4 ms·

Good cookie (Memcache version)

21 points by gabriel_b 14y ago

gnosis 14y ago
This is exactly the sort of thing developers who care about privacy can avoid doing, and oppose when someone else does it. See the following[1] article and thread for a discussion of why such opposition is necessary (if it isn't obvious to you already). [1] - https://news.ycombinator.com/item?id=5386249 https://news.ycombinator.com/item?id=5386249
- jdangu 14y ago
  Your comment is not very constructive... Of course, there is a strong divide between the internet industry (driven for a large part by advertising) and the proponents of an ideal Internet that respects people's privacy. It seems to me that web publishers should be allowed to decide what ad tracking they want to set up to monetize their website, as long as it's disclosed and you can opt out. You're also free to take any action that you deem to protect yourself against such tracking.
  - gnosis 14y ago
    Opting out and taking counter-surveillance measures have always been options. But look at the world we're in now. Those options have not been very effective for the overwhelming majority of internet users, who often don't even realize they have a choice, much less know how to take effective counter-surveillance measures. We can't just continue the status quo, because it's obvious that it will lead to ever greater surveillance and loss of power and control for the average user. Only the wealthy and technologically savvy will stand much of a chance of retaining their privacy. The rest will be thoroughly screwed. This is why it's important for developers and founders to opt out of creating such surveillance technology in the first place, and taking a public stand against it. It's up to those who know and make technology to turn the tide.
  - ratherbefuddled 14y ago
    You should probably disclose that you're a former colleague and a friend of the guy behind this poor attempt at privacy invasion.
  - PavlovsCat 14y ago
    as long as it's disclosed On the site for this thing it says it's "100% transparent for the users", which is the exact opposite.
    - gabriel_b 14y ago
      As much as you guys are right in term of user's privacy, there are a few points to remember : - data is anonymous. There is no easy way to retrieve all keys from Memcache anyway. Its only purpose is to imitate the cookie's behavior. It won't store more, it won't store less. - I strongly agree that users should be able to deny third party cookies or cookies in general if they want. That is their right to privacy. However, Firefox's move is going to kill the business of thousand of companies all around the world (ad networks and traffic analysis companies) and I believe that is an selfish move on their part. You should think about other people when you develop these types of tools and activate them by default. I think it's normal for us to defend our jobs.
      - PavlovsCat 14y ago
        I think it's normal for us to defend our jobs. It's not normal to stumble blindly into them. It's not like people wake up one morning with randomly assigned jobs. Depending on the kind of job, it's also normal for everyone else to defend themselves against that job. Avoid such jobs.
seppo0010 14y ago
That code implies that two computers using the same browser from the same IP will share sessions, or I'm reading it wrong?
- byroot 14y ago
  Yes, they will share their cookies. So if you use these "Good Cookies" (sic) to store your session key you will have some huge troubles with corporate proxies and also 3G connections since a lot of mobile ISP transparently proxy HTTP and that a lot of people use the same mobile browsers.
  - jdangu 14y ago
    Why would you store your session key with this? It's not meant for first-party domains.
    - drivebyacct2 14y ago
      Ironically, it's probably at least as useless for third-party trackers. Here [advertiser], here's statistics that could correlate to a user, or to a group of users at a conference, or to a group of random people at a coffee shop or some disjoint group of people sharing wifi at an apartment complex. Sorta defeats the point of tracking.
drivebyacct2 14y ago
And the rest of us will start setting up to sue the first person to use this and simply hand off my cookie to the other person sitting at the same coffee shop as me.
pasbesoin 14y ago
I've been watching this whole "tracking" thing, along with now this latest twist. I avoided writing this reaction the other day, but now: If you have to hound me to sell me your product, you've already failed. I realize this doesn't reflect the reality of the world, and perhaps myself -- were I to reflect in a fully informed fashion upon myself. But it is my considered, "rational" reaction and approach to the situation. Make a quality product that is useful to me, and I'll seek you out. Otherwise, fuck off. You and your business model can crawl off into a dark corner and die, please. Oh, is that a bit harsh? You deserve no better, you "business" (ueber alles) absolutists.
- spullara 14y ago
  This really makes no sense. How will you seek out a product or solution that you don't know exists?
  - pasbesoin 14y ago
    Some degree of analytics to determine how users are interacting with your online property, I understand. And, I understand that many want to source those analytics to a third party (e.g. Google Analytics). However, the third party tracking that enables advertisers to notice a view or interest and then "haunt" users across multiple sites for days with ads related to that view? That aggregate and warehouse such knowledge, building up extensive profiles that become their own form of property and that may be used and sold against the target user's own best interest? (So, you're looking at information related to diabetes? I bet health insurers would be interested in that...) I have very little sympathy for those use cases.
cbsmith 14y ago
Welcome to ad serving 101.
snaky 14y ago
But there is cookie handover technique that uses 1st party cookie http://www.liesdamnedlies.com/2006/11/the_joys_of_cro.html http://www.liesdamnedlies.com/2006/11/the_joys_of_cro.html
ratherbefuddled 14y ago
An extremely naive implementation of a morally dubious idea. Not a good advert for the company behind it. Would a good solution be to have your browser spoof the user agent to FF21?
yahelc 14y ago
Google Analytics uses first party cookies, not third-party cookies, so it is unaffected by Firefox's changes.

21 points by gabriel_b 14y ago

This is exactly the sort of thing developers who care about privacy can avoid doing, and oppose when someone else does it. See the following[1] article and thread for a discussion of why such opposition is necessary (if it isn't obvious to you already). [1] - https://news.ycombinator.com/item?id=5386249 https://news.ycombinator.com/item?id=5386249

jdangu 14y ago
Your comment is not very constructive... Of course, there is a strong divide between the internet industry (driven for a large part by advertising) and the proponents of an ideal Internet that respects people's privacy. It seems to me that web publishers should be allowed to decide what ad tracking they want to set up to monetize their website, as long as it's disclosed and you can opt out. You're also free to take any action that you deem to protect yourself against such tracking.
- gnosis 14y ago
  Opting out and taking counter-surveillance measures have always been options. But look at the world we're in now. Those options have not been very effective for the overwhelming majority of internet users, who often don't even realize they have a choice, much less know how to take effective counter-surveillance measures. We can't just continue the status quo, because it's obvious that it will lead to ever greater surveillance and loss of power and control for the average user. Only the wealthy and technologically savvy will stand much of a chance of retaining their privacy. The rest will be thoroughly screwed. This is why it's important for developers and founders to opt out of creating such surveillance technology in the first place, and taking a public stand against it. It's up to those who know and make technology to turn the tide.
- ratherbefuddled 14y ago
  You should probably disclose that you're a former colleague and a friend of the guy behind this poor attempt at privacy invasion.
- PavlovsCat 14y ago
  as long as it's disclosed On the site for this thing it says it's "100% transparent for the users", which is the exact opposite.
  - gabriel_b 14y ago
    As much as you guys are right in term of user's privacy, there are a few points to remember : - data is anonymous. There is no easy way to retrieve all keys from Memcache anyway. Its only purpose is to imitate the cookie's behavior. It won't store more, it won't store less. - I strongly agree that users should be able to deny third party cookies or cookies in general if they want. That is their right to privacy. However, Firefox's move is going to kill the business of thousand of companies all around the world (ad networks and traffic analysis companies) and I believe that is an selfish move on their part. You should think about other people when you develop these types of tools and activate them by default. I think it's normal for us to defend our jobs.
    - PavlovsCat 14y ago
      I think it's normal for us to defend our jobs. It's not normal to stumble blindly into them. It's not like people wake up one morning with randomly assigned jobs. Depending on the kind of job, it's also normal for everyone else to defend themselves against that job. Avoid such jobs.

seppo0010 14y ago

That code implies that two computers using the same browser from the same IP will share sessions, or I'm reading it wrong?

byroot 14y ago
Yes, they will share their cookies. So if you use these "Good Cookies" (sic) to store your session key you will have some huge troubles with corporate proxies and also 3G connections since a lot of mobile ISP transparently proxy HTTP and that a lot of people use the same mobile browsers.
- jdangu 14y ago
  Why would you store your session key with this? It's not meant for first-party domains.
  - drivebyacct2 14y ago
    Ironically, it's probably at least as useless for third-party trackers. Here [advertiser], here's statistics that could correlate to a user, or to a group of users at a conference, or to a group of random people at a coffee shop or some disjoint group of people sharing wifi at an apartment complex. Sorta defeats the point of tracking.

drivebyacct2 14y ago

And the rest of us will start setting up to sue the first person to use this and simply hand off my cookie to the other person sitting at the same coffee shop as me.

pasbesoin 14y ago

I've been watching this whole "tracking" thing, along with now this latest twist. I avoided writing this reaction the other day, but now: If you have to hound me to sell me your product, you've already failed. I realize this doesn't reflect the reality of the world, and perhaps myself -- were I to reflect in a fully informed fashion upon myself. But it is my considered, "rational" reaction and approach to the situation. Make a quality product that is useful to me, and I'll seek you out. Otherwise, fuck off. You and your business model can crawl off into a dark corner and die, please. Oh, is that a bit harsh? You deserve no better, you "business" (ueber alles) absolutists.

spullara 14y ago
This really makes no sense. How will you seek out a product or solution that you don't know exists?
- pasbesoin 14y ago
  Some degree of analytics to determine how users are interacting with your online property, I understand. And, I understand that many want to source those analytics to a third party (e.g. Google Analytics). However, the third party tracking that enables advertisers to notice a view or interest and then "haunt" users across multiple sites for days with ads related to that view? That aggregate and warehouse such knowledge, building up extensive profiles that become their own form of property and that may be used and sold against the target user's own best interest? (So, you're looking at information related to diabetes? I bet health insurers would be interested in that...) I have very little sympathy for those use cases.

cbsmith 14y ago

Welcome to ad serving 101.

snaky 14y ago

But there is cookie handover technique that uses 1st party cookie http://www.liesdamnedlies.com/2006/11/the_joys_of_cro.html http://www.liesdamnedlies.com/2006/11/the_joys_of_cro.html

ratherbefuddled 14y ago

An extremely naive implementation of a morally dubious idea. Not a good advert for the company behind it. Would a good solution be to have your browser spoof the user agent to FF21?

yahelc 14y ago

Google Analytics uses first party cookies, not third-party cookies, so it is unaffected by Firefox's changes.