3 ms·

Sorry but this is insane. The real question is why is IE allowing Facebook, Google and others to bypass its privacy controls? Maybe beacause IE is not that sec

Sorry but this is insane. The real question is why is IE allowing Facebook, Google and others to bypass its privacy controls? Maybe beacause IE is not that secure. If your software have security problems, please fix those problems instead of complaining that others are exploiting them.

uid 15y ago
P3P is based on trust. If Facebook and Google don't want to support it then they should ignore it rather than subvert it.
- tripzilch 15y ago
  True, but apparent "not including the header" gives you strict privacy controls, while "including an invalid header" will set them wide open. That is a bit strange behaviour on IE's side as well.
- robertc 15y ago
  Where does P3P allow me to manage this trust relationship you say it's based on?
socialized 15y ago
I agree. It seems to me that it's a browser level problem if Google and Facebook could subvert so could the less "upstanding" websites.
robertc 15y ago
Because if you don't allow people to bypass the privacy controls a significant chunk of the web stops working. For instance there's at least one well known WiFi hotspot service in the UK for which the block 3rd party cookies option in Firefox breaks the logon process for.
dspillett 15y ago
> The real question is why is IE allowing Because the standard says that it should. In this circumstance they can legitimately claim "in all good faith". We can't lambaste MS for running roughshod over standards when ever it suits them (and believe me, I do) then turn around and moan because we don't a like the side-effect of them implementing a standard correctly (correctness here being defined by the standard, not any other measure of desirability) - that would be somewhat hypercritical. MS are (by my interpretation at any rate) being catty about this and using it as an excuse to get a petty shot out against Google, but that doesn't alter the three facts: 1. The standard has flaws 2. MS has implemented the standard (flaws and all, but that isn't the point) 3. Google (and others, though Google is the one MS are calling out) appear to be using a loophole in the standard to go against the spirit of the standard. If they don't agree with using that header for its intended purpose then they should just not include it. Including a header that is intended to be machine readable but giving it human readable content is not something that can be easily defended: they could easily include it as "x-P3P" instead which is perfectly valid. Any human that does looking for the P3P header will find a message in a x-P3P header just as readily and it wouldn't confuse the client application into opening greater access because it doesn't understand the "for humans" message Perhaps, considering the "assume human fallibility over malicious intent unless there is evidence otherwise" maxim, Google (and facebook, and everyone else that does this but isn't being fingered for it right now) did this in all good faith rather than to deliberately make use of a loophole, in which case the right course of action is to encourage them to correct this oversight instead of telling MS to ignore part of the standard.

uid 15y ago

P3P is based on trust. If Facebook and Google don't want to support it then they should ignore it rather than subvert it.

tripzilch 15y ago
True, but apparent "not including the header" gives you strict privacy controls, while "including an invalid header" will set them wide open. That is a bit strange behaviour on IE's side as well.
robertc 15y ago
Where does P3P allow me to manage this trust relationship you say it's based on?

socialized 15y ago

I agree. It seems to me that it's a browser level problem if Google and Facebook could subvert so could the less "upstanding" websites.

robertc 15y ago

Because if you don't allow people to bypass the privacy controls a significant chunk of the web stops working. For instance there's at least one well known WiFi hotspot service in the UK for which the block 3rd party cookies option in Firefox breaks the logon process for.

dspillett 15y ago

> The real question is why is IE allowing Because the standard says that it should. In this circumstance they can legitimately claim "in all good faith". We can't lambaste MS for running roughshod over standards when ever it suits them (and believe me, I do) then turn around and moan because we don't a like the side-effect of them implementing a standard correctly (correctness here being defined by the standard, not any other measure of desirability) - that would be somewhat hypercritical. MS are (by my interpretation at any rate) being catty about this and using it as an excuse to get a petty shot out against Google, but that doesn't alter the three facts: 1. The standard has flaws 2. MS has implemented the standard (flaws and all, but that isn't the point) 3. Google (and others, though Google is the one MS are calling out) appear to be using a loophole in the standard to go against the spirit of the standard. If they don't agree with using that header for its intended purpose then they should just not include it. Including a header that is intended to be machine readable but giving it human readable content is not something that can be easily defended: they could easily include it as "x-P3P" instead which is perfectly valid. Any human that does looking for the P3P header will find a message in a x-P3P header just as readily and it wouldn't confuse the client application into opening greater access because it doesn't understand the "for humans" message Perhaps, considering the "assume human fallibility over malicious intent unless there is evidence otherwise" maxim, Google (and facebook, and everyone else that does this but isn't being fingered for it right now) did this in all good faith rather than to deliberately make use of a loophole, in which case the right course of action is to encourage them to correct this oversight instead of telling MS to ignore part of the standard.