skysight-inc/HackerNews huggingface dataset:
Since no one seems to think about how this could have prevented, here is a simple way, which I've applied to lots of things in life, not just cryptocurrency transfers:

- If you're making a transfer somewhere with a large amount, do a small transfer first and verify it's working. Confirm at the receiving end before moving big sums.

- If you're calling a contract, try it with a small amount first. Verify the parameters multiple times, and verify the return values multiple times.

- If you're doing something with a huge sum of money, do it in steps instead of all-at-once. Fees won't be as big since you're already dealing with a huge sum of money anyways

- Verify verify and verify that everything went alright with the small sum before trying to do something with a big sum

- If you're tired, don't do it. Wait until you got some sleep

- If you're rushed, don't do it. Wait until you're not rushed, have a tea and think about it

- When in doubt, verify it and don't be tired

- If you're not an expert, have someone who is do verification above for you
The Game of War: Chess with Networks (2008)
I think we're on the same page, as I'm no fan of allowing intermediaries to copyright something that was copied left. But the idea that a third or even a second party can treat GPL as a contract ... doesn't that potentially create enormous liability for the creators of the original code? I mean I guess "as is" is plain enough, but...

After Log4J this was the first thing that jumped at me, not the anticapitalist argument.
Well, that's not for lack of trying. He subjected Iran to a strict regime of (illegal) sanctions, then assassinated Iranian general Qassem Soleimani. That could easily have started a war.

Now, I should perhaps qualify the above, since there are reasons to believe that Trump was not really able to get his way, foreign-policy-wise, due to military-intelligence-industrial complex objections, plus his defense secretary, head of the CIA etc (poor staffing which is mostly on him).
There is also the option of not messing around with personal data. It would get rid of all the cookie notices that are there, as well as not adding new ones.
Sorry, but an opinion from 2012 has no chance to be relevant if it disagrees with the current GDPR interpretation I linked to. Note how it explains that the ePrivacy Regulation is not in effect. I do not see how there could be any basis to legislate cookie usage if it is not linked to private data/analytics, if this happens it will not survive the courts I think. I do understand that this cookie consent interpretation is common - one just has to look at those stupid cookie consent forms on private blogs - but it does not follow from real legislation.

However:

> This is not the case for cookies placed by Instagram embeds.

Yeah, I can see how this is complicated and how it fits the topic. It's not a third party cookie for the embed, but for the website it might be, and is it even a functional cookie? I doubt it. I'm not sure how those would be judged and what is a reasonable way to work with embeds. It's only certain that there is not a solution as easy as it was in this case, where self-hosting the fonts was possible.
Absolutely agree. We can and should expect good things from Apple on the security front. And we should call out where their security fails short of their marketing promises.

My comment was only about explaining what makes a state level adversary formidable.
Website have no authority over the browsers accessing them. They can't order. Just state information. "There's a font over here" not "you have to go access this font over here".

That browsers by default tend to follow links to resources automatically doesn't change that. It's still the agent the user has chosen to represent them when talking to the website making the decision not the website.

If a legal body want to make the call that users shouldn't be responsible for choosing what their browsers automatically do or don't do on their behalf that's fine. But it's absurd to do it by making it the website creators problem. It's the browser that's choosing to do things without asking the person it represents for explicit permission. It's the browser sending the information to the third party. Put it on the browsers!

We've got a handful of choices for browsers. They all gratuitously send every bit of information they can get their hands on to every website they can. Just straight up informational security Judas'. And GDPR blames websites? It's crazy to me.
I couldn't find anything related to Edge.

Safari: https://webkit.org/blog/8613/intelligent-tracking-prevention...

Chrome: https://developers.google.com/web/updates/2020/10/http-cache...

Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1536058
You could just link to YouTube and not embed the video.

I think the important part is that this is an issue, only because companies like have had a surprising hard time not misusing every single bit of information sent their way. The result is that companies have forced governments to step in and now they are overregulating.
I find it hilarious that the entire internet tracking and surveylance industry simply thinks it is entitled to this level of information now.
> [...], if not installed on the user’s computer, [...]

This is incorrect. The font is downloaded regardless of whether a font with the same name is installed on the system.

The only exception is when you specify a local() function in @font-face [0], but almost nobody does that.

[0]: https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#...
People everywhere care more about people like them than about foreigners. German people were more upset about the 200 people killed in the 2021 floods than about the hundreds of thousands killed in the Indian Ocean Tsunami.

It’s sad, but not specifically American.

(That said, I always use the number of Iraqi deaths when arguing that GWB is the worst president of all time.)
This is indeed the level of knowledge required for even just transferring ETH to another person/wallet. There are different kinds of ETH, and if you transfer to the wrong kind of wallet, you lose everything.

Despite the protestations of advocates, this kind of thing is a major hurdle to adoption.
If we are talking about a right to software repair, we also need to talk about a right to not have our devices’ performance degraded.

A related issue that is somewhat the inverse, which has always bothered me, is the seemingly intentional sabotage of performance and hardware by way of software updates, essentially building in incremental sabotage and obsolescence.

What I am referring to is that fundamental performance is negatively impacted by OS updates that are usually mandatory, e.g., an iPhone or windows computer cannot load a basic website as fast as it could in the past, a basic function of the device, due to imposed software updates.

There should be a legal requirement that the basic functions and performance of a device cannot degrade without justification over time. Imagine if your car required mandatory computer updates or maintenance that resulted in things like losing 100hp over 5 years, or it took longer and longer between hitting the unlock button and the locks actuating, or the brake responsiveness got worse and worse with every update; and then being told you have to buy a new car to get all those features back.

I understand that there are certain things that cause preference degradation, but when it is imposed without real choice and there is no incentive for developers to actually prevent degradation, then there is also San incentive to intentionally sabotage customers.

If anyone remembers the push and emphasis on performance that Steve Jobs imposed on apple engineers after using an older apple device, it is clearly possible. I clearly recall that when that update went out, it majorly improved the performance and UX of older apple devices.
Of course. Good point. If an individualized URL would be used, it would be another story.

Though I don’t think that Google Fonts URLs contain individualized parameters by default that disclose either the user’s IP address or the site visited. The ruling also does not mention that this is what happened here. All the site user did, from what I can see, is embed a Google Font.

Had the site owner put an automatic JavaScript redirect to Google on his page, he’d be just as liable, according to the logic of this ruling.
When someone accidentally sent me 200 EUR about 15 years ago it sure as heck didn’t stay mine: their bank contacted mine, which then contacted me to warn me that they would soon be pulling it back out. The sender had transposed numbers in the Bankleitzahl - the pre-SEPA number codes for German banks that are still in modern IBANs, and I happened to have the same account number as someone at that other bank (all little community Sparkassen). Those Bankleitzahlen didn’t have any sort of checksum digits, but IBANs do, preventing most of these kinds of accidents.
But women and men are not the same. They may be similar on average, but the outliers generally sit on one side.
That's why convicts and dropouts are mostly men.

I have a daughter and two sons and I'm way more worried about my sons than my daughter.

The main concern I have about my daughter is transgender erasing male / female boundaries and creating unsafe space for females.
I'm sure she'll be fine whether she wants to have a career or focus on her family.

My boys, on the other hand, they'll need to ignore a lot of weakening propaganda I didn't have to. Toxic masculinity and other crap touted by the media.
The high percentage of women looking for partners earning more than them, couple with wages moving towards being equal (mainly due to women not taking maternity leave as much as in the past) also means it will be hard to date.
So what happens if you include e.g. a Wikipedia image or a youtube video? Is that a GDPR violation too? These scenarios also lead to making the users IP available to a third party.

If so, how do we avoid breaking the web while keeping privacy needs in balance?
The initiator as seen in F12 is the site HTML\CSS... not the browser.
"Arsenals radiate lines of communication vertically, horizontally, and diagonally. In addition, transmission relays propagate any line of communication aimed at them. All units must remain in direct connection with their own lines of communication, or be adjacent to a friendly unit in communication. If stranded, a unit goes offline and becomes inert."
If you are logged in to Google and visited YouTube earlier that day they already know that you are behind IP X with device Z and use that information later on by connecting it with the font API key of mydomain.de

Remember that your user agent is sent as well.
If you ask me, this argument is what we in Sweden call "satan reading the bible". I think you're fully aware that the practical result, i.e. what happens in reality, is that as the court puts it:

> The transfer of the user's IP address in the above-mentioned manner and the associated encroachment on general personal rights

Furthermore, the court is correct in stating that:

> The use of font services such as Google Fonts cannot be based on Article 6 Paragraph 1 S.1 lit. f GDPR, since the use of fonts is also possible without the visitor having to connect to Google servers.

Let's not be naive, we all know the purpose of Google offering these fonts for free via their CDN. As the author of a website, I think it's completely sensible that you should be responsible for the decision of embedding these fonts from Google rather than just serving them yourself: you are, in fact, "leaking" the IP addresses of your visitors to Google without their consent.

This is in my mind just another one of those things that have been considered completely normal for a long time, but really shouldn't. A bit like how literally everyone used Google Analytics 15 years ago without really thinking about what that meant for the ethical processing of personal data.
Functional data pipelines without side-effects could do the trick indeed. It would also make it a lot easier to debug for performance issues, and the browser could be more clever about optimizations: for example if you've got a loop changing DOM elements, maybe you could wait for the loop to finish before starting a re-render... something that's impossible to do with JS-based rendering where global page state may change under your feet at any given time.

EDIT: Just for the sake of mentioning, simple/obvious computations for interactivity was the promise of GNU's libreJS project. I'm unaware of the current state of it, though.
So you advocate a computer licence?
Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure logs IP addresses like Google Fonts here. But surely that doesn't require consent. Why not, what's the difference? What if you host with a much sketchier provider? I could see politicians thinking users would want to know if their requests were served by, say, China or Russia.
A regular user has no idea how these mechanisms work and can't be reasonably expected to do the configuration themselves. Since it's a clearly privacy-hostile behavior to include this code in the first place, the operator of the website should be prosecuted.
It's not really edge bases, it's how contracts works, and how this contract works.

There is nothing magical here. It's a bit like avoiding the checksums that IBAN has, and then complaining that IBAN is broken. Most people interact with WETH via UIs, but for some reason this user chose not to, and got severely burned because of it.

Things that require expertise usually requires one to know acronyms and how things works underneath, the cryptocurrency space is no different.

Now I don't know what you do for a living, but it certainly isn't cryptocurrencies. I'm sure there are more industries you don't work with on a day-to-day basis, and when people who are in those industries talk with each other on a technical level, you'll see the same amount of jargon. That's just part of expertise in a subject.

For example, two of my friends are chemists, and sometimes they talk chemistry stuff when we're having dinners and stuff. Of course I don't understand most of the stuff they are saying, but I'm not gonna claim "chemistry" is "magical knowledge" just because I don't understand it, so I'm not sure why you would about cryptocurrencies.
Link gives a 404, you might want to replace it with https://mdsvex.com
It has nothing to do with approval. This specific ruling is about the principle of data minimisation. If you process personal data you must do a risk assessment and make sure you only process no more data then strictly necessary. This applies even if you have consent. So in this case since you can host the fonts yourself to not share data (IP, time, browser agent, cookies) with Google you should.
I agree, but the court did not ban Google fonts. It required consent before using it.
The new meaning of hard work
> To everyone: If you wrongly send money to a mistyped IBAN it is gone.

You clearly have no idea how an IBAN works. It has a checksum exactly to avoid mistyping.

And even if you send the money to an valid, but wrong, IBAN then one of two things happens:

* The account doesn't exist -> transaction bounces
* The account does exist -> ask for money back, worst case go to court to recover it

But the money is not gone. There are no black holes just swallowing everything up.
... or if your grandmother tries to use it and loses half a million dollars.
Yes and no. 5 is 12% away 5.6, but so is 50 and 56. I would argue that the latter difference is much bigger and more likely to be noticeable by average Joe going about his daily life than the former.
> the ETH devs literally just rolled back the transaction?

That's when some of them were themselves invested in the Dao...
Technicalities don't matter. The user never consented to this data being shared with third parties, and there is no simple mechanism for the user to block them that is available to all website users. As other mentioned, GDPR also requires opt-in.

There is a case for third-party requests, and considering that some websites make tens and sometimes hundreds (eg Yahoo) of third-party requests, passing the burden of filtering those requests to the customer doesn't really scale.

The burden is fully on the website operator here. They wrote the software, and it's most certainly closed-source. Just as the burden of keeping my data safe on their backend is on them, the burden of keeping my data safe on my frontend is also on them.
Well, it depends. If it's a short video that fits into your available traffic that you can just self-host with a video tag, why shouldn't you take that option? If it would be a huge burden like where you really would have to develop infrastructure despite that not being in your budget nor competence, then of course not.

I already agreed in a comment above that these questions wrongly answered by a pure privacy maximizing position carry a huge danger for the german web.
Fine. It's not a [standard, generally accepted] word.

Feel free to disregard my advice, though; it's no skin off my nose if you don't want to sound like a "native, educated speaker".
The problem is, they have a fundamentally simple concept that solved the double spend and trust problems for a decentralized (sort of currency).

That part we kind of figured out, maybe it's ok, albeit super slow and power intensive, but let's put that aside for a while.

But is there a solid mathematical and cryptographical basis for everything else layered on top? I don't get that impression, it just looks like they're just plugging gaping holes because there's a gold rush to be continued!

If they're just rebuilding a crappier version of the global financial system, there's no point in the rest of us following them.
https://old.reddit.com/r/UsbCHardware/comments/motlhn/magnet...
"Any sufficiently advanced technology is indistinguishable from magic."

but yes, I find myself thinking the same with many things. especially when the disciples seem irritatingly proud of their "knowledge" which actually is just a collection of arbitrary and anti intuitive rules.
So it is the responsibility of the website owner, to make sure that the user is informed about how his own browser works. Couldn't you make a case for shifting this responsibility to e.g. the browser vendor or the regulating bodies who decide on web standards?
Cryptocurrency is fiat, in that unlike commodity money, they are not backed by anything
Economically, KYC in the real world is a step backwards. Economically, laws made to restrict trading is a step backwards. There's still a damn good reason we do it, but the crypto grifters seem to only see the economical part of it for some reason.
I think calling them tokens and giving them acronyms like they’re a currency of some sort leads to a lot of the confusion.

I mean, Java class naming wouldn’t be any better but “WETH” is just extending a base class with an interface.
> - If you're not an expert, have someone who is do verification above for you

I would modify this to

> - If you're not an expert, have someone who is do verification above in addition to you (not instead of you)
Bavaria only? If it had been up to Germany’s buerocrats, the whole internet would not exists.

(Also, no cars. For calling a Ford Model T an “automobile” if it still needs a human driver is misleading to consumers, according to, again, the Munich district court.)
So instead of pointing to at least single false fact in my comment you point me to a website which quite aggressively translates the official Western stance and does not even tries to look as independent (it's an EEAS outlet), which I should blindingly trust? For reference, I do know both Russian and Ukrainian (the latter to an extent of being able to understand news), so I built my opinion based on Ukrainian media and social networks.
If anyone from FTD is here, the site has some text issues on dark mode:

https://i.imgur.com/CfI5lPC.jpg

It looks fine on light mode:

https://i.imgur.com/oJPMkUZ.jpg
I agree. It's silly that people just use third party services left and right.
So how valuable would it be to you if I would share with you that I spent $20 yesterday on shopping groceries. Probably not so much. But if I would share with you 90% of my spending, you might be able to infer a lot more information about me.

So the question isn't how useful the single request is, but rather what can be done with a lot of these requests. And Google and Facebook are specialists in generating lots of said requests with services like google fonts and like-buttons. And once you realize that the sum of these requests is so valuable that they are considered personal information, you want to protect them with laws.

These laws, like the GDPR, are already in place and this is one of the instances where someone didn't respect such a law. So you can argue now, that this single request isn't so valuable, but isn't that true for every penny of a million dollars?
If you look around on reddit there are ways to use any domain registrar. Just needs some txt records.
"Bouncing" can happen in cryptocurrency world as well, it's called "sending to an invalid address". It just happens to be that the address-space is so big you don't really know what address has a real physical person behind it or not, or yet even.

Try sending cryptocurrency to an invalid address and you'll see that the wallet will reject sending it, just like email bouncing.
Thanks. That lets me know I've done my satire well ;)
For that matter, does the fact that reaching my self hosted site must travel the last mile along a service I paid for (my ISP), mean I must gain consent for using them?
What? I have to give name, address, credit card information, order information… or click two buttons in an app and get a pizza.
Because that feature of gmail is not a part of email, it's a part of gmail the product. And it is not "undoing" sending a sent email, it's cancelling an email that was never sent in the first place.
> But in the world we live in

Read: The world the USA maintains

> there are too many military and paramilitary actors who are not guided by such Enlightened ideals.

A majority of which being: US forces per se, forces of US allies (NATO etc.), and forces of states which the US has paid off, extorted, or otherwise manipulated.

> What will we do if we are not prepared and they come knocking on our door?

But what will "they" do when _you_ come knocking on _their_ door? And they can never 'prepare' to fend off the leading military power in the world.