13 ms·
A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on
by dessant 6y ago
A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers".
GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint.
GitHub's claims about not tracking users are false, they do identify users in tracking requests. See this tracking URL, it's full of unique identifiers and personal data, and it is currently sent after every page load, without user consent:
https://collector.githubapp.com/github/page_view?dimensions[page]=https://github.com/&dimensions[title]
=GitHub&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[user_agent]=Mozilla/5.0
(X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0&dimensions[screen_resolution]=1000x518&dimensions[pixel_ratio]
=1&dimensions[browser_resolution]=1000x518&dimensions[tz_seconds]=0&dimensions[timestamp]
=1608247177900&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[request_id]=
9CF8:4938:4516EA:5FD134:5FDBE77E&dimensions[visitor_id]=6475638196559144773&
dimensions[region_edge]=fra&dimensions[region_render]=iad&&measures[performance_timing]=
1---600-600-600-400-400-----600-0----1608247177200--1608247176900--1608247176900--400-
400&&dimensions[actor_id]=47727044&dimensions[actor_login]=dessantbot&dimensions[actor_hash]=
a274a9ae03a3b361483e273a53aba70534c609670c058fe667d8bce4d6f33bad&dimensions[cid]=1507727009.1608247109
[1] https://www.theregister.com/2020/12/17/github_will_no_longer_present/ https://www.theregister.com/2020/12/17/github_will_no_longer...
- 867-5309 6y agothis isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. "visiting our website does not send any information to third-party analytics services" - but presumably third parties are still able to access this data on request. their privacy policy probably reflects this. if you visit a website and don't want to be tracked, make it as hard as possible for the host to do so, don't rely on what the host says. they can do anything they like with visitors' data. anyone who hosts websites will confirm this
- dessant 6y agoYes, they can do anything with the user's data, if the user has consented, or if they are willing to break the law. The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.
- 867-5309 6y agoconsent is simple to gain, who reads the entire ToS and privacy policy? the law is simple to break and appear as if you're not. they're a big company and will have this covered if needed the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself
- dessant 6y ago> consent is simple to gain, who reads the entire ToS and privacy policy? That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service. > the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself The request can be blocked with uBlock Origin, but it's still important to draw attention to tracking that may be illegal, since not everyone has a content blocker installed.
- 867-5309 6y agoif you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise
- dessant 6y agoMentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#Five_Elements_Of_Consent_Under_The_Gdpr https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
- dang 6y agoI had to put some newlines in that monstrous link because it was breaking the page layout (sorry; it's our bug).
- nicky0 6y agoYou're talking about GitHub monitoring what signed-in GitHub users do on the GitHub website, right?