10 ms·

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system wh

by onli 5y ago

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it is not necessary to serve the fonts via Google, it can happen without leaking the IP (I assume they mean self-hosting): > Google Fonts kann durch die Beklagte auch genutzt werden, ohne dass beim Aufruf der Webseite eine Verbindung zu einem Google-Server hergestellt wird und eine Übertragung der IP-Adresse der Webseitennutzer an Google stattfindet. translated: > Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google. Which is good news! It is a totally consistent decision with the current privacy rules and best practices: Do not save or leak private data if not necessary, always minimize data exposure as much as possible. The as much as possible part is very important - if there is no way to embed Youtube videos without leaking the address, then that's still possible to do. Sounds fair to me.

ab_testing 5y ago
Does that also imply that do not use a cdn to serve any of your assets as that will also leak the up address to third parties.
- Jensson 5y ago
  If the CDN abides by GDPR laws and doesn't process user data then it is fine. But if the CDN you use process user data for its own gain rather than just serve the request then that goes against GDPR. It is your responsibility as a developer to ensure the services you use follow these laws. If you don't have a contract stating that the other part will honor GDPR then we will assume that the other part will misuse all data sent to them, so you aren't allowed to send any data at all.
  - iammarkbro 5y ago
    Does Google CDN not abide GDPR?
    - Jon_Lowtek 5y ago
      It does not, because of the Cloud Act and related american mass surveillance laws
    - Jensson 5y ago
      This was a static web address and not a CDN for this website, the company doesn't have a contract with Google about this and the user didn't go to Google.
asiachick 5y ago
Hundreds of thousands if not millions of mom and pop blogs are linking to images, fonts, scripts, etc from various sites. Are you really going to fine them all? You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined.
- onli 5y ago
  > You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined. Why do you think that? I would never agree that a link should carry any responsibility to the site owner, even if it linked to porn, warez or really illegal stuff.
brtkdotse 5y ago
Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv https://www.yubico.com/?lang=sv
- robin_reala 5y ago
  There’s an easier way than that: embed from youtube-nocookie.com. Of course that doesn’t necessarily help with the Munich ruling…
  - capableweb 5y ago
    IP information will still be sent to Google, and a notice would have to put up before. Easiest way to deal with this is to self-host the videos. Most people over-estimate how popular their websites are, and for the ones who don't, getting a dedicated instance with unmetered bandwidth is trivial to get and setup for video-hosting.
    - _0w8t 5y ago
      Unmetered is often means 1 Gbit. With 4K video that means less than 100 streams. It may work, but the moment the video is shared among friends the site can be in trouble. Plus YouTube handles all re-encoding and adjust the quality based on the speed and device. It is possible to do it with open-source components, but it requires a server farm and just not feasible using single cheap private server or VPS.
      - crtasm 5y ago
        If you're hosting a handful of videos a single server will be fine to encode and serve them.
      - account42 5y ago
        > and adjust the quality based on the speed and device. Now if only browsers would implement native HLS and/or DASH support then every site could have this without having to package a bunch of JS with different quirks of reach site. Of course, it is not really in Google's interest to help YouTube competitors so this is unlikely to happen for Chrome.
remus 5y ago
The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than embedding the IG post and so would result in huge changes how websites work (by vastly reducing any externally loaded content). In a similar vein, you could argue that serving cached content from another host is not strictly necessary. Why not just run your own caching servers? It's probably worse in most ways (my cache server << cloudflare's cache server), but if minimising the amount of content loaded from external hosts is your aim then it is feasible.
- zinekeller 5y ago
  > For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cookie popup. BBC even steps it up: all of their Twitter citations are screencapped and linked instead of other websites just embedding Twitter (in their defense, they can say that this is to preserve the context in case that the user subsequently deleted the post).
  - foepys 5y ago
    c) is very popular among various German websites I frequent. Instead of the embedded content there is a blank area and you can consent with one click to send your data to $service which will then load the embedded content. Sometimes it also includes a direct link so you can open the embedded content in whichever way you like. I don't find this to intrusive or annoying, especially since the website can save your choice for later and can choose to never ask you again.
  - burntoutfire 5y ago
    > c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. This is how we arrive at cookie popups and annoying "you're leaving our website" notifications. I posit that perhaps both of these could be a feature of HTTP protocol and the browsers - i.e. a browser could just display a small standard icon in its UI notifying user that he's consenting to cookies, and another one notifying him that he's being redirected outside of the domain he's in, The user could then configure the browser to auto-accept or auto-deny such attempts, review all the consents he's given earlier etc. - all in all, it would result in much better UX. Google has probably not proposed and implemented something like this in Chrome already only because it would actually improve privacy and that's obviously not in their interest. Which proves that de facto giving up Web standards to the commercial entity was never a good idea. If the EU was better at execution, they would mandate something like this as the law, instead of the current requirements which can be met by just spamming users with popups no one reads.
Blikkentrekker 5y ago
I have to say that this is such an example of new technology being scary but the problems with old technology being ignored. I'm still waiting for the ability to have mail received from someone or a company without giving such parties my name and physical address. This could very easily be implemented in many ways, but somehow does not exist. There is no reason for a mail order company to know my full name and physical address to deliver anything to do, and I feel this sis far more compromising than an i.p. address.
- iammarkbro 5y ago
  [flagged]
- jeltz 5y ago
  I feel that is more an argument for improving post than one against GDPR.
  - Blikkentrekker 5y ago
    It's an argument for, as I said, that people have a tendency of disproportionately focusing on the harmful effect of new things, all the while ignoring anything that is sufficiently old. I find giving ulterior parties my name, and the physical location on the planet I live far more scary than being tracked by cookies without such cookies being able to be tied to such things.
- deleted 5y ago
  [deleted]
Aeolun 5y ago
> if there is no way to embed Youtube videos without leaking the address But there is. Where does it stop being reasonable? When you have to host your own video delivery infrastructure?
- onli 5y ago
  I think there is not. You are not allowed to download the video and host it yourself, that would be a copyright violation. Am I missing a legally valid way?
  - HL33tibCe7 5y ago
    Okay but let’s say you have permission to host the content — e.g: you actually own the video. Do you still think it’s reasonable that it should be a legal requirement that to embed a video on your web page you must develop your own video delivery infrastructure?
    - Jensson 5y ago
      You pay for that content delivery by selling the users data to Google. Do you think that is fair that the user should pay for your video hosting with his data? If the user wants to see the video, sure, but that hasn't been made clear yet at this stage.
    - mrweasel 5y ago
      You could just link to YouTube and not embed the video. I think the important part is that this is an issue, only because companies like have had a surprising hard time not misusing every single bit of information sent their way. The result is that companies have forced governments to step in and now they are overregulating.
      - aembleton 5y ago
        But if you link and your browser preloads links to speed up browsing, then your IP address would still be leaked.
martincmartin 5y ago
> (I assume they mean self-hosting) Or proxying. Or proxying with caching, which is kind of part way between self-hosting and proxying. :)
jstummbillig 5y ago
> Sounds fair to me. The part that is tricky, is where we offload additional burden of knowledge and responsibility to the website providers. When it is on the user to figure out whether they are allowed to use a product – and that means in fact any product – that one of the biggest companies in the world is allowed to offer in my country legally, we are in trouble. Law is complex. Tech is complicated. Most people are not law or tech experts. Getting sound advice on both is expensive, and the trend to increasingly need more of both is worrisome. This seems neither fair nor reasonable to me. Or particularly democratic.
phkahler 5y ago
>> This is exactly what happened... Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.
- latk 5y ago
  This argument was tried in the Fashion ID case. A company had inserted Facebook Like buttons on the web page, and argued that it was not responsible for the ensuing disclosure of personal data (such as IP addresses or possible tracking cookies) to Facebook. See, it was the browser and not the website operator that disclosed the data, and the website operator never had access to the data in the browser in the first place! The European Court of Justice did not buy this argument. By coding the website in a particular way, the website operator was responsible for causing the user's browser to act in a particular way, so it was the “data controller” for the collection an transmission of personal data by the Facebook Like button, though Facebook is of course jointly responsible for what their code does. The underlying argument is that someone is a data controller and thus responsible for GDPR compliance when they determine the “purposes and means” of processing, alone or jointly with others. Embedding the code for the button was an exercise of this power to determine purposes and means. In contrast, the website operator is not a data controller for whatever Facebook does with the collected data on its servers, because it cannot control what FB does. The given case from Munich is a very straightforward extension from the Fashion ID judgement, though the website operator didn't even claim that they weren't responsible. Instead, they argued that they had a “legitimate interest”in loading fonts from Google servers, which the court rejected. While I consider it probable that Google does not use data from Fonts servers for tracking, the judgement correctly points out that Google is well-known for tracking – but this doesn't matter anyway, since already the disclosure of personal data without a legal basis is a problem.
  - phkahler 5y ago
    Thanks, that was a very good explanation with legal backing.
  - asiachick 5y ago
baxtr 5y ago
This is not good news. This indeed very bad news. Especially for entrepreneurs in Germany who must constantly fear to be convicted for something as ridiculous as this.
- mro_name 5y ago
  those entrepreneurs unable to host their fonts.
  - bufferoverflow 5y ago
    Host on where though? You leak user's IP to your web host, to your CDN.
    - mro_name 5y ago
      no, because that's where to visitor want to go by explicit free will. Not so a hidden 3rd party.
      - bufferoverflow 5y ago
        The CDN is a hidden 3rd party, no?
        mro_name 5y ago
        indeed.
        jeltz 5y ago
        Yes, but they have a contract with the VPN and the VPN has a data protection officer. Here they just send data to Google and Google has not made any promises to protect the data.

by onli 5y ago

ab_testing 5y ago

Does that also imply that do not use a cdn to serve any of your assets as that will also leak the up address to third parties.

Jensson 5y ago
If the CDN abides by GDPR laws and doesn't process user data then it is fine. But if the CDN you use process user data for its own gain rather than just serve the request then that goes against GDPR. It is your responsibility as a developer to ensure the services you use follow these laws. If you don't have a contract stating that the other part will honor GDPR then we will assume that the other part will misuse all data sent to them, so you aren't allowed to send any data at all.
- iammarkbro 5y ago
  Does Google CDN not abide GDPR?
  - Jon_Lowtek 5y ago
    It does not, because of the Cloud Act and related american mass surveillance laws
  - Jensson 5y ago
    This was a static web address and not a CDN for this website, the company doesn't have a contract with Google about this and the user didn't go to Google.

asiachick 5y ago

Hundreds of thousands if not millions of mom and pop blogs are linking to images, fonts, scripts, etc from various sites. Are you really going to fine them all? You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined.

onli 5y ago
> You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined. Why do you think that? I would never agree that a link should carry any responsibility to the site owner, even if it linked to porn, warez or really illegal stuff.

brtkdotse 5y ago

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv https://www.yubico.com/?lang=sv

robin_reala 5y ago
There’s an easier way than that: embed from youtube-nocookie.com. Of course that doesn’t necessarily help with the Munich ruling…
- capableweb 5y ago
  IP information will still be sent to Google, and a notice would have to put up before. Easiest way to deal with this is to self-host the videos. Most people over-estimate how popular their websites are, and for the ones who don't, getting a dedicated instance with unmetered bandwidth is trivial to get and setup for video-hosting.
  - _0w8t 5y ago
    Unmetered is often means 1 Gbit. With 4K video that means less than 100 streams. It may work, but the moment the video is shared among friends the site can be in trouble. Plus YouTube handles all re-encoding and adjust the quality based on the speed and device. It is possible to do it with open-source components, but it requires a server farm and just not feasible using single cheap private server or VPS.
    - crtasm 5y ago
      If you're hosting a handful of videos a single server will be fine to encode and serve them.
    - account42 5y ago
      > and adjust the quality based on the speed and device. Now if only browsers would implement native HLS and/or DASH support then every site could have this without having to package a bunch of JS with different quirks of reach site. Of course, it is not really in Google's interest to help YouTube competitors so this is unlikely to happen for Chrome.

remus 5y ago

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than embedding the IG post and so would result in huge changes how websites work (by vastly reducing any externally loaded content). In a similar vein, you could argue that serving cached content from another host is not strictly necessary. Why not just run your own caching servers? It's probably worse in most ways (my cache server << cloudflare's cache server), but if minimising the amount of content loaded from external hosts is your aim then it is feasible.

zinekeller 5y ago
> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cookie popup. BBC even steps it up: all of their Twitter citations are screencapped and linked instead of other websites just embedding Twitter (in their defense, they can say that this is to preserve the context in case that the user subsequently deleted the post).
- foepys 5y ago
  c) is very popular among various German websites I frequent. Instead of the embedded content there is a blank area and you can consent with one click to send your data to $service which will then load the embedded content. Sometimes it also includes a direct link so you can open the embedded content in whichever way you like. I don't find this to intrusive or annoying, especially since the website can save your choice for later and can choose to never ask you again.
- burntoutfire 5y ago
  > c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. This is how we arrive at cookie popups and annoying "you're leaving our website" notifications. I posit that perhaps both of these could be a feature of HTTP protocol and the browsers - i.e. a browser could just display a small standard icon in its UI notifying user that he's consenting to cookies, and another one notifying him that he's being redirected outside of the domain he's in, The user could then configure the browser to auto-accept or auto-deny such attempts, review all the consents he's given earlier etc. - all in all, it would result in much better UX. Google has probably not proposed and implemented something like this in Chrome already only because it would actually improve privacy and that's obviously not in their interest. Which proves that de facto giving up Web standards to the commercial entity was never a good idea. If the EU was better at execution, they would mandate something like this as the law, instead of the current requirements which can be met by just spamming users with popups no one reads.

Blikkentrekker 5y ago

I have to say that this is such an example of new technology being scary but the problems with old technology being ignored. I'm still waiting for the ability to have mail received from someone or a company without giving such parties my name and physical address. This could very easily be implemented in many ways, but somehow does not exist. There is no reason for a mail order company to know my full name and physical address to deliver anything to do, and I feel this sis far more compromising than an i.p. address.

iammarkbro 5y ago
[flagged]
jeltz 5y ago
I feel that is more an argument for improving post than one against GDPR.
- Blikkentrekker 5y ago
  It's an argument for, as I said, that people have a tendency of disproportionately focusing on the harmful effect of new things, all the while ignoring anything that is sufficiently old. I find giving ulterior parties my name, and the physical location on the planet I live far more scary than being tracked by cookies without such cookies being able to be tied to such things.
deleted 5y ago
[deleted]

Aeolun 5y ago

> if there is no way to embed Youtube videos without leaking the address But there is. Where does it stop being reasonable? When you have to host your own video delivery infrastructure?

onli 5y ago
I think there is not. You are not allowed to download the video and host it yourself, that would be a copyright violation. Am I missing a legally valid way?
- HL33tibCe7 5y ago
  Okay but let’s say you have permission to host the content — e.g: you actually own the video. Do you still think it’s reasonable that it should be a legal requirement that to embed a video on your web page you must develop your own video delivery infrastructure?
  - Jensson 5y ago
    You pay for that content delivery by selling the users data to Google. Do you think that is fair that the user should pay for your video hosting with his data? If the user wants to see the video, sure, but that hasn't been made clear yet at this stage.
  - mrweasel 5y ago
    You could just link to YouTube and not embed the video. I think the important part is that this is an issue, only because companies like have had a surprising hard time not misusing every single bit of information sent their way. The result is that companies have forced governments to step in and now they are overregulating.
    - aembleton 5y ago
      But if you link and your browser preloads links to speed up browsing, then your IP address would still be leaked.

martincmartin 5y ago

> (I assume they mean self-hosting) Or proxying. Or proxying with caching, which is kind of part way between self-hosting and proxying. :)

jstummbillig 5y ago

> Sounds fair to me. The part that is tricky, is where we offload additional burden of knowledge and responsibility to the website providers. When it is on the user to figure out whether they are allowed to use a product – and that means in fact any product – that one of the biggest companies in the world is allowed to offer in my country legally, we are in trouble. Law is complex. Tech is complicated. Most people are not law or tech experts. Getting sound advice on both is expensive, and the trend to increasingly need more of both is worrisome. This seems neither fair nor reasonable to me. Or particularly democratic.

phkahler 5y ago

>> This is exactly what happened... Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.

latk 5y ago
This argument was tried in the Fashion ID case. A company had inserted Facebook Like buttons on the web page, and argued that it was not responsible for the ensuing disclosure of personal data (such as IP addresses or possible tracking cookies) to Facebook. See, it was the browser and not the website operator that disclosed the data, and the website operator never had access to the data in the browser in the first place! The European Court of Justice did not buy this argument. By coding the website in a particular way, the website operator was responsible for causing the user's browser to act in a particular way, so it was the “data controller” for the collection an transmission of personal data by the Facebook Like button, though Facebook is of course jointly responsible for what their code does. The underlying argument is that someone is a data controller and thus responsible for GDPR compliance when they determine the “purposes and means” of processing, alone or jointly with others. Embedding the code for the button was an exercise of this power to determine purposes and means. In contrast, the website operator is not a data controller for whatever Facebook does with the collected data on its servers, because it cannot control what FB does. The given case from Munich is a very straightforward extension from the Fashion ID judgement, though the website operator didn't even claim that they weren't responsible. Instead, they argued that they had a “legitimate interest”in loading fonts from Google servers, which the court rejected. While I consider it probable that Google does not use data from Fonts servers for tracking, the judgement correctly points out that Google is well-known for tracking – but this doesn't matter anyway, since already the disclosure of personal data without a legal basis is a problem.
- phkahler 5y ago
  Thanks, that was a very good explanation with legal backing.
- asiachick 5y ago

baxtr 5y ago

This is not good news. This indeed very bad news. Especially for entrepreneurs in Germany who must constantly fear to be convicted for something as ridiculous as this.

mro_name 5y ago
those entrepreneurs unable to host their fonts.
- bufferoverflow 5y ago
  Host on where though? You leak user's IP to your web host, to your CDN.
  - mro_name 5y ago
    no, because that's where to visitor want to go by explicit free will. Not so a hidden 3rd party.
    - bufferoverflow 5y ago
      The CDN is a hidden 3rd party, no?
      - mro_name 5y ago
        indeed.
      - jeltz 5y ago
        Yes, but they have a contract with the VPN and the VPN has a data protection officer. Here they just send data to Google and Google has not made any promises to protect the data.