Hacker News

eBay stops me from typing in the thing I want to search for so they can try to persuade me to use the app that I have expressed zero interest in for a decade or so. Guys, I'm trying to press money into your thieving little hands - why are you trying to stop me?

Wells Fargo went so far as to remove their best feature from their website: the Spending breakdown page! they now say go to the app but the app is far worse than the browser version was before they removed it. i might even stop using them just for this mess.

Its always confusing to me since I'm already accesing it through an app.

On iOS Safari, tap the three stacked lines on the URL bar (depending on which Safari view you use), tap Website Settings, then you'll see a Request Desktop Website switch, which should persist for that domain.

I'd recommend using Libredirect if you're on a Firefox-based mobile browser. It can configure redirects to alternate "frontends" that will serve you much more agreeable HTML (though because we live in hell, it will usually still involve antibotting out of sheer necessity. But I accept this.)

For Reddit, my choice for now is safereddit. If I need to view a Reddit link on mobile and old Reddit is blocked as it sometimes is, I just swap the domain to safereddit.com.

For Twitter, my choice has been xcancel for ages. I have no idea how that manages to stay up in spite of Twitter's hostility but it is a Nitter instance that seems to just work.

You can also run these frontends yourself, too, but I assume it requires accounts.

(edit: Also I hope it goes without saying that I don't really have any specific trust that my activity is necessarily more "private" with these frontends, although honestly if I was forced to bet I would have to bet that they are much more respectful to my privacy than Twitter or Reddit are. I just use them for functionality.)

Good luck fellow traveler. If there was more to do in real life, I'd probably had thrown my phone into the ocean by now. I'm about halfway there in spite of the lack of many appealing third spaces.

And don’t ever save the user’s “no” for next time. We need to needle them to use the app EVERY SINGLE TIME the visitor the website.

I wonder sometimes how the team doing the website feels about being treated as second class. Or if it’s the same team and they have to hold their noses to work on it.

The third dumbest smart person I had to work with obviously hated HTML and kept trying to get us to use a DSL instead. At least it wasn’t an in house one, but he had a couple other devs interested in his madness as well. But the two of us who were doing the bulk of the performance work and tricky bug fixes would have been absolutely sunk if we’d allowed that to happen. One of the worst things about React is trying to track back an HTML bug in someone else’s complex React project to the templates that are misbehaving together. The Grafana UI code is madness to debug.We would have been there very quickly and without the dev toolbox to help.

I have Firefox setup to not launch apps on android with permission. I don't have Instagram/Facebook/etc installed. Attempting to view a Instagram link on mobile is the most hostile thing in existence. You essentially can't, but it so aggressively routes you to the website based Google play store it's horrifying.

Some Fucking MBA (SFMBA) heard that apps build customer loyalty and increase eyeball time on their sites, so now their company needs an app.

Repeat (without rinsing).

If the site happens to be a discussion site that starts with 'R', clearing cookies will let you through for a while. In Brave, there's a setting to do so when you leave the page.

National cinema chain has a banner on their web site that says something like “film lovers prefer our app” so they manage to employ a little guilt / social proof as well.

It’s such a small thing in the grand scheme of things but it’s just that final straw for me, someone made the decision to be this shitty to their users because they want to employ extra tracking/data collection / advertising in their app.

The record I saw is more like 1892 partner

"They're enforcing GDPR so here's malicious compliance and our own little template verbiage about how much we do actually 'care' about your privacy. Now click me to deny or blindly accept like you have with EVERY OTHER SITE you've visited since this morning"

Web Crimes Tribunals

Yes, but on whom does it work?

Does it work because you're taking advantage of a group of people who are extremely vulnerable to manipulation? People who already struggle with impulse control, who are prone to making bad financial decisions? The elderly, kids?

We have to escape this mentality that anything that makes money is valid, that the money itself is the validation of "rightness".

Some of us, just some think that maybe enterprises that prey on the vulnerable just don't deserve to be in business. Otherwise everything might as well be payday loans and online gambling. I'm not saying OP is definitely in that category, but I would encourage them to think long and hard about weather or not using dark patterns to goose their sales is really the kind of world we want to be fostering.

On the extreme side, things like blackmail and fraud are generally illegal, even if they can make you money. Most of these dark patterns that "work" tend to follow a similar pattern: by taking advantage of the target, one can extract more money from them.

I would possibly be a terrible salesperson, because these all give me the ick. Your product should provide an offer of genuine value.

The tech field is increasingly devoid of any resemblance of morality.

I guess it's the inevitable parable of anything started by '70s hippies: sooner or later, we all sell out.

That's the real problem: selling drugs works! Forming a cartel to produce and distribute addictive products, killing anyone who gets in your way? It's effective! You're never going to convince someone to stop killing people and dumping their bodies into culverts when they're making money. It's just not reasonable to expect that, or do anything about it.

Very much agree, but also (not saying you're saying otherwise) stealing, lying, entitlement (which is possibly just stealing and lying), and scamming "work." These are checked in large part by a person's aversion to it not just by its lack of working. Of course dark patterns work. If what one says increasingly inches towards 100% misrepresention (but shy of it), people will "mistake" what's being said. "Mistake" doing a lot of blame shifting.

"You're never going to convince someone to stop doing something that is making them money." Reasonable, but I would soften from "never". There was less of it at one point—and it seems logical to guess we have less today than we'll have tomorrow. The main reason is likely that we simply didn't know about these tricks yet, but somewhere below that on the list of the reasons is that some people dropped off from doing it at lesser forms of misrepresentation. Or they made the case against it at work resulting in them either winning (and their projects perhaps did less well) or them losing and being overrun by those more willing. With losing possible also leading towards leaving, not getting promoted, or getting fired. This is just a way to say that there are people who do forgo money, they just might not be around or visible for various reasons. And, as implied by the difficulty of convincing people to not make money, their (former) coworkers prefer that on some level even if they don't believe they agree with stealing or lying. But losing or earning less money is not the same as having no choice.

Absolutely. Maybe the answer is that everyone should just rank them up to 11 until it stops working and then people have to get creative again.

If this is the only way to get people to watch your videos, maybe your channel sucks. But glad you are making money tricking people into wasting their time so you can get one more ad impression.

Don't get me started on "like and subscribe".

Always randomly generated!

I wish we had a UI paradigm where whatever is underneath your cursor is not allowed to change. If you hover a button, that button must remain right there for you to click, if you hover some text, it must remain there for you to select. Browser and OS-enforced, ideally.

We can debate the specifics, maybe it's only in effect for X seconds after you stop moving the cursor, maybe it creates a 100px diameter disk of stability, I don't know. Just let me interact with the stuff I see.

The page of my bank's website (ABN AMRO) which shows an account's transactions does this in the worst way. It all loads perfectly, it shows the transactions, I move to click on one or the button for a new transfer, and boom a message gets loaded in at the top which shifts every fucking item on the page down 20 pixels or so.

The message is always something inane like 'markets go brrr¹', and it's never something I need at the moment on that page (or anywhere else). I can dismiss the message (hooray?) but it always comes back the next time, so that isn't actually helpful at all.

1: Obviously they use carefully blandified corporate bank language for those messages.

This. My favorite is when I search for products on a website or app and the results appear in batches, with subsequent results interleaving with the previous results. So when you want to select a particular result and start to move your mouse and click, or move your finger and press, you often end up selecting something unintended because a later result pops into the location.

Better yet, detect mouse clicks and display a popup right where you clicked that says something you didn't want, and show a busy indicator to make sure the user understands that they just agreed to something important.

It's important to have the accept cookies button pop up on top of something you are almost guaranteed to click at just the right moment.

I was waiting for the overlay that hides the content until you turn off your ad blocker. Which of course is a trap because as soon as you do it covers the content in ads.

Yes, and put a search bar that loses focus to some piece of crap I dont care about after I enter 3 characters, and some hotkeys that navigate me to a different page when I accidentally activate them because I thought I was going to put text in the search field.

youtube people I know you are in here. Fix your stupid PIP thing.

..... In such a way that most commonly used button is replaced by an ad 0.001 seconds before you click it

js eventListener that intercepts the click/tap event, moves the button somewhere else, and clicks the ad underneath.

That reasoning isn't wrong, though it seems ridiculous when looked at with techie-brain. But if there is a standard expectation of what serious company websites are like, it makes business sense to look like that too. It's like dressing up appropriately to cultural expectations. You can deviate somewhat but you have to strategically spend your weirdness points.

You could have a 'no cookies' badge that links to your cookie policy - 'we use no tracking cookies and so are compliant with EU law ... then list any cookies/local-storage used and explain what they're for.

No one is tanking UX to stick it to the EU. It would be better for them to simply not piss off their users. They are covering their ass.

The obvious conclusion is that when you try to regulate something like this you arent going to get the behavior you want.

Many years ago, I used to make informational websites for small, local businesses and they all wanted the cookie banner "just to be safe", even after explaining they didn't need it.

In my experience, most people come in two camps: 1) they just click to make it go away because they click everything and would agree to sell their own mother to organ scrappers just to get past the annoyance, and 2) they understand what it's asking and are immediately suspicious.

I built an ecommerce site long ago, and even though the UI was fairly modern for the time, they insisted we use antiquated styling on the billing forms of the checkout page to help exude trust. As a developer it bugged me because I knew it was just styling, but they probably weren't wrong.

I have had the same discussion multiple times at multiple companies. Luckily most of them were fine with dismissing the popup with a timer.

> and he said "yeah, but it makes the site seem less legitimate.

He may be right, sadly. I’ve seen the lack of a cookie banner used to suggest that a site was doing something shady or not complying with the law.

Most people don’t have knowledge about the finer details of cookie laws. They’ve been trained to believe that legitimate sites who comply with the laws will implement the cookie banner, and not seeing it feels suspiciously unprofessional.

I'd say just remove it. Don't ask people who don't actually understand the cost of having it there because you will get the wrong answers. Sometimes people just have to do the right thing, take some heat and then everyone can move on. If it has severe consequences then that's probably a good reason to leave anyway.

Back in the day, this is how we introduced AWS at a large company. We just did it. And once done, they couldn't deny that it cost a fraction of what we were paying our supplier and that things took minutes to set up rather than weeks. And that they worked a lot better.

Yes, there was shouting in meeting rooms. And yes, people said "you can't do this". Turns out they were wrong. A few years later I mentioned this to Werner Vogels. During a meeting. Where my CEO and CTO were present. And where everyone was feeling very good about us being one of AWS' biggest customers in our region.

So when someone says "you can't do that", sometimes you should make them prove it.

(At the time AWS was a good idea. Today dependence on a US service provider is a harder sell in Europe. The _first_ question you get today is if we can host it ourselves if we need to or if we can use a local service provider.)

Reminds me of the early days of the CANSPAM act.

One of the best indicators that something was not spam was the unsubscribe button.

> but it makes the site seem less legitimate

I have yet to head that cookie prompts are a sign of legitimacy. What business has customers that would think that way?

>it's an example of malicious compliance

So how would you do ePrivacy Directive compliance/risk avoidance in a non-obnoxious way?

Good point. The page should have 200MB of assets so that it loads slowly, making it look like there's serious engineering going on.

CFO should be fired immediately.

Not web devs per se, I’d be hard pressed to find a serious web dev who wanted to “forcefully sodomize users”. Thats a management thing

Actually the purpose was not to invade our privacy as much, which we do and there is active lobbying (for example by Google) against any better solution: https://noyb.eu/en/eu-member-states-and-google-suddenly-want...

Classic over-regulation producing unintended side effects

Nah fuck the companies and their horse shit.

99% percent of them intentionally turn the "decline" choice into a 5 - 10 step game of dark patterns even though the EU policy says it should be equally easy to decline. They know its bullshit but they also know the chance that someone will drag them through court is low.

I’ve long believed that making companies liable for paying damages if PII is leaked in a data breach would be the best way to stop excessive tracking. If you force them to have to manage user data like they’re handling radioactive waste then the expense and overhead involved is a natural drag on the business logic that drives the bottomless appetite for data collection. They’ll collect it if they actually need it, and they’ll take great pains to secure it.

1. It's also a piece of cake to just not display the cookie banner for non-EU IPs

2. If you are a purely US entity with no actual business presence in the EU, you only need to comply with US laws and nothing else. If the EU doesn't like a purely-foreign website, it's on them to set up a national firewall and block it.

Case in point 1: It's not on you to comply with China's laws, it's on them to block it if they want to

Case in point 2: China's local businesses with no EU presence do not follow GDPR and do not display cookie banners even if accessed from the EU

Do not track has been used by ad companies to track users, it’s one of the datapoints that can be used to identify your fingerprint

Policy should never assume good faith actors. There wouldn't need to be policy if an assumption of good faith was a valid substrate for the policy. The policy is bad because its authors built it in a vacuum, without any thought or care put towards how its compliance would actually instatiate. This is a consistent problem with EU regulators. The 'tax' the policy levies on invasive cookie use (which I agree is broken and horrific) is forwarded to the user, via this terrible, omnipresent popup. The policy has made the problem worse, by further densensitizing humanity at large to this terrible practice. Shameful behavior by EU regulators and they should absolutely be pilloried for the present state.

> Policy making assumed good faith actors

Let's not paint the policymakers naïve when they're in fact incompetent.

The biggest positive outcome of the whole GDPR affair is that people finally believe me when I say that yes, they are selling your data to thousands of 3rd parties, and no, I'm not making these numbers up or exagerrating at all.

I’m certain it’s often just the California “literally everything is known to cause cancer” problem.

It’s simplest just to put the bullshit everywhere and the dipshit bureaucrats will leave everyone alone.

I have always seen the cookie banner as a sort of punishment to the public for daring to have demanded better treatment.

“Oh you want consent involved in this interaction? Then we’ll annoy you about it constantly instead of respecting the intent of the regulation.”

"Every time you visit the websites managed by the European Commission, you will be prompted to accept or refuse cookies." https://european-union.europa.eu/cookies_en

>The only mistake EU policymakers made was underestimating how willing companies were to deface their websites.

Yes and that is a MASSIVE mistake for a policymaker to commit. They should absolutely be pilloried for their incredible lack of foresight and understanding of how internet companies handle compliance. The policy has set back humanity by further desensitizing internet users around the world to the terrible, endemic use of cookies by most websites.

That shows the same fundamental misunderstanding of the modern web that led to the ignorance of EU regulations.

The policy is both, good, but also flawed. For example, you cannot persist settings, because one policy says that website settings should be ephemeral unless user agrees to persist them.

It is not an EU law. Nowhere in GDPR are cookie banners mandated.

Actually big tech is to blame: https://killthecookiebanner.eu/

Downvote all you like, if you're just using purely functional cookies, you don't need a banner.

If they make it hard enough to interact with the actual website, we'll have to use AI!

Clever people with no morals use that to load ads under your finger, timed to create an inadvertent click.

I swear NYT do this in their games app, the play button gets replaced with a subscribe as the late loaded subscribe element shifts the page exactly the amount to put subscribe under your finger. I wonder how well it worked?

manually scrolling before every widget loads should cause a full page refresh.

zooming in should cause a full page refresh

That one is honest at least, makes you aware that you're the product.

And if you scroll back up the content above is completely changed to something else.

Don't give them ideas... LoL

Not a problem; you were on a 28.8k, so the adult banner images would take forever to load, so you could close the pop-ups before they got you in trouble

You're hired

Claude should modernise this. It'll come out looking like all the other results when you search an image engine for "AI landing page": dark, with purple, blue or other neon accents.

That doesn't take away from the fact "I agree" etc can be displayed prominently and often is. "I agree" isn't outlawed