17 ms·

Crazy how evil Google is. Just wow. Since this runs entirely on the domain of the website, it can easily ignore your privacy rights, with Google more or less w

• ornornor 5y ago
  > privacy rights given to us by law (eg in the EU) > As a EU citizen, i hope that our ineffectual administration at least tries to fight this somehow. Of course, there is little hope. GDPR is thanks to the EU and I wouldn’t say it has no effect. It seems like you’re contradicting yourself with these two paragraphs.
  • CommanderData 5y ago
    GDPR has been a massive win for user/consumer rights. Its a piece of legislation law makers in the US are trying to mimic. Surprisingly the UK are trying to rid or weaken GDPR significantly after brexit. The only way to fix this problem now is through strong legislation.
    • wjnc 5y ago
      Do we really need more or new legislation if there is still ample room for improvement on the enforcement side of GDPR. Just a not so far stretch: all or most of the GDPR supervisors now think Google Analytics is a no-go. Publish this and an intention to fine say 2% of revenue, set an expiration date six months ahead and do a EU-tender for a scraping facility finding all users of Google Analytics. Then in six months, re-scrape and send out the fines. Rinse and repeat. Google Tag Manager could be declared illegal on the outset, with a 5 to 10% fine for Google if they continue to offer it in the EU. Do a top-down assessment of the usage of Google Tag Manager in the largest e-commerce users in Europe. Fine them as well. At the end of the day privacy enforcement could easily pay for itself. (Edit: After typing this I think you were writing from a US perspective. I think GDPR is a big win as well, but enforcement is feeble ;)
    • mlatu 5y ago
      US law makers are trying to mimic GDPR? are you certain? would be certainly nice, but i dont believe there is a majority in the US that would support such a change. I mean there are probably more individual people interested in doing that than not, but I bet in comparison there are more individual $$$ being invested in keeping data privacy laws as lax as possible
    • kkjjkgjjgg 5y ago
      Did it really make the world a better place? Most sites collect as much data as ever, but now we need many more clicks, and can't have nice things like photos from kindergarden parties anymore.
      • GreenWatermelon 5y ago
        I'm less likely to use a site that offers obnoxious cookie consent forms, and I think I'm better off without them. so yeah, it made the world better for me. My anger is directed towards the criminal websites that seek to circumvent the spirit of the law (most if the web today)
        • shadowgovt 5y ago
          To my observation, there are no sites with more than a dram of content on them that haven't been compelled by GDPR compliance to put an obnoxious cookie banner up. If you've found some, please share.
          • denton-scratch 5y ago
            If you need to set a cookie for the correct operation of your site, then you don't need a cookie banner. The banners are a middle-finger to the GDPR.
            • shadowgovt 5y ago
              ... but "correct operation of your site" is in the eye of a judge and can't be evaluated before someone brings suit, so "better safe than sorry" behavior (at the cost of user time) is completely predictable. ... It's not even clear that it's safe to log IP addresses in the style of a default Apache configuration on a static website without user consent.
              • denton-scratch 5y ago
                > completely predictable It's completely predictable that there are people who don't want to comply. Collecting personal information is a lucrative business. Re. Website logs: in fact it's perfectly clear that a website log retained for the purposes of site management is fine. It's on the face of the regulation.
    • kristofferR 5y ago
      > Surprisingly the UK are trying to rid or weaken GDPR significantly after brexit. Isn't that the whole point of brexit - to get rid of various EU customer protection laws and regulations?
  • chickenimprint 5y ago
    Is it safe to assume you've never had to deal with those downright malevolent dark patterns and button labyrinths, designed to make it extremely unlikely for anyone in the general population to actually reject tracking?
    • simongray 5y ago
      There are solutions to most of that, e.g. https://chrome.google.com/webstore/detail/consent-o-matic/mdjildafknihdffpkfmmpnpoiajfjnjd https://chrome.google.com/webstore/detail/consent-o-matic/md...
      • danuker 5y ago
        This is more of a workaround. A solution to a poliical problem is political, not technical.
        • mlatu 5y ago
          i would call it societal; society still needs to grasp in what way they are being exploited. it's still not clear to most people
        • emsixteen 5y ago
          How is it political?
          • danuker 5y ago
            The decision to force service providers collect consent from their own users is a political decision. And a fundamentally bad one: providers' incentive is to make it easy to get consent and hard to refuse. I don't know what policy is better than this, but right now, we only get more annoyance without any benefits in privacy. Pretty much every page I've visited issues 3rd party requests before I consent to data sharing.
      • KronisLV 5y ago
        Those are (nice) solutions to a problem that shouldn't be allowed to (legally) exist. The industry shouldn't be allowed to play clever with the ways to coerce their users into giving up their information just because they know that most of those users are not interested in navigating difficult dialogs.
  • MrYellowP 5y ago
    You think the GDPR is a good idea? Wow, mate, that's quite the detachment from reality. In reality, GDPR is pure nonsense. It's a serious burden for anyone putting up a site. Any site. They all have cookies. All of them. It is so bad, there are now services taking care of this, because it's so much of a bullshit that people need to rely on others to get it right. You'll probably spin this as a net win, right? Because more businesses, right? Right?? The odds of 99% of the people not simply clicking "accept all" are slim to none and anyone insisting otherwise would make himself look like a moron. It's like you're assuming the masses out there are actually thinking about things. They don't! It's not how people work! They just click it away and are done with it, because it's super fucking annoying to constantly click that bullshit away and it does literally nothing for us people, no matter how much anyone would want to insist that it does, theoretically, do benefit us. The GDPR is pure nonsense. It is not made for the people. It in fact completely ignores how people operate.
    • sunaurus 5y ago
      It seems you're not fully clear on what GDPR is. You could check this page for more info: https://gdpr.eu/what-is-gdpr/ https://gdpr.eu/what-is-gdpr/ Just as a very brief note: it's not really about cookies, it's more about how companies should store data about people and what kind of rights people have concerning that data.
      • MrYellowP 5y ago
        AND NOBODY FUCKING CARES! THAT'S THE FUCKING POINT! ALL IT IS IS AN ANNOYING WINDOW WHICH HAS TO BE CLICKED AWAY! That's what I mean by "detached from reality." For you it's something glorified, but the vast majority of humanity do not give a flying fuck and just think it's annoying. You think this is good! It's not! You're just so deep in that bubble, you don't fucking recognize that your bubble isn't actual reality!
        • sunaurus 5y ago
          Again, go ahead and read the link I posted. You're talking about cookie consent pop-ups, those are not what the GDPR is about at all. Putting a cookie consent pop-up on your website does not make you compliant with the GDPR. The GDPR is about protecting personal information of EU citizens, giving them rights to demand access to data that is held about them, and giving them rights to request deletion of any personal data that is held about them. To be super clear, I'm not saying that cookie consent pop-ups are good - I also think they're not really serving any real purpose. But this fact has very little to do with the GDPR!
• dxdm 5y ago
  > our ineffectual administration It always saddens me to see EU citizens talk in absolutes like that. With some exceptions, and by comparison, we have some of the best governments in the world, and, for all its faults, the EU has been a huge net positive. Perpetuating these overly negative stereotypes just aids populists in replacing our good governance with the other kind that we see all over the world.
  • deleted 5y ago
    [deleted]
  • prox 5y ago
    I agree. I understand people like to talk in this way to show their emotional connection to the topic, but it’s not very helpful and like you mention, too absolute. It’s a system in progress, and we need to be invested in its ideals (fair, just, democratic)
    • saiya-jin 5y ago
      Most often such comments come from eastern parts of Europe, where nationalistic movements have a nice resurgence in past few years. A prime example is Czech republic, a very euro-skeptical nation despite all the benefits it brought them. Hungary would be another one. That being said, as somebody coming from east too and seeing clearly all the direct and indirect benefits of EU, its far from ideal. The whole concept of central planning resembles old east communist block when soviets forced down our throats whatever they pleased (we had to refuse Marshall's plan, they took all of our uranium reserves for free for which more appropriate term is stealing, and many many other cases) and that's an association many older people have knee-jerk reaction of.
      • ThalesX 5y ago
        > Most often such comments come from eastern parts of Europe, where nationalistic movements have a nice resurgence in past few years. I wish people would stop attributing our attitude to nationalistic resurgences. I’m a globalist and think nationalism and regionalism should be relics of the past and I keep getting put in the same box as nationalists because I am Euro-realist. With this frame of mind I think the EU politicians are shit at building the foundations for a truly globalized civilization and the current system devalues entire areas of the continent both of natural resources as well as human resources.
• npteljes 5y ago
  How is this crazy? Server administrators could have done, and have done anything on their side of the code. Nothing changed on this front since the invention of the HTTP request.
  • eps 5y ago
    What's crazy is how openly anti-individual Google is. They explicitly and aggressively facilitate practices that virtually every single person is against.
    • shadowgovt 5y ago
      ... in the tech-commentary echo chamber, perhaps. The outside world is more apathetic than hostile to it.
      • cascom 5y ago
        It shouldn’t be on the todo list of the average user to be knowledgeable on this subject, just like the average consumer should not have to be an expert in airbags to expect the ones installed in their car to work.
        • shadowgovt 5y ago
          I think there's a huge assumption implied in an analogy between airbags and user tracking. Airbags save lives. Anti-tracking guards against some hand-wavey philosophical concerns regarding privacy (in an inconsistent fashion, even... It's hard for me to buy that we need to make user-behavior tracking for ad targeting illegal in a world where user-purchase tracking for credit reporting is legal).
          • cascom 5y ago
            My point is that an average consumer does not and should not need to understand some complex embedded technology in the products they buy and use, and that their lack of interest and understanding of such technologies can’t be used to infer their intent on a broader subject (privacy,safety,health, etc)
• kkjjkgjjgg 5y ago
  Is it really worse for the users? Article also mentions possible privacy benefits, as Google could prevent transmission of some data to third parties.
  • niels_bom 5y ago
    Believing Google values privacy over profits is a bit naive I’d say.
    • kkjjkgjjgg 5y ago
      Nevertheless it could be strictly better: the new version gives the OPTION to share less data, whereas the old version does not really give you the option. If you include third party scripts, they can just send the information to third parties directly. Google could also be audited and would then have to prove that they really didn't share ay data, or whatever.
      • ImPostingOnHN 5y ago
        In the old way, site owners who did not want to send data to 3rd parties could just NOT insert the "send data to 3rd parties" code into their website Now they still have that option, but users have no technical means to determine whether this is happening
        • kkjjkgjjgg 5y ago
          In the old days, servers could still share data with third parties, so in that sense, there never was any way to be sure.
      • pixeldetracking 5y ago
        the big difference is that I cannot audit the websites using this new version of GTM (and I don't trust marketers)
        • 5y ago
• PhantomGremlin 5y ago
  Crazy how evil Google is. Just wow. Yeah, but there are a lot of employees there who check their bank accounts twice a month and say: "Just wow". Venial evil is easily bought. Edit: As a EU citizen I really hate to even say this, but "Crazy Vlad" nearby is what true evil is about.
  • raspberry1337 5y ago
    >I really hate to even say this, but "Crazy Vlad" nearby is what true evil is about. I would say that systematic evil, evil that is a consequence of technology or reality, will always surpass individual evil. It's like comparing the horrors of slavery as an instituted system compared to one really evil, sadistic slave-owner. Or how the native Americas we're to the 90% killed by viruses, rather than the evil of greedy conquerors. Perhaps you could argue that Putin is a manifestation of an evil system as well, but I'd think that if he was replaced by a good person tomorrow, the world would be a radically better place. Google is clearly working hard, as an powerful institution, to perpetuate the system.
  • Cthulhu_ 5y ago
    That's the thing here, morals are flexible for most people if there's a decent paycheck on the other side. It's another reason why politics are so corrupt these days. There's plenty of ways to avoid direct corruption, via "campaign funds", board of director seats, and lucrative corporate positions after a political career - most recently there's Nick Clegg, a former UK politician who will now be paid $15 million a year and probably bonuses and stocks as well to represent Facebook.
• Cederfjard 5y ago
  Not taking a moral stance here, just curious what laws you think have been broken in this instance?
  • RamblingCTO 5y ago
    Technically none. But google helps circumvent protections that would prevent illegal cases where website owners are breaking the law. Now we can't defend ourselves any more. Would be fun to see if any law makers would consider this abedment (?) or even go directly after google for this kind of thing.
• manholio 5y ago
  > Of course, there is little hope. I think our hope are technical solutions: - No 3rd party cookies or equivalents, fully compartmentalized browsing, no automated cross-domain GETs/POSTs, no domain can leak data to another domain without manual intervention - No User-Agent leak, just a standards compliance level ex. HTML/5.0 - No Java-Script leaks, fonts or any other way to do client fingerprinting - Cycle your IPv6 addresses or even use persistent IP-domains binding, with OS support, in a Tor-like manner. - & Many more It will break the current web yes, but the web needs a do-over, it has become a toxic soup of massive surveillance.
  • marcosdumay 5y ago
    None of those have any chance of helping.
    • manholio 5y ago
      Really, none of them, not even a chance? And you've conjured that conclusion using your extraordinary powers of argumentation, perchance.
      • marcosdumay 5y ago
        Hum. Do you care to explain how any of them could stop the attack on the article? Because they are all aimed at stopping cross domain leaks that have nothing to do with it and fingerprinting that is moot once you share cookies.
• habosa 5y ago
  > the only possible reason this exists at all is to illegally circumvent privacy preferences. The article gives multiple other reasons why this exists.
• fxtentacle 5y ago
  I'd say when it comes to privacy laws, the EU is actually doing better than almost any other countries. Yes, they could be faster, but the GDPR is still a big win for users everywhere. And a pita for Facebook / Google, which is intentional.
  • csunbird 5y ago
    Laws are meaningless if they are not enforced. It has been more than 3 years and all kind of illegal cookie banners, unauthorized processing of the data and data leaks without any discourse to the public are still there.
• piokoch 5y ago
  Things has changed indeed. Modern economy (I mean the one that has started somewhere deep in the Middle-ages) which finally led to the appearance of capitalism, was built on several foundations, one of them was ethics - in the olden days, in the times of lack of communication, invoices, the state authority that could enforce any law quickly, people had to count on the honesty of the others. One merchant had to trust another, otherwise no trade would be possible, there were no courts that could block dishonest party bank account or take any action to prevent fraud. There were dishonest merchants, sure, but when finally message was spread, nobody would trade with them (if they managed to stay alive). In the western world this ethics come from Christianity, those who were stealing, cheating, were going to hell - People really believed that and were afraid of this. Today for a lot of people, and for sure for Google management, this sounds like some fairy tale of the Princess Mononoke or Little Red Riding Hood type. Nobody (including a lot of Christians) is not scared by the devil, hell and all that stuff any more. Unfortunately, as we see, ethics is still needed. Whatever EU does, Google will find the way to circumvent any regulation as it happens with GDPR, which is easily bypassed by the maze of buttons, 6pt light grey text, etc. And even if Google will be forced at some point to close its service officially in Europe (escalation that probably will never happen, but I also though that probably there will no war in Europe during my lifetime), people will use VPN-s, etc. to keep using it, as there is no viable alternative (the issue in itself). It all can stop only if some people in Google would just decide that doing X is nasty and that they are abandoning the idea, even if income will be smaller next year. This would be an ethical behavior, but nowadays to be ethical company it is cheap - it is sufficient to add to your company management board "person of color", person from "oppressed minority" (luckily there is so many such minorities to chose from so this is not a problem) which costs somewhere around $500K per year plus change your company logo to LGBT+ rainbow once a year ($100 for an HTML expert to handle this). Once this is covered, company is ethical in the eyes of the public and can use all possible tax avoidance schemes, exploit it workers as Amazon does in its warehouses, steal their data and use them to create conflicts between people and manipulate them like Facebook does. And so on. As a result Google can do what it wants and nobody will stop them. More, people would not even know about this outside tech/privacy oriented circles as mass media are living from the ads, so this change is actually what they dream of.
  • 5y ago
• Cthulhu_ 5y ago
  > Since this runs entirely on the domain of the website, it can easily ignore your privacy rights. This is not exactly correct; unless the user consents, they still can't transmit this data to any 3rd party. I mean they can, but they're not allowed to. I mean they're not allowed to, but IF they investigate and IF they find evidence that data is shared with third parties and IF they can be arsed to proceed with legal action, the company using this technology MIGHT be in trouble. It does work to circumvent ad- and tracking blockers though, if they can hide the endpoint and scripts well enough.
• fsflover 5y ago
  If you want to support the fight for privacy in EU, consider supporting https://edri.org https://edri.org.
• manigandham 5y ago
  Any website can ingest data and then pass it off to another 3rd party. This has been possible since the dawn of the internet and very common. There is absolutely nothing new here. The technical workings of how data is collected on websites is completely orthogonal to legal doctrine that protects user privacy.
  • pixeldetracking 5y ago
    the "new" thing is that it's been pushed by Google, hence made a lot easier
• beagle3 5y ago
  What is their means to correlate users between sites, though? On IPv6, the IP itself is often enough (or IP+Browser/OS version). Currently, at home, I’m behind a CG/NAT (and with a somewhat fingerprint resistant setup - rotating user agent, blocked canvas, a few other things). What would they use to correlate my identity across sites, when there’s no common “google.com” cookie to anchor against?
• suction 5y ago
  • RamblingCTO 5y ago
    That's definitely not trolling, that's just correct. We have nice laws and stuff, but it's not widely enforced and almost all websites do not implement these laws correctly. So why is it trolling? You also need to enforce it and make it hurt.
    • thirdvect0r 5y ago
      Twitter has convinced everyone on the Internet that people who have even midly divergent views about their government of choice are "Russian bots".
      • jevgeni 5y ago
        No, Russian bots convinced everyone to suspect diverging opinions to be Russian bots.
      • suction 5y ago
        Never been on Twitter, sorry kid
• Gibbon1 5y ago
  I was thinking about something. There is belief that Old Boeing died when they 'bought' McDonald Douglas, with the result that MD's cancerous bloated failed defense contractor management then injected itself into Boeing. Hear me out. Google bought Doubleclick in 2007. And Doubleclick's sleezy amoral management culture injected itself into Google.
  • tyingq 5y ago
    I'm sure it had an effect, but they were already reading your email and making targeted ads out of the content before that.
  • geeB 5y ago
    From the outside, Eric Schmidt basically put them on the current track and he long predates the acquisition. Most likely when the company was in its infancy and growing at high rates relied on cranking out products loved by all, it was easy to do the right thing/humor the founders (assuming they cared at least). At this stage though there is not much utility (as far as increasing ad revenue) in improving products, so its harder to hide what really mattered all along if they want to meet the growth expectations that the market/themselves have set.
• kall 5y ago
  Well, it‘s not the only possible reason (but probably the core one). It will theoretically also improve website performance. I‘ve personally seen some bad things injected by GTM. For now, this doesn‘t actually work for the thousands of trackers by flimsy adtech companies, so I guess that benefit won‘t materialise. I don‘t think this is really different from what usually happens with Segment and pretty much exactly what happens with (Cloudflare aquired) Zaraz. I guess the problem is that google is doing it and why. In terms of blocking, isn‘t it good for you when a website uses segment? One script and you‘re done. For now, this looks like the same thing.
• shadowgovt 5y ago
  Google explains the purpose of server-side tagging here: https://developers.google.com/tag-platform/tag-manager/server-side https://developers.google.com/tag-platform/tag-manager/serve... The main benefits are performance and security (performance because the tagging can be online with other resource requests, so user agents aren't pausing on additional requests to third-party resources). This system is giving site owners a fancy way to do analytics they could build into their own server. Hardly evil as long as it's disclosed and managed in a GDPR-compliant fashion.
  • pixeldetracking 5y ago
    I agree, thought it has to be done properly (and most marketers are not used to that currently)
• Fice 5y ago
  > Crazy how evil Google is. And the even worse evil are the website owners who betray their own users by placing third-party trackers on their own sites.
• catfishx 5y ago
  Google: "Don't be evil" Wat?
• tinus_hn 5y ago
  If the scripts are hosted on the separate domains they don’t have access to some global state and there is no cross site tracking.
• WithinReason 5y ago
  > It seems the only possible option to retain privacy rights given to us by law (eg in the EU) is to disable JavaScript and cycle IPs or other fingerprinting features. None of that is realistic. As a last resort, using a VPN and automatically scrambling your fingerprint seems doable
• collegeburner 5y ago
  I'll probably get roasted hard for saying this on HN. Maybe not the tracker part, but I am excited by server side ads. I hate that I can't either make the ~30% of my audience that block ads stop using my site or see the ads anyway because they continue costing me resources. Especially since my ads aren't awful or invasive or slow.