9 ms·

How's Mozilla Doing with Do Not Track? Not So Good

40 points by fafssaf 15y ago

nikcub 15y ago
since DNT is opt-in for ad networks it is about as useful as robots.txt. the good guys will honor it, but the bad guys - who users are really concerned about, will ignore it. a better solution is to integrate tools to allow users to block third-party scripts, to fix bugs and improve cache handling headers that can be used to track users, and to not let any third-party scripts store any information on the client.
- mnutt 15y ago
  If you don't allow third-party scripts to store any information on the client, you break everyone's Google Analytics scripts. Then everyone will have to give out subdomains to analytics companies, ad networks, etc and we'll be right back where we started.
- icebraining 15y ago
  The thing is that as usual, there's no good or bad guys. The ones doing the tracking - which is in this case embedded in the websites - are not criminals who run botnets and crack servers, they're big, amoral companies like Google, Facebook, Twitter and some specialized firms. These can be pressured (by public opinion, for example) into complying with DNT even if it's not their 'first instinct' to do so.
endtwist 15y ago
The DNT initiative always reminded me of the "Evil Bit" joke: http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt
- gwern 15y ago
  Somewhat surprisingly, some 'evil bits' like the .xxx TLD, seem to be getting traction.
  - dsl 15y ago
    It is only gaining traction from people who want the bit explicitly turned off. People are lining up to pay $100 and change to prevent coca-cola.xxx and nike.xxx from being registered. Not a single person I've talked to in adult is seriously considering a move to .xxx
- ez77 15y ago
  When the IP standard was defined, was this bit purposely left undefined? Is this newer RFC really a joke, and nothing but a joke? How come the IETF allows just-kidding RFCs? I'm puzzled...
  - sbierwagen 15y ago
    Note the date. Typically people submit joke RFCs on April 1st. http://en.wikipedia.org/wiki/April_Fools%27_Day_RFC http://en.wikipedia.org/wiki/April_Fools%27_Day_RFC Also, RFCs are not terribly heavyweight technical documents. They're essentially memos, not ISO standards. Any (demonstrably competent) person can submit a RFC, and if it becomes popular, then the idea enters the standards track, and new, better RFCs are issued based on it.
- SteveJS 15y ago
  I had the same reaction. It seems like DNT is more notable for reducing interest and effort in actual solutions. However, the EFF (whose opinion on this I'd trust) appears to indicate DNT is complimentary with things like AdBlock and IE's TPL's: https://www.eff.org/deeplinks/2011/03/tracking-protection-lists https://www.eff.org/deeplinks/2011/03/tracking-protection-li...
Wilya 15y ago
It would be more interesting to know the adoption of this among website developers. And some use cases where it is beneficial for them (as I don't see any). As it is, it is quite useless. If the feature doesn't do anything, the numbers are just a consequence of the buzz done around it, nothing more.
- robryan 15y ago
  There either needs to be user demands or laws to push it I think. Given that the average user doesn't really care in most cases though I think they are a long way from succeeding with it. Good to see them at least offering up something though.
Xuzz 15y ago
Most of us on Hacker News, from what I can tell, are generally against legislating the Internet. But, that's exactly what DNT requires to be effective, since it provides no technical barrier against tracking: either websites are legislated into being required to honor it, or it has essentially no value to users. As much as privacy is important, I'm actually glad that Chrome doesn't support DNT. Hopefully that will give reason for a better technical solution to be developed.
- tomelders 15y ago
  I don't see that this would require legislating the internet. Instead, amendments to things such as data-protection, privacy or human rights legislation should be able to cover it.
  - justinschuh 15y ago
    This doesn't strike me as a legitimate difference (even just semantically). It doesn't matter if it's amended to existing legislation or passed as new law; both are the same from the perspective of "legislating the Internet."
- dredmorbius 15y ago
  Speak for yourself. I'm against bad laws. I'm for good laws. If a realm of human activity exists in which unregulated behavior trends toward maximum social benefit, reasonable minds will contemplate whether or not appropriate regulation (and enforcement of same) might be beneficial. Say: putting teeth into DNT, allowing for civil penalties (a border condition in which law and private enforcement both come into play), and civil penalties for egregious flouting of the law.
bmuon 15y ago
Working as a developer in an ad network I'm very interested in implementing this. However, said ad network doesn't currently provide an opt-out mechanism and Mozilla isn't doing a good job of providing me with arguments to take to management and convince them that a DNT opt-out is something they want. What do you think?
pluies 15y ago
"This might be a bit low because the tracking for DNT is by IP address." Tracking people using DNT? This is quite ironic.
gst 15y ago
Why should people turn it on - when most people just don't care? That's the same problem we have in the EU right now. The correct way to deal with cookies would be for people to enable or disable them in their browser, according to their personal preferences. Instead, the EU forces their cookie legislation on everybody, because most people are too lazy to fix their preferences.
- barrkel 15y ago
  It's precisely because grandmothers are "too lazy to fix their preferences" that governments step in.
- SoftwareMaven 15y ago
  Most people have no idea what a "cookie" is, nor how or why they should manage them. Calling people lazy for not managing them is the epitome of engineering arrogance. Browsers need better, more clear, interfaces for managing cookies and websites need to provide easily parses info on what each cookie is for before people will even be able to manage them.
  - gst 15y ago
    If you're using a car it's taken for granted that you learn how this thing works. If you're using it without learning how it works, it's your own fault, if you have an accident. Why should this be any different with computers? The risk that you pose to others is pretty low, so there shouldn't be any requirement to have a "license". But I wouldn't call it arrogance, if I'll assume that someone using the network has a minimum knowledge about how things work.
    - blahedo 15y ago
      > If you're using a car it's taken for granted that you learn how this thing works. Only to a point. I own a car and am perfectly competent to use it, but I have only the vaguest of understanding as to what things like spark plugs and catalytic converters do. I know what a manifold is in mathematics, and I suppose it's a bit similar in a car engine. I deem myself knowledgeable to open the bonnet and add windshield wiper fluid when that's low, but anything more complicated I'll take to a mechanic. > If you're using it without learning how it works, it's your own fault, if you have an accident. It's my fault if I drive without, say, learning how to operate the brake pedal, or learning how to turn on the turn signal. But if the accident is due to something wrong with the internals that I know very little about? I don't think any reasonable person believes that getting licensed to drive should require one to have the knowledge of an automobile mechanic.
hexis 15y ago
DNT is like putting a note atop your plain text file asking unintended recipients to ignore the contents. What browsers need is something akin to encryption, where you're not asking for compliance, you're denying access.
- azakai 15y ago
  > DNT is like putting a note atop your plain text file asking unintended recipients to ignore the contents. Well, robots.txt is a simple text file that politely asks robots to not spider parts of your website. It is completely voluntary and unenforceable, but works very well.
  - qjz 15y ago
    How can you tell it works? How do you know the bot owners aren't returning to crawl those parts with User-Agent strings that impersonate ordinary users?
  - sbierwagen 15y ago
    It is completely voluntary and unenforceable, but works very well. Ha! It works very well: for Google, and Yahoo. They use informative user-agents, and respect robots.txt directives. They have to, they're large corporations, with shareholders. Everybody else ignores it. Why would they listen? Live example: 216.55.185.45 - - [11/Sep/2011:06:50:56 -0400] "GET / HTTP/1.0" 200 4835 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" 216.55.185.45 - - [11/Sep/2011:06:50:57 -0400] "GET / HTTP/1.0" 200 4835 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" 216.55.185.45 - - [11/Sep/2011:06:50:57 -0400] "GET /blog/ HTTP/1.0" 200 114535 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" 216.55.185.45 - - [11/Sep/2011:06:51:01 -0400] "GET /blog/archives/2010/01/12/creating_an_account_on_the_scp_wiki_is_like_pissing_glass/ HTTP/1.0" 200 10490 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" This is all the traffic from this IP, with no lines skipped. You might notice that it doesn't request CSS, or any of the linked images, or favicon.ico. Nor does it populate the referral header fields, which of course it would be doing if it was actually Firefox, and there was actually a human clicking on these links. It doesn't even bother requesting a robots.txt, which I don't have anyway.[1] Do a whois check on the IP, and we get: Codero CODERO1999A (NET-216-55-176-0-1) 216.55.176.0 - 216.55.187.255 Codero's a dedicated server host. This is a spambot, looking for email addresses. Visit the IP in a browser, and you see a site selling fake Tiffany jewelry. 1: http://www.archiveteam.org/index.php?title=Robots.txt http://www.archiveteam.org/index.php?title=Robots.txt

40 points by fafssaf 15y ago

since DNT is opt-in for ad networks it is about as useful as robots.txt. the good guys will honor it, but the bad guys - who users are really concerned about, will ignore it. a better solution is to integrate tools to allow users to block third-party scripts, to fix bugs and improve cache handling headers that can be used to track users, and to not let any third-party scripts store any information on the client.

mnutt 15y ago
If you don't allow third-party scripts to store any information on the client, you break everyone's Google Analytics scripts. Then everyone will have to give out subdomains to analytics companies, ad networks, etc and we'll be right back where we started.
icebraining 15y ago
The thing is that as usual, there's no good or bad guys. The ones doing the tracking - which is in this case embedded in the websites - are not criminals who run botnets and crack servers, they're big, amoral companies like Google, Facebook, Twitter and some specialized firms. These can be pressured (by public opinion, for example) into complying with DNT even if it's not their 'first instinct' to do so.

endtwist 15y ago

The DNT initiative always reminded me of the "Evil Bit" joke: http://www.ietf.org/rfc/rfc3514.txt http://www.ietf.org/rfc/rfc3514.txt

gwern 15y ago
Somewhat surprisingly, some 'evil bits' like the .xxx TLD, seem to be getting traction.
- dsl 15y ago
  It is only gaining traction from people who want the bit explicitly turned off. People are lining up to pay $100 and change to prevent coca-cola.xxx and nike.xxx from being registered. Not a single person I've talked to in adult is seriously considering a move to .xxx
ez77 15y ago
When the IP standard was defined, was this bit purposely left undefined? Is this newer RFC really a joke, and nothing but a joke? How come the IETF allows just-kidding RFCs? I'm puzzled...
- sbierwagen 15y ago
  Note the date. Typically people submit joke RFCs on April 1st. http://en.wikipedia.org/wiki/April_Fools%27_Day_RFC http://en.wikipedia.org/wiki/April_Fools%27_Day_RFC Also, RFCs are not terribly heavyweight technical documents. They're essentially memos, not ISO standards. Any (demonstrably competent) person can submit a RFC, and if it becomes popular, then the idea enters the standards track, and new, better RFCs are issued based on it.
SteveJS 15y ago
I had the same reaction. It seems like DNT is more notable for reducing interest and effort in actual solutions. However, the EFF (whose opinion on this I'd trust) appears to indicate DNT is complimentary with things like AdBlock and IE's TPL's: https://www.eff.org/deeplinks/2011/03/tracking-protection-lists https://www.eff.org/deeplinks/2011/03/tracking-protection-li...

Wilya 15y ago

It would be more interesting to know the adoption of this among website developers. And some use cases where it is beneficial for them (as I don't see any). As it is, it is quite useless. If the feature doesn't do anything, the numbers are just a consequence of the buzz done around it, nothing more.

robryan 15y ago
There either needs to be user demands or laws to push it I think. Given that the average user doesn't really care in most cases though I think they are a long way from succeeding with it. Good to see them at least offering up something though.

Xuzz 15y ago

Most of us on Hacker News, from what I can tell, are generally against legislating the Internet. But, that's exactly what DNT requires to be effective, since it provides no technical barrier against tracking: either websites are legislated into being required to honor it, or it has essentially no value to users. As much as privacy is important, I'm actually glad that Chrome doesn't support DNT. Hopefully that will give reason for a better technical solution to be developed.

tomelders 15y ago
I don't see that this would require legislating the internet. Instead, amendments to things such as data-protection, privacy or human rights legislation should be able to cover it.
- justinschuh 15y ago
  This doesn't strike me as a legitimate difference (even just semantically). It doesn't matter if it's amended to existing legislation or passed as new law; both are the same from the perspective of "legislating the Internet."
dredmorbius 15y ago
Speak for yourself. I'm against bad laws. I'm for good laws. If a realm of human activity exists in which unregulated behavior trends toward maximum social benefit, reasonable minds will contemplate whether or not appropriate regulation (and enforcement of same) might be beneficial. Say: putting teeth into DNT, allowing for civil penalties (a border condition in which law and private enforcement both come into play), and civil penalties for egregious flouting of the law.

bmuon 15y ago

Working as a developer in an ad network I'm very interested in implementing this. However, said ad network doesn't currently provide an opt-out mechanism and Mozilla isn't doing a good job of providing me with arguments to take to management and convince them that a DNT opt-out is something they want. What do you think?

pluies 15y ago

"This might be a bit low because the tracking for DNT is by IP address." Tracking people using DNT? This is quite ironic.

gst 15y ago

Why should people turn it on - when most people just don't care? That's the same problem we have in the EU right now. The correct way to deal with cookies would be for people to enable or disable them in their browser, according to their personal preferences. Instead, the EU forces their cookie legislation on everybody, because most people are too lazy to fix their preferences.

barrkel 15y ago
It's precisely because grandmothers are "too lazy to fix their preferences" that governments step in.
SoftwareMaven 15y ago
Most people have no idea what a "cookie" is, nor how or why they should manage them. Calling people lazy for not managing them is the epitome of engineering arrogance. Browsers need better, more clear, interfaces for managing cookies and websites need to provide easily parses info on what each cookie is for before people will even be able to manage them.
- gst 15y ago
  If you're using a car it's taken for granted that you learn how this thing works. If you're using it without learning how it works, it's your own fault, if you have an accident. Why should this be any different with computers? The risk that you pose to others is pretty low, so there shouldn't be any requirement to have a "license". But I wouldn't call it arrogance, if I'll assume that someone using the network has a minimum knowledge about how things work.
  - blahedo 15y ago
    > If you're using a car it's taken for granted that you learn how this thing works. Only to a point. I own a car and am perfectly competent to use it, but I have only the vaguest of understanding as to what things like spark plugs and catalytic converters do. I know what a manifold is in mathematics, and I suppose it's a bit similar in a car engine. I deem myself knowledgeable to open the bonnet and add windshield wiper fluid when that's low, but anything more complicated I'll take to a mechanic. > If you're using it without learning how it works, it's your own fault, if you have an accident. It's my fault if I drive without, say, learning how to operate the brake pedal, or learning how to turn on the turn signal. But if the accident is due to something wrong with the internals that I know very little about? I don't think any reasonable person believes that getting licensed to drive should require one to have the knowledge of an automobile mechanic.

hexis 15y ago

DNT is like putting a note atop your plain text file asking unintended recipients to ignore the contents. What browsers need is something akin to encryption, where you're not asking for compliance, you're denying access.

azakai 15y ago
> DNT is like putting a note atop your plain text file asking unintended recipients to ignore the contents. Well, robots.txt is a simple text file that politely asks robots to not spider parts of your website. It is completely voluntary and unenforceable, but works very well.
- qjz 15y ago
  How can you tell it works? How do you know the bot owners aren't returning to crawl those parts with User-Agent strings that impersonate ordinary users?
- sbierwagen 15y ago
  It is completely voluntary and unenforceable, but works very well. Ha! It works very well: for Google, and Yahoo. They use informative user-agents, and respect robots.txt directives. They have to, they're large corporations, with shareholders. Everybody else ignores it. Why would they listen? Live example: 216.55.185.45 - - [11/Sep/2011:06:50:56 -0400] "GET / HTTP/1.0" 200 4835 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" 216.55.185.45 - - [11/Sep/2011:06:50:57 -0400] "GET / HTTP/1.0" 200 4835 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" 216.55.185.45 - - [11/Sep/2011:06:50:57 -0400] "GET /blog/ HTTP/1.0" 200 114535 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" 216.55.185.45 - - [11/Sep/2011:06:51:01 -0400] "GET /blog/archives/2010/01/12/creating_an_account_on_the_scp_wiki_is_like_pissing_glass/ HTTP/1.0" 200 10490 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" This is all the traffic from this IP, with no lines skipped. You might notice that it doesn't request CSS, or any of the linked images, or favicon.ico. Nor does it populate the referral header fields, which of course it would be doing if it was actually Firefox, and there was actually a human clicking on these links. It doesn't even bother requesting a robots.txt, which I don't have anyway.[1] Do a whois check on the IP, and we get: Codero CODERO1999A (NET-216-55-176-0-1) 216.55.176.0 - 216.55.187.255 Codero's a dedicated server host. This is a spambot, looking for email addresses. Visit the IP in a browser, and you see a site selling fake Tiffany jewelry. 1: http://www.archiveteam.org/index.php?title=Robots.txt http://www.archiveteam.org/index.php?title=Robots.txt