Google must pay €50 million for GDPR violations, France says

Found on Ars Technica on Monday, 21 January 2019
Browse Legal-Issues

CNIL explained that Google had violated two provisions of the law: first by not making its data-collection policies easily accessible enough and second by not obtaining sufficient and specific user consent for ad personalization across each of Google’s numerous services, including YouTube, Google Maps, and more.

Noyb, an English acronym for "None of your business," has also filed related complaints against Instagram, WhatsApp, and Facebook, which remain pending.

Good to see that courts are taking privacy serious and fine the big companies too.

Russia tries to force Facebook and Twitter to relocate servers to Russia

Found on Ars Technica on Monday, 21 January 2019
Browse Internet

Roskomnadzor, the Russian censorship agency, "said the social-media networks hadn't submitted any formal and specific plans or submitted an acceptable explanation of when they would meet the country's requirements that all servers used to store Russians' personal data be located in Russia," The Wall Street Journal reported today.

"At the moment, the only tools Russia has to enforce its data rules are fines that typically only come to a few thousand dollars or blocking the offending online services, which is an option fraught with technical difficulties," a Reuters article said today.

Nice try, but it won't work.

Facebook is adding petitions to your news feed

Found on Cnet News on Sunday, 20 January 2019
Browse Internet

The social network will start rolling "Community Actions" out to its US users on Monday. It's been testing the feature for several weeks in a couple of markets, TechCrunch first reported Sunday, and is building on that existing pilot.

In the past, activists have been able to post petitions to Facebook via third-party platforms like Change.org or Causes.com. Community Actions simplifies the process and gives Facebook direct oversight to monitor and take petitions down if they violate its community standards.

Not to forget it gives FB even more data about yourself, so the profiles are worth even more when sold to others.

Twins get some 'mystifying' results when they put 5 DNA ancestry kits to the test

Found on CBC on Saturday, 19 January 2019
Browse Various

Last spring, Marketplace host Charlsie Agro and her twin sister, Carly, bought home kits from AncestryDNA, MyHeritage, 23andMe, FamilyTreeDNA and Living DNA, and mailed samples of their DNA to each company for analysis.

Despite having virtually identical DNA, the twins did not receive matching results from any of the companies.

When asked why the twins didn't get the same results given the fact their DNA is so similar, 23andMe told Marketplace in an email that even those minor variations can lead its algorithm to assign slightly different ancestry estimates.

So in other words, the tests are a complete waste of time and money. Not to mention that customers hand over their DNA samples to a profit-focused company who fails to deliver anything substantial.

Firefox to remove UI dark pattern from Screenshot tool after months of complaints

Found on ZD Net on Friday, 18 January 2019
Browse Software

The issue is that the Save button doesn't save the screenshot to the PC, as most users would naturally expect, but uploads the image to a Mozilla server.

This is both a privacy violation, as some users don't appreciate being tricked into uploading sensitive images saved on remote servers, but also an incovenience as users would still have to download the image locally, but in multiple steps afterward.

You have to admit that Mozilla is working as best as it can to totally ruin what is left from the userbase of Firefox. In the past years it has removed features the users liked, added features users don't like while generally trying hard to be a clone of Chrome.

Red Hat gets heebie-jeebies over MongoDB's T&Cs squeeze: NoSQL database dropped

Found on The Register on Thursday, 17 January 2019
Browse Software

Under section 4.7, the release notes say, "Note that the NoSQL MongoDB database server is not included in RHEL 8.0 Beta because it uses the Server Side Public License (SSPL)."

The SSPL differs from other software licenses in that it requires anyone making SSPL software available as a service to publish not only source code and modifications, but also the source code of the infrastructure applications that run SSPL code. This includes, as the license states, "management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available."

That's one way to kill yourself. Not that anything of value will be lost.

Mozilla: Firefox 69 will disable Adobe Flash plugin by default

Found on ZD Net on Wednesday, 16 January 2019
Browse Software

Firefox 69 will be Mozilla's third last step to completely dropping support for the historically buggy plugin, which will reach end of life on December 31, 2020. Flash is the last remaining NPAPI plugin that Firefox supports.

As of Chrome 69, users need to give permission for each site to use Flash every time the browser is restarted.

It's about time. Flash has always been the biggest security issue in any browser. It's amazing how bad and extremely buggy a single plugin can be.

WordPress to show warnings on servers running outdated PHP versions

Found on ZD Net on Tuesday, 15 January 2019
Browse Internet

The current plan is to have the warnings appear for sites using a PHP version prior to the 5.6.x branch (<=5.6).

The reason why the WordPress team wants to push site owners to update their underlying PHP servers is because the PHP team has recently dropped support for security fixes for the PHP 5.6.x and PHP 7.0.x branches.

Obviously the WordPress developers either don't know anything about enterprise grade operating systems, or are blindly riding the "latest is greatest" choo-choo train. Otherwise they would know that relying on version numbers is a grave mistake.

GoDaddy injecting site-breaking JavaScript into customer websites, here's a fix

Found on Tech Republic on Monday, 14 January 2019
Browse Internet

GoDaddy's analytics system is based on W3C Navigation Timing, but the company's practice of unilaterally opting in paying customers to an analytics service—tracking the visitors to websites hosted on GoDaddy services—without forewarning is deserving of criticism.

Kromin notes that he is "not against web host providers monitoring how their servers are running," but that "Injecting JavaScript into pages being served is far from passive and... a violation of trust between the web host and the customer."

Tracking users with methods that sound like a MITM attack are not a smart way to deal with your customers, or the GDPR.

German police ask router owners for help in identifying a bomber's MAC address

Found on ZD Net on Sunday, 13 January 2019
Browse Legal-Issues

In a press release published yesterday, police from the German state of Brandenburg, where the city of Berlin is located, is now asking router owners to comb through their logs for a specific MAC address.

The suspect demanded large sums of money from DHL and threatened to detonate bombs across Germany, at DHL courier stations, private companies, and in public spaces.

Unfortunately, the MAC address is considered as personally identifiable information so it would be covered by the DSGVO/GDPR. So router owners are legally not allowed to store this information, especially not for more than a year.