5 ms·

Yeah, the plaintiff's browser made the request after all, no?

guipsp 5y ago
Use this one weird trick to make all browser exploitation legal.
maratc 5y ago
The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.
- 7373737373 5y ago
  Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.
  - Jon_Lowtek 5y ago
    > a user agent is not forced to follow the instructions Luckily! A large german media corporation called "Springer" has for years, and is still, unsuccessfully trying to get the courts and politicians to rule that users can not manipulate web content and must run it as intended, as changing it would violate copyright and is a sabotage of their program. And i bet they aren't the only ones globally. Also: how many devices are locked down and can only run code as it is provided by trusted third parties? Try installing an ad-blocker on a smart-tv or a playstation.
  - maratc 5y ago
    > not forced to follow the instructions Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.
    - 7373737373 5y ago
      I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent forms for various provider, third party and user jurisdiction combinations is just inane.
      - maratc 5y ago
        There are two options to do what's required by the law: either A. not sending users' personal data to third parties; or B. receive informed consent from the users before sending their personal data to third parties. If the option B seems unwanted for some reason (any reason), there is still option A. Implementing a different solution (that breaks the law) has consequences.
        7373737373 5y ago
        There's a difference between data sent to the website provider (and through it, indirectly to third parties), and interactions between the browser and third parties. The linked ruling forces the provider to ask the user for consent for third parties (even though the provider has nothing to do with the interaction!), instead of mandating a direct opt-in interaction between the user (agent) and third parties. Imagine embedding many social media sites. Instead of forcing the social media sites or browser vendors to create embeddings that ask for consent themselves, the website provider has to ask for consent on behalf of all external sites before loading any content. As a web developer, this is a nightmare.
        maratc 5y ago
        > even though the provider has nothing to do with the interaction I beg your pardon, but in this case "the provider" (website) has directly sent the user's browser to a third party (google fonts) by including an instruction in the code (HTML) that the provider has sent to the user's browser. The browser did not decide to contact google fonts all by itself; it was directed to do so by the provider. Arguing the provider "has nothing to do with the interaction" looks a bit disingenuous to me.
  - ratww 5y ago
    > It's not as if the plaintiff's browser is actually under control of the defendant In theory and in practice it is, though. The browser viewport, by executing remote code, is in fact under control of the defendant's website. Most websites are closed-source. The "instructions" are not available to the customer.
- austhrow743 5y ago
  Website have no authority over the browsers accessing them. They can't order. Just state information. "There's a font over here" not "you have to go access this font over here". That browsers by default tend to follow links to resources automatically doesn't change that. It's still the agent the user has chosen to represent them when talking to the website making the decision not the website. If a legal body want to make the call that users shouldn't be responsible for choosing what their browsers automatically do or don't do on their behalf that's fine. But it's absurd to do it by making it the website creators problem. It's the browser that's choosing to do things without asking the person it represents for explicit permission. It's the browser sending the information to the third party. Put it on the browsers! We've got a handful of choices for browsers. They all gratuitously send every bit of information they can get their hands on to every website they can. Just straight up informational security Judas'. And GDPR blames websites? It's crazy to me.
mro_name 5y ago
no. It didn't decide and so isn't responsible. Have you ever seen a gun in jail?

Use this one weird trick to make all browser exploitation legal.

The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.

7373737373 5y ago
Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.
- Jon_Lowtek 5y ago
  > a user agent is not forced to follow the instructions Luckily! A large german media corporation called "Springer" has for years, and is still, unsuccessfully trying to get the courts and politicians to rule that users can not manipulate web content and must run it as intended, as changing it would violate copyright and is a sabotage of their program. And i bet they aren't the only ones globally. Also: how many devices are locked down and can only run code as it is provided by trusted third parties? Try installing an ad-blocker on a smart-tv or a playstation.
- maratc 5y ago
  > not forced to follow the instructions Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.
  - 7373737373 5y ago
    I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent forms for various provider, third party and user jurisdiction combinations is just inane.
    - maratc 5y ago
      There are two options to do what's required by the law: either A. not sending users' personal data to third parties; or B. receive informed consent from the users before sending their personal data to third parties. If the option B seems unwanted for some reason (any reason), there is still option A. Implementing a different solution (that breaks the law) has consequences.
      - 7373737373 5y ago
        There's a difference between data sent to the website provider (and through it, indirectly to third parties), and interactions between the browser and third parties. The linked ruling forces the provider to ask the user for consent for third parties (even though the provider has nothing to do with the interaction!), instead of mandating a direct opt-in interaction between the user (agent) and third parties. Imagine embedding many social media sites. Instead of forcing the social media sites or browser vendors to create embeddings that ask for consent themselves, the website provider has to ask for consent on behalf of all external sites before loading any content. As a web developer, this is a nightmare.
        maratc 5y ago
        > even though the provider has nothing to do with the interaction I beg your pardon, but in this case "the provider" (website) has directly sent the user's browser to a third party (google fonts) by including an instruction in the code (HTML) that the provider has sent to the user's browser. The browser did not decide to contact google fonts all by itself; it was directed to do so by the provider. Arguing the provider "has nothing to do with the interaction" looks a bit disingenuous to me.
- ratww 5y ago
  > It's not as if the plaintiff's browser is actually under control of the defendant In theory and in practice it is, though. The browser viewport, by executing remote code, is in fact under control of the defendant's website. Most websites are closed-source. The "instructions" are not available to the customer.
austhrow743 5y ago
Website have no authority over the browsers accessing them. They can't order. Just state information. "There's a font over here" not "you have to go access this font over here". That browsers by default tend to follow links to resources automatically doesn't change that. It's still the agent the user has chosen to represent them when talking to the website making the decision not the website. If a legal body want to make the call that users shouldn't be responsible for choosing what their browsers automatically do or don't do on their behalf that's fine. But it's absurd to do it by making it the website creators problem. It's the browser that's choosing to do things without asking the person it represents for explicit permission. It's the browser sending the information to the third party. Put it on the browsers! We've got a handful of choices for browsers. They all gratuitously send every bit of information they can get their hands on to every website they can. Just straight up informational security Judas'. And GDPR blames websites? It's crazy to me.

mro_name 5y ago

no. It didn't decide and so isn't responsible. Have you ever seen a gun in jail?