Hacker News Reader

Comment by flipbrad | Hacker News Reader

I'm pretty confident this is to comply with a recent EU ruling that held that EU antispam laws apply to display ads that look like an email in your inbox. In essence the left prompt is a marketing email opt-in, even if it doesn't look like one (nastier people than I would say it's disguising its true nature - not I, of course).

Here's the CJEU case in question: https://www.insideprivacy.com/european-union-2/court-of-just...

View on HN

That's pretty sneaky. Most users will select "more space". Clearly a deliberate Catch 22 for users.

Such a disgustingly unethical design. What kind of sick people come up with this stuff?

Edit: Perhaps showing ads in line with real emails is less visually intrusive then traditional "banner" ads. I take issue specifically with the false choice presented to users in order to manipulate them.

>What kind of sick people come up with this stuff?

Well, Microsoft in this case, and companies like it. They're out to maximize the profit they can extract from their users, so they will do so. People aren't leaving their products in large enough quantities for them to stop doing it.

Which makes this a good opportunity to re-evaluate whether you really need any of their products, or at least see if you can reduce your dependency on anti-user companies.

Don't forget the other side of it: we as programmers, designers, PMs, etc. have a lot more concentrated power than end users do. One of many good reasons to unionize is the ability to set professional standards.

This.

For people in the software biz I think being allowed to make quality products is one of the most important aspects of our working conditions, particularly for our social standing in the long term.

Professional standards have a hard time against monetary incentives. We should work towards making dark patterns simply illegal and removing those incentives.

Edit: AND unionize AND vote for proper labor rights that make unions unnecessary. I just mean to say that it's better to remove the problem rather than trying to "battle" it with more force.

Outlook.com isn’t even a good product if you ignore the ads. Their extremely strict anti spam policies make it very hard to deliver email to their customers.

Gmail has the same "problem". This is a concern for you, the person sending mail to these people, because the people you're trying to send mail to are probably going to complain to you about how they're unable to receive your messages.

I know this is just anecdotal, but IME gmail might send you to spam (and seems to at least sometimes learn not to do so for people you have exchanged mail with before) but MS will simply reject all mail from you if you are a small player without a long-standing deditacted /24 without any way for the recipient to get the mail.

There is also a third choice, you can get Office 365 and remove ads completely. Companies cannot be expected to give away services for free, so if you're not directly sending them money, somebody else is sending them money for you to use it.

Paying for Office 365 does not remove ads. https://answers.microsoft.com/en-us/msoffice/forum/all/how-d...

So you linked to a random answers article (not a good sign) which in fact isn't even about the product being discussed (it's Word, not Outlook). In addition the ad they mentioned isn't an ad at all, it's a resume assistant feature offered as part of the linked in service and doesn't show up unless you open that feature.

I just checked my copy of Word, and honestly that doesn't feel like an ad. Seems like a pretty cool feature for a lot of people, and your link shows how you can disable it through settings.

It's not asking for money nor does it save your personal information, it's just a Github CoPilot for resumes.

I use office 365 and I've never seen an ad (and I would drop microsoft immediately if I did, they are on a very short leash already, although they don't show 3rd party ads their software bags and annoys the f* out of you and makes every effort to steal you data, even on a business subscription, but I digress)

The linked thread talks about a "home" version, and I have (I assume) a business version, though I dont remember seeing an option, that may be why

Windows itself is full of this. Microsoft is clearly not impressed by your thin ‘would drop immediately if I did’ threats.

I have never seen an ad in Windows. Where exactly do they appear?

In the Start Menu? Have you never seen the ads for Candy Crush?

No, never! And I'm not joking. What kind of Windows you folks have? Or it's maybe country dependent???

isn't this web based? in which case the obvious choice is ad blocker

> What kind of sick people come up with this stuff?

Probably a lot of the fine guys and gals on this forum, or people we would all work with. Lets be real here...

doesn't make them any less sick or vile.

This is unhelpful. Whether we like it or not, these are actions driven by incentives, not by some sort of sadism.

We simply need to change the incentives. Calling people names just has zero effect on the situation.

Who's calling people names?

How do you propose to change the incentives? The incentives are money. Surely you have something more helpful than whatever you wanted to accomplish with your retort.

If I told you to your face that you were "sick and vile" for trying to do your job to the best of your ability - without a hint of play or irony - you would probably complain to HR. Name-calling doesn't have to entail the use of nouns.

> you would probably complain to HR

HR are sick and vile

I'm not going to claim that it's right in this situation, but calling people names and social ostracism is a very effective way to modify the behaviors of people. In no small part because people dislike it and it modifies incentives.

> is a very effective way

Is it? I think this an overstatement.

Sadism for financial incentives, just another day of user abuse at Microsoft.

Which choice results in ads being fully eliminated by ublock and pi-hole?

Less visually intrusive is exactly the point. The bastards want to trick you into thinking the ads are your emails.

It's pretty clear which one they want you to pick. Oh, you don't want ads that look like email, I guess you want less space on your screen and slower-loading? Okay fine Mr. Likes Less Space and Slower Loading.

Whenever I see these kinds of choices it always seems like the "bad" choice is the right one.

Similar to clicking buttons during checkout flow that literally say things like "No, I don't want extra protection for my purchase".

Try applying this rule to any popup modals, calls-to-action, and other unsolicited software interactions: Identify the button decorated as "primary" and click the other button instead.

I wonder how many modals use the fine-print button, or even an X, as the primary one, having trained so many users to instantly close modals by searching for those.

Good find. Every prompt I see I now wonder, did the EU do this?

I came across an EU site that now make you click accept before they show you the LINK to a youtube video.

This is a video they made themselves. It's really interesting

You cannot even embed fonts or libraries from a CDN. Because this could be construed as “leaking the visitor’s IP address” to the non-EU “Ausland”. You either have to host everything yourself, or ask the user for consent first.

Once again, shouldn't that be controlled by the browser? The users browser is making the request, not the website.

Of course. Any engineer would solve it that way. And it ran just fine as a browser setting since the 1990s. But the EU isn’t run by engineers. It’s run by bureaucrats who try to save the web without understanding it. They’ve heard nothing of Chesterton’s Fence.

Im pretty sure EU passed GDPR as a response to brexit figgling and facebook/google avoiding paying taxes.” Hurting EU market immensly.

Politics dont understand the web but noticed its dengerous if left unregulated.

Not really. GDPR preparations predated the Brexit vote. It was even completed and passed several months before the vote even happened (back when everyone still expected it to fail, even Cameron who initiated it has no expectation it would pass)

And EU tax avoidance is mainly done through Ireland and the Netherlands which are still member states.

The GDPR is a sensible legislation and no amount of FUD can change that. If you can't explain what you are doing with personal data, you shouldn't be allowed to handle it.

You are also confusing legislation with rulings. GDPR says your business interests cannot outweigh my rights. That's it. Now courts find that leaking my IP address to third countries is something that harms me more than it does your business good. I can live with that.

How does the web browser know if the website is under EU or US jurisdiction?

GDPR applies to the data subject (the person visiting the site). It doesn’t matter where the website is hosted, it matters who visits it.

The website is making the browser make that request, and the user has not had the opportunity to accept or deny the data transfer to the destination. That's it.

I don't believe it makes sense to have every website in the world implement this in a half arsed JavaScript implementation when it could be done once per major browser. Same with the cookie nonsense.

The only real explanation is that the cookie laws were explicitly designed to wear users down into blindly accepting whatever prompts get thrown at them on website load.

Anyone with half a brain and a real intent to reduce tracking would have mandated websites abide by the existing Do not Track toggle. Unfortunately the law was instead introduced by politicians with strong lobbying from media industry. So no brain, and no intent to reduce tracking.

The GDPR isn't a "don't track" law, it's a "tell me what data you collect on me, what you're going to do with it, who are you going to share it with, and allow me to refuse that, retroactively if need be" law. Vastly more nuance than an on/off toggle.

On paper, sure. In practice, it’s a quick path to “yeah whatever I accept all your stuff just show me the damn content I came here for”. The web would be much better off if the law was implanted with normal consumers and sane defaults in mind.

I think ideally the web would be much better off if the law was implemented bilaterally with the US so sites had to make a much more important consideration of whether they want to tick off their users or not. It's not like third party cookie usage is required - websites choose what pieces of tech they'll utilize and they have, on the whole, made a choice that is extremely unfriendly to the consumer.

Websites make the consumer unfriendly choice because it makes them money, the law allows it, and their competitors are already doing it. They’d be fools not to.

If the law was instead “no non-essential cookies may be stored when the do not track flag is set”, consumers would be far better off. But that’d cause significant financial impact to the media companies that lobbied for the current wording, so now the whole world is screwed.

Vastly more nuance than an on/off toggle.

Yes, and the result of that nuance is less privacy and more annoyance. It's an open invitation for sites to use dark patterns to get you to "agree" to tracking. (In fact they "have" to use dark patterns because they specifically aren't allowed to offer you anything in exchange). Either banning tracking outright or requiring sites to obey the DNT header would make much more sense.

It's not an open invitation, in fact those dark patterns are explicitly forbidden in that law :) And many of them have been ruled to be against the law, but compliance is a bit slow.

How is the browser supposed to know what information the website collects, who is it shared with, and manage consent and revocation thereof?

The browser is the one actually opening up the connection in this case. That's why there's so much disagreement in this thread.

Your browser opens the connection to the original website and downloads the base page. That base page references images and js and fonts hosted elsewhere, so your browser opens a connection to download those images. At this point the browser could pop open a dialogue box that says "Hey you said you wanted to communicate with foo.com but I need to grab a pic from bar.com is that cool?"

At no point in this use case does foo.com send anything to bar.com

> At this point the browser could pop open a dialogue box that says "Hey you said you wanted to communicate with foo.com but I need to grab a pic from bar.com is that cool?"

IE 6 in the default configuration did something like that with its yellow bar, IIRC, and all it amounted to was the fastest known method (minutes, for me) to provoke warning fatigue and make people vulnerable, seeing as the same UI was used for installing ActiveX controls.

(Could be it did that all additional resources, though, not just those from a different origin? I don’t remember since I disabled the whole thing near-immediately even when I did actually use IE 6.)

This is unworkable from a usability perspective for as long as hotlinking to external resources is so commonplace. And a user permission might not be an effective way to do this, anyway, given the imbalance in bargaining power, as already seen with adblocker-blockers and such. (See also the 2006 paper, “A pact with the devil”[1].)

[1] https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-666.pdf

Why should the browser be supposed to know all that? It only needs to know if the user has authorized the 3rd-party connection, not why.

The easiest fix would be to have reasonable privacy laws in the US.

This is also the most difficult fix.

And China, and Russia, and every country in Africa?

Are you sure it's an issue if you use a CDN that isn't tracking people?

You mean like Google fonts? Yes, still an issue.

https://developers.google.com/fonts/faq#what_does_using_the_...

"Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure."

They don't say how long the raw data is kept either, on a page trying to minimize the tracking, so we can probably assume it's longer than necessary for technical purposes.

They keep it separate from their other tracking, but that's still collecting user data.

> still collecting user data.

No.

So logging every request indefinitely and in detail wouldn't count?

The fact that you linked that page makes it seem like you agree that a CDN could collect user data.

So what would it look like to meet that bar, by your reckoning?

> ...and in detail...

This is an extremely disingenuous way to phrase it. It's deliberately not hosted on a domain which would have any session information sent. There's no tacking information set by that service. I invite you to actually look at a call to this service (you'll want to Google "browser developer tools", that should get you started) and realize that there is no user data in the request. Because of course there isn't.

>...makes it seem like you agree...

Ah, the classic tactic of standing up a weak strawman and then arguing against that. Good to see you again, nemesis.

> This is an extremely disingenuous way to phrase it.

It's not disingenuous because I was going by what those terms allow. They say nothing about detail level, so when I talk about whether they could be tracking you I will talk about the worst thing those rules allow.

> It's deliberately not hosted on a domain which would have any session information sent.

Being a separate service from the rest of google is an entirely different question from whether it tracks you. And tracking doesn't need session cookies.

> There's no tacking information set by that service. I invite you to actually look at a call to this service (you'll want to Google "browser developer tools", that should get you started) and realize that there is no user data in the request.

That doesn't stop them from fingerprinting me to a moderate extent and storing that with my IP and exact time forever.

> Ah, the classic tactic of standing up a weak strawman and then arguing against that. Good to see you again, nemesis.

It's not a strawman. Strawmen don't say "makes it seem". That's my doing my best to figure out your opinion, so that I can effectively respond to it, and making it very clear that I'm guessing.

So are you saying that guess was wrong, or are you being vague on purpose here?

In terms of strawman and related, my guess would actually fall under "steelman". Assuming the opposite would have been a strawman. Because if my guess was wrong, and you don't think it's possible for a CDN to collect user data, then why did you make this conversation be about a specific CDN in the first place?

It's totally disingenuous to use phrases like logging in detail when there are no details to log.

> if my guess was wrong...

As I have previously said, you're totally wrong and your misunderstanding is so far from what I said that it's hard to understand how you got there. You asked if CDNs that don't track user data needed to worry, I gave an example of one which doesn't track user data and still got into trouble.

> It's totally disingenuous to use phrases like logging in detail when there are no details to log.

That's not disingenuous. You disagree with me about what counts as "details to log". Nobody is acting in bad faith.

> As I have previously said, you're totally wrong and your misunderstanding is so far from what I said that it's hard to understand how you got there.

I made a post talking about the difference between a "CDN that tracks people" and a "CDN that doesn't track people".

You responded by linking a specific CDN as an example of a "CDN that doesn't track people".

So I guessed that you agreed that "CDN that tracks people" and "CDN that doesn't track people" are both things that exist.

Why is that guess "so far from what you said that it's hard to understand"?

You're saying you don't think that, so why didn't you just say "No CDNs can track people"?

If every CDN is a "CDN that doesn't track people", then what use is it to link the terms of a specific CDN? If no CDNs can track people, then it doesn't matter what their terms say!

But as to your argument, I think your definition of tracking is too narrow, but I don't see any way to convince you otherwise so I'm not going to attempt that.

AFAIK the question is whether the CDN’s server is inside or outside the EU. The argument being, if it’s outside, we can’t enforce anything anyway.

Not just where the CDN is, but apparently where the company operating the CDN is incorporated. In the eyes of the EU, it doesn't matter if you serve out of an EU data center if the overall corporate entity is still subject to the laws of the United States.

Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in.

Now people say "oh but if every website hosts their own fonts the browser can't cache them" while sending me 35 megs of shitty tracking Javascript code.

There is a very clear aggressor here and it's not the EU or the regulators.

What about a HTML tag that includes a hash sum? Only request the resource if not already present. That could enable cross-website resource caching without leaking information. (IF the resource the site sends if necessary matches the resource of the tag, otherwise the hash sum would tell the server whether the user visited some other site.) Hashing content makes more sense than relying on the URL staying the same IMHO.

I think the reason this is not done is it would leak to the website if the user had previously downloaded the same file from a different website.

Sure. And you can do the same thing with a CDN file by timing how long it takes to load. Sub millisecond means cache.

It's why newer versions of Firefox and Safari use segmented caches. Which, of course, means that loading fonts from a CDN no longer buys you anything at all.

Chrome as well. (The zdnet article above is about Chrome, which shipped this last year.)

The Decentraleyes extension does this.

Unless the situation has changed the LocalCDN extension is a bit more active and contains more (recent) resources.

Including the hash is exactly what subresource integrity[1] does (it was even designed for a CDN context originally), but so far people haven’t figured out a sufficiently non-leaky design to use it for caching[2,3].

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

[2] https://github.com/w3c/webappsec-subresource-integrity/issue...

[3] https://hillbrad.github.io/sri-addressable-caching/sri-addre...

>Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in.

But it's not "everyone" - it's you. Your computer sends out all the information that is requested from it. That's how the internet is built. Even when a website tries to use an external font it is still your browser that asks the font host for the font.

A little too much blaming the victim vibe from this. "It's not the rapists who let you get raped! You let yourself get raped! Why didn't you have more personal security?"

It seems you either missed the point of what the post was getting at, or you are being purposefully obtuse about it.

Victim blaming? What's the point of your system being open and you are in control if you don't use that control to stop voluntarily sending data to websites you don't want.

I agree that it would be nicer if websites slurped up less data. But to portray a lot of this stuff as the user being the victim is ridiculous. The users are the ones that voluntarily started using browsers made by an adtech companies. There are alternatives but they don't use them! And yet they complain that their data then ends up with the adtech company because their browser, that is under their control, sends it to the company.

In case you didn't realise it's Google who controls the browser not the user.

This design is largely perpetrated by the adtech companies in question. Your reference to an external font is, of course, largely referring to Google Fonts. Nobody embedded externally-hosted fonts until adtech companies started pushing you to just add their convenient code that grabs the fonts from their servers direct, but it's insane we allow this.

Of course, the web browser should do something about it... but the adtech company built that too. "That's how the internet is built" is an aggressively dismissive attitude, because there are specific companies building the Internet. Note that every new trash web standard is written by... oh, yeah, Google too.

Sidebar: I block Google Fonts. You should too.

Yes, but the ones at fault there are us. We choose to use the browser made by them.

So... the problem with that argument is that users do not choose whether or not to have fonts on their webpages. The web developer does that. No browser will, out-of-the-box, ask you "Hey, do you want to send your IP address and Referer to Google in order to see this website with the correct font?" or "Hey, do you want to run this untrustworthy, obfuscated, proprietary blob of Somebody Else's Code in a sandbox?". You just tell the browser "go to this website", and it dutifully does whatever the website says within the web sandbox.

If this was a clickable link to Google, and the EU was saying that telling people to go to Google makes you a GDPR data exporter, then I'd be up in arms about this.

But it's not.

What we're talking about are subresource references, not anchor links. Those get loaded automatically without user control, and users do not get the ability to audit them by default. So it's reasonable to argue that subresource requests are "caused" by the developer of the website, not the user.

Furthermore, this is how actual ad trackers work. It's very common for ad trackers to include a reference to either a script file or a 1x1 pixel GIF (the latter called a "tracking pixel"). This isn't a misinterpretation of GDPR, it's the heart of the issue. If we treat subresources the same as clicking a link, then GDPR is a hollow, toothless meme of a law.

>No browser will, out-of-the-box, ask you "Hey, do you want to send your IP address and Referer to Google in order to see this website with the correct font?"

Then make one that does. Or demand for one. But everybody wants to use Chrome and then they're surprised that their browser doesn't give them the control they want.

The whole point is that Google gets your data because you send it to them. Your browser and computer are under your control.

It's no wonder Apple thrives while taking away control from the user. Because when we do have control we just don't use it.

>Those get loaded automatically without user control, and users do not get the ability to audit them by default. So it's reasonable to argue that subresource requests are "caused" by the developer of the website, not the user.

It would only be reasonable to argue this if you think your computer/browser/os is not under your control. NoScript has been a thing for a long time. How many people actually use it?

On your average modern website (or, really, any website), such a design would result in pop-up fatigue very quickly. This is when you pelt the user with so many permission dialogs and "Are you sure?" prompts that they just learn to click "Yes" to get to the thing they actually want to do. Furthermore, I'm not entirely sure what "No" should even do in this context. Most subresources are non-negotiable - if you do not load them you do not get a working website. So even a slightly-savvy user will try denying things, realize that it breaks websites, and learn that they just have to either click "Yes" or close the tab out and not use that website.

The same concerns apply to NoScript and that browser extension the FSF has that bans non-Free JavaScript. If you point them at GDocs, you don't magically get a tracker-free, Free Software word processor. You just get a broken web page. The reason why users don't exercise this control is because they don't have it to begin with. It's not their webpage to modify.

On a more meta-level, you're arguing for technical controls & DRM where legal ones are needed. We don't want browsers where users can pick and choose where their data goes, but if they choose wrong and don't enable enough trackers they don't get the website they wanted. We want websites that don't have trackers on them to begin with.

This is why Do Not Track was a great idea. No popups because the browser indicates your choice proactively.

The problem was the legal framework to enforce it didn't exist so the industry was just using it as a suggestion. The EFF's voluntary declaration didn't help either.

I think if it had been enforced in the style of GDPR it would have been a great thing to have.

Each origin has its own cache, so it doesn't matter if you load your fonts from the same place as some other site -- they won't be shared.

https://andydavies.me/blog/2018/09/06/safari-caching-and-3rd...

https://www.zdnet.com/article/chromes-new-cache-partitioning...

https://arstechnica.com/gadgets/2020/12/firefox-v85-will-imp...

Additionally - when everything is served from the same server - existing connections can be re-used, resulting in a latency advantage.

Yes but that added inefficiency is also a result of adtech abusing the font cache for tracking. Which led to the need to isolate sites.

That’s just absurd. Browsers, or User-Agents, should be where this is implemented. “This site would like to fetch external resources. Allow or Block?”. Same goes for all those cookie prompts.

Then the consent question would actually be presented in a balanced way. And the preference could be stored even if you wipe cookies. At moment if you distrust cookies, your preferences expressing your distrust of cookies is constantly being reset forcing you be re-prompted again and again.

(It might be harder for regulation to require changes in browser though, and then there's legacy browsers, so I can see how we ended up here)

Is it really harder to require 2-4 entities to make a change than it is to require zillions of website to do it?

Fair point. It would certainly be a better world. Though constantly self-updating browsers are a relatively new thing and the legislators probably wanted to "protect" all those people stuck on IE11?

And legal precedence wise, laws have been requiring things of websites for a long time, but I can't think of any legislation that has required certain behavior by browser applications themselves. Since browsers, in theory, just implement open web standards, requiring something of them is effectively legislating a forced change into web standards. That's a spooky thought.

But let's be real... having individual websites ask for cookie and 3rd party request consent makes opt-out massively less popular than if this was built into the browser. If the "disable ad-targeting cookies" button wasn't hidden behind obtuse UI bespoke to each site, far far more people would opt out of them. I suspect that's a big reason why we got to this arrangement.

GDPR isn't about loading external resources, though. It's about tracking.

The browser has no way of knowing what kind of tracking is going to happen on the server it's connecting to or what jurisdiction that data would fall under.

If trackers would provide metadata indicating what kind of tracking each resource is going to do, then browsers could handle it, but trackers would never do that without being forced because they want to make opting out of tracking as painful as possible.

AIUI the embedding is itself not the issue. The issue is that you are leaking user data to a third party, and this needs to be handled with care, considering the degree of threat to the user data, your legitimate need to use a CDN, and any possible consent. If your CDN assures you that this data will only be used for legitimate purposes and conforming to GDPR, I think (but IANAL) that explicit user consent wouldn't be necessary, as site owners have a legitimate interest in using CDN services. After all, DDoS prevention is even explicitly listed as a legitimate interest, and fulfilling this legitimate interest is itself enough to allow processing of personal data, without further consent. With the Google fonts ruling, the issue seemed to be that there was no such agreement in place, Google is known for aggressively building user profiles, and the technical need for this was judged to be low, as fonts are rather small and the site could have operated with self-hosted fonts. This was considered to go beyond the scope of the legitimate interest - it's essentially selling user data to Google to save a little on bandwidth, and that would require consent.

(Then there is a separate issue with a human rights dispute between EU and US that makes things a bit more complicated)

  > You either have to host everything yourself, or ask the user for consent first.

As a user, I am very very glad that this is the case.

I wonder if nobody in the EU regulatory bodies read what Snowden shared. The fact that requests go to US based datacenters has no impact on US's ability to spy on foreign citizens. They latch on to fiber cables everywhere and slurp up all the data they can. What EU should be doing is telling US to reel in their agencies or else all US tech companies get taxed out of the wazoo for operating in the EU. But no, instead all European citizens and businesses have to suffer through these braindead restrictions in how buttons are placed or what popups are needed as if they have any impact on privacy whatsoever.

This is exactly what the Schrems I/II rulings encapsulated: the Privacy Shield agreement was ruled invalid as any guarantees made on the privacy of European Citizens data transferred to the US were deemed to be fake. This has put a lot of cloud migrations on hold particularly for companies that are dealing with sensitive data, like banks and health care, but also retailers.

So it is approached from the consuming end for better or worse.

Because EU regulators knew what the response will be. Trade wars go both ways, and EU is more vulnerable in case of all out confrontation.

Uh, there's also increasingly broad mandates that all sensitive data of european citizens should be located in european-based datacenters managed by european companies with no legal liability to the US.

Acting like the EU isn't reacting to american spying is frankly just ignorance of the situation.

> I came across an EU site that now make you click accept before they show you the LINK to a youtube video.

This was somewhat common in Germany for years. I also remember Facebook buttons behind such an opt-in mechanism.

>display ads that look like an email in your inbox.

Like the ones in my Gmail.

There are ads in Gmail??

There are ads on the internet?

I think I've even seen ads out of the internet!

They show up before you finish setting up the browser and installing the extensions required for daily usage.

If you have the tabbed inbox enabled (i.e. Social, Promotions, Updates, Forums), then Gmail will insert ads into the non-primary tab that look almost like regular emails. If you have the tabs disabled so that all your messages show up in the Primary inbox, you don't get ads.

To be fair, they are only showing it in the “promotions” tab, which is where all the other junk mail goes to.

Huh.

When did various mail providers start deciding to go from having a spam filter as a selling point to having spam built in?

Around when they decided they could use their "spam" filter to filter out competing or idependent mail providers.

"Would you like misleading fake email ads, or big ugly ads?"

that's so interesting. and an odd ruling?! I've boughten yahoo email ads. and tried gmails promoted version. it's a really interesting idea and seems better than outright spam

plus email inboxes have a huge amount of valuable data it could be one of the most relevant ad experiences if they truly leveraged that data. I buy ads and don't have a problem with a lot of the industry, i'm minority on that here. To me highly relevant ads are way better than mortgage loan quicken shit ads and virus crap I see otherwise.

I think part of the difference here is that you see ads at all. Most of us who hate tracking block ads completely so it's not a choice between relevant ads or irrelevant ones. Either way we don't see them so limiting tracking has no downsides.

But I would especially hate ads showing up in my mailbox. I pay for O365 business so they don't, but if they did I would drop the service immediately. Spam is a big problem and artificially adding ads on top of all that makes it even bigger.

Not all “malicious compliance” is to be celebrated.

> this is to comply with a recent EU ruling

then should n't that UI layout be specific only to EU users?

The linked Twitter user lives in Portugal

Reply on news.ycombinator.com