4 ms·
In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing brow
by burke 6y ago
In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing browser vendors to provide more visibility into and control over (especially third-party) cookies.
Instead, we have a banner you have to interact with as the price to visit pretty much any website.
- rafram 6y agoI don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.
- contravariant 6y agoI mean sure, but technically you already have that choice. It's entirely up to you whether to keep, discard or modify cookies. Your user agent is doing a bad job of managing this for you.
- wlll 6y agoGDPR isn't a cookie law, it's a data privacy law. Cookies aren't the problem, it's what people are doing with the data that's the issue. You can track people with all sorts of other means other than cookies, you would also need to get people's permission to do this.
- contravariant 6y agoWe were specifically discussing the cookie banners though.
- wlll 6y agoYes, but in the context of GDPR, which doesn't really go into detail about cookies, "…throughout its’ 88 pages, it only mentions cookies directly once" - https://gdpr.eu/cookies/ https://gdpr.eu/cookies/. The issue is handling of PII, tracking users and the hoops companies are jumping through to try to trick users into agreeing to allow this. In reality forcing users to select through the myriad of cookies that many sites set isn't practical, and doesn't get round the fact that you still would have to "Receive users’ consent before you use any cookies except strictly necessary cookies." A better technical solution would be to enforce that web applications respect a client header that specifies the level of cookies the client will allow (see https://gdpr.eu/cookies/ https://gdpr.eu/cookies/). An even better solution to this would be to stop the invasive tracking and profiling of users that has brought us to this point at all.
- jeofken 6y agoA HTTP response may ask the user agent to keep a cookie. The user agent is free to do so, reject it, or ask the user (as Konqueror did). It is not the responsibility of everyone responding to HTTP requests to ask to ask “I ask you if I can ask you to keep this cookie”. Remembering that HTTP is a format of messages being sent between people, it’s clear to me that this law is unwise. Likely written by Eurocrats who don’t understand HTTP.
- rafram 6y agoIn principle, yes, but if a browser asks a non-technical user whether they want to accept a cookie called "__Secure-3PAPISID" (an actual Google tracking cookie) with gibberish contents, what are they supposed to say? How can they understand what that means?
- jeofken 6y agoIt’s true that those who don’t understand what a HTTP cookie is, are unable to make informed decisions about them. Forcing those who reply to HTTP messages to ask if they can send a header asking if they can save a cookie does not change that - the user who clicks the cookie popup may still now understand what they do. Many do understand things like private mode though, which is nice.
- burke 6y agoIn this analogy though, browsers really feel more analogous to roads and sites to cars to me, rather than the other way around, being the common infrastructure on which the other operates.
- knorker 6y agoWhy is it the responsibility of a host to provide labour for free? If you don't accept the price of admission, then just don't go in. Say I have a dress code at my club. You don't have the right to a "meaningful choice" of wearing flip flops and shorts and still enter my property. I don't have the right to a meaningful choice of bypassing paywall either.