Hacker News Reader

eivarvon Ask HN: AdSense alternatives without cookie banner?

Contexual ads [0]. Alternatively anonymized analytics (i.e. you don't store personal data, IPs, do fingerprinting etc.)

And, as you might know, you're required to get permission before dropping any cookies that are not strictly required for the core functionality of the site (which does not include ads).

[0]: https://www.nytimes.com/2019/06/19/opinion/facebook-google-p...

eivarvon Ask HN: Is there any right to online privacy?

It already is – in national constitutions, and both the EU and UN definitions of human rights.

The issue is with enforcement. Lots of today's data collection, sale and use is illegal (often patently so).

eivarvon Ask HN: Is there any right to online privacy?

The difference is there are actually formal guarantees wrt privacy - such as k anonymiy, l diversity, and differential privacy.

If you can PROVE anonymiy (to a certain extent), theres little privacy issue.

The problem is that, frankly, lots of people have no idea what they're doing (or are just lying about it) – claiming location data is anonymous (it doesn't take many data points over time to identify someone), or that datasets with names removed are anonymous (they're deidentified, and the remaining attributes might be enough to identify someone).

eivarvon Ask HN: Is there any right to online privacy?

Seems there's still "required diagnostic data" [0].

See also "Minimum telemetry level" [1] under "Comparison of Windows 10 editions" on Wikipedia.

[0]: https://privacy.microsoft.com/en-us/data-collection-windows

[1]: https://en.wikipedia.org/wiki/Windows_10_editions#Comparison...

eivarvon Ask HN: What is your current side-project?

https://cleave.app

Cleave is an application that lets users persist OS state as a "context" - saving and loading open applications, their windows (and their positions), tabs, open files/documents and so on. Think of it as a workspace or project manager from an IDE, but on the OS-level.

Started because of frequent multitasking of heavy work with limited resources. Made it because I wanted to switch between studying, working, reading, looking for an apartment, etc. without manually managing all states or consuming all resources.

I'll release an Open Beta (macOS) as soon as I finish license verification and delta updates, but I keep getting sidetracked...

eivarvon Commenting vs. Making

While it is harder to make than to comment, the sort of attitude that leads to environments where one can't "criticize without having an alternative" is unbelievably counterproductive.

eivarvon Website scores kill our success, waste our time

"When a measure becomes a target, it ceases to be a good measure".

That's not to say anything about any beneficial side-effects, though.

[0]: https://en.wikipedia.org/wiki/Goodhart%27s_law#Generalizatio...

eivarvon Tauri: An Electron alternative written in Rust

That's not my experience, at least. I haven't had any major issues I wasn't able to solve with either.

Even if I were more comfortable with web tech when I first started experimenting with this stuff (some time around 2012-2015) I still found the end result much better.

eivarvon Tauri: An Electron alternative written in Rust

For the GUI-parts (and more) there's always wxWidgets and Qt, at least.

eivarvon Tauri: An Electron alternative written in Rust

    What we need is a subset of HTML features that are known to work across all major browser. From Firefox, Safari /WebKit on other MacOS, and Chrome.

What, you mean like standards? Web standards?

eivarvon Tauri: An Electron alternative written in Rust

It would also be nice if people understood and really appreciated the trade-offs of doing so – i.e. hogging resources, killing batteries, potentially wrecking the end users' experience and ability to multitask efficiently, etc.

eivarvon Tauri: An Electron alternative written in Rust

I don't think this is entirely true. Have you tried wxWidgets or even Qt?

In my experience, this is more about resources and economics ("reuse existing code" vs. having to learn something new).

eivarvon Tauri: An Electron alternative written in Rust

Why not just wrap/abstract the native platform APIs (like what wxWidgets does)?

eivarvon EU privacy agency urges more safeguards to curb U.S. tech giants

Exactly. Not to mention that lots of people do lots of stupid stuff – so appealing to it's popularity doesn't tell us much either.

eivarvon Is energy efficiency a thing in SW Engineering?

It definitely should be. I think about it all the time.

Resource-hungry apps screams "unprofessional" to me. The makers (i.e. developers or company) behind these app have apparently decided for me that whatever trade off they did for my battery life/capability to multitask is worth it – without consulting me.

You don't need to run many such apps before even a relatively new (Intel) Macbook Air spins up the fan, gets hot and battery life plummets. Wirth's law is maddeningly real.

It's frankly ridiculous, considering the functional reqiurements of some of these apps – we had chat-apps comparable to Slack in the early 2000s, for goodness' sake.

So TLDR; Either the companies don't really care about user experience (in real contexts, i.e. using multiple apps – which most people do), or the software engineers are bad at their work.

eivarvon SSL/TLS-Decryption and the GDPR

We're talking past each other here.

The definition of personal data is "any information that relates to an identified or identifiable living individual [...] directly or indirectly"

This says nothing about being linked. It's about whether the candidate can be theoretically identified. This includes both _any_ information unique enough (having enough entropy, in the information theory -sense of the word) in and of itself, as well as information that can identify the data subject in combination with other data.

In summary: Whether a piece of data constitutes "personal data" is not dependent on "whether an individual is identifiable" from that isolated piece of data itself.

The concept is thus much broader, and totally different from Personally Identifiable Information (PII).

eivarvon SSL/TLS-Decryption and the GDPR

Sorry, but I still don't think you're right. In fact, your understanding doesn't sound like anything I've heard from anyone else. The link doesn't give examples of what can be, but what is personal data.

"Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data."

This says something about the data, and how it relates to a person in itself – not what practical ways you have in a certain context, limited only to other information you have immediately available in that same context. It's about whether the individual is identifiable – the ICO says [0]:

"You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual."

Otherwise, this next part wouldn't make sense:

"Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR."

It isn't an issue of whether you're able to identify the person given only the information you have available – but whether the candidate can be theoretically identified.

[0]: https://ico.org.uk/for-organisations/guide-to-data-protectio...

eivarvon SSL/TLS-Decryption and the GDPR

You're incorrect – the GDPR mentions IP addresses specifically as an example of personal data in recital 30 [0].

The EU Commission also mentions [0] it as an example of personal data.

[0]: https://gdpr-info.eu/recitals/no-30/

[1]: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

eivarvon SSL/TLS-Decryption and the GDPR

Yes; It might not be clear, but my argument is that these sorts of logs are usually personal data (as they usually include IP-address or other person/device-identifier) – but if you have URLs too you run the risk of storing SENSITIVE personal data ("special category").

eivarvon Solid Project: All of your data, under your control

I think it's important to point out (if only for end-users) that Solid puts your data "under your control" in the "allows you to authorize third party access to your data" – not in the "can actually control your data in practice, post-access".

It'll let you granularly authorize first party access what data you have in your pod, but there can’t be any technical guarantees with regards to illegitimate sharing or otherwise copying (many might at least cache, for instance) – nor about what is collected and shared outside this system. It's own documentation even states this, if you dig a little.

I keep seeing data-hubs and identity-providers touting themselves as solutions to the web's privacy issues, but I don't see how they actually solve anything. It seems like an attempted technical solution to a social problem to me.

The real problem with data how data is used these days is really that a bunch of data is collected opaquely, unethically, and in some cases illegally – and possibly shared. The whole system including data brokers and real time bidding is out of control.

eivarvon Europe’s telcos want ‘open’ 5G networks

It'll probably never happen, but we should look into solving the technical debt in our communications infrastructure – even if breaking backward-compatibility . Huge issues and vulnerabilities wrt security and privacy that are probably solvable, but were never considered in the first place.

eivarvon I tried creating a web browser and Google blocked me (2019)

Yes, it's relevant – they migrated from Electron because of the security-issues associated with building a browser in Electron specifically. Meaning: it's relevant because it's particularly insecure, and a bad idea to implement a browser inside a browser (which is what you do when you develop a "browser" in Electron, implementing GUI using web-technologies).

And they didn't migrate to CEF (which is another embedded framework), but built Brave on top of Chromium AFAIK.

As you can see linked [0] in another thread here, what I'm describing above makes sense in the context of Google blocking anything that's implemented in an embedded framework (e.g. Electron, CEF, webviews) which does not use browser-based OAuth authentication.

I agree – The suggestion you mention doesn't make any sense from a security perspective, but from a purely functional perspective it would seem to solve the problem at hand.

And while I agree that the end result is bad, I frankly find it weird to complain that Google won't just fork over their proprietary DRM-implementation on someone else's terms. And it's not very surprising that it's closed source, or handled this way; It's typically how DRM works, after all – which is why the inclusion of DRM in webstandards was widely debated in the first place.

[0]: https://security.googleblog.com/2019/04/better-protection-ag...

eivarvon I tried creating a web browser and Google blocked me (2019)

Ah, right. Thanks!

eivarvon I tried creating a web browser and Google blocked me (2019)

Binary blobs (i.e. not open source) ?

eivarvon I tried creating a web browser and Google blocked me (2019)

I don't know. Implementing a browser in a browser can make XSS potentially bad, and I think it even lead to full on RCE in the earlier days of Brave/Electron. Still happens, I think (though to a lesser extent these days).

There's also the difference in time between committed patch and end user having a new release in the case of a critical vulnerability, for instance.

Using an embedded browser framework introduces many intermediate parties, some (many?) of which might not have being up to date with the upstream as a priority – which leads to a weakened state of security in the "browsers" downstream.

eivarvon I tried creating a web browser and Google blocked me (2019)

... and Brave famously migrated away from building a browser using Electron, because of the security-implications (not to mention that Electron actively discourages it).

Building something on top of the Chromium project is pretty different than using and embedded version of its web engine.

In the case of a high-impact vulnerability, for instance, the time between committing a fix in Chromium and the user having an updated browser is obviously shorter than committing a fix in Chromium and making a release, waiting for the framework embedding Blink to update it's embedded engine and make a release, waiting for a "browser" built using an embedded framework to update its dependencies (including the new version of embedded framework) and pushing a new release to end users.

eivarvon I tried creating a web browser and Google blocked me (2019)

This. Brave famously migrated away from Electron because of the security implications of that approach.

Also, it kind of makes sense: You'd effectively be implementing a browser (or the GUI thereof) in a browser.

eivarvon I tried creating a web browser and Google blocked me (2019)

There is another, arguably legitimate differentiating feature:

How up to date the embedded web engine is (and how quickly you would be able to merge upstream changes, update the framework, wait for "browsers" implemented using the embedded framework to update their dependencies, etc.) That can be a pretty big deal when there's a fix for a high-impact vulnerability.

eivarvon I tried creating a web browser and Google blocked me (2019)

The Qt project didn't write the origins of Google's browser engine.

Blink forked from Webkit, which started as a fork of the KHTML and KJS libraries from KDE. Many KDE-projects are built upon Qt, but Qt is an independent project.

eivarvon I tried creating a web browser and Google blocked me (2019)

I'm just summarizing what the linked article actually says.

As for your examples, Konqueror and Falkon might be blocked because they use Qt WebEngine – which embeds Blink in the Qt framework [0].

[0]: https://en.wikipedia.org/wiki/Blink_(browser_engine)#Framewo...