FreeHugs

It is amusing that in Europe, there is this big DGPR drama playing out about websites embedding resources from US companies. Like Google Fonts, Tweets and Facebook like buttons.

Yet the browser sends each and every website the user visits to a US company.

All in all, I tend to think that it is a net positive.

Downside: Now one US companies gets all my DNS queries. But can they stitch them together? I tend to think they can't easily. And will hopefully not keep enough logs to do so later.

Upside: My ISP and the cafes and hotels I visit do not get the info which websites I visit.

The protection could be made even stronger if the browser would send 5 DNS requests for every IP it needs. So if you visit news.ycombinator.com it additionally sends 4 random hostnames to cloudflare.

It gives me this error:

    error in reading settings

(I'm using Firefox on Linux with uBlock Origin.)

How do you run such a Google Colab thing?

I don't see a run button?

On.. maybe "Runtime -> Run All" from the menu ...

Shows me a spinning circle around "Download model" ...

26% ...

Fascinating, that Google offers you a computer in the cloud for free ..

Now it is running the model. Wow, I'm curious ..

Ha, it worked!

Nothing compared to the images in the Dall-E 2 article but still impressive.

Essays are my favorite type of writing.

Thought experiment:

What if we just continue like we did in the last two decades?

Would there be any real harm if we simply returned to the pre "cookie banner world" of the internet?

Lets talk about startups first:

An indie dev in New York does not care about the GDPR. The just build cool shit and put it online. Look at all the Show HNs here.

In the EU, the situation is very different. Indie devs are super afraid and work hard to make their stuff less useful to please the GDPR.

Now about larger players:

EU companies agonize their worldwide users with cookie banners. Because that is what the GDPR tells them to do.

Non EU companies dont do that. Because why should they? Will a lone Italian traveller in the USA sue them for using Google fonts? Probably not. And if they do - they can handle it. So they only agonize their EU users with cookie banners.

That sounds very theoretical. I witness the journey of several German startups for a while now and get a very different picture.

Many of the most powerful web tools are not compatible with the GDPR. Google Analytics. Ad marketplaces. Free CDNs. And its all a moving target. I see small companies struggling for years now with these problems. And they will keep struggling for the forseeable future.

Dumb money is not the basis for the web as we know it.

Look at where we are communicating here. On a US website built by a single person.

Regulating local companies is making things only worse. That is the reason why all of Europe depends on foreign tools in the first place.

It is a similar death spiral to how we deal with the housing problem. People have a hard time finding affordable apartments in the city centers? Create more laws that limit rents! Does this create more apartments? No. It just send the local housing market further down the drain.

One reason the EU missed out on the internet is our unlimited willingness to be regulated. And we keep piling more and more bureaucracy on top of it.

This only cements the power of US big tech like Google and Facebook.

And it sets the stage for the next big applications of the web all being build outside the EU as well.

Here in Germany, everyone is afraid to start a web startup. And if they do, they spend endless amounts of energy on agonizing over the GDPR and how to build useful international services without using international tools. We sanctioned ourselves by making the use of foreign SAAS illegal.

If you are in the EU, try out surfing the web via a non EU IP once. It is an eye-opening experience. No cookie banners! Only Europeans have to deal with those.

But it gets worse: Look at European websites from a US IP. You do get cookie banners. European companies deal with degraded user experience, slower build time and worse monetization. On a worldwide basis. While the rest of the world only applies these downsides to the European part of their business.

I am not aware of any big publishers doing that. That is why I asked for an example.

What do you mean? Can you give an example?

I run a website with a few hundred thousand monthly active users. I get tons of mails from users telling me how much they love it. One unintrusive, smallish Adsense banner pays for everything. For years now, everyone was happy.

Now Google sent me an email that they want me to gather user consent before showing Adsense. They offer an automatic consent modal. But the problem with that one is that it not only displays the consent modal but also injects a smaller widget into the site. It looks like the widget only pops up when the user scrolls down to the bottom of the page. Unfortunately, that also makes it pop up when the page is not longer than the screen. So pages where the content fits on the screen behave really really shitty. Maybe that is the reason why I have never seen it used anywhere.

And of course loading the consent script from Google before getting consent is not in line with GDPR in the first place.

Other consent solutions I see around the web are heavy third party widgets that do a lot of complicated stuff. And because they are third party scripts, they are also not in line with the GDPR.

I have not found any indie developers who have implemented their own consent solution. And as far as I understand it, Google has no communication channel. They just threaten to kick you off Adsense. So all I can do is implement my own solution and wait if it happens or not.

I started to implement my own consent banner now. Not sure if I will get it right so that it pleases Google.

I fear that this whole GDPR thing might be the end of my website.

Nice reminder to stick with plain JS and not go for the latest "compiles to js" language.

First of all, GDPR is not about cookies. It is about personal data. And so far, courts have considered the user's IP to be personal data.

Since advertisers need to know if you really show their ads, the ads need to send some signal back from the user to the advertiser. So ads always send the user's IP to a third party: The advertiser or a trusted intermediary.

Assuming no consent to that for everybody would mean that the revenue of my website goes to zero. And I would not be able to run it anymore. As the ones paying for the costs are the users who consent.

As far as I understand it, "withdraw" here is the withdraw of the consent at a later time. Consent that was previously given.

https://gdpr-info.eu/art-7-gdpr/

I don't think it means that when asked for consent, the user must have an easy way to deny that consent. As the user can always decide to simply not use the website.

When I try to sign up, it sends me to go.redirectingat.com which is blocked by my ad/tracking blocker.

How does that domain come into play here? What does it do?

What does it actually do? Does it automatically "accept everything"? Or reject everything? Or just supress the consent forms?

    were already in court

Really? That surprises me. I did not hear about this.

Do you have a link to such a case?

    "Accept all" and the "Deny all" must be both
    be the same level of "easy-ness"

I think this is not clear until it has been tested in court.

Many websites now have two offers: Free with 3rd part ads and paid.

Surely paying is much less easy than clicking "Ok, show me the content with 3rd party ads".

It will be very interesting, how courts see this.

I wish there was an open source project for developers to implement those darn consent forms.

Adsense offers an automatic consent modal. But the problem with that one is that it not only displays the consent modal but also injects a smaller widget into the site. It looks like the widget only pops up when the user scrolls down to the bottom of the page. Unfortunately, that also makes it pop up when the page is not longer than the screen. So pages where all content fits on one screen look really shitty.

Anybody who has a website with Adsense here? How do you guys deal with this?

Anybody here who wrote their own consent modal?

I am about to implement my own. Unfortunately that will then not be automatically handled by extensions like the one in this post or ublock. Putting the burden of clicking it away on my users. Even on the 50% that use an ad blocker anyhow :/

Yes, that is basically how I understand it too.

My question is what people here on HN who run free, ad supported sites do.

As far as I know, the GDPR says that not giving consent must not have negative consequences for the user. If it means they have to pay, how is that not a negative consequence?

So be it!

Until XyZ is the new WebAssembly and @!# is the new XyZ!

As long as my Django backend works and browsers support my HTML/CSS/JS frontend, I am fine.

I have the same LAMP (Linux, Apache, MariaDB, Python) SAAS project running for decades now, paying all my bills, letting me live a free life.

As long as nobody touches that, you can do all you want. Invent new fancy stacks every other year, make courses for it, migrations to it, a religion of it - I don't mind.

How so? I have not much knowledge about it, but my expectation is that when you run your own lightning node, there is no reduction in decentralization and trustlessness.

And I would expect that running your own node is as easy as setting up a cheap $10/month VM, download the software, start it, wait some hours until it is synced and then you are good to go?

What do you mean with "legal and process and regulation"?

Regarding "fraud detection" - isn't that a self made problem of payment processors? When the settlement is instant, the merchant does not need to be afraid of fraud. Bitcoin paid via the lightning network is paid and can not be taken back.

Layer two solutions like the lightning network make payments almost free. Much cheaper than using Stripe.

Someone correct me if I am wrong, but I think it is pretty easy to run a lightning node. And then no service is between you and the network.

Will this type of thing still happen when/if we all are using crypto payments?

I know that bringing up crypto creates a strong positive/negative "with us or against us" reaction. But it would be great if we could discuss this question on a technical level this time! It is a real question: Will using Bitcoin and the lightning network (or similar technologies) free us from the constant fear that a human or algorithmic error kills our business?

It would be cool if something like this would be possible with standard Linux tools on the command line.

How hard would it be to implement a network rule "if http://abc.com/def is requested reply with this data: ..."?

Or is it possible to inject something like this on the fly into Apache?

Would be very nice to mock end-2-end tests.

But can you swap out CPython for Cython in - say - a Django stack and things go smooth?

Every time I look up how to replace CPython with something faster for Django, everybody who tried it (in production) is of the opinion that it was surprisingly painful and is not worth the hassle.