Hacker News Reader

Comment by mark_and_sweep | Hacker News Reader

At first, I wanted to read the article. But having to wait more than one minute to submit my cookie preferences, I closed the tab and left.

If anyone at Docker is reading this: Please reconsider your cookie banner implementation.

View on HN

Of course it's annoying, but posts like this end up becoming annoying too, and even damaging, when they gather upvotes and mass at the top of a thread, choking out the on-topic discussion. That's why we have this rule:

"Please don't complain about website formatting, back-button breakage, and similar annoyances. They're too common to be interesting. Exception: when the author is present. Then friendly feedback might be helpful."

The upvotes are really more the problem than the comment, but please don't post such comments and then such upvotes will have no surface to stick to.

https://news.ycombinator.com/newsguidelines.html

These cookie banners are so annoying - govt messes this type of stuff over and over. Let me control cookies on my end, I can choose not to accept cookies using my own browser controls, or delete them after 1 hour etc.

"govt" didn't develop the specific cookie banner implementation Docker is using.

Yeah the government is far from perfect, but people also treat it as a punching bag. It was companies who used the lack of regulation in tech to abuse cookies, and our government responded with regulation. And now some sites are implementing those rules in very annoying ways. Instead of getting mad at the party who is trying to protect you in this situation, how about directing that anger at the parties who caused the problem in the first place?

I control who sets cookies on my machine. We all do. Don't like them? Block them.

What is gained, SERIOUSLY, by these stupid pop-ups? I'm serious, has anyone analyzed this? It really shows how the heavy hand of govt has ZERO cost/benefit constraint or analysis. Browsing on phones is particularly painful.

I wish we could just set an accept all cookies header in our browser and govt would let these websites then stop displaying these damn notices, banners and consent boxes.

The GPDR ones (if you use euro websites) are getting even crazier.

> What is gained, SERIOUSLY, by these stupid pop-ups?

I appreciate the ability to allow "required" cookies, but reject all other cookies.

I agree that I would absolutely prefer an HTTP header for cookie preferences instead of pop-ups. But the new cookie popups add some value to me, in letting me allow session authentication cookies, and reject all others.

An outright block on all local cookies tends to break authentication for many sites.

Why not have a setting or two in Firefox/Chrome/Safari menu:

  - reject all cookies
  - allow only required cookies
  - allow all cookies

And never to have to fall into 100s of different dark patterns by people who have spent dozens of hours coming up with solutions that would basically trick people in clicking whichever button is highlighted (usually the "accept all cookies" one) just so they can browse some content?

See "do not track" for how that goes. Remember, people that do actively make the choice to design such a popup to trick you, they do not intend to use the solution that respects your interests best. And at the same time, it makes sense that legislation refrains from requiring specific technologies.

Well, that would require some kind of interoperability between the client and the website (like an HTTP header that sends cookie events).

I absolutely would prefer that to the world we have now. I'm all on board, you don't have to convince me it's a good idea.

But, that doesn't exist today. I do prefer having the stupid annoying popup that gives me the option to allow only required cookies to having no choice at all.

The new GDPR compliant cookie popups give me that option. It's a step up above not having the option at all.

> What is gained, SERIOUSLY, by these stupid pop-ups?

Disclosure

I disagree. It's the over-regulation that calls for these pain in the ass implementations.

Downvote all you want, but you're in denial. GDPR and the like are nothing more than "privacy theater". I work in this industry and know it very well. Cookie opt outs or forced opt-ins on publisher pages aren't helping anyone with anything. The whole thing is just a farce so that they can enforce this against bigger tech companies when they want to. They should just tax them outright and save us all the trouble.

No kidding. The first sign is how intrusive it all is. The second sign is how ineffective it is at anything web / crime related people actually care about (normal people).

On HN it's like - go ahead and let me cable company and cell phone company track / sell and target me on my browsing history (wildly intrusive), but random website doing pet necklaces, try to stay on top of all the popups you need to shove at your users (who will all say OK) so you can show your page.

If you can't share the data you buy up the other companies into groups and then are just using it "yourself" etc.

Malicious compliance.

Google is facing a 5B lawsuit over incongnito mode. The fact that someone goes overboard with this crap is not unreasonable.

yeah this is Docker's legal team.

It's actually not about the cookies, a website is allowed to have technical cookies without a banner, but getting your consent to track you and use and sell your data.

Exactly. But trackers try to hide this and make it seem harmless.

GitHub has no cookie banner[0], how come docker.com needs one?

[0]: https://github.blog/2020-12-17-no-cookie-for-you/

Per my comment on the HN discussion at the time, that was based on a very dubious interpretation of the law. They are getting around needing the popup by only using "necessary" cookies, which doesn't need consent, but then they turn around and use the cookies for unnecessary things (like analytics) that therefore do require a consent popup, but they don't ask for it.

Analogy would be like:

Law: you can't store someone's picture or personal data without their consent, unless it's necessary for the transaction.

Most companies: <nag you for consent to store your picture>

GitHub: We authenticate you by your face, so it's necessary to collect that, so we don't need to get your consent for it. Then, once we have it, we do whatever the fudge we want with it.

https://news.ycombinator.com/item?id=25457903

They dont need consent for cookies. They need consent for tracking

Heads up - most users do NOT care about tracking, and click yes to these popups. Do folks on HN not get this?

This is all posturing. If you want to reduce tracking, use a browser that reduces the tracking. Seriously, just use total cookie protection or something on firefox.

> most users do NOT care about tracking, and click yes to these popups

By a corollary, some users DO care about tracking and click "no" to these popups.

Which ends up doing almost nothing in terms of actual tracking.

There is a cookie banner filter list for uBlock Origin :)

Docker's implementation is instant if you accept, but takes an eternity if you only want essential cookies. That seems in violation of the ePrivacy directive which according to the official website [1] requires that you "Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place."

I guess it's for the courts to decide if requiring the same number of clicks but letting you wait for an eternity is equally easy, but I doubt it.

1: https://gdpr.eu/cookies/

The problem is that it takes so long because they make a bunch of requests to the opt out endpoints of different services, which takes time. Of course, it is questionable why those requests are essential, but the point is that there is a reason to this madness.

But why do they block user interaction while doing that? You can call those in the background.

And why call an opt-out endpoint at all, after all there has to be a mechanism that prevents setting the cookie before the user sees the cookie banner. Just continue using that mechanism (e.g. gtag's consent default denied).

They are aware of it, I've contacted them multiple times about it, they just don't care.

In situations like these I can only say a massive thank you to uMatrix + uBlock Origin author!

Trust arc is incredibly obnoxious

Is this kind of artificial delay even legal under the GDRP? Does anyone know if there has been any lawsuits against trust arc and co over this stuff? After waiting forever I was greeted with: "Some opt-outs failed. Opt-out requests responded with error or timeout. Please try again". How is this okay?

It isn’t (GDPR regulates how consent can be obtained and shenanigans like these are an obvious example of bad faith) but the entities supposed to enforce the GDPR are absolutely incompetent and don’t care.

Especially as a corporate site (that is, not a click-farm that relies on tracking ads) this is unacceptable

"Trust arc" I'd trust the site more if it had a sensible cookie policy

NoScript + uBlock Origin to the rescue!

For this reason, I find myself often often using archive.is to browse text-only websites, including twitter links.

https://archive.is/iGdbt

I use an addon for Firefox which gets rid of all cookie banners [0]. No issues on docker.com either.

[0] https://addons.mozilla.org/de/firefox/addon/i-dont-care-abou...

It's perfectly readable even if you don't click on anything? And it doesn't set any cookies until you agree.

And here I wasn't asked at all about my preferences! I wonder why our experience was so different.

My guess: you aren't in the EU and the top commenter is.

I've checked, mine was blocked by adblocker

Docker (or anyone for that matter) should not use TrustARC.

TrustARC is the most evil, dark pattern I have ever encountered. Opting out takes >10 clicks and then it displays a fake progress scanner for over 30 seconds to punish you for opting out (pro tip! just accepting all is instant!).

GDPR is good, having a choice not to be tracked is good. But the pathetic way that websites try to fool you into handing over your data should be punished hard by the EU.

That's some decent patience you've got there.

I give websites 5 seconds, tops.

To muggles it can be explained line this: computers send letters to each other. Getting a webpage is sending a letter that says “can I please GET the document you call /mypage?”, where the other part replies “OK (200), by the way, next time you write, please include this token “<cookie>“, here is your document”.

When I send the next letter, I (or my user agent) can chose to send along the cookie, or not. The server does not force me. This is why the EU cookie law regulating HTTP messages makes no sense.

Meh, the onus is on the web pages not tracking all kind of shit. Don't blame the law for exposing it.

Also, gdpr consent isn't that particular about implementation. Cookies aren't something special that needs consent. It's their usage.

Reply on news.ycombinator.com