3 ms·

Many of us remember when cookies were purely a utility-add for end users and were restricted only to the domain which set them. Thanks for inventing that.

1vuio0pswjnm7 3y ago
Who can take credit for lifting that restriction. Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default. The most fascinating thing IMO about so-called "modern" browsers is that even when their vendors publish source code, "99.9%" of people will not even attempt to make changes, even something as simple as changing a default from "on" to "off". It's like the software is stamped with "Read Only" or "Do Not Touch" and "99.9%" of people dutifully obey. The "0.1%" appear to be very conservative with the changes they make. For example, if it was possible to disable auto-loading of resources, I might actually use these "modern" graphical browsers for tasks other than commercially-oriented transactions. Cookies are only one problem with these browsers.
- jalk 3y ago
  Seems a bit overkill to recompile to get "no third party cookies by default" when you can just open the settings and disable it when you first install the browser. The setting is kept between updates (in Firefox at least) and if you are paranoid you can always check with Dev tools or a dumping proxy that 3rd party cookies are still disabled after an update
  - 1vuio0pswjnm7 3y ago
    This undervalues convenience. The convenience of not having to worry about privacy-hostile default settings. Also, this will not work where the user is running applications from read-only media, or using something like "Guest mode" on a Chromebook where changes to settings are either not possible or ephemeral. This sort of argument in defense of so-called "tech" company "default settings" shenanigans has been called out in recent litigation. Courts are becoming aware of the power and significance of "default settings". It's this idea of "overkill", or other simialr rationales, that I am referring to in the original comment. Just enough "friction" to stop people from changing things. Not worth the trouble, people may think. And this works year after year. Amazing. Browser vendors were not the first in the computer industry to utilise this type of tactic, but it's a fine example. Not sure who "you" refers to in the parent comment: me or a hypothetical person. If it's the former, I use a text-only browser that neither auto-load resources nor runs Javascript, along a localhost-bound proxy that strips or adds cookies. This is perfect for me. Both software I can change and quickly re-compile at any time. If it's the later, and "you" refers to a hypothetical person, then I cannot comment on behalf of such persons. What I do know is that most users do not change default settings.
    - anecdotal1 3y ago
      I think most will agree that we should focus on making browsers by default limit the amount of private and identifying information sent to anywhere that didn't explicitly get authorized for it.
      - 1vuio0pswjnm7 3y ago
        TBH, with today's web the only way I have found to limit the information sent is to either not use a browser to make HTTP requests (e.g., use TCP client instead) or use a browser that (a) does not auto-load resources, e.g., images, Javascript files, etc, and (b) does not run Javascript inside <script> tags. Of course no other silly stuff like automatic "DNS prefetch" either. This way I know that the only information I am sending is the information I the web user actually sent, i.e., the HTTP request. Otherwise, there is no way to know what other HTTP requests will be made to accomplish auto-loading images, fonts, etc. or what other HTTP requests will be made by auto-loaded or inlined JS when the browser automatically runs it. When the user types or clicks on https://hostx.com/1.htm https://hostx.com/1.htm, the user knows she has sent a request for filepath "/1.htm" at hostx.com. That's straightforward and easy to understand. Her intent is clear. She wants the file named "1.htm" from hostx.com. However, what if she uses a browser that auto-loads remote files and auto-runs JS, and, e.g., the file 1.htm instricts the browser to auto-load the file "1.js", the browser automatically runs 1.js without any input from the user, and then 1.js makes more HTTP requests. Has the user "authorised" that information to be sent. Imagine she does not know the contents of file 1.js. How can she authorise sending information, i.e., an HTTP request, if she does not know what is the information, i.e., the request, and where it is being sent.
    - jalk 3y ago
      You originally wrote: > Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default. And my response was simply it's way easier for the vast majority of people to change a setting once, than compiling the source (and remember to stay up to date with new releases) > What I do know is that most users do not change default settings. And they don't install alternative privacy respecting browsers either. (edit for layout)
- abdullahkhalids 3y ago
  Firefox rolls out Total Cookie Protection by default to more users worldwide https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/ https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-... Finally, just last month.
- eternityforest 3y ago
  Browsers need a lot of updates. No way I'd want to touch a single line of code in a browser. Somehow, something is going to break and I'll have to screw with it at an inconvenient time no matter how clever my auto update script is. There's lots of stuff I'd like to change, but I am not wading through the nightmare pile of code to add mdns browsing and SyncThing bookmark sync. It's too bad most apps are getting rid of true scriptability. Browsers would be way better if you could just drop a python file in a folder and change stuff.
  - 1vuio0pswjnm7 3y ago
    The text-only browser I use does not need updates. I am able to script it via tmux. Overall I think "browsers" are overextended and overrated. I use them as HTML readers. I prefer separate programs for different tasks instead of one program for every task. The so-called "modern" web browser, a "nightmare pile of code" indeed.

1vuio0pswjnm7 3y ago

Who can take credit for lifting that restriction. Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default. The most fascinating thing IMO about so-called "modern" browsers is that even when their vendors publish source code, "99.9%" of people will not even attempt to make changes, even something as simple as changing a default from "on" to "off". It's like the software is stamped with "Read Only" or "Do Not Touch" and "99.9%" of people dutifully obey. The "0.1%" appear to be very conservative with the changes they make. For example, if it was possible to disable auto-loading of resources, I might actually use these "modern" graphical browsers for tasks other than commercially-oriented transactions. Cookies are only one problem with these browsers.

jalk 3y ago
Seems a bit overkill to recompile to get "no third party cookies by default" when you can just open the settings and disable it when you first install the browser. The setting is kept between updates (in Firefox at least) and if you are paranoid you can always check with Dev tools or a dumping proxy that 3rd party cookies are still disabled after an update
- 1vuio0pswjnm7 3y ago
  This undervalues convenience. The convenience of not having to worry about privacy-hostile default settings. Also, this will not work where the user is running applications from read-only media, or using something like "Guest mode" on a Chromebook where changes to settings are either not possible or ephemeral. This sort of argument in defense of so-called "tech" company "default settings" shenanigans has been called out in recent litigation. Courts are becoming aware of the power and significance of "default settings". It's this idea of "overkill", or other simialr rationales, that I am referring to in the original comment. Just enough "friction" to stop people from changing things. Not worth the trouble, people may think. And this works year after year. Amazing. Browser vendors were not the first in the computer industry to utilise this type of tactic, but it's a fine example. Not sure who "you" refers to in the parent comment: me or a hypothetical person. If it's the former, I use a text-only browser that neither auto-load resources nor runs Javascript, along a localhost-bound proxy that strips or adds cookies. This is perfect for me. Both software I can change and quickly re-compile at any time. If it's the later, and "you" refers to a hypothetical person, then I cannot comment on behalf of such persons. What I do know is that most users do not change default settings.
  - anecdotal1 3y ago
    I think most will agree that we should focus on making browsers by default limit the amount of private and identifying information sent to anywhere that didn't explicitly get authorized for it.
    - 1vuio0pswjnm7 3y ago
      TBH, with today's web the only way I have found to limit the information sent is to either not use a browser to make HTTP requests (e.g., use TCP client instead) or use a browser that (a) does not auto-load resources, e.g., images, Javascript files, etc, and (b) does not run Javascript inside <script> tags. Of course no other silly stuff like automatic "DNS prefetch" either. This way I know that the only information I am sending is the information I the web user actually sent, i.e., the HTTP request. Otherwise, there is no way to know what other HTTP requests will be made to accomplish auto-loading images, fonts, etc. or what other HTTP requests will be made by auto-loaded or inlined JS when the browser automatically runs it. When the user types or clicks on https://hostx.com/1.htm https://hostx.com/1.htm, the user knows she has sent a request for filepath "/1.htm" at hostx.com. That's straightforward and easy to understand. Her intent is clear. She wants the file named "1.htm" from hostx.com. However, what if she uses a browser that auto-loads remote files and auto-runs JS, and, e.g., the file 1.htm instricts the browser to auto-load the file "1.js", the browser automatically runs 1.js without any input from the user, and then 1.js makes more HTTP requests. Has the user "authorised" that information to be sent. Imagine she does not know the contents of file 1.js. How can she authorise sending information, i.e., an HTTP request, if she does not know what is the information, i.e., the request, and where it is being sent.
  - jalk 3y ago
    You originally wrote: > Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default. And my response was simply it's way easier for the vast majority of people to change a setting once, than compiling the source (and remember to stay up to date with new releases) > What I do know is that most users do not change default settings. And they don't install alternative privacy respecting browsers either. (edit for layout)
abdullahkhalids 3y ago
Firefox rolls out Total Cookie Protection by default to more users worldwide https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/ https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-... Finally, just last month.
eternityforest 3y ago
Browsers need a lot of updates. No way I'd want to touch a single line of code in a browser. Somehow, something is going to break and I'll have to screw with it at an inconvenient time no matter how clever my auto update script is. There's lots of stuff I'd like to change, but I am not wading through the nightmare pile of code to add mdns browsing and SyncThing bookmark sync. It's too bad most apps are getting rid of true scriptability. Browsers would be way better if you could just drop a python file in a folder and change stuff.
- 1vuio0pswjnm7 3y ago
  The text-only browser I use does not need updates. I am able to script it via tmux. Overall I think "browsers" are overextended and overrated. I use them as HTML readers. I prefer separate programs for different tasks instead of one program for every task. The so-called "modern" web browser, a "nightmare pile of code" indeed.