The Essential Tool for Hong Kong Protesters? An Umbrella - <AUTHOR> https://www.bloomberg.com/graphics/2019-hong-kong-protesters-umbrellas/ <comment><USER2> > Chinese e-commerce sites like Taobao and AliExpress no longer sell them to > customers in Hong Kong

Impressive coordination of public & private bureaucracies

<comment><USER3> A cursory glance indicates I am perfectly able to buy an umbrella from Ali express in Hong Kong - didn't go all the way through the purchase however.

I do somewhat question the reliability of the source in this instance.

<comment><USER4> Some more information on the subject:

[https://www.bloomberg.com/news/articles/2019-08-18/china- e-c...](https://www.bloomberg.com/news/articles/2019-08-18/china-e-commerce- sites-block-sales-of-protest-gear-to-hong-kong)

[https://bitterwinter.org/bans-on-shipment-of-goods- imposed-t...](https://bitterwinter.org/bans-on-shipment-of-goods-imposed-to- curb-protests/)

</comment></comment></comment><comment><USER5> Following the Be water thinking, ppl start to have no specific items or clothes to represent themselves now. So the essential tool would be the determination to live in this city with courage, hope, dignity and helping each other in a crisis created by no one but the government.

This government has lost all its credibility within a hundred day, which is impressive in a way I guess? I don't think HK will be totally recovered when CCP continues to intervene. The damage has be made, and the scar will always be there.

<comment><USER6> >...and the scar will always be there.

Will it? I think over time, people will forget.

When the British colonized Hong Kong, they were especially brutal to the protestors. During the protests in the late 1960s, the British controlled police killed over 50 protesters.

Yet today, the protesters are wishing for the British to intervene.

<comment><USER7> It's worth noting that after the 1960s protests, Britain made laissez-faire policy official and economic growth skyrocketed, creating lasting social changes that were beneficial for boosting living standards.

To win the hearts and minds of Hong Kongers, Beijing needs to either give people the power to dismantle an economy strangled by property tycoons (e.g. electing a chief executive with actual power) or do it itself, and neither is permissible. China will never let a territory it controls have unfettered universal suffrage, and the mainland itself is turning into the conglomerate/tycoon economy that now restricts Hong Kong. Which is a great deal of irony for a party that started riots over working conditions in the 1960s.

</comment></comment></comment><comment><USER8> Remember 2014, Kyiv, Maidan. We actively used a push-to-talk mobile app Zello. Cheap used mobile phone, burner sim-card without id, and you're on the way. Also many people used whatsapp, Facebook was very liberal to UA protesters.

"Winter on fire", Netflix, highly recommend.

Of course times changing, and heard now Zello is affiliated with Russian government.

<comment><USER9> Yeah, but there are new options. I've seen Telegram and Briar both listed as options that the Hong Kong protesters have used. When a company sells out to the state, it's time to switch to another one. Briar, in particular, was made specifically for dissidents and protesters.

<comment><USER10> People should seriously consider Keybase with it's non-required use of a phone number and strong encryption in every chat. I'm not in any way affiliated with them but I just don't like Telegram suggested with it's unaudited homebrewn crypto and Russian roots.

<comment><USER9> The unaudited thing is definitely raising questions but, come on, let's not act like people being from a certain country should automatically discard them. Signal is made by Americans and so is Briar, I'd hope neither are thought of as NSA stooges or something. Telegram creators got essentially run out of the country and the app itself was banned in Russia, that's a pretty good sign that there's no cooperation with the government.

Not suggesting we put blind trust into it, just saying it's unfair to judge an app by where its makers come from.

<comment><USER10> It's definitely not a single thing (e.g. origin) I find untrustworthy, it's the things combined (homemade crypto + Russian origin).

</comment></comment></comment></comment></comment><comment><USER11> What's the most effective way to support the Hong Kong protesters/people?

<comment><USER12> [https://www.change.org/p/international-court-of-justice- requ...](https://www.change.org/p/international-court-of-justice-request- international-court-of-justice-to-investigate-excessive-force-of-hong-kong- police)

[https://www.change.org/p/the-grand-chancery-of-the-legion- of...](https://www.change.org/p/the-grand-chancery-of-the-legion-of-honor- revoke-hong-kong-chief-executive-carrie-lam-s-legion-of-honor- distinction-19c4dc0e-f0ca-433a-9496-08e6705dbdeb)

[https://www.change.org/p/international-police-association- re...](https://www.change.org/p/international-police-association-reporting- misconduct-of-hong-kong-police-force-during-the-protest-in-hong- kong?recruiter=false&utm_source=share_petition&utm_medium=twitter&utm_campaign=psf_combo_share_message&utm_term=share_petition&recruited_by_id=4e0f5610-c6bc-11e9-8ef7-4d89fc670684&share_bandit_exp=message-16946662-en- US&share_bandit_var=v3)

[https://petition.parliament.uk/petitions/244402](https://petition.parliament.uk/petitions/244402)

[https://www.pori.hk/donation](https://www.pori.hk/donation)

<comment><USER11> This is great, thank you.

</comment></comment></comment><comment><USER13> Makes me think of this: [https://unbreakableumbrella.com/product/unbreakable- walking-...](https://unbreakableumbrella.com/product/unbreakable-walking- stick-umbrella-model-u-115/)

I own one and it's a great umbrella that I have only ever used for conventional purposes. :)

Now I just need to learn this Kunfgu set ...

[https://m.youtube.com/watch?v=uWtZmKrENDE](https://m.youtube.com/watch?v=uWtZmKrENDE)

</comment><comment><USER14> Are there any interesting startups specifically focused on protest technology?

<comment><USER15> Not protest-tech per se, but Alphabet's Jigsaw [0] has an impressive collection of opensource tools they themselves built.

And the usual suspects (a few are not startups): the guardianproject [1], lantern-vpn [2], the tor-project [3], freedom-box [4], matrix [5], GNU Jami [6], letsencrypt, grapheneos [7], signal [8], freedom.press [9] ivpn / pia / mulluvad et al.

[0] [https://jigsaw.google.com](https://jigsaw.google.com)

[1] [https://guardianproject.info](https://guardianproject.info)

[2] [https://getlantern.org](https://getlantern.org)

[3] [https://torproject.org](https://torproject.org)

[4] [https://freedomboxfoundation.org](https://freedomboxfoundation.org)

[5] [https://matrix.org](https://matrix.org)

[6] [https://jami.net](https://jami.net)

[7] [https://grapheneos.org](https://grapheneos.org)

[8] [https://signal.org](https://signal.org)

[9] [https://freedom.press](https://freedom.press)

</comment></comment><comment><USER16> Part of the inspiration for us building Umbrella: a free, open source app with advice on how activists can deal with protests, arrests, surveillance and communication. It's available in multiple languages, including Chinese. (More information at [https://www.secfirst.org](https://www.secfirst.org))

iOS: [https://itunes.apple.com/us/app/umbrella- security/id14537153...](https://itunes.apple.com/us/app/umbrella- security/id1453715310)

Android: [https://play.google.com/store/apps/details?id=org.secfirst.u...](https://play.google.com/store/apps/details?id=org.secfirst.umbrella)

<comment><USER17> See Zeynep Tufekci's Twitter thread on Rory Byrne, who you Do Not Want To Be.

[https://twitter.com/zeynep/status/1169323269297717248](https://twitter.com/zeynep/status/1169323269297717248)

</comment></comment><comment><USER18> To be remembered as the Umbrella Revolution.

</comment><comment><USER19> Terrible GDPR page - not clear if you're answering "yes" or "no"

Why do websites insist on the most terrible custom designs? What's wrong with "input type=checkbox"?

<comment><USER20> The "not clear if you're answering "yes" or "no"" part is the entire point of the deliberately poor design. See [https://www.darkpatterns.org/](https://www.darkpatterns.org/) for more examples

<comment><USER21> Tbh they'd probably get more people to answer "yes" if they made the "yes" very clear. Most people just blindly press whatever looks like yes. The dark pattern would have the opposite effect in this case imo.

</comment></comment></comment><comment><USER22> Anyone have a quick summary for the paywalled folks?

<comment><USER23> [https://web.archive.org/web/20190920083048/https://www.bloom...](https://web.archive.org/web/20190920083048/https://www.bloomberg.com/graphics/2019-hong- kong-protesters-umbrellas/)

</comment></comment><comment><USER24> Next year on AliExpress, weaponized umbrella's

<comment><USER25> Yeah, they will shock the user if opened in a protest area.

</comment></comment><comment><USER26> > "If you compare the umbrella with the weapon the others are using to attack > us, the umbrella is nothing for that. Actually, umbrellas are really easily > broken and we only use it to protect ourselves."

Are umbrellas in China just really light and flimsy? I've had a lot of umbrellas heavy and sturdy enough to do some serious damage if I were so inclined.

<comment><USER19> Compared to British umbrellas.

[https://www.youtube.com/watch?v=tukQDg22o9M](https://www.youtube.com/watch?v=tukQDg22o9M)

<comment><USER24> That video screen on the inside of the umbrella could be made with some portable beamer projecting it, would be cool to have in a storm so you could see oncoming traffic haha

<comment><USER25> You know, there are transparent umbrellas out there...

</comment></comment></comment></comment><comment><USER27> All those people who protest ... They protest against what ? In France, we have the "Gilets Jaunes", who also protest, there is also the young people who protest against climate change. They protest, and they go nowhere ...

<comment><USER28> Honestly, right now, the "unfairness of life" is the closest to a coherent message I can interpret from their "movement".

It was really a tense and passionate debate 2 months ago, but now many of us just roll our eyes at the latest news, like when they shave people who clean the streets, burn an MTR station, cry in a foreign country they need to be "freed", and the like...

<comment><USER29> Seems a little bit unfair not to mention the five demands in this context: [https://www.theguardian.com/world/2019/aug/13/what-do-the- ho...](https://www.theguardian.com/world/2019/aug/13/what-do-the-hong-kong- protesters-want)

If you really want to "interpret" the message of their movement, that would seem like a good place to start.</comment></comment></comment>


Thread Safe Connection Pool in Ruby - <AUTHOR> https://medium.com/@jshah111/thread-safe-connection-pool-in-ruby-6da83a5aa3ba <comment><AUTHOR> Wrote my first blog post, if anyone ends up stumbling across this would love to hear if you enjoyed it or if you have any suggestions.</comment>


How to create and use custom keyboard layouts on OS X - <AUTHOR> http://apple.stackexchange.com/a/45402/4408

<comment><AUTHOR> I documented everything I know about custom keyboard layouts on OS X, which have been supported since Jaguar (10.2): how to create them, how to install them on a per-user basis or system-wide, how to make a custom layout the system default (even for the login screen!), and how to assign a custom icon to your self-made keyboard layout.</comment>


Using All Your CPUs – Elixir on Raspberry Pi 2 - <AUTHOR> https://onfido.com/blog/using-cpus-elixir-on-raspberry-pi2/

<comment><USER2> Elixir is new to me. The Raspberry Pi 2 less so - and I'm so impressed with it. Everything I used to get frustrated about with the Pi 1 has gone.

It's very satisfying to run such a solid system so cheaply. I haven't even overclocked it. To think its efficiency can be further improved is great news.

Ideas for my own Pi projects basically boil down to having persistent sessions and server functions. Nothing mind-blowing, but certainly, as I say, satisfying. It's the silence and low-power consumption of the thing that really clinches it for me.

Also had my first Minecraft programming session with my nephew recently. He was ready to leave half-way through to go watch TV when he saw a lake of diamond blocks appear. Then he sat back down. I've left it in his room (an old Pi 1) and I'm watching to see where he takes it.

</comment><comment><USER3> Cache: [http://webcache.googleusercontent.com/search?q=cache:xA743Uv...](http://webcache.googleusercontent.com/search?q=cache:xA743UvoXP4J:https://onfido.com/blog/using- cpus-elixir-on-raspberry-pi2/+&cd=1&hl=en&ct=clnk&gl=uk)</comment>


Analysis: Facebook ignites Bubble 2.0 chatter - <AUTHOR> http://www.reuters.com/article/idUSTRE7055A520110106 <comment><USER2> "Unlike in the late 1990s, shares of today's Web sensations are privately held and not available to the general public. But a growing secondary market has developed in which investors meeting certain criteria, such as minimum net worth, can buy and sell shares."

They left out a couple words. They meant "a growing thinly-traded, easily- manipulated secondary market ..."</comment>


Social Credit – Obedience to the state gamified - <AUTHOR> This hasn't appeared very high, probably due to the fact that HN hates links to vids with no context, so here it is, China is implementing a social credit system that will be mandatory in 2020, that gives you a social score based on what the state deems are "good" and "bad" actions. What you share on social media, your friends, your purchases etc. This is scarily Orwellian.  https://www.youtube.com/watch?v=lHcTKWiZ8sI <comment><USER2> This sounds a lot like Whuffie from Down and Out in the Magic Kingdom by Corey Doctorow. If you haven't read the book yet, you can download it for free from his site, [http://craphound.com/down/download/](http://craphound.com/down/download/)

</comment><comment><USER3> I'm not familiar with the implementation details but I can say that this idea is fantastic and much needed.

This is one of those things that will forever change humanity for the better. I'm working on something similar, although with a much broader scope.

</comment><comment><USER4> Human behaviour, eminently hackable. Just like any complex system.

Also I totally see someone hacking this system to their own benefit, if they're not doing it already. I also see markets arising in hiring people to help you hack your score. And that's with officials looking actively for rule breakers. That said I bet most people will fall in line.

</comment><comment><USER5> This takes nudging to a whole new level (pun intended)</comment>


MySQL Challenge Contest - <AUTHOR> http://debiprasad.net/coding-and-logic/mysql-challenge-contest <comment><USER2> Seems like this guy just needs his problem solved.

Prize: getting a job offer for a very unspecific web company based in India. Yay?

But, in the spirit of being constructive, he should probably forgo solving this in SQL, have PHP generate the date, then use the date as part of the SQL WHERE clause.

<comment><AUTHOR> I am sorry my dear friend; what you are thinking is wrong. I have already solved this problem a week ago. I am not that stupid that I will post a question on a forum on the day I join it and ask for immediate solution. If you want me to prove my potential, please send this solution to my email id and also send another problem. I will solve your problem.

BTW, the job is offered to the people who need a job (in India). You don't worry, you must have a good job.</comment></comment>


Only 9% of visitors give GDPR consent to be tracked - <AUTHOR> https://markosaric.com/gdpr-consent/ <comment><USER3> What really drives me crazy are prompts that start by showing two options: "Consent to all cookies", or "customize". If you click "customize", it opens a new modal window with a loading indicator that just doesn't seem to finish. I literally waited 60 seconds and then tried again by refreshing the page, ending up with another infinite loading indicator.

This means that users are de-factor forced to click "consent to all". I'm not even sure if that's legal.

Now, this was not some obscure small website, but the official Java documentation on docs.oracle.com! They use some third-party service for that - I just tried again, and though it worked this time, it still took 30+ seconds to submit my settings. I have a very hard time to believe this has technical reasons. Either this was made slow on purpose, or built by a bunch of morons.

/rant

<comment><USER4> DockerHub uses a company/product called "TrustArc: TRUSTe" and they have _exactly_ this method. The slowdown is intentional. People who come up with sort of tactics and those who implement them should go to jail. It's beyond infuriating. I've decided to not upload my images to dockerhub because of this.

Edit: jail time is not for anger obviously, but for intentionally swindling people. It'll be handled on a case by case bases obviously, but data is worth something, people who swindle you out of your data are like those who scam you in the street for your wallet, and as far as I know, there's jail time for that.

<comment><USER5> Causing you to get angry is all it takes to warrant justification for jail time in your eyes? I am thankful you aren't in charge of any lawmaking.

<comment><USER6> Jail time is probably the only suitable enough deterrent for adtech nightmares. Fines are just treated as a cost of doing business expense, and doesn't directly even hurt the terrible people making these decisions.

When someone commits a wrong, the punishment is in part based on the amount of harm. You might feel that adtech causes small harms, if you look at harm against an individual, but adtech folks harm _billions of people, every single day_.

If you're Mark Zuckerberg, Larry Page, or Sergey Brin, no fine is large enough to make you regret your life choices. The only way to punish billionaires who get rich off harming others is to take away their time/freedom, the one thing they can't just buy back. As long as corporate CEOs can't get jailed, crime absolutely pays in this country.

<comment><USER7> Most studies pretty clearly show that harsher punishments are not an effective deterrent.

<comment><USER8> That may be, but a threat of jail hanging over a director or CEO may make them take the correct course of action - effectively becoming the deterrent.

<comment><USER7> It won't. Again, this is well studied.

[https://www.psychologytoday.com/us/blog/crime-and- punishment...](https://www.psychologytoday.com/us/blog/crime-and- punishment/201804/why-punishment-doesnt-reduce-crime)

<comment><USER6> Your source doesn't actually apply well here. It talks about things like substance abuse and addiction being reasons that criminals don't act rationally to punishment as a deterrent. For white collar crime, there's a very different set of circumstances in play. Crime is often just a business decision based on risk and reward. Raise the risk and the reward becomes less worth going for.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The author's consent form is very simple and isn't using any shady UX tricks to get the user to consent. One action will opt you in, one action will opt you out.

I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies.

<comment><USER10> Why would anyone consent to be tracked if given a real choice? What are the benefits? The 9% look like an error.

<comment><USER11> I know people who just automatically click yes. I don't think they ever even cared to read what is says. They just have the habit to click yes to every prompt to "make sure it works"

<comment><USER12> Decades of bad UI design have trained people to click away these kinds of things without reading them. Even people like you or I who should otherwise know better frequently do it.

</comment></comment></comment></comment><comment><USER13> I signed up for a new account on a fitness website yesterday. They track health and food and diet you enter. anyway, during the sign up they had a opt out, I chose to do just that, however the opt out process then took over the screen with a modal window, which gave a loading bar and took about thirty seconds to complete... But guess what... There was a big CANCEL button. I couldn't perform any action during sign up and opt out.

This was one of the worst dark patterns I've seen. PS. The app was MyFitnessPal which i registered on recommendation but that felt so shady.

<comment><USER14> I use "LoseIt" since MFP went overboard with having features and not a single UI/UX review.

<comment><USER15> It really is impressive how many taps it takes me to do anything in MFP. Why are there so many damn menus, I just want to input calories and see a counter. It is so overly complex I just switched back to a legal pad and doing the math by hand, it is faster.

</comment></comment></comment><comment><USER16> Fundamentally, the browser is the user's agent. Storing cookies, running tracking scripts, etc. should be controlled by the browser. Some browsers may take a strict "block everything" approach, some may be relaxed, and some may harass the user with prompts. Users are free to choose the appropriate browser.

Depending on websites to limit tracking by on their own is very difficult, since it is inherently against many websites' business model. They will keep trying to bypass the rules.

<comment><USER17> This is nice in theory, except the amount of fragmentation in 2020 is huge.

The average user simply cannot switch browsers.

The likelihood of encountering a website that breaks even switching from Chrome to _Firefox_ is too much for any normal user to want to bother for just these purposes. They'll switch back the minute they find a website that doesn't work in their new browser, if they even get that far.

So unless you're suggesting "Chrome should make it more obvious how to clear cookies automatically and/or not accept them at all" (which seems like quite a UX challenge itself), saying "just tell everyone to switch browsers" just isn't going to work I don't think.

EDIT: to finish the thought -- yes I agree, browsers should provide users with choice, and switching browsers should be available to anyone who is unhappy with the way their browser treats their data, but that can't be the _only_ way -- otherwise, the average user will get left behind.

<comment><USER18> > This is nice in theory, except the amount of fragmentation in 2020 is huge.

The GDPR popups is not nice in theory or practice.

<comment><USER17> I think everyone agrees with this, and is now at the "what are we going to do about it" phase.

</comment></comment></comment></comment><comment><USER19> Surprised no one has mentioned the systems that, if opted out of, redirect users to a 'privacy policy' page and won't allow access to content without opting in.

Or the sites that don't bother with compliance and just show a message to the effect of 'this site operates under a jurisdiction that may have different privacy laws to your country' and leaves it at that.

<comment><USER20> Those very much falls in the shady part.

The first option, redirect, is not GDPR-compliant, because then the "consent" cannot be considered freely given, and thus is not valid

The second option is really borderline, and could work out for a US-only news website, for example (arguing it doesn't cater to European residents), but would be non-compliant for a business which knowingly serve European residents.

<comment><USER21> > The first option, redirect, is not GDPR-compliant, because then the > "consent" cannot be considered freely given, and thus is not valid.

I don't quite understand the reasoning on that one. In Europe, and pretty much everywhere else, there are a bazillion interactions every day in the form of one party offering to provide some good or service only if the other party agrees to something.

For example, the grocery store will only give me food if I agree to let them charge my credit card.

Why is consent considered freely given when I give someone money for a good or service because if I do not do so they will not provide the good or service, but not freely given when I click "agree" on a privacy policy disclosure because if I do not do so they will not provide the good or service?

<comment><USER22> Under GDPR consent can't be "freely given" when it's bundled as a condition of service unless the consent they're asking for is necessary in order to perform the service. To use your example:

The grocery store doesn't need to ask if you consent to paying for an apple because if you didn't consent there wouldn't be any transaction to perform.

Now if you paid for your apple and the cashier said okay hand over your phone so I can poke around a bit because there's some fine print that says by nature of walking through the front doors you agree to allow the store to look through your phone. Did you consent to that? Of course not.

Consent wasn't "freely given" because the store is requiring you disclose information (the contents of your phone) as a condition of service (you can't even walk through the door without "consenting" let alone make a purchase) and that information isn't necessary in order for the store to complete the transaction.

GDPR says they have to ask you first (usually in the form of a giant irritating banner as soon as you walk in the door) and that if you say no they have to let you buy your apple anyway.

<comment><USER23> > GDPR says they have to ask you first (usually in the form of a giant > irritating banner as soon as you walk in the door) and that if you say no > they have to let you buy your apple anyway.

Can you link to source for this (the part that says you can't deny access)?

<comment><USER22> Perhaps I've oversimplified a bit. GDPR has a paragraph that's often called the "coupling prohibition" - Article 7(4):

> When assessing whether consent is freely given, utmost account shall be > taken of whether, _inter alia_ , the performance of a contract, including > the provision of a service, is conditional on consent to the processing of > personal data that is not necessary for the performance of that contract.

It somehow says a whole lot and not much at the same time. Since every member state and everyone who has to comply needs to interpret what GDPR means there are various "recitals" that offer official guidance. One of those is Recital 42 - Burden of Proof and Requirements for Consent[1] which says:

> Consent should not be regarded as freely given if the data subject has no > genuine or free choice or is unable to refuse or withdraw consent without > detriment.

So a person must be able to refuse consent "without detriment" and the company is meant to provide an equivalent, but necessarily identical, service to those who do not consent.

What that means exactly is, of course, the subject of much litigation. For example is it a "detriment" to require a subscription fee to those who do not consent to information sharing? So far one ruling (Austria) has said no, provided the fee is reasonable while another (UK) has said yes, the equivalent service must also be free.

As far as how the coupling prohibition should or will apply to a company like facebook - where harvesting user data is the _entire_ business model - I think that is yet to be clearly determined. As are most of the nuances and technicalities in GDPR.

Edit: I should also note that consent is just _one_ avenue to legally allow a company to process user data under GDPR. It's not the _only_ avenue.

[1][https://gdpr-info.eu/recitals/no-42/](https://gdpr- info.eu/recitals/no-42/)

<comment><USER23> This really shouldn't be left to interpretation, both Article 7(4) and Recital 42 define what is "freely given consent" and in no way limits the actions i can take as a site owner. It is clear that a "cookie wall" isn't considered a "freely given consent" so you can't process personal data based on that.

<comment><USER22> Correct you can't process personal data based on it. And the underlying implication is that _none_ of the consent you've obtained via a cookie wall is valid because you haven't given _any_ users the opportunity to "refuse without detriment" (because their options are to consent or see nothing). So the information you're processing on behalf of users who clicked "I agree" - <USER2> the users who _do_ in fact knowingly and willingly agree to the information processing - might be lacking a legal basis.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> I would say that it means 9% of visitors "click away" any banner they see without reading it.

And usually clicking "yes" will do away the banner in the most hassle free way.

I am surprised the number is so low.

I surely click "Yes" on any banner immediately without reading it.

My guess is that the number was so low because his banner (by its simplicity) looked unusual enough that many people read it.

With the typical spammy pseudo consent banner, the number would probably be much higher. Even without dark patterns. People are just trained to click yes.

<comment><USER25> I'd be interesting to perform another test, with "No" and "Yes" buttons swapped (and the banner text updated accordingly).

</comment></comment><comment><USER26> The article says mobile users are more likely to engage with the banner. Rightly so, cause it takes up precious screen real estate. What are some ways I can protect myself more when browsing the web through my phone?

<comment><USER27> Depends on the phone, but generally you can't protect yourself as well as on PC, because phones (sadly) are locked down devices running proprietary software. Best you can do is probably DNS-level blocking.

<comment><USER28> Firefox on Android with ublock works just fine.

<comment><USER29> Additionally, set Firefox to clear all data when selecting Quit from the menu. It's then easy enough to do a reset of any lingering bits every now and then.

</comment></comment></comment></comment><comment><USER30> I helped implement a consent tool in our SaaS product that has users from a lot of different regions, many of which are more technical/"developer persona", and the tool we use isn't shady (it depends on the region, but for example in Germany it is opt-in by default and the options are presented immediately rather than behind a modal).

During the initial stages we had worried that consent rates would be low, and while Germany was "low" at around 70-75%, we found that overall consent rates across all countries were 90%+ with exceptions for Germany, France, and a couple other European countries. This was consistent across both the application and our marketing website, and across 10s of 1000s of users.

So while I don't doubt that the author ran an experiment and got these results, I strongly disagree that you will get "only 9%". Specifically, these lines in the blog post:

> And if you give them an easy way to ignore your banner or to say no to be > tracked, most of them will simply do that.

> Most web users will simply select "no to tracking" once in their browser and > the browser will block all the trackers for them as they surf the web.

is not correct, at least from my experience, and it absolutely can't be used as a blanket statement like this. Of course my anecdote is, well, anecdotal, so take it with a grain of salt, but I don't think it's fair to say that users will simply reject it no matter what, and it really depends on both context and trust levels.

</comment><comment><USER31> I would say of 9% who gave consent the vast majority gave their consent through error, deceit or because they don't know what tracking really means and they wanted the service anyway.

Why not outright outlaw opt-out tracking and be done with this silly state of things?

There are legitimate uses of tracking and any company would still be able to provide it for the users, but you would have to have legally binding contract and opt in for the service.

<comment><USER32> Tracking already has to be opt-in according the GDPR. The issue is that the GDPR is not enforced so sites get away with non-compliant consent prompts.

<comment><USER33> The issue here simply seems like enforcement needs to be formalized to be as cost-effective and simple as possible. It starts with fines, ramps up to full investigations if bad faith is shown. Turns out when you write laws they also need to be enforced.

</comment></comment></comment><comment><USER34> Ironically, if you disable cookies in your browser you won't be able to see the images in this blog post.

<comment><USER35> Works for me on Firefox mobile with cookies blocked in the settings.

<comment><USER36> Works for me in Safari with cookies blocked too.

</comment></comment></comment><comment><USER37> I'm one of those strange people who will happily opt in to your Measurement cookies and opt out of the other stuff.

</comment><comment><USER38> Unless they do browser fingerprinting, the number will be overinflated by all the people like me who clear their cookies regularly, if not on every browser session, and are therefore re-asked consent on every single visit.

<comment><USER39> I'd imagine the people who do that to be a very small percentage.

<comment><USER40> I know many people who only browse in incognito mode.

<comment><USER41> I do, too, but fingerprinting still works for these people. In fact, using Incognito Mode is part of the fingerprint.

</comment></comment></comment></comment><comment><USER42> I tried your website Metomic and I really like the preview example! The preview, overlay, etc. is very well done.

</comment><comment><USER43> I hate ads as much as everybody else, and this reads to me like "given the choice only 9% of people would pay for their meal", should we forbid charging for food then? Probably not.

As sad as the current ads-powered internet is becoming I haven't seen any promising viable alternative, and sure non-tracking-based ads is not the same thing as having no ads, but it significantly moves the needle in that same direction in terms on revenue.

<comment><USER44> A meal paid for by money is a transaction where both parties understand what's being exchanged. Not paying for it criminal.

A viable alternative: show non tracking ads and see if it keeps the lights on, otherwise shut down?

<comment><USER43> > A viable alternative: show non tracking ads and see if it keeps the lights > on, otherwise shut down?

I'm not sure that'd be viable in general, like what would the economic impact globally if all websites that barely can manage to keep the lights on today because of effective ads just disappeared? Maybe the impact could be even positive, like by disallowing politically very-targeted ads, among all other kinds of targeted ads, maybe we can prevent idiots from being elected, but if I had to guess I'd say I wouldn't like to see those websites disappear.

Like imagine if YouTube disappeared because it can't make enough money to host all that staggering amount of content.

<comment><USER45> I wouldn't miss it. If they can find a viable non-tracking business model, I'd imagine most would. People used to pay for newspapers so there's pretty good precedent.

<comment><USER43> I have friends who a few years ago switched away from WhatsApp because it was charging 1 buck per year, and for that amount of money they gave you instant global unlimited text messaging, and those same people would have happily paid 10x that for a one-time meal.

I think you are grossly overestimating how much the average person is willing to pay for a digital service.

And I don't think newspapers are a good precedent giving how nobody buys newspapers anymore, compared to pre-internet levels at least.

</comment></comment></comment></comment></comment><comment><USER46> I wonder how much of this is the Lizardman constant. Do people even exist who actually volunteer to be tracked in exchange for nothing?

<comment><USER33> No, the entire transaction relies on coercion and/or deceit. If companies aren't going to listen, maybe it's easier to just ban any sort of unnecessary tracking across the board in order to cut down on enforcement costs, so it stops becoming a process and more of a draconian whip. We tried the carrot, it's time for the stick!

</comment></comment><comment><USER47> If I need to figure out what they're actually asking I'm out. This article makes it clear the majority of these consent boxes are not really compliant. On a side note if someone says they're in advertising I automatically hate them, this terrible I know, but they're usually pompous assholes and that's how I feel of that industry as a whole.

<comment><USER48> > if someone says they're in advertising I automatically hate them

You might enjoy Bill Hicks' take: [https://youtu.be/tHEOGrkhDp0](https://youtu.be/tHEOGrkhDp0)

</comment></comment><comment><USER49> The real question is: is the other 91% not being tracked?

<comment><USER41> Of course they're being tracked through any and all means. The whole adtech biz is one big shady shitshow.

You can probably count the ethical, law-abiding adtech firms on one hand.

<comment><USER29> I work on mobile apps, and I can promise there's no tracking on the apps I've been building if you opt out. The SDKs I've seen seem to do what they promise: no communication to backend when tracking is disabled.

Of course, I can only speak for the apps I've been building and SDKs I've used.

<comment><USER41> Do you have to explicitly opt out to stop tracking? If so, are you sure your apps are GDPR compliant?

<comment><USER29> They are not my apps per se, that part is for the company lawyers. I'm just taking care of the technical implementation. It's always some way of opting out/opting in during the onboarding.

</comment></comment></comment></comment></comment><comment><USER50> One click opt out should be mandatory. It's obviously unscrupulous to force you to go through several pages of text when I could've clicked one button. Most the time I just use a special blocker script or reader mode.

<comment><USER51> One click opt-in, zero click opt-out would be better.

</comment></comment><comment><USER52> General rule: most people pick the default option if there is one. For example, organ donation [1]: Germany and Austria are culturally very similar, but in Germany 12% of citizens are organ donors and in Austria 99%. The reason: Germany is opt-in, Austria is opt-out.

The interesting thing about GDPR is it officially bans "opt out" tracking cookies - you need someone's consent, although lots of sites interpret that in a way which ... let's just say if they applied the same standards of consent to their private lives they'd very quickly find themselves at the center of the next #MeToo campaign.

GDPR does allow you to make the "Yes" and "No" buttons the same size, so "equal choice" rather than "opt in" \- maybe that gets you better conversion rates?

[1] [http://www.behaviouraldesign.com/2015/08/11/why-99-of- austri...](http://www.behaviouraldesign.com/2015/08/11/why-99-of-austrians- donate-their-organs/)

</comment><comment><USER53> Now is a good time to remind users that to easily remove large cookie consent banners from view is to use uMaytrix to block CSS and refresh your browser.

Gorhill's browser extensions are a must when browsing the web these days.

</comment><comment><USER54> The position of the "no" is what made the most difference. My SO constantly click on "Ok" without thinking. The number of time she told me something didn't work, I asked her for the error, she said there was none, I then ask her to reproduce the problem and then she mechanically click on "Ok" of an error warning...

Is it really less disingenuous to place it to fit what HE wants versus what SOMEONE else wants? Both still abuse this mechanic... it's just the goal that we agree with.

</comment><comment><USER55> "On the lifestyle site, three permissions were being asked for. Web statistics (Google Analytics), personalized advertising (Doubleclick) and social media sharing (Pinterest).

Only 1 person out of the 774 who opted into being tracked drilled down and made a more granular choice. That visitor said no to stats but said yes to advertising and social media."

This seems weird to me. Why would you block google from getting the statistics, and then give it to them anyways via doubleclick?

</comment><comment><USER56> Relevant Study examining different types of banners and their impact on interaction: [https://dl.acm.org/doi/10.1145/3319535.3354212](https://dl.acm.org/doi/10.1145/3319535.3354212) (Preprint: [https://arxiv.org/pdf/1909.02638.pdf](https://arxiv.org/pdf/1909.02638.pdf))

</comment><comment><USER57> There are some sites (e.g. sites by Vox Media like TheVerge) that are outright illegal according to GDPR. There is only "Accept" and cookie information links that don't include any opt-out options. This is not just a dark pattern, but actually not having the settings on the site. Maybe I can email them not to track me. I wonder why aren't they fined a few hundred millions so that this kind of practice stops.

So my guess overall is that GDPR is not enforced at a larger scale and we are very far from enforcing the requirement to have "Accept"/"Decline" buttons equally usable.

</comment><comment><USER58> complain complain complain. these threads exist so that people can gripe, together. it's tiring.

instead let's talk about solutions.

safari's cookie and localStorage policy is great and automatic. beyond that, firefox containers are good, albeit effectively limited to isolating a few "top sites" like FB. and then of course, UBO, ABP, ghostery and the like.

it's actually not that hard to take a few small steps (or just do the default things on MacOS) to stop this from affecting you, without impacting your (ahem) user journeys.

first-order fixes are easy. now let's get ahead of these assholes and work on fixing fingerprinting.

TFA is ironically quite interesting in that it itself is SEO content, aka an ad. targeting those that care about not being targeted. i, for one, have bookmarked it.

</comment><comment><USER59> Wait. You tracked users after they opted out of tracking? How else did you get this data?

<comment><USER60> It's not personal data, so it's not under the scope of GDPR.

<comment><USER61> Yeah, no. This about the ePrivacy directive, if you don't have proper consent, you can't read/write tracers regardless of wether this is personnal data or not, except for tracers needed to establish the communication or demanded by the user (carts, login, etc).

EDIT: Thought about it, and if you only record the button click and does not identify the user, it works, and I am wrong! In general ePrivacy is very restrictive, only about access to terminal and not about personnal data ( and btw PII is not a GDPR thing, we say personnal data), but here it's ok! So yeah, no to me!

<comment><USER62> There's no tracer. Just a counter of how many said yes vs how many said no. There's no personally identifiable information there

<comment><USER63> the downside of this method is that it is impossible to discard duplicated negative answers.

<comment><USER64> Functional cookies (e.g has displayed banner to this user) are fine, you don't need consent

</comment></comment></comment></comment></comment></comment><comment><USER65> There is a setting in every web browser that controls which sites can store cookies on your computer. They are a core part of the standard web specification along with JavaScript, <img> tags, etc.

If you need a reminder every single freaking time you visit a website, that's your problem not the government's. If you don't want them, turn them off in your browser, install a blocking/auto-wipe extension, use lynx, whatever you want.

Now, I completely agree that websites should clearly state what they are doing with data the user uploads, if it is end-to-end encrypted, etc. The user otherwise has no way of knowing, and it is material to assessing the accuracy of the often-BS "military-grade security"-type marketing and other claims like that. But there is no need for users to "consent" to using a public API of their web browser.

</comment><comment><USER66> I'm wondering if i should implement the consent prompt myself or use some plugin? If i were to implement it myself is it enough to give two options Yes/No or does the law require me to give some additional customisation options?

Edit:typos

<comment><USER67> A "I do not consent to any of this" option that you actually respect is perfectly compliant. All of these granular options are to "provide full control to allow users to customise the partners that they trust" (read: extra complexity to put off users exercising their right to not be tracked, plus the marginal improvement to telemetry from the 1% of users that will allow google analytics but not ad tracking).

That said, you do need to inform users of who specifically they're sending the data to (and what they're going to do with it) in the consent option. So "Yes, track me with all your unspecified partners" doesn't quite cut it for the yes option.

</comment></comment><comment><USER68> I for one have been enjoying the verge and weather.com without any crap or slowness.. just ignoring the consent at the bottom :P

for websites that do not allow me to navigate or do not have a refuse button, I simply navigate away.

</comment><comment><USER69> If allowed. NO Body, and I mean No Body wants to be tracked in any kind of way.

<comment><USER70> Sure I do. I opt into any kind of "voluntary user experience research" tracking that a lot of desktop apps offer. As long as a website does the same thing (and doesn't try to gather PII to tie it to my identity), I'm also open for it.

</comment></comment><comment><USER71> When you're made aware of the tracking, why would anyone willingly choose it? It's a sad state of the internet when you're doing 90% of your Google searches in an incognito window.

</comment><comment><USER72> The worst offenders are the ones that give you instructions on how to disable your ad/tracking blockers. If I wanted them disabled I wouldn't have them in the first place.

</comment><comment><USER73> I'm actively working on a cookie banner blocker for iOS. Feedback, questions and suggestions appreciated!

[https://213tec.com](https://213tec.com)

</comment><comment><USER74> Current related thread: [https://news.ycombinator.com/item?id=23757272](https://news.ycombinator.com/item?id=23757272)

</comment><comment><USER51> This law (and the California one) should be amended so that it takes the same number of clicks to opt in as to opt out, and so that ignoring the banner is an opt out.

<comment><USER75> This is actually already the case with the GDPR, just very few websites practise it that way

</comment></comment><comment><USER76> I must say I'm really surprised. I'm a frontend developer and probably more keen to keep an eye on this stuff but there are lots of times where I just say yes because the popup is in-my-face and I just want to scroll to the content.

I guess where the article falls flat is where the author says a "proper GDPR content banner" was implemented. No online publication will do this. At least they will trick you with button colors, or some kind of double negative mind trick. Sometimes they will require you to tick all the checkboxes out.

GDPR was a good idea from the start but it's implementation is rather dull - they shifted responsibility to each country without penalization for relaxed enforcing, and now there are countries like mine (Portugal) where we have less than a hundred fines.

<comment><USER77> > but there are lots of times where I just say yes because the popup is in-my- > face and I just want to scroll to the content.

I am exactly the same. I use UBlock Origin and Privacy Badger so pretty much nothing gets through anyway but just to get rid of the banner, I click on OK.

However, that being said, I only do it if the other choice is "Manage Preferences" or something equally vague: If I am given a clear yes-or-no choice, I always choose "No".

<comment><USER78> > I use UBlock Origin and Privacy Badger so pretty much nothing gets through > anyway

And yet the cookie is still there and can be used to track you. They don't need to serve you adds to track you. A simple check for the presence of the cookie is enough to track.

</comment></comment></comment><comment><USER79> I usually reopen the site in private / incognito and "agree all". I don't trust these sites to abide by the modal agreement anyway.

</comment><comment><USER80> I've noticed on most sites even if you click deny you still get tracking cookies. Enforcement is nonexistent.

</comment><comment><USER81> This is one of the reasons server side tracking becomes more and more important. Even if users agree, tools like uBlock block client side scripts like Analytics. I build a library for Go [1] to solve this. Check it out!

[1] [https://marvinblum.de/blog/server-side-tracking-without- cook...](https://marvinblum.de/blog/server-side-tracking-without-cookies-in- go-OxdzmGZ1Bl)

</comment><comment><USER82> 20 years ago we had popups, popunders, etc... nowadays we have this crap. I don't care about GDPR, I don't care about cookies... I just want the content. That's why I use a browser extension called "I don't care about cookies" which removes these things from websites.

Accepting to GDPR / Cookies: This should be some kind of a web standard , built inside a browser so user can accept it once, ignore or whatever, but seeing this on every website drives (drived) me nuts.

</comment><comment><USER83> This research is interesting because it's highly relevant given Apple's upcoming changes to tracking consent in iOS 14. Unlike the DNT[0] header Apple are in a position to enforce apps actually respecting the users consent preference, either by technical means or by kicking offending apps off the App Store. The walled garden has many problems but this is one of the benefits. Given that almost all apps and websites have implemented GDPR's consent management in a supremely user hostile way[1] that is far from an equal binary choice I suspect we'll see much higher opt out rates in iOS 14. I've seen people argue that users will just continue to click accept at high rates as they do with current consent management solutions, but I think this is the wrong analysis. Users click accept precisely because the amount of effort required to opt out is unreasonable, when both options require equal effort the number of users clicking accept will plummet.

0: [https://en.wikipedia.org/wiki/Do_not_track_header](https://en.wikipedia.org/wiki/Do_not_track_header)

1: [https://twitter.com/K0nserv/status/1279361112627167234](https://twitter.com/K0nserv/status/1279361112627167234)

</comment><comment><USER84> Small changes in UI can have a significant effect on acceptance rate. I'm developing an open-source consent tool (Klaro - [https://klaro.kiprotect.com](https://klaro.kiprotect.com), Github: [https://github.com/kiprotect/klaro](https://github.com/kiprotect/klaro)) and where to put the different buttons, which colors to give to them and how easy to make opt-out is a large debate in our community. By default we favor a very user-friendly approach but we give our users (i.e. the website owners) different ways to ask for consent: A mandatory modal, a consent flow that accepts all cookies/apps (or customize) and a consent flow that accepts only a pre-selection of cookies/apps by default. In every flow there's a "Decline" button that visitors can use, so declining consent is just as easy as giving it. Most website publishers prefer the "Accept all" flow as they usually have a good reason for including a given app/tracker on their website, so only choosing a subset doesn't make much sense. A few sites also implement the mandatory flow, where the visitor won't be able to see the website content until he/she has chosen to either give or decline consent (and again, both options are equally simple to reach).

From a GDPR and ePrivacy perspective it's clear that opting out needs to be just as easy as opting in. Most websites violate this principle as opting in is in fact way easier, and often the UI is designed to be deliberately confusing to the user.

IMHO the consent problem one of the central unsolved issues in privacy though, as most people would not opt-in to tracking if they were given a real choice.

<comment><USER85> I now see a lot of websites now complying with the "opt-out as easy as opt-in" part by giving you checkboxes for configuring your cookies, with a faint "save choice" button that effectively opts out, and a really obvious, well contrasted "accept all" button. I think that ticks all checkboxes of the law, while still being an obvious dark pattern designed to trick the user into opting in.

</comment></comment><comment><USER86> Of course they don't; and even if they do, their browser might still block the cookies or discard them frequently.

Tracking effectively is getting harder both technically and legally; and that's a good thing long term but leads to chaotic and desperate behavior short term.

Long term, there are three ways to adapt:

\- drive users to apps instead of browsers. E.g. Google and Apple do this serve most of their news via apps where they control the ad experience, tracking, and user signin. There are no anonymous users there. GDPR still applies of course but practically speaking users only have the choice whether to use it or not. And none of the legales specific to browser based things like cookies apply. \- tap into other sources of revenue (subscription based, sponsored, donations, etc). Ad revenues have in any case been declining for lots of news sites so this is something they need to do in any case. \- switch to non personalized advertising that can still be lucrative if you have access to large amounts of users. E.g. most big brands still advertise this way and still lots of money floating around here. No cookies required.

</comment><comment><USER87> I enjoy the GDPR if only because it forces websites, even big ones like Google or Reddit, to show me that they value tracking me over everything else, even if it means ruining the user experience and using every dark pattern in the book.

Those websites that are usually all about streamlining and reducing friction to a maximum suddenly don't hesitate to trick me into a maze of slow-loading menus with weird conventions and a purposefully broken and confusing UI in an obvious attempt to trick me into opting in by mistake, even though the mere fact that I clicked the "more options" button means that I'm almost certainly looking to opt out.

These are tactics that I expect to encounter on shady websites, not some of the biggest websites in the world.

Advertising is a cancer that offers next to no added value in our hyper- connected society. Tricking people into seeing ads to trick them into buying stuff they don't need has become the foundation of the web economy. An utter travesty that puts our industry to shame.

</comment><comment><USER88> So we have an entire industry built upon a coercion? Gonna be a long fight.

</comment><comment><USER89> In my opinion, GDPR, if properly enforced, is going to be a disaster for many users.

Not everyone can pay for the content they consume. Some people are poor, under 18, live in a country where Visa/Mastercard isn't widely supported or can't pay for some other reason. Internet has made the lives of those people much, much better. They definitely prefer being tracked over having to pay for Facebook, Snapchat, Youtube and all the other sites they use. GDPR forces providers to provide their services to customers who opt out of tracking, and most of them will. That means switching to a payment-only model is going to become the only viable option, hurting a large part of the population.

The "just force them to pay" attitude that I often see here is extremely elitist. For someone making six figures, being tracked matters. For someone barely scraping by or without a credit card, that's an acceptable price to pay for all the goodies they get.

</comment><comment><USER90> Still, many web sites make it hard for their users to opt out tracking.

<comment><USER91> Or, they set their cookies first and then ask.

Or, they don't ask anything, and just set their cookies. (case in point: each and every status page by Atlassian Statuspage)

</comment></comment><comment><USER92> Before I found out about ublock origins filter lists I always wanted to opt- out of these GDPR cookie banners, modals etc but I got a lot of fatigue having to follow all the steps for each website.

I tried to make an open source extension to try and do it for me: [https://github.com/pyepye/GDPR-opt-out](https://github.com/pyepye/GDPR-opt- out)

Although I hit a snag where some GDPR banners / buttons didn't return when using `querySelector` in the extension but do when you use the inspector / console and do it manually.

Does anyone know why and how to work around it? It was always something I wanted to know why but didn't find the time to dig into (and wasn't important while using ublock origin)

</comment><comment><USER93> Regarding "engagement rate": is your banner filtered by ad blockers? In my session, there's no banner displayed. Could also be a hint on why mobile browsers are more likely to enable engagement, since they might lack CSS filtering techniques (used to hide the banner).

Other point: third party hosters. It's good to see you as the website creator put effort into GDPR compliant behaviour! Did you also include Netlify and your GDPR-provider into the evaluation? Do they use additional tracking technologies?

btw, your post was copied to [https://www.facebook.com/BloggersWorldToday/posts/6238368718...](https://www.facebook.com/BloggersWorldToday/posts/623836871864402) fyi

</comment><comment><USER94> yet another EU law with tons of loopholes.

</comment><comment><USER95> It's like ads are something nobody wants.

</comment><comment><USER96> > But writing is on the wall. If your business model requires user consent, > chances are that your business will suffer if and when GDPR gets enforced. > The implication of users not giving the required consent is that the ad-tech > industry might collapse.

Is the writing on the wall? GDPR came into enforcement over 2 years ago, and I'm not aware of improvements having been made with respect to clarity, because I'm not aware of any punitive measures actually having been taken. Would love to hear comments to the contrary.

</comment><comment><USER44> The GDPR is designed to be explicitly opt-in. Given compliant consent dialogs, of course very few opt in. Hopefully few enough that keeping the tracking infrastructure just for that minority isn't worth it.

The GDPR is and should be effectively a ban on tracking ads once sites actually comply (or, in many cases - leave the EU market or go under instead).

Whether the alternative is a good solution for paying for content or if it's the end of the majority of content online isn't really interesting as both outcomes are better than the status quo.

</comment><comment><USER97> We value your privacy. Accept.

</comment><comment><USER98> This looks like an ePrivacy (cookie) consent dialog, and not a GDPR dialog? [https://markosaric.com/wp-content/uploads/gdpr-banner-on- mob...](https://markosaric.com/wp-content/uploads/gdpr-banner-on-mobile.jpg) It's asking for consent to store cookies "to power statistics".

</comment><comment><USER99> GDPR consent should be mandated for, added, and enforced at the browser level. Not a different popup for every website, but some way for the website to include some JSON say and have its rules shown in a browser native UI.

And once set, the browser should pass the user decisions to the website, and enforce those that can be enforced locally (at the browser level).

</comment><comment><USER100> is this the end of tracking in the ads industry? Hopefully so.

</comment><comment><USER101> The amazing thing is that the vast majority of websites do not even need to display a warning or anything. The gdpr doesn't apply to vast portions of the internet. He it doesn't apply to the vast majority of the internet

</comment><comment><USER102> Why would one need GDPR consent for blog?

Privacy Policy should be enough for server logs (without PII). It would be nice to have standard Privacy Policy though (like we have MIT, BSD licenses).

<comment><USER103> I run a blog. It has Google Analytics. I could probably host my own analytics solution, but that's not easy. I'll get to it eventually, but content benefits my users more.

I need analytics because this blog pays the bills. I need to see what works and what doesn't. When building partnerships, I'm usually expected to share some numbers with them. It also lets me spot issues with the website.

<comment><USER102> Thank you, I understand convenience for author / inconvenience for reader.

I do not use Google Analytics but it looks like it is possible to disable Cookies [1], anonymize IPs, disable data sharing with google [2]. Effectively making it almost third party server logs analytics (no consent required). Would remaining functionality be sufficient for you?

[1] [https://law.stackexchange.com/questions/36105/can-usage- of-g...](https://law.stackexchange.com/questions/36105/can-usage-of-google- analytics-without-consent-be-considered-a-legitimate-inter)

[2] [https://law.stackexchange.com/questions/35528/is-it- really-p...](https://law.stackexchange.com/questions/35528/is-it-really- possible-to-use-google-analytics-without-consent-and-if-so-why-ex/35587#35587)

<comment><USER103> Yes, that would be far more than I need. That's the problem, actually. I could track a fraction of that and be really happy.

I tried Plausible today, but their event handling is completely insufficient for my needs. It's basically a key-based counter. The keys have to be created in advance, and can't be categorised. This means I couldn't track outbound clicks without first creating a new event for every known URL on my website. It just doesn't work.

It's a shame, because I loved every other aspect of Plausible.

</comment></comment></comment></comment><comment><USER104> Assuming for a moment that the test websites didn't give a specific reason to trust them more or less than any other website operator. This means that if your website has significantly _more_ than those 9% consent, you're either perceived as very trustworthy, _or_ your GDPR banner is confusing (or, less charitably, deceiving) users.

Would be interesting to see how the consent rates for big offenders like techcrunch, newspapers etc are. IIRC there were specific studies about which brands are _trusted_ by consumers, and Comcast et al. didn't fare all that well in those.

<comment><USER105> I tried Tech Crunch without adblocker and I would have to click out 16 "partners" after clicking "read more" two times. There is like hundreds of "IAB Partners" of which an unspecified amount need separate opt-out on their websites. It is not clear if "select all" opts out or in on the "IAB Partners".

So I guess _exactly zero_ visitors opt out there in the intended way. So 100% "opt-in".

I tried to opt-out from all to see how many cookies would be set anyway but gave up after 5 minutes.

<comment><USER106> Yes, I've also seen the GDPR notices where there is no "select all" function and you have to manually disable hundreds of separate options.

</comment></comment></comment><comment><USER107> This is why the GDPR is a bad law. Of course nobody wants to be tracked. If you believe that the harms of tracking outweigh the benefits of increased revenue, then just ban tracking altogether. Instead, the GDPR incentivizes sites to come up with these dark patterns so they can claim that users "voluntarily" "consented", when everyone knows that's not the case.

</comment><comment><USER108> How can we report websites who use the blatant dark patterns? I'm sure they must be violating GDPR.

</comment><comment><USER109> How cycnical - an article further down (Two young scientists built a $250M business using yeast to clean up wastewater) links to Forbes.com that indeed allows me to set my tracking preferences.However, anything other than 'accept' will result in a message stating 'we are processing the request <snip> this may take up to a few minutes'. So they can set hundreds (yeah - that is right, I have seen pages tell me they wanted 500+ cookies to set, some of them to last 20 years) of cookies in a second or so, but will take minutes of me waiting for the page to show while they 'process my preferences'?!?

<comment><USER110> This is like the companies that mysteriously lack the ability to unsubscribe you from their mailing lists in less than 30 days, even though plenty of us manage to run systems that normally do it in real time.

<comment><USER111> There is an interesting Twitter thread about how this process worked in a UK bank, although their turnaround was about 4 days

[https://mobile.twitter.com/Joe8Bit/status/115631296526570701...](https://mobile.twitter.com/Joe8Bit/status/1156312965265707013)

</comment></comment></comment><comment><USER112> GDPR opt-in questions train people to accept forms without reading or thinking. I think this will be dangerous.

And I'm really irritated that I can't access local news sites in America because they aren't compliant -- so they blanket ban European access. That's deeply problematic.

<comment><USER113> > _And I 'm really irritated that I can't access local news sites in America > because they aren't compliant -- so they blanket ban European access. That's > deeply problematic._

The usual answer I get when I complain about this is either "It doesn't happen to me" or "They wanted to steal your data. You're better off without being able to use their site."

I've yet to be convinced by either argument as a European. It's almost like a knee-jerk reaction by some Europeans that if Americans do something we don't like then they're automatically in the wrong.

<comment><USER63> I personally see as usual business of the internet. Every country has their rights to regulate internal markets and every company need to decide how many markets to cover.

Personally I like GDPR more than no-GDPR and think that it would be nice if the US had a GDPR compatible regulation (as in the EU and the US diplomatically agree that it is enough for US company to respect the US regulation and for European companies to respect the GDPR to be compliant under both). On the other hand as laws stands I appreciate that they take this law seriously, even if not in the way I would like most.

Overall I do not think that losing access to local US news sites warrants remaining in a GDPRless world

<comment><USER113> But it's not just local US news sites. Plenty of other businesses won't do business with Europeans as a result. Even video games shut down over this (Ragnarok online, I believe). But the real question is the signal GDPR sends - how many online businesses will simply not get created (especially in Europe) because of GDPR? The nebulousness of the situation is why I've decided to not create at least one website before. I'm sure the lack of my website is no loss for the world, but what about others?

And keep in mind that none of this will actually save your privacy. A Chinese service could steal all of your data, sell it, and nothing would happen because they're outside the jurisdiction of the EU. The only thing that will save your privacy is not giving out the information in the first place.

<comment><USER114> >> how many online businesses will simply not get created

How many online businesses [that aim to quietly collect PII for their own monetary gain] will simply not get created?

Hopefully none of those actors will get created.

</comment></comment></comment></comment></comment><comment><USER115> I am not convinced that GDPR will ever really be enforced. Severe breaches have mostly been ignored so far and the minor dark patterns that dominate GDPR compliance popups and wrong defaults are going to be the tail end of compliance enforcement. Just like cookie laws before it GDPR will probably just make websites annoying with obnoxious implementations and remain largely unenforced until the EU does something else to try and fix this class of data problems and the cycle will continue.

<comment><USER116> One really incredibly annoying trick that I see more and more is when they pre-check only the "mandatory cookies" option, but then when you want to confirm this selection you end up allowing all tracking cookies. It's because they make the confirmation button less prominent, and something that looks more like the typical confirm button is actually "allow all cookies". I guess a lot of people just click on it automatically.

edit: sorry, replied to the wrong post

<comment><USER115> There are a lot of dark patterns. The most common stuff I am seeing (and its basically everwhere) are:

1) Accept being brightly coloured and decline as white so its less prominent.

2) Having accept all be a simple thing but decline being a more information that requires turn lots of individual things off.

3) Requiring the decline to be individual across hundreds of individual cookies.

4) Clicking accept all is stored and used forever but decline is asked everytime you come back to the website.

5) Having the decline process take minutes to complete as if significant processing is required.

6) Having the default be acceptance.

I think breaches of GDPR are the normal, 95% of the websites I see these popups on is breaking the law in some way or another and at this point have been doing so for years.

</comment></comment></comment><comment><USER117> And a large proportion of that 9% is tricked with misleading labels on buttons.

<comment><USER35> There are three buttons with very clear functions in the popup the author used.

<comment><USER117> In general.</comment></comment></comment>


Is it just for me or is kissmetrics.com redirecting to neilpatel.com? - <AUTHOR> https://kissmetrics.com <comment><USER2> Same here

       $ curl -I https://kissmetrics.com
       HTTP/2 301
       server: nginx
       content-type: text/html; charset=iso-8859-1
       content-length: 230
       location: https://neilpatel.com/

</comment><comment><USER3> Neil Patel probably acquired it. He's been on an acquisition spree lately, acquiring UberSuggest earlier this year.</comment>


L.A. is ready for micro-units - <AUTHOR> http://urbanize.la/post/la-ready-micro-units <comment><USER2> Honestly? I would love to live in a micro-unit and I live in Austin. Couch with tv, bed, shower, small kitchen, closet for stuff. Bam done.

I think the bigger issue is twofold - one I'm a single guy without a family. If the default living space in a city (where most of the jobs are fyi) is designed for a single person, families will by design suffer and people will simply not be able to afford to have kids. That's not an ideal situation. Second, just because the apartment is small doesn't make the infrastructure small. I still consume as much water as I did before, I still have a car. Cramming more and more people into an urban center without upgrading utilities and roadways is a recipe for disaster. Traffic around Austin already sucks.

So, meh?</comment>


U.S. Government Requests For Google Users' Private Data Jump 37% In One Year - <AUTHOR> http://www.forbes.com/sites/andygreenberg/2012/06/17/u-s-government-requests-for-google-users-private-data-spike-37-in-one-year/ <comment><USER2> Only 37%? I think I read somewhere else that it's 100%+.

Edit:

[http://thenextweb.com/google/2012/06/18/google-government- ta...](http://thenextweb.com/google/2012/06/18/google-government-takedown- requests-up-103-in-us-49-in-india-4-new-countries-on-transparency-report/)

<comment><USER3> Wrong statistic. That's takedown requests. This is about requesting user's private data.

</comment></comment><comment><USER4> That seems high, but it's only about 540 or so requests, and Google+ has only just got going. Perhaps that is seen as quite a large jump, but I'm not entirely convinced.

</comment><comment><USER5> Google+ launched in the 2nd half of 2011, no mention of it in the article, but I'd think that'd have to be at least partially responsible for that increase.</comment>


Airbnb racks up hundreds of millions of dollars in losses -- WSJ - <AUTHOR> https://www.marketwatch.com/story/airbnb-racks-up-hundreds-of-millions-of-dollars-in-losses-considers-capital-raise--wsj-2020-03-20 <comment><AUTHOR> This is a duplicate of this earlier submission of the WSJ article, which got flagged down from the front page to oblivion by those with a vested interest in not giving the story the attention it deserves.

[https://news.ycombinator.com/item?id=22639181](https://news.ycombinator.com/item?id=22639181)

<comment><USER2> The opposite is the case: we moderate HN less, not more, when YC or YC startups are involved.

[https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20moderate%20less%20not%20more%20yc&sort=byDate&type=comment)

In this case, though, we downweighted the story the same way we've downweighted nearly every secondary coronavirus story, for exactly the same reason: otherwise the front page would have consisted of nothing else for the last week or more.

More explanation here: [https://news.ycombinator.com/item?id=22643249](https://news.ycombinator.com/item?id=22643249)

<comment><USER3> Is there a mod log?

<comment><USER2> Not a public one, but we're always happy to answer questions.

(Well, usually happy to and always do.)

</comment></comment></comment></comment><comment><USER4> First Airbnb use, I booked a week just outside a national park. While driving, just before I arrived, the host cancelled, leaving me with an option of cancelling my trip, or a $400/night Best Western. Airbnb should have compensated me for that one. I'll never use them.

<comment><USER5> Airbnb is simply a listing service. If you have a problem, blame the host, not the platform. My advice: book with superhosts or listings with at least 4.5 stars. Maybe you just don't like the idea of vacation rentals in general? If that's the case, go to a hotel instead, but don't advocate taking away this option for everyone else.

<comment><USER4> I've used VRBO. Worked exactly as it should have. My first experience with AirBnB, I ended up spending $1000 more for a single hotel room compared to the cabin I thought I'd rented. Digging in more, the host had dozens of listings, and there was likely fraud involved by the host. I blame AirBnB because they should have detected the fraud and banned the host. Policing their listing service is their responsibility, and them not doing it, impacted me financially, and they didn't compensate me.

</comment></comment></comment><comment><USER6> Not used Airbnb too often because they had a very bad effect in Europe and other places. Really I wonder how they might not make money. It seems very easy to make money in this model. They do not even subsidize like ride share from anything I ever heard about.

Why would anyone conceal this story if already it is written in the Wall Street Journal? Is this because it is worse for such a story to appear on Hacker News?

</comment><comment><USER7> It was certainly better than the pretty crappy experience I've had canceling with them before. We couldn't stay at our AirBnb because the host had applied some kind of a sealant in their very small place and it was extremely fumey and giving us headaches. After talking to their outsourced support for a while about their absurd requests like "send us a picture of the odor", they decided to keep over $100 for service fees etc. while me and the host both got fleeced. This time it was more of a no questions asked full refund.

</comment><comment><USER8> Maybe Airbnb lost in the short term, but maybe it pays off in the long run. I had to cancel bookings both on Airbnb and on Hotels.com (which I used to be a gold member; now silver), and the experience on Airbnb was perfect. Meanwhile, I lost some money and time calling Hotels.com (two hours in total).

I'll definitely consider Airbnb more often from now on after this great costumer experience.

<comment><USER9> > We are now offering Guests full refunds and Hosts no-charge cancellations > for reservations booked on or before March 14th with a check-in date of > April 14th or earlier.

Well, that's just swell. First of all, this won't be over by April 14th, for example [https://www.minneapolis.org/minneapolis-convention- center/co...](https://www.minneapolis.org/minneapolis-convention- center/coronavirus/) "Events at the MCC will be restricted through May 10, 2020." second if you have a longer trip which got cancelled because originally it was scheduled to start before April 14th then all your bookings are toast.

I had zero problems cancelling my hotels.com reservation at Dorval though.

</comment></comment><comment> j-conn I had to cancel a ~$3,000 booking, and they made it incredibly easy through the app. The host was also very gracious and understanding in her reply to the optional message I sent with the cancelation.

Very impressive customer-centric approach. I'm now much more likely to book with them again in the future.

</comment><comment><USER10> AirBnB, given the current situation, is going to fail unless they jettison about 70% of staff.

<comment><USER11> I can't see how Airbnb isn't in a far better position than hotels. They have no fixed expenses proportional to their untapped capacity (free rooms), no cleaning staff or receptionists. Airbnb hosts, are a different matter.

<comment><USER12> Being an Airbnb host was already becoming borderline unprofitable in my metropolitan area (Seattle) as they are marketing very heavily here resulting in a glut in short-term rental housing-supply. This drove the nightly rate I could command down, and—before this current crisis, the decision between short-term and long-term tenancy was a matter of debate. Now, without any guests visiting the area in the near future, the decision is a no brainer—I'm moving to long-term tenancy and may never be an Airbnb host again. I am currently a host for rooms in my primary residence as well as for entire houses and am currently looking to turn them both types into long instead of short-term rental situations. I'm suspecting many other hosts are in a similar situation.

</comment></comment></comment><comment><USER13> I tried to cancel and was rejected because I was one day outside the window of "check-ins between March 14 and April 13" (my check-in was March 13, a Friday). The kicker is that I canceled on March 12, when the policy stated "for check-ins on or after March 13 and before April 1". They changed the policy over the weekend to the new time frame and rejected my request after the weekend.

Luckily, the host refunded me what they could, but Airbnb kept the service fees and occupancy taxes. The skeptic in me thinks they changed it to March 14 because they could cut out the people who check into places on Fridays (which I often do and assume others, too).

<comment><USER14> file a chargeback

</comment></comment><comment><USER15> Isn't the whole point of AirBnB that they don't have the liabilities of physical hotels?

</comment><comment><USER16> No problem cancelling my Airbnb bookings, but I'm slightly concerned about receiving service fees as coupons. The last time I used an Airbnb coupon and then cancelled that reservation, I lost the value of the coupon (even though the cancellation was within the 100% refund period). An extremely minor concern given what's going on, of course.

</comment><comment><USER17> Curious to know what this means to employees looking forward to a big IPO this year.

It seems many AirBnB employees' fortunes have very suddenly turned from having a handsome payoff to either having to wait indefinitely, a substantial haircut on that payday, _and_ possibly having a hard time during a recession (along with the rest of us).

Crazy times

<comment><AUTHOR> Airbnb is known to be approaching the 10 year deadline on ISOs, which they were hoping to clear through a 2020 IPO. Hopefully they come up with a creative solution with their legal team to ameliorate this.

</comment></comment><comment><USER18> Good bye! Can't stand anything that has to do with this lousy company!

</comment><comment><USER19> VRBO did not step up in the same way. I will never use them again and will look to use Airbnb in the future.

</comment><comment><USER20> We have had fantastic guest and host experiences with Airbnb.

Our friends were hosting in Wellington when an earthquake struck. Airbnb refunded all bookings and sent them flowers.

We had a booking for a concert in Christchurch the weekend of the mosque shooting. Concert was canceled and Airbnb issued a refund.

And I've just had another refund due to not being able to travel this weekend.

10/10, would use again.</comment>


A Street Map of New York City in the 1800s - <AUTHOR> http://www.techinsider.io/old-photos-of-new-york-city-in-the-1800s-with-google-street-view-2016-7 <comment><USER2> Amazing thing I learned today: The "To Let" sign you stick on your apartment when you want to rent it has not changed at all in over a hundred years.

[http://static6.techinsider.io/image/55fec4ecdd0895a9578b45e7...](http://static6.techinsider.io/image/55fec4ecdd0895a9578b45e7-1200/william- street-and-maiden-lane-1915.jpg)

[http://static1.techinsider.io/image/55fec4ecdd0895a9578b45e8...](http://static1.techinsider.io/image/55fec4ecdd0895a9578b45e8-1200/maiden- lane-and-pearl-street-1914.jpg)

There are several more examples in the article's collection, all identical to the ones today, down to the font face, size, and use of white space.

<comment><USER3> Americans don't use that phrase anymore, only the British/commonwealth still do

</comment></comment><comment><USER4> I was more surprised by the title of the article than by the content of it. Looks like editors are writing "ready-to-reddit" headlines now.

</comment><comment><USER5> Here's the actual site: [https://www.oldnyc.org/](https://www.oldnyc.org/)

<comment><USER6> Version for San Francisco: [http://www.oldsf.org/](http://www.oldsf.org/)

</comment></comment><comment><USER7> Wow, that's an amazing level of dedication to mapping this all out. Looking at the about page, it looks like an good exercise in machine learning.

The developer talks about the process of generating the test data here: [http://www.danvk.org/wp/2013-04-20/generating-training- data/](http://www.danvk.org/wp/2013-04-20/generating-training-data/)

<comment><USER8> This looks like a very similar problem to the one dropbox wrote about in "Fast and Accurate Document Detection for Scanning": [https://blogs.dropbox.com/tech/2016/08/fast-and-accurate- doc...](https://blogs.dropbox.com/tech/2016/08/fast-and-accurate-document- detection-for-scanning/) [https://news.ycombinator.com/item?id=12254517](https://news.ycombinator.com/item?id=12254517)

</comment></comment><comment><USER9> Always something amazing about old photos. Always looks much better but I know in reality I probably would have lived in a ditch and died young. Would welcome a world with fewer people though.

</comment><comment><USER10> So proud to see DanVK on the front page of HN. Way to go Dan!

</comment><comment><USER11> I was under the impression he created Google Street View from old photos. The disappointment was big when it turned out the photos are only georeferenced and presented as markers on the map.

<comment><USER12> Yeah. That was a pretty misleading title.

<comment><USER13> He should add the photos to Mapillary, the open source version of Google Street View.

<comment><USER14> Mapillary isn't open source. One can fork the recently announced [https://github.com/openstreetview](https://github.com/openstreetview) though.

<comment><USER15> We are open sourcing anything that makes sense to do and can be reused by others, like [https://github.com/mapillary/OpenSfM](https://github.com/mapillary/OpenSfM), traffico.io/examples.html and are working on open sourcing the apps too. However, putting out the docker setup of the backend is more hassle than use to anyone.

disclaimer: I am part of the Mapillary team.</comment></comment></comment></comment></comment>


Ask HN: What are the realistic capabilities of the NSA? - <AUTHOR>

From a technical perspective, what are the data collection, analysis, and code-breaking capabilities  available to the NSA?<p>What implications does this have on widely used security protocols and methodologies? <comment><USER2> I think it'd be better to consider "what can't the NSA do" given their budget and capabilities.

Tapping and storing terabits of data is effectively trivial, analysis is the hard part. If they hold useful SSL keys (like Facebook, Google, etc) they'll have a much a much easier time figuring out what people are doing.

</comment><comment><USER3> Your own secure crypto:

Assume everything popular is attacked, assume vast libraries of primitive and proprietary cryptanalysis routines.

Of their thousands of hires with security clearance, the cipher newbies are likely given exercises attacking odds-and-ends with massive (old?) Cray orchards.

OTP - is always secure but inadequate for large plaintext. Pad transport is vulnerable.

Naive stream ciphers are seductive but weak.

Brits, MI5(?) had RSA a decade and a half(?) before RSA.

Factorization is RH(`assume Riemann Hypothesis'), perhaps new unpublished vulnerabilities to probable primes?

Better amateur practicing crypto analysts than me can likely offer good points here.

Wikipedia has terrific crypto intro. eg:

[http://en.wikipedia.org/wiki/Outline_of_cryptography](http://en.wikipedia.org/wiki/Outline_of_cryptography)

and ...

[http://en.wikipedia.org/wiki/Deniable_encryption](http://en.wikipedia.org/wiki/Deniable_encryption)</comment>


Google's Microsoft-esque landgrab for IE's market share - <AUTHOR> http://news.cnet.com/8301-13505_3-10130301-16.html

<comment><USER2> There's one major obstacle to adoption of non-IE browsers: something I call the "big blue E syndrome".

I see it a lot at work-- all computers have both IE and Firefox installed and the icons are positioned next to one another on the desktop. As far as I can tell, there are only two of us using Firefox despite it being accessible alongside IE. That big blue E, for most people, IS the internet. It has "Internet" in the name, for goodness sake. I don't use it simply because I need to get things done online in the day and I find IE mindnumbingly slow.

If Google really want to be cheeky, they should take the e from their logo, turn it blue and use it as the Chrome icon. Then rename the browser "Internet with Google"...!

</comment><comment><USER3> Google is trying to get people to move to _faster_ browsers, meaning Firefox 3, Chrome or IE8 (and definitely not IE7). IE8 gets less attention because it is still in beta. I don't see an anti-MS stance there.

</comment><comment><USER4> How can the author claim Firefox is Google's ally? Does he not realize that Chrome is a WebKit browser? Is he completely unaware of the recent TraceMonkey vs. SquirelFish Extreme vs. V8 battle?

All Google is doing is telling its users like it is...There's a lot of advancement in the world of browsers, and Microsoft's not a part of it!

<comment><USER5> > There's a lot of advancement in the world of browsers, and Microsoft's not a > part of it!

Umm.... the benchmarks I've seen of IE8 show substantial (order of magnitude) improvements in javascript speed. They are still behind, but we should be able to count on a big increase in javascript speed across the board in the next couple of years.

<comment><USER4> ...and Detroit automakers are making more efficient cars today then they did a decade ago. What's your point?

</comment></comment></comment><comment><USER6> I'm guessing in the sentence, "Google now regularly hawks its own Chrome browser on its search page, the same page that 63.5 percent of the world uses," "regularly" means "occasionally" since I've never seen it.

<comment><USER7> They probably only show it for supported OSes... I'm on a Mac, and since there's no "official" port yet, there's no Chrome adverts.

Probably the same for every non-Windows OS.</comment></comment>


Ask YC: Demos of our apps at submission? - <AUTHOR>

For the upcoming application round, is it ok to record a short demo of people on our team demo'ing parts of our app (similar to what divvyshot did)? <comment><USER2> You can add a link to such a demo in the demo field, but please don't put it in the field for the video. That's supposed to be just people talking into the camera, and we don't want it to turn into an arms race.

Also, if your demo doesn't get to the point within about 10 seconds, we'll just click on Back. I realize this sounds harsh, but this is a fact about investors generally, not just us.

</comment><comment><USER3> You don't need anyone's permission to market yourselves in the most effective ways you can dream up.</comment>


Stable SIMD in Rust - <AUTHOR> https://github.com/alexcrichton/rfcs/blob/simd/text/0000-stable-simd.md <comment><USER2> What does it mean to target "stable Rust" with a proposal? How is it different from how these proposals usually work, one would think they would land in stable Rust after being implemented in the development versions?

<comment><USER3> We've had _some form_ of SIMD support on nightly for a while; this proposal suggests a different form, one we think we can actually land on stable.

Basically, it's strangely worded because of the long, long history of this feature.</comment></comment>


A website to count the votes of #TheDress - <AUTHOR> http://colorthatdress.com

<comment><USER2> The "scientific" conclusion taken by Wired is not correct. Nobody is "wrong". The phenomenon we observe is known, and it is the manipulative way the questions were asked that led to the weird hype. See [https://news.ycombinator.com/item?id=9120940](https://news.ycombinator.com/item?id=9120940) and [https://news.ycombinator.com/item?id=9118214](https://news.ycombinator.com/item?id=9118214)</comment>


Ask HN: Is affiliate marketing mainly about SEO - <AUTHOR>

I worked at a company that did affiliate marketing about a year ago. I quit because I was burned out but I was also in disagreement about the focus the company had which was more about SEO than building an innovative product. I did a lot of research at the time and it seemed that for most websites (that was in the insurance industry so there is a ton of competition) the most important goal was appearing on Google first, the actual content of the website is of secondary importance. The reality was that for the end user clicking on result number 5 and result number 50 didn't  matter much because the main difference between them was their SEO budget or strategy.
I have contemplated coming back into this field now with an attitude of "if I build something good, they will come" but I am faced with the doubt that I might have gotten it all wrong.
So my question is, in your experience is it possible to build a profitable affiliate marketing business without the pressure that you'll have to dump money on SEO or be left behind? <comment><USER3> Be that SEO or creating valuable content - creativity goes long way. Create something unique - and your post might as well go viral and you'll get tons of backlinks and traffic and hence ranking from Google. Having said that - <USER2> being in SEO field myself - if you build tons of backlinks to not-that-great page - you'll get ranked higher than others who are trying to content their way to the top. It's like creative fistfighter will likely lose to creative machine gun owner :) I've created 1 page website and attracted about 50,000 backlinks to it targeting highly competitive computer security keywords in about 80,000,000 pages competition. That got me to #1 page, while IBM, RSA and similars had to use Adwords to be seen. It was fun for me to do it. I guess the bottom line - do what you love - and you'll succeed no matter what.</comment>


How long intermittent fasts should last - <AUTHOR> https://medium.com/the-mission/the-sweet-spot-for-intermittent-fasting-9aae12a2158c <comment><USER2> (August 2016)</comment>