Hacker News new | past | comments | ask | show | jobs | submit login
The opt-out illusion: how we have acquiesced to losing our privacy (the-tls.co.uk)
392 points by jrepinc on March 9, 2020 | hide | past | favorite | 142 comments



I have been mulling cancelling my Facebook account for a while now. Today as I was browsing I saw several Scientology ads. I know Facebook doesn't have an agenda per se - you have the money, they have the adspace - but I was still struck by the brazenness of advertising something whose ethical dubiousness has been so thoroughly publicized.

Facebook will never change unless they are forced to. We have signed away perhaps one of the most important experiments ever in digital social networking to a behemoth that chips away at your humanity the longer you stay on it. People who think I'm being dramatic almost always underestimate exactly how much data Facebook, Google, et al. collect on you and the extent to which they use it to manipulate you emotionally or with your wallet. Every facet of Facebook is designed to coerce you into an addiction that results in you spending more and more time on the site while you consume ever more advertising content.

These enormous tech companies are kind of like the fast food of the Internet. They have erased individuality and served us an experience that is mass produced and shrink wrapped for our convenience. It's delicious and addictive, but we keep being told lies about the quality and safety of what we are consuming. We've become so reliant on it we've forgotten how to cook, if you'll extend the metaphor.

I increasingly hate a lot of the what the Internet is. I always feel watched and directed to the point where I have trouble trusting what I'm reading, like watching manufactured drama in a reality TV show. I'm planning on setting up my own website as an expressive space where I can go to be creative and try to consume thoughtful content and (hopefully) make thoughtful content for people in return. I'm hoping there's a world of expressiveness and fun to be had in interacting with people on the Internet on one's own terms.

Hope it turns out well!


> I have been mulling cancelling my Facebook account for a while now

Going cold turkey is never easy. If you're having trouble withdrawing, consider what I did over the past few years:

1. Turn off notifications for the Facebook app on your phone; then

2. Turn off notifications for the Facebook Messenger, Instagram, et cetera apps on your phone; next

3. Delete the Facebook app from your phone; then

4. Delete the Facebook Messenger, Instagram, et cetera apps from your phone; and finally

5. Log out of Facebook on your desktop.

It took me 2 years to go through from step 1 to step 5. It has made me happier and more productive. I still have a Facebook account. But the friction of grabbing my laptop and logging in forces me to consider "is this what I want to do? Or am I thoughtlessly reaching for the crack pipe?" (It's been over a year since I've cared to log into Facebook. Feels more like trudging through spam in an old e-mail inbox, now, than anything compelling.)


I was amazed how well it worked to get off Facebook by removing the button from the phone's home screen. First few days it was weird - when between things I grabbed my phone, unlocked, moved my finger to the palace where I expected Facebook and then was confused "what was it I wanted to do? - oh nothing, damn" and after a week or two I got used to it being away and was mostly off Facebook. Now I use it only when specifically searching for information which (unfortunately) is exclusive there (for some businesses it's simpler to do a FB post than their own thing ...) and when I scroll over my feed quickly think "oh what a waste of time" and am happy for getting past my "addiction".

Won't say it works for everybody, but certainly worth to try. My life got better.


That's a good approach. On top of being easier than going cold turkey, it also lets you slowly migrate all your social needs elsewhere. For instance, having done step 2, you can start telling your friends that you barely ever check Messenger these days - they're more likely to accommodate that than you going all "Facebook is evil and I cleansed myself of it".


When I deleted my account, I went through one additional step:

6. Delete your account. Create a new account under a pseudonym. Add a single friend, who can add you to group chats.

At this point, you should have a near-empty news feed; Facebook is only for staying in touch with the group (eg, not missing out on social events) until people have gotten used to texting you to invite you to things.

You won't be able to comment on anything public because if your account gets reported as a fake, you'll be locked out of the account unless you provide ID (which of course you can't do, since it's not your real name).


>Create a new account under a pseudonym.

I've not been on Facebook for years, and I tried doing this recently. It was relentless in pestering me for a phone number for "security reasons". It would not accept any of the online SMS services I found. I ended up abandoning it.


Sounds like a job for a burner phone.


Why would someone buy a whole new phone just to use a shitty advertising network they explicitly did not want to use?


Who said anything about a phone? Prepaid SIM cards are free, top one up with £5 and you're good to go.


> Sounds like a job for a burner phone.

I mean it's right there...


Right, but the "phone" part of a burner phone is essentially superfluous, it's the sim card that serves the purpose here. Of course you need to put it into something but it doesn't matter what. You can swap your main sim card with a "burner" sim, get the code to authenticate, then swap back. It takes 2 minutes.


You can get a free SIM, but even if you have to pay 5$ or whatever... many people still need to use facebook messenger to get in touch with some people, for instance.


and then what, run the spyware on my main phone, so it can have all of my data and my friends data?


m.facebook.com for the social network

mbasic.facebook.com for chat

No apps needed


Even if you take it literally as a physical phone instead of SIM, the SMS verification works equally well with 20 EUR Nokia dumbphone as with the latest iPhone.


Because due to network effects they effectively have to use it.


Yes, but there's no way I'm investing neither money nor time in jumping through silly Facebook hoops. What's to stop them from suddenly requiring dental x-rays, or some other nonsense, for "security reasons"?


Nope, that won't work. Facebook will ask you for a phone number and for a selfie. It will then match both against their databases, and ask you for an ID if there is none.

You can get a "burner" phone number and even a physical phone (that's what I do for whatsapp), but you can't have a burner face to make selfies.

...so now I don't have a FB account at all, and it is very inconvenient.


You can try using a picture from https://www.thispersondoesnotexist.com/.

If a lot of people do that, then maybe Facebook moves to requiring pictures with a code written on them, like Reddit does.


>Nope, that won't work. Facebook will ask you for a phone number and for a selfie. It will then match both against their databases, and ask you for an ID if there is none.

Damn, I never would have made a Facebook account if that was what the sign up process was when I signed up. That's just fucking insane. How the hell did it get to that point?


Since when? I've never been asked for a selfie.

If you must, it doesn't seem like a big problem still. Go to thispersondoesnotexist.com, hit F5 a few times to find a nice portrait, then Google "driver license template" and apply basic Photoshop skills.


It probably means you're using your real name and/or your real phone number. Or have an established account with photos of you.

I did not check if images from thispersondoesnotexist.com would work to pass the selfie check, but my guess is that they wouldn't. A professional portrait of someone from a Western country who has never been seen on any photos Facebook owns, not even in the background? That's a red flag. Also, my guess is that Facebook knows about that page and takes precautions.

Anyway, if Facebook tries that hard to make sure I'm not there, why should I join?


I'm using a psuedonym but my real phone number. I don't see what they would compare it to though. It might as well just be a burner phone.

I do not believe they check it; if you provide an ID scan, it's good enough.

Because you have no choice but to join.


Bookmark the groups you want to periodically check.

Stay away from the newsfeed on the home page, no distraction and no mindless scrolling.


I'd do something else before #3:

3. Unfollow everyone in order to disable the news feed.

I did this to reduce usage and force me to actually visit friends' profiles, but it did its job too well. In the end I noticed that I wasn't really interested in anything I couldn't know by chatting in some other app or in person. The only thing hooking me up was the news feed itself.


If unfollowing everyone is too much effort (or too much potential drama from people assuming unfollow = no longer friends), then there is another way. Someone mentioned the Newsfeed Eradicator plugin the other day -- it replaces the FB News Feed with a thought-provoking quote...!

https://addons.mozilla.org/en-GB/firefox/addon/news-feed-era...


I've found that to be a really useful extension as well, stops you getting distracted by all the news feed posts when you just logged in to check an event or something.


I would also add that, on the rare occasion when you do need/want to log in, use https://mbasic.facebook.com/


I know very well why I am still using FB: there is a single group that I am working with that uses it as its main channel of communication. And I don't want to invest the effort to make them switch right now.

What I did was an alternate plan that can work for many:

- Don't install the Facebook app, but the FB Messenger lite app. No access to the walls.

- Mute channels you don't want to be pinged about (most of them except two in my case)

- Logging out of FB on the desktop is a good idea but I really type faster on a keyboard so often when pinged I'll just open up FF (with all the fencing in place) for a quick answer.


Out of curiosity, have you tried messenger.com to answer the pings?


>Going cold turkey is never easy. If you're having trouble withdrawing, consider what I did over the past few years

The main issue, at least for me, is that everything social that is happening is arranged through Facebook. My kids school events, social events in the town i live in, hell even the good old paper adds from our local grocery store has been replaced with posts on Facebook. Everything is announced and coordinated through Facebook.

So going "cold turkey" is not really an option unless i want to be left out of everything that is going on. That doesn't mean i don't care. I don't have the app installed, and usually don't browse it on my phone. Instead i limit it to "checking todays news" on Firefox (with facebook container) on my PC at home.


It is always an option.

It starts with replying "I don't have Facebook and won't sign up to this thing" to everyone that explain that they are only on Facebook; even before you close your account. Just signalling that Facebook-only is not ok.

You're not so much being left out of everything as much as they are leaving people (you're far from alone) out of their events.

And that's part of the clever thing Facebook does to make you believe you have no option but theirs.

It took me 3 years from starting to reduce to finally deleting my account. I only wish I did it way sooner.


Being left out of social events is a significant reduction in my quality of life. I've got enough reasons to stay home all day without deliberately excluding myself from social events.

Organizers of these events have enough to manage without going to the effort of finding everyone who is not on facebook and contacting them. And let's stay away from "if they are real friends they will make the extra effort", as it is usually a good way to find out how few 'real friends' you have.


So, in some way, they let Facebook win by bullying people into their closed garden.

Edit: and I mean _they_, not you.


I haven't used my facebook account in over a year. Even if I logged in to follow something like this I'd never see it because I'd never remember to log in and look.


> So going "cold turkey" is not really an option

Ending an abusive relationship is always an option.


I'm not really worried about being on Facebook but only about wasting too much time checking the stream (or worse: integrating with it in even more stupid ways which could result from excessive browsing). I good surprisingly good results from adding the tiny bit of friction of removing the app from the Android launcher screens, relegating it to App drawer. (and careful push configuration of course)


I still have a facebook account for the sole purpose of messaging those people I only contact once a year. Honestly never really used facebook for anything more than a IM platform. I never felt comfortable posting anything since all family members would be seeing it. And I never liked consuming content on it because I found it all to be low quality shitposts and blog spam.


Before I deleted Facebook (and severely cut down on my Google usage) I imported the birthday list to my own calendars (on Nextcloud). I added all the contacts in my calendar as well (on Nextcloud). This gets synced with DAVx5 when I'm home on WLAN.

Now I keep contact with these people via WhatsApp (due to network effect it has in The Netherlands) and plain old telephone/e-mail as these are included in their contact info.

Don't quit Facebook right away. First, request your data and import this. Manually backup the data I mentioned above (and consider to remove people). Gradually delete all your posts (there's an addon for it, not sure which one I used). Then make a post you're going to leave Facebook. No drama, no reason required. You're just informing people about it. And then you do it: you go through the process of removing your account, and you never log in again. Ie. remove the password from your password manager.

I've also installed containers for GAFAM, and use a myriad of browser addons to protect my privacy.


I had a similar bad habit of mindlessly visiting sites I consider time sinks from the browser. I learned I could edit my hosts file to override the DNS lookup from a comment on HN. Just be sure to cover variants of the url you wish to block, otherwise if you're anything like me you'll start prepending 'www.' to bypass the block.


Why not delete? This way they legally keep your data and it would be naive to assume they don't find a way to keep following you...


It's worth it. It is occasionally annoying to not be able to easily interact with some people or find a person or two to talk to, but other than that there isn't much downside. I got back time each day that I was wasting on FB, I found that I didn't care much about the content that I was missing, my privacy has improved, and I got away from the outrage culture that permeates most social networks. After I quit FB I was living with roommates who were constantly agro about random stuff that was ultimately irrelevant which they learned about through IG and Twitter. It was definitely making them less happy.


To be fair, the “ethical dubiousness” of Scientology isn’t much different from the chatholic church, Islam or other organized religions.

They’ve just been the target of specific bad press, which they’re naturally trying to rectify.

And I mean sure we can argue without end if preventing medical care to mentally disabled people is worse or less severe than harboring and protecting child molesters, or if it’s more unrealistic that we all have Alien soul fragments from a Vulcano explosion or that a superhuman beings once defied the laws of biology, chemistry and physics all in ways that are less impressive than what David Copperfield can pull off without assistance. But at the end of the day the all fit in the catagory of “Tax avoiding institutions based on a belief in obvious falsehoods harboring and protecting criminal behavior in their organizations”

At time it honestly seems that the Mobs biggest mistake was not openly proclaiming a belief in man-bear-pig to justify their operations.


Having deleted Facebook 3 years ago made my social life miserable. Any time I tried to join a real-life group activity I was always the one person being out of the loop and I had to pester a single person I chose, constantly, to get any updates. So after a few groups and gigs like that I finally chose to rejoin Facebook. One thing I tried to keep me out of addiction this time, was to unsubscribe from everything, so my wall is always either empty or only showing updates from the current group I'm participating in. And thus I have no real desire to scroll FB, cause nothing really happens there for me - automatically. What really bugged was that none of my closest friends really wanted to chat with me for those few years - they seemed to have a real mental barrier against switching to the regular Messages app.


I deleted mine a couple years ago and I haven’t regretted it or missed it at all, though I agonized over the decision for a long time because of fomo.


Even worse, even if you don't have facebook you are still tracked by facebook from apps you use that track your activity for them.

The only way to interact with what they collect is to have a facebook account!

https://www.facebook.com/off_facebook_activity


I maintain a hosts-formatted blacklist for all Facebook owned services, like Facebook and Instagram. Combined with a PiHole, its a fairly effective way to reduce tracking exposure to Facebook. https://www.github.developerdan.com/hosts/


Step 1: Admit these people are not your friends and you don't actually have as many friends as you would like and that their lives are meaningless to know about

Step 2: Download your backup copy of horribly over-compressed images and videos that Facebook ruins on your behalf

Step 3: Deactivate and cancel your Facebook

Step 4: Enjoy life


> "...I saw several Scientology ads. I know Facebook doesn't have an agenda per se [...] but I was still struck by the brazenness of advertising something whose ethical dubiousness has been so thoroughly publicized."

scientology is certainly ethically dubious. it's a tax shelter and MLM to financially benefit it's leaders disguised as a religion, which attacks its detractors publicly. that some people find meaning and belonging there is incidental to it's purpose. so no love for scientology.

but why would you expect facebook to ban advertising from them? and why would that be the last straw that made you quit facebook?

facebook (particularly zuckerberg) itself has poor ethics, and that's as good a reason to quit facebook as one should need.


A few weeks ago I just logged out. I have since then never felt the need to log back in. Occasionally on autopilot I start typing the domain but when I realise I need to open my password manager and click a link in an email to log in, I lose interest.


I quit FB as a new year's resolution. The main problem is that it's evil and I don't want to be encouraging more friends into the addiction. Something like TikTok has its evil, but it seems more trapped by their choices. Facebook has had their clear ethical choices and they prioritized growth every time.

I feel we're approaching a sunset of companies that blatantly violate privacy. It's similar to how cigarettes and sugar were king once and suddenly society strikes back at them hard.

As time goes by, bad stuff will gain traction faster, like a global virus, but we'll also develop antibodies for them faster.


What an interesting timing. Just yesterday I got fed up with Facebook after I realized I was somehow angry about politics at 2am on the comments of a post that was 100% filled with bots. I can honestly take everything they (Facebook, Twitter, etc) do to a certain point to claw interactions out of me, but making me angry and my day worse is the breaking point.


Someone should write and maintain a library that can scrape Facebook accounts. This library could be used by software that can help people stay away from FB without the downside of missing out on things like events or groups.


This would be impossible to maintain. Facebook regularly changes the layout of pages, and mangles the DOM to defeat adblocking, and also likely take anti scraping measures.


Yes, but are you familiar with the tool Youtube-DL, which is open-source, runs on Linux, and allows users to download content from youtube? This tool is very useful, and is constantly being updated after changes on YouTube that break the tool. If the tool doesn't work, you simply invoke it with the "-U" flag and it updates itself. So far, this tool has not failed me.

I think a similar approach could be taken by this scraping library, though I admit it would be a lot of work to maintain it.


There are other approaches like accessibility APIs and text selection based on positioning and visibility.


i'd love for everyone to have a website and a connection system so you 'friend' other websites.


> I was still struck by the brazenness of advertising something whose ethical dubiousness has been so thoroughly publicized.

I actually don't entirely see the problem here. I mean taking money from Scientologists to fund services I use (I don't use facebook, but hypothetically if I did ...) is a good thing in my view.

I guess you are worried that people will convert to Scientology, but really if the only thing that is keeping people from being Scientologists is not knowing about it then I think the problem is in no way related to Scientology.

The real issue then is that large swathes of society have been advocating for completely abandoning any sense of objective values while they loudly shout value judgements at the top of their lungs like petulant children with no sense of propriety having temper tantrums.

Blocking Scientology ads won't change that. You can't fix a problem not caused by the visibility of Scientology adds by changing the visibility of Scientology ads.


Ads don't just inform people that Scientology exists, that's widely known. They try to manipulate them into joining. The "real" problem here is that people can be manipulated like that. But until we find a way to remove that vulnerability we must stop Scientology from exploiting it.


But is Scientology's view not that we are essentially manipulated into our current value and belief systems?

Why does your goal of trying to limit their "manipulation" have more validity than their goal of limiting yours?


"Why does your goal of trying to limit their "manipulation" have more validity than their goal of limiting yours?"

Because Scientology's views aren't held in good faith and claims about society should be assumed to be pretexts used to justify the quoted excuse for predatory behavior. Scientology has a history of fraud, kidnapping, extortion, and other extreme exploitation and don't deserve any benefit of the doubt. Their views do have less validity since they're known bad actors.


I personally think they are kooks, and their views are less valid to me, but I also realize that it's just my subjective opinion. They also have the subjective opinion that their views are valid to them, and our views have less validity. No way to say who's "right", so they should be allowed to advertise until we agree on laws (still subjective) to possibly invalidate their views.


Of course Scientology should be allowed to advertise until there is a law that forbids that. That's how laws work.


They are not mere kooks. They are an organized criminal enterprise. They've engaged in arson, kidnapping, extortion, attempted assassinations, money laundering, and other criminal acts. They are actively malicious and that's as realistic a line for dividing who is and isn't right there is.


>But the pop-up won’t let us pass without clicking “agree”. Opting out is an illusion.

I mean this is a weird way to phrase it but you definitely cannot participate in modern society without hindering yourself in various meaningful ways if you do not "opt-in" to giving up your privacy. "Opt-in" requirements have consequently struck me as "privacy theatre" which mostly irritates.

I don't see any solution for the current privacy situation other than regulation and enough liability attached to data breaches to make hoarding customer data a good way to go bankrupt.


The regulation already says that this kind of coercion is illegal and subject to admonishment and eventual fining.

Sites that do not offer the equal choice between "continue with privacy intrusion" and "continue without privacy intrusion" are definitely out of compliance since 2018. Report them to ankle-biters like http://noyb.eu if you feel like making the world a little bit better.


Unfortunately it isn't very clear about it at all, and it actually only talks about it in advice about the legislation - not in the main body of the legislation. It also isn't clear if you can do things like "Click here to continue for free with tracking, or pay to access without tracking".


No, it's very clear. From the guidelines:

> Consent will not be free in cases where there is any element of compulsion, pressure or inability to exercise free will


It should also be a law that customers can not be opted-in by default, or through consent buried in a 100 page TOS agreement. There should be a requirement that the question is presented to the user in a clear way.


It is. The consent has to be explicit and informed.


But even companies like Apple (which claims to champion privacy) blatantly don’t seem to care https://blog.gingerlime.com/2020/does-apple-care-about-your-...


https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

Article 7 is the key bit, specifically entry 2: "...the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language."

(edited to remove superfluous GDPR reference)


GDPR unfortunately doesn't apply in North America. I know there may be other clauses in American, or Canadian law (I am Canadian), but this is in no way enforced. I can think of multiple services, where the first thing I have to do after creating an account, is go and toggle opt-out in all the places the setting has been buried.


I think it is widely believed but you don't actually loose that much with opting out. It requires a lot of effort though and it probably shouldn't.


If it requires a lot of effort, how can you say you don't actually lose much?


Social media tries to insinuate that you loose out on current stuff, topics to talk about, the activities of your friends, it can prey on your insecurity and jealousness in general. But that is mostly not true in my experience.

I meant it requires effort to resist these temptations and of course the more technical effort of defending against privacy invasions of large networks.


>> But the pop-up won’t let us pass without clicking “agree”. Opting out is an illusion.

You can generally just delete the popup from the DOM.


The content blocker extension uBlock Origin already comes with various annoyance filter lists maintained by end-user volunteers that do that automatically.

https://github.com/gorhill/uBlock#installation


Idea for an addon: delete popups, delete overlays, fix scrolling ( which is often broken after deleting popups ). Is it possible to earn money with addons?


> Is it possible to earn money with addons?

Sure, if you lack your spine and moral compass. The business model is as follows:

1) Make a free add-on and have it gain popularity.

Then, either:

2a) Inject malicious code into it that delivers malware/advertisements, making you money.

or:

2b) Sell your add-on to a third party that will do 2a). If your add-on is popular enough, potential buyers will come to you themselves.

Other than that, no, I don't think you can monetize an add-on directly.


True but fails to address the illegality, coercion, and vast multitude of users.


Breaches are just part of the problem. You can have no breaches and no privacy at the same time


Ironically this page sent a payload to a domain call permuative.com, without my permission.

This payload contains user events e.g. how long I read the article, a user identity guid (presumably a fingerprint of my browser), my isp name


HN is ycombinator, which are the people who helped make reddit happen. Is it really that big of a surprise they're doing stuff like this?


I am not defending HN/YC here, but the user's noted irony is referring to TFN, located at the-tls.co.uk, not talking about HN/YC.


Thanks that is what I meant. Sorry to confuse people.

By the way HN by the way seems to be the nicest site in terms of privacy, simplicity and page load times.


The tone of the article dips a bit too far into sensationalism and fear mongering for my taste. While the concerns expressed are absolutely legitimate, I grow weary of people spreading fear for the sake of fear (or worse, clicks) without any mention of what we can do to protect ourselves. Spreading fear and then calling people to action based on that fear is not really leading us down a good path.

I've noticed the effects of this reaching normal people. It can be debilitating when they're spoon-fed fear without a corresponding dose of digital safety education. They're afraid of these companies or the internet in general but don't really know why. That kind of environment makes it all too easy for someone with an agenda to step in and take control of the narrative, manipulating people for their own purposes. "You're afraid. Let me tell you why you're afraid and how I'm going to fix it. Vote for me."


The problem here is that surveillance firms _are_ out of control and there isn’t much you can do about it.

Even if you leave their platform they won’t leave you alone. How exactly can you stop Facebook compiling shadow profiles?

How do you stop Google Analytics without installing more of their software?

We used to be able to say no to software, now it’s all “Not Right Now”.


> there isn’t much you can do about it

1. Support advocacy groups that defend your rights (i.e. make a donation, become a member, participate in activities) 2. Send letters, e-mails to or call your representatives expressing your concerns. 3. Attend protests when those are organized. 4. Use your right to vote. Make an informed decision. 5. Educate those around you about viable options, such as they are. 6. Support technological efforts such as they are: document, give feedback, report bugs, inform yourself about alternatives, use them. 7. Inform others, those that are also concerned, about steps 1 to 6.

Your civil and human rights are never ever self-evident or to be taken for granted. They are not unmovable natural laws. Their existence hinges entirely on the willingness of society at large as well as individual responsibility to defend the basic principles and uphold the culture that underpin them.

So, when it comes to defending your rights, safeguarding them boils down to one brutally simple question: how hard are you willing to pull your weight?


Well, the tone has a lot to do with the business model of the websites that publish them which is to get people to click on their article and see the ads. There's more than a bit of irony in here; but it's on the front page of HN so they did that right (from the point of view of reaching their target audience).

Things that stand out to me is the use of the word "we" in the title creating an artificial us and them of of people like "us" who are clued in enough to be reading this bit of wisdom on their website.

In reality, this is a piece cliche laden drivel that brings us nothing new, novel, or remotely insightful and rehashes the same things that people have been writing for years. It's true clickbait; no redeaming features. It's light reading for designed to trigger emotions in a particular crowd with reasonable and irrational concerns about having their freedoms infringed by "surveillance capitalism".

My view is very simple: we are enjoying a brief period of time where the technical capabilities still have enough wiggle room that we can sometimes be un-monitored. Enjoy it while it lasts. But given that we all carry phones that have their microphones turned on just so it can respond to "Alexa", "Siri", or "Hey Google" for the last few years means that it's quite hard to be out of reach from several active microphones; no matter how many things you opt out off (unless that includes having a social life). Much of our public space is monitored by surveillance cameras. Our phones also report our location (via cell towers) every second they are connected to a network. Etc. We emit so many signals continuously that are tracking us that the only thing limiting surveillance is our ability to connect the dots. Which is an ability we now know for sure that the NSA has been investing in as fast as nearly unlimited government funding allows (courtesy of Snowden, Assange, and other people risking everything to report on this).

Right now it's easy to track large groups of people but tracking the entire population is still a bit controversial though that's probably been happening covertly in some places and a bit more openly in China. And of course there's no good reason to assume they are limiting their tracking to China. They have a long track record of industrial espionage, just saying.


Oh, the irony of this article slamming me in the face with a sleazy "We need your consent" dialog with intentionally confusing options and sub-dialogs...

My "consent" is being forced out of me so that roughly ~100 (at a first glance) "partners" can invade my privacy and learn about my browsing habits.

By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.


I took a look the domains being used for the consent and saw an interesting JavaScript name: 'messagingWithoutDetection.js'. Looking into it more, I found the documentation [1], there is this disgusting paragraph:

> The Dialogue Javascript communicates with the Sourcepoint messaging server on a subdomain of the site. The benefit of doing that is to allow messaging cookies to be “first party” and thus, circumventing Safari’s web browser Intelligent Tracking Prevention (ITP). This creates a discrete messaging channel between the publisher’s messaging subdomain and the Dialogue messaging server. Once you have created the subdomain, you should create a DNS CNAME record to direct traffic to the Sourcepoint messaging endpoint message<account id>.sp-prod.net where the account id refers to you account ID in the Sourcepoint user interface

Luckily uBlock Origin now supports blocking on CNAME records and PiHole is rolling support out for it as well. I maintain a blocklist that I use with the PiHole: https://www.github.developerdan.com/hosts/

[1] https://documentation.sourcepoint.com/web-implementation/sou...


dnscrypt-proxy is already supporting CNAME blocking and full domain based blocking (*.adhost.com), something that is still missing in Pi-Hole.


Pi-Hole does support regex and wildcard based blocking


regex is _extremely_ resource inefficient and should not be used with large sets of rules. Dnsmasqs domain redirecting feature (address=/adhost.com/#) is not supported by pihole.

Is there any other way to wildcard block full domains in Pi-Hole?

Look for example in your list: d41.co, admaster.com.cn, mixmarket.biz chances are extremely slim that all (current) hostnames of those type of domains are currently being blocked.


It is resource inefficient, which is why PiHole supports it, but does not allow you to subscribe to list containing regex, as that would quickly make it unusable. I'm not sure how Dnsmasqs would be accomplishing this feature without some sort of pattern matching logic - which would have the same inefficiencies. Basically O(N) where N is the number of domains/patterns that should be blocked. There could certainly be a cache to keep track of matched/unmatched queries, but I would imagine with the modern web the average case would still be very close to O(N). Just speculation.


Dnsmasq 'address=' function is just a substr() call, which is as fast as 'normal' hostname blocking (host == "adhost.com"). No regex magic is required there.

You are not able to block something like 'ads.%.adhost.com', but only (prepending wildcard) '%.ads.adhost.com', which in practice will cover almost all scenarios where random subdomains are used by adhosts.


Pihole uses a forked version of dnsmasq they named 'Pi-hole FTL engine'. I don't believe there are any features of dnsmasq that cannot be used with the PiHole - but how to configure it to work alongside of PiHole might not be as obvious.


It is possible to use this feature 'in' Pi-Hole, see: https://github.com/notracking/hosts-blocklists/wiki/Install-...


If the regex rules do not require backreferences, it should be possible to implement them in such a way that they run in constant time with respect to the number of rules.


<pedantry> Regex with backreferences isn't really regex at all, in that it no longer corresponds to the regular languages. </pedantry>


> regex is _extremely_ resource inefficient

No, it's not. Is there something wrong with their implementation?


On the positive side, the Quantcast cookie popups now offer a choice between "Accept All" and "Reject All".

Previously they offered "Accept All" or "Click here to enter our deliberately confusing rat's warren of options".

I wonder if the French DPA's announcement that they will start cracking down on dark patterns like this was the impetus for the change.


Well, it's true that this popup was slightly less sleazy and misleading, but it wasn't that great, either.

Just for reference (since it is obviously needed), if someone really DOES want to slam readers in the face with a popup as the first thing they see, here is some non-confusing wording:

"Do you agree to be tracked using cookies by 134 advertising companies (link to full list)?"

Two large buttons: "Yes" "No".

Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no.


>Yes or No. Not "Configure", not "adjust my preferences", not "Leave" which doesn't actually leave, not "Settings" which takes you to a list of all the "partners" with individual switches, no dark patterns. Yes or no.

Even worse when the switches are made in such way that you have no idea whether you are opting-in or out.


Then you click it to test and you've opted in for just a second and it's already too late to go back...


What about "accept cookies or pay" like some newspapers do? Is that okay?


No, one must provide the same service with or without tracking.



>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.

I think the logic underlying this sentiment is never consistently applied. Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? Do we call out the other negative results of a person's job (tax money going to a war machine is pretty common for those in the US)? Do we call out the person cooking burgers at the local fast food joint for the effects our fast food consumption has on our health as a whole? Do we call out doctors who are members of groups that limit the supply of doctors, thus increasing prices and resulting in people getting less healthcare coverage?

What about the people who are against unions, which may be a factor in why some choose not to risk their job opposing implementing data gathering on their own website?


" Do we call out the people working on Tor or encryption because of how it is used by some to cause harm? "

I am pretty sure, they thought alotabout the pros and cons of their work and decided a long time ago that the positive outweight the negative a lot. But what is the social positive in intentional programming dark pattern UI? I don't see any.


A few possibilities:

Disagreeing it is a dark pattern to begin with. For example, see how many people love opt out consent for organ donation and overlook the consent implications it has in that case. Another example is requiring email address at signup, is that actually needed and is it a dark pattern to not allow a person to sign up until they provide one, even though a more industrial user could give you a fake/temporary email address?

Seeing the data as not actually worth protecting and not having an issue with opt out or the like.

Thinking those who do care will already be using adblockers and the like.

Thinking it would be done regardless if they do it, so why burn what social/political capital they have achieving no difference when they can save it for something that might have an actual impact.


Does that really convince yourself? It stays the same to me. Intentionally misleading.


>By the way, if you are a programmer and you implement those sleazy dialogs, think about your life choices.

I'm sure this stern talking to really made them evaluate their life choices. We need more people on HN to take a stand like this, downvotes be damned. We all have to be the change we want to see.


>We need more people on HN to take a stand like this, downvotes be damned.

As the funding dries up the community will close ranks even more so. We are already getting to the point on this forum where anything not outwardly positive (not even "negative") said about certain subjects is instantly donwvoted. Being as how downvoting is something that requires 500 karma, these are not bots or spam accounts; they are veteran members, preventing balanced discourse from occurring ("slow down").


Working with an analytics team, a sentiment I get is:

"We have a contract with [analytics company]. They are not allowed to look at the data."

When you suggest that a contract might not be as good as physical limitations hosting it yourself give you, they follow up with something like:

"Well, then AWS/Azure/etc. could look at it!"

What I found drives the increase of tracking on the web in big corporations, is simply the number of teams, who want data. Data is used to play internal politics. And it is easier to get a new vendor in, than to get data from a hostile team.


Isn't that what the back button is for? We read too much shit anyway. My preferred method for handling theses popups now is the back button.


Sorry, that has be acquiesced

Times Literary Supplement:

[...] Reviews were normally anonymous until 1974 [...]


I either get rid of cookie/tracking popups from the DOM (using e.g. Nuke Anything on Firefox, or developer tools) and use a bookmarklet to reenable scrolling or I open private browsing and accept all the junk they want to give. My browsing is basically unaffected beyond the 5 seconds it takes to do the above, and I am successfully opting out of privacy invasion. Unfortunately this isn't simple enough for the average person to do so they'll continue to be the bait for these companies.

The irony of the text that says "we care about your privacy" while simultaneously hiding the "deny all" button is profound.


Is that... a loading screen for a text-based news website? Christ.


Funny how a text based website doesn't work without JS.


Ironically, an excellent demonstration of the "opt-out illusion" as applied to JS.

It's not one of those sites where the content can be easily found in the source of the page either. The latter appears to be, at a cursory inspection, consist of tracking scripts, furthering the irony of this demonstration.

At least a site that calls itself "the TLS" is served via HTTPS...


It's amazing how many sites won't even load nor give you a warning when you just opt out of JS (e.g. by using an addon like NoScript). Even very big ones, like twitch.


I don't see how you could remove JS from twitch without gutting a huge chunk of the functionality.


Do it like they did in the good old days when JS was new and couldn't be relied upon to exist.

Don't rely upon it to exist.

Serve up well marked content, CSS that might format it nicely, and JavaScript that allows some types of per-validation to happen client side but only as a means of making a page nicer. The server side should STILL perform all data validation, normalization, and verification (assume someone will craft their own form submission).


No, Twitch specifically. It's an interactive chat and live video streaming application that happens to be built out of web tech. If you don't have AJAX, you could maybe-kinda-sorta kludge it together out of forms and video elements, but it'd degrade hard, and need to be built completely different from the normally-interactive version.


I was thinking of Twitter for some reason.

Twitch could be done with a native app... the phone versions SHOULD be done with such if they aren't.


How is installing a native application a viable alternative to javascript? Presumably, if you're blocking the latter is because you don't want to run untrusted code on your device.


Twitch does have an IRC gateway, so it's possible to use your own application for chat.

As another poster commented, the video aspect can be fulfilled with a number of different methods, and I don't see any technical reason a standard couldn't be followed to allow for arbitrary clients to handle that interaction as well.


We had chat long before the era of SPAs -- no JS was required with things like long-polling, although that's one of the applications where I think a bit of JS will definitely be useful and welcome.

As for video streaming, that's not hard at all, especially now that there's a <video> tag.


On the flip side a lot of sites, in particular news sites, work better with JS disabled. They load faster, the entire content is visible, and oddly enough the majority of paywalls seem to be implemented client side and it neatly bypasses them.


Twitch I can see. Very complicated interface and chat setup. But I was surprised to see a warning on stackoverflow.


On the bright side, SO warns you that it might degrade, but it does actually work fine (heck, I can browse SO in dillo without issue), which is far better than most sites, and actually pretty decent.


It's a dark pattern though. It doesn't provide any useful information, but is an ugly red hover panel in addition to other hover panels.


...aaand now we're distracted by a completely irrelevant annoyance of technology instead of discussing the content of the article and some very serious issues...


It's not completely irrelevant, disabling javascript used to be a way to somewhat protect your privacy.


Starting an article about facebook privacy concerns with comparisons to the Stasi and typhoid just turns me off straight away. This kind of thing is so tired, not to mention insulting to actual victims of the Stasi.


Like the YouTube video says, this sort of thing is really as simple as tea:

https://www.youtube.com/watch?v=pZwvrxVavnQ


Just wish these articles would address the amount of content and utility we get in exchange for our data (instead of our money) and speak to the trade-off. Until we find a better way to financially support all of the things we consume on the web, I'm not sure I see anything changing.


> we supposedly have control, but “no cookies at all, ever” is not an option

I browse the web with cookies off for sites by default. It's an option in almost every browser.


[flagged]


I much prefer living in a place that errs on the side of too much caution when it comes to privacy. You say "easily manipulated", I say that they have social memory of the horrors of the Stasi. After the fall of the Berlin wall, the Stasi archives were disclosed. The awareness of the amount of information hoarded on so many citizens with the help of friends, family & neighbors was deeply traumatic. Some people even decided they didn't want to know, so that they wouldn't find something about someone close that was hard to forgive.

In my view, this cultural and social memory makes the Germans less insane on the topic of privacy, not more. We can see very well how in most of the modern world how insidious the process is. We make small concessions, little by little, and soon we live under total surveillance. It doesn't seem like that long ago that using your real identity on the internet was considered unwise. Now people are voluntarily giving deeply personal information to shady operations such as FB.

I hope the Germans are not convinced by people like you, and that they remain healthily paranoid about privacy. It's one of the things I appreciate the most about living here. I feel the laws actually protect me against the bad guys on this topic.


One problem with StreetView is that it has pictures of people and cars with a timestamp. It could be used to prove someone's whereabouts at a given time.

Yes, I know the car plates and faces are blurred, but when I go around my village with streetview, I can still often tell who that person is even though the face is blurred.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: