match up (in part because [1] is more verbose and its points scattered).
Another satire RFC in the same spirit is the one about the evil bit[2] (designate one bit in packets to indicate whether it’s intended for evil), with the same subtext as the linked post: no, you can’t trust malicious entities to change their behavior to make it easier to stop.
[1] https://www.w3.org/TR/2019/NOTE-tracking-dnt-20190117/
[2] https://datatracker.ietf.org/doc/html/rfc3514
> it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more, because every company out there fucking hates you and would sell you out to make a bit more money if they legally could. and even if they couldn’t, who’s going to stop them?
Certainly not any government. If you think the EU's regulation are of any help to the consumer you are gravely mistaken. The EU is quickly becoming a fucking nightmare to live in. "The more corrupt the state, the more numerous the laws". The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.
That's what the EU is: probably that some politicians or bureaucrats with enough brain cells to recognize a bottle cap on the ground thought "I've got an idea to make the EU better, let's mandate every bottle to have a cap that cannot be separated from the bottle".
As a result you lay horizontally a plastic bottle of sugary drink in your fridge (because you've been used to do that for decades) and now all your fridge is sticky due to the bottle leaking.
It's all that is wrong with the EU bureaucrats in one example.
Also hailing the EU as the savior vs Microsoft when our lives becames miserable with EU consent cookie popups virtually everywhere is a bit thick.
So the EU is bad because you can't learn to screw on a bottle cap that's different than before?
I am not joining the whole “EU is bad argument”, however the new caps are very annoying, especially the limited benefits they provide.
Honestly yeah. The EU is run entirely by PMC people who don't understand or care about the effect on lower-class and frankly less intelligent people's lives.
Good grief if you’re biggest complaint about why the EU is a nightmare to live in because sometimes you get nasty soda all over your fridge then I think you might need to touch some grass.
No, he needs to learn how to screw on a bottle cap. We keep soda bottles horizontal in our fridge, and they don't leak.
> The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.
I haven't encountered that meme, but if it exists, it's like most memes seem to be: Wrong. The bottle caps work just fine.
The authors are [redacted] Google. Are they actually Google? They seem to unironically complain about what Microsoft is doing, but Google is guilty of the same.
I think the author's entire point is that self-regulation by the big boys is not working very well.
The actual author is one person, user '5225225'
Dude come on