kqp

> To not be indistinguishable from "strictly necessary" there would have to be a case where the "functional cookie" actually required consent, right?

The case is when you don’t use that feature.

> how would you solicit that consent other than some kind of cookie banner?

Using the feature that requires the cookie is considered consent, same as using the website is considered consent to set cookies actually necessary for the entire website to function. For example, if you click “save settings”, that’s consent to save those settings, there’s no need for a “but am I allowed to save settings?” popup.

You might be tempted to dive into the potential grey area here, and sure, one exists, but (a) that’s why the laws go into 1,000 times more detail than this HN comment, (b) most of it’s not in the grey area, and (c) even in the worst case, making 100% sure is as easy as a checkbox before the button that activates the feature, there’s never a requirement for a blanket “can we do whatever we want” before even displaying the homepage.

> It refers to statistics, but sometimes you do want that, e.g. so the site can tell you how long it took you to do something compared to the average user, or provide those analytics to you. And the fact that this is ambiguous is an obvious problem -- if you get access to the data they collect is that "analytics" or "functional"?

The GDPR calls it “statistics”, but in this context defines the word to mean analytics, not statistics shown to users. If it’s shown to users then it’s either strictly necessary or functional.

> In the face of an ambiguity, most corporate bureaucrats are going to take the risk-averse option, which is to ask for consent in case it turns out to be adjudicated as required ex post facto. The result is quite predictable. If you pass a poorly drafted law, businesses have a general preference for doing something stupid/wasteful/annoying over something that could get them sued or fined.

Businesses are generally risk averse, yes, but don’t mistake knowing a force at play for knowing them all. The “cookie consent banner” was invented and evangelized not by the laws they’re commonly believed to have sprung from but by the IAB, an ad industry consortium counting Google, Facebook, and many others as members. The same organization that organized efforts to prevent third party cookie blocking, and that tried to block the GDPR entirely. The banner norms they created did not even comply with the law until changes a few years ago, the EU just took its sweet time on enforcement.

The average small business, of course, is not in on some grand scheme, but this is where your risk aversion comes in: if all the big players are doing something, and everybody around you is doing it, and you Google it and the first 20 results all say to do it, then the risk averse move is of course to just do it and move on. After all, trusting your own judgement is scary, what if you get sued or fined?

Strictly necessary cookies don’t require explicit consent, and generally can’t be rejected. Functional cookies don’t require additional explicit consent if you actually use that function. “Performance” actually refers to analytics, probably rebranded because users did not want it. Making you think they had to ask for the reasonable cookies, too, is the whole trick being pulled here.

This is already what LibreWolf does for most of its fingerprinting protection, including resolution, which you call out. It already works, LibreWolf is the only browser besides Tor I’ve found that actually defeated fingerprinters in some of my testing. Is there something that’s currently randomized that you think should be binned or homogenous?

This is misinformation stemming from disinformation propagated by organized industry retaliation to the law. Cookie banners are not and never have been required by law, they are intentional harassment designed to make users oppose laws that actually just say “you may not track users without their consent”. A good faith implementation would be simply nothing, because no explicit consent is required when you’re actually using cookies for honest purposes.

Genuinely, I’d recommend you spend a day manually verifying every AI answer you otherwise would have just trusted. I suspect what you’ll find is actually that you cannot bring yourself to do it. I’ve found myself trusting AI answers sometimes, despite knowing they’re usually false, and after some introspection I realized my subconscious was acting on three factors: I wouldn’t actually be harmed by being wrong about the thing, I wanted to feel like I knew it, and I didn’t want to spend any time on it. Getting a real answer could only work against those goals: I didn’t actually need it, it’d likely be less certain, and it’d certainly take a lot longer. In other words, I was fooling myself.

This is going to be unpopular here, but life became easier when I quit trying to write semantic HTML. It’s just poorly designed, I’m sorry. Every time I’ve reached for a <dl> I’ve eventually regretted it because I wanted multiple levels of wrappers, or a divider between sections, or an icon, or a heading spanning multiple key-value pairs, etc. They make this stuff with some flexibility but nowhere near enough to actually cover the generalized concept it purports to. I still use the corresponding elements when there are observable benefits, of course, like <button>, <h1>, etc, but when all it’s going to do is not quite fit the data model and force me to override everything, it’s just not a practical choice.

It shouldn’t be so controversial to say that if 99% of usage routes around your API, it’s probably the API’s fault.

Every single macOS update the top comments are about giving it six months to stabilize, but when a program’s biggest ever rewrite involves a lot of AI, the top comment is calling you irrational if you don’t YOLO it, and probably a jerk, too.

The known/unknown question is not separate in the real world, computing avoids it by asking binary questions only when they’re answerable. Considered generally, though, if I ask a true/false question then read your answer from a single bit, it may be the case that there is no possible way for you to not lie to me.

It’s phones, mainly. People do also have multiple other devices, yes. For me another big pro is having a realtime offsite backup and being able to survive simultaneous loss of all my devices, which is plausible in correlated scenarios like a burglary, fire, mugging, car crash, etc, but I don’t know how much others think of that one.

The people I know who use KeePass live like they’re disabled. You ask them to sign up for something and they need to schedule a half hour for it two weeks out. Ask them to use a website and they need to wait until they’re home because their biweekly manual data transfer was put off because of whatever. And if they ever drop their phone, it’s this totally unforeseeable panic they’re still recovering from two months later. I’m far from convinced it must be like this, but I’m also far from convinced that most KeePass people—or people using any other strategy—have really thought this through.

Down for me too, in the Philippines. Maybe it’s not down in the US. I found out when I was using DuckDuckGo just fine while my friend thought the internet was down, that was kind of fun.

> what do you actually want?

Give me the ability to choose what I trust. “You can either trust Apple and nobody else, even yourself, or you can trust literally everybody” is obviously not a good faith implementation of this. Apple excels at steering the narrative with false conflation and false dichotomy, I’d also remind you of the came-and-went secure boot debate, which Apple successfully steered into Apple owns the encryption keys vs no encryption, and people just kind of forgot to ask, wait, why can’t I have the keys to my device?

Is this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.

Never retaliating is a great way to get people to attack you. Of course escalating to all-out war provokes the same in response, but there does need to be a proportionate response, because it needs to be stupid to hurt us, not good business. t’s a significant failure of the US government when half the world freely loots US citizens and businesses.

This page helped me understand what they’re going for: https://patapom.com/blog/Lighting/Colored%20Penumbra/Colored....

The way I’m intuiting it: some things will “glow” when strongly illuminated, and the glow is more colored than the reflected light, so if the illumination has a hard edge then the penumbra can end up saturated by the more strongly illuminated part’s glow.

OP’s rendition isn’t quite landing for me, though, and I’m not enough of an artist to be sure why. Maybe it’s just that saturation is cranked way up for the demo, but it might also be that it shouldn’t occur on rock, or that color seems sometimes to not react to a change in which material is glowing.

A week ago GitHub published a blog post saying this, a day later GitHub execs were in HN comments repeating it, and just like that it’s common knowledge that GitHub’s steady reliability decline from the 2019 onward was actually caused not by the 2019 Microsoft integration, but by something that did not exist until 2023. PR works, y’all. Turns out the reason GitHub doesn’t work is because it’s just so good!

This is something I’ve long believed to be true and important to understand, yet rarely see anybody else argue, so it makes me happy to read. I think of it like the kissing noise we make to make a pet come. You could call it the truth or a lie depending on what the pet is expecting and whether you then do it, but both judgements miss what actually happened: it didn’t even occur to us to think about whether it’s “true”, we just made that noise because we expected it to produce the desired behavior. CEOs and politicians are usually like this with humans.

Well, it started just after the Microsoft acquisition, when AI did not exist, and coincided with news of Microsoft fully ingesting the GitHub team and forcing architecture and priority changes, and has steadily continued since. So idk, it’s a mystery. Maybe it was caused by the thing that did not exist when it happened. Microsoft just posted on a PR blog that it’s the thing that did not exist, and they’re famously truthful, open, and altruistic.

It’s not industry advice, it’s life advice. Believe it or not, there exists a world outside what’s trending in the tech industry, and the outside world is also much bigger, much more important, and considered by many more to be the point of both education and life.

You were gifted a breath of fresh air, and thought only “well this does a terrible job of smelling like my room”.

They’re publicly traded for-profit companies, selfishness is literally the definition of both of them and it’s the farthest thing from a secret.

It sounds like he didn’t actually file a false police report. They don’t even say they asked him whether it’s true. It seems the police just read a post by a random person on the internet, assumed it’s true, then arrested him when it wasn’t. The article is devastatingly light on info, though, so I can’t be sure.

I’m going to go out on a limb and guess that you define “vulnerability” as something like “thing that will be fixed soon”. After all, Joe Random not liking a behavior doesn’t make it a vuln, there needs to be a litmus test. Am I close?

They are one of the main players in cords, chargers, power banks, robot vacuum cleaners, smart home devices, and headphones and earphones, and also make a bunch of other stuff. They have $4B annual revenue. Some things are under the Eufy brand.

Do you have a source for any of this? Wikipedia and news that I can find support that he fled Russia after government conflicts. It’s also well known that he keeps his and the dev team’s location secret, so anybody going knocking on incorporation addresses in Dubai then feigning surprise is acting in bad faith.