jefftk

52 ms·

451.
by jefftk 3y ago
If they're essential for doing what the user wants, though, then (a) no one cares and (b) they don't need e-Privacy consent and so don't need a cookie banner.
452.
by jefftk 3y ago
If you authenticate users only via Same-Site=Strict cookies you're protected against CSRF in modern browsers: a cross-site request won't have the auth cookie.
453.
by jefftk 3y ago
A CSRF vulnerability on a login form is a bit of a weird one: doesn't this require that the user has submitted their username and password to a site that isn't yours, in which case the attacker has successfully phished the user an
454.
by jefftk 3y ago
Using cookies or other client-side storage for a shopping cart doesn't require a cookie banner as long as you're careful to use the minimum practical duration. See section 2.3 of https://ec.europa.eu/justice/
455.
by jefftk 3y ago
Poking around a bit more, visiting https://sentry.io/auth/login/ but performing no action sets first-party cookies __stripe_mid, __stripe_sid, session, and sentry-sc. If I don't log in, but then visit other
456.
by jefftk 3y ago
The way most sites do this is that absence of a cookie indicates not logged in; any reason this wouldn't work here?
457.
by jefftk 3y ago
Thanks! Also, I did figure out how to reproduce the Vimeo player cookie. If I visit https://docs.sentry.io/product/performance/performance-video... I get a __cf_bm cookie from player.vimeo.com.
458.
by jefftk 3y ago
They might be tracking whether I'm logged in, but since I didn't log into the site I didn't consent for them to store that state on my client. The e-Privacy directive is quite particular, and unless these cookies are "s
459.
by jefftk 3y ago
A login cookie does not require a consent banner, because logging in is an explicit user request. But I didn't log into Sentry in my testing.
460.
by jefftk 3y ago
Cookie banners predate the GDPR, and were initially a response to the ePrivacy Directive of 2002: https://en.wikipedia.org/wiki/EPrivacy_Directive While the GDPR has added additional restrictions, the basic framework i
461.
by jefftk 3y ago
While they removed cookie banners and say they no longer include dependencies that set cookies, browsing around the site for a bit I still see several cookies set. For example, visiting https://changelog.getsentry.com I get fir
462.
by jefftk 3y ago
If it's static HTML you can put it on Github Pages and leave it alone.
463.
by jefftk 3y ago
Yes, that's not great. But at least it doesn't bite you if you're running an all-localhost dev environment.
464.
by jefftk 3y ago
Browsers deal with this by considering localhost a "secure context", and anything that "requires https" actually requires a secure context. [1] You can debug new web features like the Audio Output API that require a secu
465.
by jefftk 3y ago
My guess is those paths didn't have automated tests, or the automated tests missed some important aspect of real-world usage? Issues engineers working on the product ran into were way more likely to get fixed (among other things bec
466.
by jefftk 3y ago
> Google only focusing QA on Chrome and Safari FWIW, over my time at Google (2012-2022) we had massively better testing on Firefox than Safari, because you can run Firefox on Linux on arbitrary hardware while Safari requires MacOS whic
467.
by jefftk 3y ago
I don't think glossing "It makes no sense to call for heads to roll without even knowing the root cause" as a Boeing apologist makes sense?
468.
by jefftk 3y ago
I think the place where it gets tricky is whether you're meeting the "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user" standard. If the control looks like
469.
by jefftk 3y ago
Is there any delivery van with a hood height low enough to lift pedestrians, though? Others have more of a curve, but it starts high enough not to matter. For example, the bend on a Sprinter is around 46", above almost anyone's
470.
by jefftk 3y ago
The hood needs to be pretty low for a pedestrian to go above it, lower than you'd see on the delivery vehicles (ex: current Sprinter platform) this is competing with.
471.
by jefftk 3y ago
Which pillar are you thinking is thick? In the rightmost vehicle of the header image it looks thick, but that's just glare. The front section is also a window, which makes for very good forward visibility: https://media.can
472.
by jefftk 3y ago
You can be comfortable with donating to charity but also have strong opinions on which charities you want to support. The confusing bit is that it's presented as half of the income , where unless you spend some time looking at the mat
473.
by jefftk 3y ago
I like the idea of Long Bets, though their fee is much higher than it looks: https://www.jefftk.com/p/long-bets-by-confidence-level I've recently gotten into Manifold ( https://manifold.markets ) which I
474.
by jefftk 3y ago
See discussion above: https://news.ycombinator.com/item?id=38901520 As long as it's clear to the user that they're making a site-wide UI customization choice and just not choosing the language for this specific ex
475.
by jefftk 3y ago
I agree for something that's clearly customizing the UI of the whole site, but if it looks like you're choosing a language only for the currently displayed snippet then I think that wouldn't qualify?
476.
by jefftk 3y ago
GDPR and ePrivacy are different regulations. Under the latter even purely local data storage still requires consent unless it's "strictly necessary" to implement something the user has requested. For example, see the discussi
477.
by jefftk 3y ago
> As an example, the Eleventy documentation seems to avoid using client-side JavaScript for the most part. As Eleventy supports various templating languages it provides code samples in each of the different languages. Unfortunately, it
478.
by jefftk 3y ago
> their actual employer Cognizant You're assuming something that's very much in dispute: The NLRB has concluded otherwise that "Cognizant and Google have codetermined the essential terms and conditions of employment [fo
479.
by jefftk 3y ago
The real headline is that the NLRB held Google and the staffing agency to be joint employers. Like other big tech companies Google has tried very hard to avoid that designation, and have it be Google contracting with the staffing agency, wh
480.
by jefftk 3y ago
Nice to see another browser engine project! For all the apparent diversity in full-featured browsers, right now they're all running on one of Gecko, WebKit, or Blink. And Blink started as a WebKit fork. If this succeeds we'll be

More ›