8 ms·

Doesn't this attitude overlook the "agency" of the "User-Agent"?

maratc 5y ago
Note the text: > It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website. In this context, "It is undisputed" does not mean "It is a truth universally acknowledged by everyone", but rather "there is no dispute between the defendant and the plaintiff that this happened; in the light of that non-disagreement, the court is not required to decide whether that happened or not, and will accept that as a fact". So in this case, the defendant (as well as the plaintiff, of course) agreed that "the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website". If there was a place to bring forward this "agency argument", this was the place; however the defendant seems to have chosen not to bring it forward. It may be because the defendant's lawyers are unprofessional and forgot; it may also be because they are professional and so they knew this argument would not hold. P.S. see also https://news.ycombinator.com/item?id=30139489 https://news.ycombinator.com/item?id=30139489
7373737373 5y ago
Yeah, the plaintiff's browser made the request after all, no?
- guipsp 5y ago
  Use this one weird trick to make all browser exploitation legal.
- maratc 5y ago
  The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.
  - 7373737373 5y ago
    Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.
    - Jon_Lowtek 5y ago
      > a user agent is not forced to follow the instructions Luckily! A large german media corporation called "Springer" has for years, and is still, unsuccessfully trying to get the courts and politicians to rule that users can not manipulate web content and must run it as intended, as changing it would violate copyright and is a sabotage of their program. And i bet they aren't the only ones globally. Also: how many devices are locked down and can only run code as it is provided by trusted third parties? Try installing an ad-blocker on a smart-tv or a playstation.
    - maratc 5y ago
      > not forced to follow the instructions Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.
      - 7373737373 5y ago
        I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent forms for various provider, third party and user jurisdiction combinations is just inane.
        maratc 5y ago
        There are two options to do what's required by the law: either A. not sending users' personal data to third parties; or B. receive informed consent from the users before sending their personal data to third parties. If the option B seems unwanted for some reason (any reason), there is still option A. Implementing a different solution (that breaks the law) has consequences.
- mro_name 5y ago
  no. It didn't decide and so isn't responsible. Have you ever seen a gun in jail?
dividedbyzero 5y ago
What does the browser's user agent have to do with this?
- randalluk 5y ago
  The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.
  - maratc 5y ago
    > It could be configured not to That's an opt-out and GPDR requires an opt-in.
    - bondarchuk 5y ago
      You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions.
      - maratc 5y ago
        It hardly matters in the court of law what you "could also say". The law is clear: you don't have to send your users' data to third parties, but if you decide to do it, you have to receive their informed consent first. In this case, the defendant chose to send personal data to a third party without receiving their informed consent. The option of conforming with the law by not sending that data anywhere still stands, as does the option of receiving informed consent beforehand.
        bondarchuk 5y ago
        But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah https://google.com/fonts/blah". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and then send it to a third party (e.g. selling user data to a data broker). >It hardly matters in the court of law what you "could also say". On the contrary, it's exactly what the court is there for.
iqanq 5y ago
Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?
- ZeroGravitas 5y ago
  When talking about UX, there's this bad habit of using people's mothers or grandmothers as examples, because they are 'too stupid' to understand the UI that was built. Aside from the obvious problems, this also implicitly removes blame from the designer/implementor of the interface. I always prefer to reframe it as someone with a very important, intelligence requiring job, say vaccine reasearcher, who doesn't have time to deal with your shitty UI when they want to print a document. I feel the same applies here.
  - iqonq 5y ago
    - mro_name 5y ago
      the car example again. There is a legal framework that has certain requirements. Enforced by a court here. These laws are from elected representatives of the people. So they are binding. Like it or not.
      - iqonq 5y ago
        Okay, and I made an argument of why I am against the law. That is all.
    - mro_name 5y ago
      and: many are forced to use the www if they like it or not. E.g. for tax or to get access to public services. So there's no excuse for hostility but it has to be legal and layperson-friendly.
    - jeltz 5y ago
      So you advocate a computer licence?
mro_name 5y ago
no, if external resources are pulled in prior informed consent then there is no agency. Such consent is a hard requirement. If I visit example.com I am not to guess what 3rd parties it uses.

Note the text: > It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website. In this context, "It is undisputed" does not mean "It is a truth universally acknowledged by everyone", but rather "there is no dispute between the defendant and the plaintiff that this happened; in the light of that non-disagreement, the court is not required to decide whether that happened or not, and will accept that as a fact". So in this case, the defendant (as well as the plaintiff, of course) agreed that "the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website". If there was a place to bring forward this "agency argument", this was the place; however the defendant seems to have chosen not to bring it forward. It may be because the defendant's lawyers are unprofessional and forgot; it may also be because they are professional and so they knew this argument would not hold. P.S. see also https://news.ycombinator.com/item?id=30139489 https://news.ycombinator.com/item?id=30139489

7373737373 5y ago

Yeah, the plaintiff's browser made the request after all, no?

guipsp 5y ago
Use this one weird trick to make all browser exploitation legal.
maratc 5y ago
The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.
- 7373737373 5y ago
  Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.
  - Jon_Lowtek 5y ago
    > a user agent is not forced to follow the instructions Luckily! A large german media corporation called "Springer" has for years, and is still, unsuccessfully trying to get the courts and politicians to rule that users can not manipulate web content and must run it as intended, as changing it would violate copyright and is a sabotage of their program. And i bet they aren't the only ones globally. Also: how many devices are locked down and can only run code as it is provided by trusted third parties? Try installing an ad-blocker on a smart-tv or a playstation.
  - maratc 5y ago
    > not forced to follow the instructions Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.
    - 7373737373 5y ago
      I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent forms for various provider, third party and user jurisdiction combinations is just inane.
      - maratc 5y ago
        There are two options to do what's required by the law: either A. not sending users' personal data to third parties; or B. receive informed consent from the users before sending their personal data to third parties. If the option B seems unwanted for some reason (any reason), there is still option A. Implementing a different solution (that breaks the law) has consequences.
mro_name 5y ago
no. It didn't decide and so isn't responsible. Have you ever seen a gun in jail?

dividedbyzero 5y ago

What does the browser's user agent have to do with this?

randalluk 5y ago
The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.
- maratc 5y ago
  > It could be configured not to That's an opt-out and GPDR requires an opt-in.
  - bondarchuk 5y ago
    You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions.
    - maratc 5y ago
      It hardly matters in the court of law what you "could also say". The law is clear: you don't have to send your users' data to third parties, but if you decide to do it, you have to receive their informed consent first. In this case, the defendant chose to send personal data to a third party without receiving their informed consent. The option of conforming with the law by not sending that data anywhere still stands, as does the option of receiving informed consent beforehand.
      - bondarchuk 5y ago
        But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah https://google.com/fonts/blah". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and then send it to a third party (e.g. selling user data to a data broker). >It hardly matters in the court of law what you "could also say". On the contrary, it's exactly what the court is there for.

iqanq 5y ago

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

ZeroGravitas 5y ago
When talking about UX, there's this bad habit of using people's mothers or grandmothers as examples, because they are 'too stupid' to understand the UI that was built. Aside from the obvious problems, this also implicitly removes blame from the designer/implementor of the interface. I always prefer to reframe it as someone with a very important, intelligence requiring job, say vaccine reasearcher, who doesn't have time to deal with your shitty UI when they want to print a document. I feel the same applies here.
- iqonq 5y ago
  - mro_name 5y ago
    the car example again. There is a legal framework that has certain requirements. Enforced by a court here. These laws are from elected representatives of the people. So they are binding. Like it or not.
    - iqonq 5y ago
      Okay, and I made an argument of why I am against the law. That is all.
  - mro_name 5y ago
    and: many are forced to use the www if they like it or not. E.g. for tax or to get access to public services. So there's no excuse for hostility but it has to be legal and layperson-friendly.
  - jeltz 5y ago
    So you advocate a computer licence?

mro_name 5y ago

no, if external resources are pulled in prior informed consent then there is no agency. Such consent is a hard requirement. If I visit example.com I am not to guess what 3rd parties it uses.