6 ms·

Allowing bad actors to act badly against all but the most sophisticated users is exactly where lawmakers should be stepping in. Sorry you find that controversia

by thom 2mo ago

Allowing bad actors to act badly against all but the most sophisticated users is exactly where lawmakers should be stepping in. Sorry you find that controversial.

xp84 2mo ago
We ask more sophistication of drivers to understand the rules of right of way than we would be asking of users to hit Settings -> Privacy and Cookies and read the plain language there. Sorry that you need the government to "help" people in this way, by forcing other people to give them free things.
- kalleboo 2mo ago
  Are you proposing a licensing scheme to use the internet?
  - xp84 2mo ago
    No, I'm just saying that it's okay to burden humans with the responsibility to learn a few basic ideas about how to operate their own computers if they want to control their data privacy. Simple, easy tools are already there, such as the Clear Browsing Data menu item in Chrome, Edge, and Safari. For more complicated intents, the browser settings are no more complicated to navigate than the actual customization UI in the CMPs, anyway.
    - kalleboo 2mo ago
      Then I don't understand the driver analogy. Drivers are forced to take lessons and get licensed for the precise reason that we know people can't take the responsibility on their own. Clearing browser data is anything but easy for people who aren't certain what is "browser data". Is this going to delete all my google sheets? Those are in the browser. And it's not a bad question, some apps actually use IndexedDB or whatever to store user data.
      - xp84 2mo ago
        > some apps actually use IndexedDB or whatever to store user data. Not any notable apps used by noobs though. Unsophisticated users don't include Local Storage in their mental model - they simply believe that "When I log into Gmail, Google Docs, or Slack on a fresh computer, my stuff will be as I left it on my other computer." Webapps which subvert this by not persisting things outside of Local Storage would be taking wild and unnecessary data-loss risks with user data. > people who aren't certain what is "browser data". This I agree with you on. Everyone including EU legislators are trying to regulate something that none of them actually know or agree on what it even is. The common person has basically only one single concern that relates to cookies: They don't like retargeting ads. That's it, that's the whole beef. They feel offended that by some mysterious (to them) means, they see ads 'around the Web' for things they've browsed before. Of course, those ads exist because they're incredibly effective. But they are annoyed that it, in their opinion, manipulates them into spending money. These ads are "too good." This is a technical problem with a technical solution, and if the EU (and US) regulators weren't technically illiterate they would recognize this and issue clear requirements aimed at browsers[1] instead of the stupid ones we have today which are basically just rely on the honor system, meaning compliance will be patchy at best, and it relies on costly enforcement actions and complaints, is subject to litigation, and has so many gray areas - "If the CMP didn't work right and cookies were stored, is MY company liable? We tried!"). There is a second concern, but it has little to do with cookies, it's just that we ideally want to stop companies from keeping and exchanging dossiers on our behavior and preferences (and a dispute on whether anonymized data is ok, or whether it's unethical because if detailed enough it can be deanonymized). That is bigger than cookies, and applies just as much to offline companies. [1] Here's an imaginary scheme, just for example: 1. Segment cookies storage by the domain in the address bar - the same way the memory/disk cache works today. This is really functionally the same as turning off third-party cookies, but if anything "needs" them, this sandboxing would nerf it so that a Facebook Like Button on a webpage can't be aware of a facebook session you created on a different domain. 2. Big switch in the browser's UI that defaults to "Temporary" - if you leave it alone, all cookies and storage are evicted 2 hours after last tab is closed, or you switch it to "Permanent" (preference stored per top domain) to have the current behavior where expiry can be longer. Regardless of the specifics, a browser-side solution would solve the problems of "compliance" as it pertains to cookies and other client-side tracking (they can't abuse data the browser simply won't persist for them), and level the playing field between the tech giants and upstart competitors.
ApolloFortyNine 2mo ago
YouTube is a site that pretty much everyone has an account already for (and therefore have already consented), but say you make YouTube 2, you can only make money if people allow personalized ads (they pay 10-20x untargeted ads). 90% less revenue means your business model doesn't work. The government in the area has decided you can't refuse service to customers that cost you money (people who don't consent). You simply will have to go out of business. This is also why you see many large companies fighting for more regulation. It's harder for a competitor to emerge if they have to navigate mountains of red tape.
- kalleboo 2mo ago
  What if I want to start a restaurant that can only make money if I use expired ingredients, run the fridge at a higher temperature to save on electricity, and don't waste my employee's time by washing their hands? These food safety laws mean my business model doesn't work. I simply will have to go out of business.
  - ApolloFortyNine 2mo ago
    This is just a strawman, these aren't equivalent and I'm not going to waste time pretending they are. Might as well just compare ads to nuclear weapons at this point.
    - kalleboo 2mo ago
      There are enough libertarians out there that believe that the government should not be involved in food safety inspections to establish that regulations like this ARE on a related spectrum. Do you have a right to trust that food you buy is safe or should you get to choose to buy raw milk? Do you have a right to consume online services while retaining privacy? It's a debate society constantly has, and the EU electorate has chosen the side of privacy over a specific business model, just like most developed societies have chosen food safety.
      - xp84 2mo ago

by thom 2mo ago

Allowing bad actors to act badly against all but the most sophisticated users is exactly where lawmakers should be stepping in. Sorry you find that controversial.

xp84 2mo ago

We ask more sophistication of drivers to understand the rules of right of way than we would be asking of users to hit Settings -> Privacy and Cookies and read the plain language there. Sorry that you need the government to "help" people in this way, by forcing other people to give them free things.

kalleboo 2mo ago
Are you proposing a licensing scheme to use the internet?
- xp84 2mo ago
  No, I'm just saying that it's okay to burden humans with the responsibility to learn a few basic ideas about how to operate their own computers if they want to control their data privacy. Simple, easy tools are already there, such as the Clear Browsing Data menu item in Chrome, Edge, and Safari. For more complicated intents, the browser settings are no more complicated to navigate than the actual customization UI in the CMPs, anyway.
  - kalleboo 2mo ago
    Then I don't understand the driver analogy. Drivers are forced to take lessons and get licensed for the precise reason that we know people can't take the responsibility on their own. Clearing browser data is anything but easy for people who aren't certain what is "browser data". Is this going to delete all my google sheets? Those are in the browser. And it's not a bad question, some apps actually use IndexedDB or whatever to store user data.
    - xp84 2mo ago
      > some apps actually use IndexedDB or whatever to store user data. Not any notable apps used by noobs though. Unsophisticated users don't include Local Storage in their mental model - they simply believe that "When I log into Gmail, Google Docs, or Slack on a fresh computer, my stuff will be as I left it on my other computer." Webapps which subvert this by not persisting things outside of Local Storage would be taking wild and unnecessary data-loss risks with user data. > people who aren't certain what is "browser data". This I agree with you on. Everyone including EU legislators are trying to regulate something that none of them actually know or agree on what it even is. The common person has basically only one single concern that relates to cookies: They don't like retargeting ads. That's it, that's the whole beef. They feel offended that by some mysterious (to them) means, they see ads 'around the Web' for things they've browsed before. Of course, those ads exist because they're incredibly effective. But they are annoyed that it, in their opinion, manipulates them into spending money. These ads are "too good." This is a technical problem with a technical solution, and if the EU (and US) regulators weren't technically illiterate they would recognize this and issue clear requirements aimed at browsers[1] instead of the stupid ones we have today which are basically just rely on the honor system, meaning compliance will be patchy at best, and it relies on costly enforcement actions and complaints, is subject to litigation, and has so many gray areas - "If the CMP didn't work right and cookies were stored, is MY company liable? We tried!"). There is a second concern, but it has little to do with cookies, it's just that we ideally want to stop companies from keeping and exchanging dossiers on our behavior and preferences (and a dispute on whether anonymized data is ok, or whether it's unethical because if detailed enough it can be deanonymized). That is bigger than cookies, and applies just as much to offline companies. [1] Here's an imaginary scheme, just for example: 1. Segment cookies storage by the domain in the address bar - the same way the memory/disk cache works today. This is really functionally the same as turning off third-party cookies, but if anything "needs" them, this sandboxing would nerf it so that a Facebook Like Button on a webpage can't be aware of a facebook session you created on a different domain. 2. Big switch in the browser's UI that defaults to "Temporary" - if you leave it alone, all cookies and storage are evicted 2 hours after last tab is closed, or you switch it to "Permanent" (preference stored per top domain) to have the current behavior where expiry can be longer. Regardless of the specifics, a browser-side solution would solve the problems of "compliance" as it pertains to cookies and other client-side tracking (they can't abuse data the browser simply won't persist for them), and level the playing field between the tech giants and upstart competitors.

ApolloFortyNine 2mo ago

YouTube is a site that pretty much everyone has an account already for (and therefore have already consented), but say you make YouTube 2, you can only make money if people allow personalized ads (they pay 10-20x untargeted ads). 90% less revenue means your business model doesn't work. The government in the area has decided you can't refuse service to customers that cost you money (people who don't consent). You simply will have to go out of business. This is also why you see many large companies fighting for more regulation. It's harder for a competitor to emerge if they have to navigate mountains of red tape.

kalleboo 2mo ago
What if I want to start a restaurant that can only make money if I use expired ingredients, run the fridge at a higher temperature to save on electricity, and don't waste my employee's time by washing their hands? These food safety laws mean my business model doesn't work. I simply will have to go out of business.
- ApolloFortyNine 2mo ago
  This is just a strawman, these aren't equivalent and I'm not going to waste time pretending they are. Might as well just compare ads to nuclear weapons at this point.
  - kalleboo 2mo ago
    There are enough libertarians out there that believe that the government should not be involved in food safety inspections to establish that regulations like this ARE on a related spectrum. Do you have a right to trust that food you buy is safe or should you get to choose to buy raw milk? Do you have a right to consume online services while retaining privacy? It's a debate society constantly has, and the EU electorate has chosen the side of privacy over a specific business model, just like most developed societies have chosen food safety.
    - xp84 2mo ago