12 ms·

Dumb question - I always come on HN, where lots of web devs hang out, and see people decrying dark patterns. So who builds this stuff? Where are the devs defend

Dumb question - I always come on HN, where lots of web devs hang out, and see people decrying dark patterns. So who builds this stuff? Where are the devs defending it? Or do they just take a check and keep quiet?

omgitsabird 5y ago
Maybe they attempt to comply with regulation that is often confusingly worded and written by people who are not human computer interaction experts.
- geewee 5y ago
  I've done a lot of compliance work, and the laws are _very clearly_ worded. This is definitely a case of "let's see what we can get away with"
  - franciscop 5y ago
    Exactly, I don't know what people are saying (well, I smell an agenda) but the GDPR is the easiest "specification" I've read.
    - arkh 5y ago
      But if you can't be bothered to read a RFC, 40ish pages of GDPR will be too much for you. You've got code to write, reading and learning is for schmucks.
    - usr1106 5y ago
      These fines have nothing to do with GDPR. GDPR introduced one stop shopping with EU for data controllers. Google does that in Ireland. GDPR is a regulation, legally binding all over EU. And for others offering services to EU residents, although that's probably unenforcable. When they get fined in France the basis is a French law. Probably a law to implement an EU directive. The cookies directive (don't remember the official name) is older than and different from GDPR.
  - LunaSea 5y ago
    This is wrong. The GDPR is anything but clear.
    - chmod775 5y ago
      What specifically isn't clear to you?
      - LunaSea 5y ago
        Situations like needing signed pre-approval of all your customers in a data controller position or giving the possibility to refuse when you act as a sub processor and need to update your own subprocessors.
        vntok 5y ago
        What isn't clear about these situations?
        LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
        avianlyric 5y ago
        That sounds pretty clear cut to me. Sounds like a pain to implement, but the requirements are simple enough.
        LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
        5y ago
- Thiez 5y ago
  Oh please. One might argue that the GDPR is a bit vague on some points, but it is very readable for ordinary people, and it clearly states that opting out should not be harder than opting in. So no, these dark patterns that push you into accepting by introducing extra friction for users that reject tracking (by adding artificial delays, having a lot of manual clicking to opt-out, etc) are not a case of genuine confusion. The people who build this functionality are just assholes.
  - omgitsabird 5y ago
    This article is about the French Data Protection Act, not GDPR. They might be lex specialis, I don't know. I am just giving a benefit of the doubt that it is a more difficult problem than people make it out to be. I skimmed this [paper](https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Perspective%20on%20Digital%20Consenting_The%20Case%20of%20GAFAM_Soheil%20Human_Florian%20Cech.pdf https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Pe...) which, among its main topic, argues the issue being intentional and ubiquitous, but I am unconvinced.
    - dmitriid 5y ago
      French Data Protection Act has been around since 1978. And was amended in 2018. GDPR (which is basically all such acts from across EU in one legislation) has been around since 2016. If in 2021 your company pretends not to understand the law, your company deserves to be sued into oblivion
      - 123pie123 5y ago
        From my understanding GDPR and all other EU wide ideas or "Laws" are issued as Directives, each country then has to implement the directives in their own countries laws. some/ most implement directives in cut and paste manner some don't.
        detaro 5y ago
        > GDPR and all other EU wide ideas or "Laws" are issued as Directives, No. The fact that the last letter in "GDPR" is not "D" is a pretty good hint that it's not a Directive ;) It's a Regulation. Regulations apply directly, and are not translated into local law. But omgitsabird is correct that GDPR is not the relevant basis here, but a clause in French Data Protection Law. And this clause exists because of the ePrivacy Directive.
123pie123 5y ago
depends on the person(s) or company creating the site, for larger companies, there'll be various people who would have a say on how the site works or flows, eg marketing people, UX, graphic designers, architects, product owners etc... Not just developers each these people may have a different viewpoint on what they want to happen and why
jabej 5y ago
I haven’t built any of those, but I feel like the cookie law is profoundly stupid and I think that it’s fair to punish users for their bad voting choices. If you want to block third party cookies you have always had a switch there in your browser options.
- dmitriid 5y ago
  In the absolute vast majority of cases those popup banners are illegal under the rather straightforward and unequivocal law. If 5 years after GDPR went into effect you still don't know what it is and why it exists, your company deserves to be sued into oblivion.
- robin_reala 5y ago
  Many third parties are now relying on information forwarded to them through first party systems and cookies. This forces sites to isolate those and provide a way of disabling the flow of personal data regardless.
- Semaphor 5y ago
  It’s neither a cookie law, nor about cookies. It’s about tracking and is far more comprehensive. The adtech industry is just engaging in collaborative gaslighting and very successful at it.
franciscop 5y ago
IMHO there are multiple moral boundaries, and making a dark pattern like requiring an extra click to reject cookies is unlikely a hill to die on for most devs. They might complain to their manager, even log a formal notice that they believe this feature to be breaking the law (if they are smart), but quitting a company for this specific dark pattern seems a bit unusual.
- efficientsticks 5y ago
  There’s a lot of selection bias, since a great many developers who would quit when asked to brazenly disregard privacy also wouldn’t interview at Google or Facebook in he first place. There’s a lot of a-moralistic attitude towards FAANG on Hacker News, which honestly I find strange; Google and Facebook in particular are just giant douchebags with lots of cash. https://goomics.net/339/ https://goomics.net/339/
  - JeremyNT 5y ago
    This is huge, there are a ton of us out here writing software at non-profits, edus, etc., willingly making much less because we don't want to ever be involved. FAANG (and any VC funded company that touches ad revenue) is already selecting for developers who are willing to overlook these kinds of things. It's one of the reasons why they need to pay people so much more.
  - deleted 5y ago
    [deleted]
jack_pp 5y ago
The question isn't who builds it but who orders it. Would you leave your job just to fight back against this particular dark pattern? Do you ask about this dark pattern in interviews in order to make a decision about a potential employer?
- sjtindell 5y ago
  Good point. Especially if they tell me we’ll get $X more revenue and my RSUs will be worth that much more…not sure I would say anything to be honest. Although I feel some shame saying that.
- alkonaut 5y ago
  Yes and yes. People shouldn’t have to though. Instead the regulation should be set up to make it a legal risk to aid in breaking the regulation too.
- thrwyoilarticle 5y ago
  It wouldn't need to be individual action if we just made a union.
- Aachen 5y ago
  What do you mean leave your job? If I tell my boss that doing xyz is illegal and he doesn't dispute it, I'm absolutely certain he would not ask me to implement it. Certainly there will be shittier bosses that will ask anyway, demand it, and perhaps even go so far as to fire someone for not violating the law, but I should hope those in the last category are few and far between and there would be internal and/or external outcry over it. Even if you have a boss that wants to fire you over it and nobody cares internally or externally (I'd find this situation very unlikely), you'd still get unemployment benefits / severance / whatever is typical in your jurisdiction, since you were fired rather than choosing to leave yourself.
  - pydry 5y ago
    Most dark patterns arent illegal. Theyre just morally dubious.
beingflo 5y ago
Probably comes down to two factors: - Only a tiny fraction of all web devs read HN - If business wants something done, the devs are rarely in a position to oppose the decision
Starlevel001 5y ago
This site fetishises money over morals to a disturbing degree, so yes, they are just taking a cheque and keeping quiet.
hetspookjee 5y ago
@jefftk seems an avid and vocal defender of the advertisement business so perhaps he likes to chime in on why the patterns are as they are?
- tempodox 5y ago
  I don't know about the user you mentioned, but the “why” is patently clear: Tricking and bullying users into being the milking cows of the surveillance economy.
  - hetspookjee 5y ago
    I feel the same, but I am genuinely curious to hear from someone that genuinely feels the other way.
mierz00 5y ago
I have had to build things I consider to be dark patterns. Normally, it goes something like this: 1. Client asks for something that is a dark pattern. 2. I outline that it is morally questionable to do that and give a suggestion on how it can be done otherwise. 3. Client insists that they don’t care or don’t agree because they feel as it will bring in more money. 4. I end up building it. I do have the choice to outright say no, but I’ve found that it normally comes down to a compromise. Some clients are not willing to budge but we can always steer them in the right direction.
- alkonaut 5y ago
  So the solution here would be a fine that is also affecting the developer. Knowinbly aiding in breaking a law is usually frowned upon. “I did what they said because they won’t pay me otherwise” usually doesn’t fly. I understand it’s hard to say no but it would perhaps be easier to say “we’ll build that but it’ll cost you 5x more because we would be taking a legal risk”. Making the option to follow the regulation cheaper has to be the goal.
  - moduspol 5y ago
    Maybe imprisonment would be better. Just a few years to teach the lesson. I mean this developer knowingly aided in getting users to see more targeted ads!
    - kuschku 5y ago
      We're calling ourselves software engineers, maybe we should have personal liability like professional engineers then as well.
      - madeofpalk 5y ago
        I definitely do not call myself an engineer. I make glorified blogs.
    - alkonaut 5y ago
seaman1921 5y ago
the unpopular opinion, however well presented, gets heavily downvoted so there is no incentive for them to share their views - healthy discussions are rare.
AtNightWeCode 5y ago
I have implemented things that are illegal. I objected against it in meetings, and it was one of the reasons I left that company. What exactly are you supposed to do as a developer? In general, I think all these trickster managers are just making things harder for everybody. It often feels like their decisions are based on a mindset rather than something that they can back up with real data.
- Aachen 5y ago
  > What exactly are you supposed to do as a developer? I don't quite understand what you're trying to say. If you were asked to kill someone, clearly you wouldn't say "what are you supposed to do anyway" and go off to find a murder weapon since the answer there is rather obvious. What makes being asked to violate a different law different? (Assuming you find the request morally objectionable, I've probably violated laws that I thought were counterproductive for everyone.)
  - virgilp 5y ago
    Because it _is_ different. If you asked me to kill someone for 1 Mil. $, I wouldn't do it. If you asked me to drive 20km/h faster than the legal limit for 10K $, I wouldn't even blink, it's a easy choice. Now, how severe is this? You're not a lawyer, you can bring it up, and the company lawyers (that are paid maybe more than you are) say they reviewed the spec and it's legal. What standing do you have, as a developer, to say "no it's not legal, I won't do it!". Do you really know better than the lawyers? [edit] > If you were asked to kill someone, clearly you wouldn't say "what are you supposed to do anyway" and go off to find a murder weapon since the answer there is rather obvious. What if you were a soldier? Or a drone pilot? Is the answer still obvious?
    - Aachen 5y ago
      > company lawyers [say] they reviewed the spec and it's legal. [...] Do you really know better than the lawyers? I'd be very surprised if anyone thought this was clearly legal after reading the law. But yeah, that would be a valid answer to the question: legal team says it's legal. If something is legal, you cannot be prosecuted for it, and you can have some reasonable confidence in lawyers reading the law and providing legal council correctly. However, you were saying "I have implemented things that are illegal. I objected against it in meetings", so I was more thinking from the scenario where everyone knows it's illegal but the dev is asked to do it anyway. Presumably not even explicitly, just implicit "we need this feature" without ever bringing up "and we know it's illegal, but if you want to keep your healthcare..."
durnygbur 5y ago
Who creates malicious software, hijacking websites, computer viruses? There exist morally murky demographics in every profession, and it's mostly for money otherwise not available to them.
- Aachen 5y ago
  Typically those people are prosecuted though, or at least they know to expect it. I don't think it's the same situation here.
olalonde 5y ago
> Or do they just take a check and keep quiet? I think so. There are many devs who are against government regulating the web and will happily code around them. HN is pro regulations so it's either keep quiet or get down voted to hell.
1337shadow 5y ago
If you don't then a less competent developer might do it, increasing risks even moreso.
- hackerfromthefu 5y ago
  Or .. fail in doing it ..
- sailingparrot 5y ago
  Increasing risk of what exactly ? Since you are already doing it anyway ? The original saying (that I don’t necessarily agree with) is not about competence but about ethics: if every ethical person refuses to work in weapon manufacturing/ advertising / whatever is deemed morally unacceptable, then the only people that will do it are people with no morals and we will be worse off as a society. So really, in this case the person just shutting up and doing it is already the worse fallback.
vanusa 5y ago
They're here of course, and they're reading along with the rest of us. And they're thinking: "Yup, that's me. That's my handiwork, my impact on the world." And then they think: "But what can you do? R&V, R&V, R&V ..." As in: rest & vest
deleted 5y ago
[deleted]
willcipriano 5y ago
Front end folks are more on Reddit/Twitter and the like in my experience.
Sebb767 5y ago
I actually implemented one of those. It's not as bad as the Google one, but still asymmetrical (accept is just a large button and reject is small, non-highlighted text next to it). The customer in this case was rather non-technical and just wanted his tracking, so he wanted to have it like everyone else does. I/We actually told him very clearly that this is most likely illegal and talked it down a notch (from having "reject" hidden in the text), but he said he checked that with legal and we should do it. Loosing the customer over this was really not worth it (especially since this is basically the way cookie dialogs are done everywhere), so we did what he asked, with our asses covered in case it backfires. I might send him this case, though. On a side note, it was really hard to implement the cookie dialog correctly so that it only loads Google Analytics and our tracking when ok is clicked. We thought this was a solved problem, but nope. Especially when you want to delete cookies when consent is revoked. I would not be surprised at all if most dialogs actually don't work at all.
dgellow 5y ago
You can be paid for the task and keep quiet, or be paid for the same task and still complain online about it. You don't have to be aligned with the company that employs you, and a lot of workers aren't. Often what happens is that someone (hopefully you) will raise the issue internally, but if the company decided to ignore regulations and take the risk of legal punishment, well it's not an engineer that will be able to stop it from being implemented. Hopefully such fines will make product owners and upper management consider the problem more seriously, but I wouldn't bet on it.
kingcharles 5y ago
Done this several times. It's always been when I've had to take paid employment between building and failing at my own startups. I will always argue up and down with the client and almost always will get significant reduction in the nastiness of whatever thing they were trying to do, through education. I think a lot of this dark patterns would be even darker but for the push-back by some developers. Though I've been at companies where some workers are like robots and will carry out management's desires down to a T, even when the idea is total insanity. Some workers are immigrants who cannot afford to lose their employment or they will be thrown out of the country and potentially lose their partner and children. When I have to work on my own projects, I generally avoid all dark patterns - I try to go as far in the opposite direction as possible, while still generating revenue. Though, with the torrent site I built once, it was "Anything Goes". You're already running an illegal site, might as well write something that bleeds the users dry if you can. EDIT: I want to add that most of it was down to lack of technical knowledge by management. They were business guys who didn't know the Web. Most of the time they weren't trying to be assholes, it just appeared that way.
LNSY 5y ago
They just take a check and keep quiet. These types of engineers will also build stupid stuff that doesn't work, because that's what the specification written by a group of business people who have never even looked at code before said. It's also why frameworks like React are popular.
xwolfi 5y ago
I've implemented 1000+% payday loan promotion in Mexico, with credit score check etc, stuff I find absolutely abject myself. I don't think I cared much: if it's not illegal, I do it, even if it's "immoral". Especially in remote jurisdictions I have interest to see fail miserably rather than succeed. It's a bit sad, but each time you try to be nice and friendly, you get "raped" I feel, so well, might as well make some money off of some people to pay for when we get scammed ourselves.
anticristi 5y ago
My experience is that devs generally lack the desire and expertise to read and interpret legal texts. According to GDPR isn't not their job either. Each company needs to employ or hire a Data Protection Officer (DPO) who is responsible for keeping track of data protection regulations and ensuring they are applied company-wide. IMHO, as long as devs weren't trained on cookie law, they are not morally responsible.
Sephr 5y ago
A proper solution to this problem requires a completely new perspective. I made a client side firewall-esque library for Transcend Consent Manager so that site owners can load trackers immediately and locally quarantine tracking events for replay once consented. This makes it possible to track like before but move the annoying cookie banner into an integrated UI so that site owners can ask for consent when the user is more invested in the site (e.g. during signup/checkout).

omgitsabird 5y ago

Maybe they attempt to comply with regulation that is often confusingly worded and written by people who are not human computer interaction experts.

geewee 5y ago
I've done a lot of compliance work, and the laws are _very clearly_ worded. This is definitely a case of "let's see what we can get away with"
- franciscop 5y ago
  Exactly, I don't know what people are saying (well, I smell an agenda) but the GDPR is the easiest "specification" I've read.
  - arkh 5y ago
    But if you can't be bothered to read a RFC, 40ish pages of GDPR will be too much for you. You've got code to write, reading and learning is for schmucks.
  - usr1106 5y ago
    These fines have nothing to do with GDPR. GDPR introduced one stop shopping with EU for data controllers. Google does that in Ireland. GDPR is a regulation, legally binding all over EU. And for others offering services to EU residents, although that's probably unenforcable. When they get fined in France the basis is a French law. Probably a law to implement an EU directive. The cookies directive (don't remember the official name) is older than and different from GDPR.
- LunaSea 5y ago
  This is wrong. The GDPR is anything but clear.
  - chmod775 5y ago
    What specifically isn't clear to you?
    - LunaSea 5y ago
      Situations like needing signed pre-approval of all your customers in a data controller position or giving the possibility to refuse when you act as a sub processor and need to update your own subprocessors.
      - vntok 5y ago
        What isn't clear about these situations?
        LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
      - avianlyric 5y ago
        That sounds pretty clear cut to me. Sounds like a pain to implement, but the requirements are simple enough.
        LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
        5y ago
Thiez 5y ago
Oh please. One might argue that the GDPR is a bit vague on some points, but it is very readable for ordinary people, and it clearly states that opting out should not be harder than opting in. So no, these dark patterns that push you into accepting by introducing extra friction for users that reject tracking (by adding artificial delays, having a lot of manual clicking to opt-out, etc) are not a case of genuine confusion. The people who build this functionality are just assholes.
- omgitsabird 5y ago
  This article is about the French Data Protection Act, not GDPR. They might be lex specialis, I don't know. I am just giving a benefit of the doubt that it is a more difficult problem than people make it out to be. I skimmed this [paper](https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Perspective%20on%20Digital%20Consenting_The%20Case%20of%20GAFAM_Soheil%20Human_Florian%20Cech.pdf https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Pe...) which, among its main topic, argues the issue being intentional and ubiquitous, but I am unconvinced.
  - dmitriid 5y ago
    French Data Protection Act has been around since 1978. And was amended in 2018. GDPR (which is basically all such acts from across EU in one legislation) has been around since 2016. If in 2021 your company pretends not to understand the law, your company deserves to be sued into oblivion
    - 123pie123 5y ago
      From my understanding GDPR and all other EU wide ideas or "Laws" are issued as Directives, each country then has to implement the directives in their own countries laws. some/ most implement directives in cut and paste manner some don't.
      - detaro 5y ago
        > GDPR and all other EU wide ideas or "Laws" are issued as Directives, No. The fact that the last letter in "GDPR" is not "D" is a pretty good hint that it's not a Directive ;) It's a Regulation. Regulations apply directly, and are not translated into local law. But omgitsabird is correct that GDPR is not the relevant basis here, but a clause in French Data Protection Law. And this clause exists because of the ePrivacy Directive.

123pie123 5y ago

depends on the person(s) or company creating the site, for larger companies, there'll be various people who would have a say on how the site works or flows, eg marketing people, UX, graphic designers, architects, product owners etc... Not just developers each these people may have a different viewpoint on what they want to happen and why

jabej 5y ago

I haven’t built any of those, but I feel like the cookie law is profoundly stupid and I think that it’s fair to punish users for their bad voting choices. If you want to block third party cookies you have always had a switch there in your browser options.

dmitriid 5y ago
In the absolute vast majority of cases those popup banners are illegal under the rather straightforward and unequivocal law. If 5 years after GDPR went into effect you still don't know what it is and why it exists, your company deserves to be sued into oblivion.
robin_reala 5y ago
Many third parties are now relying on information forwarded to them through first party systems and cookies. This forces sites to isolate those and provide a way of disabling the flow of personal data regardless.
Semaphor 5y ago
It’s neither a cookie law, nor about cookies. It’s about tracking and is far more comprehensive. The adtech industry is just engaging in collaborative gaslighting and very successful at it.

franciscop 5y ago

IMHO there are multiple moral boundaries, and making a dark pattern like requiring an extra click to reject cookies is unlikely a hill to die on for most devs. They might complain to their manager, even log a formal notice that they believe this feature to be breaking the law (if they are smart), but quitting a company for this specific dark pattern seems a bit unusual.

efficientsticks 5y ago
There’s a lot of selection bias, since a great many developers who would quit when asked to brazenly disregard privacy also wouldn’t interview at Google or Facebook in he first place. There’s a lot of a-moralistic attitude towards FAANG on Hacker News, which honestly I find strange; Google and Facebook in particular are just giant douchebags with lots of cash. https://goomics.net/339/ https://goomics.net/339/
- JeremyNT 5y ago
  This is huge, there are a ton of us out here writing software at non-profits, edus, etc., willingly making much less because we don't want to ever be involved. FAANG (and any VC funded company that touches ad revenue) is already selecting for developers who are willing to overlook these kinds of things. It's one of the reasons why they need to pay people so much more.
- deleted 5y ago
  [deleted]

jack_pp 5y ago

The question isn't who builds it but who orders it. Would you leave your job just to fight back against this particular dark pattern? Do you ask about this dark pattern in interviews in order to make a decision about a potential employer?

sjtindell 5y ago
Good point. Especially if they tell me we’ll get $X more revenue and my RSUs will be worth that much more…not sure I would say anything to be honest. Although I feel some shame saying that.
alkonaut 5y ago
Yes and yes. People shouldn’t have to though. Instead the regulation should be set up to make it a legal risk to aid in breaking the regulation too.
thrwyoilarticle 5y ago
It wouldn't need to be individual action if we just made a union.
Aachen 5y ago
What do you mean leave your job? If I tell my boss that doing xyz is illegal and he doesn't dispute it, I'm absolutely certain he would not ask me to implement it. Certainly there will be shittier bosses that will ask anyway, demand it, and perhaps even go so far as to fire someone for not violating the law, but I should hope those in the last category are few and far between and there would be internal and/or external outcry over it. Even if you have a boss that wants to fire you over it and nobody cares internally or externally (I'd find this situation very unlikely), you'd still get unemployment benefits / severance / whatever is typical in your jurisdiction, since you were fired rather than choosing to leave yourself.
- pydry 5y ago
  Most dark patterns arent illegal. Theyre just morally dubious.

beingflo 5y ago

Probably comes down to two factors: - Only a tiny fraction of all web devs read HN - If business wants something done, the devs are rarely in a position to oppose the decision

Starlevel001 5y ago

This site fetishises money over morals to a disturbing degree, so yes, they are just taking a cheque and keeping quiet.

hetspookjee 5y ago

@jefftk seems an avid and vocal defender of the advertisement business so perhaps he likes to chime in on why the patterns are as they are?

tempodox 5y ago
I don't know about the user you mentioned, but the “why” is patently clear: Tricking and bullying users into being the milking cows of the surveillance economy.
- hetspookjee 5y ago
  I feel the same, but I am genuinely curious to hear from someone that genuinely feels the other way.

mierz00 5y ago

I have had to build things I consider to be dark patterns. Normally, it goes something like this: 1. Client asks for something that is a dark pattern. 2. I outline that it is morally questionable to do that and give a suggestion on how it can be done otherwise. 3. Client insists that they don’t care or don’t agree because they feel as it will bring in more money. 4. I end up building it. I do have the choice to outright say no, but I’ve found that it normally comes down to a compromise. Some clients are not willing to budge but we can always steer them in the right direction.

alkonaut 5y ago
So the solution here would be a fine that is also affecting the developer. Knowinbly aiding in breaking a law is usually frowned upon. “I did what they said because they won’t pay me otherwise” usually doesn’t fly. I understand it’s hard to say no but it would perhaps be easier to say “we’ll build that but it’ll cost you 5x more because we would be taking a legal risk”. Making the option to follow the regulation cheaper has to be the goal.
- moduspol 5y ago
  Maybe imprisonment would be better. Just a few years to teach the lesson. I mean this developer knowingly aided in getting users to see more targeted ads!
  - kuschku 5y ago
    We're calling ourselves software engineers, maybe we should have personal liability like professional engineers then as well.
    - madeofpalk 5y ago
      I definitely do not call myself an engineer. I make glorified blogs.
  - alkonaut 5y ago

seaman1921 5y ago

the unpopular opinion, however well presented, gets heavily downvoted so there is no incentive for them to share their views - healthy discussions are rare.

AtNightWeCode 5y ago

I have implemented things that are illegal. I objected against it in meetings, and it was one of the reasons I left that company. What exactly are you supposed to do as a developer? In general, I think all these trickster managers are just making things harder for everybody. It often feels like their decisions are based on a mindset rather than something that they can back up with real data.

Aachen 5y ago
> What exactly are you supposed to do as a developer? I don't quite understand what you're trying to say. If you were asked to kill someone, clearly you wouldn't say "what are you supposed to do anyway" and go off to find a murder weapon since the answer there is rather obvious. What makes being asked to violate a different law different? (Assuming you find the request morally objectionable, I've probably violated laws that I thought were counterproductive for everyone.)
- virgilp 5y ago
  Because it _is_ different. If you asked me to kill someone for 1 Mil. $, I wouldn't do it. If you asked me to drive 20km/h faster than the legal limit for 10K $, I wouldn't even blink, it's a easy choice. Now, how severe is this? You're not a lawyer, you can bring it up, and the company lawyers (that are paid maybe more than you are) say they reviewed the spec and it's legal. What standing do you have, as a developer, to say "no it's not legal, I won't do it!". Do you really know better than the lawyers? [edit] > If you were asked to kill someone, clearly you wouldn't say "what are you supposed to do anyway" and go off to find a murder weapon since the answer there is rather obvious. What if you were a soldier? Or a drone pilot? Is the answer still obvious?
  - Aachen 5y ago
    > company lawyers [say] they reviewed the spec and it's legal. [...] Do you really know better than the lawyers? I'd be very surprised if anyone thought this was clearly legal after reading the law. But yeah, that would be a valid answer to the question: legal team says it's legal. If something is legal, you cannot be prosecuted for it, and you can have some reasonable confidence in lawyers reading the law and providing legal council correctly. However, you were saying "I have implemented things that are illegal. I objected against it in meetings", so I was more thinking from the scenario where everyone knows it's illegal but the dev is asked to do it anyway. Presumably not even explicitly, just implicit "we need this feature" without ever bringing up "and we know it's illegal, but if you want to keep your healthcare..."

durnygbur 5y ago

Who creates malicious software, hijacking websites, computer viruses? There exist morally murky demographics in every profession, and it's mostly for money otherwise not available to them.

Aachen 5y ago
Typically those people are prosecuted though, or at least they know to expect it. I don't think it's the same situation here.

olalonde 5y ago

> Or do they just take a check and keep quiet? I think so. There are many devs who are against government regulating the web and will happily code around them. HN is pro regulations so it's either keep quiet or get down voted to hell.

1337shadow 5y ago

If you don't then a less competent developer might do it, increasing risks even moreso.

hackerfromthefu 5y ago
Or .. fail in doing it ..
sailingparrot 5y ago
Increasing risk of what exactly ? Since you are already doing it anyway ? The original saying (that I don’t necessarily agree with) is not about competence but about ethics: if every ethical person refuses to work in weapon manufacturing/ advertising / whatever is deemed morally unacceptable, then the only people that will do it are people with no morals and we will be worse off as a society. So really, in this case the person just shutting up and doing it is already the worse fallback.

vanusa 5y ago

They're here of course, and they're reading along with the rest of us. And they're thinking: "Yup, that's me. That's my handiwork, my impact on the world." And then they think: "But what can you do? R&V, R&V, R&V ..." As in: rest & vest

deleted 5y ago

[deleted]

willcipriano 5y ago

Front end folks are more on Reddit/Twitter and the like in my experience.

Sebb767 5y ago

I actually implemented one of those. It's not as bad as the Google one, but still asymmetrical (accept is just a large button and reject is small, non-highlighted text next to it). The customer in this case was rather non-technical and just wanted his tracking, so he wanted to have it like everyone else does. I/We actually told him very clearly that this is most likely illegal and talked it down a notch (from having "reject" hidden in the text), but he said he checked that with legal and we should do it. Loosing the customer over this was really not worth it (especially since this is basically the way cookie dialogs are done everywhere), so we did what he asked, with our asses covered in case it backfires. I might send him this case, though. On a side note, it was really hard to implement the cookie dialog correctly so that it only loads Google Analytics and our tracking when ok is clicked. We thought this was a solved problem, but nope. Especially when you want to delete cookies when consent is revoked. I would not be surprised at all if most dialogs actually don't work at all.

dgellow 5y ago

You can be paid for the task and keep quiet, or be paid for the same task and still complain online about it. You don't have to be aligned with the company that employs you, and a lot of workers aren't. Often what happens is that someone (hopefully you) will raise the issue internally, but if the company decided to ignore regulations and take the risk of legal punishment, well it's not an engineer that will be able to stop it from being implemented. Hopefully such fines will make product owners and upper management consider the problem more seriously, but I wouldn't bet on it.

kingcharles 5y ago

Done this several times. It's always been when I've had to take paid employment between building and failing at my own startups. I will always argue up and down with the client and almost always will get significant reduction in the nastiness of whatever thing they were trying to do, through education. I think a lot of this dark patterns would be even darker but for the push-back by some developers. Though I've been at companies where some workers are like robots and will carry out management's desires down to a T, even when the idea is total insanity. Some workers are immigrants who cannot afford to lose their employment or they will be thrown out of the country and potentially lose their partner and children. When I have to work on my own projects, I generally avoid all dark patterns - I try to go as far in the opposite direction as possible, while still generating revenue. Though, with the torrent site I built once, it was "Anything Goes". You're already running an illegal site, might as well write something that bleeds the users dry if you can. EDIT: I want to add that most of it was down to lack of technical knowledge by management. They were business guys who didn't know the Web. Most of the time they weren't trying to be assholes, it just appeared that way.

LNSY 5y ago

They just take a check and keep quiet. These types of engineers will also build stupid stuff that doesn't work, because that's what the specification written by a group of business people who have never even looked at code before said. It's also why frameworks like React are popular.

xwolfi 5y ago

I've implemented 1000+% payday loan promotion in Mexico, with credit score check etc, stuff I find absolutely abject myself. I don't think I cared much: if it's not illegal, I do it, even if it's "immoral". Especially in remote jurisdictions I have interest to see fail miserably rather than succeed. It's a bit sad, but each time you try to be nice and friendly, you get "raped" I feel, so well, might as well make some money off of some people to pay for when we get scammed ourselves.

anticristi 5y ago

My experience is that devs generally lack the desire and expertise to read and interpret legal texts. According to GDPR isn't not their job either. Each company needs to employ or hire a Data Protection Officer (DPO) who is responsible for keeping track of data protection regulations and ensuring they are applied company-wide. IMHO, as long as devs weren't trained on cookie law, they are not morally responsible.

Sephr 5y ago

A proper solution to this problem requires a completely new perspective. I made a client side firewall-esque library for Transcend Consent Manager so that site owners can load trackers immediately and locally quarantine tracking events for replay once consented. This makes it possible to track like before but move the annoying cookie banner into an integrated UI so that site owners can ask for consent when the user is more invested in the site (e.g. during signup/checkout).