5 ms·

Just don't use sites that dont respect your privacy. If it doesn't like you blocking cookies, walk away.

by tfha 7y ago

TylerE 7y ago
So, don't use the internet? Because that's what you're describing. Better cut the power cord, too, just to be safe.
- toby- 7y ago
  Plenty of sites respect user privacy. I should know; I run dozens of them.
  - coldtea 7y ago
    Define plenty. Are among those "plenty" the actual important pages that people want to use? Or some irrelevant pages here and there? And how do you know there are plenty? In fact, even if it is so, how can anyone verify that, even just about your sites? We can merely just trust you.
    - liability 7y ago
      Most of the articles I click through to from HN work just fine with all JS, including first party, blocked by uMatrix.
    - hueving 7y ago
      >the actual important pages that people want to use? Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile?
      - coldtea 7y ago
        >Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile? Or, as I like to call it, pragmatic. Visits are a power law distribution, 80% of people's visits go to 20% of sites, and so on, recursively. s So unless e.g. the top 1000 (which may vary depending on country) people want to use are there, e.g. the social media, news sites, booking, video, shopping sites, banking sites, you're just talking about a number of niche websites. Sites that "still work with JS disabled" are in the minority on those lists. Essentially you're saying "don't use all those sites with the content/services you want", use all those others that don't have tracking (but which you don't really care for). E.g. pointing to Diaspora vs Facebook... The best I've seen people come up with on this front is DDG vs Google.
        half-kh-hacker 7y ago
        > Sites that "still work with JS disabled" are in the minority on those lists. You'd be surprised how many sites are still viewable without JS enabled.
        oefrha 7y ago
        You’d be surprised how many sites are more viewable without JS enabled.
        liability 7y ago
        Damn straight! Disabling JS fixes more websites than it breaks.
  - TylerE 7y ago
    There are plenty of ways to track that involve zero javascript.
  - aasasd 7y ago
    I feel like this is a reference to ‘Arrested Development.’
    - hinkley 7y ago
      And if it is not, it should be. DOZENS.
    - toby- 7y ago
      Haha, it was indeed my inspiration. But it's also true! Dozens! :)
  - stiray 7y ago
    If plenty is "a few" than I would agree (and I am glad you respect privacy). I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. In most cases they just give you fake impression they respect privacy (by setting banner to "opt-out" (which is violation on its own) after the tracking 3rd party scripts are already loaded). The whole privacy deal on the web just shows moral corrosion. It is putting IT neck to neck with scammers.
    - mikekchar 7y ago
      > I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. I think the reason you can't find one is likely because you are disqualifying all the ones that aren't violating it. There a lots of websites that don't violate GDPR: they don't record any information. Perhaps we can quibble about server logs and whether or not IP addresses are PII, but let's stick to at least the broad strokes here since you are saying all sites blatantly violate GDPR. I think what you are probably trying to say is that amongst the websites that are trying to harvest your data, (virtually) all of them do so in a way that violates GDPR. This is not surprising to me, because at its heart GDPR is trying to encourage companies not to harvest personal information. I don't think we will ever get around that. The question is not whether or not many (most? virtually all?) companies will try to get around GDPR (they will). The question is whether or not GDPR will have an positive influence on the use of private data. I can say in the company I do work for, it has completely transformed how we deal with PII. We now actually have gatekeepers that tell marketing what they can and can't have access to. If there are problems, then people actually get chewed out and we put real, emergency resources into fixing them. I mean it is absolutely night and day. For us there is always this fight between people and departments that would like unrestricted access to information and people who are protecting it. Without GDPR, there was no defense! There was no argument you could make -- "It's wrong!" "By whose definition? The lawyers are fine with it" Now we can legitimately say, "You can't legally do that". Not only that, but I've even had marketing managers being very concerned that we might be handling data incorrectly. I've never, ever seen that before in my 30 year career. Yeah, there are lots of problems and I don't see them going away ever, but man GDPR is really helping in a lot of areas.
- deathanatos 7y ago
  I whitelist cookies; only sites that I have a known relationship to (e.g., HN, for login) get to set cookies. The overwhelming majority of the web still works just fine. It's trivial to pick out what doesn't, as it either tends to: a. require cookies for some inane task that doesn't need them, and it tells me this b. breaks horribly. Typically, JS trying to access LocalStorage, but not checking whether the call was successful or not. The grandparent is also wrong about, > Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. No, or you're whitelisting all or third-party cookies. (The latter being significantly easier to do, and causes much less breakage. I don't think I've ever seen a third-party cookie cause breakage.) N.b., I'm not necessarily recommending what I do to others; it takes a lot of work, and I really need better tooling around my flow. But it gives me the context on how cookies/persistence causes or does not cause site breakage.
  - pferde 7y ago
    Or you can just freely allow all cookies from any website that wants to set them (sites will be happy and working), but only for current browser session. You have to remember to restart the browser every now and then, though. Then use whitelist to selectively allow cookies from some "friendly" sites to be stored permanently.
    - CaptainZapp 7y ago
      I clear all browser data upon exit. Overkill? Maybe, but it works for me.
    - the_duke 7y ago
      If the intent is no tracking, then this defeats the purpose. Often the browser stays open for hours and you'll have identifying tracking cookies very quickly. A great, really underused feature in Firefox is first party cookie isolation: it isolates all cookies set by a site to the same domain, preventing all cross site tracking. Set privacy.firstparty.isolate to true in about:config. Some more info: https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox/ https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...
tomjen3 7y ago
I highly recommend Temporary Containers for Firefox. It can be set up so that every time you open a new tab, that is a new context, new logins, new cookies. No reason to block sites that set cookies, since in a few minutes they will be deleted anyway.
- thiagomgd 7y ago
  that's something I miss in chrome/opera

Just don't use sites that dont respect your privacy. If it doesn't like you blocking cookies, walk away.

by tfha 7y ago

Just don't use sites that dont respect your privacy. If it doesn't like you blocking cookies, walk away.

TylerE 7y ago

So, don't use the internet? Because that's what you're describing. Better cut the power cord, too, just to be safe.

toby- 7y ago
Plenty of sites respect user privacy. I should know; I run dozens of them.
- coldtea 7y ago
  Define plenty. Are among those "plenty" the actual important pages that people want to use? Or some irrelevant pages here and there? And how do you know there are plenty? In fact, even if it is so, how can anyone verify that, even just about your sites? We can merely just trust you.
  - liability 7y ago
    Most of the articles I click through to from HN work just fine with all JS, including first party, blocked by uMatrix.
  - hueving 7y ago
    >the actual important pages that people want to use? Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile?
    - coldtea 7y ago
      >Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile? Or, as I like to call it, pragmatic. Visits are a power law distribution, 80% of people's visits go to 20% of sites, and so on, recursively. s So unless e.g. the top 1000 (which may vary depending on country) people want to use are there, e.g. the social media, news sites, booking, video, shopping sites, banking sites, you're just talking about a number of niche websites. Sites that "still work with JS disabled" are in the minority on those lists. Essentially you're saying "don't use all those sites with the content/services you want", use all those others that don't have tracking (but which you don't really care for). E.g. pointing to Diaspora vs Facebook... The best I've seen people come up with on this front is DDG vs Google.
      - half-kh-hacker 7y ago
        > Sites that "still work with JS disabled" are in the minority on those lists. You'd be surprised how many sites are still viewable without JS enabled.
        oefrha 7y ago
        You’d be surprised how many sites are more viewable without JS enabled.
        liability 7y ago
        Damn straight! Disabling JS fixes more websites than it breaks.
- TylerE 7y ago
  There are plenty of ways to track that involve zero javascript.
- aasasd 7y ago
  I feel like this is a reference to ‘Arrested Development.’
  - hinkley 7y ago
    And if it is not, it should be. DOZENS.
  - toby- 7y ago
    Haha, it was indeed my inspiration. But it's also true! Dozens! :)
- stiray 7y ago
  If plenty is "a few" than I would agree (and I am glad you respect privacy). I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. In most cases they just give you fake impression they respect privacy (by setting banner to "opt-out" (which is violation on its own) after the tracking 3rd party scripts are already loaded). The whole privacy deal on the web just shows moral corrosion. It is putting IT neck to neck with scammers.
  - mikekchar 7y ago
    > I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. I think the reason you can't find one is likely because you are disqualifying all the ones that aren't violating it. There a lots of websites that don't violate GDPR: they don't record any information. Perhaps we can quibble about server logs and whether or not IP addresses are PII, but let's stick to at least the broad strokes here since you are saying all sites blatantly violate GDPR. I think what you are probably trying to say is that amongst the websites that are trying to harvest your data, (virtually) all of them do so in a way that violates GDPR. This is not surprising to me, because at its heart GDPR is trying to encourage companies not to harvest personal information. I don't think we will ever get around that. The question is not whether or not many (most? virtually all?) companies will try to get around GDPR (they will). The question is whether or not GDPR will have an positive influence on the use of private data. I can say in the company I do work for, it has completely transformed how we deal with PII. We now actually have gatekeepers that tell marketing what they can and can't have access to. If there are problems, then people actually get chewed out and we put real, emergency resources into fixing them. I mean it is absolutely night and day. For us there is always this fight between people and departments that would like unrestricted access to information and people who are protecting it. Without GDPR, there was no defense! There was no argument you could make -- "It's wrong!" "By whose definition? The lawyers are fine with it" Now we can legitimately say, "You can't legally do that". Not only that, but I've even had marketing managers being very concerned that we might be handling data incorrectly. I've never, ever seen that before in my 30 year career. Yeah, there are lots of problems and I don't see them going away ever, but man GDPR is really helping in a lot of areas.
deathanatos 7y ago
I whitelist cookies; only sites that I have a known relationship to (e.g., HN, for login) get to set cookies. The overwhelming majority of the web still works just fine. It's trivial to pick out what doesn't, as it either tends to: a. require cookies for some inane task that doesn't need them, and it tells me this b. breaks horribly. Typically, JS trying to access LocalStorage, but not checking whether the call was successful or not. The grandparent is also wrong about, > Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. No, or you're whitelisting all or third-party cookies. (The latter being significantly easier to do, and causes much less breakage. I don't think I've ever seen a third-party cookie cause breakage.) N.b., I'm not necessarily recommending what I do to others; it takes a lot of work, and I really need better tooling around my flow. But it gives me the context on how cookies/persistence causes or does not cause site breakage.
- pferde 7y ago
  Or you can just freely allow all cookies from any website that wants to set them (sites will be happy and working), but only for current browser session. You have to remember to restart the browser every now and then, though. Then use whitelist to selectively allow cookies from some "friendly" sites to be stored permanently.
  - CaptainZapp 7y ago
    I clear all browser data upon exit. Overkill? Maybe, but it works for me.
  - the_duke 7y ago
    If the intent is no tracking, then this defeats the purpose. Often the browser stays open for hours and you'll have identifying tracking cookies very quickly. A great, really underused feature in Firefox is first party cookie isolation: it isolates all cookies set by a site to the same domain, preventing all cross site tracking. Set privacy.firstparty.isolate to true in about:config. Some more info: https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox/ https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...

tomjen3 7y ago

I highly recommend Temporary Containers for Firefox. It can be set up so that every time you open a new tab, that is a new context, new logins, new cookies. No reason to block sites that set cookies, since in a few minutes they will be deleted anyway.

thiagomgd 7y ago
that's something I miss in chrome/opera