4 ms·

Just as a reminder to folk, safari never allowed third party cookies by default, and when google made chrome they made the choice to enable third party cookies

by olliej 3y ago

Just as a reminder to folk, safari never allowed third party cookies by default, and when google made chrome they made the choice to enable third party cookies as the primary purpose of chrome is to support google's ad business. Anything that they do needs to be considered in context, including "different" browsers that just re-ship chromium, as they simply solidify the chromium monopoly of what defines the web - i haven't seen "you must use safari" or "you must use Firefox", only "you must use chrome". I've seen enough people (incl. on HN) claiming that if chrome and the spec or chrome and other browsers diverge chrome is inherently right to recall the days of "IE is always the correct one" (also try to remember that while MS did a bunch of clearly BS reasons to beat netscape, IE was also a more capable, faster, and more responsive browser than netscape at the time, it was only once it rendered netscape irrelevant that the great stagnation happened).

rs_rs_rs_rs_rs 3y ago
Chrome is an amazing browser, thank you Google for investing a lot of money into it!
- henriquez 3y ago
  It’s because they love you so much.
  - rs_rs_rs_rs_rs 3y ago
    All the things made by Google that I use make my life easier, they do love their customers, you're right!
    - g-b-r 3y ago
      they do love their products
      - zx8080 3y ago
        They love only money
        olliej 3y ago
        I think g-b-r's point is that their "users" are the product. Google is an advertising company.
        g-b-r 3y ago
        yep
hirsin 3y ago
"never allowed" seems to be a stretch, as I remember when Safari disabled them. ITP wasn't that long ago, was it?
- olliej 3y ago
  Literally from the first beta release of safari more than a decade ago 3rd party cookies were not allowed by default. ITP is not about 3rd party cookies, ITP is first and second party cookies where people use indirect load mechanisms to circumvent 3rd party cookie blocking. e.g when people load Facebook buttons and such like directly into a page the 3rd party cookie isn't available in JS but the resource load for the Facebook button allows Facebook (or whoever) to return the tracking identifier directly to the host page so that it can update its own tracking information. ITP (and similar in Firefox) prevents that by saying some variation of "if I see requests to domain X from lots of different domains, we should assume that's being used for tracking purposes, and so not every request to domain X from a domain Y should be completely isolated from queries to domain X from any other domain" so now once you decide the domain X is used for tracking purposes you don't have a "cookies for X" database you have "cookies for X when loaded from Y", "cookies for X when loaded from Z", etc. What google is talking about is not anything approaching ITP, they're literally talking about something even more basic: JS on domain A can't directly interact with cookie information on domain B, which is the 3rd party blocking that is what Safari and WebKit have always done by default.
  - hirsin 3y ago
    Wild, I sat in meetings for months with JohnW and the Chrome team to discuss exactly these things but go off.
viraptor 3y ago
FF did isolated cookies last year for everyone as well https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/ https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-... Chrome is late to the party here with a very special workaround...
- olliej 3y ago
  Isolated cookies is not 3rd party cookie blocking. Based on commentary I think google has done a good job of misleading people. ITP and isolated cookies are a response to companies like Google and Facebook developing mechanisms to defeat/undermine 3rd party cookie blocking. Google's "tracking protection" is something Safari did from the very first beta two decades ago, Firefox adopted 3rd party cookie blocking more recently, but that's all google is doing right now, and (presumably because) it's a tracking mechanism that they have already defeated. They're calling it "tracking protection" to try and launder the "tracking protection" terminology of actual privacy mechanisms and terminology of other browsers, rather than actually acknowledging that what they're doing now was insufficient years ago (when safari and firefox had to introduce a bunch of very complex logic to continue to actually protect user privacy).
IshKebab 3y ago
That's incorrect: https://www.theverge.com/2020/3/24/21192830/apple-safari-intelligent-tracking-privacy-full-third-party-cookie-blocking https://www.theverge.com/2020/3/24/21192830/apple-safari-int...
- olliej 3y ago
  I literally worked on the webkit for most of a decade. I also worked on and developed a lot of ITP. ITP is not 3rd party cookie blocking. 3rd party cookie blocking has been the default in safari and webkit since literally the first beta. ITP is a response to companies like google and Facebook developing techniques to circumvent 3rd party cookie blocking as it became more popular (due to Firefox, Safari, and mostly iOS safari). Google is not developing an equivalent to ITP, it's literally flipping a single flag that they decided to turn off when they launched chrome because they're an advertising company that was dependent on them. You need to understand here: Google is not working on releasing anything equivalent to ITP or whatever Firefox calls their version, they're working on something much more basic, and it's something they have already circumvented (which is why Safari and Firefox have their complex ITP or whatever mechanisms).

by olliej 3y ago

rs_rs_rs_rs_rs 3y ago

Chrome is an amazing browser, thank you Google for investing a lot of money into it!

henriquez 3y ago
It’s because they love you so much.
- rs_rs_rs_rs_rs 3y ago
  All the things made by Google that I use make my life easier, they do love their customers, you're right!
  - g-b-r 3y ago
    they do love their products
    - zx8080 3y ago
      They love only money
      - olliej 3y ago
        I think g-b-r's point is that their "users" are the product. Google is an advertising company.
        g-b-r 3y ago
        yep

hirsin 3y ago

"never allowed" seems to be a stretch, as I remember when Safari disabled them. ITP wasn't that long ago, was it?

olliej 3y ago
Literally from the first beta release of safari more than a decade ago 3rd party cookies were not allowed by default. ITP is not about 3rd party cookies, ITP is first and second party cookies where people use indirect load mechanisms to circumvent 3rd party cookie blocking. e.g when people load Facebook buttons and such like directly into a page the 3rd party cookie isn't available in JS but the resource load for the Facebook button allows Facebook (or whoever) to return the tracking identifier directly to the host page so that it can update its own tracking information. ITP (and similar in Firefox) prevents that by saying some variation of "if I see requests to domain X from lots of different domains, we should assume that's being used for tracking purposes, and so not every request to domain X from a domain Y should be completely isolated from queries to domain X from any other domain" so now once you decide the domain X is used for tracking purposes you don't have a "cookies for X" database you have "cookies for X when loaded from Y", "cookies for X when loaded from Z", etc. What google is talking about is not anything approaching ITP, they're literally talking about something even more basic: JS on domain A can't directly interact with cookie information on domain B, which is the 3rd party blocking that is what Safari and WebKit have always done by default.
- hirsin 3y ago
  Wild, I sat in meetings for months with JohnW and the Chrome team to discuss exactly these things but go off.

viraptor 3y ago

FF did isolated cookies last year for everyone as well https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/ https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-... Chrome is late to the party here with a very special workaround...

olliej 3y ago
Isolated cookies is not 3rd party cookie blocking. Based on commentary I think google has done a good job of misleading people. ITP and isolated cookies are a response to companies like Google and Facebook developing mechanisms to defeat/undermine 3rd party cookie blocking. Google's "tracking protection" is something Safari did from the very first beta two decades ago, Firefox adopted 3rd party cookie blocking more recently, but that's all google is doing right now, and (presumably because) it's a tracking mechanism that they have already defeated. They're calling it "tracking protection" to try and launder the "tracking protection" terminology of actual privacy mechanisms and terminology of other browsers, rather than actually acknowledging that what they're doing now was insufficient years ago (when safari and firefox had to introduce a bunch of very complex logic to continue to actually protect user privacy).

IshKebab 3y ago

That's incorrect: https://www.theverge.com/2020/3/24/21192830/apple-safari-intelligent-tracking-privacy-full-third-party-cookie-blocking https://www.theverge.com/2020/3/24/21192830/apple-safari-int...

olliej 3y ago
I literally worked on the webkit for most of a decade. I also worked on and developed a lot of ITP. ITP is not 3rd party cookie blocking. 3rd party cookie blocking has been the default in safari and webkit since literally the first beta. ITP is a response to companies like google and Facebook developing techniques to circumvent 3rd party cookie blocking as it became more popular (due to Firefox, Safari, and mostly iOS safari). Google is not developing an equivalent to ITP, it's literally flipping a single flag that they decided to turn off when they launched chrome because they're an advertising company that was dependent on them. You need to understand here: Google is not working on releasing anything equivalent to ITP or whatever Firefox calls their version, they're working on something much more basic, and it's something they have already circumvented (which is why Safari and Firefox have their complex ITP or whatever mechanisms).