4 ms·

Well, but there is nothing that makes it impossible to build logins and the like without 3rd party cookies. Yes, there are certain patterns out there, that use

Well, but there is nothing that makes it impossible to build logins and the like without 3rd party cookies. Yes, there are certain patterns out there, that use them, but slowly turning 3rd party cookies off and giving major sites time to adapt might help to dump 3rd party cookies one day completely. I think the whole idea of sharing cookies across origins was a conceptual mistake right from the beginning, because it is also responsible for quite a lot of security vectors which had to be fixed by other mechanics like the SOP (Same Origin Policy) which in turn required mechanics like CORS (Cross Origin Resource Sharing). And with all those mechanics in place, modern browsers are pretty tied up and are significantly reduced in their abilities compared to other HTTP/S clients. So when you want to build a PWA (Progressive Web App) that can use a configurable backend (as in federated), you will run into all kinds if problems, that can all be traced back to the decision to share cookies across origins.

andrewmcwatters 6y ago
My point is you can make these arguments all day. Why do we allow iframes? You could argue web servers should simply communicate among themselves and serve subdocuments to clients. Why is HTTP/2 Server Push being rescinded? Why do user agents not provide additional types for <script> based on runtime installations? Why isn't there a renderer API that allows me to use painted trees in <canvas>, but there is a bluetooth API that no one uses?
- arendtio 6y ago
  I am not sure if I get your point then. I think it is important to see the patterns of bad decisions in the past to improve decision making in the future. That those mistakes were not done deliberately and with good intentions is a completely different story and that in hindsight everything looks so clear is also well known ;-)

andrewmcwatters 6y ago

My point is you can make these arguments all day. Why do we allow iframes? You could argue web servers should simply communicate among themselves and serve subdocuments to clients. Why is HTTP/2 Server Push being rescinded? Why do user agents not provide additional types for <script> based on runtime installations? Why isn't there a renderer API that allows me to use painted trees in <canvas>, but there is a bluetooth API that no one uses?

arendtio 6y ago
I am not sure if I get your point then. I think it is important to see the patterns of bad decisions in the past to improve decision making in the future. That those mistakes were not done deliberately and with good intentions is a completely different story and that in hindsight everything looks so clear is also well known ;-)