whoknowswhat11

Is this really the case.

The key is that the data controller be able to demonstrate AND RECORD that consent was received. If I clear my cookies, how does data controller prove consent?

“keep a record of consent statements received, so [the controller] can show how consent was obtained, when consent was obtained and the information provided to the data subject at the time ... [and] also be able to show that the data subject was informed and the controller’s workflow met all relevant criteria for a valid consent.”

With that guidance in mind, and from a practical standpoint, consider keeping records of the following:

The name or other identifier of the data subject that consented; The dated document, a timestamp, or note of when an oral consent was made; The version of the consent request and privacy policy existing at the time of the consent; and, The document or data capture form by which the data subject submitted his or her data."

Just seems like some huge liability here if you didn't record the required elements in a manner that allowed you to produce them. Does GDPR allow me to requisition my users devices if I'm investigated?

Of course, we are told GDPR is "easy".

Is GDPR coming to restaurants somehow? Oh god! This really is getting worse and worse. Is this for things like remembering your favorite orders etc? I could see some GDPR arguments there. What if a waitress just remembers your orders in their head - will they need a consent form? If they put it in their CRM / sales system?

The issue folks have is many users if given a choice, will take the free service (instagram / tiktok / free gmail) in return for being tracked if they are given a choice.

Feel free to start up the business that doesn't do this (protonmail etc). But MAJOR services are built the other direction (ie, billions of users worldwide).

I'm not giving a legal opinion, but some say that

"Consent must be freely given, specific, informed and unambiguous."

So a question remains, if you give someone the option to decline to be tracked, is that enough? Or do you need actual consent?

The EU website is doing the tracking with option not to be. Other experts say you really should have consent first before doing any tracking.

Anyways, not giving my opinion on which is right, just that there are different views, and even EU does it in ways I think that folks here do not understand.

The one thing, the EU sites are extremely CLEAR about things, I do like that.

Again, this illustrates are badly understood and hard GDPR is.

Browser preferences are opt-out currently. ie, users has to go set some flag. The GDPR requires informed affirmative consent.

"Consent must be freely given, specific, informed and unambiguous."

So having a website that track you unless you set some browser flag is not enough. Many folks say that you need specific consent to track. That is why there are so many pop-ups on EU websites.

They are not doing that. Matomo anonymous Ip is separate (and google and others use similar features).

They claim no cookie consent is needed because:

* tracking cookies are not used

* the data is not used for any other purpose than analytics

* a user cannot be tracked across days within the same website

https://matomo.org/faq/new-to-piwik/how-do-i-use-matomo-anal...

Reality is EU website sets a 13 month cookie, they clearly explain they will track a lot of data about you.

Anyways, some folks here claim that just using things for analytics is NOT an allowed exception to GDPR notice rules. I mention this to just again show that GDRP is not simple (despite claims here that it is "so easy").

The issue though here is around consent pop-ups being found to violate the GDPR. I'm just pointing out that the pop-ups continue to be very complicated for folks to deal with. My understanding is that the cookie set by the consent pop-ups may now be classified as personal data, requiring a data controller, permissions etc. Or am I misunderstanding this latest twist? Shouldn't be hard to fix, but good lord if you are a smaller player.

Just note, politically somehow cookies have become the big privacy boogeyman. Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc) at least in the US without consequence. Ripoffs online are insane in quantity without much consequence. Major issues like DoS attacks go unaddressed and more.

And because practically while the EU says ads and analytics are not essential, since for free websites they are in reality pretty essential, there is a lot of natural tension there.

I am bummed about SSO issues now and modal cookie popups particularly on mobile etc.

The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website. I've seen data that 95%+ of folks click accept all. So you are delivering a product feature that annoys 95% of your target, it's a losing game.

My own expectation, in long run this compliance overhead will help the mega platforms win out. They are the only ones (youtube / google / microsoft / apple etc) with the scale to really manage the years long investigations, million page doc requests etc. Ie, if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it.

The other side is, vast folks ignore the law and just hope they won't be caught, or do a random (I accept) cookie popup and hope they are covered.

Sorry for not being clearer - I will try to spell things out better.

"Incognito" mode (or whatever one's browser may call it) is irrelevant in this scenario."

No it is not. When looking at what a website does, if you browse in your regular session you may be bringing over a very large cookie store, visit history, prior acceptance of cookie popups. The reason I suggest using a new incognito session is because you start these sessions fresh from a cookie perspective, and the site you are visiting should see you as a new user and re-prompt for cookie acceptance etc. Then you can easily see what they are doing.

It's really actually interesting being lectured and yelled at by "experts" here. I think the GDPR is sort of a bandwagon thing at this point. A fair number of relatively uninformed folks on the issues / technical side jumping on and making a set of fairly strong and often uninformed claims?

You literally have folks saying GDPR is not complicated, and literally on the same threads making plenty of contradicotry claims (ie, totally illegal to not have a deny all button, totally banned to track before acceptance, ok to track before acceptance (default opt-in vs opt-out) etc.

The folks claiming GDPR is easy don't realize how big a consulting industry has sprung up to try and help folks trying to get it right. I mean, tracking rules for the cookie acceptance cookies - is like perfectly up these consultants thing because they make so much money off all this.

Nothing has made it seem like anyone actually looks at any of this themselves. I've been following this a while now.

Open a new incognitio window and go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en

Do not click accept on anything.

Check your cookies. Tracking cookies have been set before consent.

Many on HN are ranting about how something like this is illegal or that the GDPR is easy. The answer is that the GDPR is NOT easy. That some would say that setting tracking cookies on landing without consent is not legal, others that it is, and the EU is all over on enforcement.

If you browse an EU website, they track you without any explicit consent.

I prefer this approach personally, all their websites used to have a modal pop-up, you could not move forward until you consented. Between phone, desktop etc etc, SO annoying. I'm sure it turned a lot of folks off GDPR, so they cheat with this to try and avoid annoying people (as many others do).

I went to their website in incognito mode.

https://ec.europa.eu/info/privacy-policy/europa-analytics_en

Before accepting any cookies I got a _pk_id cookie expiring in 13 months.

They are clear this is what will happen.

Just check it for yourself before you listen to the lies / blather you read here.

The EU's own websites track you on first landing.

Note - I have been following this. They used to do a blocking cookie pop-up. This actually had nothing set on pop-up, but blocked you from using their websites until you gave consent or denied it.

The problem was, these required cookie popups are so annoying that many folks have (perhaps illegally) moved to the EU's new model, where they stick it at the bottom, they set the cookies, and if you just use the website you get them.

Do you understand that even if you don't click accept, if you browse the EU's own websites, they track you?

https://ec.europa.eu/info/privacy-policy/europa-analytics_en

The anti-google / pro-gdpr stuff is almost religious orthodoxy now in terms of its unwillingness to evaluate facts.

We are being told

"They often do not allow a single click deny, you have to go through sometimes dozens of vendors and deny them one-by-one. This is so obviously illegal it isn't even funny."

The site sets two cookies on landing regardless of any clicks anywhere.

Edited because I can't reply:

There are lots of lies being told on this discussion. The EU websites track you even if you don't hit accept. It's a 13 month cookie.

Go here:

https://ec.europa.eu/info/privacy-policy/europa-analytics_en

" When opening a page where Europa Analytics is enabled, the browsing experience is registered by the service.

If you refuse cookies, you will also stop the Europa Analytics service. If you choose, though, to contribute your browsing experience on our websites as part of the anonymous statistics, you will enable us to significantly improve the performance of our communication, its outreach and its cost-efficiency."

Even the EU's own website using cookies.

https://europa.eu/european-union/index_en

Most users don't care about a session cookie or whatever. In fact for some sites / SPAs etc where users are behind NATs are CGNATs they are pretty needed / useful. Or if the website is being hosted behind a load balancer, you can do a sticky session with the cookie, and many more uses.

I'm not sure if this is intended as a joke or not.

" Astronomers are very cost-conscious,"

Have you paid any attention to cost over-runs on TMT or Webb?

Can you give me an example if a larger $100M+ project done on a payment on delivery / fee for service model in astronomy in last decade? I'm seriously interested.

Look at the Origins Space Telescope Project:

https://www.spiedigitallibrary.org/journals/Journal-of-Astro...

The jokes start right away. Design with a fairing for the Space Launch System, which supposedly has a cost of $500M to launch (already estimates are off by 4x!).

I'm not sure if this is intended as a joke or not.

" Astronomers are very cost-conscious,"

Have you paid any attention to cost over-runs on TMT or Webb?

Can you give me an example if a larger $100M+ project done on a payment on delivery / fee for service model in astronomy in last decade? I'm seriously interested.

But it's not actually how they do it.

Payment is based on COST incurred, not delivery. Or expenditure to a limit regardless of outcome.

For Webb we have this:

"All told, NASA has spent about $9.7 billion on the project, which has been delayed by more than six years in the past decade. That's in stark contrast to estimates for the project when it was approved, when it was meant to cost $1 billion to $3.5 billion and launch sometime between 2007 and 2011, according to the GAO report."

Can I ask who is footing the bill if this was payment as delivery was met? Oh right, because it's not.

The only recent efforts towards fee for service were the HLS award and some of the commercial crew program work. Interestingly, the women heading that up (Kathy - very successful) appears to have been sidelined from directing new space development for someone from old space / old boys network.

We really do need a fresh start - the more I poke at this the worse it looks.

Again, if the move is data intensive, do a fleet in space, do long baseline stuff in space if possible.

We went from inmarsat (I was a user) to starlink launching. The differences are remarkable.

All we hear from astro community is how terrible this change is. Well, if you read a bit of sci-fi, space (LEO) is going to get more crowded, so a solution is to get above the crowds.

This is what is so interesting to me. I'm not saying EUV astro in particular. And frankly how does EUV even work terrestrially? From what I've seen it really doesn't work so well.

What I am pointing out is that something has gone wrong, badly, in astronomy. The TMT is the telescope I've been following most closely. The costing just doesn't make sense. The project delivery seems horrible.

Shall we use the TMT as our example? Its going to HAVE to have some sort of actuation on mirrors, because its sitting under atmosphere. Period. There is going to be noise from atmo in the imaging. So you are already starting behind.

Transmission losses for infra / UV.

My proposal is simple. Put a $2B RFP out for a 9 arc second telescope if that is what is needed, perhaps 10 $1M proposal awards, down select to 3 $20M awards for further work, then down select to 1 or 2 $1B-$2B awards depending on where the bidding comes in. Payment as delivery is met.

Find folks who instead of criticizing dirt cheap access to space can think of ways to take advantage of it.

Note that I say this having written sections of or supported very successful govt grant proposals, chased all the preference points, yadda yadda. An amazing waste of time if someone else had the "in" and you didn't realize it, and sometimes you crush everyone for no good reason other than your proposal checks every box very carefully.

The swap is generally for light collector, being exposed to a plasma light source! I would expect demands in astro to be much simpler. These machines are in the 10's to 100's of kw of power needed.

Size is 15-20 inches. Despite what you might think, "thirty" meter telescope does not have a 30M primary. The move is to segments.

EUV is one of the hardest to target for reflection. I'm not sure what astro is getting in terms of reflectivity if they even need EUV, my guess is Zeiss is crushing that in most cases.

Existing players generally get to keep their funding for a while.

Space Launch System is ticking along, going to be $20B to first launch and then $2B per launch after that - just imagine those costs.

I have no doubt old Astro existing projects will continue hoovering up the $$. That's fine, some of these are major sunk costs.

I'm pitching throwing some new funding streams at new ideas / providers. Lock out the folks who don't see opportunity (they can still do what they do, just don't have them hoover up the new money).

Or set an observing objective (ie, planets around other starts) and only pay a fixed price on delivery, and put it out to bid.

You need to understand, most of astro now is not delivery based, it's cost based.

At UC berkeley, if you get a grant for your research work at your oncampus office, before you pay for any of your own overhead, berkeley will take probably 40%-60% for just straight "overhead". So a $100M grant, 40M of that will evaporate immediately. No delivery is actually required BTW - just incurring costs -> that's the billable metric. And note, that you are "on campus" when working from your house these days!

One group is building a 100,000+ part device, with much HIGHER accuracy than astro, using a miserable wavelength (UV) for $200M a machine.

Not only that, they are doing UV light emission generation (dual laser) at 50,000 per second just to generate the light.

Actuation speeds are actually ridiculous in these machines as they image. Precision is ridiculous (and far higher than astro), lifetimes are pretty good so far. Reflectivity? EUV is one of the hardest wavelengths to manage reflectivity at. Does it even do anything on a standard polished surface? I would expect it to be absorbed pretty much 100%.

In terms of size, if you look at the individual elements the TMT is not one mirror, it is many smaller mirrors.

I think your comment sort of explains why astro is trapped. There is not a willingness to consider options.

Exactly - try new things, experiment.

The existing funding streams are calcified, and we've gotten to a point with the monster projects that they basically turn into drag out career builders.

Things like James Webb, TMT etc. At some point we have to try new things.

If you look into TMT closely, the actual optics package etc - $3B is a ridiculous price. It's just totally crazy. If we pulled pricing apart we'd find out that an incredible amount is going into overheads of various sorts.

ASML makes machines with 100,000+ parts, the precision needed is absolutely mind blowing. 4 747's and 40 containers to ship it. $200 - $500M tops.

https://www.cnbc.com/2021/10/12/chip-machine-maker-asml-will...

I'm serious, the precision of mirrors in these machines absolutely rivals or crushes astro precision. "The mirrors are polished to a smoothness of less than one atom’s thickness. To put that in perspective, if the mirrors were the size of Germany, the tallest ‘mountain’ would be just 1 mm high."

I agree - and might reveal that our diet these days is pretty amazing.

I lived in Europe for a number of years. At least then, transit was great and I used it extensively. In San Francisco at least, for policy reasons, transit is pretty grim.

I witnessed a guy getting beat up for stopping a tourist scam. Interestingly, after they grabbed his shoes and he chased them HE was arrested.

I saw an old women be spit on (huge spit) while sitting in the handicap seat.

What's very unique in San Francisco, passengers know that if they get involved and a claim of excessive force, racial etc factors come in - they may have a career ending consequences or liability. AS a result, again, no one will help you. It's really amazing watching TOTALLY brazen theft from stores, from cars, folks getting harassed while on transit. No one will step in. I wouldn't be surprised if someone was dying that folks might step over them or around them, it's that socialized.

This may have changed in the EU, but when I was there it just wasn't comparable at all. The US model for transit has soured me a bit on transit. At some point you need to make it so it serves the 95% that want a safe ride, perhaps doing on call pickup transits for those struggling with mental health / drug and other issues who still need to get places?

Bottom line though - I'd encourage govt to create safe options people WANT to use vs focusing on banning things (out here major efforts to get uber banned so taxi cartels could take over again with their "broken" credit card meters, unreliable pickups, failures to service areas etc).

Uhh - that's pretty normal. If I buy my full frame Nikon off craigslist - no warrenty comes with this.

"nasty move".

Only on HN would this even be an issue. Most places, if you don't buy from an authorized dealer - no warranty. My HVAC system was the same way. If you bought grey market / off market - no equipment warranty.

Same thing with solar warranty.

The issue with public transit is that

a) its often out of my control in terms of options to fix it

b) some things (violence) seem to have become accepted.

c) there are a ton of (very) entrenched special interests which make touching any element of this difficult.

Options like auto-cars put control in users hands, who can self organize if they want to car share etc.

This is where green folks aren't paying attention to what folks want.

Go ahead and ban straws (put in the trash in the restaurant) while letting tons of plastic blow into the ocean from street litter.

Some folks don't want to be on public transit, including liberals and definitely liberal elites (ie, COVID / crime / dirt / safety / whatever).

There is no middle ground on the green / left. We all have to cram into public transit (I took it for a while, the bus would skip my stop if full, NO ONE took action on the clearly crazy idiots disrupting the ride forcing the bus to stop etc). Ideas like robotaxies are fought. Why? I don't get it.

I'm also convinced many liberals / green folks are either very wealthy or don't live in tougher areas. It seems to be -> you take the bus, while I fly my private jet to talk about climate somewhere.

Weirdly, it's going to be the ruthless capitlists, google, uber (ugh!), tesla (run by a bit of maniac) who are moving us forward.

Little support locally. Ie, do a lane on highway dedicated for auto-drive truck trains and cars etc.

I've noticed more an more "environmental" or "green" type politicans and activists seem to be very anti-progress? Has anyone else noticed this?

For example, automated cars would allow you to park your car outside of the city, but still have car driving to get places. Get's criticized. Would allow for larger capital investments in cars (batteries etc). Just removing parking alone would free up so much space for either more efficient car transport or additional options (yes, bikes).

Auto cars increase sharing opportunities as well. Reducing car ownership.

Smaller / safer nuclear power research would be near totally CO2 emission free - but big fights against that or even exploring it - while talking about how serious climate change is?

Carbon sequestration, storage, capture, ideas to drive global cooling - all shot down.

I've come to think we may end up with a rich group of folks able / willing to invest in stuff creating a sort of second tier society (ie, clean water, air and temp control for them - the rest of us suffering).

This path of emissions reductions can't be the only option worth exploring, even while we pursue it, start thinking of other ideas!

Wow - that is an absolutely incredible result for a heart transplant! Very unusual situation. Be interesting to understand the specifics - and the team doing this kind of work!

Actually, the 64/64 split is not always the same.

I cannot get my ISP to allocate me a SINGLE static ipv6. So it's much MUCH more expensive to get an ipv6 address than an ipv4 static IP address.

It's a combination of a couple of factors.

1) Huawei had a tech / competitive lead vis a vis western firms, so those firms have been pushing / lobbying / this narrative of distrust around Huawei.

2) Huawei has done itself NO favors by just ridiculous actions - I think not realizing they are trying to sell into a western market where some of these stunts don't come across so well. In China helping N. Korea not a big deal and makes sense, China doesn't want N Koreans flooding over border. But then I thought the claims that no assistance etc offered was silly, just say yes, for x reasons we helped y country with their telecom.