New study: Google manipulates users into constant tracking - <AUTHOR> https://www.forbrukerradet.no/side/google-manipulates-users-into-constant-tracking <comment><USER3> They constantly berate you to deactivate no tracking preferences on google maps. When you're aware of this fact you start seeing it everywhere, not just on google. For example, on Pinterest they will berate you to sign up using highlighted buttons on land, and the x button is out of the way on the top right corner.

This end result is due to product managers/devs looking at conversion rates and optimizing for whatever their metric of success is, which in this case is creating accounts and users being more "engaged" with the platform. 3 or 4 rounds of A/B testing and you get the most efficient (read: manipulative) method of getting users "engaged". There may be no intention of manipulation but using empirical evidence to achieve your metric of success will tend to make your product manipulative.

<comment><USER4> At this point I'm convinced they're deliberately making their captcha's impossible, to annoy me for taking anti-tracking measures.

<comment><USER5> On the plus side I've become 400% better at identifying whether or not objects are traffic lights and/or fire hydrants.

<comment><USER6> The most annoying captchas are the ones that change after selecting them. What da faq do I look like - free labor?!?!

<comment><USER7> yes.

</comment></comment></comment></comment></comment><comment><USER8> My list of degooglifying actions:

* switch default search engine to DuckDuckGo (can still use !s bang when one wants to see what Google has)

* use tracking blocker (uBlock origin, BlockBear on iOS)

* use anonymous/private/porn mode browsing most of the time (except for sites I actually want to be logged in permanently)

* use Zoho as a replacement for shared Google docs

* use Youtube either in private window, and/or download content with youtube-dl

* use Apple Maps or OpenStreetMaps instead of Google maps, though still revert to Google maps sometimes. It's good. (But never log in, and don't use the apps).

* long ago switched to different email for main email, and forwarded gmail account to it (nobody uses it anymore). (In fact, I use a catch-all domain now (very easy to set up), and a fresh email for basically every account. Quite handy.)

* for contacts, photos, etc. I use Apple's built-in stuff. I do trust Apple a bit more (and it's a different business model; quite evidently unfortunately when you look at recent iPhone prices.)

All in all, I think a fairly degooglified life is eminently possible.

<comment><USER9> > * use anonymous/private/porn mode browsing most of the time (except for > sites I actually want to be logged in permanently)

instead of this, I just use Firefox and use the Multi-Account Container function to separate my browsing

<comment><USER10> Firefox is great on desktop, but I've found it too slow and clumsy on mobile, sadly.

<comment><USER11> But with the ad-blocker installed, you get a bonus speed boost that doesn't apply to the other browsers...

<comment><USER12> That's why I use Brave on mobile.

<comment><USER13> I like Bromite on Android.

</comment></comment></comment></comment></comment></comment><comment><USER14> _Android users are pushed through a variety of techniques:

      Deceptive click flow
      Hidden default settings
      Misleading and unbalanced information
      Repeated nudging
      Bundling of services and lack of granular choices*

Deceptive click flow is _the click-flow when setting up an Android device pushes users into enabling "Location History" without being aware of it.*

Hidden Default settings is _[when] setting up a Google account, the Web & App activity settings are hidden behind extra clicks and enabled by default._

Third one is _users not given sufficient information when presented with choices, and are misled about what data is collected and how it is used._

Repeated nudging is users being _repeatedly asked to turn on "Location History" when using different Google services even if they decided against this feature when setting up their phone._

And finally, bundling services when for example _if the user wants features such as Google Assistant and photos sorted by location, Google turns on invasive location tracking._

I would believe most of us HN crowd are fully aware of the pros and cons of such tracking and make our choices accordingly (using these tools/software/devices). However, for the majority (yes, they may not appear to be interested in privacy as yesterday's FB quarterly report shows), are they aware of how much data is being collected, how it could be misused, etc.? We, as a society, should do our part in pushing back against such indiscriminate tracking. No specific call to action. For my older parents, I have switched them to iPhone 6S and have gradually gotten older family relatives to do the same as well.

<comment><USER15> I would've liked it if they included photos and videos of these "deceptive" interactions. Instead they have this flashy video which basically is just showcasing the Timeline feature, and pretending it's some secret malicious data collection plan.

<comment><USER8> Do you doubt that the deceptive interactions they describe exist as described?

Most people do _not_ realise how much data Google et al. collect about them, and are genuinely shocked when it is shown to them (even though, yes, it's an existing feature well known to you and most HN readers).

The video demonstrates both a) how much Google collects (which comes as a surprise to most people), and b) that most people are not aware of it (which apparently comes as a surprise to you).

> pretending it's some secret malicious data collection plan

Of course, there's the maxim that one should never ascribe to malice what can plausibly be blamed on incompetence. But sorry, if you find these repeated dark patterns throughout again and again, in apps that have been carefully designed and optimised by huge teams of people, then it is justified to speak of bad intentions.

<comment><USER16> I kinda doubt actually. Personal anecdote : I disabled location history about a year ago, and it almost never asked me to enable it afterwards, obviously they dialed it down quite a bit lately. Other claims are also hand wavy. They should include tiimestamped videos with build ids otherwise, it is horse manure.

</comment></comment></comment></comment><comment><USER17> I tried using Google Maps without search history turned on. It's basically a downgraded version. They tied saving locations with the search history, so it won't let you search for friends' contacts, set a home address, etc. Is it on purpose? I don't know, but I find it weird that they would tie some unrelated features together. Why does setting a Home address require search history?

<comment><USER18> > Is it on purpose? I don't know, but I find it weird that they would tie some > unrelated features together. Why does setting a Home address require search > history?

I work at Google but not on Maps, opinions are my own.

I don't know if this is why they did it that way, but it wouldn't surprise me if the reason was merely that 99.9% of users opt in to location sharing and the developers didn't feel it useful to spend time supporting the use case for the 0.1%.

You have to also keep in mind that Google is just a company with thousands of individuals who each have their own motives and are given incentives by the company. If a developer is career driven (and many if not most are) they have to work on "high impact" things to get a good performance review. Since Google tries to be very objective, you have to measure your impact with data and sadly 0.1% of users is not really considered impactful. Unfortunately good will earned by customers is hard to measure.

Again just my observation from working here.

<comment><USER8> Well, in particular, if a developer "untied" these things (ie made the app more useful without signing in), and then the ratio of users who do sign in drops, then that is presumably a "bad impact" metric for the developer. Why would they do that?

It seems rather obvious that there is little incentive to provide usefulness without tying it as closely as possible to data collection.

<comment><USER19> >It seems rather obvious that there is little incentive to provide usefulness without tying it as closely as possible to data collection.

That seems about right. Other than services that you actually pay hard cash for (like gce), all other metrics will eventually trace back to some kind of ad/data related metric.

</comment></comment></comment></comment><comment><USER20> This dark pattern seems to be spreading. Amazon recently pushed out an update to their (beta last I knew) web app that allows you to use their smile.amazon.com charity donation through the app. But in order to turn that on, you have to turn on _all_ the notifications the app has, including their rather constant pushes of "deals I may be interested in". They're holding you hostage to their notifications because "it's for charity!"

Not that this is news, but clearly Silicon Valley has no intention of retraining itself in any manner. Every wheedling trick in the book will be used to track you, up to and including holding arbitrary charities emotionally hostage.

<comment><USER21> Amazon finally exceeded my tolerance for slimy behavior last year, and I let Prime lapse. The amount of time and energy they have put in to making it hard to compare prices in their own goddamn store was enough by itself; behavior like this is motor-oil icing on the garbage cake.

I had to readjust a few common purchases, but I was far less habituated to them than I thought I was. Having to actually pay attention and look meant I found cheaper options. And I never cared about Video or their other goofy add- ons.

Still handy for pricing data-points when buying elsewhere, though.

<comment><USER22> Yep, let Prime lapse a year or two ago as well. Moving my business to other companies now.

<comment><USER23> What competitors are you using?

<comment><USER24> Walmart.com has stepped it up recently. Still a long way to go, and I doubt their intentions are any better, but competition is healthy.

<comment><USER25> As much as Amazon seems to be throwing their mud in consumers' collective faces, the Waltons are 100% not better people and Wal-Mart's entire success is based on exploiting low-wage workers and subsidizing your workforce through social programs.

That's like trading arsenic for cyanide.

<comment><USER26> Last year I spent 5 months cycling through the US. Walmart was the one place I could consistently find healthy food such as fruit at low prices.

Many other retailers have specials prices on fruit that only apply to loyalty cards holders. Obviously they track their customers.

<comment><USER27> I'm fascinated that you cycled through the U.S. Did you happen to write anything about your travels that you're willing to share? I'd love to hear your experiences seeing America.

<comment><USER26> [http://cycleblaze.com/journals/burgers](http://cycleblaze.com/journals/burgers)

I met hundreds of people and most of them were so generous with food, accommodation etc. Some even tried to give me money.

<comment><USER27> I'm late to get back to you - thanks for sharing this. This is so extensive and exactly what I was looking for!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> Ethically I think the good old days of software _products_ were superior to the current days of software _services_. Services are paid for by subscription or ads or selling data, so that they are forced to optimize for continued use. Products are sold as-is, with the hope that they are useful enough that enough people will buy them once and own it forever.

It should work this way: you spend N months making a useful product that fills a real need, start selling it, and ideally make just enough money to cover the time you spent working on it. As soon as you start selling it and money comes in, you start working on another product. This has flaws though. You have to have the cash up front to pay your own bills for the first N months. And you risk not making up the time you spent.

But what I see happening is worse: people make products that sell, get greedy over the money they can make, and milk that product to death, first by paid upgrades (which isn't inherently unethical) but then turning to subscriptions or free but selling you to ad- or data-companies.

<comment><USER29> Having worked on desktop software, I much prefer the services model.

There were endless conversations about a support matrix and patching older versions for customers who refused to upgrade. We were hamstrung by old design decisions and backporting fixes making any change onerous. We couldn't add value for new customers as fast because we spent a majority of the time supporting older customers. Now those older customers probably preferred it that way. They had software that worked (until a new vulnerability was discovered at least) and that they had paid for and liked. But as the decades (literally software that old) dragged on they became like technical debt that we couldn't detach.

As a developer, the incentives were clear. If I'm spending half my time supporting people who had already paid and weren't likely to pay again, then I can be more productive elsewhere, creating more additional value at a company that had a services model. So I left.

<comment><USER30> _Having worked on desktop software, I much prefer the services model._

I think that's one portion of how we ended up where we are now: The companies thinking more about what is easier for the company than the needs of the customer.

<comment><USER31> The companies will always think about their bottom line. They will think of the needs of the customer to the extent that actually affects said bottom line. But customers demonstrated, through their behavior in the marketplace, that they also prefer the service model - or at least they don't care enough to preserve the old model. And so, here we are.

<comment><USER32> Software tends to spread from person to person, and any given piece of software in context is usually non-substitutable - therefore I believe consumers _weren 't really given an option_ to voice their opinion on product vs. service. Companies started to migrate to service model, and customers had to follow suit, because they didn't have any choice.

<comment><USER31> Customers had a choice in many cases. For example, Office is still offered as both a boxed product, and as a subscription service. Every time I see a discussion on one versus the other online, most people prefer the service, because it's cheaper (even long term).

</comment></comment></comment></comment></comment></comment><comment><USER33> Whenever you tap a link in the iOS YouTube app, it starts nagging you to download Chrome, or continue with the old boring Safari... There's a pre- checked switch at the bottom of the dialog that says "Ask me which app to use every time". Now, even if you uncheck the switch and choose Safari, they will only let you off the hook for around a day; after this cooldown period you're "offered" to download Chrome yet again, ad nauseam!

Just a gut feeling, but I think if I had installed Chrome once, they would never show me this dialog again... :)

Seriously Googlers, how do you look into the mirror each morning?

<comment><USER34> Chrome is just a safari skin. There is no freedom to choose browser render in iOS.

<comment><USER33> Yes. Chrome is just a Safari skin plus Google's tracking.

Which makes this dialog in the YouTube app even more ridiculous.

</comment></comment></comment><comment><USER35> Google Maps works just fine with the GPS from my phone's sensors, but _every single time_ I bring up the app, it asks me to enable device location and Google Location Services.

I stubbornly (and maybe foolishly) keep opting out of every Google tracking option, it's crazy how annoying they are if you do this.

<comment><USER36> This happens to me too, various opt-in nags on both desktop and mobile. Using google maps has become a chore for me. I used to like going to the site or the app and browsing around for fun to learn about a new place. Now I only use it when I absolutely need to.

<comment><USER37> I'm now trying to use OSMAnd wherever possible. If there's a location I can't use it to find, I'll revert to Google Maps (and click 'no' to the opt in nag). When home, I'll make sure to update OpenStreetMap to make their map more useful.

I'm convinced that open data is the better option. Certainly, I'm happy to volunteer my time and effort to contribute to things like OSM (and Wikipedia), but I'm loathe to part with my personal data for 'free' to a huge advertising behemoth.

<comment><USER38> My biggest gripe with OsmAnd is the fact that plug-ins are actually part of the source code, meaning that I would need to recompile the entire project to accommodate, say, a plug-in that could pull in traffic data. That's my largest use case for maps apps - avoiding traffic on my lengthy commute.

There are some gross hacks to get traffic overlays on the map, but the navigation still chooses routes independently of that data (driving you right _into_ traffic)

</comment></comment></comment></comment><comment><USER39> I have had to visit the #nixos channel in Freenode (IRC) lately on a computer with all tracking disabled and the Recaptcha that is usually just click and continue becomes a multi-minute endeavor finding street signs, cars and buses. You really get punished if you opt out of tracking.

<comment><USER40> I'm sure this isn't done, but I do have to wonder if it'd be possible to identify a user by their unique behaviors when interacting with the extended Recaptcha puzzles. Something like writing style analysis, but applied to patterns of mouse movement, click timings and positions, or recognition rates for particular types of problems.

<comment><USER41> If it can be done it will be done seems to be the moral of these stories so lets hope not.

</comment></comment></comment><comment><USER42> I for one are happy to be tracked so that my experience is optimal.

Edit: I understand the potential issues and especially with someone like Google using it for other things. But I am more concerned about the backlash against using data to improve our world.

There are many different areas which would be improved greatly from more data and would be to everyone's benefit.

Personally I have always shared as much as I can as I believe that the more we share the more the problem corrects itself. But each to their own.

<comment><USER43> I don't see people willing to share their data (with companies like Google) as the issue. The problem I'm concerned about is that there is a decreasing amount of choice in the matter. While you ultimately have a choice in a lot of these privacy-concerning cases, it's increasingly difficult and annoying to do so. People eventually cave and Google (et al) profits greatly by pushing them to do so.

> There are many different areas which would be improved greatly from more > data and would be to everyone's benefit.

I agree wholeheartedly that data can be used for some really fantastic things, but it should not come at the cost of choice/freedom nor privacy.

I'm also thinking about it in terms of opportunity cost. Namely, companies like Google and Facebook are poisoning the waters for would-be data-based companies that would have much greater impacts on quality of life for everyone. While they help some things at the moment, I think they are ultimately hurting would-be bigger and better data driven endeavors.

<comment><USER42> Yeah but that's the problem of technology though especially the AI-driven one.

It forces consolidation of data as a way to compete. You can't both have lots of competition and good use of data as the value is in the accumulated data.

What I think we still need a revolution in is how to make consumers data brokers of their own data. There are some attempts at making this a reality but it's not clear what the utility which will force this transcendence is going to be.

</comment></comment></comment><comment><USER44> Privacy is like drinking water: no one in the US cares about it until it's on the news.

Why don't people care about clean water? Because federal agencies set standards and test for them. You could bore someone to death talking about it until Flint happened. And sure some people buy water tests to verify they're not getting poisoned, or setup their own filtration systems but most people don't want to waste the time or don't have the knowledge. Just the same as privacy.

Not every can or will get educated about privacy, and really they shouldn't have to, it should be a waste of their time. But it's not because we don't set standards for it. Most people give it away without knowing it's value only to have it bite them in the ass later through identify theft, data breaches, or eventually giving into a surveillance state where the government and big corporations know more about your than your mom does.

This is why it needs government intervention, because without it corporations will claim to give you a choice every step of the way but no one will understand what those choices entail, and it turns out they'll badger and pester you to make the choices that benefit themselves.

Relatedly, this is why I am OK with iOS being a walled garden. Sure, they make bank from it, but that incentivises them to make it protected. As I said in another thread, they're the only one capable and willing of enforcing privacy rules until the government steps up.

</comment><comment><USER45> FTA: "Bundling of services and lack of granular choices - If the user wants features such as Google Assistant and photos sorted by location, Google turns on invasive location tracking."

I unplugged my google home precisely for this reason. It wouldn't operate with all kinds of web and location tracking turned on. And when I turned them off it would only respond with something along the lines of "you have to turn on <tracking_feature_x> for google home to work properly."

The hell I do. Amazon doesn't require me to turn stuff like that on to work just fine.

It was blatant and a bit nauseating. After that I understood the google-free movement very well.

I would still like an all-on-site voice assistant that respects privacy.

<comment><USER38> There was an article posted here recently about a device that feeds white noise to devices like that until you give the new device they keyword it's looking for. It was supposed to look like a fungus or something. Lemme see if I can find the article...

Wouldn't help with location tracking, but might put your mind partially at ease if you own a creepy home assistant thing.

<comment><USER46> Project Alias.

[https://news.ycombinator.com/item?id=18903289](https://news.ycombinator.com/item?id=18903289)

</comment></comment></comment><comment><USER47> At some point we need to sit down and map, exactly what kind of information can be extracted from which meta-data sets.

For instance, screen time is also sleeping habits, for some its toiletbreaks. If its toiletbreaks, its stomach/health related. Couple that with location, its eating habits and risk factors. Couple that with phonelogs its much much more.

Once we have that mapped out, we can do an honest evaluation of whats being tracked, because every extrapolation possible will at some point be turned into usable data (my theory).

<comment><USER48> > honest evaluation of whats being tracked

And, next steps? Easier just to apply basic OPSEC into your life, no data - <USER2> extrapolations.

</comment></comment><comment><USER49> On the subject of Dark Patterns, Linkedin has to be one of the biggest offenders. Almost every time I open their app (which isn't very often), they try to trick me into uploading my contact list. I wonder if it'll come to some sort of regulation that requires companies to respect your opt-out answer and not continuously badger you into opting back in.

</comment><comment><USER50> Definitely. I think the initial setup of an android phone is pretty similar to that of windows 10. You have to read everything very carefully to avoid all the dark patterns and hidden consents for tracking.

</comment><comment><USER51> The thing that drives me nuts is (at least last time I set them up) Google Home and Android Auto both require Location and Web Activity permissions at an account level. I don't understand why Google just can't offer a subset of functionality on these devices rather than forcing you to have enable these permissions.

<comment><USER52> Thy can do this but they don't want to.

</comment></comment><comment><USER53> What Android desperately needs is an additional API layer that provides apps like Google and others with fake location data and fake contact data so there's simply no way they can tell that you're holding information back. Turning off these data sources just makes them use dark patterns to get you to turn them back on; _spoofing_ the data is the real solution.

<comment><USER38> What you're looking for is called 'MicroG'. They even have their own LineageOS builds with it.

Haven't tested it though, and it comes with its own set of security concerns.

</comment></comment><comment><USER54> The privacy settings user interface on my Android is deceptive. It lures you into thinking that you have changed all the settings and does not show all the settings in one go. Google is creepy.

</comment><comment><USER55> Another example of Google not even trying to give the account holder an option to pause tracking is the purchase/order-linking feature for purchases history. They scan the users Gmail account for orders/receipts and quietly storing that information into the purchases history as can be seen by going to [https://myaccount.google.com/purchases](https://myaccount.google.com/purchases).

Instead of giving the account holder an option to delete this history, their helper section vaguely mentions you can go to Gmail and "manage" the corresponding message. [https://support.google.com/accounts/answer/7673989](https://support.google.com/accounts/answer/7673989)

</comment><comment><USER56> I read an article a while back, that argued[1] that openness to tracking and surveillance may be linked to helicopter parenting.

The argument goes that because millenials have been raised to be under continuous adult supervision, that predisposes them to view surveillance as benign and benevolent.

[1] I can't find the source.

<comment><USER57> This was (essentially) the assumption that made me decide that teaching my daughter to expect privacy by respecting hers was the only way to go. It turned out well, and I feel like a lot of other positives emerged out of it.

</comment></comment><comment><USER58> All this tracking is obviously one-sided.

I might not mind it so much if I had access to sufficiently granular data to make it useful, such as automatic workout tracking. I'm sure they have the data and the AI to notice that I'm on foot/bike moving at a higher-than-normal pace and on one of my usual workout routes. Or, to provide nice detailed reports of my commute (min/max, variance, total time, etc.)...

But no, the only data we get is rough, 'you visited store X yesterday, want to review it?', when I actually only visited the much smaller store nearby...

There is already starting a backlash from this massively greedy -- in both data & money -- culture. It would not surprise me to see it overshoot and seriously cripple the industry if the participants don't become a bit more self-aware.

</comment><comment><USER59> This is scary stuff. Thank you norway for taking the fight against Google.

How can you turn this off on an android?

<comment><USER60> Installing LineageOS without any Google apps (including Google Play Services) might be the only way to continue using Android minus the tracking. You lose quite a bit of convenience for this, though. And of course, you're still being tracked by virtue of it being a cell phone with a baseband processor (see my comment at [https://news.ycombinator.com/item?id=18821444](https://news.ycombinator.com/item?id=18821444)).

<comment><USER61> Your carrier will know where you are (and have been). Are you saying this information is also available to apps?

<comment><USER60> I meant more that it is very hard to completely avoid tracking and that the cell carrier is an often-overlooked part of the equation.

</comment></comment></comment></comment><comment><USER62> Google Podcasts is the same. No subscribing to a podcast without Web History turned on.

The message says its needed to get personalized recommendations.

</comment><comment><USER63> This aspect of Google (forcing you into full surveillance mode before they will enable services) is the reason my wife is looking at an iPhone for her next phone. To the extent that others follow that move will be interesting to watch.

<comment><USER64> Even for those of us all-in on Google services -- like me with Gmail, Drive, Maps with history and sharing, YouTube Red -- iOS is way better. iOS and all the Google apps works great, and you can dump Google at any time.

</comment></comment><comment><USER65> Great article, thank you for sharing. Love the list of deceptive practices - reads as a blueprint for what to avoid if you respect your users.

The "data helps us understand usage and build a better product" narrative is all over these comments and in product teams. Revealed preferences are helpful for building better products. I suppose the story gets twisted when "better" for the business diverges from "better" for the user. Are there ways to achieve a win-win here by sufficiently anonymizing data or explaining why tracking is helpful and asking for explicit consent? Would love if anyone has links / reads on this.

</comment><comment><USER66> There are more than 40000 individuals in Google in SV working to stalk you 24/7 and monetizing the data with different teams thinking up more ways and means to do it, other teams working on thwart any regulatory or other challenges to ensure business continuity, other envisioning a future in which they can grow this business unhindered.

This is an entire organization devoted just to this, and they in turn enable ecosystems of hundreds of thousands all interlinked driven by profit.

Yet on a technical forum which probably has a large proportion of people involved in this intimately as their jobs we do not have informed discussion, instead we pretend as if its not happening, or a one off by a 'misguided program manager', or the motives are 'benign' or unquestioningly accept self serving attempts to 'normalize' this surveillance dystopia.

This is an insult to informed discussion and enables an environment and discussions where blatant bad behavior is consistently overlooked and control of standards that benefit toxic business models are glibly handed over without scrutiny, skepticism or challenge. And then when one day one wakes up in dystopia some will wonder how it happened, this is a culture of delusion.

</comment><comment><USER67> Actively having to take extra steps to just log out of any of their services is the biggest little deception. Once they changed their login screen (cannot even remember when) you had to click multiple extra times to remove an account explicitly or you were still tracked/logged in/Google was aware of you. I started deleting history in Fx whenever the browser is closed which helps with this but I have windows/tabs open for weeks for a reason and can't always close the browser. I've just some to accept the extra steps it takes to actually logout though it pisses me off slightly each time I do it.

I've taken no steps to confirm they are actively getting info from my browser if I don't remove my account or if they are not if I do because I have turned off as much account data tracking/opted out of as much as I could for my Google account. But logging out of YouTube, which gives you no indication that you are actively logged in in the active browser window, and then going to mail.google.com will show you that Google is still aware of your account. Bullshit.

</comment><comment><USER68> Scannning the comments here it does not appear anyone is considering the cost of network activity and bandwidth.

The user is subsidising the tracking.

Google does not pay for the cost of the user's internet access or her mobile data plan. In some cases, the user might only need an offline map however instead she is coaxed into accessing the same map over a computer network again and again, day after day, year after year. The cost of that access is carried by the user, not Google. Multiply this cost over millions of users.

Users are paying, in many cases unnecessarily, to send tracking information to Google.

When Google coaxes a user into accepting the settings that Google prefers (24/7/365 tracking), users are not merely agreeing to be tracked in exchange for something, a price not easily measurable and thus perceived as "free". Users are agreeing to pay for the costs of that tracking, namely the transmission costs to get the tracking data to Google. Those prices are measurable, though few users might be measuring them.

Of course users are not opening an application and hitting a "send" button everyday to do this task; it is not conscious spending. They are permitting Google to do it for them in the background, using the user's CPU, memory, storage and bandwidth.

None of those resources are "free". Whilst users may have generous amounts of privacy and personal data to trade away in exchange for some perceived benefit, users did not have to pay for those "assets". They might not put much thought into whether each exchange was truly necessary.

On the contrary, users must pay for computing resources and internet access. It stands to reason that they might not wish to trade away those acquired assets where not truly necessary.

</comment><comment><USER69> Big companies will break laws because they can afford to and the data they collect provides more value to them than the price of the penalty.

Lawsuits like this have become the norm now and don't think it'll change any time soon.

The majority of people will always choose convenience over privacy and remain on these platforms even after reading headlines like this.

</comment><comment><USER70> I understand the article is not about web site tracking, but the Norwegian Consumer Council should not be permitting readers of that particular piece to be tracked by Google, or have an eight-month tracking cookie dropped by them. Either way, it's good to read another authority detail such unethical practises.

</comment><comment><USER71> That is correct. In an earlier comment [1] I have checked what options are enabled by default when registering or adding a Google Account to an Android Phone. For example, checkboxes "Backup to Google Drive" and "Save web and app activity" are enabled by default.

I suppose that many Android users might agree to these options without understanding completely what they mean or even without noticing because some of the options are hidden behind spoilers.

Android is an example of a case where you become a product although you have paid for the phone.

[1] [https://news.ycombinator.com/item?id=18493084](https://news.ycombinator.com/item?id=18493084)

</comment><comment><USER72> Google no longer has the benefit of the doubt...these things would have gotten traction a few years ago. Or, Googlers, must be doing this to cure cancer or something, they're so good and nice. Now, all that goodwill gone.

</comment><comment><USER73> I didnt know about location history and web & app activity. It is indeed quite hidden and when I disabled them, i saw along with web and app activity, there was a bunch of other history google was storing like search history, browsing history etc. The really evil bit about Google is that, even when you disable them, Google does not delete the already collected history, they just "PAUSE" that so that they can keep old history.

</comment><comment><USER74> Speaking of Google Maps location tracking, are there alternatives (for iOS) that can let _me_ track myself, without putting all the location data in the cloud?

I want to disable Google's location tracking, but I want to know where I've been so that I can go back and recall. A sort of location diary.

The only app I know about is Life Cycle, which is quite good, but it doesn't quite have the granularity I want.

</comment><comment><USER75> Yelp is the worst about this. You can't even use most features on the mobile website without downloading the app so they can suck up all your info.

<comment> sudo-i Reddit too, they cripple their mobile website to force you into their mobile app and hence your data.

<comment><USER76> Oh man, tell me about it. I lurk on Reddit from time to time from my smartphone and the experience nowadays is terrible. I have like half a dozen elements disabled using u-block to make it somewhat bearable. From the pulsating button at the top of _every_ page to the multiple dialogs taking turn to harass you into installing the app...

On top of that I've noticed that the website keeps getting slower and slower to load what's effectively a few KB of plain text comments.

The state of the web in 2019 is frankly shameful. Those are tactics that you should expect from shady websites, not some of the biggest players in the field. Everybody is trying to trick you into going against your best interests.

The GDPR did a good job at highlighting that for me, suddenly all the websites in the world deployed a wealth of ingenuity to develop new dark patterns to trick you into opting into the tracking, using ambiguous controls and confusingly worded instructions.

I hope this is only a phase and we'll move away from this toxic ad-driven business model sooner or later but honestly at this point I'm not holding my breath.

<comment><USER56> >The state of the web in 2019 is frankly shameful. Those are tactics that you should expect from shady websites, not some of the biggest players in the field.

Because of ad networks, _every_ site is now a shady website.

</comment></comment></comment></comment><comment><USER77> A few years ago I made a comment about how funny it was that I would immediately delete all the Apple default apps and replace with Google apps (gmail, maps, etc). Now I'm back on the flipside and only use Apple Maps, Mail, etc. Unless Apple really F's up, they are going to win the privacy game and see a lot more usage of their native apps and services.

</comment><comment><USER78> My "favorite" Google dark pattern is suggesting "Privacy Checkup" when I'm logged out. The checkup of course requires signing in.

This is so cunning — they make it look like they care about my privacy, while in reality they upgrade from no tracking (signed out) to at least default tracking they allow themselves in the ToS.

<comment><USER16> Why is this a dark pattern? There could be a lot of people who sometimes sign in and sometimes stay logged out, the privacy checkup is useful for them, even you might have some settings from past you might want to see. This is not a dark pattern, HN became hysterical.

</comment></comment><comment><USER79> The librem 5 can't come fast enough.

</comment><comment><USER80> You cant use wear OS, or really any wearable on Android anymore without enabling location tracking. They bundle "low power bluetooth" settings in the same permission set as GPS in order to force you to leave it on at all times.

</comment><comment><USER81> Google is notorious for refusing to allow users to say no. They misread the book "Nudge" and use the nudge techniques t to shove or one could use less charitable descriptive words.

e.g. I would like to make the choice to NOT bind my location data to my identity. In theory I can do that by not logging into Maps. In practice Google refuses to allow that choice, constant nagging, attempts to force their desired choice by nerfing logged out features. When you don't allow your uses to say no you're not actually providing them any choice at all.

Google either needs to commit to allowing their users to say no or we (their users but also citizens) need to have our courts and governments force them to do it.

Note to you Google folks reading this (I'm looking at you Larry). Seriously. Step up now because you will be sued for this, and you will force legislation if you continue down this path.

</comment><comment><USER82> I think companies will always find ways to track you. One solution would be to create a fake bot that will feed noise to these trackers by visiting random sites and doing random google searches on your behalf.

</comment><comment><USER83> I disabled web and app activity and then voice commands stopped working in Android Auto so I had to turn it back on. Why does Android Auto need my web and app activity to process sppech and search for me? Sheesh.

</comment><comment><USER84> I have launched yelp clone pagestan.com for Pakistan. And feeling helpless to compete against google's dominance. I am sure yelp is also reevaluating its business model

</comment><comment><USER85> Repeated nudging!: [https://news.ycombinator.com/item?id=18863660](https://news.ycombinator.com/item?id=18863660)

</comment><comment><USER86> Remember when Big Bad Ol' Microsoft bundled their Web browser with the OS, and that was beyond the pale?

That was so quaint.

</comment><comment><USER87> You do not really need a study for that, just a few minutes of browsing with the uMatrix extension.

<comment><USER88> I used to use ublock origin and noscript a long time ago, but now after years of browsing with umatrix, I say browsing without it is like having unprotected sex with the internet.

</comment></comment><comment><USER89> Haha! Much love to my home of Norway's «forbrukerråd», i.e. consumers counsil.

</comment><comment><USER90> They ditched the don't be evil motto a while back, didn't they.

</comment><comment><USER91> It's fun to just browse your location history. You can much more easily recall vacations, or other events you might have forgotten otherwise.

</comment><comment><USER92> So something that maybe not everyone knows, is that the Norwegian Consumer Council, is the Norwegian governmental entity tasked with protecting consumers right.

I'm not a lawyer, but my take on this, is that this is a governmental agency in a GDPR country, triggering legal proceedings against Google for violating the GDPR.

It is going to be interesting to see how this pans out, and imo. this case is going to be a defining case on what the GDPR is in practice.

</comment><comment><USER93> The title is false. This isn't a new study. This is from 2018.

</comment><comment><USER94> Duh.

</comment><comment><USER95> "Don't Be Evil" kids!

</comment><comment><USER96> Fuck surveillance capitalism

<comment><USER56> Word!

</comment></comment><comment><USER97> _" If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."_

Eric Schmidt, 2009

<comment><USER98> This attitude makes me so off the charts angry, I struggle to put it into words. I think Jews in Germany in the 1920s didn't think they were doing anything wrong, or feel a need to actively hide it.

<comment><USER99> Schmidt's attitude shows just how much Google thinks it owns the internet. There is so much data out there that people can live in relative anonymity online (95% of bloggers) however Google crawls and indexes so much that many things become quite easy to find. All the tracking and linking and indexing that is done without a person's informed consent makes that person's intentional behavior a warped spotlight back on them.

<comment><USER100> > All the tracking and linking and indexing that is done without a person's > informed consent makes that person's intentional behavior a warped spotlight > back on them.

Sure, but only in the minds of people who don't even know themselves, and can't make a coherent argument to save their lifes. They confuse the "data" they have on things with the things themselves, not to mention people -- same noobs doing the same shit, different day.

</comment></comment></comment></comment><comment><USER101> Keep the karma points at 666 for humorous effect please.

</comment><comment><USER48> Stop whining that Ad company collects data, it is in DNA. Just put some effort and un-google yourself.

There is no free cheese (services, apps).

</comment><comment><USER102> Honestly tired of Europe pretending like they are so high and mighty for flagging tech companies for "privacy violations." Frankly it's insulting to say that adults cannot decide for themselves how they want their data used. At this point, users know if you turn on Google tracks you. It is worth it to many for the convenience of quality results Google delivers. If it isn't turn it off. But to say it is Google's fault is nonsense.

<comment><USER103> This is comical. I try _really_ hard to keep Google from tracking me. I use DDG, FastMail, iOS, have pseudonymous accounts for logging into Youtube. But I know Google still has a pile of information on me through reCaptcha, trackers on various web sites (Google analytics for starters) and services that use the Google Maps API. So I'm left with the nagging sense that I'm still being tracked by Google, no matter what I do. There is _no real choice_ available. Google _will_ track you in some way, your "decisions as an adult" be damned.

<comment><USER104> It doesn't even matter anymore if they can tie your actions to your identity, so long as they can tie your actions to the information that they choose to let you consume.</comment></comment></comment>


Is the F-35 our AT-AT? - <AUTHOR> https://medium.com/point-of-decision/is-the-f-35-our-at-at-348b40ca4d3c <comment><USER2> I just think it's useless to discuss this.

We practically don't know anything besides a couple of photos, some information that might or might not be false, a few not myth-busted myths, and opinions from people that don't know much about it but want to voice it.</comment>


Twitter Rolls Out Search And Trends And A Business Model? - <AUTHOR> http://blog.socialmedia.com/twitter-rolls-out-search-and-trends/ <comment><USER2> Hmmm, I'm not seeing it on my Twitter page.</comment>


Shareholder urges Nintendo to develop for mobile platforms - <AUTHOR> http://www.polygon.com/2014/2/26/5450938/shareholder-urges-nintendo-to-develop-for-mobile-platforms

<comment><USER2> Virtual console on ios and android please

</comment><comment><AUTHOR> _" Just think of paying 99 cents just to get Mario to jump a little higher."_

It _might_ be the right thing for Nintendo to get into mobile gaming, but I don't think this would be the reason why.</comment>


Clojure, from a Ruby Perspective - <AUTHOR> http://briancarper.net/blog/clojure-from-a-ruby-perspective

<comment><USER2> _Ruby-style OOP brings a lot of complexity and baggage which Clojure avoids by not being OOP. For example (ignoring Java for the moment), in Clojure land you don't have to worry about a member being public/private/protected, and there are few times when you have to worry about inheritance and class hierarchies._

In my limited clojure experience I actually found the lack of a clearly defined object model to be something of a handicap. In a language with a single, solid object model it's easy to build consistent interfaces to libraries because they all follow the same conventions. In languages like scheme or clojure these things become more heterogeneous and less predictable.

The forthcoming protocols stuff in 1.2 might nail this down though.

</comment><comment><USER3> no real negatives there... I'll fix that. Immutable-by-default and lazy-by- default made simple tasks awkward, its macro system is like CL's but gets in your way a little more, and because it's java it takes forever to start.</comment>


A Golang Redirection Service for DNSimple - <AUTHOR> http://blog.dnsimple.com/a-golang-redirection-service/ <comment><USER2> I ran into the same problem with the lack of timeouts on the standard library's http server. This is probably something that should be updated to have a reasonable value. Even if that value was 10 or 15 minutes it would keep more people from falling into this trap.</comment>


Thrown out of Ebay Live for wearing Google shirt - <AUTHOR> http://mystorespace.blogspot.com/2007/06/mystorespace-launches-at-ebay-live-but.html <comment><USER2> If this is true it's a bad sign for eBay. Such heavy-handedness is always correlated with major suckage in the product.

<comment><AUTHOR> I think I tried to convey that exact sentiment to their VP at one point during that unpleasant encounter. And yes, it's a true story. The Auctomatics can vouch we were there :)

</comment></comment><comment><USER3> I think it's pretty smart marketing in some ways. People remember that kind of stuff, and it's getting them a lot of attention. I remember at Linuxcare when the head of marketing (who was actually one of the brightest guys at the company, except for Andrew Tridgell of course) pulled some kind of stunt, of which I dont' remember the details, with the implication that Linuxcare was _the_ place to go for Redhat support. Of course we had to pull it, but it got on all the news sites and got the name out.

</comment><comment><USER4> I just googled "Google Checkout." It looks interesting.

If it wasn't for Gary Briggs, Chief Marketing Officer for eBay North America, I'd still be blissfully ignorant.

</comment><comment><USER5> eBay needs to get their act together. This is not their best marketing move...

</comment><comment><USER6> If you interested in knowing what happened in a couple of the major panel discussions during the event, you can read our notes here: https://auctomatic.com/user/ebaylive

The Q&A; with the ebay execs was v interesting

</comment><comment><USER7> Ebay made the right call, I'd throw them out also if they pulled that nonsense...

<comment><USER8> What nonsense?

<comment><USER9> their product

<comment><AUTHOR> I would appreciate some more constructive criticism about our product. Keep in mind it's just entering beta. What about it seems like nonsense to you?

Update: "sfo" appears to be a troll - his account was created 10 minutes ago.

<comment><USER7> This has nothing to do with the product. They showed up with a plan to stir the pot... if it was for press then it looks like it might be working for them. Nicely done in that respect but don't pretend this was a huge coincidence.

<comment><USER2> It's true it was suspicious that they wore Google shirts. Every little startup I know of would wear their own shirts to a trade show.

<comment><USER10> It's very common for people to display brands that they want to be associated with. E.g., in fashion, you can't copyright a clothing design, which has led designers to sell plain T-Shirts that say "Ralph Lauren", "A&F;", "Hugo Boss", etc. Wearing a Google shirt is saying, "Hey, please associate our tiny little start-up with Google!" It worked! And check out the press they're getting for rocking the boat via the existing eBay-Google flap.

<comment><USER11> Yep, they definitely wanted to be associated with Google. In fact, if there was a Google Checkout t-shirt they would have worn it. It's clear that they went there to tout the merits of Google Checkout. That being said, it unfortunate the way the Ebay exec handled it. He fell for it hook, line and sinker.</comment></comment></comment></comment></comment></comment></comment></comment>


New Tax Plan Calculator - <AUTHOR> http://taxplancalculator.com/ <comment><USER2> I am very confused by "Current Tax System You'd save $0" part. This makes no sense and reeks of snakeoil.

Then I looked up who created this calculator, and it's Maximm Lott, a writer for Fox News who's twitter retweets Republican talking points and is bending over backwards to sell this plan:

[https://twitter.com/maximlott?lang=en](https://twitter.com/maximlott?lang=en)

This propaganda has no business on HN. If you want a tax plan calculator, use the NYT's.

<comment><USER3> The NYT did seem to put more effort into it:

[https://www.nytimes.com/interactive/2017/12/17/upshot/tax- ca...](https://www.nytimes.com/interactive/2017/12/17/upshot/tax- calculator.html)

At least it looks nicer.

<comment><USER4> I quite like the no-frills approach of the originally posted calculator. It's kind of refreshing.

</comment></comment></comment><comment><USER5> This says I will save a few thousand dollars. I am a single young person with no dependents and no debt and I make a six figure income that likely puts me in the top 10% of earners in this county. If anyone deserves a tax cut, it isn't me.

<comment><USER6> Cool so will you be writing a check for the difference to the IRS as a "donation"? You can actually do that you know.

<comment><USER7> I don't think you can donate to the IRS. You can do similar things, but none are quite the same as paying taxes.

[http://www.slate.com/articles/news_and_politics/explainer/20...](http://www.slate.com/articles/news_and_politics/explainer/2011/04/uncle_sam_wants_you_or_at_least_your_spare_change.html)

Also, the problem is that the government now has to plan its budget based on the new tax plan. Even if I donate a few thousand extra, that won't stop a lot of important programs from getting cut, and it won't stop general inequality from increasing.

<comment><USER8> You're correct that you don't donate to the IRS, specifically. You can write a check to the "United States Treasury", however.

They will gladly cash your check.

</comment></comment></comment></comment><comment><USER9> Surprised to see such a big tax decrease (~14%) even though my wife and I live in Manhattan and our state and local taxes are about ~10% effective.

The loss of the state and local deductions is more than made up for by the drop in the marginal rates, apparently.

Now, if we had other deductions (e.g., student loan, mortgage interest and tax, medical, etc.), I suspect we'd lose out here.

I'm sure this is an unpopular opinion on HN, so let me say I don't believe we deserve such a large tax cut, but I'm glad to see this plan is not incentivizing debt or artificially inflating home prices as much as the current one.

<comment><USER10> this probably removes the AMT if you're making < 500k individual or 1M married, which, for us, was huge last year.

<comment><USER11> FYI that is a bit of an oversimplification. See the AMT page on TaxPlanCalculator.com/static/AMT.html to see if it really eliminates your AMT in that range.

</comment></comment></comment><comment><USER12> This does not take into account the changes to pass-through entities which I still don't fully understand ...

When I say I don't fully understand them, what I mean is, it _looks like_ they have changed pass-through entities into (effectively) _negative pass through entities_ for up to 20% of before tax earnings ? And I think this is for "draw" or "dividend" income that you extract from the entity ?

So it's like santa claus came and gave me an enormous gift that I never even dreamed of asking for ?

There must be something I am missing here ...

<comment><USER8> No, there's not.

It's something I was discussing with an accountant when these tax proposals were first being discussed. The accountant _would not accept_ what I was describing as their proposed pass-through treatment of income because it would be _ludicrous_.

Ultimately, though, that's what they did. I get a _huge_ tax break that I don't want and don't need, because we happened to structure our business as a partnership instead of an LLC.

<comment><USER6> I'll take it off your hands! I just sent my name and address to you via PM, but let me know if you'd prefer to send through PayPal instead of a check.

<comment><USER8> No thanks!

I'm going to put it into a savings account or low risk investment, and write a check to the US Treasury at a time when I have more faith in the federal government.

<comment><USER6> So... you do want the huge tax break then?

Hopefully you'll consider donating at least some (perhaps even all) of that tax break money to a homeless shelter or a food bank, maybe an animal shelter as well, especially this time of the year. That would definitely make that money go much further than it would if you paid it in taxes or sent it to the Treasury, be it this year or 10 years from now.

</comment></comment></comment></comment></comment><comment><USER13> Fairly sure some of these calculations are wrong or I need to get a new tax person. There is no way I will pay as little on the current bill as they think. I think it is making the current plan look way better than what I would actually pay and have been paying. This makes me distrust the what I would pay part.

Edit. In fact both of the numbers for both plans are way less than any tax bill I have seen in the last few years. I would honestly take either of those over that I actually pay.

<comment><USER14> In my case, the federal tax bill amount shown is ~1/3 of my actual.

<comment><USER9> Are both of you incorrectly taking into account payroll taxes or AMT or state and local? It seems accurate to me.

<comment><USER13> I am only looking at my federal tax bill. That being said the site seems to be giving me different numbers now that I am on a computer at home. I checked my phone (still had the tab open) and it was showing near half what the site is showing now. But now the site shows the new tax bill will save me money, when before it said I would pay more.

The numbers I am getting on my computer are closer to the real numbers for the current plan.

As far as somebody saying "current tax bill saved zero" being weird. Yea it is weird but not really an issue. Keeping the same plan won't save you anything, I would be more upset if it tried to suggest it did save you something.

</comment></comment></comment></comment><comment><USER15> The big unknown with this tax bill, is how the states will react. My adjusted gross income goes up substantially because of the elimination of the personal exemption, but my child tax credits offset this - but only at the federal level.

However, at the state level (in Minnesota), I get no child tax credits. This means I suddenly have a 10% increase in my AGI (with no corresponding increase in gross income to show for it) that will suddenly be taxable at the state level, because state taxes are keyed off of federal AGI.

</comment><comment><USER16> According to this I'm saving quite a bit. _This year._ Next year, not so much. Year after that, even less. It's like if I offered you a job at a really nice starting salary, but decreasing over the next few years to even less than you make already. Apparently a lot of people are stupid enough to accept that deal, and the folks in DC are dishonest enough to offer it. That's even before we consider how things will look in ten more years, as the deficit interest piles up and everyone's earning power is less than it would have been with a healthier economy.

</comment><comment><USER17> This is totally wrong. It doesn't take AMT into consideration at higher salary levels in the current tax system.

<comment><USER11> If you are in high-income, it links to a page that tells you how to figure out AMT yourself.</comment></comment>


Make Your Own URL Shortening Service - <AUTHOR> http://lifehacker.com/5335216/make-your-own-url-shortening-service

<comment><USER2> One URL shortening service is too many. Do we really need everyone making their own?</comment>


Reviewing the worst piece of code ever - <AUTHOR> https://www.micheleriva.it/posts/2020-07-31-reviewing-the-worst-piece-of-code-ever <comment><USER2> Ha, this is nothing. We once fired a programmer and had her turn over her code after she failed to turn any work in after a few months. Her code was atrocious and also none of it worked...or even was runnable. The biggest sin was that she wrote all of her code in MS-Word, smart-quotes and all on all the literals. Never once ever tried to run or test any code, just thousands of lines of useless stuff that "looked" like code.

Oh yeah, she's also an adjunct CS professor at a local college.

<comment><USER3> > We once fired a programmer and had her turn over her code after she failed > to turn any work in after a few months

How did that go un-noticed for months?

<comment><USER4> We had a guy who, after a month of sitting smack-dab in the center of the IT department being busy on his new MacBook, got caught with his pants down because he finally asked for help, and me and a bunch of other devs stood behind him watched in horror as we discovered that not only did he know nothing about programming, he didn't know /any/ keyboard shortcuts.

When we asked him to copy some code from one file to another, he'd click on 'edit' and 'copy', struggle to get to the other file, and then click on 'edit' and 'paste'.

How it went unnoticed is that we were all busy with our own stuff, he was put on some small project that none of us were working on, and we just assumed that nobody would be stupid enough to hire someone without at least /some/ vetting.

He slipped through the cracks because he got hired into another department, and when they found out that he'd worked as a 'developer' at Microsoft they figured he'd be more useful in our department.

In hindsight I feel I should've known something wasn't quite right when every time I walked past his brand-new MacBook, he seemed to /really/ be struggling with something and it never looked like it was code. I imagine he spent the entire month figuring out how to deal with not having a 'start' button.

EDIT: I'll add that while this was in my top 10 of worst situations, there are many others that, for me, provided a convincing argument against the idea that corporations are somehow more efficient or whatever than the government.

My experience with both the public and private sector, beyond a certain size at least, is that they're largely similar in wastefulness/inefficiency/idiocy/etc.

<comment><USER5> That's what I felt like when ai joined a company that issued me a macbook for the first time. There's nothing quite like demonstrating your code to somebody and having the conversation turn into a tutorial on cmd vs ctrl keys. It was probably only a week or two before I had it mostly worked out, but the imposter syndrome was pretty bad for a while. I can imagine falling into the same trap as the fellow in your story if I had trouble with the code too. At some point you start thinking that anything you say will out you so you just shut up and hope to delay the inevitable.

<comment><USER6> Been the same for me using a Windows PC on work having a Mac home.

having different keymappings in different machines is hard

<comment><USER7> I was okay when I had the proper keyboard in front of me, but I still stumble with reflexively using the correct keys for shortcuts when I'm remote controlling one from the other.

I've found it very difficult to use Ctrl+C to copy from Windows and then Cmd+V to paste on Mac OS without pretty frequently using the wrong modifier key.

<comment><USER6> Also, Hyper.app has ctrl+shift+v/c for copy paste, Git-ui has some weird shit like alt-shift-fn-c/v too LOL...

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Code formatting is indeed minor here compared to the rest, but you missed the one that popped out at me: The opening curly braces are sometimes on the same line as the condition, sometimes on the following line.

That said,

> I'm absolutely sure that the code above is fake.

> That's the first time that I see a synchronous SQL query:

      var accounts = apiService.sql(
        "SELECT * FROM users"
      );

Pretty sure you meant synchronous ajax/web request rather than sql query. This could be old code, because it totally used the be a thing: [https://developer.mozilla.org/en- US/docs/Web/API/XMLHttpRequ...](https://developer.mozilla.org/en- US/docs/Web/API/XMLHttpRequest/Synchronous_and_Asynchronous_Requests#Synchronous_request)

Edit: Actually hell, it still works, at least in Firefox. It just also logs the deprecation warning mentioned on that page. I thought this was already removed.

<comment><USER9> Funny I almost commented that you must be mistaken because it would be positively insane to support synchronous requests. Wow, that is insane.

In the end, synchronization can be achieved by busy waiting. So the implementation of apiService.sql() could just rely on that even if the browser API didn't support it.

The code still looks fake to me. Because you have to know quite a bit to create a combination of fails like that. Natural bad code I've seen is less purposefully structured. But maybe I just haven't been exposed to this type.

<comment><USER8> > In the end, synchronization can be achieved by busy waiting. So the > implementation of apiService.sql() could just rely on that even if the > browser API didn't support it.

I haven't tested this, but I don't think it can. The result callback doesn't have a chance to run if there's a busy loop - javascript is single-threaded, and callbacks only fire when idle (think cooperative multitasking, not preemptive multitasking).

Webworkers may get around this, but I've not used them and am not sure of the details on how they work. A quick look at a guide indicates they still rely on event callbacks in the main thread, so if my thought above is right, it looks like they wouldn't work either.

<comment><USER9> It's true! I tested it because I thought it would be possible to just wait for readyState == 4 in a loop. My assumption was that XMLHttpRequest runs in another thread once you do send() on it. And indeed, the request starts immediately. But the instance of XMLHttpRequest doesn't get updated until control is yielded. So you can't get the goods. All considered, that is a good thing :-)

</comment></comment></comment></comment><comment><USER10> One bit of awfulness the article missed: Rather than scanning for the username and then checking whether the password is correct, it scans for a match on both username _and_ password. So if you have the right username but the wrong password, it still has to check _every single_ username to conclude this; it won't stop when it gets to the username you entered.

I mean, not that it should be scanning through a list to find the right username, but still...

(And yeah, I suppose that would allow for some sort of username enumeration via a timing attack, but somehow I don't think that's the reason they didn't do that here...)

<comment><USER11> You assume that username are unique in this DB, maybe they support multiple password :)

<comment><USER12> What a neat feature ;)

<comment><USER13> If you forget a new password, you can create a new one, and then if you remember the old password later, you can use both. Is this so different in principle from supporting multiple methods of authentication? :D

</comment></comment></comment></comment><comment><USER14> A colleague of mine once turned in A FULL JAVA APPLICATION all written in the static void main method. Using booleans in databases polled at 25k/s to check for completion of async tasks. Worst is, it was working. I spent 6 months rewriting it, using it as a black blox to recreate the same system, including bugs because we were interfacing with other systems.

Infuriating given that we were a team people team, but also a great deal of fun from the engineering's side.

EDIT: Forgot to mention I was the junior dev and he had in excess of 15 years of experience :D

<comment><USER15> A company I worked for acquired another company. When we finally got access to their code it was in two files: source.cpp and source2.cpp. The latter was introduced when they reached some limit of the visual c++ compiler at the time.

<comment><USER14> Holy cow hahaha.

</comment></comment></comment><comment><USER16> Hilarious, and a great breakdown of what's wrong with the code!

But also, in an article calling out programming falsehoods, this snippet is a bit odd:

> Even if apiService.sql returns a value synchronously (which I doubt), > internally it have to open a connection to a database, make a query and send > back the response, which (as you may have guessed) can't be synchronous.

Sure it can, it's dead simple to write an API that accepts a database query and returns the result synchronously.

<comment><USER17> But how would you call this API from the browser synchronously? I guess in theory there is a synchronous XHR call but I've never seen it used. That could be something you add to the problems.

<comment><USER8> In the early days of ajax proliferation, I remember reading blog posts where people recommended synchronous XHR to keep your code linear, instead of trying to understand callbacks, which would make the code too complicated.

<comment><USER18> Obviously crazy advice that the current generation of Javascript programmers was wise to disregard. /s

<comment><USER19> Well, yeah. You have one thread to work with in the browser, and if you tie it up with a synchronous XHR your application freezes until the request finishes.

</comment></comment></comment></comment></comment><comment><USER20> I've seen something like this before that allowed login with any password as long as you gave a valid user name:

> if (hash(password == hashedPassword)) { login(username); }

"Don't write your own hash function" is common advice, but I would go much further and say don't write anything to do with passwords, logins, roles or sessions etc. if you can because one small mistake is all it takes to create a huge security hole.

<comment><USER21> Does anyone have any experience with password-less login? Like were you just do the other half of a 2fa like an email? And I mean both experience as a consumer or developer.

I feel like if I were to have a service that required log in that's how I would do it, but with all the talking about it I've never actually seen it in the wild.

<comment><USER22> This is how Hack Club Bank works. You enter your email, then wait for the 6 digit code emailed to you. No passwords at all.

</comment></comment></comment><comment><USER23> According to a reddit thread [1] from a few years ago, this is from an internal application, though on a public facing server.

Still, I agree with one of the posts on reddit, this is a decent ice breaker interview question to see how many problems the candidate can find.

[1] [https://www.reddit.com/r/programminghorror/comments/66klvc/t...](https://www.reddit.com/r/programminghorror/comments/66klvc/this_javascript_code_powers_a_1500_user_intranet/)

</comment><comment><USER24> This is genuinely stupid code from a first-week-junior dev who is still learning a lot.

The worst code i've ever seen was a PHP function that printed a menu (with relative permissions) from a database. Problem: it was O(n^3), 200 lines long, completely unmantainable and with random fails. Problem n° 2: it was written by our "best" programmer. It took me one hour to rewrite that into a 10 lines O(nlogn) function that my PM didn't want to use inside the framework because it was my first week.

<comment><USER25> i hope you left before the 2nd week!

</comment></comment><comment><USER26> But the employer wanted a full-stack developer, everything else is just details!

I've seen worse code than this. How about a hard coded backdoor check that looked like: || pw == "debug0"

<comment><USER4> Hmm. I have hard-coded superusers for an app that are based on email address (where email is the login username). I'd love to hear from the HN experts if that is a very bad idea and how to do it better.

(initially I had a 'superuser' permission that would sort of short-circuit the permission system, but I felt really uncomfortably about how much that affected my code. I figured having compile-time hard-coded superusers per-app- instance would make more sense).

<comment><USER26> I think its a bad idea to hard-code anything like that.

If you have to do it then accept it as a command-line argument or read it from a config file - at least then it can be backed-out with an application restart instead of a recompile.

<comment><USER26> Oh and it also becomes more obvious for people who may not have access to the source code that its there!

</comment></comment></comment></comment><comment><USER27> But the dev made 15 commits this week and knocked out 5 Trello tasks. All tests pass. Top performer.

</comment><comment><USER28> TBH if this is the "worst code you've ever seen", bless you sweet summer child.

<comment><USER29> Right? I suppose he/she is focusing on the naive authentication piece, but I honestly thought most of the code was clean and sensible (the dev is just inexperienced). I'd rather teach this person the technology than someone who constructs labyrinth-like mental models, but knows the technology. They are code terror incarnate.

There are many people that could take that simple function, split it across three files, with various events being dispatched, with "elegant" switch cases, and over abstracted utility functions all over the place. These are the minds I fear, these monsters will eat your sanity with their contraptions.

You know nothing Jon Snow, this code is good. I know what the person was trying to do, and it can mostly be solved. Please purchase a ticket to a few React apps, or a home grown php framework. Then we'll talk. You have not met a real mind eater yet.

</comment></comment><comment><USER30> > Here we can see the use of the double quotes for writing strings ... Here we > can see single quotes ... This may not look important, but it's actually > telling us that the developer has probably copied some code from > StackOverflow without even rewriting it following a common style guide for > the whole codebase.

I have a habit of mixing double and single quotes, depending on what side of bed I woke up on. Doesn't mean I copied my code from Stackoverflow.

<comment><USER31> Same. It's very easy to mix them, sometimes on lines entered minutes apart. I'm used to double quotes in C#, C++, Rust, etc. so it's just my natural fallback when coding in Python. I find myself doing it with SQL occasionally too, but there it's quite obvious right after entering the double quote since the string syntax highlighting doesn't kick in.

<comment> mark-r I don't seem to have a problem with context switching. I use C++ 90% of the time, but in Python I use single quotes just because I'm too lazy to use the Shift key.

</comment></comment></comment><comment><USER21> Does anyone have any experience with password-less login? Like were you just do the other half of a 2fa like an email? And I mean both experience as a consumer or developer.

I feel like if I were to make a service that required log in that's how I would do it, but with all the talking about it I've never actually seen it in the wild.

<comment><USER32> Discord is using user/password but every time I want to log in it says my IP- adress has changed and I have to use my email to verify my location. So it's basically the same as password-less email-login.

That's terribly annoying to me as a consumer so please don't do it.

<comment><USER33> I lost a discord account by forgetting to change my email address when sunsetting a domain then getting a new phone.

</comment></comment></comment><comment><USER34> Not the worst, though. It maybe insecure because the app was intended for internal use.

I did, however, see some shitty stuff in my job. Like, someone iterates a hashtable to find a key. I didn't even know what to explain to that person when I reviewed the code.

</comment><comment><USER35> This is a piece of jewelry, compared to what I've seen.

Our team was called in to help on a strange case. An important organization had corruption in the management and they had contracted a mission-critical service, one that created income, to someone.

The code was written in asp (the project has started in 2016, 16 years after the last release). Database tables where named table_01 to table_36, columns named Column_01 to whatever. All values stored in database were "encrypted" using base64 most files where 10,000+ lines of repeated code, no modularity, no naming convention, not DRY.

All the income from the orders went to the programmer's personal bank account. The money would then be wired to the right companies.

Well, this was just the beginning, the code was much worse, I cannot bring any examples as I don't have the code and don't remember, but suffice to say that even though we had made our minds that we're going to handle this mess, but faced much much worse problem than we expected.

We came up with a smooth plan to transition to a good state.

Meanwhile, the corrupt management had been lobbying, got reinstated, made the version 2 contract with the same guy and the team I consulted was asked to just keep the version 1 running while the genius is coming up with more brilliant ways to write version 2 of pure shit.

</comment><comment><USER36> I'm sure most of us have seen far worse and more nonsensical code, it's a nicely designed snippet to teach basic security issues and show silly mistakes though.

</comment><comment><USER37> I call bs on the code being real, because of triple equal operator. Doubt this developer would know such thing.

<comment><USER38> Every JS IDE warns you about that so I could see a developer correcting the warning.

<comment><USER39> Do you think this dev uses an IDE?

</comment></comment></comment><comment><USER40> I just saw an atrocious piece of Perl code that controls the flow of shipping containers for several large corporations. It's completely unmaintainable and only the original author has the complete picture.

He was originally a trucker on office duty because of health issues. In the office he saw lots of inefficient thing so he bought a copy of "Perl for Dummies" and started fixing.

The product itself is actually a huge success. No developer is willing to stay, though, so the guy just picks other people from the office and teaches them what he thinks is Perl.

</comment><comment> Seb-C I have seen way worse than this.

In a "corporate [bull]shit" setting, I could easily imagine scenarios where the synchronous client-side query could make sense and be the best available option. Thankfully I have escaped this kind of workplace long ago.

The worse codebases IMHO are the ones that have random associative arrays that are exchanged and mutated randomly in any part of the code. Give it a few years of maintenance by bad developers, and you end up with a mess of conditional workarounds and variables that can contain up to a dozen of different data structures with inconsistent properties.

</comment><comment><USER41> I swear, I conducted an interview once where the candidate actually did this (tho it was server side).

They could write fizzbuzz tho.

</comment><comment><USER42> I can only suggest you to spend some time on thedailywtf.com ... it can be frustating as much as hilarious

</comment><comment><USER43> Hold up.

The expectation of junior developers seems pretty low. I think I've been job seeking below my mark...

<comment><USER44> Yes, this is beyond incompetent. Even someone without any programming knowledge would probably know that you can't have an API for checking the username and password combinations of all users.

</comment></comment><comment><USER45> 1\. SQL injection as a service.

2\. It should implement this logic server-side.

3\. No hashing + salting of passwords.

4\. It should retrieve one user at a time, rather than all of them.

5\. Not understanding basic control flow.

...

There was probably a presentation about this project, where the author received a round of applause. This person was likely promoted for finishing this project in record-time.

The developer that spent time reporting the issue lowered their own performance metrics in exchange for a bug report that was given a low priority. When the developer objected to the prioritization, the project leadership got pissed off and punished the developer evaluation citing reasons such as "does not align with business needs", "has poor communication skills" (talks abstract things that nobody understands or cares about).

By the time this defect was found and fixed, the author likely pushed 10 different other defects just like this. Also, other engineers copied and pasted this code multiple times because it's working and has unit tests.

<comment><USER46> Were you going for a comic effect or tragic?

<comment><USER45> Is Office Space a comedy or a documentary?

<comment><USER47> ... yes.

</comment></comment></comment></comment><comment><USER48> Anyone else find the quotation marks in the original picture suspicious?

Especially around:

      if ("true" === "true") {
        return false;
      }

</comment><comment><USER49> This can't be real, it seems to be especially crafted to break most if not all common-sense programming rules...

</comment><comment><USER50> I like how everyone's answering questions about someone's personal experience with even more personal experience, I'm not being sarcastic, keep them coming, please.

</comment><comment><USER51> "Just throw more hardware at it."

</comment><comment><USER52> > _... why they're not hashing passwords inside of their database?_

Sending passwords plaintext over the wire isn't good either, even with TLS. You don't want your server to have any knowledge of the plaintext password. For that reason, it's a good idea to salt and hash passwords client-side as well.

An even better idea is to not roll your own authentication if you can help it.

<comment><USER53> > Sending passwords plaintext over the wire isn't good either, even with TLS. > You don't want your server to have any knowledge of the plaintext password.

This is literally impossible to avoid. Whatever the server receives, that's what the password is.

<comment><USER54> This is literally untrue. Zero-knowledge comparison protocols exist [1], and their goal is to prevent malicious party from obtaining any knowledge of the secret. Yes, the _genuine_ server will have its copy of the password (or its hash, whatever) and the user will have their copy of the password too. What you don't want is to have the user send their copy of the password to a place which looks like your server but isn't.

[1]: [https://www.cossacklabs.com/files/secure-comparator-paper- re...](https://www.cossacklabs.com/files/secure-comparator-paper-rev12.pdf)

EDIT: I mean, yeah, you're right in the sense that whatever you send to the server is used to authenticate you, so that whatever is a 'password' of a sort by definition. However, using the raw password as is for authentication is not a great idea. If you intercept the password, you will be able to compromise any further authentications. There are alternatives that avoid this.

<comment><USER55> Another alternative is a PAKE. You'll never have a password sent over the wire.

For some reason PAKE schemes aren't that commonly used despite having a solid grounding. Matthew Green has a few good articles on them.

<comment><USER53> > You'll never have a password sent over the wire.

As far as I can see, you do need to send the full password over the wire once when you set its value. But the server doesn't need to remember it.

> For some reason PAKE schemes aren't that commonly used despite having a > solid grounding.

It doesn't look like something you can implement unilaterally. How's browser support?

(Interestingly, I guess you could implement it unilaterally between your server and client-side javascript...)

<comment><USER55> I'm not sure if this is coming down to semantics here but the password is essentially encrypted to everyone except the client, I wouldn't call that sending a password over the wire, you may disagree. This is a unique value for every login attempt.

Probably the most common scheme is SRP.

[https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)

<comment><USER53> No, you're right; I wasn't talking about login attempts. I was thinking that PAKE is a way to establish that two parties have common knowledge of a shared secret, and so the password needs to be shared once in order to become a shared secret. But the protocol you link doesn't transfer the password even when setting it.

(Weirdly, the article explicitly notes that s, the salt Carol applies to her own password, is shared with the server and sent over the wire during login. But the salt never appears to be used by the server in any capacity.

And the instruction "Carol must not share x with anybody, and must safely erase it at this step, because it is equivalent to the plaintext password p" doesn't make a lot of sense; presumably Carol isn't going to erase her knowledge of her password -- what does erasing x add?

[The only thing making the password equivalent to x is that the server transmits the value s during the login attempt. If it didn't do that, x would still be useful, but the "password" would be worthless, unless of course s was stored alongside the password...])

</comment></comment></comment></comment></comment></comment></comment><comment><USER56> Honest question, is code a very important part of our job as a developers, seniors or junriors? I truly think about code as an implementation details, I don't really care how the code looks as soon as is quality tested (and cross- functionally testes, ie: security). I agree with the sense of the article in general, this code lacks basic engineering/programming concepts, but I generally disagree on the fact that code as a piece of text that execute a software have any meaning of "beauty" standard as such. Code is just the way we have in this specific moment in time to describe the solution of a problem, very far from being the only one ore the "final" one. Therefore I would not invest much time in putting lipstick on cows.

<comment><USER57> In short. Yes. Most code needs to be maintained and understood(!), so having some semblance of standardization (in its many forms) usually provides benefits to the stakeholders.

And to address your last sentence, I think it's important to understand that for a skilled engineer it _does not necessarily_ take more time to write better code!

<comment><USER56> I totally agree with you on the fact that for a skilled engineer good code does not comes with a bigger cognitive load (nor time spent). But I would like to challenge your point on writing maintainable and understandable code. One can argue that writing maintainable code following the best practices it's just a set of conventions that are useful just because we have no better solution right now. It's a solution that works but can be very well be improved for instance by removing the needs of writing code in the first place (ie: with some very advanced level of code generation). About the understanding bit I usually look at tests for understanding code, it's easier for me to read an English statement that tells me what a things does rather then trying to understand it starting from how the problem has been solved in details. Code is for machines, "it should do this" is for humans.

<comment><USER57> Surely one must actually improve upon the current conventions before dismissing them, no?

Similarly the field is called computer _science_. Not every convention an engineer follows is simply because "we have yet to find a better one". I can certainly agree that the landscape has and will continue to change over time, but there are some truths when it comes to designing systems.

As for gleaning understanding, tests are useful for learning "what" a system is meant to do, but wholly meaningless when we need to know "how". Often the latter becomes the important bit when we need to extend/modify code.

I agree that there is a balance to be had. Not every LoC or module needs to be perfect. It's often more important (and practical) to choose a suitable level of abstraction, and make sure that the code _at that level_ has an amount of agreed upon standardization.</comment></comment></comment></comment>


House of Lords criticises right-to-be-forgotten laws as 'unworkable' - <AUTHOR> http://www.independent.co.uk/life-style/gadgets-and-tech/house-of-lords-criticises-righttobeforgotten-laws-as-unworkable-and-wrong-in-principle-9637498.html

<comment><AUTHOR> I link to this version of the story because of this:

> "We think there is a very strong argument that, in the new regulation, > search engines should not be classed as data controllers, and therefore not > liable as 'owners' of the information they are linking to. We also do not > believe that individuals should have a right to have links to accurate and > lawfully available information about them removed, simply because they do > not like what is said."

The first sentence is a perverse interpretation of current UK law.

Actual full title is "House of Lords criticises right-to-be-forgotten laws as 'unworkable and wrong in principle'"

See also [http://www.telegraph.co.uk/technology/news/10998382/Right- to...](http://www.telegraph.co.uk/technology/news/10998382/Right-to-be- forgotten-is-unworkable-say-peers.html)

and [http://www.theguardian.com/technology/2014/jul/30/lords- righ...](http://www.theguardian.com/technology/2014/jul/30/lords-right-to-be- forgotten-ruling-unworkable)

None of these articles mention the fact that Google refused to give evidence to the upper house of English legislature in public, and would only give evidence if they could do so in private.</comment>