19 ms·

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

Already__Taken 5y ago
The website owner decides what's asked to be done. The browser is still owned by the end-user can choose to make the request. This is why ad-blocking is fundamentally required.
Andrew_nenakhov 5y ago
Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?
- npteljes 5y ago
  So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.
  - Andrew_nenakhov 5y ago
    If you are that caring about your privacy, you absolutely should use a browser that is configured in such a way that it doesn't leak your IP to anyone you didn't consent to.
    - npteljes 5y ago
      I'm running systems that I'm modifying to the extent that satisfies me, but that's not the concern here. Right now I'm caring about everyone's default privacy level, not just my own. And in this ideal world, third party sharing is not opt-out.
  - 7373737373 5y ago
    Yes, definitely. Ad absurdum, browsers could be mandated to have the user opt-in to every single instruction that is executed. It's technically possible, the user has control. I think it's a slippery slope to imagine/enforce a transfer of agency between the website user and provider, where the latter will try to make the opt-in appear as simple as possible. An ideal opt-in is more than the click of a button, it's an understanding. A button accompanied by a wall of text isn't understanding.
    - npteljes 5y ago
      Code in the frontend is absolutely not "asking". I'd bet that most of the users have no idea what's going on in their browsers and devices, and those instruments then, in turn, shouldn't prey on this ignorance. I know that this is not how the world works, but a difference is that we could have control over this one.
  - leobg 5y ago
    The court did not even see this issue, i.e. the distinction between issuing a suggestion or directive vs. actually executing the request directly. The court, in fact, states that the was the website itself that did the sharing. The ruling suffers from unsound reasoning. It could be, however, that the website owner never brought up these arguments. The court does not have to do its own investigation. This is called the “maxim of disposition” in German law. Whatever both parties agree on what is true has be treated as true by the court. So if the claim that the website itself issued the request to Google servers was uncontested, then this ruling is sound, based on the claims brought forth by the parties in this particular case.
- germanier 5y ago
  Depending on the circumstances, telling people to jump from the bridge can be a crime.
  - Andrew_nenakhov 5y ago
    Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?
    - npteljes 5y ago
      Another thing came to mind. Let's say you know I'm the kind of person to easily give people money. I just got my paycheck, and you knowing this, you ask me to give you the money. I'll give you the money because that's the kind of person I am. But then I'm left with no money for the month, and all of its consequences. Who do you think would carry the blame in this situation?
    - rpadovani 5y ago
      You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right? UK:https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_crime_in_English_law https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland) https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)
      - Andrew_nenakhov 5y ago
        Stripping and jumping from a bridge is not illegal activity.
        ceejayoz 5y ago
        Both are illegal in quite a few places. Stripping may violate public nudity laws. Jumping off bridges is often illegal, as well. For example, Florida: https://www.tcpalm.com/story/news/local/2020/07/06/bridge-jumping-illegal-but-common-summer-treasure-coast/3198620001/ https://www.tcpalm.com/story/news/local/2020/07/06/bridge-ju...
- isbvhodnvemrwvn 5y ago
  A regular user has no idea how these mechanisms work and can't be reasonably expected to do the configuration themselves. Since it's a clearly privacy-hostile behavior to include this code in the first place, the operator of the website should be prosecuted.
leobg 5y ago
I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.
- tyilo 5y ago
  Going further with this argument would all hacking also be ok?
  - parksy 5y ago
    No because hacking generally circumvents the intended system design. The architecture of the World Wide Web explicitly allows for user discretion in fetching and executing linked content. There's no slippery slope from using a system within design parameters and executing malicious instructions on other people's systems without their permission and/or knowledge.
  - leobg 5y ago
    Good point. There is a distinction to be made. For fraud, we have those distinctions. If I send you an email that looks like an invoice for a service you already ordered, but is really, at closer inspection, an order form, I am still responsible if I planfully designed the email so that the average recipient would be fooled. This also means that if I send that email to grandmas I’ll be held more accountable than if I send it to lawyers. These are all important discussions. The ruling we see here just doesn’t enter such discussions, because the court hasn’t even recognized the problem.
- rpadovani 5y ago
  Except you cannot. If you are aware of a vulnerability that triggers the destruction of user's data from the browser just visiting a website, abusing it would be illegal.
- Flocular 5y ago
  >>You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those. By that logic malware doesn't exist. That's the wildest west version of the internet that we gladly left behind.

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

Already__Taken 5y ago

The website owner decides what's asked to be done. The browser is still owned by the end-user can choose to make the request. This is why ad-blocking is fundamentally required.

Andrew_nenakhov 5y ago

Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

npteljes 5y ago
So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.
- Andrew_nenakhov 5y ago
  If you are that caring about your privacy, you absolutely should use a browser that is configured in such a way that it doesn't leak your IP to anyone you didn't consent to.
  - npteljes 5y ago
    I'm running systems that I'm modifying to the extent that satisfies me, but that's not the concern here. Right now I'm caring about everyone's default privacy level, not just my own. And in this ideal world, third party sharing is not opt-out.
- 7373737373 5y ago
  Yes, definitely. Ad absurdum, browsers could be mandated to have the user opt-in to every single instruction that is executed. It's technically possible, the user has control. I think it's a slippery slope to imagine/enforce a transfer of agency between the website user and provider, where the latter will try to make the opt-in appear as simple as possible. An ideal opt-in is more than the click of a button, it's an understanding. A button accompanied by a wall of text isn't understanding.
  - npteljes 5y ago
    Code in the frontend is absolutely not "asking". I'd bet that most of the users have no idea what's going on in their browsers and devices, and those instruments then, in turn, shouldn't prey on this ignorance. I know that this is not how the world works, but a difference is that we could have control over this one.
- leobg 5y ago
  The court did not even see this issue, i.e. the distinction between issuing a suggestion or directive vs. actually executing the request directly. The court, in fact, states that the was the website itself that did the sharing. The ruling suffers from unsound reasoning. It could be, however, that the website owner never brought up these arguments. The court does not have to do its own investigation. This is called the “maxim of disposition” in German law. Whatever both parties agree on what is true has be treated as true by the court. So if the claim that the website itself issued the request to Google servers was uncontested, then this ruling is sound, based on the claims brought forth by the parties in this particular case.
germanier 5y ago
Depending on the circumstances, telling people to jump from the bridge can be a crime.
- Andrew_nenakhov 5y ago
  Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?
  - npteljes 5y ago
    Another thing came to mind. Let's say you know I'm the kind of person to easily give people money. I just got my paycheck, and you knowing this, you ask me to give you the money. I'll give you the money because that's the kind of person I am. But then I'm left with no money for the month, and all of its consequences. Who do you think would carry the blame in this situation?
  - rpadovani 5y ago
    You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right? UK:https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_crime_in_English_law https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland) https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)
    - Andrew_nenakhov 5y ago
      Stripping and jumping from a bridge is not illegal activity.
      - ceejayoz 5y ago
        Both are illegal in quite a few places. Stripping may violate public nudity laws. Jumping off bridges is often illegal, as well. For example, Florida: https://www.tcpalm.com/story/news/local/2020/07/06/bridge-jumping-illegal-but-common-summer-treasure-coast/3198620001/ https://www.tcpalm.com/story/news/local/2020/07/06/bridge-ju...
isbvhodnvemrwvn 5y ago
A regular user has no idea how these mechanisms work and can't be reasonably expected to do the configuration themselves. Since it's a clearly privacy-hostile behavior to include this code in the first place, the operator of the website should be prosecuted.

leobg 5y ago

I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.

tyilo 5y ago
Going further with this argument would all hacking also be ok?
- parksy 5y ago
  No because hacking generally circumvents the intended system design. The architecture of the World Wide Web explicitly allows for user discretion in fetching and executing linked content. There's no slippery slope from using a system within design parameters and executing malicious instructions on other people's systems without their permission and/or knowledge.
- leobg 5y ago
  Good point. There is a distinction to be made. For fraud, we have those distinctions. If I send you an email that looks like an invoice for a service you already ordered, but is really, at closer inspection, an order form, I am still responsible if I planfully designed the email so that the average recipient would be fooled. This also means that if I send that email to grandmas I’ll be held more accountable than if I send it to lawyers. These are all important discussions. The ruling we see here just doesn’t enter such discussions, because the court hasn’t even recognized the problem.
rpadovani 5y ago
Except you cannot. If you are aware of a vulnerability that triggers the destruction of user's data from the browser just visiting a website, abusing it would be illegal.
Flocular 5y ago
>>You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those. By that logic malware doesn't exist. That's the wildest west version of the internet that we gladly left behind.