7 ms·

The web site did no such thing -- it served up a document that contained the reference. It is the end user that CHOSE to delegate interpretation of that docume

The web site did no such thing -- it served up a document that contained the reference. It is the end user that CHOSE to delegate interpretation of that document to a web browser (ad a counter example, look at how RMS browses the web). Yes this is less practical. But since the decision only deals with what is "possible", then logically it should be fully consistent. Now from a practical standpoint, I'd like to see a privacy consent header which informs the web site of the privacy options the user has selected. Absence of that header or absence of specific selections will result in annoying popups like we have now.

josefx 5y ago
> it served up a document that contained the reference A document that is expected to be executed by the receiving system. Might as well log in to your companies production server as root and send the completely meaningless string of letters "rm -rf / \n", not your fault if the receiving system actually executes it.
dTal 5y ago
It strikes me that this is exactly the same scenario, in reverse, that we have with people being convicted of "hacking" a website by entering a URL that wasn't supposed to be exposed. Things like "consent" and "authorization" are murky when we delegate our will to computer programs like browsers and servers. If URL "hacking" is illegal, then we have decided as a society that persuading a piece of software to do something does not equate to informed consent on the part of the person operating it (and by extension that we're meant to make some sort of guess as to what they do intend).
- southerntofu 5y ago
  I strongly disagree with this interpretation. In my view, a person maintaining infrastructure is a position of power and therefore should be held to specific standards in regards to how it treats users. Users on the other hand are just people. Being a user on a service does not grant you power over other users (not out-of-the-box anyway). Sure you can scan for vulns and/or follow a public link to a top-secret document: in my view that's nothing wrong. Now reverse the situation: why should a remote server administrator dictate the computing performed on your machine?! Is it ethical for some website operators to start scanning your local network? A service operator knows about threats, hopefully has counter-measures in place, and can always ban you (or specific requests) if it comes to that. A user is mostly helpless, especially when it comes to computations performed by a script you unconsciously downloaded and executed from a server. How many users are aware of what RCE even means and that a web browser with JS enabled is essentially RCE-as-a-service?
floatingatoll 5y ago
GDPR specifies a different interpretation of events, that takes precedence here: the user chose to visit GDPR-bound site A, and the law requires site A not to compel the user to visit any site B that is not bound by law or treaty to honor GDPR as well. You’re not wrong that one could logically evolve your interpretation from circumstances, but GDPR’s authors chose not to accept your interpretation as sufficient, and went further than that.
captn3m0 5y ago
We had two: https://en.m.wikipedia.org/wiki/P3P https://en.m.wikipedia.org/wiki/P3P, https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track
- derekp7 5y ago
  I was thinking more along the lines of the "allow location" and "allow notifications" popups. The web site will ask you first, and if you say yes the browser then asks you in its own popup. Or you can tell the browser to always accept, or always allow on a per-site basis.

josefx 5y ago

> it served up a document that contained the reference A document that is expected to be executed by the receiving system. Might as well log in to your companies production server as root and send the completely meaningless string of letters "rm -rf / \n", not your fault if the receiving system actually executes it.

dTal 5y ago

It strikes me that this is exactly the same scenario, in reverse, that we have with people being convicted of "hacking" a website by entering a URL that wasn't supposed to be exposed. Things like "consent" and "authorization" are murky when we delegate our will to computer programs like browsers and servers. If URL "hacking" is illegal, then we have decided as a society that persuading a piece of software to do something does not equate to informed consent on the part of the person operating it (and by extension that we're meant to make some sort of guess as to what they do intend).

southerntofu 5y ago
I strongly disagree with this interpretation. In my view, a person maintaining infrastructure is a position of power and therefore should be held to specific standards in regards to how it treats users. Users on the other hand are just people. Being a user on a service does not grant you power over other users (not out-of-the-box anyway). Sure you can scan for vulns and/or follow a public link to a top-secret document: in my view that's nothing wrong. Now reverse the situation: why should a remote server administrator dictate the computing performed on your machine?! Is it ethical for some website operators to start scanning your local network? A service operator knows about threats, hopefully has counter-measures in place, and can always ban you (or specific requests) if it comes to that. A user is mostly helpless, especially when it comes to computations performed by a script you unconsciously downloaded and executed from a server. How many users are aware of what RCE even means and that a web browser with JS enabled is essentially RCE-as-a-service?

floatingatoll 5y ago

GDPR specifies a different interpretation of events, that takes precedence here: the user chose to visit GDPR-bound site A, and the law requires site A not to compel the user to visit any site B that is not bound by law or treaty to honor GDPR as well. You’re not wrong that one could logically evolve your interpretation from circumstances, but GDPR’s authors chose not to accept your interpretation as sufficient, and went further than that.

captn3m0 5y ago

We had two: https://en.m.wikipedia.org/wiki/P3P https://en.m.wikipedia.org/wiki/P3P, https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track

derekp7 5y ago
I was thinking more along the lines of the "allow location" and "allow notifications" popups. The web site will ask you first, and if you say yes the browser then asks you in its own popup. Or you can tell the browser to always accept, or always allow on a per-site basis.