3 ms·

> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth

> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option used for everyone. You're right to complain about how we're basically unable to use an otherwise-useful feature because of bad actors. It's a signal that core web technologies need to be created with potential abuses first and foremost.

horsawlarway 4y ago
> It's a signal that core web technologies need to be created with potential abuses first and foremost. No. This is how absolutely everyone ends up with the shittiest version of everything. We need recourse and a general legal expectation that you DON'T abuse your users. Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its fucking mouth out of the feed trough (or honestly do much of anything at all, right now). We don't take that stance for literally ANY other industry: You can buy a gun, but guns can kill people. You can buy a car, but cars can crash. You can get a dog, and that dog can bite people. The answer is not "Ban it because it might be bad". The answer is to properly set expectations that abuse will be met with heavy penalties. This is not fucking Minority Report, and we shouldn't be trying to "precognition" all the bad out of the world. We should address it head on, and fucking burn the bad actors to the ground.
- shadowgovt 4y ago
  It is possible the US government lacks the reach to do what you've described, given how much organized crime is centered in other nations. But I agree with you overall... Much of the web's concept of privacy and security is baked in with the assumption that it must be technologically enforced because it can't be legally enforced. Change that math and you change the model.
- mindslight 4y ago
  While I agree that we direly need privacy legislation to stop openly chartered surveillance companies from tracking us through whatever means, your position doesn't work for computer security in general. The only way "accountability" works for computer security is if every node on the network carried an inescapable real world identity that is responsible for its network traffic, which would be much more of a draconian regime than you are arguing against.
yunohn 4y ago
> If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them Okay, but this thread is about the right use of them.

horsawlarway 4y ago

> It's a signal that core web technologies need to be created with potential abuses first and foremost. No. This is how absolutely everyone ends up with the shittiest version of everything. We need recourse and a general legal expectation that you DON'T abuse your users. Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its fucking mouth out of the feed trough (or honestly do much of anything at all, right now). We don't take that stance for literally ANY other industry: You can buy a gun, but guns can kill people. You can buy a car, but cars can crash. You can get a dog, and that dog can bite people. The answer is not "Ban it because it might be bad". The answer is to properly set expectations that abuse will be met with heavy penalties. This is not fucking Minority Report, and we shouldn't be trying to "precognition" all the bad out of the world. We should address it head on, and fucking burn the bad actors to the ground.

shadowgovt 4y ago
It is possible the US government lacks the reach to do what you've described, given how much organized crime is centered in other nations. But I agree with you overall... Much of the web's concept of privacy and security is baked in with the assumption that it must be technologically enforced because it can't be legally enforced. Change that math and you change the model.
mindslight 4y ago
While I agree that we direly need privacy legislation to stop openly chartered surveillance companies from tracking us through whatever means, your position doesn't work for computer security in general. The only way "accountability" works for computer security is if every node on the network carried an inescapable real world identity that is responsible for its network traffic, which would be much more of a draconian regime than you are arguing against.

yunohn 4y ago

> If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them Okay, but this thread is about the right use of them.