Cookie Warning Shenanigans Have Got to Stop - <AUTHOR> https://www.troyhunt.com/these-cookie-warning-shenanigans-have-got-to-stop/ <comment><USER2> In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning;

Clicking 'no' should still allow people to view the website, but without placing any tracking cookies.

Source (in Dutch): [https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites- moe...](https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten- toegankelijk-blijven-bij-weigeren-tracking-cookies)

<comment><USER3> Hmm, there are features that one literally can't provide without state (cookies).

I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking.

There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is true that cookies are the _easiest_ (if not the only) way to do the other; but making "cookies" the thing that gets effectively "regulated"... I realize this isn't necessarily the intent of the regulations, but I'm suggesting it's part of what results in the situation troy mentions. There are very few sites that don't use cookies; there are or at least could be more sites that don't track you in a privacy-compromising way, to train the user that this is the same thing is just too much noise for the user to actually make any discernments.

<comment><USER4> > Hmm, there are features that one literally can't provide without state > (cookies).

The biggest lie in most cookie warning popups is that you need to accept them for the site to function. It is often not true. Those are session cookies and you don't need to warn users about them, they're just allowed.

I didn't know this, and neither do any of the cookie warnings mention this. So like many people I thought the cookie law was the stupidest thing ever because like you say, you gotta have state. But the session cookies used to make a site hold state, those aren't considered tracking. When I learned about this little fact, it changed my opinion about the cookie law considerably.

<comment><USER5> I went through a similar thing which resulted in me removing cookie warnings from all but one of the websites I manage, yet I still believe that the law is stupid. It's like outlawing guns to solve your murder problem without considering all the other murder weapons all while keeping the act of murder itself legal.

As far as I understand it, the GDPR does everything and more than the cookie law was supposed to, so IMO it's about time we put that disaster behind us.

<comment><USER6> The directive containing the cookie law (ePrivacy) was indeed being revised in 2017. I haven't heard much about it since though. It Essentially enshrined the Do Not Track header into law and also expanded the rules for privacy etc of sms to internet messeging services. I wonder how much of the information in this thread is about the original directive and how much is about the new one.

</comment></comment></comment></comment></comment><comment><AUTHOR> To add insult to injury the big players with most trackers just refuse to show the cookie warnings at all. At least that's the situation Germany where most major news outlets are full of ads and trackers and handle all of it via opt- out(!) in the privacy policy. For a example see spiegel.de, the most widely read German-language news website.

It's mostly small and medium sized firms that show the cookie warning out of fear. That's completely the opposite of what I want as a consumer as well as a small-time webmaster.

EDIT: Just to be clear: spiegel.de never shows a cookie warning even if visit with a fresh browser. You can opt out by visiting their privacy page [1] (in English).

[1] [http://m.spiegel.de/extra/what-we-do-with-your- data-a-121194...](http://m.spiegel.de/extra/what-we-do-with-your- data-a-1211940.html)

<comment><USER7> Anyone who didn't see this as the predictable end-result of requiring cookie awareness and consent was hopelessly naive about how large vs. small organizations respond to unfunded government mandates.

The money and time could have been a lot better spent on international awareness campaigns arming consumers with more privacy knowledge instead of expecting website owners to shoulder the informational burden (because those orgs in aggregate have no core incentive to treat user's privacy as an inherent good).

<comment><USER8> These organizations _do_ have such an incentive. The very _essence_ of GDPR is to create these incentives. The EU's goal with GDPR was to make user data a _liability_ , and to encourage organizations to reconsider their need to hoover and hoard it.

The GDPR is unlikely to be overturned, and there are plenty in the EU who are eager to enforce it. Just because it's not being enforced right this second doesn't mean the law won't catch up to offenders.

Especially if Margrethe Vestager replaces Jean-Claude Juncker as president of the European Commission, you can expect a ton of action on this front.

<comment><USER9> > there are plenty in the EU who are eager to enforce it

But we haven't yet seen it enforced, have we?

<comment><USER10> [https://news.ycombinator.com/item?id=18416887](https://news.ycombinator.com/item?id=18416887)

</comment></comment></comment></comment></comment><comment><USER11> The omnipresent "Please accept our privacy policy (or leave)" is worthless cargo cult GDPR pseudo-compliance. If it's neither freely given nor informed, it's not consent under GDPR.

See Art. 7: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

See Recital 32: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data ... This could include ticking a box when visiting an internet website ... Silence, pre- ticked boxes or inactivity should not therefore constitute consent."

If you want to use external tracking and be GDPR-compliant, you _must_ offer a clear choice ("yes/no") and you _must not_ use pre-ticked boxes (i.e. an opt- out approach).

Please feel free to downvote this if you don't like it, but I'm merely telling you what the law says. If you disagree factually, I'd appreciate a comment though.

<comment><USER12> > If you want to use external tracking and be GDPR-compliant, you must offer a > clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt- > out approach)

Exactly this. Basically what the GDPR says is: if your business doesn't require the data, you cant use it without the user's consent. And data used for better advertising is NOT essential to e.g. a news site.

What's more, the regulation syas that you can NOT simply say "accept or leave" in that case. You then have to provide the service to the user _without_ storing that non essential data. You can't provide a service, even for free, that you condition on storing data not essential for that service. There is no "if you don't like it, leave" clause.

Basically: spiegel.de has to be prepared to show their news to anyone, including those that do not wish to be tracked by their ads. Right now we are in a period of denial where site owners believe they can have these "By entering you agree to..." banners. Once the first large fines are handed out, It'll be fun to watch.

<comment><USER13> This is the view of a US person: These are private owned and operated web sites. The site owner determines what is "essential." If you do not agree to to the terms, do not use the site. If you don't want to be tracked for advertising, that's on you to install ad blockers.

<comment><USER14> Are you allowed to sell your kidney in the US? (No, you aren't.)

This means that a site operator can't offer you access to a super awesome news site in exchange for your kidney. They can't get away by saying "but you can choose not to use the site".

Well, Europe does the same thing for your personal data.

<comment><USER15> Trading a kidney for access to a news site would obviously be insane, and we should have laws to prevent insane people from harming themselves.

On the other hand, if a person of sound mind decided they would rather have $1,000,000 than both of their kidneys, why shouldn't they be able to sell one, logically?

The idea of selling one's organs sets off the human involuntary disgust/outrage reaction ("of COURSE it should be illegal! how DARE you suggest such a thing?!"), but if we put that aside, is there a _rational_ reason it shouldn't be allowed?

<comment><USER16> Yes: it protects the poor and weak.

Thought experiment: a multi-billionaire wants to beat a human to death, and offers $10 million for it. A grandfather decides he would like to take that offer, for his children and grandchildren. Would you allow that?

If you also would not allow it (that's what I hope), then where is the proper boundary? What should we outlaw, and what allow?

<comment><USER17> If the grandfather consents to it, then what is actually wrong with him taking up that offer?

Your thought experiment (or at least your "hope" re: the "correct" answer) presupposes that suicide is wrong. Personally, I believe the only one who is allowed to dictate whether I live or die is myself; if I want to die, and have good reason to want to die (financial security for my children and grandchildren would certainly be compelling!), then that's _my_ right, and it ain't your place to deny me that right.

<comment><USER16> No, it doesn't tell anything about suicide.

It is about the question: should one be allowed to _buy_ everything, or are there limits? To emphasize: NOT should one be allowed to _sell_ everything.

<comment><USER17> But those are fundamentally intertwined. If nobody's allowed to buy something, then how is anyone expected to be allowed to sell something? A purchase and sale are not independent events.

<comment><USER16> I fully agree. But still it makes a difference from a moral analysis point of view, because my aim is to condemn the buyer, and don't judge the seller.

So now you have to convince me that buying the right to beat someone to death is a morally justifiable action. It is not sufficient for you to judge selling as justifiable to make your point. I actually agree that selling is morally justifiable, and would never vote to make this a punishable offense.

<comment><USER17> Like I mentioned in another branch of this thread, if selling is allowed, then it would be immoral to _not_ allow buying; punishing someone for buying something that's legal to sell would be entrapment.

In fact, doing so might even pass that immorality down to the grandfather seeking compensation for his suicide; if he's aware of the illegality of buying his life, and yet exercises his right to sell it anyway, then at best it's a meaningless gesture and at worst he's complicit in entrapping prospective buyers.

That's what I mean when I say buying and selling are intertwined. Without one, you can't have the other. If one is moral, the other must be moral as well. If one is immoral, the other must be immoral as well. Attempting to carve out an exception is inevitably going to run into all sorts of moralistic and/or logical snags.

<comment><USER16> Let me try to repeat your argument: whenever something is morally allowed for an individual, the moral system must ensure that the individual actually can do it.

This does not stand on its own, you need to provide a good argument why a moral system should be designed such that everything which is allowed can also actually be done. In particular, because our current system is not designed that way.

And even if you find such an argument, we end up with a moral dilemma, as long as you can't argue that buying is morally good _in itself_.

<comment><USER17> "whenever something is morally allowed for an individual, the moral system must ensure that the individual actually can do it"

More like "whenever one of an inherently-coupled pair of actions is morally allowed, the other of those actions is morally allowed". A moral system which allows one and not the other is self-contradictory.

In this case, a moral system which permits the right to sell a life but denies the right to buy a life self-contradicts; unless you believe that it's moral to trick someone into committing an immoral act (I do not), any attempt to exercise the right to sell one's own life would be inherently immoral because of the impossibility of doing so without causing someone else to perform an immoral act. The only way for the sale of one's own life to be moral is for the corresponding purchase to also be moral.

"we end up with a moral dilemma"

Only if you insist that buying is wrong while also insisting that selling is not wrong. When both are right or both are wrong, then there is no such self- contradiction.

<comment><USER16> > "whenever one of an inherently-coupled pair of actions is morally allowed, > the other of those actions is morally allowed".

Why does that follow? I could understand it for actions you are morally _obliged_ to do, but I fail to see why it follows for actions which are merely _allowed_.

A 6-year old boy is allowed to fall in love with his teacher, but she is not allowed to fall in love with him, so his love - even though morally allowed - can never be fulfilled. That is a perfectly fine situation, from a moral point of view.

<comment><USER17> A 6-year-old is not capable of informed consent. A 60-year-old man is.

<comment><USER16> Now you are discussing another topic.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> This shows utter incompetence and detachment from reality by European legislators. Maybe it seemed like good idea in theory but the only practical significant impact is that browsing the web has become more annoying.

Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes?

<comment><USER19> How do you remember that a customer has responded to a popup if you don't give them a cookie? Even a cookie as a session identifier.

<comment><USER20> "Cookies" are mentioned only once in GDPR, in a long list of examples. They're not targeted specifically.

The law talks about _information that can be used to identify a person_.

So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance.

<comment><USER21> > So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance.

I wouldn't be so certain about that. Before now, most people were pretty certain that an accept/decline warning was enough and that they had the right to refuse service to people who did not click OK on the warning.

<comment><USER22> If anyone believed that, they did not research more than 10 minutes.

This comes up in _every_ discussion about GDPR.

I honestly worry - are we as developers just extra stupid, or are other occupations (electricians, ship captains, architects) equally lax when it comes to reading and following regulations?

<comment><USER23> Those other occupations have been regulated for a long time, so the training and verification practices have had time to mature. This is still the early days of software development regulation, so there's not much history or tradition to fall back on -- I'm pretty sure that all the other industries had similar problems when their first regulations were enacted.

</comment></comment></comment></comment></comment></comment><comment><USER24> The problem isn't dumb ol' grandpa EU's folly lawmaking. The lawmaking is on point and the cookie banners are the problem - not the symptom. EU regulations are trying to _eliminate_ privacy-invasive practices like tracking. It's not about making users aware that they're being tracked. It's about making businesses cut that shit out.

Of course, on HN I have to acknowledge that half of the users on this website get their paychecks from invading the privacy of the general public. If you fall into this category: what you're doing has always been wrong and now the law is catching up to that.

<comment><USER25> It doesn't matter what they're _trying_ to do. What matters is what actually ends up happening. The socialists in the Soviet Union tried to improve things as well.

It's also quite ironic that the EU now cares about privacy considering that a decade ago they passed the Data Retention Directive. I guess privacy didn't matter then, huh?

<comment><USER26> "It's also quite ironic that the EU now cares about privacy considering that a decade ago they passed the Data Retention Directive. I guess privacy didn't matter then, huh?"

This is a very astute observation, and is causing some angst among parts of the European population.

However, this seemingly conflicting behavior has a cultural rationale behind it.

In general, Europeans see government as trying to look out for their best interest, while they view corporate power with large skepticism. "Americans" hold the complete opposite view.

So when the governments in the EU tout sheepish clichés like "think about the children, catch terrorists, pedophiles" etc, by being able to retain data for those purposes, the public falls flat and lets Orwellian laws pass without much fuss. Because ... "the government is our ally, and we trust it, the claims, and that the data will be managed responsibly".

However, when corporations do the same, there's more fuss.

The one european people that is of sane mind here is those of germany, due to their history. Unfortunately germans are also deceived by their government through back-room deals on EU level, and with the national security excuse, when it can be kept out of the public eye; effect same as the other EU nations. The good thing however is that the german people are not as gullible as other parts of europe when it comes to surveilance and tracking, and they _do_ tend to kick up a _big_ fuss when this sh*t goes down. So they act as a sort of moral calibration for the other nations, such as mine.

Understanding this fundamentally different mindsets between US and European citizen will hopefully help explain quite a lot, for those who didn't already know this. This is why "american" views are insane to some europeans, and why EU is naive/retarded in the eyes of the US. (very generalized)

</comment></comment></comment><comment><USER27> (European)

Most sites have a simple 'Reject All' which I definitely use all the time.

Oath and it's sites are the devil incarnate when it comes to implementation and they deserve to be slapped down.

<comment><USER28> This is precisely it. It's not that the EU legislation is too restrictive, it's that it doesn't go far enough. Sites like these shouldn't be compliant, users should be prompted with a simple yes/no consent form without any dark patterns.

<comment><USER16> They are not compliant. The fining machinery is just being started, and it will take a while.

</comment></comment></comment><comment><USER29> _internet visitors must be asked for permission in advance for any tracking software to be placed — such as third-party tracking cookies; tracking pixels; and browser fingerprinting tech — and that that permission must be freely obtained... Is this really what we want?_

Yes. I'm not even European, and I'm perfectly fine with this.

Ask me to track me. If I like you, your web site, or your content, then sure. I'll give you a little personal data.

<comment><USER30> So once you've determined that you like a site you are going through the hassle of figuring out how you can reenable the tracking after you disabled it on your first visit?

<comment><USER31> "you've visited this site a few times recently. are you still okay with these settings? (if you ever change your mind, click privacy at the bottom of the page)"

just because we don't currently have solutions doesn't mean they aren't out there. i guarantee my 5 second developer definitely not UX idea is the LEAST that a real UX professional will come up with, when pushed

*EDIT: and yes this kind of cookie is okay with GDPR because it's not tracking a "data subject"... it's maybe a broad timestamp (the day you first accessed the site), and a counter for the number of articles/site loads... you don't have to ask for this permission, because you can't track someone with it

<comment><USER32> It can also be implemented purely on the client side: store the counter in the browser, increment on each visit, and prompt the user after N visits.

This way, no information about the client is sent to the server at all.

</comment></comment></comment></comment><comment><USER33> I am not a fan of the cookie banners at all. If anything I feel like browsers should implement it as it already does with other security settings (access to location, camera, etc…) and then people can decide to allow all websites. Blacklist, whitelist whatever. Why are we making every site implement a completely unique interface with different verbiage?

<comment><USER34> Because its done under legal compulsion rather than web standards good faith. Cookies predated the more democratic process by which the web evolves today, and it was outside the EUs power to just ask the likes of the dying Netscape / Microsoft / etc to all standardize on this feature at the spec level, especially when nobody was really much following web standards at all in the early 2000s.

All those settings in browsers that let you control access to your camera, location, etc aren't part of legal compliance, they are just there because Google, Mozilla, sometimes Apple and Microsoft all agreed this is a good best behavior to avoid getting regulated on again.

If the EU started mandating an opt-in system for camera access you can bet most websites would start dumping pop up banners about it regardless of if all the browsers supported the regulation already just to avoid culpability.

</comment></comment><comment><USER35> I find the clarification about cookie walls being out of compliance with GDPR to be a real headscratcher. Here's part of the Dutch authority's FAQs[0] thanks to Google Translate:

"At a cookie wall, website visitors have no real or free choice. It is true that they can refuse tracking cookies, but that is not possible without adverse consequences. Because refusing tracking cookies means that they cannot access the website. That is why cookie walls are prohibited under the AVG."

I find this fascinating. Is there really not a free choice to simply leave the website? A paywall is surely legal. But it is illegal for me to "pay" using something other than money.

Am I allowed to offer users additional functionality in exchange for access to their data?

[0] [https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...](https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet- telefoon-tv-en-post/cookies#mag-ik-als-organisatie-een-cookiewall- gebruiken-7111)

<comment><USER36> Of course you have a choice, but in reality who leaves a site because they see that warning? I imagine almost no one. Hell, I understand the implications and I don't care because site X has what I'm after and perhaps no one else does (or they all have the same warning anyway.) I have no reasonable option but to accept whatever these sites want.

The warnings accomplish nothing. It's just another nag screen. It was a bad idea when it was thought up and it still is today. It's an attempt to seal a wound (misuse of personal data) with a piece of string. It wasn't even a half decent band-aid.

<comment><USER7> ... and users appear to disagree on whether there's a wound to seal.

<comment><USER36> It's difficult for the average person to understand the long term implications of this sort of data collection. They don't realize how powerful all these little details can be when put together.

<comment><USER37> And there's another category of people that understand but don't care.

<comment><USER36> Not proud of it, but I fit somewhere in that bucket. I do consider it and I have made (slightly) inconventient choices in the name of privacy, but when it comes down to it, I typically say "screw it" because I want what I want.

<comment><USER37> Oh yeah, I'm definitely including myself in that bucket too.

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> It's not even clear to me how they actually work. Usually what I do when there's no "Deny" button (which is most of the time) is just leave the dialog open in hopes that that qualifies as "not accepting". But then some of them say "by continuing to use this site you agree". But, what does that even mean? Do they wait for a scroll event before setting the cookie, or is it there already before I even click "Agree", and the dialog does nothing whatsoever?

<comment><USER14> Legally, you haven't consented. They're of course tracking you anyways because they're too lazy/greedy to implement it properly, so you should use the usual security measures (adblocker, PrivacyBadger), but they're breaking the law.

It's just that there's too many people doing that for the overloaded DPAs to take care of them all.

</comment></comment><comment><USER39> I feel the same way about California Prop 65 warnings. Any overused warning will result in warning fatigue. We'll just blindly click that OK button or lick that pewter candle stick.

Look, it's even a real thing: [https://en.wikipedia.org/wiki/Alarm_fatigue](https://en.wikipedia.org/wiki/Alarm_fatigue)

</comment><comment><USER40> What I don't understand is why websites hosted outside the EU, for non-EU users have the cookie banners.

At least keep it in Europe, use the IP to geolocate, let the EU users deal it.

Some companies have outright banned EU traffic, sounds like only showing the banners for EU IPs seems ok.

<comment><USER41> The law doesn't just apply to pages being served to the EU, it applies to pages being served to EU citizens, wherever they happen to be at the moment.

So geolocation is not a satisfactory option.

<comment><USER42> > wherever they happen to be at the moment

In the vast majority of cases that's not how laws actually work from one nation to the next. That isn't how legal jurisdiction works. If it were, any nation could impose its laws on any other nation at any time.

> So geolocation is not a satisfactory option.

In fact it is. I can safely disregard the EU and nearly all of its laws including GDPR and privacy laws in the EU. I don't operate in the EU, either physically or in terms of hosting. They have no access to me, my finances, my business, and have zero jurisdiction over me as a US citizen. I'm bound by US law, not EU law.

I can do anything I want to with data from EU citizens that visit my US-based services, so long as I obey US laws. The exception to that is if I need to operate in the EU, then I should comply with EU law.

The EU also does not rule China (1.4 billion people, world's second largest economy), for a strong reference on how the EU's laws don't actually apply globally. While you're in China, as an EU citizen, you are not governed by EU law, you are governed by Chinese law. Give that a test run, you'll find out instantly how it works. If you visit sites located in China, they're going to obey Chinese law, not EU law. Millions of Chinese sites are not concerning themselves with GDPR compliance, because it does not apply to them at all.

<comment><USER43> Of course, if you fly to Paris for honeymoon they get access to you and can hold you responsible. Just like bankers coming to Las Vegas and being held responsible for aiding tax fraud overseas.

</comment></comment></comment></comment><comment><USER44> FTA he's quoting:

> And the Dutch DPA's guidance makes it clear internet visitors must be asked > for permission in advance for any tracking software to be placed — such as > third-party tracking cookies; tracking pixels; and browser fingerprinting > tech — and that that permission must be freely obtained. Ergo, a free choice > must be offered.

Neither cookies, nor tracking pixels, nor browser fingerprinting are software. Your web browser is software. The server side runs software. These are data.

It seems pedantic, but I think it shows that the lawmakers have an underlying misunderstanding of how tech (and the world) works.

To make an analogy, cookies and tracking pixels are akin to license plates. I think the authors of this law thought they were more like cellular GPS beacons.

It's one thing to say, "no installing a device which actively communicates home on your visitors". It's quite another to say, "No remembering your visitor's face unless they tell you it's ok."

<comment><USER45> Tracking cookies, pixels, etc., are implemented by server-side software; perhaps the matter you would like to contend is what the meaning of the word "placed" is.

<comment><USER46> Cookies are data that is placed on the visitor's computer. Tracking pixels are software instructions placed on the visitor's computer.

The tracking that is akin "remembering a face" is user agent and ip address tracking.

In my mind, a store that uses facial recognition software to track my movement within the store and purchasing habbits is still incredibly creepy and highly invasive of my privacy.

<comment><USER44> The government has automated license plate readers that do much the same thing. Their justification is, you're in a public place, you have no expectation of privacy. I'm a little more concerned about that.

If I don't want to be tracked, I can choose to shop at a different store. But I can't live in a system of underground tunnels.

<comment><USER16> In Germany, your privacy is protected in public places as well. A German court just recently ordered a German state to turn off an automated license plate reader: [http://www.spiegel.de/auto/aktuell/b6-streckenradar- verwaltu...](http://www.spiegel.de/auto/aktuell/b6-streckenradar- verwaltungsgericht-hannover-untersagt-sektorkontrolle-a-1238579.html) (only available in German)

</comment></comment></comment></comment></comment><comment><USER47> This is honestly what your "regulated internet" looks like. None of the solutions ultimately address the real issue and are done purely for liability purposes.

<comment><USER48> It's what it looks like without any enforcement of the spirit of the law, sure.

You'll see malicious or smart-aleck compliance with any rule that a group doesn't agree with or when they feel that it personally spites them.

</comment></comment><comment><USER49> I'm sure there's some good reason not do it, so I'll ask if anyone here knows: why doesn't the law just require some technical implementation that can be automated? Why can't the law just specify something similar to the DNT header (finer grained) and require compliance with that?

<comment><USER16> The law should lay out principles, not techniques. The GDPR works for any kind of data processing, it is not specific to browsing on the Web.

The core issue is that the ~150 companies of the Oath network will effectively go out of business when they comply with GDPR. So now they try to play some games, until the fines handed out to them become too large to sustain in EU.

<comment><USER25> Can't they just stop their business in the EU?

</comment></comment></comment><comment><USER3> That post reminded me about the [https://amiunique.org/](https://amiunique.org/) site for seeing how trackable you are with browser fingerprints.

I had remembered that I had installed a "Random User-Agent" plugin in Chrome, with privacy concerns in mind. Sometimes it sends a user-agent that causes a site to send me a page that can't actually be rendered by my browser, so I have to turn it off on some sites.

But I was curious to see what amiunique.org would make of the various random user-agent strings that the plugin would send it.

Ironically, the plugin seems to break the amiunique.org site, I can only get a whitescreen or occasionally a spinner forever, unless I disable the "random user-agent" plugin.

Not sure what to make of that.

<comment><USER50> I think it's having problems right now. I don't use anything and it's slow, blank page, 500 errors, etc.

<comment><USER51> I am encountering the same issues. Hopefully it comes back up soon, I'm curious what it has to say about my browser setup.

</comment></comment></comment><comment><USER22> Most cookie warnings are beyond useless, in that they don't even try to actually comply with the GDPR.

The fact that your site uses cookies is irrelevant, and there's no need to tell anyone. However! If your site stores personal information (directly or via a partner), you need to have a valid reason.

The definitions of "personal information" and "valid reason" are, fortunately, not exhaustively enumerated in the GDRP. I say fortunately, because if they were exhaustively enumerated, Facebook would find a loophole, and the whole law would be worthless.

One of the 'valid reasons' for storing personal information, is a clear, freely given, consent from the user. This is the one that all the tracking companies want to get, because they think it allows them to do shady things if they can trick the user into pressing 'OK'. But if the user was tricked or coerced, the consent was not really clear or freely given. Hence the sort of court rulings that the article mentions.

So, if you store a cookie for your domain saying 'tracking_consent=false', this is probably not personally identifiable, so you can just do it. No reason for any banner.

But if you track the 'browser fingerprint' that Troy Hunt is talking about, without consent, you are probably in violation of the GDPR. Even if it's not a cookie. And you had a cookie banner.

<comment><USER11> Very true, that can't be stressed enough. One note though:

 _> The fact that your site uses cookies is irrelevant, and there's no need to tell anyone._

Let's not forget the infamous ePrivacy directive, e.g. Recital 66:

"Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. ... Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user."

Of course, the relationship between GDPR and the old ePrivacy directive is rather ambiguous.

</comment></comment><comment><USER52> I think consent is important for tracking, but I noticed an implementation problem/annoyance:

On the same device, I consume news of the same sites from multiple sources or embeded browsers: Facebook, Google News, Chrome...

I don't want to go through the hassle of opting out of tracking from every partner of the very same site I visit. Now multiply the task by every site you visit and every device you use...

I now even suspect they intentionally remove the preference cookies so that you get tired of opting out

</comment><comment><USER53> Train people to click away on annoying shit, what could go wrong?

<comment><USER54> Aren't people already trained to ignore cookie banners? They've been around for years.

</comment></comment><comment><USER55> The browser fingerprint nonsense assumes Javascript is turned on and the user has allowed someone else to choose the user agent string and other headers.

Thought experiment: What would these "fingerprints" look like if on given day everyone were to turn off JS and set their user agent string and other headers to the same values?

The author writes that if I visit amiunique.org I "will almost certainly be" informed that I am unique.

Well that is not what happened. According to their test, I am "almost" unique, but still _not unique_. What the page says is that we can almost certainly be _tracked_. Does not say whether this would still be worth it to an advertiser.

The question is not "whether we can be tracked". Of course we can. Most people using the computers on the internet, in the same way as people using telephones on a landline or cellular network, are not expecting to be "untraceable".

The question is how easy we are making it for _anyone_ to conduct tracking -- not just those who are properly authorised to do so -- and for what purpose are they collecting this information.

</comment><comment><USER56> > Is this really what we want? To continue chucking up cookie warnings to > everyone and somehow expecting them to make an informed decision about the > risks they present? 99% of people are going to click through them anyway > (note: this is a purely fabricated figure based on the common-sense > assumption that people will generally click through anything that gets in > the way of performing the task they set out to complete in the first place). > And honestly, how on earth is your average person going to make an informed > decision on a message like this:

I think the logic is "Yes, you're right, many regular people can't make freely informed consent for that sort of mass tracking... _so the solution is to stop tracking people_ "

</comment><comment><USER57> I often visit many sites every day and I often see big popups with full "ad partners" configuration. I don't have time for this! Sometimes, if I can see at least three lines of an article text in the middle, I try to read through it. Other times, I just confirm it so I can read the article. I think the providers should be forced to react to the "do not track" browser feature and then simple don't track and don't show any cookie prompts. Browsers are configurable so they should let people decide. Per-site web prompts like that do more harm than good unfortunately.

</comment><comment><USER58> Standardize it. Policy makers should provide a standard message, or small set of messages websites can reuse and consumers recognize with links to an EU-run informational website easy to understand for consumers. I don't understand why it wasn't implemented this way, maybe to allow for more freedom of implementation, but we have seen that has hurt the policy effort. Just standardize it.

Incidentally, with all of the Organic / GMO-Free / et all certifiers out there, would a privacy badge be the way to go, or is that backwards thinking in the way of early internet site badges?

<comment><USER26> There's not a standard copy-paste-ready set of phrases because it would be impossible for the law makers to craft such.

They couldn't possibly know what site A or B respectively does with a user's data. That differs from site to site.

It is therefore of course the obligation of each site that directly or indirectly works with user PII to explain to its users how that specific site is using the data.

</comment></comment><comment><USER59> Can anyone explain to me why the browser isn't the one asking the user? Since, y'know, the browser is the only thing that actually prevents a cookie from being placed or sent in the first place?

<comment><USER14> The browser cannot distinguish between cookies that are necessary to support a feature you're using (e.g. a session cookie for a login or shopping cart) and a tracking cookie.

The former does not require consent. The latter does.

<comment><USER59> That's a technical problem, which shouldn't prevent solving the main usability issue.

For example, the CAN-SPAM act requires the words "SEXUALLY EXPLICIT" to accompany messages with sexual/adult content. A tracking cookie's name can simply have the word "tracking" in it, which would trigger a browser to throw up a consent pop-up. A long, useless message from the site about why the user should click it could be provided to the user in a number of ways. The law doesn't even have to specify that

</comment></comment></comment><comment><USER60> I'm in the EU. I just dont bother looking at those sites anymore.. So, a lot of the links posted here for example.

ps. If I ever mention that the article had a _ridiculous_ cookie warning system that I didnt bother getting through (eg. The techcrunch gif in the article), or that the site is just plain broken from EU, then I get downvoted to hell.

pps. If I really wanna read something, or need to for work or whatever then I use outline.com

</comment><comment><USER61> Is it possible to write a browser extension that has the browser request access to store cookies just like it does for microphone or location access?

<comment><USER62> Firefox has had that built in for years but you have to manually accept or deny cookies for each website and you would still get the popups.

I just use this Firefox add-on to hide most of the popups: [https://addons.mozilla.org/en-US/firefox/addon/i-dont- care-a...](https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about- cookies/?src=search)

</comment></comment><comment><USER38> What if the EU instead mandated that browser makers have to keep up with, implement, and enable by default the highest levels of tracking protection possible? It would be far easier to enforce that on four or five organizations (half of which already do that) than to try and corral millions of websites into compliance.

<comment><USER63> GDPR applies to a lot of things that are not mediated by the data subject's web browser. For example, when your grocery store takes your purchase history (from your rewards card) and sells it to a marketing or credit reporting agency. Or when housing or job applications are rejected by error-prone automated background checks. The website stuff may be more visible, but it's not the main thrust of the legislation except insofar as it has exposed how many websites are collecting and trading in your information.

<comment><USER38> I'm pretty sure the cookies thing predates GDPR

</comment></comment></comment><comment><USER64> Congratulations, there's now a pop-up added to every single website on the internet that isn't blocked by adblockers. It makes zero difference to me whether the pop-up is telling me about cookies or advertising "huge anime tiddy" it's still an obstruction and a delay.

<comment><USER62> This Firefox add-on hides of most of them: [https://addons.mozilla.org/en- US/firefox/addon/i-dont-care-a...](https://addons.mozilla.org/en- US/firefox/addon/i-dont-care-about-cookies/?src=search)

</comment></comment><comment><USER65> That last warning comes so close to being a good horror movie quote. "Something or somebody is making changes to your connection" should obviously be "Someone or ... something".

The true monster was the intrusive firewall/AV all along.

</comment><comment><USER66> It's the result of government interference everyone around here loves so much.

</comment><comment><USER67> Do they expect a user to re-enter their password every time they click a button on a website? Without requiring cookies how do they expect a session to persist between pages?

<comment><USER68> Session cookies are fine, it's only advertising and tracking cookies which are covered by the legislation.

</comment></comment><comment><USER69> At my company's site[1] we have a non-intrusive banner at the bottom which lets you agree or disagree to tracking cookies, or just ignore it and browse the site.

You don't get served any tracking cookies until you agree.

This fulfills the explicit consent requirement of GDPR as well as the requirement for people to be able to use your site even if they don't accept cookies.

We get much less analytics then we used to - many people just ignore the cookies bar, either knowingly or just because they don't notice it. But it's totally worth it.

I hope the EU starts fining non-compliant (i.e. 99% of) sites aggressively, specifically those that _pretend_ to care about your privacy, but don't really ("Agree" button only).

[1] [https://www.soundradix.com/](https://www.soundradix.com/)

</comment><comment> shaki-dora What people miss about the new GDPR notices, compared to cookie warnings of yore, is that they offer you the choice of opting out.

In my experience, the option is usually hidden (look for "options"). But a surprising number of sites do actually comply and make this not prohibitively obscure.

<comment><USER70> It was my clear understanding that "pre-checked boxes" would be illegal. Meaning that if you want to have 200 trackers on a page, then the user needs to click accept to all 200 trackers. So that if you just dismiss the "Cookie warning", you would be default get no tracking. That pretty much solves the issue right there, most people would effectively have zero tracking.

</comment></comment><comment><USER71> Any site that makes it a hassle to manage this stuff, I just close the tab and never visit again. Hasn't affected my happiness one iota.

</comment><comment><USER72> Is there a browser plugin that just auto-accepts (or denies I guess) all those cookie pop-ups? That'd be nice!

</comment><comment><USER73> I'm sure they mean something like "if the user chooses no, make your website work without cookies".

</comment><comment><USER74> ITT people are suggesting _GDPR mandated cookie warnings are pointless because people have been trained to automatically tap "accept" or not gain access._

I don't buy it, and was the main point of this latest GDPR clarification [1]:

> _" Cookie walls that demand a website visitor agrees to their internet > browsing being tracked for ad-targeting as the "price" of entry to the site > are not compliant..."_ [adding] _"...There is no objection to software for > the proper functioning of the website and the general analysis of the visit > on that site... sharing of this information with 3rd parties is only allowed > with permission."_

Basically the mere presence of a cookie warning (regardless of the specifics) should not be signaling to the visitor _" [agree] to enter"_ or _" [agree] to enable features"_. They should be signaling _" [agree] to us sharing some identity elements and browsing behavior with 3rd parties, mostly for ad targeting; or [decline] the aforementioned; either way, welcome to the site."_

Once users realize they can still enter the site if they click _deny_ , their (automatic) choice will better align with their actual preference.

[1] [https://techcrunch.com/2019/03/08/cookie-walls-dont- comply-w...](https://techcrunch.com/2019/03/08/cookie-walls-dont-comply-with- gdpr-says-dutch-dpa/)

</comment><comment><USER75> this isnt very accurate. Usually, there is first a generic "this site uses cookies" popup, then an interstitial about how much they "care for your privacy", then a popup about their newsletter, and finally a sticky header to nag you to take their survey.

</comment><comment><USER76> It is common sense vs dumb bureaucrats of EU. Who do you think wins in the long run ?

<comment><USER77> Media companies, publishers, and copyright hoarders, obviously.

</comment></comment><comment><USER78> No man, let's keep waving that dead chicken! Apocalypse is upon us.

</comment><comment><USER79> Did he actually said something new? A rant upvoted to 800s.

</comment><comment><USER80> Cookie warnings cannot be provided without state

</comment><comment><USER81> Troy's statement that accepting one advertiser's agreements means accepting all their partners' agreements, and all _their_ partners agreements, and so on is interesting.

It lead me to the idea that it might be interesting to build a bot that builds a "consent graph" which will tell you exactly how many (and perhaps draw connections visually) different companies you have to provide consent to from a given advertiser/company/website.

This is a pretty interesting argument against the clumsy rules of GDPR which exist, in my opinion, practically entirely outside reality.

</comment><comment><USER82> The main problem here is that the GDPR is not enforced.

Those annoying cookie banners aren't actually GDPR compliant. GDPR mandates that consent should be freely given and should be opt-in, so forcing you to consent in order to view the site is illegal, and so is pre-checking the tick boxes or making it hard to opt-out (like having to explicitly visit the privacy policy, or uncheck hundreds of tick boxes).

If GDPR was actually enforced, fines would start flying out, and website operators will quickly start complying and cookie banners will become much less intrusive or annoying.

</comment><comment><USER83> So I have a question regarding GDPR. I've recently done two projects for intergovernmental organizations (like the UN, to give you an example). Both organizations claim that they do not have to comply with GDPR. I kindof doubt that but IANAL. Short of reading the GDPR laws, or contacting an expensive lawyer, what's the best way to find out if they are right? I'd like to find out before I start the next project for such an organization. Thanks.

<comment><USER26> Read the document: [https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELE...](https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX:32016R0679)

That's the cheapest. It's not really that hard to understand. I'm not a lawyer, read it and had a GDPR consulting firm review the tweaks we made of our systems. They were happy with it.

But if you're working for a larger company, then consult with their legal department or have the company hire a GDPR consulting firm. They should be able to afford it without a problem, and will likely be happy to support such an action if the non-compliance risk is deemed large enough. A business decision, not a technical one.

</comment></comment><comment><USER84> It's almost as if the GDPR were less a carefully designed way to increase the degree of freedom individuals experience while perusing the web, and more an expensive and highly visible way to demonstrate that EU functionaries are Doing Something About Scary Technology Companies. I mean, obviously, it's totally not that at all, of _course_ but it's _almost as if_ it were.

</comment><comment><USER14> I disagree with a number of premises stated in the article:

> it essentially boils down to "take this cookie or no access for you"

This is something GDPR explicitly bans. "Consent" obtained this way is invalid; the site doesn't even have to bother asking at that point.

> To continue chucking up cookie warnings to everyone and somehow expecting > them to make an informed decision about the risks they present? 99% of > people are going to click through them anyway

No, sites don't have to chuck up cookie warnings. If the cookie warnings were actually compliant, i.e. didn't try to hide the "no" option behind several clicks, there would be very little incentive for the user to say yes, because "no" means the warning goes away just as well, plus the user doesn't get tracked.

Of course, the sites realize that, and are setting up non-compliant "consent" dialogs that try to trick or pressure the user into "consenting". The solution to that is to prosecute the ones that do that until they stop. (I bet many of the sites set and use tracking cookies even before you close the dialog.)

At that point, the sites can choose whether they want to annoy users or not, but since a large part of the users will click "no" at that point (since the sites can't really provide an incentive to click yes), they might as well stop using the trackers.

And sites using cookies for functionality the user actually wants don't have to ask for consent for those cookies. If the site asks, it's because it wants to track you, and you have no reason to agree.

</comment><comment><USER85> Agreed. Not happy EU laws are affecting US business. We had to do a bunch of GDPR stuff even though we sell products only in the United States. I get if we are marketing to or selling in the EU, but we're not. What do I know though? I'm just some dude who lives in a terminal.

</comment><comment><USER86> Well, only somebody completely out of touch with reality (=government folks) wasn't able to predict outcome of this law.

Good thing that there are browsers extensions which take care about removing these "cookies" notification so I don't have to deal with it.

Regular users _absolutely do not care_ about privacy,cookies GDPR etc. When events like "cambridge analytica" occur they will be enraged, maybe even some "thumbs down" and "angry face" emotes will appear under facebook news notification before scrolling further down! Probably for HN users it is hard to comprehend because you are looking at the world from inside of your knowledge bubble.

More knowledgeable users know that this is total farce and masquerade and don't care about cookie _notifications_ too.

</comment><comment><USER87> I think what is missing from this discussion is possible solutions that don't involve allowing free for all surveillance.

The obvious one to me is to just ban consent. Make anything you would need consent for outright illegal. No one in the right mind would be giving consent for tracking without compensation (which is what the GDPR asks for) anyways.

Maybe leave a small prohibitively expensive loophole for projects that do need to track things (e.g. scientific studies). For instance requiring approval by an ethics committee and a contract signed in person by hand by both parties after jointly reviewing every term.

</comment><comment><USER88> The EU should ban cookie "walls" and pop-ups completely. They're uneccessary, annoying, and against the spirit of the GDPR.

</comment><comment><USER89> This is like a case study of well-intentioned, carefully designed regulation doing more harm than good. Honestly, I'd rather just have a browser addin that blocks the cookies I don't want. The market was working fine. Now every new website is a pain, and my organization has hired some amiable lady to be "GDPR expert". She doesn't appear to know anything about anything, but she sure seems nice.

<comment><USER20> GDPR absolutely does not do "more harm than good". It extends well, well beyond these dumb cookie warnings.

GDPR puts the citizen/customer in power of their own data. They can ask for their data, they can ask for it to be deleted, they have (however shitty the UX) control over where it goes. They can contact large corporations and request these things _and be heard out_.

I don't know how to explain it any other way: These things are fucking important.

As for your organization's GDPR expert who doesn't know anything about anything, this sounds like a "your organization" problem. Replace GDPR with some other acronym such as HIPAA, PCI or even SEO or PHP, it's still your organization's fault for hiring someone who doesn't know their stuff. How is that GDPR's fault?

Edit: Yes, keep downvoting facts. GDPR isn't just cookie warnings, how is that controversial?

<comment><USER7> > I don't know how to explain it any other way: These things are fucking > important.

I believe that thought is treated as an axiom by some and an under-tested hypothesis by others.

<comment><USER20> That they're not important to everyone doesn't make them unimportant for everyone.

It's kinda like other rights such as free speech. Some people don't need/use it. Some specific people might arguably be better off without it. But _Everyone_ needs it; as in, it needs to be available to everyone for it to work.

<comment><USER7> It's worth noting that the United States considers a right to keep and bear arms as important as a right to free speech.

Internationally, reasonable disagreement on rights seen by some as fundamental is to be expected.

<comment><USER20> You make a fair point, but the right to bear arms is mainly controversial for safety reasons. What safety issues are there with providing customers control (or at least visibility) over their data?

It's also worth pointing out that the right to bear arms, by its origin, should probably be called the "right to revolt". While this is still a controversial issue _for governments_ (governments don't want revolt), it's less controversial for _citizens_.

<comment><USER7> I think the safety issues with GDPR compliance are minimal (there's a weak argument to be made for inefficiency introduction and contributing to warning blindness, but it is a weak argument).

Larger arguments are in the space of tradeoffs. What _could_ companies be doing with the engineering resources devoted to GDPR compliance (including compliance with the consumer-frustrating applications of the law, like the cookie walls)? Since the US doesn't have a GDPR compliance law (and companies in the US only comply when they want to do business in the EU), we'll probably see with time whether the inefficiency introduced is worth the tradeoffs in a highly-competitive world of software services.

<comment><USER20> I agree with you that the whole thing is inefficient. I think every GDPR advocate, much like me, will agree that it still needs to be improved and worked on. We're nowhere done.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER90> Its too bad nobody invented a browser header to be sent with HTTP requests for Allow-Cookies: SURE_YES_WHATEVER_OMG_STOP_ASKING_PLZ

<comment><USER91> It's too bad nobody came up with the simple idea of forcing browsers to ask permission before sending personally identifying information everywhere.

<comment><USER92> There are easy ways to do this though, I use uMatrix.

<comment><USER93> The joke is that this is a browser setting. Its just set to "Always accept without asking" by default.

</comment></comment></comment></comment><comment><USER94> Everything in California is labeled carcinogenic, and so nobody pays it any mind, but it's still done anyway because that's what regulations and the law say. Similarly, this isn't just a bunch of people who operate websites deciding to write these wacky cookie banners because they think people really care about cookies.

When I implemented one of these it was because lawyers told my team to do it. We didn't want this, neither as developers nor as users of websites. Neither were our designers thrilled at the prospect of cluttering up our site with this dingus.

I get that this is just a general rant, and I agree that people just click through them and don't actually care. But it's important to keep in mind how this actually came about, and (as a somewhat separate point) that lots of things in our society operate this way. Which is not intended as a defense, but it's more common than just cookies.

Or do you read every terms of service document shoved in your face when you sign up for something?

</comment><comment><USER95> this gdpr....argh.. all smoke and mirrors bs leftist incompetence, breaking the www experience, luring users into using even more more opaque 'apps' (usually simple ux making http api calls). The real question is who will be siphoning 'our' (eu) data in the near future (more), china, u.s. or full on balkanisation?

</comment><comment><USER96> It's time GDPR is actually enforced. I tried to get my country's law enforcement on the tail of some violators but they're __toothless __.

I don't understand the downvotes though, are you disagreeing that certain countries do not have the manpower to enforce GDPR to the extent they could? Please.

<comment><USER97> I think they are currently going after the big ones. Personally, I expect that to change once they are through with them. It simply makes no sense to go after big companies when there is still google and facebook to go after. And well, medium and small? I think those still have another year or 2.

<comment><USER98> In addition to the practicality of choosing the big, obvious violators first, one or two actions against well-known targets should _hopefully_ convince a lot of the secondary and tertiary potential enforcement targets that the EU is serious about enforcing these regulations. Some[1] companies might even decide that _complying_ with the regulations be a better business plan than abusing their user's ignorance to undermine democracy[2].

[1] Unfortunately, experience suggests many will prefer bullheaded clinging to their surveillance capitalism business models to the bitter end.

[2] [http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q- and...](http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and-a-the- age-of-surveillance-capital.html)

</comment></comment></comment><comment><USER99> I feel like GDPR and such had some good spirit to it... but the result isn't what they had in mind and the consumers just click through everything / have no more clue. Piling on or malforming GDPR seems like it would just make the already unworkable situation more of a mess.

I like the "ideas" behind GDPR, it's just this isn't the way to do it and really accomplish anything that really helps an individual.

<comment><USER7> I wonder how often we'll repeat the error of treating user privacy as something the user cares deeply about (against all this observable evidence to the contrary) before we accept that the well-demonstrated-and-documented default is users do not care (and if we want the behavior of websites to change, step 1 is educating users as to why they should care and what the risk models are).

<comment><USER100> I mean, for the average person, it's pretty rational not to care. The only result they see from tracking is seeing more relevant ads. 99.99% of people for the foreseeable future will not have a bad experience from commercial tracking (that they wouldn't have from non-tracked ads anyway).

</comment></comment></comment><comment><USER101> As a web developer I gotta say the only true solution to this is to stop using the internet altogether. Might as well shut the internet down.

We can't authenticate you without cookies or some other form of identification, so that throws out any site with an account.

Even if I am not even remotely interested in tracking what pages you view on my website if I need to have you login and authenticate I need some form of cookie / session ID.

If you need to be anonymous use a browser like Firefox Focus or similar but understand that you won't be able to log in for longer than a single session, if at all.

Cancel GDPR and similar privacy laws before we outlaw the [useful] internet completely. These laws are a mess written by people who honestly are not remotely qualified to make these kinds of decisions.

I'm all for the option of privacy but it's your own responsibility -- stop using the internet leave all your electronics at home and go ride your horse into the wilderness and breathe some fresh air if you want privacy.

<comment><USER102> While I'm certainly not going to argue in favor of the GDPR, the "cooking warning" actually specifically excludes cookies used for things like authentication. It covers cookies used for other purposes, such as trackers.

<comment><USER101> From my understanding if the cookie is for an account on a website (which usually is only required to store private information such as name, email, address, etc) you would need to display the cookie warning.

<comment><USER20> Cookies are only affected if they are not a core and essential part of the product's functionality, and can identify the user. You could also argue that authentication may not be an essential part of an app's functionality, but you would not be successful; it's well-established by now.

<comment><USER101> According to the following you still are required to display the cookie warning/banner, but without the consent requirement.

[https://www.iubenda.com/en/help/5525-cookies-and-eu-data- law...](https://www.iubenda.com/en/help/5525-cookies-and-eu-data-law-gdpr- requirements)

Exemptions to the consent requirement Some cookies are exempt from the consent requirement and therefore are not subject to preventive blocking (though you're still required to have the banner and cookie policy in place). The exemptions are as follows:

Technical cookies strictly necessary for the provision of the service. These include preference cookies, session cookies, load balancing, etc. Statistical cookies managed directly by you (not third-parties), providing that the data is not used for profiling Statistical (anonymized) third-party cookies (e.g. Google Analytics)* *This exemption is may not be applicable for all regions and is therefore subject to specific local regulations.</comment></comment></comment></comment></comment>


Comparison: Lockless programming with atomics in C++ 11 vs. mutex and RW-locks - <AUTHOR> https://www.arangodb.com/2015/02/16/comparing-atomic-mutex-rwlocks

<comment><USER2> Jeff Preshing gave a _really_ good introduction to atomics at CppCon 2014.[1] He explains it so clearly that 1 day later I had a fully tested lock-free work stealing queue and a queue. One of my favorite talks of last year.

[1]: [https://www.youtube.com/watch?v=X1T3IQ4N-3g](https://www.youtube.com/watch?v=X1T3IQ4N-3g)</comment>


Show HN: Pasteify, a novel photo app - <AUTHOR> http://pasteifyapp.com/

<comment><USER2> When you copied the privacy policy page from Quotr, you forgot to change links to FB/twitter/download, and even page title.</comment>


Ask HN: Favourite Entrepreneur Quotes - <AUTHOR> Title says it all. <comment><USER5> Here are a few of my favorites

Don't worry about people stealing an idea. If it's original, you will have to ram it down their throats. Howard Aiken

I can't understand why people are frightened of new ideas. I'm frightened of the old ones. John Cage

If I had asked people what they wanted, they would have said faster horses" Henry Ford

Good judgment comes from experience, experience comes from bad judgments Mark Suster

If you want to succeed, double your failure rate. Tom Watson (IBM)

</comment><comment><USER6> "Move fast and break things. It's not the end of your career if you bring the entire site down." - <USER2>

</comment><comment><AUTHOR> Here are a few of mine to start off:

 _"If there exists no possibility of failure, then victory is meaningless."_ \-- Robert H. Schuller

 _"If everything seems under control, you're just not going fast enough"_ \-- Mario Andretti

 _"When I was 17, I read a quote that went something like: "If you live each day as if it was your last, someday you'll most certainly be right." It made an impression on me, and since then, for the past 33 years, I have looked in the mirror every morning and asked myself: "If today were the last day of my life, would I want to do what I am about to do today?" And whenever the answer has been "No" for too many days in a row, I know I need to change something."_ \-- Steve Jobs

<comment><USER7> I prefer it the other way around: Live every day as if it is your first. [http://ezinearticles.com/?Can-You-Live-Every-Day-As-If-it- Wa...](http://ezinearticles.com/?Can-You-Live-Every-Day-As-If-it-Was-Your- First-and-Not-Your-Last?&id=1851076)

<comment><AUTHOR> That's a powerful mind trick - more optimistic than the 'as if it was your last day' certainly.

</comment></comment></comment><comment><USER8> Attitude determines outcome. - Jim McGraw, COO of Marion Laboratories

Be the first, be the best, or be different. - Jacyln Easton

Chance favors the prepared mind. - Louis Pasteur

Elegance is for tailors. Don't always believe in the numbers. There is always room for human judgment. - Albert Einstein

Great ideas come into the world as gently as doves. - Albert Camus

Half the money I spend on advertising is wasted, and the trouble is, I don't know which half. - John Wanamaker

I do not love the money. What I love is the making of it. - Philip Armour

I guess we can make them, although we never have. - Benjamin Franklin Goodrich

I never gamble. - J. P. Morgan

A man to carry on a successful business must have imagination. He must see things as in a vision, a dream of the whole thing. - Charles Schwab

If I could get $25,000, I would spend $24,000 on advertising, the remainder in making Coca-Cola. Then we would all be rich. - John Pemberton

If I had six hours to chop down a tree, I'd spend the first four sharpening the axe. - Abraham Lincoln

The best way to really enter minds that hate complexity and confusion is to oversimplify your message. The lesson here is not to try to tell your entire story. Just focus on one powerful differentiating idea and drive it into the mind. That sudden hunch, that creative leap of the mind that "sees" in a flash how to solve a problem in a simple way, is something quite different from general intelligence. If there's any trick to finding that simple set of words, it's one of being ruthless about how you edit the story you want to tell. Anything that others could claim just as well as you can, eliminate. Anything that requires a complex analysis to prove, forget. Anything that doesn't fit with your customers' perceptions, avoid. - Jack Trout

If you're going to lose money, lose it. But don't let 'em nose you out. - Gustavus Swift

If you love an idea, that is good. If you have ideas as to how to work it out, that is better. - Henry Ford

It's a barrier to entry because you're shooting at a moving target. - <USER3> George, CEO, Medtronics

Name the greatest inventors. Accident. - Mark Twain

Nothing, not all the armies of the world, can stop an idea whose time has come. - Victor Hugo

Perceived truth is more powerful than truth itself. - Michel Fortin

Purchasers are made, not born. - Henry Ford

Success depends on how you react to unexpected opportunities. - Ross Perot

The ancestor to every action is a thought. - Ralph Waldo Emerson

The march of improvement in any given field is always marked by periods of inactivity and then by sudden bursts of energy which revolutionize existing methods sometimes in a day. - George Eastman

There was never a great character who did not sometimes smash the routine regulations and make new ones for himself. - Andrew Carnegie

Think a lot. Say little. Write nothing. - J. P. Morgan

If first an idea is not absurd, it has no hope for survival. - Albert Einstein

To lead people, walk behind them. - Sun Tzu

We study the methods of improving our business as we would a science. We imitate no one. - A. Montgomery Ward

We took what was a luxury and made it into a necessity. Our only advantage was lack of precedent. - Henry Ford

We want character to go with our goods. And 16 ounces is a Swift pound. - Louis Swift

What others could not or would not do we would attempt, and this was a rule of business which was strictly adhered to. - Andrew Carnegie

What we believe is based upon our perceptions. What we perceive depends upon what we look for. What we look for depends on what we think. What we think depends on what we perceive. What we perceive determines what we take to be true. What we take to be true is our reality. - Gary Zukav

You can't get wet from the word "water". - Alan Watts

You can't solve a problem with the same mind that created it. - <USER4> Einstein

</comment><comment><USER9> Those who are crazy enough to think they can change the world actually do.

</comment><comment><USER10> The only thing you can control is your effort.</comment>


Cost of serving billions of images per month - <AUTHOR> https://medium.com/p/f499620a14d0 <comment><USER2> I like Unsplash. They and Pixabay are what I use for apps I have developed in the past.

But simply, this floors me. I looked at their costs and with some developer muscle, you could find savings such as:

\- Move Fastly to Cloudflare. They don't expressly say what the cost is for that. But moving to CF would eliminate it.

\- Move Heroku to Digital Ocean. It's not difficult to create a fully redundant solution.

\- Move from Imgix to having Golang micro services which handle the resizing of images and use something like Belugacdn for the CDN. Beluga is $5k a month for a PB. (Or some other cheaper CDN if you don't like Beluga, but damn... imgix pricing)

I'm pretty sure that a savvy CTO could save at least $50k a month with a well designed project that does this over many months and achieves the same result and keeps the redundancy concerns for the small team.

I do realise however, why the team have done this. In the same position (with very few resources) I would probably have done the same. But damn, when a cost of a service gets up to a years salary ($120k) for a good developer. Time to seek alternatives.

<comment><USER3> $50k/month comes out to $600k/year which is the cost around 2-3 engineers counting overhead.

To manage infrastructure at that scale themselves they'd need someone who knows DevOps. To write services at that scale they'd need someone who knows backend engineering and micro services. Then they'd need to be able to have 24/7 on call rotations for when things break. And of course, like any rewrite it seems like a "couple month" project until you get into the details and it becomes a two year project. Soon you've got a full 6+ person team and are paying them a lot more than $600k/year.

<comment><USER4> 600k year for 2-3 is only real in the silicon valley bubble. You could get just as talented of a team from a Nordic Country for example and only pay 120kish

<comment><USER5> Realistically the costs for the company are higher. At least in The Netherlands the total costs for the employer is between 2-3x because of social security, health insurance, pension, housing/office costs.

<comment><USER6> I've been an employer in NL for close to 30 years and the 2-3x fully loaded is not supported by any data that I'm aware of. 1.5 or so is more like it.

</comment></comment></comment></comment></comment><comment><USER7> What's the business model here?

We would never run with such expensive options for this functionality, especially if it was a free/donations powered service. This company raised $7.5M though: [https://techcrunch.com/2018/02/15/unsplash-simple-token- seri...](https://techcrunch.com/2018/02/15/unsplash-simple-token-series-a/)

<comment><USER8> They raised money from the crypto-coin outfit run by the former fab.com CEO. At Fab and at his previous company it seems the modus oprandi was to raise millions and then pocket as much as possible before the shit hit the fan.

<comment><USER9> I ordered so much stuff from Fab back in the day! I thank the investors for their largess

</comment></comment></comment><comment><USER10> So they must have some form of business model, right? All I can see on their website is that everything is for free, even their API which can be used for free without any limits or restrictions. And given the already huge Imgix costs, abusing or over-using their API to request and resize images would directly increase their overall costs. According to Crunchbase ([https://www.crunchbase.com/organization/unsplash#section- fun...](https://www.crunchbase.com/organization/unsplash#section-funding- rounds)) they raised $10m last year, but they must be churning through $3m+ per year on staffing and hosting costs.

I use and love the service but I can't see how it can last for more than a few more years.

<comment><USER11> "He said it's too soon to know exactly what that [business] model will be, but it will involve blockchain technology and cryptocurrency" [1]

[1] [https://techcrunch.com/2018/02/15/unsplash-simple-token- seri...](https://techcrunch.com/2018/02/15/unsplash-simple-token-series-a/)

<comment><USER12> Is there a way I can short this company?

<comment><USER7> I think the way to do this for VC companies is to sell them expensive stuff until they go out of business. This post and many others like it seem to indicate it works well.

</comment></comment></comment></comment><comment><USER13> Wow, these are some serious expenses!

I run a service that does ~30 million requests a month, and I only spend $15 on it. It's an apples to orange comparison, but looking at their costs breakdown, I'm sure a couple engineers with a couple weeks can dramatically reduce their costs.

For me, the biggest cost savings were at browser caching. With `immutable` and far future cache expiration dates, webp images, etc, I could pull of the 30m and growing stats without the server load going more than 0.40.

<comment><USER14> That's very tempting to do so but not knowing the exact details of the processing involved, you probably make a mistake on how easy it would be to optimize their costs.

It could be true, but would mean engineering time not dedicated at features and likely more risk and more maintenance. It's often hard to admit but costs are not that easy to assess and trade of are tricky.

</comment></comment><comment><USER15> The numbers being thrown around on this post are staggering. Not the bandwidth, storage or or the number of images —they're all pretty average for a small image host— but the casual tone that they're willing to throw money at services rather than engineering some quite simple problems.

Seriously, I _know_ I'm not in their shoes but I know what they do, I know popular options in these areas and I know they are literally throwing cash away by not trying to in-house any of this.

The worst thing is they seem _proud_ about their decisions; that their current situation has justified $100K/month expenses. I'm not the only person in here that thinks they could be delivering the same —even better— service on a fraction of their current budget, even after hiring. I think they should be ashamed.

<comment><USER16> Doing a cost benefit analysis and deciding that using a service instead of hiring and paying humans is a perfectly rational decision. I've downvoted because I see a lot of vitriol like this and it's exhausting to argue each time that these decisions are carefully considered and work well for the people making them.

This is no different from saying people should be ashamed because they pay so much for food, then it's much cheaper (almost free!) to grow it yourself in a pot.

<comment><USER15> Being able to come to the decision that in-housing isn't good value, is _of course_ possible. But they do it for everything. And they've been exhaustive enough in their breakdown here that it's trivial to any experience developer that they're spaffing money away.

They're not in an all-or-nothing situation. There are so many individual elements that they could improve efficiency on and they're just not.

And I think cooking your own food vs going to a restaurant is a better analogy (because it focuses on a service provision, not resource gathering). They're currently eating out, seven days a week.

<comment><USER16> Even if they are currently eating out, seven days a week, that was a decision to focus entirely on the product without any distractions.

[https://medium.com/unsplash/scaling-unsplash-with-a-small- te...](https://medium.com/unsplash/scaling-unsplash-with-a-small-team- fbdd55571906)

It's absolutely nothing for them to be ashamed of. We can all disagree with the decision and say that we wouldn't do the same, but we shouldn't call it a bad of shameful decision.

<comment><USER15> I don't understand your stance in the context of HN. We're here to make money, celebrate people who can make money from the things they build, the services they provide... And most importantly to learn from it when it goes right and learn from the mistakes when it doesn't.

Unsplash is eating out seven days a week. But they don't have anything to show for it. They're burning through cash. The product is basic. There's no magic, nothing clever. It just is.

They're saying everything is great! I think it's a shambles; simultaneously mediocre at both making money and being an excellent example of engineering. Why is anybody _here_ celebrating or defending this result?

I maintain what I said. Unsplash _should_ be ashamed. They shouldn't trot out numbers like this label them a success. It's a record of successive failures.

</comment></comment></comment></comment></comment><comment><USER17> I'm curious what their price-per-GB is from Fastly/Imgix ... the monthly total doesn't really tell me the full story.

At the last place I worked I was in charge of a team that ran our image service so I have a very solid understanding of the infrastructure around it and what resources we had in place to develop/monitor/support/etc. It wouldn't be hard to do a calculation and see if they are using money inefficiently.

I will say that most people don't really have any idea of the cost of simply pushing bits. The majority of what I did was video distribution which gets into eye-watering costs pretty quickly. Without knowing a bit more detail on the precise volumes they are storing/moving I don't think it is fair to criticize.

</comment><comment><USER18> I'm stunned that a business of this size would still be using Heroku.

Heroku's sweet spot (to me at least) is for anyone with less than 3-4 servers. After that, it just becomes so expensive there's no rationalization in the world that makes sense.

<comment><USER19> Moreover what if Heroku goes out of business? Then they're f'd. Hosting on k8s, using Terraform or whatever would give them a lot of automation and provider independence.

<comment><USER19> I'm guessing I'm being grayed because I'm suggesting Heroku might go out of business? Ok let me explain. That is one scenario, it's unlikely but there might be other similar scenarios that pose risk being tied in to one providers stack. DDOS, TOS issues, simply out growing them, Heroku themselves having TOS issues with their cloud. There are almost weekly posts on HN of "this major service is down" and "that major service is down".

I understand a scrappy startup needing to focus on growth and using the most convenient tools, but once you've been around a bit it's time to think of boring stuff like what if stuff goes wrong. It might be technical, security related, business related or political. Eliminating SPOFs is wise.

Happy for you to downvote this but if you do please drop a sentence to say why I'm wrong. I'm happy to be proved wrong it helps me learn.

<comment><USER20> Downvoter (of your previous comment) here.

Your comment is not only bad, but outright dangerous. This is a company that is burning through hundreds of thousands of dollars on hosting and staff with no business model yet. The primary risk to this company is not their host going away; the primary risk to this company is that _they won 't figure out how to make money_. Worry about optimizing your serving infrastructure after you have a business that you know is worth saving.

<comment><USER19> Cool thanks it's nice to hear the story behind the downvote. I agree you'd need to be flying their plane so to speak to know the reasoning behind their business decision. I still forget there are businesses that burn through that much cash looking for product market fit etc. it's not the European way so I often don't correlate spending 100k/m on hosting with fighting to stay alive. Anyway I was sort of making a general point about lock in. It may not apply to this company.

</comment></comment></comment></comment></comment><comment><USER21> $99K/month in hosting costs and no visible source of revenue...

I think this baby is ready for an IPO!

<comment><USER22> The losses are not large enough for an IPO. They need to scale at least 1000x to be IPO ready.

</comment></comment><comment><USER23> I'm a little surprised as to how you guys afford to give such a quality service away for free. Really cool of you guys to share this data though. Wishing you guys continued success!

</comment><comment><USER24> It's interesting to see how so many people here focus on specific line items on their costs. What it comes down to is management focus. It's a lot easier to switch a CDN than to lay off two engineers as needs change.

I Do wonder why they don't charge for API at all as even currency APIs charge and that is effectively public knowledge.

Very interesting though as this is some serious scale indeed...

</comment><comment> jon-wood Everyone here seems to be screaming about how high their Heroku bill is, but I'm more interested in how they keep their New Relic bill so low. I find that New Relic are fine early on, and then the costs explode as you scale up and there's no way to justify spending huge amounts of money on their platform.

</comment><comment><USER25> 10(+) billion images served monthly for $100k = 1/1000th of a cent per image. This is not bad but I think Netflix is 2c a gigabyte; you are 10c (I'm assuming 100k per image).

<comment><USER16> Netflix sends their own cache machines to tens, if not hundreds, of ISPs and interchanges all over the world, each of which have multiple terabytes of storage and act as cache nodes. I don't think Unsplash is going to do that.

</comment></comment><comment><USER26> Now I'm interested to see what their business model is. It seems like they have a lot of money to throw at services instead of developing it themselves, so I'm interested in their ROI or opportunity cost decisions now.

</comment><comment><USER27> Holy cloud. Well I guess the silver lining is they're leaving lots of room for cost improvements...

</comment><comment><USER28> Does anyone know their bussiness model?

</comment><comment><USER14> That's a great blog post. Very transparent. I'm especially glad he's willingly giving up cheaper alternative for having more value from his services.

I just would have liked some more details on what it means technically... :-)

<comment><USER29> Well, it's transparent about their costs, but I would have liked a little transparency about how they actually make money

<comment><USER14> Very true but I suppose we can't have it all, plus maybe it's sensitive information.

</comment></comment></comment><comment><USER30> I'm surprised that at that scale you are still not building some core functions internally.

Though it makes sense, buy over build is almost always the best choice early stage. It's hard to slow down product velocity to fix things that work fine when costs start to add up. (Also it's easy to say "do you want to save 3k a month or deliver features x,y, and z" and let costs slide)

</comment><comment><USER31> Is there any particular reason they are still using Heroku instead of something like DO or AWS+S3? They can probably save a lot of money that way. Unless Heroku is offering them some good deal?

<comment><USER32> They tell you in the blog post.

"We continue to use Heroku as our main web platform. Despite its premium cost over AWS, Azure, and Google Cloud, Heroku's built-in deployment and configuration tools allow our team to move faster, more confidently, and more reliably.

As we've detailed previously, the alternatives would undoubtably be cheaper on paper. But in reality, the increased simplicity and freedom offered by Heroku for a small, product-focused team is a major cost savings advantage."

<comment><USER33> I'm far from a Devops guy. But deploying to AWS using their native tools are Azure using Microsoft's tools is dead simple.

<comment><USER34> Yeah something doesn't add up.

I'll believe Heroku is easier, but can it be _that_ much easier? For people spending piles of cash on their webscale?

<comment><USER35> I work for a company that runs multiple major websites pulling in tens of millions of users a month. We run on Heroku. We made that decision when we didn't have a single user. Right now we're a team with 25 engineers.

Every time we need to re-negotiate our contract with Heroku we ask ourselves whether we should move away from Heroku or not. So far, the answer has always been no. Complexity would go up and the time spent on DevOps would go up. Right now, any idiot can do a deployment, or a rollback. Most of the things we need are taken care off for us by Heroku and it doesn't cost us any effort. We use Heroku Postgres for our database and we get point-in-time restore for free, without doing anything. We can upgrade our database or create a new follower in minutes. It just requires a couple of clicks. On top of that, all the monitoring is taking care of by Heroku. It just gives us a nice dashboard.

As for costs, on an negotiated Enterprise contract, it's not that bad. If we'd move to AWS or DO for example, we might save a little bit, but the extra engineering resources would quickly make those savings useless. Even if it's a bit more expensive to run on Heroku, it's still cheaper than cobbling together all of those features on another platform.

We've made a couple of small engineering investments to get features that Heroku doesn't offer. For example, we built a simple auto-scaler for dyno's that consume from RabbitMQ. This helps a bit to keep our costs down and respond to massive spikes quickly.

We run our web servers, database, caching, data pipeline etc on Heroku. However, we are not _that_ dependent on Heroku. We use Docker for deployments, so we can easily reproduce what's happening and it reduces our vendor lock-in.

I hope this explains a little why some people might choose to stick to Heroku. It works for us, it might not work for you or anyone else.

<comment><USER33> _We 've made a couple of small engineering investments to get features that Heroku doesn't offer. For example, we built a simple auto-scaler for dyno's that consume from RabbitMQ. This helps a bit to keep our costs down and respond to massive spikes quickly. We run our web servers, database, caching, data pipeline etc on Heroku. However, we are not _that_ dependent on Heroku. We use Docker for deployments, so we can easily reproduce what's happening and it reduces our vendor lock-in._

I missed this part. If you are okay with using managed services, why are you doing so much "undifferentiated heavy lifting"? Setting up autoscaling based on queues, managed RabbitMQ based messages (Amazon MQ), and without knowing what your data pipeline consists of, probably that too could all be done with managed services.

<comment><USER35> Don't imagine anything fancy here. This is roughly 100 lines of Python code that scales based on some tresholds. It took a day or two to develop, test and deploy.

However, we recently found a managed service to do this for us so we'll be switching to that as soon as we can.

If we'd have to spend more engineering resources on our infrastructure than the occasional simple tool, then we'd consider switching away from Heroku. The benefits still outweigh the potential engineering effort of not running on Heroku.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Curious, anyone who knows what the business model is?

The service seems pretty cool :)

</comment><comment><USER37> how do they monetize ? i can't find the monetization ...

<comment><USER38> Maybe API partners

</comment></comment><comment><USER39> I work with these guys since they are customers of Stream. Super solid team, really respect how they have such focus in their execution.

</comment><comment><USER40> it would be nice if each category would line up in this graph: [https://cdn- images-1.medium.com/max/2400/1*Bvw2zcdE146WaXB7i...](https://cdn- images-1.medium.com/max/2400/1*Bvw2zcdE146WaXB7io3tZQ.png) ... kinda hard to read as-is

<comment><USER41> looking at that image fullscreen, the bars seem to be moving to me. Interesting effect

<comment><USER40> visualization fail though

</comment></comment></comment><comment><USER42> I'm using unsplash for a while, They have the best quality free to use pictures on the internet.

As someone who appreciate creative marketing i like how they generate millions of backlinks by asking you to link back to their site and credit the author.

In few years they became among the most popular sites in their niche, a lot thanks to their creative growth approach.

</comment><comment><USER43> How does unsplash make money?

</comment><comment><USER44> TLDR; $98K/mo. Year ago they were 10X smaller and used to cost only $17K.

<comment><USER39> Sounds like they were focused on that 10x growth :D

</comment></comment><comment><USER45> First time hearing about unsplash, thank you!!! This is awesome for us OSS devs.

</comment><comment><USER46> It's cool that they're sharing this information, but using Heroku at this scale is wasteful and fiscally irresponsible.

</comment><comment><USER47> > We continue to use Heroku as our main web platform. Despite its premium cost > over AWS, Azure, and Google Cloud, Heroku's built-in deployment and > configuration tools allow our team to move faster, more confidently, and > more reliably.

This is just bullshit, really. I'd buy this excuse from a service like Snapchat/Facebook in their early years, but unsplash is nothing that changes dramatically all the time.

Every single point in their analysis just shows how they like to waste money. Imgix as the main image CDN? Start serving images using thumbor and a cheap CDN like BunnyCDN or KeyCDN.

They could easily save 60% on their monthly bill. That would enable them to hire 1 or 2 engineers capable of maintaining a few dozen servers on AWS, DO or GCP.

<comment><USER48> > They could easily save 60% on their monthly bill. That would enable them to > hire 1 or 2 engineers capable of maintaining a few dozen servers on AWS, DO > or GCP.

If they reduce their bill and then hire engineers to do the same job they've gained nothing other than an increased headcount for no discernible benefit.

<comment><USER7> If they're not really adding features then its the same staff. Not every change needs a new developer.</comment></comment></comment>


Looking for dedicated servers and flexible storage solution - <AUTHOR>

We are now looking for an ISP providing us with dedicated servers and a lot of flexible storage (comparable to Rackspace uNAS) - but not Rackspace. Anyone? <comment><USER2> openhosting.com, check them out ..</comment>


NYC housing prices in near 'free fall,' conditions mirror recession era - <AUTHOR> https://www.fox5ny.com/news/nyc-housing-prices-in-near-free-fall-conditions-mirror-recession-era-following-tax-hikes <comment><USER2> Importantly, the housing prices that are falling are those for units at the top end of the market, i.e., above $3 million in price. A lot of those expensive condos (25% per the article) remain unsold because they're expensive, the foreign buyers who used to buy most of them can't get their money out of their home countries, and now buyers need to pay an additional tax on top of their condo purchase.

Three's still a lot of demand at the bottom end--if you can find any units in that range for sale.

<comment><USER3> AFAIK, that's how it starts. Top end unit sales fall, top end unit prices fall, and this starts a domino effect. That 3 million dollar condo now sells for 2.5M. The condo that previously sold for 2.5 now looks overpriced, it falls to 2M. The condo that was previously 2M now has to sell for 1.5M, and so on. Eventually, your 1 million dollar condo can't sell for a million anymore, because you can buy something nicer for one million.

<comment><USER4> The pool of potential buyers increases as you move down market. So prices may fall 25% for the absolute top of the market without affecting the median price at all.

</comment></comment></comment><comment><USER5> > In July, New York City increased its mansion tax – a progressive tax that > applies to home sales of more than $1 million – to a maximum of 3.9 percent, > up from a flat-rate of 1 percent.

A bunch of other tax changes and reduced deductions have occured recently that make buying/owning expensive units more expensive - especially for frequent buyers/sellers. So I'd be inclined to think the trend is evidence of less short-term speculation rather than a 'true' downturn in NYC real estate.

</comment><comment><USER6> I don't think all these "recession signs" articles serve any productive purpose. That aside, the article itself mentions this situation is due to the hiked taxes. Anecdotally, I don't see many people in my age cohort looking to buy property anyway, let alone a million dollar condo in NYC. Changing perspectives?

<comment><USER2> It's Fox News. They probably received a mandate from Murdoch to cast it as a recession-warning to match what Trump has been saying.

(Murdoch kept the Fox TV stations and Fox News when he sold Fox to Disney.)

</comment></comment><comment><USER7> I used to live in NYC, and so much money went to both taxes and housing. I do hope living costs come down considerably, a lot of people can't afford to save while living there.

</comment><comment><USER8> Meanwhile retail rent is all time high with some storefronts going^^^^being listed but never rented for over $200/ft.</comment>


This Method Is How Successful Companies Stand Out from Their Competition - <AUTHOR> https://testlio.com/blog/post/successful-companies-stand-competition

<comment><USER2> It's all fluff. Make a great product, your clients will come to you.

<comment><AUTHOR> This is half true. Nothing will ever trump making a great product. However, it would be pretty foolish to just rely on that alone.

Companies need marketing strategies to serve as a catalyst to their product growth. Again, product is king. No doubt about that, because without a good product, no amount of marketing will make it stand out.

But not every company is going to be the next Instagram, Snapchat, or Facebook. Focusing on only product may not work out as well.</comment></comment>


Google Home gets 'Beauty and the Beast' promo, but Google says it's not an ad - <AUTHOR> http://marketingland.com/google-home-beauty-and-the-beast-promo-209424 <comment><AUTHOR> Google is basically injecting 'partner' content into the daily summaries for users, and denied this is a form of advertising.

However, since this blew up quickly online they have already pulled the 'partner content'.</comment>


Google Play Store Now Open for Progressive Web Apps - <AUTHOR> https://medium.com/@firt/google-play-store-now-open-for-progressive-web-apps-ec6f3c6ff3cc <comment><USER2> This is awesome. I've used a number of apps where the PWA is better than their native counterpart. I want more people to use this technology.</comment>