4 ms·

I totally understand your point and I think I agree, except—well, the setting says “disable cookies”. It should do what it says. If the goal is to disable all p

I totally understand your point and I think I agree, except—well, the setting says “disable cookies”. It should do what it says. If the goal is to disable all persistent information, the setting should be called “disable persistent storage”. Of course, I also know why it’s not called that: a lot of people know what cookies are at this point, at least relative to the number who'd understand “persistent storage”. A toggle named “disable cookies” is better for usability. On the other hand, trying to guess what the user actually wants based on a different preference is virtually guaranteed to cause confusion of its own. Should the setting also disable Canvas, since that’s commonly used for fingerprinting? And will Google make the same decision in Chrome v104 as they do in Chrome v110? I can’t decide whether the primary issue is: • The name of the setting. • The undeserved cultural prominence we’ve given “cookies” specifically. • The modern web in general.

orev 4y ago
“Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist. When people, laws, banners, etc. refer to cookies, they mean “any technology that stores information on the client side systems”. Whatever mechanism is used is irrelevant to the meaning/concept.
- kevingadd 4y ago
  Well, there is the distinction between cookies getting sent over the network vs localStorage being (obviously) local. but of course, a website can work around this by manually sending localStorage data in requests, so it makes sense that if people want privacy, you block both. Sucks though.
- MetaWhirledPeas 4y ago
  > “Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist Most people don't know what "cookies" means either. We shouldn't make the problem worse by giving them false information.
  - orev 4y ago
    I disagree, but not in the technical sense. People have been talking about cookies since they were invented, so most people who’ve used a web browser know the word and have a vague sense that they’re used to store information on their computer, and are often used for tracking. The fact is that “cookies” now has a colloquial meaning that’s different from the technical definition, and both meanings are valid.
  - pessimizer 4y ago
    Or we could just recognize that for the general population, "cookies" are any client storage by a website, and for technical people, cookies are a subset of options for client storage by a website. The public never needs to know the technical distinction because it is both 1) Arbitrary: "cookie" could just as well have been a general term for client storage, and 2) Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. > We shouldn't make the problem worse by giving them false information. So what I'm saying is that it's not a problem. It's very easy and accurate enough to tell users that they have to allow cookies in order to use some webpages offline. They can make all of the informed political decisions and personal decisions they need to make. I'd be happy to even further complicate the situation by referring to localstorage as the type of cookie that you'd need to make a lot of pages work offline. edit: I mean, you can save your cookie in localstorage. For me, that makes it a superset, and the name "local storage" makes it clear that it's storing things where you are. If the public weren't calling all client storage cookies, I'd recommend that they start calling all client storage localstorage.
    - Wowfunhappy 4y ago
      > Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. IMO, your exception is what makes the distinction significant. Defining a cookie two different ways gives companies a powerful new tool for purposefully misleading and manipulating end users. Yes, many users are already confused. But if we actually make it acceptable to define cookies more broadly (but only when it's convenient for those in power), we're going to make the situation much worse.
- pentagrama 4y ago
  > “Cookies” is shorthand for “persistent storage” "Cache" is also “persistent storage” to me.
- javajosh 4y ago
  I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. But at least some of this conversation revolves around what the public perception of cookies is, and as for that, I really don't know. I wouldn't presume that anyone else knows either unless they've conducted a poll.
  - NovemberWhiskey 4y ago
    >I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. I can't get with that definition. A server that attempts to set a cookie is very explicitly asking for state persistence on the client in the otherwise stateless HTTP protocol exchange. It literally has no other purpose.
    - javajosh 4y ago
      Cookies are a way for clients (and servers) to add data to HTTP requests. It's a header, plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe. Consider that a similar effect can be achieved by adding an id to every link in the body of a response. But its still just a link. In fact, before cookies this is how you associated requests with each other into a "session". And indeed, this is still a way to do user tracking across domains without cookies and in a way that is impossible to block in general. What a thing is used for is not the thing itself.
      - NovemberWhiskey 4y ago
        >plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe That's the definition of "client-side state". Cookies have no purpose other than maintenance of client-side state. https://www.rfc-editor.org/rfc/rfc6265 https://www.rfc-editor.org/rfc/rfc6265 "This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called cookies) at HTTP user agents, letting the servers maintain a stateful session over the mostly stateless HTTP protocol."
antiframe 4y ago
They could call it "disable cookies and other persistent storage (more information)" with more information providing their reasoning why they are bundled in plain English. There is no reason the setting has to have a two word name with no description.
- ape4 4y ago
  Just like Windows Control Panel has "Printers and Devices" - because I guess people don't think of printers as devices?
  - GuB-42 4y ago
    I guess that well behaved devices took offense of being put in the same category as printers. And I understand them.
    - jamiek88 4y ago
      Yeah if I was a device and someone called me a printer I tell you hwat!
  - LeifCarrotson 4y ago
    I'd guess it's more likely that there used to be a "Printers" control panel, when the main thing it controlled was the DB-25 parallel printer port on an ancient IBM-compatible PC, and later they added other devices to it. People accustomed to adjusting printer settings might scroll straight to "Printers" and be confused if it got renamed to "Devices." Even more nefariously, it's reasonable that there's some software out there that does a string comparison for "Printers" that ignores extra characters like " and Devices" which would be a reason not to rename it completely. Similarly here, cookies have been around since Netscape in 1994. IndexedDB is as new as 2015, window.LocalStorage is from ~2010 IIRC. For backwards compatibility, it's totally reasonable to use "Cookies" or "Cookies and local storage", and expect that to extend to any new developments.
  - WorldMaker 4y ago
    From what I saw, that was indeed one of the more common complaints about Windows 8. Nobody could find printers and thought Windows 8 didn't support printers because Windows 8 merged everything to just "Devices" (and the short-lived Devices "charm" as an intended one-stop print shop/"universal Print button", RIP). It didn't help that Windows 8 tried to at the same time update the ancient Windows Printer driver model and remove some of the worst habits of Printer driver vendors (background apps that are always running, bespoke updaters, weird unregulated UI extensions to Win32 common dialogs via backdoor hacks, etc) so there was some Manufacturer-encouraged hysteria that Windows was moving too much cheese on Printers and coming to take people's beloved Printers away (which did result in Microsoft killing that nicer printer driver stack initiative of Windows 8 and its user-focused experience).
janfoeh 4y ago
How about — Allow websites to store data on your computer [ ] short-term [ ] long-term or permanently Some websites need to store data for some features, or to work it all. Storing data can also enable them to track you. And I'd be inclined to blame the state of the web in general.
- iam-TJ 4y ago
  I'd be tempted to nuance that: [ ] Cookies - stored locally and sent to web-sites automatically [ ] Local Storage - not automatically sent to web-sites In all cases I veer towards sharing explicit details. If users choose to not understand it fully that is fine. I don't like 'dumbing-down' or simplifying taking away explicit details with no easy way to get it in the same place as the 'simple' exposition.
  - potatoz2 4y ago
    That’s a distinction without a difference IMHO. Local storage (or Cache API, IndexedDB) + Service Worker = Cookies (simply add a header to every request) Local storage + DOM manipulation to add search params with the stored content = Cookies (apart from first navigation) And on the flip side Cookies set using JS + Ignore cookies server side = Local storage It’s almost like the object/closure equivalence.
jefftk 4y ago
The current phrasing in Chrome is: Block all cookies (not recommended) - Sites can't use cookies to improve your browsing experience, for example, to keep you signed in or to remember items in your shopping cart - Sites can't use your cookies to see your browsing activity across different sites, for example, to personalize ads - Features on many sites may not work That seems long enough that they could put in text about how this is storage in general and not just cookies. Firefox just has "Cookies: All cookies (will cause websites to break)" so there's not really a place for that sort of text.

orev 4y ago

“Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist. When people, laws, banners, etc. refer to cookies, they mean “any technology that stores information on the client side systems”. Whatever mechanism is used is irrelevant to the meaning/concept.

kevingadd 4y ago
Well, there is the distinction between cookies getting sent over the network vs localStorage being (obviously) local. but of course, a website can work around this by manually sending localStorage data in requests, so it makes sense that if people want privacy, you block both. Sucks though.
MetaWhirledPeas 4y ago
> “Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist Most people don't know what "cookies" means either. We shouldn't make the problem worse by giving them false information.
- orev 4y ago
  I disagree, but not in the technical sense. People have been talking about cookies since they were invented, so most people who’ve used a web browser know the word and have a vague sense that they’re used to store information on their computer, and are often used for tracking. The fact is that “cookies” now has a colloquial meaning that’s different from the technical definition, and both meanings are valid.
- pessimizer 4y ago
  Or we could just recognize that for the general population, "cookies" are any client storage by a website, and for technical people, cookies are a subset of options for client storage by a website. The public never needs to know the technical distinction because it is both 1) Arbitrary: "cookie" could just as well have been a general term for client storage, and 2) Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. > We shouldn't make the problem worse by giving them false information. So what I'm saying is that it's not a problem. It's very easy and accurate enough to tell users that they have to allow cookies in order to use some webpages offline. They can make all of the informed political decisions and personal decisions they need to make. I'd be happy to even further complicate the situation by referring to localstorage as the type of cookie that you'd need to make a lot of pages work offline. edit: I mean, you can save your cookie in localstorage. For me, that makes it a superset, and the name "local storage" makes it clear that it's storing things where you are. If the public weren't calling all client storage cookies, I'd recommend that they start calling all client storage localstorage.
  - Wowfunhappy 4y ago
    > Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. IMO, your exception is what makes the distinction significant. Defining a cookie two different ways gives companies a powerful new tool for purposefully misleading and manipulating end users. Yes, many users are already confused. But if we actually make it acceptable to define cookies more broadly (but only when it's convenient for those in power), we're going to make the situation much worse.
pentagrama 4y ago
> “Cookies” is shorthand for “persistent storage” "Cache" is also “persistent storage” to me.
javajosh 4y ago
I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. But at least some of this conversation revolves around what the public perception of cookies is, and as for that, I really don't know. I wouldn't presume that anyone else knows either unless they've conducted a poll.
- NovemberWhiskey 4y ago
  >I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. I can't get with that definition. A server that attempts to set a cookie is very explicitly asking for state persistence on the client in the otherwise stateless HTTP protocol exchange. It literally has no other purpose.
  - javajosh 4y ago
    Cookies are a way for clients (and servers) to add data to HTTP requests. It's a header, plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe. Consider that a similar effect can be achieved by adding an id to every link in the body of a response. But its still just a link. In fact, before cookies this is how you associated requests with each other into a "session". And indeed, this is still a way to do user tracking across domains without cookies and in a way that is impossible to block in general. What a thing is used for is not the thing itself.
    - NovemberWhiskey 4y ago
      >plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe That's the definition of "client-side state". Cookies have no purpose other than maintenance of client-side state. https://www.rfc-editor.org/rfc/rfc6265 https://www.rfc-editor.org/rfc/rfc6265 "This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called cookies) at HTTP user agents, letting the servers maintain a stateful session over the mostly stateless HTTP protocol."

antiframe 4y ago

They could call it "disable cookies and other persistent storage (more information)" with more information providing their reasoning why they are bundled in plain English. There is no reason the setting has to have a two word name with no description.

ape4 4y ago
Just like Windows Control Panel has "Printers and Devices" - because I guess people don't think of printers as devices?
- GuB-42 4y ago
  I guess that well behaved devices took offense of being put in the same category as printers. And I understand them.
  - jamiek88 4y ago
    Yeah if I was a device and someone called me a printer I tell you hwat!
- LeifCarrotson 4y ago
  I'd guess it's more likely that there used to be a "Printers" control panel, when the main thing it controlled was the DB-25 parallel printer port on an ancient IBM-compatible PC, and later they added other devices to it. People accustomed to adjusting printer settings might scroll straight to "Printers" and be confused if it got renamed to "Devices." Even more nefariously, it's reasonable that there's some software out there that does a string comparison for "Printers" that ignores extra characters like " and Devices" which would be a reason not to rename it completely. Similarly here, cookies have been around since Netscape in 1994. IndexedDB is as new as 2015, window.LocalStorage is from ~2010 IIRC. For backwards compatibility, it's totally reasonable to use "Cookies" or "Cookies and local storage", and expect that to extend to any new developments.
- WorldMaker 4y ago
  From what I saw, that was indeed one of the more common complaints about Windows 8. Nobody could find printers and thought Windows 8 didn't support printers because Windows 8 merged everything to just "Devices" (and the short-lived Devices "charm" as an intended one-stop print shop/"universal Print button", RIP). It didn't help that Windows 8 tried to at the same time update the ancient Windows Printer driver model and remove some of the worst habits of Printer driver vendors (background apps that are always running, bespoke updaters, weird unregulated UI extensions to Win32 common dialogs via backdoor hacks, etc) so there was some Manufacturer-encouraged hysteria that Windows was moving too much cheese on Printers and coming to take people's beloved Printers away (which did result in Microsoft killing that nicer printer driver stack initiative of Windows 8 and its user-focused experience).

janfoeh 4y ago

How about — Allow websites to store data on your computer [ ] short-term [ ] long-term or permanently Some websites need to store data for some features, or to work it all. Storing data can also enable them to track you. And I'd be inclined to blame the state of the web in general.

iam-TJ 4y ago
I'd be tempted to nuance that: [ ] Cookies - stored locally and sent to web-sites automatically [ ] Local Storage - not automatically sent to web-sites In all cases I veer towards sharing explicit details. If users choose to not understand it fully that is fine. I don't like 'dumbing-down' or simplifying taking away explicit details with no easy way to get it in the same place as the 'simple' exposition.
- potatoz2 4y ago
  That’s a distinction without a difference IMHO. Local storage (or Cache API, IndexedDB) + Service Worker = Cookies (simply add a header to every request) Local storage + DOM manipulation to add search params with the stored content = Cookies (apart from first navigation) And on the flip side Cookies set using JS + Ignore cookies server side = Local storage It’s almost like the object/closure equivalence.

jefftk 4y ago

The current phrasing in Chrome is: Block all cookies (not recommended) - Sites can't use cookies to improve your browsing experience, for example, to keep you signed in or to remember items in your shopping cart - Sites can't use your cookies to see your browsing activity across different sites, for example, to personalize ads - Features on many sites may not work That seems long enough that they could put in text about how this is storage in general and not just cookies. Firefox just has "Cookies: All cookies (will cause websites to break)" so there's not really a place for that sort of text.