5 ms·

How the hell does NOBODY understand that everything you enter into a textbox on the internet will get sent to a server where somebody(es) you certainly do not k

How the hell does NOBODY understand that everything you enter into a textbox on the internet will get sent to a server where somebody(es) you certainly do not know or trust will get to read what you wrote? How the fck do people (and ones working in security-sensitive positions no less) treat ChatGPT as 'Dear Diary'? I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions.

whacko_quacko 2y ago
> websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions The first part is somewhat infeasible, because your IP is sent by just visiting the page in the first place. And I think the second part is what a privacy policy is. It might be more helpful to make it mandatory to have your privacy policy be one page or less and in plain english, so people might read them for the services they use often.
InDubioProRubio 2y ago
That idea is idiotic, if not automated. People already shun everything attached with a workload inflicted by security or legal. It needs to be auto-negotiated thing, where if the negotiations do not work out, the service just does not work. That way, it-administration in security environs can override the negotiation settings. At lot of things would cease to work in a lot of companies, instantly though.
chvid 2y ago
These people obviously know what government agencies can see and are capable of (both domestic and foreign). But they cannot fathom that the massive apparatus of surveillance and control would be directed towards themselves. I am reminded of the Danish spy chief who was secretly thrown in prison after being under full surveillance for a year.
morsch 2y ago
That seems reasonable and pretty close to GDPR.
yorwba 2y ago
As far as I understand, the evidence was discovered after his devices were seized, so even if it hadn't been sent to a server, his browser history was enough to get him into trouble.
kolinko 2y ago
That is why we have GDPR in Europe, and it severely restricts how personal data is shared across companies. The punishments can be severe, and we have swift institutions that really monitor this. I’m yet to meet a company that doesn’t stress about that internally.
- inglor_cz 2y ago
  In practice, I haven't seen a single GDPR-related investigation, though. The Czech ÚOOÚ is very lax about this, or maybe understaffed.
  - mjlee 2y ago
    Meta was fined €1.2 billion. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ has a list of 2,560 fines.
    - inglor_cz 2y ago
      Given how many underhanded sites are out there, 2560 is pretty modest for the EU?
      - mjlee 2y ago
        I don’t know if that list is exhaustive. Besides, it’s only fines. I think everywhere I’ve worked has had requests (“what information do you hold on me and what do you do with it?”) that haven’t resulted in any punitive action. I’m not completely sure what you meant by investigations but I’m just trying to point out that GDPR certainly isn’t toothless.
      - TeMPOraL 2y ago
        Compliance is preferred to punishment. I don't know if anyone tracks all the cases of a business getting a warning and adjusting to become compliant before getting fined.
      - mschuster91 2y ago
jaredklewis 2y ago
> I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions. Oh good, another pop-up dialog no one will read that will be added to every site. Hopefully if something horrible like this is done, just shoving it in the privacy policy or terms of use will suffice, because no one will read it regardless. I have my own draconian idea: no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce. This stuff just leads to a lot of wasteful, performative compliance without delivering any actual benefits.
- dijksterhuis 2y ago
  > Oh good, another pop-up dialog no one will read that will be added to every site. > no one i go through every cookie pop up and manually reject all permissions. especially objecting to legitimate interest. i actually enjoy it. i find it satisfying saying no to a massive list of companies. the number of people who read these things is definitely not 0. my question to you is, why does compliance with regulation make you so … irritated? you don’t think it serves a purpose. but it does. there’s an incongruity there.
  - jampekka 2y ago
    At least my irritation comes from the increasing amount of "consents" and "agreements" that are obviously not designed to be read, let alone understood. Not only cookie nags, but things like EULAs and ToS and privacy policies. And they are often not even legally valid. It's all a performative sharade of "voluntary contracts", which are in practice just forced down people's throats due to power inbalances.
    - TeMPOraL 2y ago
      Yes, but how much can you blame this on regulation, where the regulatory intent is clear, and it's the industry that collectively chose to engage in malicious compliance?
Cthulhu_ 2y ago
I mean permission is implicit in that you opened up the browser and entered text. As for what they do with it, that's also covered in the terms & conditions, privacy policy, etc. People are informed, the legal frameworks are all there, they can't claim they didn't know what they were doing / what was happening with their data.
grahameb 2y ago
I'd like to be able to say, as a page / site, "disable all APIs that let this page communicate out to the net" and for that to be made known to the user. It'd be quite handy for making and using utility pages that do data manipulation (stuff compiled to wasm, etc) safely and ethically. As a simple example, who else has pasted markdown into some random site to get HTML/... or uploaded a PNG to make a favicon or whatever.
survirtual 2y ago
Your idea is the start of something I model as a "consent framework". Dialog boxes don't seem effective to me, but tracking your data does. Who accessed your data, and when? Who has permission to your "current" data? Did an entity you trusted with your data share the data? And more. Nothing can perfectly capture this, but right now, nothing even tries. With a functioning consent framework, it would be possible to make digital laws around it -- data acquired on an individual outside a consent framework can be made illegal, as an example. If a bank wants to know your current address, it has to request it from your "current address" dataset, and that subscription is available for you to see. If you cut ties with a bank, you revoke access to current address, and it shows you your relationship with that bank still while also showing the freshness of the data they last pulled. All part of a bigger system of data sovereignty, and flipping the equation on its head. We should own our data and have tools to track who else is using it. We should all have our own personal, secure databases instead of companies independently having databases on us. Applications should be working primarily with our data, not data they collect and hide away from us. This, and much more, is required going forward.
- nextts 2y ago
  Been thinking about this idea too. The concept of data residency seems like a farce when eu-central is owned by AWS who answers to the US government. An inverted solution has say a German person using a server of their choice (we get charged by Google Apple etc. for storage anyway) and you install apps to that location operated by a local company. Been musing on this and how it could get off the ground.
  - survirtual 2y ago
    You get it off the ground the same way you get a calculator off the ground. You build it as an indispensable & obvious tool. You have to imagine the auxiliary applications that become possible with this model. Start with useful personal tools and grow it outwards. This model can ultimately replace every search engine, every social media experience, every e-commerce website, etc. it allows for actually much easier app development, and significantly less compute centralization. What I am saying is don't look outward for ways to make it happen, look inward. This model goes against every power structure in the world. It disempowers collective entities (corporations, governments, etc) and empowers individuals. In other words, it is completely politically and economically infeasible with the current world order, but completely obvious as the path forward for humanity. You will not make money pursuing this line of technology.
krisoft 2y ago
Idk why you find that element salient. The real mistake was participating in a coup. The second mistake was letting the coup you participate in fail. That is where his troubles stem from.
3np 2y ago
> I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions. Decent summary of the GDPR. Too bad it lacks enforcement.
personalaccount 2y ago
> How the hell does NOBODY understand that everything you enter into a textbox on the internet will get sent to a server where somebody(es) you certainly do not know or trust will get to read what you wrote? If you have some free time, go watch some crime channels on tiktok or youtube or wherever. It's amazing the amount of people, from thugs to cops and even judges, who use google to plan their crimes and dispose of the evidence. Search history, cell tower tracking data and dna are the main tools of detectives to break open the case. > I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions. It's a losing battle. Think about what llms and AI agents are? They are data vacuums. If you want the convenience of a personal "AI agent" on your smartphone, tv, car, fridge, etc, they need access to your data to do their job. The more data, the better the service. People will choose convenience over privacy or data protection. Just think about what the devices in your home ( computers, fridge, tv, etc ) know about you? It's mind boggling. Of course if your devices know, so does apple, google, amazon, etc. There really is no need to do polls or surveys anymore. Why ask people what they think, when tech companies know already.

whacko_quacko 2y ago

> websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions The first part is somewhat infeasible, because your IP is sent by just visiting the page in the first place. And I think the second part is what a privacy policy is. It might be more helpful to make it mandatory to have your privacy policy be one page or less and in plain english, so people might read them for the services they use often.

InDubioProRubio 2y ago

That idea is idiotic, if not automated. People already shun everything attached with a workload inflicted by security or legal. It needs to be auto-negotiated thing, where if the negotiations do not work out, the service just does not work. That way, it-administration in security environs can override the negotiation settings. At lot of things would cease to work in a lot of companies, instantly though.

chvid 2y ago

These people obviously know what government agencies can see and are capable of (both domestic and foreign). But they cannot fathom that the massive apparatus of surveillance and control would be directed towards themselves. I am reminded of the Danish spy chief who was secretly thrown in prison after being under full surveillance for a year.

morsch 2y ago

That seems reasonable and pretty close to GDPR.

yorwba 2y ago

As far as I understand, the evidence was discovered after his devices were seized, so even if it hadn't been sent to a server, his browser history was enough to get him into trouble.

kolinko 2y ago

That is why we have GDPR in Europe, and it severely restricts how personal data is shared across companies. The punishments can be severe, and we have swift institutions that really monitor this. I’m yet to meet a company that doesn’t stress about that internally.

inglor_cz 2y ago
In practice, I haven't seen a single GDPR-related investigation, though. The Czech ÚOOÚ is very lax about this, or maybe understaffed.
- mjlee 2y ago
  Meta was fined €1.2 billion. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ has a list of 2,560 fines.
  - inglor_cz 2y ago
    Given how many underhanded sites are out there, 2560 is pretty modest for the EU?
    - mjlee 2y ago
      I don’t know if that list is exhaustive. Besides, it’s only fines. I think everywhere I’ve worked has had requests (“what information do you hold on me and what do you do with it?”) that haven’t resulted in any punitive action. I’m not completely sure what you meant by investigations but I’m just trying to point out that GDPR certainly isn’t toothless.
    - TeMPOraL 2y ago
      Compliance is preferred to punishment. I don't know if anyone tracks all the cases of a business getting a warning and adjusting to become compliant before getting fined.
    - mschuster91 2y ago

jaredklewis 2y ago

> I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions. Oh good, another pop-up dialog no one will read that will be added to every site. Hopefully if something horrible like this is done, just shoving it in the privacy policy or terms of use will suffice, because no one will read it regardless. I have my own draconian idea: no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce. This stuff just leads to a lot of wasteful, performative compliance without delivering any actual benefits.

dijksterhuis 2y ago
> Oh good, another pop-up dialog no one will read that will be added to every site. > no one i go through every cookie pop up and manually reject all permissions. especially objecting to legitimate interest. i actually enjoy it. i find it satisfying saying no to a massive list of companies. the number of people who read these things is definitely not 0. my question to you is, why does compliance with regulation make you so … irritated? you don’t think it serves a purpose. but it does. there’s an incongruity there.
- jampekka 2y ago
  At least my irritation comes from the increasing amount of "consents" and "agreements" that are obviously not designed to be read, let alone understood. Not only cookie nags, but things like EULAs and ToS and privacy policies. And they are often not even legally valid. It's all a performative sharade of "voluntary contracts", which are in practice just forced down people's throats due to power inbalances.
  - TeMPOraL 2y ago
    Yes, but how much can you blame this on regulation, where the regulatory intent is clear, and it's the industry that collectively chose to engage in malicious compliance?

Cthulhu_ 2y ago

I mean permission is implicit in that you opened up the browser and entered text. As for what they do with it, that's also covered in the terms & conditions, privacy policy, etc. People are informed, the legal frameworks are all there, they can't claim they didn't know what they were doing / what was happening with their data.

grahameb 2y ago

I'd like to be able to say, as a page / site, "disable all APIs that let this page communicate out to the net" and for that to be made known to the user. It'd be quite handy for making and using utility pages that do data manipulation (stuff compiled to wasm, etc) safely and ethically. As a simple example, who else has pasted markdown into some random site to get HTML/... or uploaded a PNG to make a favicon or whatever.

survirtual 2y ago

Your idea is the start of something I model as a "consent framework". Dialog boxes don't seem effective to me, but tracking your data does. Who accessed your data, and when? Who has permission to your "current" data? Did an entity you trusted with your data share the data? And more. Nothing can perfectly capture this, but right now, nothing even tries. With a functioning consent framework, it would be possible to make digital laws around it -- data acquired on an individual outside a consent framework can be made illegal, as an example. If a bank wants to know your current address, it has to request it from your "current address" dataset, and that subscription is available for you to see. If you cut ties with a bank, you revoke access to current address, and it shows you your relationship with that bank still while also showing the freshness of the data they last pulled. All part of a bigger system of data sovereignty, and flipping the equation on its head. We should own our data and have tools to track who else is using it. We should all have our own personal, secure databases instead of companies independently having databases on us. Applications should be working primarily with our data, not data they collect and hide away from us. This, and much more, is required going forward.

nextts 2y ago
Been thinking about this idea too. The concept of data residency seems like a farce when eu-central is owned by AWS who answers to the US government. An inverted solution has say a German person using a server of their choice (we get charged by Google Apple etc. for storage anyway) and you install apps to that location operated by a local company. Been musing on this and how it could get off the ground.
- survirtual 2y ago
  You get it off the ground the same way you get a calculator off the ground. You build it as an indispensable & obvious tool. You have to imagine the auxiliary applications that become possible with this model. Start with useful personal tools and grow it outwards. This model can ultimately replace every search engine, every social media experience, every e-commerce website, etc. it allows for actually much easier app development, and significantly less compute centralization. What I am saying is don't look outward for ways to make it happen, look inward. This model goes against every power structure in the world. It disempowers collective entities (corporations, governments, etc) and empowers individuals. In other words, it is completely politically and economically infeasible with the current world order, but completely obvious as the path forward for humanity. You will not make money pursuing this line of technology.

krisoft 2y ago

Idk why you find that element salient. The real mistake was participating in a coup. The second mistake was letting the coup you participate in fail. That is where his troubles stem from.

3np 2y ago

personalaccount 2y ago

> How the hell does NOBODY understand that everything you enter into a textbox on the internet will get sent to a server where somebody(es) you certainly do not know or trust will get to read what you wrote? If you have some free time, go watch some crime channels on tiktok or youtube or wherever. It's amazing the amount of people, from thugs to cops and even judges, who use google to plan their crimes and dispose of the evidence. Search history, cell tower tracking data and dna are the main tools of detectives to break open the case. > I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions. It's a losing battle. Think about what llms and AI agents are? They are data vacuums. If you want the convenience of a personal "AI agent" on your smartphone, tv, car, fridge, etc, they need access to your data to do their job. The more data, the better the service. People will choose convenience over privacy or data protection. Just think about what the devices in your home ( computers, fridge, tv, etc ) know about you? It's mind boggling. Of course if your devices know, so does apple, google, amazon, etc. There really is no need to do polls or surveys anymore. Why ask people what they think, when tech companies know already.