6 ms·

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my k

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with said business, not with Shopify, not with Google, not with Facebook or Twitter (I'm looking at those "sign in with" widgets that run social media code in my browser) or whatever 3rd party "SaaS" service the website is outsourcing my data to for ease of development or convenience. I don't consent to my data being shared with people I don't know about and did not consent to give a single shred of my information to.

chinathrow 5y ago
> I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. You might never know that they backfeed data into external analytics services. Under this assumption, wouldn't you need to stop using _any_ website, at all?
mwint 5y ago
> any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?
- scoutt 5y ago
  As long as Personal Data isn't being trasferred, there is no need to ask.
  - mwint 5y ago
    That CDN will know your IP and what site you’re from, and likely can do a decent job correlating visits with other sites. The internet is just not designed for privacy at a technical level.
    - eps 5y ago
      > The internet is just not designed for privacy at a technical level. The Internet is A-Ok. The issue lies with various slimy companies that exploit web developers ignorance, laziness and negligence with free and easy shortcuts in exchange for the private data of said developers' clients. No one's forcing you to use CDNs in place of a properly setup caching. No one's stuffing Google Fonts down your designer's throat, they are just lazy to add local resources. An analytics service is not required and there are simple self-hosted options. And so on and so forth. And the most infuriating part is that these companies, Google being the offender, know perfectly well that they are exploiting the ignorance and they are willingly facilitating and encouraging the spread of practices that would've been viewed as wildly unethical not 10-15 years ago. Just look at the level of general erosion of privacy and nearly universal lack of concern for it in general population. If you reflect on it for a moment, it is plain fucking scary.
- denton-scratch 5y ago
  > we want to load JS from a CDN like literally everyone does Well, carry on and load it, it's your server. Oh, wait, you mean you want ME to load it, into MY browser? That's a problem - my browser only loads JS from the origin server, and only if I give it explicit permission. As a developer, I deplore the use of CDNs to serve javascript libraries; you don't know what the CDN is going to serve to your users, it could change without warning and break your site.
  - mwint 5y ago
    You’re just illustrating why this isn’t an issue requiring legislation - anyone can block requests to whatever origin they like. No need for heavy handed gov’t getting involved in technical matters.
    - Griffinsauce 5y ago
      Anyone is a huge stretch. First people need awareness and secondly skill. Neither is widespread. Leaving users, especially vulnerable ones, to the whims of businesses. Privacy isn't a "technical matter".
      - mwint 5y ago
        If the large news outlets took a couple days to educate people, they’d know how. It’s not that complicated.
        isbvhodnvemrwvn 5y ago
        If you buy a gun then you can shoot the guy who robs you, so the robber doesn't do anything wrong.
        mwint 5y ago
        More analogous to locking your window, so the robber can’t get in to do wrong.
- youngtaff 5y ago
  You should self-host 3rd-party libraries for performance and reliability reasons anyway - reduces the number of TCP connections - reduced the risk of failure if the relevant edge node can't be reached Browsers don't support cross-site caching of 3rd-party content so whatever limited benefits there might have been of using a library CDN are long gone
  - toqy 5y ago
    A CDN isn't about caching jquery and sharing for various domains, everybody knows that doesn't work anymore. It's about getting jquery physically closer to your users. And sure upload it to your "own" CDN that you pay Azure or whoever for.
    - youngtaff 5y ago
      > Everybody knows this doesn't work anymore I be willing to bet that most web developers don't know about how the browser cache is partitioned And most people don't know that it never really worked (apart from perhaps a few Google fonts)
ComodoHacker 5y ago
>as long as the data never leaves their servers This is kind of ridiculous in the cloud era, isn't it? The analogy with external accountant up this thread is a good one. It's not about where data are processed, it's about how it's used.
- hdjjhhvvhga 5y ago
  No, it's not. Using Matomo on my own servers has nothing to do with the way GA etc. operates - it's an equivalent of going through my own Nginx logs and parsing them to generate diagrams and so on. Of course if I share personally identifiable data with a third party, it's a completely different thing - in this case it does not matter if it comes from Matomo or web server logs. But I agree with your conclusion: what matters is how it's being used. In this case - whether you share/sell it to others or not.* [*] But not only: it also matters if you take adequate care in protecting personally identifiable information or not.
  - germanier 5y ago
    In general, under the GDPR it doesn't matter much whether you process data yourself on your own server or contract that same task out to a third-party. Either that processing is legal or it isn't - ownership of the server doesn't play a role. The problem with Google Analytics here is not that it's a third-party but that it's under US control.
rewq4321 5y ago
This seems very impractical given the way the internet currently works. Most startups use dozens of SaaS products, let alone more basic/foundational things like global CDNs. You're being logged at every step of the process if only to prevent spam/DDoS/etc. What you're asking for would require a fundamental restructuring of the internet, and of software business models, and a lot of other stuff. I can't see that happening any time soon. In the meantime you can try using Tor, but good luck not getting blocked on half the websites you want to visit - and you can't blame the website for that (they need DDoS/spam defence).
- acka 5y ago
  When I visit a website of some business, I provide them with an IP address for use during the session (because of the way TCP/IP works). I'm okay with said site using some kind of load-balancer, DDoS protection or what not, as long as the business takes full responsibility to keep my personal information private unless I specifically indicate otherwise (opt-in[1]), for example using a form on the landing page. I believe that this is the true intent of the GDPR in this matter. [1]: https://europa.eu/youreurope/citizens/consumers/internet-telecoms/data-protection-online-privacy/index_en.htm https://europa.eu/youreurope/citizens/consumers/internet-tel...
- bcrosby95 5y ago
  Not only the internet, this is impractical given how any business works. Even a brick and mortar store is sharing aggregate customer buying habits with its supplier based upon products it buys from them.
Kerrick 5y ago
> I'm looking at those "sign in with" widgets that run social media code in my browser Arguably, they provide code that can be run in your browser, but your browser chooses to run it. And since your browser is a user agent, you choose to run the code by way of installing and configuring a browser that makes that choice by default.

chinathrow 5y ago

> I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. You might never know that they backfeed data into external analytics services. Under this assumption, wouldn't you need to stop using _any_ website, at all?

mwint 5y ago

> any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?

scoutt 5y ago
As long as Personal Data isn't being trasferred, there is no need to ask.
- mwint 5y ago
  That CDN will know your IP and what site you’re from, and likely can do a decent job correlating visits with other sites. The internet is just not designed for privacy at a technical level.
  - eps 5y ago
    > The internet is just not designed for privacy at a technical level. The Internet is A-Ok. The issue lies with various slimy companies that exploit web developers ignorance, laziness and negligence with free and easy shortcuts in exchange for the private data of said developers' clients. No one's forcing you to use CDNs in place of a properly setup caching. No one's stuffing Google Fonts down your designer's throat, they are just lazy to add local resources. An analytics service is not required and there are simple self-hosted options. And so on and so forth. And the most infuriating part is that these companies, Google being the offender, know perfectly well that they are exploiting the ignorance and they are willingly facilitating and encouraging the spread of practices that would've been viewed as wildly unethical not 10-15 years ago. Just look at the level of general erosion of privacy and nearly universal lack of concern for it in general population. If you reflect on it for a moment, it is plain fucking scary.
denton-scratch 5y ago
> we want to load JS from a CDN like literally everyone does Well, carry on and load it, it's your server. Oh, wait, you mean you want ME to load it, into MY browser? That's a problem - my browser only loads JS from the origin server, and only if I give it explicit permission. As a developer, I deplore the use of CDNs to serve javascript libraries; you don't know what the CDN is going to serve to your users, it could change without warning and break your site.
- mwint 5y ago
  You’re just illustrating why this isn’t an issue requiring legislation - anyone can block requests to whatever origin they like. No need for heavy handed gov’t getting involved in technical matters.
  - Griffinsauce 5y ago
    Anyone is a huge stretch. First people need awareness and secondly skill. Neither is widespread. Leaving users, especially vulnerable ones, to the whims of businesses. Privacy isn't a "technical matter".
    - mwint 5y ago
      If the large news outlets took a couple days to educate people, they’d know how. It’s not that complicated.
      - isbvhodnvemrwvn 5y ago
        If you buy a gun then you can shoot the guy who robs you, so the robber doesn't do anything wrong.
        mwint 5y ago
        More analogous to locking your window, so the robber can’t get in to do wrong.
youngtaff 5y ago
You should self-host 3rd-party libraries for performance and reliability reasons anyway - reduces the number of TCP connections - reduced the risk of failure if the relevant edge node can't be reached Browsers don't support cross-site caching of 3rd-party content so whatever limited benefits there might have been of using a library CDN are long gone
- toqy 5y ago
  A CDN isn't about caching jquery and sharing for various domains, everybody knows that doesn't work anymore. It's about getting jquery physically closer to your users. And sure upload it to your "own" CDN that you pay Azure or whoever for.
  - youngtaff 5y ago
    > Everybody knows this doesn't work anymore I be willing to bet that most web developers don't know about how the browser cache is partitioned And most people don't know that it never really worked (apart from perhaps a few Google fonts)

ComodoHacker 5y ago

>as long as the data never leaves their servers This is kind of ridiculous in the cloud era, isn't it? The analogy with external accountant up this thread is a good one. It's not about where data are processed, it's about how it's used.

hdjjhhvvhga 5y ago
No, it's not. Using Matomo on my own servers has nothing to do with the way GA etc. operates - it's an equivalent of going through my own Nginx logs and parsing them to generate diagrams and so on. Of course if I share personally identifiable data with a third party, it's a completely different thing - in this case it does not matter if it comes from Matomo or web server logs. But I agree with your conclusion: what matters is how it's being used. In this case - whether you share/sell it to others or not.* [*] But not only: it also matters if you take adequate care in protecting personally identifiable information or not.
- germanier 5y ago
  In general, under the GDPR it doesn't matter much whether you process data yourself on your own server or contract that same task out to a third-party. Either that processing is legal or it isn't - ownership of the server doesn't play a role. The problem with Google Analytics here is not that it's a third-party but that it's under US control.

rewq4321 5y ago

This seems very impractical given the way the internet currently works. Most startups use dozens of SaaS products, let alone more basic/foundational things like global CDNs. You're being logged at every step of the process if only to prevent spam/DDoS/etc. What you're asking for would require a fundamental restructuring of the internet, and of software business models, and a lot of other stuff. I can't see that happening any time soon. In the meantime you can try using Tor, but good luck not getting blocked on half the websites you want to visit - and you can't blame the website for that (they need DDoS/spam defence).

acka 5y ago
When I visit a website of some business, I provide them with an IP address for use during the session (because of the way TCP/IP works). I'm okay with said site using some kind of load-balancer, DDoS protection or what not, as long as the business takes full responsibility to keep my personal information private unless I specifically indicate otherwise (opt-in[1]), for example using a form on the landing page. I believe that this is the true intent of the GDPR in this matter. [1]: https://europa.eu/youreurope/citizens/consumers/internet-telecoms/data-protection-online-privacy/index_en.htm https://europa.eu/youreurope/citizens/consumers/internet-tel...
bcrosby95 5y ago
Not only the internet, this is impractical given how any business works. Even a brick and mortar store is sharing aggregate customer buying habits with its supplier based upon products it buys from them.

Kerrick 5y ago

> I'm looking at those "sign in with" widgets that run social media code in my browser Arguably, they provide code that can be run in your browser, but your browser chooses to run it. And since your browser is a user agent, you choose to run the code by way of installing and configuring a browser that makes that choice by default.