4 ms·

> Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for so

> Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law. The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request. The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.

Sebb767 6y ago
> I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law. There's two sides for this. For one, this is the infrastructure that already exists and that is out there in the wild. If you start selling 500V electric appliances, people can of course buy transformers or the state could upgrade its grid, but in reality, changing the existing infrastructure to suddenly support something different is a huge effort. It's far easier and more economical to treat the given infrastructure as fixed and working within its bounds. On the other hand, it usually adds a lot of needless complexity to break layers. Sometimes it is worth it (ZFS might be a good example), but usually it isn't. Imagine, for example, if Firefox needed to be patched to support SSDs or SD cards because it did some magic and accessed the HDD firmware directly - this would arguably be a bad idea. > The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request. Sure it does. The OS<->Browser boundary is basically about what the browser executable itself can do to the OS; the OS has no context on the finer granularity of websites. Going back to the electrical grid: My power company is worried about bringing electricity to my flat connection; turning specific appliances on or off is my part. It would be very strange if the power company would suddenly be in charge on whether my kettle specifically should have power. > The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking. I fully agree on that and we need more of that, but that is irrespective of how the user is asked whether he wants to accept cookies/tracking.
- hnedeotes 6y ago
  I understand that and agree with you regarding backwards comp, and legacy systems, it still pisses me to no end though, because it's like a continuous patching of things over things, each one increasing the area of friction - at some point if this digital infrastructure is to take a central part in human systems though it will need to be pruned, re-worked and if needed broken, otherwise it will continue to get worse. And this is not even just at a systems level that I think is problematic - for those working with it, it's also with what it enables and what it doesn't. I'm not a genius but I can see many ways of solving these cookie/privacy issues and I'm sure the smart folks back at these companies (browser, ads, etc) could too, they just choose not to.

Sebb767 6y ago

> I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law. There's two sides for this. For one, this is the infrastructure that already exists and that is out there in the wild. If you start selling 500V electric appliances, people can of course buy transformers or the state could upgrade its grid, but in reality, changing the existing infrastructure to suddenly support something different is a huge effort. It's far easier and more economical to treat the given infrastructure as fixed and working within its bounds. On the other hand, it usually adds a lot of needless complexity to break layers. Sometimes it is worth it (ZFS might be a good example), but usually it isn't. Imagine, for example, if Firefox needed to be patched to support SSDs or SD cards because it did some magic and accessed the HDD firmware directly - this would arguably be a bad idea. > The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request. Sure it does. The OS<->Browser boundary is basically about what the browser executable itself can do to the OS; the OS has no context on the finer granularity of websites. Going back to the electrical grid: My power company is worried about bringing electricity to my flat connection; turning specific appliances on or off is my part. It would be very strange if the power company would suddenly be in charge on whether my kettle specifically should have power. > The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking. I fully agree on that and we need more of that, but that is irrespective of how the user is asked whether he wants to accept cookies/tracking.

hnedeotes 6y ago
I understand that and agree with you regarding backwards comp, and legacy systems, it still pisses me to no end though, because it's like a continuous patching of things over things, each one increasing the area of friction - at some point if this digital infrastructure is to take a central part in human systems though it will need to be pruned, re-worked and if needed broken, otherwise it will continue to get worse. And this is not even just at a systems level that I think is problematic - for those working with it, it's also with what it enables and what it doesn't. I'm not a genius but I can see many ways of solving these cookie/privacy issues and I'm sure the smart folks back at these companies (browser, ads, etc) could too, they just choose not to.