4 ms·

“Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist. When people, laws, banners, etc. refer to co

by orev 4y ago

“Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist. When people, laws, banners, etc. refer to cookies, they mean “any technology that stores information on the client side systems”. Whatever mechanism is used is irrelevant to the meaning/concept.

kevingadd 4y ago
Well, there is the distinction between cookies getting sent over the network vs localStorage being (obviously) local. but of course, a website can work around this by manually sending localStorage data in requests, so it makes sense that if people want privacy, you block both. Sucks though.
MetaWhirledPeas 4y ago
> “Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist Most people don't know what "cookies" means either. We shouldn't make the problem worse by giving them false information.
- orev 4y ago
  I disagree, but not in the technical sense. People have been talking about cookies since they were invented, so most people who’ve used a web browser know the word and have a vague sense that they’re used to store information on their computer, and are often used for tracking. The fact is that “cookies” now has a colloquial meaning that’s different from the technical definition, and both meanings are valid.
- pessimizer 4y ago
  Or we could just recognize that for the general population, "cookies" are any client storage by a website, and for technical people, cookies are a subset of options for client storage by a website. The public never needs to know the technical distinction because it is both 1) Arbitrary: "cookie" could just as well have been a general term for client storage, and 2) Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. > We shouldn't make the problem worse by giving them false information. So what I'm saying is that it's not a problem. It's very easy and accurate enough to tell users that they have to allow cookies in order to use some webpages offline. They can make all of the informed political decisions and personal decisions they need to make. I'd be happy to even further complicate the situation by referring to localstorage as the type of cookie that you'd need to make a lot of pages work offline. edit: I mean, you can save your cookie in localstorage. For me, that makes it a superset, and the name "local storage" makes it clear that it's storing things where you are. If the public weren't calling all client storage cookies, I'd recommend that they start calling all client storage localstorage.
  - Wowfunhappy 4y ago
    > Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. IMO, your exception is what makes the distinction significant. Defining a cookie two different ways gives companies a powerful new tool for purposefully misleading and manipulating end users. Yes, many users are already confused. But if we actually make it acceptable to define cookies more broadly (but only when it's convenient for those in power), we're going to make the situation much worse.
    - roywiggins 4y ago
      It's a bit late, these things have been called "supercookies" since Flash started to support persisting data outside the browser's control.
      - account42 4y ago
        Right, if anything, we should campaign for the technical definition of "Cookies" to encompass everything as well and just call the old thing legacy HTTP cookies or whatever when you need to be specific.
- JohnFen 4y ago
  As a non-web developer, I remember years ago when disabling cookies meant only cookies -- then learning that there were other forms of persistent storage. It made me angry and I felt betrayed. Calling all persistent storage "cookies" matches the popular understanding of what "cookie" means. I don't see the problem with accepting that and using the term accordingly. It may not be technically correct, but this is a point where the technical distinction isn't important. If a user disables cookies, what the user is expecting is that persistent storage won't happen at all. Renaming it to disabling "persistent storage" would be fine, too, except that it would be necessary to explain what "persistent storage" means.
pentagrama 4y ago
> “Cookies” is shorthand for “persistent storage” "Cache" is also “persistent storage” to me.
javajosh 4y ago
I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. But at least some of this conversation revolves around what the public perception of cookies is, and as for that, I really don't know. I wouldn't presume that anyone else knows either unless they've conducted a poll.
- NovemberWhiskey 4y ago
  >I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. I can't get with that definition. A server that attempts to set a cookie is very explicitly asking for state persistence on the client in the otherwise stateless HTTP protocol exchange. It literally has no other purpose.
  - javajosh 4y ago
    Cookies are a way for clients (and servers) to add data to HTTP requests. It's a header, plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe. Consider that a similar effect can be achieved by adding an id to every link in the body of a response. But its still just a link. In fact, before cookies this is how you associated requests with each other into a "session". And indeed, this is still a way to do user tracking across domains without cookies and in a way that is impossible to block in general. What a thing is used for is not the thing itself.
    - NovemberWhiskey 4y ago
      >plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe That's the definition of "client-side state". Cookies have no purpose other than maintenance of client-side state. https://www.rfc-editor.org/rfc/rfc6265 https://www.rfc-editor.org/rfc/rfc6265 "This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called cookies) at HTTP user agents, letting the servers maintain a stateful session over the mostly stateless HTTP protocol."

by orev 4y ago

kevingadd 4y ago

Well, there is the distinction between cookies getting sent over the network vs localStorage being (obviously) local. but of course, a website can work around this by manually sending localStorage data in requests, so it makes sense that if people want privacy, you block both. Sucks though.

MetaWhirledPeas 4y ago

> “Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist Most people don't know what "cookies" means either. We shouldn't make the problem worse by giving them false information.

orev 4y ago
I disagree, but not in the technical sense. People have been talking about cookies since they were invented, so most people who’ve used a web browser know the word and have a vague sense that they’re used to store information on their computer, and are often used for tracking. The fact is that “cookies” now has a colloquial meaning that’s different from the technical definition, and both meanings are valid.
pessimizer 4y ago
Or we could just recognize that for the general population, "cookies" are any client storage by a website, and for technical people, cookies are a subset of options for client storage by a website. The public never needs to know the technical distinction because it is both 1) Arbitrary: "cookie" could just as well have been a general term for client storage, and 2) Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. > We shouldn't make the problem worse by giving them false information. So what I'm saying is that it's not a problem. It's very easy and accurate enough to tell users that they have to allow cookies in order to use some webpages offline. They can make all of the informed political decisions and personal decisions they need to make. I'd be happy to even further complicate the situation by referring to localstorage as the type of cookie that you'd need to make a lot of pages work offline. edit: I mean, you can save your cookie in localstorage. For me, that makes it a superset, and the name "local storage" makes it clear that it's storing things where you are. If the public weren't calling all client storage cookies, I'd recommend that they start calling all client storage localstorage.
- Wowfunhappy 4y ago
  > Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups. IMO, your exception is what makes the distinction significant. Defining a cookie two different ways gives companies a powerful new tool for purposefully misleading and manipulating end users. Yes, many users are already confused. But if we actually make it acceptable to define cookies more broadly (but only when it's convenient for those in power), we're going to make the situation much worse.
  - roywiggins 4y ago
    It's a bit late, these things have been called "supercookies" since Flash started to support persisting data outside the browser's control.
    - account42 4y ago
      Right, if anything, we should campaign for the technical definition of "Cookies" to encompass everything as well and just call the old thing legacy HTTP cookies or whatever when you need to be specific.
JohnFen 4y ago
As a non-web developer, I remember years ago when disabling cookies meant only cookies -- then learning that there were other forms of persistent storage. It made me angry and I felt betrayed. Calling all persistent storage "cookies" matches the popular understanding of what "cookie" means. I don't see the problem with accepting that and using the term accordingly. It may not be technically correct, but this is a point where the technical distinction isn't important. If a user disables cookies, what the user is expecting is that persistent storage won't happen at all. Renaming it to disabling "persistent storage" would be fine, too, except that it would be necessary to explain what "persistent storage" means.

pentagrama 4y ago

> “Cookies” is shorthand for “persistent storage” "Cache" is also “persistent storage” to me.

javajosh 4y ago

I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. But at least some of this conversation revolves around what the public perception of cookies is, and as for that, I really don't know. I wouldn't presume that anyone else knows either unless they've conducted a poll.

NovemberWhiskey 4y ago
>I think of cookies as a mechanism to send data across the network. That mechanism can be used to simulate persistence on the client, among other things. I can't get with that definition. A server that attempts to set a cookie is very explicitly asking for state persistence on the client in the otherwise stateless HTTP protocol exchange. It literally has no other purpose.
- javajosh 4y ago
  Cookies are a way for clients (and servers) to add data to HTTP requests. It's a header, plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe. Consider that a similar effect can be achieved by adding an id to every link in the body of a response. But its still just a link. In fact, before cookies this is how you associated requests with each other into a "session". And indeed, this is still a way to do user tracking across domains without cookies and in a way that is impossible to block in general. What a thing is used for is not the thing itself.
  - NovemberWhiskey 4y ago
    >plus the expectation that the client will add this data to subsequent requests sent within a certain timeframe That's the definition of "client-side state". Cookies have no purpose other than maintenance of client-side state. https://www.rfc-editor.org/rfc/rfc6265 https://www.rfc-editor.org/rfc/rfc6265 "This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called cookies) at HTTP user agents, letting the servers maintain a stateful session over the mostly stateless HTTP protocol."