8 ms·

Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame o

by arebop 15y ago

Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them. P3P was standardized but it never got traction due to various practical problems. For example, privacy policies vary in many, sometimes-subtle, ways and nobody could figure out how to build simple software to decide automatically how to respond to these policies on behalf of users. Don't take Google's word for it, see what facebook says: http://www.facebook.com/help/?page=219494461411349 http://www.facebook.com/help/?page=219494461411349. epic.org doesn't use it either. There are some appealing ideas in P3P but in real life it doesn't actually help users protect their privacy, even on sites that actually implement it (such as Bing). The P3P working group shut down long go (http://www.w3.org/P3P/ http://www.w3.org/P3P/). This is article is just cheap shot at a competitor.

kevingadd 15y ago
So the fact that P3P doesn't solve all the problems it set out to solve justifies Google intentionally using it to compromise visitors' privacy in a way that directly contradicts the purpose of the header? And this is okay because it's an MSIE feature they're circumventing?
- eli 15y ago
  Well, you have a choice: send a bogus P3P header, or break some functionality for IE users.
  - kevingadd 15y ago
    The functionality being "broken" is functionality that users DO NOT WANT and have EXPLICITLY OPTED OUT OF by configuring their browser to reject tracking cookies. If they weren't tracking cookies, you could send a VALID P3P header and your app would work.
    - eli 15y ago
      Actually it's the default in IE, not a feature people opted into. I'd be a lot less sympathetic to Google if it was a feature people opted into rather than one that IE users were unaware of.
      - cooldeal 15y ago
        XP SP2 made the firewall default and enabled. If Chrome disabled it for themselves and started uploading user files when the computer was idle, will that make it okay since it was Microsoft who installed the firewall by default and not the user? MS tries to market their browser as safer and with more privacy features. Presumably some users trust MS to go with safe defaults. And Google tries to break that by intentionally breaking the standard for their profit by recording the users' browsing habits on their tracking servers and you are sympathetic to Google because they would make less profit if they didn't do this?
        eli 15y ago
        I recognize it's a judgement call, but I'm sympathetic to breaking P3P because P3P is a crappy standard that doesn't actually do much to protect your privacy. In 2012, P3P is best known as the thing that breaks your single sign-on solution in IE.
  - wvenable 15y ago
    No, the choices are: send a bogus P3P header, send a legitimate P3P header, or accept the user's tracking cookie preference.
    - yuliyp 15y ago
      That third one is accept that you lost 99% of IE users, since almost no IE users can actually understand something like P3P and who is asserting what and why that claim should be trusted, and thus leave that scary looking setting at the default level.
untog 15y ago
Oh look, Google fails to fully support features only MSIE has P3P was standardized Then it's a little unfair to describe P3P as some IE-only standard then, no? You make it sound like proprietary extension.
- eli 15y ago
  Lets not get lost in semantics. True it's a documented standard, but only Microsoft supports it and given its many drawbacks no one else is likely to add support any time soon. It might as well be proprietary.
  - untog 15y ago
    It might as well be proprietary. Not even slightly. That does a huge disservice to any standardisation process. In fact, how "only Microsoft supports it" ends up being Microsoft's problem baffles me. It was created by a standards body. The other browser manufacturers did not implement it. Therefore, it's all Microsoft's fault?
    - eli 15y ago
      It is Microsoft's problem that they have IE default to rely on what nearly everyone agrees is a crap solution to protecting privacy on the Internet. To web developers and certainly to web users there is zero difference between a standard that only Microsoft supports and a documented, but non-standard extension that only Microsoft supports.
      - untog 15y ago
        It is Microsoft's problem that they have IE default to rely on what nearly everyone agrees is a crap solution Do they? Then what's the point in the standardisation process? The whole point is that everyone agreed on a solution in P3P. Maybe it wasn't ideal, but it was the standard. So, faithfully, MS implemented it. So, MS is to blame when they go alone and make their own standards, but they are now also to blame when they follow the standardisation process to the letter and other people don't?
ceejayoz 15y ago
> Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them. No, Google deliberately set a P3P header that confuses IE into letting Google bypass the user's privacy settings.
- eli 15y ago
  I'd wager that very few P3P headers used in the wild are an accurate and complete representation of the privacy policy of the site. Most are either deliberately confusing IE (as you put it) or copied from a tutorial by a developer who just needed to fix the damn login button for stupid IE users. Creating an accurate P3P header that captures the nuances of different ways data can be used is somewhere between difficult and impossible (I've tried).
  - cooldeal 15y ago
    >I'd wager that very few P3P headers used in the wild are an accurate and complete representation of the privacy policy of the site. So now the standard of comparison for Google is shady warez sites that flout every possible standard for maximum gain? I'd wager that there are a lot of exploits that install spyware in the wild. That doesn't excuse Google does it.
    - azylman 15y ago
      As has already been discussed in numerous places, Google, Facebook, Amazon and even Microsoft have broken P3P implementations in several places. That's hardly "shady warez sites". I love you you jumped straight to that conclusion, though. Shows your biases coming through...
      - cooldeal 15y ago
        Broken implementations are different from intentionally subverted ones. If FB is doing this, they deserve blame too. The argument I was responding to seems to be that P3P is a gentleman's agreement and thus is doomed to fail. However, I expect more from Google than I would from random sites on the internet. So Google flouting a gentleman's agreement is very different from a warez site doing it. After all, you don't expect Google to read your mail in Gmail versus the site admins of warez-mail.com reading your email. Or do you?

by arebop 15y ago

kevingadd 15y ago

So the fact that P3P doesn't solve all the problems it set out to solve justifies Google intentionally using it to compromise visitors' privacy in a way that directly contradicts the purpose of the header? And this is okay because it's an MSIE feature they're circumventing?

eli 15y ago
Well, you have a choice: send a bogus P3P header, or break some functionality for IE users.
- kevingadd 15y ago
  The functionality being "broken" is functionality that users DO NOT WANT and have EXPLICITLY OPTED OUT OF by configuring their browser to reject tracking cookies. If they weren't tracking cookies, you could send a VALID P3P header and your app would work.
  - eli 15y ago
    Actually it's the default in IE, not a feature people opted into. I'd be a lot less sympathetic to Google if it was a feature people opted into rather than one that IE users were unaware of.
    - cooldeal 15y ago
      XP SP2 made the firewall default and enabled. If Chrome disabled it for themselves and started uploading user files when the computer was idle, will that make it okay since it was Microsoft who installed the firewall by default and not the user? MS tries to market their browser as safer and with more privacy features. Presumably some users trust MS to go with safe defaults. And Google tries to break that by intentionally breaking the standard for their profit by recording the users' browsing habits on their tracking servers and you are sympathetic to Google because they would make less profit if they didn't do this?
      - eli 15y ago
        I recognize it's a judgement call, but I'm sympathetic to breaking P3P because P3P is a crappy standard that doesn't actually do much to protect your privacy. In 2012, P3P is best known as the thing that breaks your single sign-on solution in IE.
- wvenable 15y ago
  No, the choices are: send a bogus P3P header, send a legitimate P3P header, or accept the user's tracking cookie preference.
  - yuliyp 15y ago
    That third one is accept that you lost 99% of IE users, since almost no IE users can actually understand something like P3P and who is asserting what and why that claim should be trusted, and thus leave that scary looking setting at the default level.

untog 15y ago

Oh look, Google fails to fully support features only MSIE has P3P was standardized Then it's a little unfair to describe P3P as some IE-only standard then, no? You make it sound like proprietary extension.

eli 15y ago
Lets not get lost in semantics. True it's a documented standard, but only Microsoft supports it and given its many drawbacks no one else is likely to add support any time soon. It might as well be proprietary.
- untog 15y ago
  It might as well be proprietary. Not even slightly. That does a huge disservice to any standardisation process. In fact, how "only Microsoft supports it" ends up being Microsoft's problem baffles me. It was created by a standards body. The other browser manufacturers did not implement it. Therefore, it's all Microsoft's fault?
  - eli 15y ago
    It is Microsoft's problem that they have IE default to rely on what nearly everyone agrees is a crap solution to protecting privacy on the Internet. To web developers and certainly to web users there is zero difference between a standard that only Microsoft supports and a documented, but non-standard extension that only Microsoft supports.
    - untog 15y ago
      It is Microsoft's problem that they have IE default to rely on what nearly everyone agrees is a crap solution Do they? Then what's the point in the standardisation process? The whole point is that everyone agreed on a solution in P3P. Maybe it wasn't ideal, but it was the standard. So, faithfully, MS implemented it. So, MS is to blame when they go alone and make their own standards, but they are now also to blame when they follow the standardisation process to the letter and other people don't?

ceejayoz 15y ago

> Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them. No, Google deliberately set a P3P header that confuses IE into letting Google bypass the user's privacy settings.

eli 15y ago
I'd wager that very few P3P headers used in the wild are an accurate and complete representation of the privacy policy of the site. Most are either deliberately confusing IE (as you put it) or copied from a tutorial by a developer who just needed to fix the damn login button for stupid IE users. Creating an accurate P3P header that captures the nuances of different ways data can be used is somewhere between difficult and impossible (I've tried).
- cooldeal 15y ago
  >I'd wager that very few P3P headers used in the wild are an accurate and complete representation of the privacy policy of the site. So now the standard of comparison for Google is shady warez sites that flout every possible standard for maximum gain? I'd wager that there are a lot of exploits that install spyware in the wild. That doesn't excuse Google does it.
  - azylman 15y ago
    As has already been discussed in numerous places, Google, Facebook, Amazon and even Microsoft have broken P3P implementations in several places. That's hardly "shady warez sites". I love you you jumped straight to that conclusion, though. Shows your biases coming through...
    - cooldeal 15y ago
      Broken implementations are different from intentionally subverted ones. If FB is doing this, they deserve blame too. The argument I was responding to seems to be that P3P is a gentleman's agreement and thus is doomed to fail. However, I expect more from Google than I would from random sites on the internet. So Google flouting a gentleman's agreement is very different from a warez site doing it. After all, you don't expect Google to read your mail in Gmail versus the site admins of warez-mail.com reading your email. Or do you?