skysight-inc/HackerNews huggingface dataset:
> the w3c standards define, that browsers execute the commands they receive from the server

I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly configure to leak their data, even if spec-adhering behaviour of rendering the webpage should not), to attempt to understand the document and retrieve any other resources that may assist displaying the content correctly.

On the other hand, if one was to send CPU instructions back to the user, I guess it's also there choice to execute them...? Also, it's not possible to determine which resources are for display purposes (fonts), and which are for tracking purposes, the browser will blindly have to retrieve the resource, so websites have a certain responsibility to issue privacy-respecting "instructions".

I'm trying to argue both sides here, I still believe that the user chooses voluntarily to use the browser, visit the webpage and therefore parse the document and initiate any subsequent requests that the document proposes, on the other hand, this is beyond most people, they just want to view a frickin' website, so perhaps the lives of web developers should be made harder to make the lives of the average Joe, who is not an IT expert, a little easier? The architecture of the web is inherently not privacy-respecting, in order to save bandwidth (and for sake of simplicity), we only send fragments and let the browser choose what else it needs, which can be tracked.

It's like walking in a park. You choose to show your face to people, we've come to just accept the fact that by the laws of nature, we cannot prevent other people from seeing our face (unless you use a mask, but then you make them very uneasy), we leak data that others can remember and use to identify us later.
Would that logic also work for loading images from other sites and services? I never sent the info to the server myself but told the browser to load the image from that server. Is you argument that it’s client-side code so doesn’t count?
> the original website is merely requesting the user to do so

... in a violation of GPDR, because user's informed consent was not received beforehand.

> it's exactly what the court is there for

I might have been more clear: it hardly matters what you or I could say — what does matter is only what the lawyers say. In this case, I assume that either A. the defendant's lawyers have brought this argument before the court, and the verdict still was what it was; or B. the defendant's lawyers have failed to bring this argument before the court.

The courts are not there to discuss arguments made in HN comments.
The law puts the responsibility on that on the website owner. A user can't be reasonably expected to know these mechanisms in depth.
It might sound weird and even sounded weird to me at first but I think it reduces to setting a trap for the user:

If

1. we accept that Google knowing we visit certain websites can hurt a user

2. one can get punished for not fencing of a construction website because someone could get hurt

then in my mind this is a very obvious digital equivalent.
Sauce and cheese.
Really? If a mail server (and the post office of most countries) don't have the specified address, it either gets sent back if there is a return address written (email non-delivery notice (aka return to sender, NOT undo) or it goes into a catch all bin (same as a lost & found)(or root account for most mail servers)(or dump it in the bin).
Unmetered is often means 1 Gbit. With 4K video that means less than 100 streams. It may work, but the moment the video is shared among friends the site can be in trouble.

Plus YouTube handles all re-encoding and adjust the quality based on the speed and device.

It is possible to do it with open-source components, but it requires a server farm and just not feasible using single cheap private server or VPS.
This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.
Where is my personal responsibility in making sure that the food I buy isn't poisoned and that the producer doesn't use slave labor? Where is my personal responsibility in making sure that my friend will return me a loan I made to him? Of course it is sensible to make basic precautions, but it is also sensible to expect social institutions like the legal system to help.

Our society is immensely complex; it is quite naive to assume that everyone has enough time and power to watch out for things like that and fix them. It is also quite dystopian to think that people should by default treat every stranger and company as adversary.

TL;DR separation of concerns is good
That’s no different than a CDN hosted in any other country, though, so it gets back to HL33tibCe7‘s point that this seems it would apply to CDNs.
But why? Why must you do that to begin with?

ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?
You have a point and I as a dev will ensure to follow this principle. The issue is that serving fonts and other assets from an external service is pretty much normal practice. This is new ground. The understanding so far was explicit tracking being the issue and not serving static assets. This ruling makes sense but goes way beyond what the consensus was so far.
At the end of the day, nothing matters, so why discuss anything at all?
Currencies don't come with a prerequisite of intimate knowledge of industrial jargon that requires use on a daily basis to be proficient enough in to not lose everything.
I hope you are doing alright. Everyone is different, but for me, finding a steady girlfriend and full time work resolved my most accuse depression. All the “freedom” was exciting, but it came at a cost.
Didn't you listen?
I’ve literally never bargained with the pizza joint, and I would get smacked in the face and thrown out on my ass if I did it in person. Are you kidding me?

As far as when there’s a problem, with the major food delivery app I use, I am refunded merely for asking. I’ve used it heavily during the pandemic and literally every problem was solved through the app.
Digital nomads are I've met are only about 5% devs in my experience. A lot of would be digital influencers and marketers. I rather liked Canggu Bali pre pandemic though I think it's still mostly closed at the moment. Pretty people/buildings/scenery. Maybe a bit shallow.
Yes, but you incur traffic costs as well when you send to/from AWS right? I don't have that issue. Nor do I want it; I like AWS for what it does, but I want to be able to get away when I need to.
Going further with this argument would all hacking also be ok?
This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c0.wp.com, i0.wp.com, s.w.org, ssl.p.jwpcdn.com).

If this ruling is upheld, either (a) browsers need to immediately stop interpreting these commands, instead providing user prompts for _each offsite load event_, or (b) a very large swath of websites are all open to the same legal issue. As a small example, the Aesop wine company site (https://www.aesopwines.com/), made with Squarespace, uses typekit, squarespace, and google CDN loads. They're subject to the same ruling, right? And so on, and so on...
I think it allowed browsers to cache font files across websites. But that might not even work anymore as I understand many browser vendors are moving towards resource isolation.
I guess one advantage could be to better use browser caches for these things? If you visit multiple websites that include the same fonts or javascript libraries, the browser can reuse the cache for them.
You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.
Yes yes, as mentioned in another sibling comment, your wallet won't allow you to send anything to an invalid address. In this case, the address was not invalid, so why expect it to get rejected?
> It's not as if the plaintiff's browser is actually under control of the defendant

In theory and in practice it is, though. The browser viewport, by executing remote code, is in fact under control of the defendant's website.

Most websites are closed-source. The "instructions" are not available to the customer.
On the one hand I don't want lawyers, government and politicians to shape cyberspace. But I also like this ruling it seems to set a precedent for users to be able to opt-in to APIs (and probably javascript the obvious next step if this goes on). Client-server interactions should be transparent, this will prevent allot of privacy related issues. It also makes the web more decentralized, getting developers back into a host your own stuff mentality.
.. is pierogarnia a polish restaurant specializing in pierogi?
No I didn't, but there's something missing - with the same radius of circle end I assume perhaps?
So does this mean assets hosted by CDNs are illegal now? Since it doesn't ask the user's permission to direct the browser to another site to download said assets? And what if they're already cached in the browser. Distinction?

Seems like laws don't understand how tech works...
I recommend they start with microeconomics, though. More relatable and it would tell them about human nature, first.
What would really help is if the recipient had to prove they can spend the money they're about to receive before they receive it.

Which is in fact required with cryptocurrencies using the (pure) Mimblewimble protocol.
> Potassium deficiency is very rare

Potassium-deficient diets are not rare. Using the U.S. as an example, only 3% of people in the U.S. consume adequate levels of potassium in their diet according to the most recent NHANES survey.[1] The U.S. Dietary Guidelines Advisory Committee has identified potassium as 1 of 4 "shortfall nutrients" (nutrients that are underconsumed by the U.S. population at large) that are of public health concern in 2015.[2] That is why the FDA has required food manufacturers to include potassium amounts in the "Nutrition Facts" label since 2016.[3]

[1] https://academic.oup.com/advances/article/4/3/368S/4591617

[2] https://nutritionj.biomedcentral.com/articles/10.1186/s12937...

[3] https://www.ift.org/news-and-publications/food-technology-ma...
The sources link is broken and some of the data is wrong (or maybe old). The site says the Danish life expectancy at birth is 79 years. CIA factbook (the supposed source) has the number as 81.45 years.
There's a difference between data sent to the website provider (and through it, indirectly to third parties), and interactions between the browser and third parties. The linked ruling forces the provider to ask the user for consent for third parties (even though the provider has nothing to do with the interaction!), instead of mandating a direct opt-in interaction between the user (agent) and third parties.

Imagine embedding many social media sites. Instead of forcing the social media sites or browser vendors to create embeddings that ask for consent themselves, the website provider has to ask for consent on behalf of all external sites before loading any content. As a web developer, this is a nightmare.
Thank you for your response. I’m curious to know what the utilitarian approach to policing would be. (An approach that is useful or beneficial to the majority?) I currently believe that approach is still a highly decentralized one—Local communities deciding what the best approach is and the freedom to move over to a different community if desired. And I still think that belief aligns most with libertarianism.
I don't understand German but understand HTML/HTTP. Technically, you only get HTML from the website you visited. Then, YOUR browser, requests more data based on that HTML. So technically, it is your browser who requested the font and as a result leaked the IP address.

Am I getting this correctly or not?
I don't think people understand the trades they're making. They see that one offering seems to do approximately the same stuff as another one, but it only costs half as much, and don't understand that the cheaper offering is one one millionth as fixable as the more expensive one. By the time it fails, they forgot the circumstances under which they bought it, so they may never connect cause and effect.
Ask HN: What are your favorite HN threads of all time?
A robot bartender will be on duty at the Winter Olympics
What API key?
Could you be more specific please? Cause you said based on photographs. Otherwise national banks usually ask for more than half of the note. At least in that's how they do it in Germany and Romania.
Which is the same thing with cookies, you just set some string in a HTTP header, if the browser actually honors that is up to user (in the way what browser he installs and how the user configures it).
> he saw a foreigner whom he believed to be one of the Amazon staff going through his desk drawer and checking the pockets of his uniform on his chair.
So an US Amazon employee helped to get this guy and their Familie tortured for two years so that Foxconn could keep using little school children to manufacture Alexa’s working 100h per week?

Yikes.

And apparently all of this happened after Amazon had to punish Foxconn for using illegal workers, yet the leaked Foxconn internal documents suggest that the amount of illegal worker conditions had to increase to cover up for the punishment.

The US should just ban importing any good from countries using child workers, period. It should not be up to Amazon to “slap” their producers on the wrist, but rather the government should impose absurdly high fines on US companies that don’t report this, to ban goods from those countries.

In which world is it right to force school children to “work 36+ hours of overtime” to manufacture an Amazon Echo? This whole story is just completely ridiculous.
No.

The responsibility of the website owner is not to send users' personal data to third parties, OR to receive their users' informed consent to such sending BEFORE that sending occurs.

That's the law. It's enforced by courts.

Web standards aren't law. They aren't enforced. You can't sue anyone in W3C court for using non-standard CSS or forgetting to close a `<b>` with a `</b>`.
By the same token, if you run a binary executable, you are knowingly using a piece of software that has, and has always had, the default behavior of autoloading any dynamic libraries, running any unprivileged machine instructions, making any unprivileged system calls, and having access to all the appropriately mapped memory it might find or obtain.

So you could conclude that my program can do whatever it wants within those constraints, and it's your problem as a user if it does something you don't like.

But I don't think it is fair to expect normal people to analyze a program for malicious behavior before running it. And I don't see how it is relevant whether that program is a compiled binary or a spaghetti blob of html, css, javascript, and web assembly. Also it is not clear that such analysis is permitted by the draconian copyright laws.
Maybe reach out to Kernighan?
That looks really cool, bet it'd be a great way to write interactive docs and things like that too!
So it's all right to close media just because it's "Russian"? Ok...

You know, Ukraine has media control agency and laws which regulate quite strongly what can be and can not be said and shown by media. Opposition media was regularly pressured by this agency (while handling of "pro-Western" media was much more lenient), but in the end they were unable to close them using this legal channel, so instead Zelensky simply used unconsitutional executive order.
Why is it such a hot feature that you can see every transaction, though? Why do you care if I got my bank to revert one of my transactions?
Lol was trying to check in for a flight using Lufthansa's website today; just hangs and doesn't do anything after you enter all the forms...
For years I was going in the list of vendors and disabling everything. Now I became so bored by these prompts I decided to instead just accept everything and clean my cookies every week. I’m less frustrated this way, and still feel I have control over my privacy.
You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right?

UK:https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri...
Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)
that's not what a cdn is for or does
You're making the mistake of thinking that the cookie consent requirements are somehow a consequence of GDPR. The cookie consent requirements exist separately from and additionally to GDPR as a consequence of the e-Privacy Directive. What GDPR changed in regard to cookie consent is what exactly constitutes "consent", as it updated the Data Protection Directive in that regard, but it did not change when consent for cookies is required.

Other than court judgments, the Article 29 Working Party opinion is the most authoritative opinion you will get on the interpretation of the e-Privacy Directive, which is the "real legislation" that you need to look at.

edit: Nobody claims that the e-Privacy Regulation is in effect, by the way -- of course it isn't, it hasn't even been passed. The cookie consent clause of the e-Privacy Directive is however in effect, and has been since 2009.
And you are a hero.
Google fonts doesn't have an API key.
> Settings → Language and Appearance → Advanced → untick Allow pages to choose their own fonts, instead of your selections above.

Done! Thanks for the reminder!
Or yourself
This information is crazy out of date?
Socrates on the blessing of being refuted
You would not have made that request in the first place unless that company did the request in the background for you.
The ruling explicitly says the right owner does not need to take precautions, because such an obligation would restrict the right holder in the exercise of their rights worthy of protection.
I suppose even if they had the funding the company itself is at it's value extraction phase.
Kind of, the good thing is, if the user used chrome(good chance), the billing just goes to a different department.
There is, e.g. § 812(1) BGB in German law:

> Wer durch die Leistung eines anderen oder in sonstiger Weise auf dessen Kosten etwas ohne rechtlichen Grund erlangt, ist ihm zur Herausgabe verpflichtet. Diese Verpflichtung besteht auch dann, wenn der rechtliche Grund später wegfällt oder der mit einer Leistung nach dem Inhalt des Rechtsgeschäfts bezweckte Erfolg nicht eintritt.

> A person who obtains something as a result of the performance of another person or otherwise at his expense without legal grounds for doing so is under a duty to make restitution to him. This duty also exists if the legal grounds later lapse or if the result intended to be achieved by those efforts in accordance with the contents of the legal transaction does not occur.
Google cannot escape the US government agencies (CLOUD act) etc.

It doesn't matter what the promise.

They could sell their software stack to an independent European partner over whom they don't have any control and who doesn't transmit data back to the US.
There is not "API key" needed to request a font from Google Font...
Then get Squarespace to stop pinging random third parties on page load. The website owner is paying for Squarespace, why is it loading Google CDN (and Google trackers?)
On its face, this appears to be death of the third-party CDN. The largest issue is this means companies will no longer be able to use third-party hosting services like Squarespace which rely on shared (technically third-party) CDNs.

A secondary, but similar, issue, is that now all embeds are opt-in: streams, videos, everything must first be clicked on to even load the thumbnail.

A third, and less-important, issue is that advertising providers are basically over: the website, on load, can't query the third-party ad service to figure out what ad to display. Which I'm fine with, abstractly, but it's also a very large revenue issue.
Soon Spotify will start to consider doing away with music altogether. It’s kind of funny that mainstream artists withdrawing their music actually improves Spotify’s financial situation (even though ofc what they need are lost of users who pay the monthly fee, but who mostly listen to podcasts - with a reduced music offering, it’s harder for Spotify to justify the current monthly subscription prices).
Technically, yes, but legislation is not code, and many other things have to be considered.

I cannot sign that I will sell my firstborn, but _technically_ I've read, understood, and accepted a contract
It always puzzles me how people making six figures a year for translating real-life requirements to technical ones suddenly throw a tantrum when said requirements involve law.
Also, chemistry sets come with a lot of graphic warnings.
> Biologically speaking, individuals that don't produce gametes, don't have a sex.

So you agree that it's not a binary trait: masculine, feminine and none is ternary. If people can come in those three flavours then we're beyond a binary.

That said I'm fine with that definition but it does imply that we're excluding people who can't have children due to reproductive system defects as not having a sex despite having a gender, which further puts the two concepts apart from each other.

Thank you for the thorough answer!
This can all be abstracted away, so end user doesn't even know he is interacting with blockchain tech.
The Adverse Selection of Crypto Regulation
Like you say, it is a job, though, and not gig work. I don't know what it's like now or everywhere but I did delivery work in the pre-app era. I got an hourly wage, cash tips and one staff meal per shift. That's what often happens when you get employed by humans who have to look you in the face. They treat you like a human.

It would never have occurred to me to take bites out of customers food but if you see just how little these app drivers earn and consider how little loyalty they feel to any one restaurant or platform, it's kind of understandable.
I read your comment and one of the linked pages was a summary (and I'm not listening to the 2 hour discussion) and the other behind a paywall. Are you claiming that a large excess of calories due to consumption of which other nutrients than fructose does not cause adipose tissue increase? Because that would be pretty astounding. Can you copy a verbatim quote from the scientific american article (or timestamp from the video) that supports this?
History is a problematic subject because it creates false dichotomys all over the place. When actually sacrifice for your country, your community, or your friends is admirable. It is also an utterly pointless waste. A waste that can be justified at some levels of abstraction but not at others. These points are not inconsistent. But people want to take one simple truth away from the complexity. History has obvious lessons in hindsight and can be turned into trite propaganda in the moment.