GitHub will no longer present a cookie notification banner – because it's scrapping non-essential cookies
- Reference: 1608224409
- News link: https://www.theregister.co.uk/2020/12/17/github_will_no_longer_present/
- Source link:
Cookies are files stored in the web browser upon visiting a website. They may be first-party cookies – stored by the visited domain – or third-party cookies – stored on behalf of a third-party, like a digital ad company that has some relationship with the website. They're generally used for storing client-side data related to identification, advertising, tracking, analytics, and other related purposes.
Since cookies have privacy implications – they can be used to track people across the web – regulations like the EU's [1]ePrivacy Directive and General Data Protection Regulation (GDPR) require websites to notify online visitors about the site's use of cookies and to obtain [2]opt-in consent .
Privacy laws in the US haven't gone that far yet but websites anywhere looking to comply with EU law generally include some form of cookie notification/consent banner to alert visitors that their browser will be stuffed with cookies. GitHub did so but no longer does because, as it turns out, the Microsoft-owned outfit didn't really need most of the cookies placed by its website code.
In a blog post published Thursday, GitHub CEO Nat Friedman explains, "At GitHub, we want to protect developer privacy, and we find cookie banners irritating, so we decided to look for a solution. After a brief search, we found one: just don’t use any non-essential cookies. Pretty simple, really."
France fines Google, Amazon €135m total for slipping ad cookies into people's computers without permission [3]READ MORE
The EU rules exempt functional cookies – those necessary for authentication or other technical functions – from the notification requirements. So by getting rid of unnecessary analytics and tracking cookies, GitHub no longer has to present a cookie notice banner.
Friedman says going forward that GitHub will only use cookies necessary to serve GitHub.com. "Developers should not have to sacrifice their privacy to collaborate on GitHub," he [4]said .
In an email, a spokesperson told The Register that GitHub is making this change despite the fact that there's been [5]praise for the company's approach. "We recognize that even the best cookie banner is a sub-par user experience, and decided to put developers, their privacy, and experience first," GitHub's spokesperson said.
GitHub now sets nine cookies: dotcom_user, _gh_sess, has_recent_activity, __Host-user_session_same_site, user_session, device_id, tz, logged_in, and _octo. These cookies, used for necessary functions like logging in, may be consolidated further in the future.
"We removed cookies from github.com and nearly three dozen subdomains," GitHub's spokesperson said. "But this is just the start, and we will carry this commitment forward across all GitHub-owned domains."
The spokesperson said the code-hosting biz does use browser-based storage, like localStorage or IndexedDB, but only for essential purposes. "We use local storage to speed up the loading of assets (CSS, JS), but no information leaves one’s computer," the spokesperson said.
The company also relies on network requests for specific analytics. For example, it makes POST requests to the https://api.github.com/_private/browser/stats endpoint.
"That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers," GitHub's spokesperson explained. "It tells us things like how long a given asset took to load, on average, so that we can optimize the performance of our pages."
We use local storage to speed up the loading of assets (CSS, JS), but no information leaves one’s computer
The tech industry is trying to be more attentive to privacy, or so online ad companies like to suggest. Mark Zuckerberg, head of Facebook, one of the largest data gathering operations around, declared at his company's F8 conference in 2019, "The future is private," perhaps not anticipating his antisocial network's decision to [6]criticize Apple for its tightened iOS app privacy requirements.
Then there's Google, which has said third-party cookies will be [7]phased out by 2022, assuming the search ad giant doesn't let that deadline slip to accommodate laggard ad industry allies.
But cookies are not so much going away as evolving into a set of new technologies that purport to provide ad tracking without the privacy problems. Google has put forth a set of proposals which it calls its [8]Privacy Sandbox , much [9]derided by critics of the company, and other ad industry players have offered their own [10]technical specifications for gathering online data, while somehow protecting privacy despite having not done so in the past.
GitHub may be getting rid of cookie banners and weaning itself from cookie-based tracking but not every business is ready for that diet. And if cookies do go out of fashion, expect whatever replaces them to raise a different set of privacy concerns. ®
Get our [11]Tech Resources
[1] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&from=EN
[2] https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf
[3] https://www.theregister.com/2020/12/11/amazon_google_french_fines/
[4] https://github.blog/2020-12-17-no-cookie-for-you/
[5] https://twitter.com/cuu508/status/1338847797622280194?s=20
[6] https://www.theregister.com/2020/12/16/facebook_apple_privacy/
[7] https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html
[8] https://www.chromium.org/Home/chromium-privacy/privacy-sandbox
[9] https://www.theregister.com/2019/08/22/google_chrome_privacy_sandbox/
[10] https://github.com/w3c/web-advertising
[11] https://whitepapers.theregister.com/
Bloody Microsoft, coming into our house and taking over Github, fixing their issues, improving their security and putting privacy first. What dastardly shenanigans will they be up to next?!
GitHub doesn't really need third party trackers and services, it has the power to collect and analyze the data itself. It's still better because trackers can't track across GitHub - still MS can sell ads to "developers aged 30-40, using .NET and Typescript, from Texas, etc. etc."....
s
Bill doesn't need to track you across the web if he can track you in the real world using his nanobot vaccine
/s
Of course this does nothing to stop other methods of tracking.
Since users of GitHub are likely to be authenticated, in order to access their repositories, it follows that any API requests include that AUTH info, and therefore the back-end will have no issues with recording who does what. The end user has no control over what happens to that data, especially in the US, where the concept of privacy is as screwed up as their date formatting.
On the plus side, this does potentially stop every advertiser and their co-spawn from tracking your every movement. Somewhat.
Unless they're paying MS for that data, of course. In theory, GDPR stops them doing that with data about users in the EU (and for now, at least, the UK, but who knows what will happen with the disaster capitalist race-to-the-bottom here). US users, legally, are fair game, so it remains to see whether Microsoft decide to be ethical with their data or not.
I was going to say the same thing. Unlike (say) a newspaper site, the vast majority of accesses to github are from authenticated users.
The session cookie, which is necessary to permit access for each page view, handily doubles up to allow tracking of which pages you visit and in what order. They'll certainly be analysing that data.
unless the github cookies are used cross-site they'll just be showing how you view other people's repos on github. Somehow I don't think it's all that bad, if no advertising nor "what you see" adjustments are made from that info.
(that doesn't mean there's no 'web bug' on other pages that sneaks a peek at the github cookies to see who you are - that is STILL a possibility, right? Then again so is your IP address in some consolidated tracking database someplace)
Thinking of cookies (in general) there used to be this one plugin [that no longer works nd I can't find an equivalent last I checked] that could put ALL non-white-listed cookies into memory and NOT persistently on disk. You could click a button in the toolbar that would "flush" the memory cookies. Also they'd disappear whenever you closed the browser. So, not only could you white-list only CERTAIN cookies remaining after you close all sessions to that site, you could 'grey list' OTHER cookies so they'd work long enough to get past the analytics crap that login processes seem to want all too often. Then you can FLUSH those things when you're done.
That would make an EXCELLENT built-in feature, wouldn't it? But Firefox's UI changes broke th3e old one (as with many other UI-related plugins I liked having).
Stop making sense ...
Come on Bob, I can't believe I keep agreeing with you. Are you losing your touch, or am I losing mine?
Wow
Microsoft doing something right, whodathunkit?
Well done, to everyone involved in that decision.
Re: Wow
2020 just gets weirder every day
"Privacy turns out to be fairly easy"
Maybe The Register should do that then?
They are, at about the same pace they took to implement https everywhere. I believe that means we'll see them dropping all the unnecessary cookies some time around 2038.
around 2038 ...
...early in the morning of Jan 19th?
re cookie banners, a conjecture
These ultimately emanate from a handful of central sources - such as Google - who deliberately design them to annoy end users with the goal of turning them against data protection regulation; the fairly frequent posts in on-line forums such as this one blaming the EU for these is astroturfing to ascertain the intended reaction (the obvious solution of using only strictly necessary cookies with no banner has been available all the while, it is just incompatible with a business model with privacy violation at its core).
Who would have thought it...
It's nearly as simple as avoiding a parking ticket...