5 ms·

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

thepangolino 5y ago
brtkdotse 5y ago
I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.
- questiondev 5y ago
  that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers
  - brtkdotse 5y ago
    A Google font file is just a small file, smaller than most images. You can download it and place is along side your css files. And seeing how most websites are 20 megs+, the eco argument seems forced.
  - Youden 5y ago
    A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?
    - kalleboo 5y ago
      Is it really better to tunnel your whole site through CloudFlare than embed a font from Google, from a privacy perspective?
    - krehl 5y ago
      This as well would "leak" the IP address to Cloudflare, wouldn't it?
      - hammyhavoc 5y ago
        https://www.cloudflare.com/en-gb/trust-hub/gdpr/ https://www.cloudflare.com/en-gb/trust-hub/gdpr/
    - cuu508 5y ago
      > A standard web font (e.g. Roboto) is ~1MB. Currently on HN frontpage there is an article "How to avoid layout shifts caused by web fonts" [1]. It lists several techniques you can use to reduce font size. One of the examples shows how subsetting reduces Roboto Regular size to 11KB. [1] https://simonhearne.com/2021/layout-shifts-webfonts/ https://simonhearne.com/2021/layout-shifts-webfonts/.
    - skyeto 5y ago
      (in reply to krehl) And in that specific case you should probably have a DPA ready. Big issue with anything Google-related (and probably CloudFlare) is that they may transfer the data outside of the EU[0]. [0] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
    - Andrew_nenakhov 5y ago
      I wonder if you can get penalized for sending users' IPs to CloudFlare..
      - hammyhavoc 5y ago
        https://www.cloudflare.com/en-gb/trust-hub/gdpr/ https://www.cloudflare.com/en-gb/trust-hub/gdpr/
  - lkramer 5y ago
    An interesting question. Someone should do a environment cost impact on self hosting fonts (and other resources) vs client having to make lot's of requests to various hosts for those resources.
    - isbvhodnvemrwvn 5y ago
      None of the standard browsers share third-party cache across different domains. Made it too easy to leak data.
  - cuu508 5y ago
    > one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of server Browsers don't share cache between sites: https://www.stefanjudis.com/notes/say-goodbye-to-resource-caching-across-sites-and-domains/ https://www.stefanjudis.com/notes/say-goodbye-to-resource-ca...
- losvedir 5y ago
  Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure logs IP addresses like Google Fonts here. But surely that doesn't require consent. Why not, what's the difference? What if you host with a much sketchier provider? I could see politicians thinking users would want to know if their requests were served by, say, China or Russia.
  - Hnrobert42 5y ago
    For that matter, does the fact that reaching my self hosted site must travel the last mile along a service I paid for (my ISP), mean I must gain consent for using them?
  - jlokier 5y ago
    With Hetzner you can get a GDPR compliant Data Processing Agreement (DPA) when using them for hosting. https://www.hetzner.com/news/vertrag-zur-auftragsverarbeitung-gemaess-art-28-ds-gvo-steht-ab-sofort-online-zur-verfuegung-eintrag/ https://www.hetzner.com/news/vertrag-zur-auftragsverarbeitun... It's ok that their infrastructure logs IPs that it has to. They commit via their DPA to protecting personal data such as embedded in those logs, not logging what they don't need, not keeping it longer than necessary, only sharing it with third parties that agree similar protections, anonymising and aggregating as needed, etc. You probably want an agreement like that with a hosting provider for another reason, not just IP logging: They have physical access to all your on site storage, user databases, etc. It's good that they commit to treating data on those physical systems with appropriate respect.
- dgellow 5y ago
  You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.
  - liveoneggs 5y ago
    Google rate limits and then blocks your server ip? oops Doubling your bandwidth costs vs hosting the woff files? oops Still forwarding the ip address in the X-Forwarded-For header? oops Not following the license agreements of font providers? my bad
  - pembrook 5y ago
    Oh, super simple! The local bakery down the street just needs to figure out what a reverse proxy is, what a redirect is, and what Nginx is and how set rules for it, and then weigh the pros and cons vs self-hosting assets. I’m sure that’s easily doable for them, aren’t regulations fun?
    - Handytinge 5y ago
      They also will have regulations around financr, health codes, discrimination and hiring, etc etc. Very few business owners are experts in all regulations when starting. You learn and adjust.
    - brtkdotse 5y ago
      No, the bakery’s _website provider_ should do that.
5e92cb50239222b 5y ago
Go to uBlock Origin settings and check every item in the 'annoyances' list. I haven't seen a single cookie banner for a few years now. (This is assuming you're using uBO, because who the hell isn't these days?)
- foepys 5y ago
  The interesting thing that a lot of services don't consider is that blocking these cookie banners is perfectly allowed and does not implicitly allow services to collect personal data. Twitter is one of those service that just states "we collect data, deal with it when using this website" (which is already not legal) but the thing is, I don't even see this pop-up because uBlock is filtering it out. If Twitter now collects my personal data, it is not only breaking the opt-in component of GDPR but also doesn't even notify me about data collection. Quite a lot of services have JS-only popups which I also don't see. Do they collect data? I think so. Do they know they are doing it illegally? I would bet quite a bit of money that they never thought about somebody getting past their cookie banner without consenting, so probably no.
- smilespray 5y ago
  People who have other priorities and interests than technology.
  - oblio 5y ago
    Aka 95% of people out there.
HL33tibCe7 5y ago
Non-technical users that I’ve seen interacting with these prompts literally just look for the button with the most prominent colour and click it. Frankly, I’ve even found myself doing this without thinking on occasion. The prompts are beyond useless.
- dgellow 5y ago
  For years I was going in the list of vendors and disabling everything. Now I became so bored by these prompts I decided to instead just accept everything and clean my cookies every week. I’m less frustrated this way, and still feel I have control over my privacy.
jeroenhd 5y ago
There's no difference between that popup and IP sharing consent. It's not about cookies, it's about tracking and tracking risk. Smart websites would just host the font files on their own domains but I guess the dumber ones will just add Google Fonts and similar to their consent list, yes.
2ion 5y ago
You'll just see HTTP451 more.
eps 5y ago
On the other hand, there was a post on the front page recently that said that showing opt-in 3rd party cookie prompts resulted in over 90% refusal rate. Ignorance is a bliss, but if given a choice to not share extra info with random companies, many will in fact take that opportunity. So a popup warning that your visit to this website will be recorded by Google may be just what the doctored ordered to shake people of their nirvana and make them look at things a bit more closely.

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

thepangolino 5y ago

brtkdotse 5y ago

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

questiondev 5y ago
that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers
- brtkdotse 5y ago
  A Google font file is just a small file, smaller than most images. You can download it and place is along side your css files. And seeing how most websites are 20 megs+, the eco argument seems forced.
- Youden 5y ago
  A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?
  - kalleboo 5y ago
    Is it really better to tunnel your whole site through CloudFlare than embed a font from Google, from a privacy perspective?
  - krehl 5y ago
    This as well would "leak" the IP address to Cloudflare, wouldn't it?
    - hammyhavoc 5y ago
      https://www.cloudflare.com/en-gb/trust-hub/gdpr/ https://www.cloudflare.com/en-gb/trust-hub/gdpr/
  - cuu508 5y ago
    > A standard web font (e.g. Roboto) is ~1MB. Currently on HN frontpage there is an article "How to avoid layout shifts caused by web fonts" [1]. It lists several techniques you can use to reduce font size. One of the examples shows how subsetting reduces Roboto Regular size to 11KB. [1] https://simonhearne.com/2021/layout-shifts-webfonts/ https://simonhearne.com/2021/layout-shifts-webfonts/.
  - skyeto 5y ago
    (in reply to krehl) And in that specific case you should probably have a DPA ready. Big issue with anything Google-related (and probably CloudFlare) is that they may transfer the data outside of the EU[0]. [0] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
  - Andrew_nenakhov 5y ago
    I wonder if you can get penalized for sending users' IPs to CloudFlare..
    - hammyhavoc 5y ago
      https://www.cloudflare.com/en-gb/trust-hub/gdpr/ https://www.cloudflare.com/en-gb/trust-hub/gdpr/
- lkramer 5y ago
  An interesting question. Someone should do a environment cost impact on self hosting fonts (and other resources) vs client having to make lot's of requests to various hosts for those resources.
  - isbvhodnvemrwvn 5y ago
    None of the standard browsers share third-party cache across different domains. Made it too easy to leak data.
- cuu508 5y ago
  > one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of server Browsers don't share cache between sites: https://www.stefanjudis.com/notes/say-goodbye-to-resource-caching-across-sites-and-domains/ https://www.stefanjudis.com/notes/say-goodbye-to-resource-ca...
losvedir 5y ago
Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure logs IP addresses like Google Fonts here. But surely that doesn't require consent. Why not, what's the difference? What if you host with a much sketchier provider? I could see politicians thinking users would want to know if their requests were served by, say, China or Russia.
- Hnrobert42 5y ago
  For that matter, does the fact that reaching my self hosted site must travel the last mile along a service I paid for (my ISP), mean I must gain consent for using them?
- jlokier 5y ago
  With Hetzner you can get a GDPR compliant Data Processing Agreement (DPA) when using them for hosting. https://www.hetzner.com/news/vertrag-zur-auftragsverarbeitung-gemaess-art-28-ds-gvo-steht-ab-sofort-online-zur-verfuegung-eintrag/ https://www.hetzner.com/news/vertrag-zur-auftragsverarbeitun... It's ok that their infrastructure logs IPs that it has to. They commit via their DPA to protecting personal data such as embedded in those logs, not logging what they don't need, not keeping it longer than necessary, only sharing it with third parties that agree similar protections, anonymising and aggregating as needed, etc. You probably want an agreement like that with a hosting provider for another reason, not just IP logging: They have physical access to all your on site storage, user databases, etc. It's good that they commit to treating data on those physical systems with appropriate respect.
dgellow 5y ago
You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.
- liveoneggs 5y ago
  Google rate limits and then blocks your server ip? oops Doubling your bandwidth costs vs hosting the woff files? oops Still forwarding the ip address in the X-Forwarded-For header? oops Not following the license agreements of font providers? my bad
- pembrook 5y ago
  Oh, super simple! The local bakery down the street just needs to figure out what a reverse proxy is, what a redirect is, and what Nginx is and how set rules for it, and then weigh the pros and cons vs self-hosting assets. I’m sure that’s easily doable for them, aren’t regulations fun?
  - Handytinge 5y ago
    They also will have regulations around financr, health codes, discrimination and hiring, etc etc. Very few business owners are experts in all regulations when starting. You learn and adjust.
  - brtkdotse 5y ago
    No, the bakery’s _website provider_ should do that.

5e92cb50239222b 5y ago

Go to uBlock Origin settings and check every item in the 'annoyances' list. I haven't seen a single cookie banner for a few years now. (This is assuming you're using uBO, because who the hell isn't these days?)

foepys 5y ago
The interesting thing that a lot of services don't consider is that blocking these cookie banners is perfectly allowed and does not implicitly allow services to collect personal data. Twitter is one of those service that just states "we collect data, deal with it when using this website" (which is already not legal) but the thing is, I don't even see this pop-up because uBlock is filtering it out. If Twitter now collects my personal data, it is not only breaking the opt-in component of GDPR but also doesn't even notify me about data collection. Quite a lot of services have JS-only popups which I also don't see. Do they collect data? I think so. Do they know they are doing it illegally? I would bet quite a bit of money that they never thought about somebody getting past their cookie banner without consenting, so probably no.
smilespray 5y ago
People who have other priorities and interests than technology.
- oblio 5y ago
  Aka 95% of people out there.

HL33tibCe7 5y ago

Non-technical users that I’ve seen interacting with these prompts literally just look for the button with the most prominent colour and click it. Frankly, I’ve even found myself doing this without thinking on occasion. The prompts are beyond useless.

dgellow 5y ago
For years I was going in the list of vendors and disabling everything. Now I became so bored by these prompts I decided to instead just accept everything and clean my cookies every week. I’m less frustrated this way, and still feel I have control over my privacy.

jeroenhd 5y ago

There's no difference between that popup and IP sharing consent. It's not about cookies, it's about tracking and tracking risk. Smart websites would just host the font files on their own domains but I guess the dumber ones will just add Google Fonts and similar to their consent list, yes.

2ion 5y ago

You'll just see HTTP451 more.

eps 5y ago

On the other hand, there was a post on the front page recently that said that showing opt-in 3rd party cookie prompts resulted in over 90% refusal rate. Ignorance is a bliss, but if given a choice to not share extra info with random companies, many will in fact take that opportunity. So a popup warning that your visit to this website will be recorded by Google may be just what the doctored ordered to shake people of their nirvana and make them look at things a bit more closely.