5 ms·

Oh, the irony of this article slamming me in the face with a sleazy "We need your consent" dialog with intentionally confusing options and sub-dialogs... My "c

by jwr 7y ago

Oh, the irony of this article slamming me in the face with a sleazy "We need your consent" dialog with intentionally confusing options and sub-dialogs... My "consent" is being forced out of me so that roughly ~100 (at a first glance) "partners" can invade my privacy and learn about my browsing habits. By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.

fmajid 7y ago
On the positive side, the Quantcast cookie popups now offer a choice between "Accept All" and "Reject All". Previously they offered "Accept All" or "Click here to enter our deliberately confusing rat's warren of options". I wonder if the French DPA's announcement that they will start cracking down on dark patterns like this was the impetus for the change.
- jwr 7y ago
  Well, it's true that this popup was slightly less sleazy and misleading, but it wasn't that great, either. Just for reference (since it is obviously needed), if someone really DOES want to slam readers in the face with a popup as the first thing they see, here is some non-confusing wording: "Do you agree to be tracked using cookies by 134 advertising companies (link to full list)?" Two large buttons: "Yes" "No". Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no.
  - Xelbair 7y ago
    >Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no. Even worse when the switches are made in such way that you have no idea whether you are opting-in or out.
    - thebudgie 7y ago
      Then you click it to test and you've opted in for just a second and it's already too late to go back...
- lima 7y ago
  What about "accept cookies or pay" like some newspapers do? Is that okay?
  - Nursie 7y ago
    No, one must provide the same service with or without tracking.
  - kouh 7y ago
    A visual representation: https://media1.tenor.com/images/3adcbb8cc711b0c9a4cc2e3b90b0dec0/tenor.gif?itemid=9322857 https://media1.tenor.com/images/3adcbb8cc711b0c9a4cc2e3b90b0...
3733782263 7y ago
>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices. I'm sure this stern talking to really made them evaluate their life choices. We need more people on HN to take a stand like this, downvotes be damned. We all have to be the change we want to see.
- allendoerfer 7y ago
  Working with an analytics team, a sentiment I get is: "We have a contract with [analytics company]. They are not allowed to look at the data." When you suggest that a contract might not be as good as physical limitations hosting it yourself give you, they follow up with something like: "Well, then AWS/Azure/etc. could look at it!" What I found drives the increase of tracking on the web in big corporations, is simply the number of teams, who want data. Data is used to play internal politics. And it is easier to get a new vendor in, than to get data from a hostile team.
- aguyfromnb 7y ago
  >We need more people on HN to take a stand like this, downvotes be damned. As the funding dries up the community will close ranks even more so. We are already getting to the point on this forum where anything not outwardly positive (not even "negative") said about certain subjects is instantly donwvoted. Being as how downvoting is something that requires 500 karma, these are not bots or spam accounts; they are veteran members, preventing balanced discourse from occurring ("slow down").
  - 3733782263 7y ago
    I'd say we're well past that point. I gave up ages ago and just spam throwaways now. Dang says it undermines the sense of community when people do that, I think the community already does a fine job of undermining itself.
rezeroed 7y ago
Isn't that what the back button is for? We read too much shit anyway. My preferred method for handling theses popups now is the back button.
raxxorrax 7y ago
Sorry, that has be acquiesced Times Literary Supplement: [...] Reviews were normally anonymous until 1974 [...]
lightswitch05 7y ago
I took a look the domains being used for the consent and saw an interesting JavaScript name: 'messagingWithoutDetection.js'. Looking into it more, I found the documentation [1], there is this disgusting paragraph: > The Dialogue Javascript communicates with the Sourcepoint messaging server on a subdomain of the site. The benefit of doing that is to allow messaging cookies to be “first party” and thus, circumventing Safari’s web browser Intelligent Tracking Prevention (ITP). This creates a discrete messaging channel between the publisher’s messaging subdomain and the Dialogue messaging server. Once you have created the subdomain, you should create a DNS CNAME record to direct traffic to the Sourcepoint messaging endpoint message<account id>.sp-prod.net where the account id refers to you account ID in the Sourcepoint user interface Luckily uBlock Origin now supports blocking on CNAME records and PiHole is rolling support out for it as well. I maintain a blocklist that I use with the PiHole: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/ [1] https://documentation.sourcepoint.com/web-implementation/sourcepoint-set-up-and-configuration-v2 https://documentation.sourcepoint.com/web-implementation/sou...
- rndomsrmn 7y ago
  dnscrypt-proxy is already supporting CNAME blocking and full domain based blocking (*.adhost.com), something that is still missing in Pi-Hole.
  - lightswitch05 7y ago
    Pi-Hole does support regex and wildcard based blocking
    - rndomsrmn 7y ago
      regex is _extremely_ resource inefficient and should not be used with large sets of rules. Dnsmasqs domain redirecting feature (address=/adhost.com/#) is not supported by pihole. Is there any other way to wildcard block full domains in Pi-Hole? Look for example in your list: d41.co, admaster.com.cn, mixmarket.biz chances are extremely slim that all (current) hostnames of those type of domains are currently being blocked.
SkyBelow 7y ago
>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices. I think the logic underlying this sentiment is never consistently applied. Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? Do we call out the other negative results of a person's job (tax money going to a war machine is pretty common for those in the US)? Do we call out the person cooking burgers at the local fast food joint for the effects our fast food consumption has on our health as a whole? Do we call out doctors who are members of groups that limit the supply of doctors, thus increasing prices and resulting in people getting less healthcare coverage? What about the people who are against unions, which may be a factor in why some choose not to risk their job opposing implementing data gathering on their own website?
- hutzlibu 7y ago
  " Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? " I am pretty sure, they thought alotabout the pros and cons of their work and decided a long time ago that the positive outweight the negative a lot. But what is the social positive in intentional programming dark pattern UI? I don't see any.
  - SkyBelow 7y ago
    A few possibilities: Disagreeing it is a dark pattern to begin with. For example, see how many people love opt out consent for organ donation and overlook the consent implications it has in that case. Another example is requiring email address at signup, is that actually needed and is it a dark pattern to not allow a person to sign up until they provide one, even though a more industrial user could give you a fake/temporary email address? Seeing the data as not actually worth protecting and not having an issue with opt out or the like. Thinking those who do care will already be using adblockers and the like. Thinking it would be done regardless if they do it, so why burn what social/political capital they have achieving no difference when they can save it for something that might have an actual impact.
    - 7y ago

by jwr 7y ago

fmajid 7y ago

On the positive side, the Quantcast cookie popups now offer a choice between "Accept All" and "Reject All". Previously they offered "Accept All" or "Click here to enter our deliberately confusing rat's warren of options". I wonder if the French DPA's announcement that they will start cracking down on dark patterns like this was the impetus for the change.

jwr 7y ago
Well, it's true that this popup was slightly less sleazy and misleading, but it wasn't that great, either. Just for reference (since it is obviously needed), if someone really DOES want to slam readers in the face with a popup as the first thing they see, here is some non-confusing wording: "Do you agree to be tracked using cookies by 134 advertising companies (link to full list)?" Two large buttons: "Yes" "No". Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no.
- Xelbair 7y ago
  >Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no. Even worse when the switches are made in such way that you have no idea whether you are opting-in or out.
  - thebudgie 7y ago
    Then you click it to test and you've opted in for just a second and it's already too late to go back...
lima 7y ago
What about "accept cookies or pay" like some newspapers do? Is that okay?
- Nursie 7y ago
  No, one must provide the same service with or without tracking.
- kouh 7y ago
  A visual representation: https://media1.tenor.com/images/3adcbb8cc711b0c9a4cc2e3b90b0dec0/tenor.gif?itemid=9322857 https://media1.tenor.com/images/3adcbb8cc711b0c9a4cc2e3b90b0...

3733782263 7y ago

>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices. I'm sure this stern talking to really made them evaluate their life choices. We need more people on HN to take a stand like this, downvotes be damned. We all have to be the change we want to see.

allendoerfer 7y ago
Working with an analytics team, a sentiment I get is: "We have a contract with [analytics company]. They are not allowed to look at the data." When you suggest that a contract might not be as good as physical limitations hosting it yourself give you, they follow up with something like: "Well, then AWS/Azure/etc. could look at it!" What I found drives the increase of tracking on the web in big corporations, is simply the number of teams, who want data. Data is used to play internal politics. And it is easier to get a new vendor in, than to get data from a hostile team.
aguyfromnb 7y ago
>We need more people on HN to take a stand like this, downvotes be damned. As the funding dries up the community will close ranks even more so. We are already getting to the point on this forum where anything not outwardly positive (not even "negative") said about certain subjects is instantly donwvoted. Being as how downvoting is something that requires 500 karma, these are not bots or spam accounts; they are veteran members, preventing balanced discourse from occurring ("slow down").
- 3733782263 7y ago
  I'd say we're well past that point. I gave up ages ago and just spam throwaways now. Dang says it undermines the sense of community when people do that, I think the community already does a fine job of undermining itself.

rezeroed 7y ago

Isn't that what the back button is for? We read too much shit anyway. My preferred method for handling theses popups now is the back button.

raxxorrax 7y ago

Sorry, that has be acquiesced Times Literary Supplement: [...] Reviews were normally anonymous until 1974 [...]

lightswitch05 7y ago

I took a look the domains being used for the consent and saw an interesting JavaScript name: 'messagingWithoutDetection.js'. Looking into it more, I found the documentation [1], there is this disgusting paragraph: > The Dialogue Javascript communicates with the Sourcepoint messaging server on a subdomain of the site. The benefit of doing that is to allow messaging cookies to be “first party” and thus, circumventing Safari’s web browser Intelligent Tracking Prevention (ITP). This creates a discrete messaging channel between the publisher’s messaging subdomain and the Dialogue messaging server. Once you have created the subdomain, you should create a DNS CNAME record to direct traffic to the Sourcepoint messaging endpoint message<account id>.sp-prod.net where the account id refers to you account ID in the Sourcepoint user interface Luckily uBlock Origin now supports blocking on CNAME records and PiHole is rolling support out for it as well. I maintain a blocklist that I use with the PiHole: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/ [1] https://documentation.sourcepoint.com/web-implementation/sourcepoint-set-up-and-configuration-v2 https://documentation.sourcepoint.com/web-implementation/sou...

rndomsrmn 7y ago
dnscrypt-proxy is already supporting CNAME blocking and full domain based blocking (*.adhost.com), something that is still missing in Pi-Hole.
- lightswitch05 7y ago
  Pi-Hole does support regex and wildcard based blocking
  - rndomsrmn 7y ago
    regex is _extremely_ resource inefficient and should not be used with large sets of rules. Dnsmasqs domain redirecting feature (address=/adhost.com/#) is not supported by pihole. Is there any other way to wildcard block full domains in Pi-Hole? Look for example in your list: d41.co, admaster.com.cn, mixmarket.biz chances are extremely slim that all (current) hostnames of those type of domains are currently being blocked.

SkyBelow 7y ago

>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices. I think the logic underlying this sentiment is never consistently applied. Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? Do we call out the other negative results of a person's job (tax money going to a war machine is pretty common for those in the US)? Do we call out the person cooking burgers at the local fast food joint for the effects our fast food consumption has on our health as a whole? Do we call out doctors who are members of groups that limit the supply of doctors, thus increasing prices and resulting in people getting less healthcare coverage? What about the people who are against unions, which may be a factor in why some choose not to risk their job opposing implementing data gathering on their own website?

hutzlibu 7y ago
" Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? " I am pretty sure, they thought alotabout the pros and cons of their work and decided a long time ago that the positive outweight the negative a lot. But what is the social positive in intentional programming dark pattern UI? I don't see any.
- SkyBelow 7y ago
  A few possibilities: Disagreeing it is a dark pattern to begin with. For example, see how many people love opt out consent for organ donation and overlook the consent implications it has in that case. Another example is requiring email address at signup, is that actually needed and is it a dark pattern to not allow a person to sign up until they provide one, even though a more industrial user could give you a fake/temporary email address? Seeing the data as not actually worth protecting and not having an issue with opt out or the like. Thinking those who do care will already be using adblockers and the like. Thinking it would be done regardless if they do it, so why burn what social/political capital they have achieving no difference when they can save it for something that might have an actual impact.
  - 7y ago