4 ms·

And browsers have had such options (block all cookies, prompt to accept, etc.) built in to them since the very beginning of cookies, except everyone turned them

by tfgg 11y ago

And browsers have had such options (block all cookies, prompt to accept, etc.) built in to them since the very beginning of cookies, except everyone turned them off because they were annoying! So now websites had to add them! And they are just as annoying! ARGH! A more useful directive would have been some sort of legally-backed "coloured cookie" type system, where a cookie has to declare for what purpose (session, internal analytics, adverts, site-to-site tracking, etc.) it's for, so browsers can then selectively block those categories. That would be useful, because then you could punish people who lie about the purpose of their cookie.

0x0 11y ago
Sounds like the misguided P3P "standard" that IE implemented which AFAIK only resulted in web developers copypasting a HTTP header they don't understand just to get facebook widgets working.
72deluxe 11y ago
I couldn't work out why people didn't just use the browser cookie controls. It seems shortsighted to force the server to bundle a message down the wire to me - the browser should tell me that. What if I am a dumb client like telnet that's just done a GET? Do we also need servers to inform us in large letters that they're making a note of our IP address and adding it to their logs? That they're using our referral info and browser details (I'm using Chromium on a Mac!)? That they'll use those details for analysis? Weirdly people have switched to Google analytics instead of just looking at the server logs (like awstats from yesteryear). Do we need messages telling us that the ISP is throttling us or logging too? That I'm using PPP or something? It's all daft. Hopefully this madness doesn't make it into mobile telephone calls - "your location can be triangulated from our phone towers"; "you're using GSM which has weak encryption and can be eavesdropped" etc. etc. We should have the option of authorising all the GET requests it makes too I feel! That'd keep websites from loading too much (and suffering website bloat, as the average website data size has been climbing massively due to all that JavaScript)

by tfgg 11y ago

0x0 11y ago

Sounds like the misguided P3P "standard" that IE implemented which AFAIK only resulted in web developers copypasting a HTTP header they don't understand just to get facebook widgets working.

72deluxe 11y ago

I couldn't work out why people didn't just use the browser cookie controls. It seems shortsighted to force the server to bundle a message down the wire to me - the browser should tell me that. What if I am a dumb client like telnet that's just done a GET? Do we also need servers to inform us in large letters that they're making a note of our IP address and adding it to their logs? That they're using our referral info and browser details (I'm using Chromium on a Mac!)? That they'll use those details for analysis? Weirdly people have switched to Google analytics instead of just looking at the server logs (like awstats from yesteryear). Do we need messages telling us that the ISP is throttling us or logging too? That I'm using PPP or something? It's all daft. Hopefully this madness doesn't make it into mobile telephone calls - "your location can be triangulated from our phone towers"; "you're using GSM which has weak encryption and can be eavesdropped" etc. etc. We should have the option of authorising all the GET requests it makes too I feel! That'd keep websites from loading too much (and suffering website bloat, as the average website data size has been climbing massively due to all that JavaScript)