4 ms·
From the very beginning of the web when HTTP was defined, there has been the rule that a GET request should never take an action on its own. Actions should be b
by Silhouette 5y ago
From the very beginning of the web when HTTP was defined, there has been the rule that a GET request should never take an action on its own. Actions should be based on some other method like a POST request.
Maybe, but then several decades passed and now billions of people don't use online systems the same ways any more. It used to be that I could send a legitimate mail to a friend or family member and not worry that whatever mail system they use would refuse to deliver it to them because my system didn't jump through several not-quite-standard hoops that didn't exist when the email protocols were defined. Google seem fine with discarding the historical standards on which most of the Internet is built in that situation.
In any case, if a communications service is going to snoop on your private communications and take actions that would be impossible without spying on you, I think the burden is 100% on them not to screw anything up for anyone, ever.
- meibo 5y ago"Things change as time goes on" is not an excuse to ignore valid standards. All big email providers know this and know that GETs should not affect their unsubscribe/confirmation links. It's part of their job.
- Silhouette 5y ago"Things change as time goes on" is not an excuse to ignore valid standards. You're talking about an idealised, theoretical world. I'm talking about the real one, the same one where big mail providers routinely ignore valid standards themselves in their efforts to fight real world problems like spam and identity theft. Again, if someone is going to help themselves to private information then the burden should be 100% on them not to screw anything up for anyone, whether or not that anyone was following any particular set of rules.
- skybrian 5y agoYes, people often don't follow standards, but they are sometimes useful in the real world for deciding who should fix their software, and for making breakage less likely due to whatever changes happen in the future. Google isn't the only vendor you need to worry about. Other mail agents, browsers, or proxies will sometimes prefetch URLs. On the web you often don't know what software your users are running or what it will do, and there's no way of knowing what they'll do in a year. Users have the right to run whatever mail software they want. But if you follow standards then you have a better chance. If you don't, it's a risk. Sometimes vendors do go the extra mile to tolerate other people's buggy code, but not always. You can decide to blame everyone else if you want, but if you use GET requests for user actions, something will likely break eventually.
- Silhouette 5y agoYes, I understand the reason for the standards, and other things being equal I am all for following them. I just think it's strange that an organisation spying on someone's communications and then doing anything it otherwise couldn't and breaking anything as a result should be getting such a free ride. There is no law that says any web application you write has to follow those standards, and the only reason not doing so is a problem in this case is because the likes of Google didn't mind their own business.
- skybrian 5y agoThere are other reasons but you're ignoring them.
- Silhouette 5y agoWhat, specifically?
- skybrian 5y agoSome other software, other than Google, might follow the link automatically. Because the standard allows that. (Also, consider mistaken clicks, which happen all the time on touch screens.)
- Silhouette 5y agoSome other software, other than Google, might follow the link automatically. Because the standard allows that. That is literally the opposite of what good native email clients have been doing for a long time. They won't even open linked images and the like by default, to prevent tracking.