Hacker News Reader

Comment by ranger_danger | Hacker News Reader

Why wouldn't a "agreement" already be in place by the mere fact that those URLs are open to the entire world on purpose? Why can't EU citizens decide they WANT to contact google to download fonts? Banning that automatically doesn't sound very freedom-like.

> There is no legitimate interest for using CDNs when the assets could be self-hosted instead.

I disagree with this because there are several reasons not to host it yourself, especially when you do not have the network/computing capacity to serve your users all of the content by yourself.

And what about loading resources from other third parties that aren't CDNs? Or just accessing any non-EU site in general. Is that now illegal too? It makes no sense to me. This seems wide open for massive abuse.

View on HN

I don't know where you got the impression that google fonts was "automatically banned".

> Why wouldn't a "agreement" already be in place by the mere fact that those URLs are open to the entire world on purpose?

What does that even mean?

> Why wouldn't a "agreement" already be in place by the mere fact that those URLs are open to the entire world on purpose?

An agreement is in place, it often just isn't sufficient to cover what the third party is going to do with the data it gains access to. In those cases an explicit agreement is required.

> Why can't EU citizens decide they WANT to contact google to download fonts? Banning that automatically doesn't sound very freedom-like.

And how would an EU citizen make that choice? This is something the web designer decides, if the choice was presented to the user this would not be a problem.

"Legitimate interest" is not a common expression, but a term of law related to data processing and defined under GDPR:

> “[where] processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.”

https://www.gdpreu.org/the-regulation/key-concepts/legitimat...

As I read it, a CDN does not further any interest of the hoster by processing user data, so it should not be used.

> doesn't sound very freedom-like

GDPR was not made for freedom, but privacy. If anything, it's for "freedom from", at the expense of "freedom to".

> It makes no sense to me. This seems wide open for massive abuse.

That the true purpose of the web - to harvest information about consumers and citizens, and, soon, to train very advanced language models - doesn't make sense to you doesn't make it any better. Despite your condescending comments, GDPR legislation turned out necessary to even make an attempt to prevent actual "massive abuse". In fact, the emergent generative AI armageddon is calling for urgent GDPR legislation updates, such as a requirement for explicit consent to use your comments, code, and other contributions online as input to ML.

Reply on news.ycombinator.com