9 ms·

Dear ICO, Sue Us

171 points by colinscape 14y ago

jamiecurle 14y ago
I'd like to see this legislation deleted and chalked up to a learning experience for government. In principal yes, I do want websites to be open about their cookie use, but leaving the implementation down to the website owners has spawned many different ways of dealing with the issue. This makes it less clear and likely more confusing for the end user. Let's try a solution at the user & browser level.
- Isofarro 14y ago
  "Let's try a solution at the user & browser level." That's not enough. Only the website really knows what the cookies are actually being used for. That information needs to be surfaced in a manner where customer preferences can be tailored. Trying to keep track of which cookie domains are used for cross-site tracking (which is what a user/browser level mechanism will max out to) becomes a big game of whack-a-mole. Cheap domains, endless supply of subdomains; IP address filtering can help, but there's a fair bit of collateral damage. We have P3P, but it's too much of an all-or-nothing thing. It's quite ardous for a website to implement correctly, and too easy to be unforthcoming with accurate information. But, we need to be able to understand the purpose of every cookie (and similar client-side storage mechanisms), and they need to be done in a way that tracking-related storage can be disabled without disrupting the storage related to the primary purpose of the site (from the customer's point of view). But the root cause of all this is that there are website owners who do not accept that their customers or visitors have a right to privacy. That perception needs to change for a viable solution to exist. It's a social issue, solving it in a technical manner runs into a similar set of issues that a legislative approach is currently doing.
  - jamiecurle 14y ago
    You're right, it is a whack-a-mole situation, which is why I'd move more towards a browser and user level solution. The OP made a fine suggestion that bridges responsibility between user, website owner and browser > The gist would be using a rel element like so: <a href='privacy.html' rel='privacypolicy'>Privacy</a> and then using that as a means of consistently linking to a privacy policy. As a result, policies would have consistent language for users ('look for the "Privacy" link') but could also be detected automatically by browsers or testing tools. That way you could actually test your site is properly linking to a policy, and users could have browser preferences like "disable cookies until I've seen a policy" or whatever. [edited for clarity]
TomGullen 14y ago
Popups/dropdowns etc semi-forced upon UK websites are extremely anti-competitive in my opinion. - Visitors who the law is trying to protect (less savvy web users) could easily be scared by cookie messages - It's another barrier to actually accessing content on the site - It's time consuming and difficult to implement sometimes. For example, if your site requires cookies to function, what should it do if a visitor declines permission? These new laws seem to be addressing peoples irrational fears, and not the actual problem. I'd like to see them go down the pan. I hope next year when they start enforcing it they don't make examples of companies with cherry picked large fines.
- stordoff 14y ago
  > For example, if your site requires cookies to function, what should it do if a visitor declines permission? If I'm reading the guidance[1] correctly (and I've only skimmed it), you don't need permission for essential cookies. Most sites just display a message along the lines of "We're using cookies; your continued use of this site gives consent" etc.. [1] http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/cookies.aspx http://www.ico.gov.uk/for_organisations/privacy_and_electron...
- MatthewPhillips 14y ago
  > These new laws seem to be addressing peoples irrational fears, and not the actual problem. What is the problem, to you? To me the problem is that websites track my movement across the internet and I don't want them to invade my privacy in that way.
r4vik 14y ago
interim solution, add this to your adblock plus rules: https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list and send me patches when you find a site with a cookie warning
- mike-cardwell 14y ago
  Nice! Up until now I've been writing small GreaseMonkey plugins to handle this. Added your list. Expect the occasional pull request. :) [edit] First pull request sent.
  - r4vik 14y ago
    first pull request merged. look forward to many more :)
- PJones 14y ago
  I like the idea, but won't this prevent you from accepting cookies if the site has actually bothered to ask permission before adding them?
  - r4vik 14y ago
    You're right to have that concern, I won't block a site if it's doing that but practically it's not an issue. I've yet to encounter one that requires opt-in before setting cookies.
5h 14y ago
Utter props to silktide to pushing this, I feel like half my posts on HN have been about this retarded legislation. Those who misuse cookies will soon use even more insidious means, those who don't are being forced into implementing stupid confusing boilerplate, utterly ridiculous!
- oliveremberton 14y ago
  Thanks! (I'm the founder of Silktide and author of that rant). We had some constructive suggestions on what could be done instead, although these are definitely up for debate. The gist would be using a rel element like so: <a href='privacy.html' rel='privacypolicy'>Privacy</a> and then using that as a means of consistently linking to a privacy policy. As a result, policies would have consistent language for users ('look for the "Privacy" link') but could also be detected automatically by browsers or testing tools. That way you could actually test your site is properly linking to a policy, and users could have browser preferences like "disable cookies until I've seen a policy" or whatever. It's just an idea but we've implemented it on our sites and will be interested to see what others think: http://blog.silktide.com/2012/09/fixing-a-broken-cookie-law/ http://blog.silktide.com/2012/09/fixing-a-broken-cookie-law/
  - jamiecurle 14y ago
    That's a really nice solution that bridges responsibility between the user, browser and the website owners.
  - loceng 14y ago
    Plus could then have a link to the privacy policy page added in the actual browser, rather than intruding on the user experience.
- wtracz 14y ago
  Until the ICO start taking people to court it will stay ridiculous, but I think the intent of it is important. Using etags to track individuals is really no different to a cookie with a unique ID... Having a 10 page complaint form is what is dumb. Why can't you just send a suspect URL, then have it scoured for dubious cookies?
asg 14y ago
Good to see them taking a stance. It is a great shame that this law does absolutely nothing to improve privacy. I typically do my casual browsing in incognito mode, which means that I'm constantly bombarded with these cookie warnings. So this law has significantly reduced the quality of my experience, for no benefit at all. The people who want to track me still continue to do so.
eckyptang 14y ago
I think the general attitude here is pretty bad and I'm disgusted with the replies. I hope the hell they do get sued. The reason that the law exists is that people have abused the cookie functionality terribly to track people all over the Internet using every possible loophole that they can. Now the price is being paid through not very good legislation. You wrote functionality that tracks people and now you're whinging when people are given their privacy back? Forget it - I have no sympathy. Regarding legitimate use, you click accept and the problem goes away. With respect to analytics, stop being cheap and lazy and do it from your logs.
- ThomPete 14y ago
  I think you are missing the bigger issue here. Many people will not click/not allow if they see a warning message. In fact many people will be either confused and scared and leave. I.e. its not theoretically a problem if you assume that most users are rational users who read what is in front of them and make reasonable choices. De facto though that is not the case and that means that a lot of business who put it up will see a drop in revenue even if they normally play by the books. Furtermore it really does not help anything since those with malicious intentions can just put it up and still do all sorts of shady business on the back.
  - eckyptang 14y ago
    I think most people ignore the warning and click through based on the amount of toolbars I have to remove from PCs. The drop in revenue hasn't happened for us and we've been compliant for months now. I think, based on the quantity of sites this is occuring on, that it's a non issue. People are used to it now. The malicious people can be identified easily. Think of these changes as covering your arse rather than an inconvenience.
    - underdown 14y ago
      Different websites have different audiences and monetization schemes making your anecdotal observation uninteresting. It's also at odds with reams of conversion rate optimization data. What did Amazon report - something like a 500ms delay produces a 1% drop in conversion rate. I wonder how long it takes the average pensioner to click through?
MattBearman 14y ago
Can anyone who is more law savvy than I answer this question for me: Does a European company have to put the cookie message on their site if the site is hosted in the US?
- MattBearman 14y ago
  Found a (sort of) answer in their cookie_guidance_v3.pdf "An organisation based in the UK is likely to be subject to the requirements of the Regulations even if their website is technically hosted overseas. Organisations based outside of Europe with websites designed for the European market, or providing products or services to customers in Europe, should consider that their users in the UK and Europe will clearly expect information and choices about cookies to be provided." Of course, much like the rest of this legislation, the phrase "likely to be subject to" is vague and ill defined. Sometimes I hate being base in England.
Zirro 14y ago
In Sweden, just about every non-government site has ignored this law. I don't think we'll see anyone getting sued over it any time soon here.
jvvlimme 14y ago
If instead of using cookies we would swap to using the browsers storage, wouldn't we circumvent this entire rubbish law (+ the other advantages it already provides)? http://www.jstorage.info http://www.jstorage.info
- rmc 14y ago
  I don't know the exact law, but the law might not refer to cookies explicitly, but instead refer to tracking users. Switching from one tracking type to another will not avoid the law then.
- prisonblues 14y ago
  The law states: "a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met." Paragraph 2 then sets out how consent needs to be obtained, and the test that the subscriber needs to have given their consent before information is stored on their computer. Cookies, flash cookies, HTML5 databases, etc. are all covered under the general concept of storing on a subscriber's computer. The original law is here - http://www.legislation.gov.uk/uksi/2003/2426/regulation/6/made http://www.legislation.gov.uk/uksi/2003/2426/regulation/6/ma... - and here are the recent amendments - http://www.legislation.gov.uk/uksi/2011/1208/made http://www.legislation.gov.uk/uksi/2011/1208/made
  - PJones 14y ago
    Isn't this vague enough that a site with an image is infringing? "Sure, they requested the web site, but they never explicitly said they wanted the image, and now you've gone and stored it in their cache."
    - alter8 14y ago
      How do you read back the tracking information from a cached object, page or image without replacing it with a fresh new one?
- ProNihilist 14y ago
bbguitar 14y ago
Having spent a good chunk of time implementing cookie permission popups across our sites, Google Analytics showed a drop down to 10% of the normal traffic. (The traffic is a bit higher according to the logs, but not normal. Also as someone else pointed out the funnelling and reporting is harder to decipher) Putting in an implied statement and removing the pop-up and we're back to the regular levels. Sorry but this law is flawed and I'm glad its getting a bit of airing again. Come on ICO and the EU peeps who created this directive please rethink this with some expert advice.
grabeh 14y ago
I think the ICO has acknowledged the issues with the law and as a result is taking a gentle approach to enforcing the law (which the OP's crusade seems at odds with...). I think it's a good idea to attempt to increase user awareness of how information about a person's visit to a site will be used. As the guidance acknowledges, the type of most interest are third party advertising cookies and if the law helps to increase awareness of such usage, then it will have succeeded. In terms of geographical location, my understanding is that the location of the provider is irrelevant as if they are providing a service in the EU, they should be complying with the law.
gavinlynch 14y ago
Every time I hear this cookie debate, I feel I must be missing something. If you don't want to be tracked. TURN. COOKIES. OFF. There is a reason all web browsers come with per-domain cookies policies. We don't need a cookie law. We need some common sense. Everyone is looking to make this someone else's responsibility. Guess what: Your digital security and privacy is your responsibility. I hate this entire debate because: 1) Cookies serve a very, very valuable purpose in website development. Client-side storage is used in basically every major website on the internet. 2) This is hardly low-hanging fruit, and we have much, much bigger problems. 3) Who is the arbiter of what "allowed use" cookies are? We're going to have someone who actually decides, for individual websites, whether cookie use is proper or not? Is it going to work like a DMCA take-down request? An individual sends a request to review a website's cookie policies, and that IT department will have to submit a technical analysis and provide reasons for their cookie usage when a user feels their rights have been violated? 4) You know where this is going? Every single website that you register on is just going to give you a EULA-type agreement when you create an account. New to Facebook? Enter your username, click this checkbox that says "I accept your terms", and that's it. Normal users will just roll with basically any terms you present to them. Making this entirely ineffective except for the small minority of people, like many here, who are hyper vigilante about digital privacy. For the people this is meant to protect, they will likely never even think about it and opt-in anyway. 5) I completely reject the notion of getting politicians to dictate requirements to the tech industry in terms of how to handle the web stack. Let the politicians get back to blaming each other for X failures and make Y promises to the public, and get out of my internet.
- chimeracoder 14y ago
  > If you don't want to be tracked. TURN. COOKIES. OFF. ...except that's not going to be enough to make you untrackable[1]. As far as I know, short of some extreme Tor practices (new Tor connection for every session, no simultaneous sessions), there's no way to make yourself truly untrackable. [1] https://panopticlick.eff.org/index.php https://panopticlick.eff.org/index.php
  - gavinlynch 14y ago
jpswade 14y ago
I remember Silktide from ~2004 when they used to have SiteScore. http://web.archive.org/web/20041010040340/http://sitescore.silktide.com/ http://web.archive.org/web/20041010040340/http://sitescore.s... Nice to see they're still around.

171 points by colinscape 14y ago

I'd like to see this legislation deleted and chalked up to a learning experience for government. In principal yes, I do want websites to be open about their cookie use, but leaving the implementation down to the website owners has spawned many different ways of dealing with the issue. This makes it less clear and likely more confusing for the end user. Let's try a solution at the user & browser level.

Isofarro 14y ago
"Let's try a solution at the user & browser level." That's not enough. Only the website really knows what the cookies are actually being used for. That information needs to be surfaced in a manner where customer preferences can be tailored. Trying to keep track of which cookie domains are used for cross-site tracking (which is what a user/browser level mechanism will max out to) becomes a big game of whack-a-mole. Cheap domains, endless supply of subdomains; IP address filtering can help, but there's a fair bit of collateral damage. We have P3P, but it's too much of an all-or-nothing thing. It's quite ardous for a website to implement correctly, and too easy to be unforthcoming with accurate information. But, we need to be able to understand the purpose of every cookie (and similar client-side storage mechanisms), and they need to be done in a way that tracking-related storage can be disabled without disrupting the storage related to the primary purpose of the site (from the customer's point of view). But the root cause of all this is that there are website owners who do not accept that their customers or visitors have a right to privacy. That perception needs to change for a viable solution to exist. It's a social issue, solving it in a technical manner runs into a similar set of issues that a legislative approach is currently doing.
- jamiecurle 14y ago
  You're right, it is a whack-a-mole situation, which is why I'd move more towards a browser and user level solution. The OP made a fine suggestion that bridges responsibility between user, website owner and browser > The gist would be using a rel element like so: <a href='privacy.html' rel='privacypolicy'>Privacy</a> and then using that as a means of consistently linking to a privacy policy. As a result, policies would have consistent language for users ('look for the "Privacy" link') but could also be detected automatically by browsers or testing tools. That way you could actually test your site is properly linking to a policy, and users could have browser preferences like "disable cookies until I've seen a policy" or whatever. [edited for clarity]

TomGullen 14y ago

Popups/dropdowns etc semi-forced upon UK websites are extremely anti-competitive in my opinion. - Visitors who the law is trying to protect (less savvy web users) could easily be scared by cookie messages - It's another barrier to actually accessing content on the site - It's time consuming and difficult to implement sometimes. For example, if your site requires cookies to function, what should it do if a visitor declines permission? These new laws seem to be addressing peoples irrational fears, and not the actual problem. I'd like to see them go down the pan. I hope next year when they start enforcing it they don't make examples of companies with cherry picked large fines.

stordoff 14y ago
> For example, if your site requires cookies to function, what should it do if a visitor declines permission? If I'm reading the guidance[1] correctly (and I've only skimmed it), you don't need permission for essential cookies. Most sites just display a message along the lines of "We're using cookies; your continued use of this site gives consent" etc.. [1] http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/cookies.aspx http://www.ico.gov.uk/for_organisations/privacy_and_electron...
MatthewPhillips 14y ago
> These new laws seem to be addressing peoples irrational fears, and not the actual problem. What is the problem, to you? To me the problem is that websites track my movement across the internet and I don't want them to invade my privacy in that way.

r4vik 14y ago

interim solution, add this to your adblock plus rules: https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list and send me patches when you find a site with a cookie warning

mike-cardwell 14y ago
Nice! Up until now I've been writing small GreaseMonkey plugins to handle this. Added your list. Expect the occasional pull request. :) [edit] First pull request sent.
- r4vik 14y ago
  first pull request merged. look forward to many more :)
PJones 14y ago
I like the idea, but won't this prevent you from accepting cookies if the site has actually bothered to ask permission before adding them?
- r4vik 14y ago
  You're right to have that concern, I won't block a site if it's doing that but practically it's not an issue. I've yet to encounter one that requires opt-in before setting cookies.

5h 14y ago

Utter props to silktide to pushing this, I feel like half my posts on HN have been about this retarded legislation. Those who misuse cookies will soon use even more insidious means, those who don't are being forced into implementing stupid confusing boilerplate, utterly ridiculous!

oliveremberton 14y ago
Thanks! (I'm the founder of Silktide and author of that rant). We had some constructive suggestions on what could be done instead, although these are definitely up for debate. The gist would be using a rel element like so: <a href='privacy.html' rel='privacypolicy'>Privacy</a> and then using that as a means of consistently linking to a privacy policy. As a result, policies would have consistent language for users ('look for the "Privacy" link') but could also be detected automatically by browsers or testing tools. That way you could actually test your site is properly linking to a policy, and users could have browser preferences like "disable cookies until I've seen a policy" or whatever. It's just an idea but we've implemented it on our sites and will be interested to see what others think: http://blog.silktide.com/2012/09/fixing-a-broken-cookie-law/ http://blog.silktide.com/2012/09/fixing-a-broken-cookie-law/
- jamiecurle 14y ago
  That's a really nice solution that bridges responsibility between the user, browser and the website owners.
- loceng 14y ago
  Plus could then have a link to the privacy policy page added in the actual browser, rather than intruding on the user experience.
wtracz 14y ago
Until the ICO start taking people to court it will stay ridiculous, but I think the intent of it is important. Using etags to track individuals is really no different to a cookie with a unique ID... Having a 10 page complaint form is what is dumb. Why can't you just send a suspect URL, then have it scoured for dubious cookies?

asg 14y ago

Good to see them taking a stance. It is a great shame that this law does absolutely nothing to improve privacy. I typically do my casual browsing in incognito mode, which means that I'm constantly bombarded with these cookie warnings. So this law has significantly reduced the quality of my experience, for no benefit at all. The people who want to track me still continue to do so.

eckyptang 14y ago

I think the general attitude here is pretty bad and I'm disgusted with the replies. I hope the hell they do get sued. The reason that the law exists is that people have abused the cookie functionality terribly to track people all over the Internet using every possible loophole that they can. Now the price is being paid through not very good legislation. You wrote functionality that tracks people and now you're whinging when people are given their privacy back? Forget it - I have no sympathy. Regarding legitimate use, you click accept and the problem goes away. With respect to analytics, stop being cheap and lazy and do it from your logs.

ThomPete 14y ago
I think you are missing the bigger issue here. Many people will not click/not allow if they see a warning message. In fact many people will be either confused and scared and leave. I.e. its not theoretically a problem if you assume that most users are rational users who read what is in front of them and make reasonable choices. De facto though that is not the case and that means that a lot of business who put it up will see a drop in revenue even if they normally play by the books. Furtermore it really does not help anything since those with malicious intentions can just put it up and still do all sorts of shady business on the back.
- eckyptang 14y ago
  I think most people ignore the warning and click through based on the amount of toolbars I have to remove from PCs. The drop in revenue hasn't happened for us and we've been compliant for months now. I think, based on the quantity of sites this is occuring on, that it's a non issue. People are used to it now. The malicious people can be identified easily. Think of these changes as covering your arse rather than an inconvenience.
  - underdown 14y ago
    Different websites have different audiences and monetization schemes making your anecdotal observation uninteresting. It's also at odds with reams of conversion rate optimization data. What did Amazon report - something like a 500ms delay produces a 1% drop in conversion rate. I wonder how long it takes the average pensioner to click through?

MattBearman 14y ago

Can anyone who is more law savvy than I answer this question for me: Does a European company have to put the cookie message on their site if the site is hosted in the US?

MattBearman 14y ago
Found a (sort of) answer in their cookie_guidance_v3.pdf "An organisation based in the UK is likely to be subject to the requirements of the Regulations even if their website is technically hosted overseas. Organisations based outside of Europe with websites designed for the European market, or providing products or services to customers in Europe, should consider that their users in the UK and Europe will clearly expect information and choices about cookies to be provided." Of course, much like the rest of this legislation, the phrase "likely to be subject to" is vague and ill defined. Sometimes I hate being base in England.

Zirro 14y ago

In Sweden, just about every non-government site has ignored this law. I don't think we'll see anyone getting sued over it any time soon here.

jvvlimme 14y ago

If instead of using cookies we would swap to using the browsers storage, wouldn't we circumvent this entire rubbish law (+ the other advantages it already provides)? http://www.jstorage.info http://www.jstorage.info

rmc 14y ago
I don't know the exact law, but the law might not refer to cookies explicitly, but instead refer to tracking users. Switching from one tracking type to another will not avoid the law then.
prisonblues 14y ago
The law states: "a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met." Paragraph 2 then sets out how consent needs to be obtained, and the test that the subscriber needs to have given their consent before information is stored on their computer. Cookies, flash cookies, HTML5 databases, etc. are all covered under the general concept of storing on a subscriber's computer. The original law is here - http://www.legislation.gov.uk/uksi/2003/2426/regulation/6/made http://www.legislation.gov.uk/uksi/2003/2426/regulation/6/ma... - and here are the recent amendments - http://www.legislation.gov.uk/uksi/2011/1208/made http://www.legislation.gov.uk/uksi/2011/1208/made
- PJones 14y ago
  Isn't this vague enough that a site with an image is infringing? "Sure, they requested the web site, but they never explicitly said they wanted the image, and now you've gone and stored it in their cache."
  - alter8 14y ago
    How do you read back the tracking information from a cached object, page or image without replacing it with a fresh new one?
ProNihilist 14y ago

bbguitar 14y ago

Having spent a good chunk of time implementing cookie permission popups across our sites, Google Analytics showed a drop down to 10% of the normal traffic. (The traffic is a bit higher according to the logs, but not normal. Also as someone else pointed out the funnelling and reporting is harder to decipher) Putting in an implied statement and removing the pop-up and we're back to the regular levels. Sorry but this law is flawed and I'm glad its getting a bit of airing again. Come on ICO and the EU peeps who created this directive please rethink this with some expert advice.

grabeh 14y ago

I think the ICO has acknowledged the issues with the law and as a result is taking a gentle approach to enforcing the law (which the OP's crusade seems at odds with...). I think it's a good idea to attempt to increase user awareness of how information about a person's visit to a site will be used. As the guidance acknowledges, the type of most interest are third party advertising cookies and if the law helps to increase awareness of such usage, then it will have succeeded. In terms of geographical location, my understanding is that the location of the provider is irrelevant as if they are providing a service in the EU, they should be complying with the law.

gavinlynch 14y ago

Every time I hear this cookie debate, I feel I must be missing something. If you don't want to be tracked. TURN. COOKIES. OFF. There is a reason all web browsers come with per-domain cookies policies. We don't need a cookie law. We need some common sense. Everyone is looking to make this someone else's responsibility. Guess what: Your digital security and privacy is your responsibility. I hate this entire debate because: 1) Cookies serve a very, very valuable purpose in website development. Client-side storage is used in basically every major website on the internet. 2) This is hardly low-hanging fruit, and we have much, much bigger problems. 3) Who is the arbiter of what "allowed use" cookies are? We're going to have someone who actually decides, for individual websites, whether cookie use is proper or not? Is it going to work like a DMCA take-down request? An individual sends a request to review a website's cookie policies, and that IT department will have to submit a technical analysis and provide reasons for their cookie usage when a user feels their rights have been violated? 4) You know where this is going? Every single website that you register on is just going to give you a EULA-type agreement when you create an account. New to Facebook? Enter your username, click this checkbox that says "I accept your terms", and that's it. Normal users will just roll with basically any terms you present to them. Making this entirely ineffective except for the small minority of people, like many here, who are hyper vigilante about digital privacy. For the people this is meant to protect, they will likely never even think about it and opt-in anyway. 5) I completely reject the notion of getting politicians to dictate requirements to the tech industry in terms of how to handle the web stack. Let the politicians get back to blaming each other for X failures and make Y promises to the public, and get out of my internet.

chimeracoder 14y ago
> If you don't want to be tracked. TURN. COOKIES. OFF. ...except that's not going to be enough to make you untrackable[1]. As far as I know, short of some extreme Tor practices (new Tor connection for every session, no simultaneous sessions), there's no way to make yourself truly untrackable. [1] https://panopticlick.eff.org/index.php https://panopticlick.eff.org/index.php
- gavinlynch 14y ago

jpswade 14y ago

I remember Silktide from ~2004 when they used to have SiteScore. http://web.archive.org/web/20041010040340/http://sitescore.silktide.com/ http://web.archive.org/web/20041010040340/http://sitescore.s... Nice to see they're still around.