5 ms·

It’s insane that this hasn’t been the default all along across all browsers. Just shows how Google et al, strive to safeguard and profit from the status quo, a

It’s insane that this hasn’t been the default all along across all browsers. Just shows how Google et al, strive to safeguard and profit from the status quo, at the expense of every internet user.

jefftk 5y ago
> It’s insane that this hasn’t been the default all along across all browsers Historically cookies weren't partitioned by site. So if you went to clear the cookies for https://publisher.example https://publisher.example, then the browser wouldn't know whether to also clear cookies for https://other.example https://other.example. (Cookies are still not partitioned by default in Firefox; it requires turning on Total Cookie Protection)
sp332 5y ago
This is two huge changes away from how every browser historically stored and cleared cookies, including old Opera, IE, Firefox, Safari, everybody.
crazygringo 5y ago
It's ridiculous to suggest that this was somehow all nefariously intended by Google et al. How do you then explain that's what Firefox has done all the way up until now? No -- it's just how cookies were meant to work from the start, the most obvious implementation before the privacy/security/tracking implications got worked out, which has taken many years. And Google's working to make similar improvements to Chrome: https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-... So not "insane" at all. To the contrary, it was entirely reasonable at the beginning, and now we see browsers reasonably addressing the problems that have arisen.
- SilasX 5y ago
  Couldn't a smart person have figured out exactly how that cookie model could be abused like, within days of it existing? Was it really something that only got figured out with time?
  - ElderKorihor 5y ago
    You have hindsight. In the early days, the internet was seen as a massively playfield-leveling and decentralizing force ("the net interprets censorship as damage and routes around it"), not a massively centralizing one (Facebook is the world's only newspaper). In a model where everything is decentralized and leveled , no player is big enough to worry about.
    - joe_the_user 5y ago
      Sure, the realization might taken a decade but the change took two decades at least. So it seems a little late.
    - tuatoru 5y ago
      A smart person could have figured it out, but it was extremely unlikely. The economics sub-discipline of economic geography was being developed at about the same time as Eternal September. The key insight (one of the key insights) from that research is that as the absolute cost of transport goes down, previously insignificant differences in cost become important. This leads to to the development of "hubs" - centralization. (Here we're talking about information transport, and the cost being time per bit.) But as you say, at the time the tech world could never have believed that centralization was the default expectation, nor designed things to compensate.
      - testermelon 5y ago
        Can you provide further reading on the insight that shows the formation of hubs/centralization? It seems interesting.
        tuatoru 5y ago
        The classic text is Fujita, Krugman and Venables, MIT Press 1999, The Spatial Economy. The internet observation is an adaptation of the original work on goods trade to other transport forms. I forget where I first read it--sorry! Maybe someone like Clay Shirky, but not the man himself.
- teawrecks 5y ago
  > How do you then explain that's what Firefox has done all the way up until now? Google is historically the largest financial contributor to Mozilla (paying for spot as default search engine) and thus has always had leverage on what they do with FF. There were a few years there where Moz flexed on google by making Yahoo the default, but then switched back to Google last year. My guess is they had to show google they were willing to go elsewhere in order to regain some of their autonomy, which is why it's only in the last couple of years that FF has been willing to add default customer privacy features despite directly hurting FB/Google's ability to track users.
- notinsaneatall 5y ago
  > How do you then explain that's what Firefox has done all the way up until now? The fact that for a long, long time the vast majority of Firefox's income has come from search engine partnerships, a category google dominates? Also: Firefox has been rather poor about user privacy. Integrating third party stuff that's difficult to remove, like Pocket, for example. There was the whole "Looking Glass" debacle where they dropped in a Mr. Robot promotional plugin into Firefox completely silently. When someone posted in bugzilla about it, the project manager for the plugin made the thread employee-only. It was then changed back to public briefly, before disappearing for good, reportedly being locked so even employees can't see it: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977#c21 https://bugzilla.mozilla.org/show_bug.cgi?id=1424977#c21 Ask yourself: "why is a bug files about a promotional plugin so secretive that not even employees can view it?" BTW: Guess where that project manager used to work before she worked at Mozilla? Answer: an online advertising and analytics firm (according to her LinkedIn profile at the time.)
  - dralley 5y ago
    >Also: Firefox has been rather poor about user privacy. Integrating third party stuff that's difficult to remove, like Pocket, for example. 1) Mozilla owns pocket, it's not third party. https://blog.mozilla.org/en/mozilla/news/mozilla-acquires-pocket/ https://blog.mozilla.org/en/mozilla/news/mozilla-acquires-po... 2) This is completely irrelevant to user privacy, because Pocket doesn't exfiltrate any data. The source code for the integration is open source, you can go look this up yourself.
- o8r3oFTZPE 5y ago
  Advertising targets1 trust Google. There is no reason for them not to trust this company. Google has the privacy of its advertising targets as its highest priority. Mozilla gets 90+% of it operating budget via a deal with Google, but Firefox developement is not influenced at all by Chrome. Totally independent. Big Tech exists for users, not advertisers. Privacy must come first and money must come second. Thats why we have more privacy than ever and Google does not make much money. Government regulation is totally unnecessary. All incentives are aligned toward greater privacy. Google will "build a more private web" for its advertising targets. Sorry advertisers. :( 1. Also known as "users".
  - zaphar 5y ago
    Mozilla was doing this literally before Google existed. The origins of how cookies work predate Google as a company let alone as an advertiser platform. At the time Netscape was not beholden to an advertising company at all. The previous poster is correct on their historical analysis. Your comment does not change the accuracy at all.
jimmaswell 5y ago
The world kept turning all these years before people got unreasonably paranoid about cookies and ad networks. I think it's all pointless theater. I wish Mozilla would focus more on browser customizability and other extension powers like we used to have with XUL and bringing the mobile browser up to speed instead. I couldn't care less about a Facebook tracking cookie.
- amenod 5y ago
  I agree with the mobile browser (the only recent change they made, afaics, was to artificially disable most of the extensions and to make tab switching worse), however it is not just about ad networks that people are paranoid about. Tracking is pervasive and there are many players which know way too much about what users are doing on the net. I don't even care if they track me - what I care about is that they track mostly everybody. Such power should not be underestimated.
  - jimmaswell 5y ago
    Law enforcement is exempt from GDPR and other online privacy acts and we all know how much intelligence agencies know. The people who it matters if they track you are still tracking you. All that changed is it's harder to make money from ads and it's more expensive and dangerous to run your own web service.
    - mnot 5y ago
      Not true; a substantial part of the Schrems II decision was about how the GDPR applies not only to law enforcement, but also national security surveillance. See eg ‘European Essential Guarantees.’
SilasX 5y ago
As others noted, I'm not sure there's a profit motive to blame here, but yeah it feels like browsers are constantly playing catch-up, indicated by ever-stronger words for the features, rather than switch to a better-engineered, more robust model -- reminds me of PHP's treadmill of "no-really-totes-secure-this-time-sql-call".
1vuio0pswjnm7 5y ago
What if there were browsers and protocols written by users instead of companies set up to exploit users.
tgsovlerkhgsel 5y ago
It isn't insane, it's a leftover from when you didn't have to assume that most sites you use are actively hostile to you. If it didn't come with all the tracking and privacy implications, being able to see your friends' comments on a site first, use social widgets etc. is a feature. This will also break some sites, some of which will never get fixed, so this is a hard change to make (but necessary at this point).

jefftk 5y ago

> It’s insane that this hasn’t been the default all along across all browsers Historically cookies weren't partitioned by site. So if you went to clear the cookies for https://publisher.example https://publisher.example, then the browser wouldn't know whether to also clear cookies for https://other.example https://other.example. (Cookies are still not partitioned by default in Firefox; it requires turning on Total Cookie Protection)

sp332 5y ago

This is two huge changes away from how every browser historically stored and cleared cookies, including old Opera, IE, Firefox, Safari, everybody.

crazygringo 5y ago

It's ridiculous to suggest that this was somehow all nefariously intended by Google et al. How do you then explain that's what Firefox has done all the way up until now? No -- it's just how cookies were meant to work from the start, the most obvious implementation before the privacy/security/tracking implications got worked out, which has taken many years. And Google's working to make similar improvements to Chrome: https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-... So not "insane" at all. To the contrary, it was entirely reasonable at the beginning, and now we see browsers reasonably addressing the problems that have arisen.

SilasX 5y ago
Couldn't a smart person have figured out exactly how that cookie model could be abused like, within days of it existing? Was it really something that only got figured out with time?
- ElderKorihor 5y ago
  You have hindsight. In the early days, the internet was seen as a massively playfield-leveling and decentralizing force ("the net interprets censorship as damage and routes around it"), not a massively centralizing one (Facebook is the world's only newspaper). In a model where everything is decentralized and leveled , no player is big enough to worry about.
  - joe_the_user 5y ago
    Sure, the realization might taken a decade but the change took two decades at least. So it seems a little late.
  - tuatoru 5y ago
    A smart person could have figured it out, but it was extremely unlikely. The economics sub-discipline of economic geography was being developed at about the same time as Eternal September. The key insight (one of the key insights) from that research is that as the absolute cost of transport goes down, previously insignificant differences in cost become important. This leads to to the development of "hubs" - centralization. (Here we're talking about information transport, and the cost being time per bit.) But as you say, at the time the tech world could never have believed that centralization was the default expectation, nor designed things to compensate.
    - testermelon 5y ago
      Can you provide further reading on the insight that shows the formation of hubs/centralization? It seems interesting.
      - tuatoru 5y ago
        The classic text is Fujita, Krugman and Venables, MIT Press 1999, The Spatial Economy. The internet observation is an adaptation of the original work on goods trade to other transport forms. I forget where I first read it--sorry! Maybe someone like Clay Shirky, but not the man himself.
teawrecks 5y ago
> How do you then explain that's what Firefox has done all the way up until now? Google is historically the largest financial contributor to Mozilla (paying for spot as default search engine) and thus has always had leverage on what they do with FF. There were a few years there where Moz flexed on google by making Yahoo the default, but then switched back to Google last year. My guess is they had to show google they were willing to go elsewhere in order to regain some of their autonomy, which is why it's only in the last couple of years that FF has been willing to add default customer privacy features despite directly hurting FB/Google's ability to track users.
notinsaneatall 5y ago
> How do you then explain that's what Firefox has done all the way up until now? The fact that for a long, long time the vast majority of Firefox's income has come from search engine partnerships, a category google dominates? Also: Firefox has been rather poor about user privacy. Integrating third party stuff that's difficult to remove, like Pocket, for example. There was the whole "Looking Glass" debacle where they dropped in a Mr. Robot promotional plugin into Firefox completely silently. When someone posted in bugzilla about it, the project manager for the plugin made the thread employee-only. It was then changed back to public briefly, before disappearing for good, reportedly being locked so even employees can't see it: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977#c21 https://bugzilla.mozilla.org/show_bug.cgi?id=1424977#c21 Ask yourself: "why is a bug files about a promotional plugin so secretive that not even employees can view it?" BTW: Guess where that project manager used to work before she worked at Mozilla? Answer: an online advertising and analytics firm (according to her LinkedIn profile at the time.)
- dralley 5y ago
  >Also: Firefox has been rather poor about user privacy. Integrating third party stuff that's difficult to remove, like Pocket, for example. 1) Mozilla owns pocket, it's not third party. https://blog.mozilla.org/en/mozilla/news/mozilla-acquires-pocket/ https://blog.mozilla.org/en/mozilla/news/mozilla-acquires-po... 2) This is completely irrelevant to user privacy, because Pocket doesn't exfiltrate any data. The source code for the integration is open source, you can go look this up yourself.
o8r3oFTZPE 5y ago
Advertising targets1 trust Google. There is no reason for them not to trust this company. Google has the privacy of its advertising targets as its highest priority. Mozilla gets 90+% of it operating budget via a deal with Google, but Firefox developement is not influenced at all by Chrome. Totally independent. Big Tech exists for users, not advertisers. Privacy must come first and money must come second. Thats why we have more privacy than ever and Google does not make much money. Government regulation is totally unnecessary. All incentives are aligned toward greater privacy. Google will "build a more private web" for its advertising targets. Sorry advertisers. :( 1. Also known as "users".
- zaphar 5y ago
  Mozilla was doing this literally before Google existed. The origins of how cookies work predate Google as a company let alone as an advertiser platform. At the time Netscape was not beholden to an advertising company at all. The previous poster is correct on their historical analysis. Your comment does not change the accuracy at all.

jimmaswell 5y ago

The world kept turning all these years before people got unreasonably paranoid about cookies and ad networks. I think it's all pointless theater. I wish Mozilla would focus more on browser customizability and other extension powers like we used to have with XUL and bringing the mobile browser up to speed instead. I couldn't care less about a Facebook tracking cookie.

amenod 5y ago
I agree with the mobile browser (the only recent change they made, afaics, was to artificially disable most of the extensions and to make tab switching worse), however it is not just about ad networks that people are paranoid about. Tracking is pervasive and there are many players which know way too much about what users are doing on the net. I don't even care if they track me - what I care about is that they track mostly everybody. Such power should not be underestimated.
- jimmaswell 5y ago
  Law enforcement is exempt from GDPR and other online privacy acts and we all know how much intelligence agencies know. The people who it matters if they track you are still tracking you. All that changed is it's harder to make money from ads and it's more expensive and dangerous to run your own web service.
  - mnot 5y ago
    Not true; a substantial part of the Schrems II decision was about how the GDPR applies not only to law enforcement, but also national security surveillance. See eg ‘European Essential Guarantees.’

SilasX 5y ago

As others noted, I'm not sure there's a profit motive to blame here, but yeah it feels like browsers are constantly playing catch-up, indicated by ever-stronger words for the features, rather than switch to a better-engineered, more robust model -- reminds me of PHP's treadmill of "no-really-totes-secure-this-time-sql-call".

1vuio0pswjnm7 5y ago

What if there were browsers and protocols written by users instead of companies set up to exploit users.

tgsovlerkhgsel 5y ago

It isn't insane, it's a leftover from when you didn't have to assume that most sites you use are actively hostile to you. If it didn't come with all the tracking and privacy implications, being able to see your friends' comments on a site first, use social widgets etc. is a feature. This will also break some sites, some of which will never get fixed, so this is a hard change to make (but necessary at this point).