6 ms·
Did the EU ban JSdelivr and other free CDNs?
- bmacho 3y agoYes, absolutely. You can't give your users browser history to jsdelivr. I don't know why would you do that, but it is illegal here.
- fafzv 3y agoWebmasters are not giving their users' browser histories to jsdelivr. Instead, their users have configured their browsers to load 3rd party content.
- stingraycharles 3y agoIs the internet even functional for browsers that don’t load 3rd party content? Isn’t that basically the modus operandi of the whole internet?
- gkbrk 3y agoHackers are not exploting machines. Instead, the users have configured their media players to interpret that MP4 file as executable code.
- fafzv 3y agoInterpreting an mp4 file as executable code is not a feature of a media player, not to mention there's no way to disable it. Bad analogy.
- jeroenhd 3y agoSimilarly, browsers don't have a way to disable loading any third party content.
- fafzv 3y agoThey have an extension API for that purpose.
- ranger_danger 3y agoThis would increase your fingerprint substantially, which is very bad from a privacy perspective.
- deleted 3y ago[deleted]
- Krutonium 3y agoTIL AdBlockers and co don't exist.
- bawolff 3y agoGuns dont kill people, instead shooting victims decided to be in the way of the bullet. /s
- deleted 3y ago[deleted]
- zdragnar 3y agoBetteridge's law apparently fails... according to this non-lawer, at least. In any case, I'm not a fan of free CDNs- they're an extra point of failure, and if you're not using subresource integrity with them, you're just asking for trouble.
- benatkin 3y ago> I'm not a fan of free CDNs They don't tend to work super well. Check the GitHub issues for each of them and they all struggle to keep up.
- ranger_danger 3y agoWhy wouldn't a "agreement" already be in place by the mere fact that those URLs are open to the entire world on purpose? Why can't EU citizens decide they WANT to contact google to download fonts? Banning that automatically doesn't sound very freedom-like. > There is no legitimate interest for using CDNs when the assets could be self-hosted instead. I disagree with this because there are several reasons not to host it yourself, especially when you do not have the network/computing capacity to serve your users all of the content by yourself. And what about loading resources from other third parties that aren't CDNs? Or just accessing any non-EU site in general. Is that now illegal too? It makes no sense to me. This seems wide open for massive abuse.
- justeleblanc 3y agoI don't know where you got the impression that google fonts was "automatically banned". > Why wouldn't a "agreement" already be in place by the mere fact that those URLs are open to the entire world on purpose? What does that even mean?
- rhn_mk1 3y ago"Legitimate interest" is not a common expression, but a term of law related to data processing and defined under GDPR: > “[where] processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.” https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat... As I read it, a CDN does not further any interest of the hoster by processing user data, so it should not be used. > doesn't sound very freedom-like GDPR was not made for freedom, but privacy. If anything, it's for "freedom from", at the expense of "freedom to".
- tannhaeuser 3y ago> It makes no sense to me. This seems wide open for massive abuse. That the true purpose of the web - to harvest information about consumers and citizens, and, soon, to train very advanced language models - doesn't make sense to you doesn't make it any better. Despite your condescending comments, GDPR legislation turned out necessary to even make an attempt to prevent actual "massive abuse". In fact, the emergent generative AI armageddon is calling for urgent GDPR legislation updates, such as a requirement for explicit consent to use your comments, code, and other contributions online as input to ML.
- benatkin 3y ago[flagged]
- 3D30497420 3y agoJSDeliver apparently hired a law firm to specifically advise on their situation and apparently the conclusion was it is still safe to use. More detail: https://www.jsdelivr.com/blog/how-the-german-courts-ruling-on-google-fonts-affects-jsdelivr-and-why-it-is-safe-to-use/ https://www.jsdelivr.com/blog/how-the-german-courts-ruling-o... Additional edit. If jsdelivr is illegal in Germany, it’s going to come as quite a surprise to many prominent sites: https://trends.builtwith.com/websitelist/jsDelivr/Germany https://trends.builtwith.com/websitelist/jsDelivr/Germany I know nothing more than I’ve found with a few minutes of web searching, but what I have found makes me skeptical of the OPs conclusions.
- fariszr 3y agoHuh, that didn't show up in my searches at all. Legalweb, one of the sources i referenced, doesn't seem to agree, and is recommending removing JSdelivr completely.
- justeleblanc 3y agoYour first link is an obvious PR piece to stave off customers' panic.
- 3D30497420 3y agoI am far from someone who can evaluate the legal questions here. However, two notes: - Legalweb, which OP references, sells services for GDPR compliance. While that may make them familiar with these rules, I wouldn't view them as an impartial perspective. - The jsdelivr post quotes actual attorneys. While they are certainly not impartial, I’d feel a bit more confident with their interpretation given that the firm is actually named. I could not find anything on Legalweb on who’s actually behind it, though I did see this quote: ”As a software manufacturer, we are not allowed to offer individual legal advice.” If someone can find a more independent interpretation, that would probably be ideal.
- benatkin 3y agoIt doesn't seem like there's any reason to be suspicious about Legalweb. The attorneys in jsDelivr's post can be lifted up without putting Legalweb down. There isn't much said editorially in the jsDelivr post. They didn't use a blockquote but it appears to be quoted until the last paragraph where it says "In conclusion". There are no editorial assertions in the intro. The conclusion appears not to match up with what the attorneys say. What the attorney says is that jsDelivr, the service, is safe. It doesn't say that about sites that use it. I agree with both the article and with jsDelivr's posts except the conclusion. jsDelivr will not be shut down just because of this ruling, but site owners may want to stop using it. Here's the conclusion: > In conclusion, the ruling that has been so controversial recently does not seem to fully address the factual and technical circumstances of how jsDelivr works, and at this point as a single ruling should not lead to any real concerns about using CDN's services. The arguments for extending to other online services a single ruling strongly emphasizing Google's failure to adequately protect personal data are insufficient and lack substance. "should not lead to any real concerns" doesn't inspire confidence
- pier25 3y agoThe GDPR laws have brought so much complexity. I'm currently navigating this for my current EU startup. Don't get me wrong, I'm all for privacy, I agree these laws are needed and that privacy is a fundamental human right. But there are so many nuances and technicalities. The GDPR is clearly making things more difficult for small companies that cannot afford a team of lawyers. GDPR is also putting EU companies at a disadvantage vs companies from the US. I'm aware GDPR laws apply to any company from any country handling personal data from EU citizens... but realistically the EU will probably not chase down small companies from other countries.
- justeleblanc 3y agoIt only seems complex because everyone has been implementing user-hostile datamining operations for years before GDPR was enacted. So for every external service you use, you must make sure that they implemented GDPR compliance or not. If GDPR had been a law since the beginning, it would be much simpler. Although I'd like to know, what difficulties have you been facing in your startup, exactly?
- fariszr 3y agoIn this case it's not enough just to be GDPR compliant, the website admin has to have Data processing agreement with the CDN, which you won't get from a free CDN such as JSdelivr. That's my understanding.
- seydor 3y agoIt's complex because 'personally identifying information' is not a thing outside the digital. You can't enforce these rights on physical businesses for exampple (e.g. can't request from your local bakery to forget that you existed)
- bawolff 3y agoYou can request they expunge all records of your purchases. Not exactly a new idea either. Doctors have been subject to rules around record keeping for a long time. Its not really all that different between physical and digital - the cost of making and (ab)using records is just way lower in digital.
- PrimeMcFly 3y agoThey banned it for sites that are hosted in the EU I guess, but that isn't most sites so...not in practice.
- deleted 3y ago[deleted]
- fariszr 3y agoActually no, the GDPR applies to all European citizens around the world. And if your website targets a global audience, then by extension you target EU users, which means you have to comply with the GDPR too.
- PrimeMcFly 3y agoWell, that's just nonsense though. They have no way to really enforce that. And I've actually put that to the test. For some medium size websites I manage that get about 30% of traffic from EU countries, instead of an annoying cookie banner, I have a banner saying the GDPR does not apply as the server is not hosted in the EU, they are free to adjust their browser settings as they like, and they're free to file a GDPR complaint and take action. And there's only an 'I accept' button, by design. So far, nothing has happened, and I doubt it ever will.
- pier25 3y agoUnder the GDPR IPs are considered personal data. If you have EU users visiting your site, then you are receiving their IPs, correct? "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”" https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/
- PrimeMcFly 3y agoOh, I understand the EU says the law applies, I just disagree that it does. Does Chinese law apply in France to Chinese citizens that have emigrated there? China would say yes, they even set up secret police stations to enforce it. But does that make it so?
- bornfreddy 3y agoGenuinely curious: how is hosting everything on Cloudflare any better?