5 ms·

My spouse will sometimes mention in conversation with others that I invented the cookie. This always puts me on the spot, and I have to enter into a long explan

by todd8 3y ago

My spouse will sometimes mention in conversation with others that I invented the cookie. This always puts me on the spot, and I have to enter into a long explanation of the what and the why of cookies least they believe that I some sort of evil software hacker. (Now for a short explanation so that HN readers don’t think that I’m an evil hacker: I invented them, with the help of a colleague, while at IBM where we were designing a distributed file system. This was before the advent of the World Wide Web.)

AbsoluteCabbage 3y ago
There are likely dozens of others out there that can lay claim to the same. What specifically do you define as the innovation behind this “invention”?
- todd8 3y ago
  I'm sure that many can make the same claim. In the 1980's, I was an operating systems architect working at IBM. I thought up many interesting (to me) innovations while working on the first couple of releases of the AIX on the IBM POWER hardware. It was a great job and I learned a lot doing it. I got to work with some really brilliant developers and computer scientists (a number from IBM Research). One project I was responsible for was the development of a distributed file system for AIX. The goal was a distributed file system that addressed some of the weaknesses found in other distributed file systems at the time. Our chief competitor was Sun's NFS distributed file system. NFS was a really nice design. It was well integrated into the operating system and quite reliable because it utilized a (mostly) stateless server. This had a number of performance and security implications along with some file system semantics over NFS that didn't match local file system semantics. We wanted to introduce state for the server to address these issues and thought of a number of complex protocols to manage it in the presence of unreliable clients. That's when I thought up the idea of making the clients keep their own state to be restored when they reconnected to the server. I protected this state from manipulation by the client by encrypting it. I didn't call them cookies, I called them tokens. This design was patented by IBM and I was one of the two inventors on the patent. This patent was owned by IBM and years later they gave a special award for this patent because it decided that it was one of IBM's most important patents. (They wouldn't have done this unless the patent had held up to scrutiny or legal challenges). Unfortunately, by that time I had already left IBM to start my own company--I was at the top of my game and had confidence that I could create a software product of some kind that would be successful--so I missed out on the financial award for the patent. By then, I was at my new company and already in competition with IBM. By now, the patent should be long expired. Interestingly, IBM ended up buying my company around seven years after I and a partner started it. I was very aware of the academic literature and industrial practice during this time so I do believe that my invention does reflect original work that ended up with a very significant impact. From a more personal perspective, the invention didn't financially benefit me. The work that I did at my company own was more creative, inventive, technically impactful, and financially important to me. For example, Austin Ventures has indicated that my company was the start of Austin becoming an important high-tech location, but none of that was related to the cookie.
  - skzv 3y ago
    What was your company?
    - EvanAnderson 3y ago
      I'm going to put my guess in as Tivoli.
      - todd8 3y ago
        Yes
        ricktdotorg 3y ago
        i did a consulting gig rolling out Tivoli at Dell in the mid-90s, i think pre-IBM merger! loved the software, hated the [flat] network Dell had in Round Rock at the time! thanks for your detailed comment. love reading tech history stories.
reaperman 3y ago
Many of us remember when cookies were purely a utility-add for end users and were restricted only to the domain which set them. Thanks for inventing that.
- 1vuio0pswjnm7 3y ago
  Who can take credit for lifting that restriction. Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default. The most fascinating thing IMO about so-called "modern" browsers is that even when their vendors publish source code, "99.9%" of people will not even attempt to make changes, even something as simple as changing a default from "on" to "off". It's like the software is stamped with "Read Only" or "Do Not Touch" and "99.9%" of people dutifully obey. The "0.1%" appear to be very conservative with the changes they make. For example, if it was possible to disable auto-loading of resources, I might actually use these "modern" graphical browsers for tasks other than commercially-oriented transactions. Cookies are only one problem with these browsers.
  - jalk 3y ago
    Seems a bit overkill to recompile to get "no third party cookies by default" when you can just open the settings and disable it when you first install the browser. The setting is kept between updates (in Firefox at least) and if you are paranoid you can always check with Dev tools or a dumping proxy that 3rd party cookies are still disabled after an update
    - 1vuio0pswjnm7 3y ago
      This undervalues convenience. The convenience of not having to worry about privacy-hostile default settings. Also, this will not work where the user is running applications from read-only media, or using something like "Guest mode" on a Chromebook where changes to settings are either not possible or ephemeral. This sort of argument in defense of so-called "tech" company "default settings" shenanigans has been called out in recent litigation. Courts are becoming aware of the power and significance of "default settings". It's this idea of "overkill", or other simialr rationales, that I am referring to in the original comment. Just enough "friction" to stop people from changing things. Not worth the trouble, people may think. And this works year after year. Amazing. Browser vendors were not the first in the computer industry to utilise this type of tactic, but it's a fine example. Not sure who "you" refers to in the parent comment: me or a hypothetical person. If it's the former, I use a text-only browser that neither auto-load resources nor runs Javascript, along a localhost-bound proxy that strips or adds cookies. This is perfect for me. Both software I can change and quickly re-compile at any time. If it's the later, and "you" refers to a hypothetical person, then I cannot comment on behalf of such persons. What I do know is that most users do not change default settings.
jhpacker 3y ago
Interesting, what kind of cookies? Like I say in the article Lou Montulli from Netscape is generally credited with creating the HTTP cookie, which they named cookie based upon magic cookies in unix, though its obviously quite a bit different.
dylan604 3y ago
Great, so when time travel becomes a thing, I'll add you to the list of people to have a chat with about needing to envision longer term visions for how nefarious people can be. I love that at one point in a not so distant galaxy, er time, that there was a thing of innocence. Now, that innocence can no longer be tolerated and every new thing must have more time invested on how the new thing can be abused rather than just used as intended.
- todd8 3y ago
  Really? I didn't invent it for browsers, I invented it for distributed file systems before the "World Wide Web" had even been invented. You might as well have a talk with William Shockley or Vint Cerf.
  - hutzlibu 3y ago
    Somewhat probably, don't take it serious. You did good.
    - todd8 3y ago
      Thanks...I'm think I'm too sensitive about it since this comes up every f'ing time.
      - godelski 3y ago
        Not too sensitive. All of us get annoyed at things we have to constantly reiterate. At least that other user revealed their insanity after they kept talking. Literally explaining why you could never have known, despite claiming you should have "thought harder." Don't feel guilty, you're not the one with the evil idea. We should, of course think long (and sometimes evil), but it's impossible to predict what others will use your tech for. You did good and there's no problems with what you did.
        dylan604 3y ago
        >Literally explaining why you could never have known, That's the entire point of coming from the future to the past with information unavailable. It's pretty much Time Travel 101 sci-fi trope. Rather than going back in time with sports scores and stock picks, I was putting it towards nerdy tech dev. Sheesh
tracker1 3y ago
Yeah, I remember in the mid-late 90's when companies would actually disable cookies altogether. Most non-technical people just don't understand the what/how/why cookies work, or were really needed in the browsers. In the end, it's definitely been used in excessive and somewhat intrusive ways. I also wish that browsers had better controls over second and third party cookies and tracking (similar for nested iframe) in order to bubble some of it closer to the surface. In the end, pihole, ublock origin and privacy badger goes a long way to limiting this.
eternityforest 3y ago
That's such a cool story! I'm very glad cookies are a thing that exists, regardless of any bad uses they might have.
sfmike 3y ago
You're a master baker

by todd8 3y ago

AbsoluteCabbage 3y ago

There are likely dozens of others out there that can lay claim to the same. What specifically do you define as the innovation behind this “invention”?

todd8 3y ago
I'm sure that many can make the same claim. In the 1980's, I was an operating systems architect working at IBM. I thought up many interesting (to me) innovations while working on the first couple of releases of the AIX on the IBM POWER hardware. It was a great job and I learned a lot doing it. I got to work with some really brilliant developers and computer scientists (a number from IBM Research). One project I was responsible for was the development of a distributed file system for AIX. The goal was a distributed file system that addressed some of the weaknesses found in other distributed file systems at the time. Our chief competitor was Sun's NFS distributed file system. NFS was a really nice design. It was well integrated into the operating system and quite reliable because it utilized a (mostly) stateless server. This had a number of performance and security implications along with some file system semantics over NFS that didn't match local file system semantics. We wanted to introduce state for the server to address these issues and thought of a number of complex protocols to manage it in the presence of unreliable clients. That's when I thought up the idea of making the clients keep their own state to be restored when they reconnected to the server. I protected this state from manipulation by the client by encrypting it. I didn't call them cookies, I called them tokens. This design was patented by IBM and I was one of the two inventors on the patent. This patent was owned by IBM and years later they gave a special award for this patent because it decided that it was one of IBM's most important patents. (They wouldn't have done this unless the patent had held up to scrutiny or legal challenges). Unfortunately, by that time I had already left IBM to start my own company--I was at the top of my game and had confidence that I could create a software product of some kind that would be successful--so I missed out on the financial award for the patent. By then, I was at my new company and already in competition with IBM. By now, the patent should be long expired. Interestingly, IBM ended up buying my company around seven years after I and a partner started it. I was very aware of the academic literature and industrial practice during this time so I do believe that my invention does reflect original work that ended up with a very significant impact. From a more personal perspective, the invention didn't financially benefit me. The work that I did at my company own was more creative, inventive, technically impactful, and financially important to me. For example, Austin Ventures has indicated that my company was the start of Austin becoming an important high-tech location, but none of that was related to the cookie.
- skzv 3y ago
  What was your company?
  - EvanAnderson 3y ago
    I'm going to put my guess in as Tivoli.
    - todd8 3y ago
      Yes
      - ricktdotorg 3y ago
        i did a consulting gig rolling out Tivoli at Dell in the mid-90s, i think pre-IBM merger! loved the software, hated the [flat] network Dell had in Round Rock at the time! thanks for your detailed comment. love reading tech history stories.

reaperman 3y ago

Many of us remember when cookies were purely a utility-add for end users and were restricted only to the domain which set them. Thanks for inventing that.

1vuio0pswjnm7 3y ago
Who can take credit for lifting that restriction. Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default. The most fascinating thing IMO about so-called "modern" browsers is that even when their vendors publish source code, "99.9%" of people will not even attempt to make changes, even something as simple as changing a default from "on" to "off". It's like the software is stamped with "Read Only" or "Do Not Touch" and "99.9%" of people dutifully obey. The "0.1%" appear to be very conservative with the changes they make. For example, if it was possible to disable auto-loading of resources, I might actually use these "modern" graphical browsers for tasks other than commercially-oriented transactions. Cookies are only one problem with these browsers.
- jalk 3y ago
  Seems a bit overkill to recompile to get "no third party cookies by default" when you can just open the settings and disable it when you first install the browser. The setting is kept between updates (in Firefox at least) and if you are paranoid you can always check with Dev tools or a dumping proxy that 3rd party cookies are still disabled after an update
  - 1vuio0pswjnm7 3y ago
    This undervalues convenience. The convenience of not having to worry about privacy-hostile default settings. Also, this will not work where the user is running applications from read-only media, or using something like "Guest mode" on a Chromebook where changes to settings are either not possible or ephemeral. This sort of argument in defense of so-called "tech" company "default settings" shenanigans has been called out in recent litigation. Courts are becoming aware of the power and significance of "default settings". It's this idea of "overkill", or other simialr rationales, that I am referring to in the original comment. Just enough "friction" to stop people from changing things. Not worth the trouble, people may think. And this works year after year. Amazing. Browser vendors were not the first in the computer industry to utilise this type of tactic, but it's a fine example. Not sure who "you" refers to in the parent comment: me or a hypothetical person. If it's the former, I use a text-only browser that neither auto-load resources nor runs Javascript, along a localhost-bound proxy that strips or adds cookies. This is perfect for me. Both software I can change and quickly re-compile at any time. If it's the later, and "you" refers to a hypothetical person, then I cannot comment on behalf of such persons. What I do know is that most users do not change default settings.

jhpacker 3y ago

Interesting, what kind of cookies? Like I say in the article Lou Montulli from Netscape is generally credited with creating the HTTP cookie, which they named cookie based upon magic cookies in unix, though its obviously quite a bit different.

dylan604 3y ago

Great, so when time travel becomes a thing, I'll add you to the list of people to have a chat with about needing to envision longer term visions for how nefarious people can be. I love that at one point in a not so distant galaxy, er time, that there was a thing of innocence. Now, that innocence can no longer be tolerated and every new thing must have more time invested on how the new thing can be abused rather than just used as intended.

todd8 3y ago
Really? I didn't invent it for browsers, I invented it for distributed file systems before the "World Wide Web" had even been invented. You might as well have a talk with William Shockley or Vint Cerf.
- hutzlibu 3y ago
  Somewhat probably, don't take it serious. You did good.
  - todd8 3y ago
    Thanks...I'm think I'm too sensitive about it since this comes up every f'ing time.
    - godelski 3y ago
      Not too sensitive. All of us get annoyed at things we have to constantly reiterate. At least that other user revealed their insanity after they kept talking. Literally explaining why you could never have known, despite claiming you should have "thought harder." Don't feel guilty, you're not the one with the evil idea. We should, of course think long (and sometimes evil), but it's impossible to predict what others will use your tech for. You did good and there's no problems with what you did.
      - dylan604 3y ago
        >Literally explaining why you could never have known, That's the entire point of coming from the future to the past with information unavailable. It's pretty much Time Travel 101 sci-fi trope. Rather than going back in time with sports scores and stock picks, I was putting it towards nerdy tech dev. Sheesh

tracker1 3y ago

Yeah, I remember in the mid-late 90's when companies would actually disable cookies altogether. Most non-technical people just don't understand the what/how/why cookies work, or were really needed in the browsers. In the end, it's definitely been used in excessive and somewhat intrusive ways. I also wish that browsers had better controls over second and third party cookies and tracking (similar for nested iframe) in order to bubble some of it closer to the surface. In the end, pihole, ublock origin and privacy badger goes a long way to limiting this.

eternityforest 3y ago

That's such a cool story! I'm very glad cookies are a thing that exists, regardless of any bad uses they might have.

sfmike 3y ago

You're a master baker