My experience was probably exactly as intended. Click on the "What is a dickover?" link trying to come up with things that it might be. And a brief moment after the page loaded (this little pause is crucial) I am hit in the face with a big annoying popup saying "This is a Dickover" followed by immediate understanding.
Now at least I know what to call it the next time I visit Substack.
I have a theory that about 97% of developers and managers completed the cookie consent (or whatever) on their own product 5 years ago and hence never see it again, and they have no idea how bad the experience for new customers actually is.
So the developers and bosses all think they're doing a great job and they've got a carefully curated homepage, even though the regular users get a cloudflare captcha, then a cookie modal, then a newsletter modal, then an install-our-app modal, all blocking their access to the 'buy product' button.
I really don’t understand why the desired cookie behavior could not be set globally for all websites in the browser. Why do I have the accept / reject them on every website and trust the website will actually do what I ask.
It can be, see Global Privacy Control [1]. As an example, the Complianz consent plugin for WordPress can detect and respect the user's GPC setting, but that feature can be toggled. So even though this exists, many sites will still ignore it.
This sounds like it would be a better implementation than 99.9% of the dickovers I encounter. Almost always, I dismiss them, then see them again in future. Sometimes with what feels like every site visit.
You see them again in the future because you dismissed them, if you do what they want you to do they will never bother you again in case you changed your mind.
Oh we care, but when it comes to cookie dickovers, we care more about making the corporate lawyers happy.
I’ll admit that I definitely like collecting my paycheck much more than I worry about customer annoyance at acknowledging a cookie policy. Some hills ain't worth dying on.
Protecting forms with reCAPTCHA uses cookies that fall under "marketing" and gathering site stats using Google Analytics uses cookies that fall under "marketing" and "statistics," making a consent banner or dickover pretty much required.
Are these services necessary for a page to work? Not at all, but many businesses consider them crucial. Unprotected public forms almost immediately start getting spammed by bots, burying real, important communications from potential clients. GA offers insight into what visitors to your site are looking for, which has real business value.
I don't like it any more than you do, but I get why businesses would choose to use these. On their end, at least with reCAPTCHA, they're just trying to protect themselves from the complete shitshow that the modern web has become.
The vast majority of users don’t know or care. The ones who do are blocking the cookies anyways. No one wins with these popups (except trial lawyers and sellers of cookie consent SaaS, of course).
We use a third party cookie consent service. It shows different things depending on your location (and allows disabling different types of cookies depending on your local laws). Lawyers mandate it. It's easier than having to figure out the laws everywhere on our own. To me it shows a banner that stays out of the way. But I couldn't tell you for sure it doesn't cover the whole page to other people.
Developers just aren’t good at determining what works best for the user experience. How would designers and PMs justify the hundreds of thousands of hours of combined industry research poured into that beautiful, performant front page design and following modal auto-load?
one of the more memorable stories from the daily wtf was from a dev at a banner ad company who got called into a VP's office and yelled at at great length because some pop-up banner was broken. after investigation it turned out the VP had installed an ad blocker and forgotten about it.
Very accurate terminology for things that are equally as welcome as the developer sending each user a surprise popup pic of their dickover and over again.
Could you or someone working on this make it easier to share the original link for a small web post? It’s difficult to the point of making me think you’re trying to force me to share the Kagi version of the url.
Flag it please, want to think you were unlocky/page added it after inclusion. It is still a manual effort to verify them, mistakes happen. Definetely not intended.
i just joined this recently, cute community. I started browsing it right after and if you skip the AI slop, it's crazy how many people are good writers
Yandex is great. When you want to see news/sites/whatever that does not conform to what the western mainstream powers "accepts as acceptable", you can go to Yandex and you will find it there. When Google search went to shit some years ago I discovered Yandex and found out how much of the web was being deliberately kept away from my eyes. You need search engines from every major power broker in the world to get a full picture of what we arrogantly like to call "truth".
I endorse this name because, once it's the standard name for this technique, people will have to use it in meetings when seriously proposing them, which makes it harder to seriously propose.
"And this is our design for the Dickover."
"Guys, I'm not sure we should Dickover the customers."
"You know, when you say it that way...."
Epilogue: six months later, the site is dead because they converted nobody to their newsletter.
Who are those people? Those perpetually amused folk who feel not a bit of rage when a dickover is slapped in their face, and for whom entering their e-mail address in the dickover is actually a thing they would seriously consider?
And a lot of the time pressing back will take you to some other article on the website instead of where you came from. Because the site used history.pushState in JavaScript to manipulate your history.
I explicitly disable these on Substack but it adds them to my posts anyway. I'm not sure if that's a bug or the thing working as intended, but it was enough to make me stop using it. I don't want to do that to my readers.
It's kinda hilarious that on an article about said "dickovers", the page has one of these consuming 80% of the screen real estate: https://files.catbox.moe/ztjg15.png
Oh yay, the nazi content again. Don't let the Feb 2026 article date fool you, this has been talked about for years and they don't lift a finger. It's like how Meta isn't incentivized to block scams because they profit off of them to the tune of a billion dollars a year.
However, I do appreciate white supremacist trash outing themselves in public. Get it on the record. Some of them try to hide, but: Patriot Front had a huge leak of data in 2022 (400GB).
"Patriot Front Fascist Leak Exposes Nationwide Racist Campaigns"[0]
You can download it at the following torrent address:
You're overreacting. They do coordinated petty vandalism motivated by politics. Not great but not something to be doxxing people for, especially people who didn't even do anything wrong. Your problem is that society has trained you to hate people with their kind of political beliefs and that hate lets you justify trying to harm them. Don't you remember all of history when people hated each other's political alignments? It never goes well.
Did anyone else think this was a clever keming pun?
Fortunately, for those sites where either JS is required for the content or to remove the dickover, browsers still have an Inspect Element tool that makes deleting this and other annoyances not too difficult and rather cathartic.
I, like most people, always just click whatever option is larger and easier to click (or closest to my cursor at the time). It never seems to matter to my experience which I pick. Sometimes it’s the “all” option, sometimes it’s the “none” option, etc.
I feel bad about doing this, because surely someone somewhere is doing analytics on click data and saying: “See! There is a lot of variation in responses to this cookie choice, people are really taking them seriously, we should keep them!”
This whole cookie dickover concept is malicious compliance. The goal was: no tracking but ask consent if you must ("who would do this, that would be super annoying"). Except every website decided they'd rather annoy everyone.
Well… Europe do require the accept and deny options to both be equally visible and accessible, see for example this week-old court ruling:
> Administrative Court (BVwG), thereby upholding a decision made by the Austrian Data Protection Authority in 2024. Specifically, the ORF must ensure that the buttons to ‘accept’ or ‘reject’ tracking cookies are designed equally so that visitors are not tricked into agreeing.
GDPR doesn't mandate cookie banners, it says that you simply cannot store irrelevant PII for the sake of it. That's the point of it: to protect the privacy of the public against "data brokers" and other scum. You're welcome.
People seem to have forgotten, but cookie banners were a pest before GDPR. And newsletters and login popovers, those are GDPR?
Did you know that a Substack's author can turn the annoying popup off? Go to dashboard -> settings, and then it's "Enable subscribe prompts on post page" under "Growth."
I’m just kind of surprised that it works to convert people.
Or…maybe it doesn’t?
Some of these things that we have are just common practices that owners of websites do that are seemingly done automatically without much thought to the experience.
Yeah this is really bad. Firefox + uBlock Origin + Filters cleans a lot of these dickovers. Some seem to slip through the cracks. There's a never ending fight between bad websites and the warriors trying to protect our attention.
For me the fact that dickovers are possible is a bug in all JavaScript interpreters.
In my opinion, any decent browser should make impossible both dickovers and also other related hostile actions, like the possibility for a Web page to modify the right-click menu or to prevent text selection.
Unfortunately completely disabling scripts is rarely a solution, because many sites do not work at all. But the kind of actions mentioned above never serve a useful purpose for the user, so they should be ineffective and their should be no way for the hostile site to determine whether they work or no.
Modal windows may sometimes be useful in applications that are controlled by myself, but it should always be possible to override them in externally-controlled applications, like when browsing Internet sites.
Genuine question, what is it that the JS implementation or DOM or anything the in the browser can do to permit desired modal popover content like dropdown menus and tooltips and floating nav bars while somehow preventing dickovers?
Like I have said, in a browser there should not exist truly modal windows.
The cases when modal windows are used abusively are far more numerous than the cases when they are useful.
Perhaps there should be a way to warn the user when moving the focus from a window that is supposed to be modal, but if the user insists it should be possible to disregard that a window is intended to be modal.
Also, it should be possible for the user to move any window as desired. It should not have been possible for windows to move on their own and to prevent the user from moving them. A script should also not be able to move the mouse cursor or any other kind of cursor.
A browser must always treat a script as potentially hostile, so all these facilities that can be used by a script to mess with the browser GUI should never have existed.
I've used the politer term "pie" for these things, since they are usually thrown in the user's face like a pie, after the normal screen has been shown for a few seconds.
In the old days, JS allowed window.open() which would create a new window on the user's sceren. That naturally was abused horribly, leading to pop-up-blocker extensions and then built-in browser permissions. We need the same thing for pies/dickovers, which are at root a workaround to the presence of pop-up blocking.
My first reaction to "dickover" was that it sounded like another Marion Zimmer Bradley fantasy fiction series...
He claims that dickovers aren't as bad as the dickbars, but I think they're equal.
The dickover is a big, immediate distraction that you can't help but deal with.
But the dickbar is insidious because you forget it's even there. You just get used to always seeing whatever banner is there and think it's just a permenant piece of the interface and you adapt to not having 25% of your viewport.
You can prevent the loading of most pop ups and many nag screens and cookie demands by simply having a browser configured with an "add-on" that allows you to toggle of and toggle on javascript. There are several add-ons available.
Alternatively, you have another browser with javascript permanently disabled and keep it minimized in the tray, or in the background.
A lot of websites that demand subscriptions, post nagscreens or use other blocks whereby the website can be read by simply toggling off javascript.
Javascript in websites has become what corporations use to manipulate & control us and do things like post nag screens & demand subscriptions.
When I run across websites that demand javascript before they will load I just shitcan them and eliminate them from viewing forever.
As a long time DF reader I can assure you that John does not use Chrome to browse the world wide web.
You are almost certainly correct in saying he is using it to illustrate his point because Chrome is engineered to be part of the internet advertising complex that commits so many of these crimes against design.
Talking of dark patterns I’ve noticed that many site “accidentally” have the bottom aligned cookie consent banner “break” on mobile Safari, such that the buttons are arranged such that “Accept All” is the only button you can press because the “Deny All” or “Customize” go out of viewport when you go to click on them. This might be related to how mobile Safari changes the bottom bar as you move to click the button. I often have this with the NYT Wordle game. Even though I use pi-hole to block ads, it’s still annoying.
I was thinking it would be nice if you could at least drag the popup out of the way so you could delay reading it while you first focus on what’s underneath. But then I realized, that would technically be a dick move.
Never thought to call them dickovers before, but it’s apt. At a certain point, I noticed my finger reflexively hitting the ESC key because that usually dismisses a lot of them.
> asking the user to accept “cookies” [...] or anything else that the user couldn’t give two shits about.
Oh, I absolutely care about cookies and whenever I have the option I do not allow the website to place them. That said, I would much prefer an architecture where I express that once in a browser setting and the browser relays that information on to any website somewhere in the background.
A combination of User stylesheet (stylus) or User scripts (greasemonkey) -- superpowered by AI models that can let users target screen elements and shape webpage display and behavior without having to manually deal with precise DOM elements or CSS JS syntax
Best useful tweaks could become part of a curated list like uOrigin ad block lists
Dickovers are annoying -- tell me, what's your solution? For me, a combination of a) not patronizing these sites, but when I have to b) some ad blockers help. Nothing seems to work well though.
Auto reader mode in mobile safari for any site I recognise having read previously that has dickovers, cookie bars, poor typography or any other design issue that distracts me from the content.
e.g. science.org - linked frequently from HN and now every time I click a link to it, I’m dropped into a perfectly readable, distraction free view of the content.
In a similar vein, If I had to explain what javascript was to someone non-technical I would say "you know all that crap that covers up a web site you are trying to look at? That's javascript."
dickover n. : a modal panel, popover, or curtain presented by a website or app, deliberately obscuring its own content to frustrate the user with an unwanted, unnecessary, mandatory interaction
Most people don't care about this and they should, I have the google analytics import on my business endeavors, but why would I put it into a blog? Why subject both myself and my poor readers to yet another tentacle to suck our interaction into its googolplex of data. I hope all webdevs start caring more. On that same note, I hope all webdevs stop using substack, it's so trivial nowadays to make and style your own blog however you want, why take the even lazier route of giving substack control over everything
I suspect two reasons. First, it's not easy to make your own blog - what are you thinking of here - self hosted wordpress, which will surely get hacked? If you use a service like WPEngine, that's no better than using substack.
Second, Google only surfaces the big platforms any more.
I'm talking about developers specifically. I understand if non-tech people would rather delegate all of it to a third-party like substack or medium, but as a dev, a blog is about the next hard thing you could make after a to-do app, especially post-AI.
As for your second point you're probably right, it depends on what your intention is with your blog. I wouldn't mind having thousands of people read mine, but I personally think it's eventual as long as you're a good writer and hang out in relevant communities, but I guess it makes sense from an SEO pov.
I agree, but being mildly offensive is kind of the point: makes it more memorable, and clearly differentiated from “popup” which is too broad and has many valid uses in an interface. Dickovers never have a valid reason to exist.
> makes it more memorable, and clearly differentiated from “popup” which is too broad and has many valid uses in an interface. Dickovers never have a valid reason to exist.
This is hardly convincing. The author even describes it as a "popup" or a "popover" which is already descriptive enough without further explanation. It is just an "unwanted popup" or "unwanted popover".
The fact he brought up a definition of that word after mentioning "popover", just made the need for "d*ckover" uneccessarily redundant.
It may work with 30 people in tech, but will not work on TV. "unwanted popup" or "unwanted popover" is better to say on TV than "d*ckover".
The problem with that is it cannot be used towards people outside of this tech bubble and would just confuse them. It would even fail many profanity filters in chats and forums.
> The derogatory term is for practices that rightfully deserve contempt.
But it doesn't mean that you should expect the layman to use it in common parlance.
Either "Unwanted popup / popover" and even "popup" / "popover" is a far sensible descriptive alternative for the layman than whatever the author is proposing.
> Doubtful ... where did that odd notion spring from?
Searching "Dickover" all over the internet and other than Mastodon (which is heavily used by techies), and the author's blog, it is only being mentioned by techies here.
So of course, you can't ever admit you are in a tech bubble.
> Perhaps in LDS or uber Christian pearl clutching circles, it's absolutely milquetoast in UK / AU Commonwealth English cultures.
Nope. Any platform that has basic censorship tools in chats. Just search "Twitch, YouTube" profanity filter(s).
Even basic filters flags it as profanity here: [0] [1].
I agree, it’s dumb. I never call those things popovers (is that a regional term?) so the whole time the word was a bit jarring. Also, at first I thought this was a riff on combovers, and imagined some weird male Medusa creature with a thinning head of dicks, and it was so disappointing when that turned out to be wrong.
Gruber's usually too much of a walking Apple ad for my taste, but I love this.
We need to define the things we hate. Give them words. Use the words as weapons.
I've been thinking about this a lot recently with "watermarks" of the statistical and non-visible kind used to track image creators. (Google embedding "this image is AI but also here's the user ID".)
I've been thinking that practice needs a new word too. It's not watermarking, it's signals-math based tracking, so maybe sigtracked.
I find the characterisation of his Apple praise fascinating. It's really not that zealous, unless you hate Apple (which is fine). I think this image of him speaks more of the prominence of the Apple superfan image in popular culture than the actual reality of his position.
It isn't anymore, but if you go back a decade or two, it really was that zealous. He really did used to blindly defend Apple (e.g. things like this: https://daringfireball.net/2006/09/open_challenge), but I think he's grown more skeptical of Apple lately.
I don't want to split hairs over what constitutes as overzealous, but I will say that Apple ~20 years ago earned more praise than Apple does today. This is probably reflected in the writing.
I don't get why people feel entitled to _not_ get dickovers. Are you paying for what you're using, to a sufficient degree that the ecosystem can work without the dickover being presented to you?
This shouldn't be the user's problem, but this is the market working. The dickovers are there because someone somewhere is making money because the dickovers are there. Saying you want the content without the spam is more or less saying you want other people to do the work and you don't want to pay for it.
If you don't like ads/dickovers, you don't have to use the site/app. The provider has decided you're not worth it. To be fair, you probably aren't making them money.
There are exceptions, but you shouldn't feel entitled to use the thing without paying the "dickover price" that the provider has decided to charge.
It's my computer, not yours. The browser is my user agent, not your server agent. If you don't want me viewing your page according to my preferences, then the world wide web is not the right medium for you to be working in. Go write a native app and try to convince people to install it. Once you serve up the contents of a web page to my user agent, you have consented to letting me digest that content however I want.
This is not a sense of "entitlement", it's just the fundamental reality of what the web is.
The author mentions a site they are paying for that still exhibits this behaviour:
> Here’s one from The Philadelphia Inquirer, for which I pay $20/month to subscribe, asking me to sign up for SMS text messages about the Jersey shore, while I’m logged into their cursed website, before they’ll let me see the article I came to read.
I would consider $20/mo "paying [...] to a sufficient degree that the ecosystem can work without the dickover".
I guess the entitlement comes from looking at it from the other way: my employer pays me a lot for my attention. I've accepted the arrangement so now I pay attention to their problems. If you want me to pay attention to your problem, there has to be something in it for me.
I've been wondering how we can use AI to clean up websites before they hit our eyes. If AI is as good as they say it is, surely it can clean up dickovers. If someone is allowed to shove something in front of my face should I not be allowed to make them invisible?
>What won't help is complaining that the largely free products we get don't work the way we want them to.
This makes no sense and seems bad-faith on multiple levels.
It must be worth a lot for me to see it, because if I land on a site shopping for something, I might just turn around when you interrupt me and force me to actively not sign up for your email list.
You should turn around! That's literally my point.
If everyone refused to touch a site that blasts you with a dickover, they would disappear overnight. Clearly people do not do this enough, because it's still being implemented.
Thank you, I got a good laugh out of that.
My experience was probably exactly as intended. Click on the "What is a dickover?" link trying to come up with things that it might be. And a brief moment after the page loaded (this little pause is crucial) I am hit in the face with a big annoying popup saying "This is a Dickover" followed by immediate understanding.
Now at least I know what to call it the next time I visit Substack.
I was afraid it would be a new kind of henway.
I actually had a similar thought - something along the lines of this gag from Spies Like Us
https://www.youtube.com/watch?v=35quNI5ed_k
At least you didn't get misgendered like Zack Mama (aka Monica).
https://www.youtube.com/shorts/tH0DWrD0_hE
https://www.youtube.com/watch?v=SlLxZr5g5is
...You thought a dickover would be about three pounds?
I have a theory that about 97% of developers and managers completed the cookie consent (or whatever) on their own product 5 years ago and hence never see it again, and they have no idea how bad the experience for new customers actually is.
So the developers and bosses all think they're doing a great job and they've got a carefully curated homepage, even though the regular users get a cloudflare captcha, then a cookie modal, then a newsletter modal, then an install-our-app modal, all blocking their access to the 'buy product' button.
Best ones, when refusing, ask again on the next page.
Perhaps they don't know what a functional cookie is? Maybe the marketing vocabulary only has YES?
I really don’t understand why the desired cookie behavior could not be set globally for all websites in the browser. Why do I have the accept / reject them on every website and trust the website will actually do what I ask.
It can be, see Global Privacy Control [1]. As an example, the Complianz consent plugin for WordPress can detect and respect the user's GPC setting, but that feature can be toggled. So even though this exists, many sites will still ignore it.
1. https://globalprivacycontrol.org/
They do. Those are designed to make you click 'Oh for fuck's sake. Just set the fucking cookies.'
> and hence never see it again
This sounds like it would be a better implementation than 99.9% of the dickovers I encounter. Almost always, I dismiss them, then see them again in future. Sometimes with what feels like every site visit.
You see them again in the future because you dismissed them, if you do what they want you to do they will never bother you again in case you changed your mind.
I have a theory that they don't care what customers think.
Oh we care, but when it comes to cookie dickovers, we care more about making the corporate lawyers happy.
I’ll admit that I definitely like collecting my paycheck much more than I worry about customer annoyance at acknowledging a cookie policy. Some hills ain't worth dying on.
Or your company could respect its users and only use cookies for essential site functions. Then you don't need a dickover.
I like the make the cookie for hiding the dickover be 30-60 minutes in duration for anyone in a company IP address. Own medicine is the best dog food.
Protecting forms with reCAPTCHA uses cookies that fall under "marketing" and gathering site stats using Google Analytics uses cookies that fall under "marketing" and "statistics," making a consent banner or dickover pretty much required.
Are these services necessary for a page to work? Not at all, but many businesses consider them crucial. Unprotected public forms almost immediately start getting spammed by bots, burying real, important communications from potential clients. GA offers insight into what visitors to your site are looking for, which has real business value.
I don't like it any more than you do, but I get why businesses would choose to use these. On their end, at least with reCAPTCHA, they're just trying to protect themselves from the complete shitshow that the modern web has become.
The vast majority of users don’t know or care. The ones who do are blocking the cookies anyways. No one wins with these popups (except trial lawyers and sellers of cookie consent SaaS, of course).
We use a third party cookie consent service. It shows different things depending on your location (and allows disabling different types of cookies depending on your local laws). Lawyers mandate it. It's easier than having to figure out the laws everywhere on our own. To me it shows a banner that stays out of the way. But I couldn't tell you for sure it doesn't cover the whole page to other people.
Have you considered just not violating anyone's privacy?
Cookie banners aren't a force of nature. They are required solely because you want to track people. Not tracking people? No need for a cookie banner!
Developers just aren’t good at determining what works best for the user experience. How would designers and PMs justify the hundreds of thousands of hours of combined industry research poured into that beautiful, performant front page design and following modal auto-load?
Please, leave this to the professionals.
Always test your website in a private window.
I suspect many developers know the truth, at least to some degree. Their boss said "it's only one [more] popup, add it anyway."
Repeat ad infinitum
I wonder if cloudflare is wise enough to always skip captchas from IP addresses it detects are associated with that website's owners.
one of the more memorable stories from the daily wtf was from a dev at a banner ad company who got called into a VP's office and yelled at at great length because some pop-up banner was broken. after investigation it turned out the VP had installed an ad blocker and forgotten about it.
>modal
I think you mean dickover,sir.
Very accurate terminology for things that are equally as welcome as the developer sending each user a surprise popup pic of their dickover and over again.
Each time they visit the website.
Ad infinitum.
One of criteria for inclusion into Kagi Small Web [1] is no dickovers. Thanks for naming it properly John.
[1] https://kagi.com/smallweb
Oh, Vlad is here. Thanks for Kagi, and spread these thanks to all Kagi employees too! Please adopt dickover.
Could you or someone working on this make it easier to share the original link for a small web post? It’s difficult to the point of making me think you’re trying to force me to share the Kagi version of the url.
I hope you make an exception for this specific page.
FYI it took me 3 clicks of “next” to hit a page with a cookie dickover. Might need to tweak the filter.
Flag it please, want to think you were unlocky/page added it after inclusion. It is still a manual effort to verify them, mistakes happen. Definetely not intended.
i just joined this recently, cute community. I started browsing it right after and if you skip the AI slop, it's crazy how many people are good writers
The real dickover moment is when you start using a service and then realize they are doing business with Yandex.
Yandex is great. When you want to see news/sites/whatever that does not conform to what the western mainstream powers "accepts as acceptable", you can go to Yandex and you will find it there. When Google search went to shit some years ago I discovered Yandex and found out how much of the web was being deliberately kept away from my eyes. You need search engines from every major power broker in the world to get a full picture of what we arrogantly like to call "truth".
I endorse this name because, once it's the standard name for this technique, people will have to use it in meetings when seriously proposing them, which makes it harder to seriously propose.
"And this is our design for the Dickover."
"Guys, I'm not sure we should Dickover the customers."
"You know, when you say it that way...."
Epilogue: six months later, the site is dead because they converted nobody to their newsletter.
Who are those people? Those perpetually amused folk who feel not a bit of rage when a dickover is slapped in their face, and for whom entering their e-mail address in the dickover is actually a thing they would seriously consider?
Seriously. These days if there isn't a huge "close" button, I'll just press "Back" and find a different website.
And a lot of the time pressing back will take you to some other article on the website instead of where you came from. Because the site used history.pushState in JavaScript to manipulate your history.
I explicitly disable these on Substack but it adds them to my posts anyway. I'm not sure if that's a bug or the thing working as intended, but it was enough to make me stop using it. I don't want to do that to my readers.
Substack’s dubious practices aren’t as bad as their dubious politics.
https://www.theguardian.com/media/2026/feb/07/revealed-how-s...
Thanks for linking to a cookie banner
You don’t see the article?
It's kinda hilarious that on an article about said "dickovers", the page has one of these consuming 80% of the screen real estate: https://files.catbox.moe/ztjg15.png
I don’t get one. Not sure if that’s a mobile safari or a blocker or what.
This is on Firefox/Linux, but I’ve also seen it on Chrome/Windows, and Safari/Mac.
Oh yay, the nazi content again. Don't let the Feb 2026 article date fool you, this has been talked about for years and they don't lift a finger. It's like how Meta isn't incentivized to block scams because they profit off of them to the tune of a billion dollars a year.
However, I do appreciate white supremacist trash outing themselves in public. Get it on the record. Some of them try to hide, but: Patriot Front had a huge leak of data in 2022 (400GB).
"Patriot Front Fascist Leak Exposes Nationwide Racist Campaigns"[0]
You can download it at the following torrent address:
magnet:?xt=urn:btih:2c87816e4c81990fb25bbca43dd8d578eaa55886&dn=patriotfront&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337&tr=udp%3A%2F%2Fexodus.desync.com%3A6969
I'm seeding this on a permanent basis. I have gigabit uplink. Please leach and share.
0. https://unicornriot.ninja/2022/patriot-front-fascist-leak-ex...
You're overreacting. They do coordinated petty vandalism motivated by politics. Not great but not something to be doxxing people for, especially people who didn't even do anything wrong. Your problem is that society has trained you to hate people with their kind of political beliefs and that hate lets you justify trying to harm them. Don't you remember all of history when people hated each other's political alignments? It never goes well.
This is an excellent bookmarklet to have:
``` javascript:(function()%7B let i%2C elements %3D document.querySelectorAll('body *')%3B for (i %3D 0%3B i < elements.length%3B i%2B%2B) %7B if(getComputedStyle(elements%5Bi%5D).position %3D%3D%3D 'fixed' %7C%7C getComputedStyle(elements%5Bi%5D).position %3D%3D%3D 'sticky')%7B elements%5Bi%5D.parentNode.removeChild(elements%5Bi%5D)%3B %7D %7D %7D)() ```
Sometimes, this one is needed to fix scrolling after using the previous one:
``` javascript:var r="html,body{overflow:auto !important;}"; var s=document.createElement("style"); s.type="text/css"; s.appendChild(document.createTextNode(r)); document.body.appendChild(s); void 0; ```
If you zoom websites to be able to read them, like I do.
Then these are especially frustrating because I have to zoom out to find the close button. Its a chase every time, and sometimes I give up.
How are these allowed to exist when there are the EU Web Accessibility Directive ?
HN itself is terrible with UI scale >1.0
I keep scrolling horizontally just to read the text.
On Android, opera browser has text-wrap which fits text into screen on any zooom level. Dunno how people live without this feature
Did anyone else think this was a clever keming pun?
Fortunately, for those sites where either JS is required for the content or to remove the dickover, browsers still have an Inspect Element tool that makes deleting this and other annoyances not too difficult and rather cathartic.
Safari’s “Hide Distracting Items” feature is one big reason I never use Chrome.
Don't tell anybody, but Chrome engineers managed to sneak in reader mode via Gemini.
First time I saw the lesser case version of dickover I thought it said clickover.
DO YOU CONSENT WITH OUR TRACKING COOKIES POLICY?
[YES, I DO, THE IMPORTANT TRACKING ONES] [YES, I DO, ALL OF THEM] ⁿᵒ ᵃⁿᵈ ᶜˡᵒˢᵉ ᵈᶦᶜᵏᵒᵛᵉʳ
I, like most people, always just click whatever option is larger and easier to click (or closest to my cursor at the time). It never seems to matter to my experience which I pick. Sometimes it’s the “all” option, sometimes it’s the “none” option, etc.
I feel bad about doing this, because surely someone somewhere is doing analytics on click data and saying: “See! There is a lot of variation in responses to this cookie choice, people are really taking them seriously, we should keep them!”
I’ve observed a few sites that now display two options, ‘Yes’ and ‘Reject and pay’
NOYB is working on it. I think for derstandard.at it was already declared illegally with the prices they have, but it’s still ongoing.
I like to call that a mafia tactic as the framing is normally „it would be a shame if we have to sell your personal data“.
Thanks, Europe!
This whole cookie dickover concept is malicious compliance. The goal was: no tracking but ask consent if you must ("who would do this, that would be super annoying"). Except every website decided they'd rather annoy everyone.
A properly informed person would've understood that's what they'd do. They'd also probably realize cookies are not a big deal.
Clicking a button could also not be a big deal, but yet here we are.
Tracking people around the web (especially without asking) is a big deal though.
Well… Europe do require the accept and deny options to both be equally visible and accessible, see for example this week-old court ruling:
> Administrative Court (BVwG), thereby upholding a decision made by the Austrian Data Protection Authority in 2024. Specifically, the ORF must ensure that the buttons to ‘accept’ or ‘reject’ tracking cookies are designed equally so that visitors are not tricked into agreeing.
https://noyb.eu/en/noyb-success-orfat-must-correct-misleadin...
Yep. Without Europe, we'd have no idea which websites were trying to sell us out to the highest bidder.
Surprise, they all are!
GDPR doesn't mandate cookie banners, it says that you simply cannot store irrelevant PII for the sake of it. That's the point of it: to protect the privacy of the public against "data brokers" and other scum. You're welcome.
People seem to have forgotten, but cookie banners were a pest before GDPR. And newsletters and login popovers, those are GDPR?
Europe is why you have CCPA
Did you know that a Substack's author can turn the annoying popup off? Go to dashboard -> settings, and then it's "Enable subscribe prompts on post page" under "Growth."
It's the first thing I did. Recommended.
We all know why they keep it on.
I’m just kind of surprised that it works to convert people.
Or…maybe it doesn’t?
Some of these things that we have are just common practices that owners of websites do that are seemingly done automatically without much thought to the experience.
I sort of make an exception for that popup. I.e. I don't mind seeing it. It's the tax to get good free content.
Medium forcing you to log in is too much tho.
I don't at all mind a link on the page that directs me to a subscription or notification signup.
If I get a popup, I'm pretty likely to just close the page, especially if I'm on mobile where closing them is more trouble.
Yeah this is really bad. Firefox + uBlock Origin + Filters cleans a lot of these dickovers. Some seem to slip through the cracks. There's a never ending fight between bad websites and the warriors trying to protect our attention.
For me the fact that dickovers are possible is a bug in all JavaScript interpreters.
In my opinion, any decent browser should make impossible both dickovers and also other related hostile actions, like the possibility for a Web page to modify the right-click menu or to prevent text selection.
Unfortunately completely disabling scripts is rarely a solution, because many sites do not work at all. But the kind of actions mentioned above never serve a useful purpose for the user, so they should be ineffective and their should be no way for the hostile site to determine whether they work or no.
Modal windows may sometimes be useful in applications that are controlled by myself, but it should always be possible to override them in externally-controlled applications, like when browsing Internet sites.
Genuine question, what is it that the JS implementation or DOM or anything the in the browser can do to permit desired modal popover content like dropdown menus and tooltips and floating nav bars while somehow preventing dickovers?
Like I have said, in a browser there should not exist truly modal windows.
The cases when modal windows are used abusively are far more numerous than the cases when they are useful.
Perhaps there should be a way to warn the user when moving the focus from a window that is supposed to be modal, but if the user insists it should be possible to disregard that a window is intended to be modal.
Also, it should be possible for the user to move any window as desired. It should not have been possible for windows to move on their own and to prevent the user from moving them. A script should also not be able to move the mouse cursor or any other kind of cursor.
A browser must always treat a script as potentially hostile, so all these facilities that can be used by a script to mess with the browser GUI should never have existed.
I've used the politer term "pie" for these things, since they are usually thrown in the user's face like a pie, after the normal screen has been shown for a few seconds.
In the old days, JS allowed window.open() which would create a new window on the user's sceren. That naturally was abused horribly, leading to pop-up-blocker extensions and then built-in browser permissions. We need the same thing for pies/dickovers, which are at root a workaround to the presence of pop-up blocking.
My first reaction to "dickover" was that it sounded like another Marion Zimmer Bradley fantasy fiction series...
> My first reaction to "dickover" was that it sounded like another Marion Zimmer Bradley fantasy fiction series...
That hits way more darkly given what has come out about Marion Zimmer Bradley and her husband...
Yep. Or maybe it could be a renaming of the existing series.
He claims that dickovers aren't as bad as the dickbars, but I think they're equal.
The dickover is a big, immediate distraction that you can't help but deal with.
But the dickbar is insidious because you forget it's even there. You just get used to always seeing whatever banner is there and think it's just a permenant piece of the interface and you adapt to not having 25% of your viewport.
You can prevent the loading of most pop ups and many nag screens and cookie demands by simply having a browser configured with an "add-on" that allows you to toggle of and toggle on javascript. There are several add-ons available.
Alternatively, you have another browser with javascript permanently disabled and keep it minimized in the tray, or in the background.
A lot of websites that demand subscriptions, post nagscreens or use other blocks whereby the website can be read by simply toggling off javascript.
Javascript in websites has become what corporations use to manipulate & control us and do things like post nag screens & demand subscriptions.
When I run across websites that demand javascript before they will load I just shitcan them and eliminate them from viewing forever.
The only surprising thing about the Tom’s Hardware example was that John Gruber evidently does not use an adblocker
Look closer. I doubt he uses Chrome regularly, I think he's using it to write this article precisely because he has no extensions installed in it.
As a long time DF reader I can assure you that John does not use Chrome to browse the world wide web.
You are almost certainly correct in saying he is using it to illustrate his point because Chrome is engineered to be part of the internet advertising complex that commits so many of these crimes against design.
Talking of dark patterns I’ve noticed that many site “accidentally” have the bottom aligned cookie consent banner “break” on mobile Safari, such that the buttons are arranged such that “Accept All” is the only button you can press because the “Deny All” or “Customize” go out of viewport when you go to click on them. This might be related to how mobile Safari changes the bottom bar as you move to click the button. I often have this with the NYT Wordle game. Even though I use pi-hole to block ads, it’s still annoying.
Does big tech understand consent?
[ ] Yes
[ ] Maybe later
Do you LOVE this app?
[ ] Yes, and obviously I want to leave this app I like to write a review RIGHT NOW
[ ] I'm a mean bad person.
They understand.
They do not care.
I was thinking it would be nice if you could at least drag the popup out of the way so you could delay reading it while you first focus on what’s underneath. But then I realized, that would technically be a dick move.
Any site I visit regularly gets a user stylesheet via Stylus that I use to hide anything like this.
Thanks for the tip! I've never heard of Stylus, but am checking it out.
"Login with your Google or some other globalist public-private tyrannical spyware trash" is the most common "dickover" around.
Never thought to call them dickovers before, but it’s apt. At a certain point, I noticed my finger reflexively hitting the ESC key because that usually dismisses a lot of them.
The Escape key's effect in the linked article was a delightful detail.
> asking the user to accept “cookies” [...] or anything else that the user couldn’t give two shits about.
Oh, I absolutely care about cookies and whenever I have the option I do not allow the website to place them. That said, I would much prefer an architecture where I express that once in a browser setting and the browser relays that information on to any website somewhere in the background.
Need of the hour :
Browser personalization tools or extensions ...
A combination of User stylesheet (stylus) or User scripts (greasemonkey) -- superpowered by AI models that can let users target screen elements and shape webpage display and behavior without having to manually deal with precise DOM elements or CSS JS syntax
Best useful tweaks could become part of a curated list like uOrigin ad block lists
I block a lot of these with ublock.
Dickovers are annoying -- tell me, what's your solution? For me, a combination of a) not patronizing these sites, but when I have to b) some ad blockers help. Nothing seems to work well though.
Auto reader mode in mobile safari for any site I recognise having read previously that has dickovers, cookie bars, poor typography or any other design issue that distracts me from the content.
e.g. science.org - linked frequently from HN and now every time I click a link to it, I’m dropped into a perfectly readable, distraction free view of the content.
I have a firm rule of leaving any website where I run into this behavior. No exceptions.
My personnal solution to this is CTRL+W.
I don’t know if there’s a personal solution to this but the societal solution is to penalize dickovers at the SEO level.
He nailed it.
But please increase the font size.
No need - it's already at dicksize.
> They’re popovers, but dickheaded.
So they're popovers.
Seriously. I've never seen a popover used for any legitimate purpose. If it was the content the user wanted, you can put it in the page where it goes.
Only time… I added a popover [1] in order to get a user click so I could enable sound.
I know, I know, but it's a game site. It needs sound! [2]
[1] https://mooncraft2000.com
[2] Damn, I just tried my site again and a recent Safari has blocked my weak attempt to force sound.
Solution: reader mode.
In a similar vein, If I had to explain what javascript was to someone non-technical I would say "you know all that crap that covers up a web site you are trying to look at? That's javascript."
dickover n. : a modal panel, popover, or curtain presented by a website or app, deliberately obscuring its own content to frustrate the user with an unwanted, unnecessary, mandatory interaction
The web needs more 'Get Bent' buttons.
That's what she asked.
Maybe if people don't like dickovers, paywalls, and all the other bad patterns , they should stop submitting and voting them up.
Wow, yeah, fuck off with the dickovers.
My own blog has none of that crap. No Google analytics, no tracking. If someone visits my site, I have no idea. And I don't care.
Most people don't care about this and they should, I have the google analytics import on my business endeavors, but why would I put it into a blog? Why subject both myself and my poor readers to yet another tentacle to suck our interaction into its googolplex of data. I hope all webdevs start caring more. On that same note, I hope all webdevs stop using substack, it's so trivial nowadays to make and style your own blog however you want, why take the even lazier route of giving substack control over everything
I suspect two reasons. First, it's not easy to make your own blog - what are you thinking of here - self hosted wordpress, which will surely get hacked? If you use a service like WPEngine, that's no better than using substack.
Second, Google only surfaces the big platforms any more.
I'm talking about developers specifically. I understand if non-tech people would rather delegate all of it to a third-party like substack or medium, but as a dev, a blog is about the next hard thing you could make after a to-do app, especially post-AI.
As for your second point you're probably right, it depends on what your intention is with your blog. I wouldn't mind having thousands of people read mine, but I personally think it's eventual as long as you're a good writer and hang out in relevant communities, but I guess it makes sense from an SEO pov.
So, here on HN, some years back, when I said as much (about my blog having no analytics, etc.) I was asked why did I even blog?
I've always thought of blogging as just writing a note, dropping it in a bottle and tossing it. No idea what happens to it once I post it.
I've always considered mine a 21st century Commonplace book/journal mashup. Write it/post it/move on...
I hate this new web behavior and leave sites immediately whenever I run into it.
This is now the word
Fanboys Annoyances List for Ublock. Install it on your family's computers when they aren't looking. It aims to filter ALL this crap.
I'm sorry but this is such a stupid name. Where did the author get this name from?
Why would I say that in front of any female colleage or any non-technical layman? We already have a name for this and it is a "popup".
Which sounds better?
"Remove this popup" or "Remove this dickover"
Be honest.
I agree, but being mildly offensive is kind of the point: makes it more memorable, and clearly differentiated from “popup” which is too broad and has many valid uses in an interface. Dickovers never have a valid reason to exist.
> makes it more memorable, and clearly differentiated from “popup” which is too broad and has many valid uses in an interface. Dickovers never have a valid reason to exist.
This is hardly convincing. The author even describes it as a "popup" or a "popover" which is already descriptive enough without further explanation. It is just an "unwanted popup" or "unwanted popover".
The fact he brought up a definition of that word after mentioning "popover", just made the need for "d*ckover" uneccessarily redundant.
It may work with 30 people in tech, but will not work on TV. "unwanted popup" or "unwanted popover" is better to say on TV than "d*ckover".
Unless it’s on cable.
see also: enshitification
https://feld.com/archives/2025/11/enshitification/
> "Remove this popup" or "Remove this dickover"
> Be honest.
The latter definitely is the more honest answer.
Thank you for "definitely" not being honest.
You could call them "clickovers".
"popups" or "popovers" is just fine.
Both of them are shorter than the "dickovers" or "clickovers" nonsense.
dickovers are a subset of popups, they are not interchangeable terms.
The derogatory term is for practices that rightfully deserve contempt.
The problem with that is it cannot be used towards people outside of this tech bubble and would just confuse them. It would even fail many profanity filters in chats and forums.
> The derogatory term is for practices that rightfully deserve contempt.
But it doesn't mean that you should expect the layman to use it in common parlance.
Either "Unwanted popup / popover" and even "popup" / "popover" is a far sensible descriptive alternative for the layman than whatever the author is proposing.
> The problem with that is it cannot be used towards people outside of this tech bubble and would just confuse them.
Doubtful ... where did that odd notion spring from?
> It would even fail many profanity filters in chats and forums.
Perhaps in LDS or uber Christian pearl clutching circles, it's absolutely milquetoast in UK / AU Commonwealth English cultures.
eg: UK public broadcast TV: https://www.youtube.com/watch?v=vbSqdSKaXTw
> But it doesn't mean that you should expect the layman to use it in common parlance.
I'm pretty sure that horse bolted long ago.
> Doubtful ... where did that odd notion spring from?
Searching "Dickover" all over the internet and other than Mastodon (which is heavily used by techies), and the author's blog, it is only being mentioned by techies here.
So of course, you can't ever admit you are in a tech bubble.
> Perhaps in LDS or uber Christian pearl clutching circles, it's absolutely milquetoast in UK / AU Commonwealth English cultures.
Nope. Any platform that has basic censorship tools in chats. Just search "Twitch, YouTube" profanity filter(s).
Even basic filters flags it as profanity here: [0] [1].
> I'm pretty sure that horse bolted long ago.
I'm pretty sure you clearly do not know that.
[0] https://app.readable.com/text/profanity/
[1] https://sapling.ai/utilities/profanity
I agree, it’s dumb. I never call those things popovers (is that a regional term?) so the whole time the word was a bit jarring. Also, at first I thought this was a riff on combovers, and imagined some weird male Medusa creature with a thinning head of dicks, and it was so disappointing when that turned out to be wrong.
Gruber's usually too much of a walking Apple ad for my taste, but I love this.
We need to define the things we hate. Give them words. Use the words as weapons.
I've been thinking about this a lot recently with "watermarks" of the statistical and non-visible kind used to track image creators. (Google embedding "this image is AI but also here's the user ID".)
I've been thinking that practice needs a new word too. It's not watermarking, it's signals-math based tracking, so maybe sigtracked.
That might not sound gross enough though.
I find the characterisation of his Apple praise fascinating. It's really not that zealous, unless you hate Apple (which is fine). I think this image of him speaks more of the prominence of the Apple superfan image in popular culture than the actual reality of his position.
It isn't anymore, but if you go back a decade or two, it really was that zealous. He really did used to blindly defend Apple (e.g. things like this: https://daringfireball.net/2006/09/open_challenge), but I think he's grown more skeptical of Apple lately.
I don't want to split hairs over what constitutes as overzealous, but I will say that Apple ~20 years ago earned more praise than Apple does today. This is probably reflected in the writing.
It's more than just defining things. It's ridiculing them.
> Cookie permissions are unnecessary. Signing up for an email newsletter is unnecessary.
They are necessary, as in: without them the creator perhaps wouldn’t be able to justify running the website.
As long as users visit websites with poor ux and show no preference versus websites with good ux, there will reliably be websites with poor ux.
Running the website isn’t necessary. These people should try not running any websites for a bit.
It was just fine when most websites were academic or hobby content, not businesses.
Hobby and academic sites without popups are still there. By quantity there’s likely more of them than ever.
I don't get why people feel entitled to _not_ get dickovers. Are you paying for what you're using, to a sufficient degree that the ecosystem can work without the dickover being presented to you?
This shouldn't be the user's problem, but this is the market working. The dickovers are there because someone somewhere is making money because the dickovers are there. Saying you want the content without the spam is more or less saying you want other people to do the work and you don't want to pay for it.
If you don't like ads/dickovers, you don't have to use the site/app. The provider has decided you're not worth it. To be fair, you probably aren't making them money.
There are exceptions, but you shouldn't feel entitled to use the thing without paying the "dickover price" that the provider has decided to charge.
It's my computer, not yours. The browser is my user agent, not your server agent. If you don't want me viewing your page according to my preferences, then the world wide web is not the right medium for you to be working in. Go write a native app and try to convince people to install it. Once you serve up the contents of a web page to my user agent, you have consented to letting me digest that content however I want.
This is not a sense of "entitlement", it's just the fundamental reality of what the web is.
The author mentions a site they are paying for that still exhibits this behaviour:
> Here’s one from The Philadelphia Inquirer, for which I pay $20/month to subscribe, asking me to sign up for SMS text messages about the Jersey shore, while I’m logged into their cursed website, before they’ll let me see the article I came to read.
I would consider $20/mo "paying [...] to a sufficient degree that the ecosystem can work without the dickover".
Abusive business models should be illegal. Nobody is entitled to harass their customers because their business would fall apart otherwise.
Get a new business model or close the site. Nobody has the right to do whatever they feel like to make money, no matter the impact on other people.
I guess the entitlement comes from looking at it from the other way: my employer pays me a lot for my attention. I've accepted the arrangement so now I pay attention to their problems. If you want me to pay attention to your problem, there has to be something in it for me.
I've been wondering how we can use AI to clean up websites before they hit our eyes. If AI is as good as they say it is, surely it can clean up dickovers. If someone is allowed to shove something in front of my face should I not be allowed to make them invisible?
> If someone is allowed to shove something in front of my face should I not be allowed to make them invisible?
Yes, I'm 100% on the adblock train. Local AI adblock sounds like a great solution.
Then maybe dickovers will go away when the market realizes they don't work. That's the only way.
What won't help is complaining that the largely free products we get don't work the way we want them to.
>What won't help is complaining that the largely free products we get don't work the way we want them to. This makes no sense and seems bad-faith on multiple levels.
On the contrary, I'm assuming good faith on the part of those who implement these "dark" patterns.
They're done for a reason, and that reason is not pure evil from their perspective.
Why doesn't Apple do dickovers? Or Hacker News?
It must be worth a lot for me to see it, because if I land on a site shopping for something, I might just turn around when you interrupt me and force me to actively not sign up for your email list.
You should turn around! That's literally my point.
If everyone refused to touch a site that blasts you with a dickover, they would disappear overnight. Clearly people do not do this enough, because it's still being implemented.
No one is making money on cookie consent dickovers, which is the majority of them.
Generally, if you're setting cookies that aren't necessary for your website's operation... there's some financial motive for it.