Google sued for secretly amassing vast trove of user data

WebGL is a fast path to direct hardware execution and kernel space execution.

It’s difficult to patch when things go wrong often requiring driver or kernel coordination.

There might be issues with cross site memory leaking, but I’ve only seen white papers on how this might be an issue.

Fingerprinting avoidance is a complex issue and it's reached the point where you can't simply disable JavaScript / WebGL and assume you're ok. One needs to run additional extensions to project a browser-view that blends in. You can use chrome-private.sh as a base layer you can build on to get there, but you are not going to get it by default (which is why I'm not making any anti-fingerprinting claims in the README).

It's far simpler to treat the profile directory as contaminated waste and nuke it at will. The only assumption you're making is that the browser implements a profile in a given directory properly.

[1] https://github.com/stoically/temporary-containers/wiki/Isola...

It seems it's currently impossible to recover your profile once you reach "Maximum bytes per object exceeded" - the remote end won't even let you delete the offending data.

[1] https://github.com/stoically/temporary-containers/issues/371

[2] https://github.com/mozilla/multi-account-containers/issues/1...

I.e if you use the same container to read news, google knows your news preferences.

That’s a very confusing statement. My server logs don’t filter incoming log entries based on user agent, and certainly not on whether you’re using a “private window” or not.

In addition, the goal of a private/incognito session is to be indistinguishable from regular sessions, otherwise websites can easily discriminate against private sessions (which they’re already trying as hard as they could).

Edit: Wow the number of people on this thread claiming websites should be able to opt people out of logging based on whether they’re using a “private window” (which websites should have absolutely no idea about) makes me question if I’m even on Hacker News.

Edit 2: Chrome sends an X-Client-Data header (which in a sense includes an installation ID, but allegedly has limited entropy) to certain Google properties, and rightfully got a lot of flak for it. It does not do so for incognito sessions. And now we have people arguing that Google should de-incognito incognito sessions to their analytics properties. Crazy stuff.

What about the fact that Incognito is so that "other people who use this device won't see your activity" and it doesn't do anything about tracking?

But what am I talking about! Google KNOWS scale, I’m sure it’ll come together eventually.

Side note, we are spinning out Google into a separate entity, because we are growing so big. The new conglomerate is called Alphabet. It's just a silly accounting action, nothing to see here.

Google is really good about takeout. It's really bad about maintaining my privacy. The opt-outs are limited in scope to the point of being almost meaningless. I don't mind ads being targeted as data being collected about me. Google's privacy tools are a joke.

Google's security tools are a joke too. Google silently drops security support for Android phones after two years, and people unwittingly walk around with zero-day exploitable phones. Chromebooks are similar. If you want to maintain a secure Google Apps domain, you need to pay Google huge bucks. It benefits everyone, especially Google, if the Internet is safe, and Google's attitude here will come back to bite it.

Per Matt Levine's "anything can be securities fraud if you don't tell your shareholders about it", then having the "unprecedented ability to forecast future events" and not informing your shareholders about it could be argued as securities fraud in court. Something to think about.

https://www.reuters.com/article/us-sec-capitalone-insidertra...

Key quote: The Huangs, who are not related, began with a $147,000 investment and together made more than $2.8 million from the trades, a three-year return of 1,819 percent, the SEC said.

The answer here depends a lot on what the hypothetical regulation would be.

Does anyone know how many consumer oriented startups reach 30 million customers?

> But the startup is not capable of compliance, because the law was made for behemoths like google.

If I were 'king of the world' I would consider something like this, but would not have it be a binary 'must comply or exempt' but a spectrum of ranges from 'totally exempt' to 'totally regulated' depending on what percentage of 50% you had.

If you have 5% of user emails, you are responsible for the bottom 10% of regulations and/or you need to fully comply with the regulations for a sample size of 10% of your users.

IDK I need to give it more thought, but first, another zoom meeting awaits.

Regulation and civil lawsuits don't serve the same purpose. Regulation is making the rules. Courts interpret the rules in light of a specific situation.

I agree that regulation can be counter productive. It can create a level playing field or cement dominant positions of encumbants. So let's have good regulation.

Also where does this end? Should car dealerships be allowed to analyze your data? Cars you've bought, cars you test drove etc.?

How? Incognito is meant to keep your history clear from other people who use the computer. It explicitly does nothing about websites tracking your activity.

I was really hoping this would be a lawsuit about Google collection of information period, rather than a quibble like this. Please too remember that Boies etc are the same scumbags (and that's the correct term) who defended Theranos, harassing those who informed the government.

DNT is a header, but it's a preference and not legally binding.

The only thing Google did that was "wrong" is that incognito gave uses the impression that they weren't being tracked externally, when in reality the only thing it does is not save your history and start with no cookies.

Deterministic = I specifically say I'm person X and am logged-in. Probabilistic = I am not logged-in on this browser, but am on the same computer, same IP, and am logged-in on a separate browser at the exact same time under name X. Therefore I'm very likely person X.

It's _very_ frustrating when people immediately discredit someone or something because they don't agree with them, even if they don't have the full story.

Project Veritas does some good work, even if they're blasted in popular culture/mainstream media for being 'biased', 'alt-right', 'etc'. I bet you the downvotes you're getting are just because you mentioned Project Veritas.

They have some very out-landish views, but when they actually put people on the street or go undercover, they've revealed dirt on a lot of companies and people.

It's shocking to me to see society go from "let's look at ALL sides of the coin, no matter how egregiously offensive they are to me" to "fuck 'em, they're trash media, they suck, they shill and are racist, alt-right losers and I'm not going to look at anything they post because in my mind everything they do is bad!"

I don't even go to Project Veritas outside of what I hear in the media, but I still give it a fair look and make my own opinion.