Comment by 4cao | Hacker News Reader

Comment by 4cao | Hacker News Reader

> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers.

Would be great to have some more details about it: in particular, how do I turn it off if I prefer to add any exceptions manually.

Edit 1: Mozilla Hacks blog [1] has a bit more but still doesn't answer the question:

> In order to resolve these compatibility issues of State Partitioning, we allow the state to be unpartitioned in certain cases. When unpartitioning is taking effect, we will stop using double-keying and revert the ordinary (first-party) key.

What are these "certain cases?"

Edit 2: Reading on, there's this bit about storage access grants heuristics [2] linked from the blog. But is that really it, or is there a hardcoded whitelist as well? If so, it'd be great to see it.

This bit in particular is ambiguous in how it's supposed to work exactly (who's "we" here):

> If we discover that an origin is abusing this heuristic to gain tracking access, that origin will have the additional requirement that it must have received user interaction as a first party within the past 30 days.

1. https://hacks.mozilla.org/2021/02/introducing-state-partitio...

2. https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Pri...

(I’m one of the developers of this feature and co-author of the blog posts)

This is a great question and I’m glad you found the answer, you probably understand that for many blog posts we avoid going into too much technical detail.

To answer your final question, there is no hardcoded allow-list for State Partitioning. The heuristics as described on MDN are accurate.

Thank you for your clarification, and your work on Firefox.

I guess that clears it up.

Have you considered using something like Expounder (https://skorokithakis.github.io/expounder/) in your posts? (Disclosure, I made it but it's a small open source lib).

I don't see why we can have full-blown web apps but our text needs to be very specifically just text these days.

Cool! I've been thinking of a similar solution to add to my (planned ;) ) longer blog posts. I'm guilty of going into the details too much sometimes.

Same here, and I didn't like the tradeoff, so I figured I'd solve it with the power of T E C H N O L O G Y.

This looks amazing. Would you mind if I packaged this in a WordPress plugin?

Not at all, go for it!

Awesome. Just a heads up, I've already finished it and just submitted it. HOWEVER, the plugin has to be licensed as GPLv2, but it shouldn't affect your license (since it's just using your code as a library). I'd feel better about it (and it will probably be smoother sailing during the review process) if I could submit your names as authors on the plugin.

If you want to be listed as an author, just drop over to https://github.com/withinboredom/expounder-wordpress/tree/ma... and let me know your wordpress.org user names in an issue.

Thanks! I don't think either of us have a Wordpress username, but it'd be great if you could include a link to the repo in the description.

Thanks again for your help!

Will do!

I would like this as well, please share once you do.

I've submitted it to the WordPress.org plugins directory, but you can download it right now from the repo in the sibling comment.

Yes, this! Your lib looks awesome. Thanks for publishing it and sharing here!

Thank you!

I love this, but I'm a bit surprised that you do not include the ability to "unexpound" an "expounded" term. Is that intentional?

If I were reading a technical text, I would definitely end up reading most paragraphs at least twice. It would make no sense to keep the expounded terms in the second time; I'd be tempted to hide them back as soon as I was finished with them the first time.

Yes, it is intentional. The functionality actually exists, it's just not mentioned:

https://github.com/skorokithakis/expounder/blob/master/examp...

It's because, once clicked, the new text should become part of the old, and that's it. Presumably you've already read it, and I don't want to make the viewer have to re-collapse the links every time.

Your use case makes sense, though, which is why the feature was included. Maybe I should mention it in the README.

I think collapsing would also be useful when all you need is a quick reminder, not a full explanation. Like "What's that again? [click to expand] Oh that's right [click to collapse]". That's easier than finding the place to skip to.

Hmm, true, I've added it to the README!

Hasn't HTML the summary and details elements for this specifically, or am I overlooking something?

As far as I know, those work quite differently.

Not the author, but presumably you're overlooking the fact that the expounded term doesn't necessarily have to be "inside" or even "neighbouring" to the details element.

The author's intent here is to have terms explained in the text explicitly in such a way that it would 'augment' the text with an explanation somewhere further down the line, but not necessarily "in-place".

It is also intended for text specifically, rather than replacing one element with another.

I agree that display/summary are similar in spirit though, I had not come across those before.

<abbr>/<defn> are also quite relevant, and would fit a number of the example uses better (like the definition of 'atoms').

This is super cool!

I've only recently discovered that Markdown has footnotes, and I've gone to down adding footnotes everywhere.

I use Jekyll + markdown on my website, and I now have lots of fun adding footnotes to my writing.

I added a "footnote tutorial" for readers on https://josh.works/turing-backend-prep-01-intro#why-this-rub..., to help them learn how to navigate the footnotes.

I _love_ your library, and I love the problem that you're solving with it.

Along the way, I've looked at Gwern's sidenotes[0] and Nate Berkapec's "footnotes"/sidenotes [1].

I eventually want to do something more "in-line", like what you've down with Expounder, but I've been satiated with markdown footnotes for now.

[0]: https://www.gwern.net/Sidenotes# [1]: https://www.nateberkopec.com/blog/2017/03/10/how-i-made-self...

Thank you! I used to use footnotes too, but I didn't like how they took you out of the flow of the text. Expounder aims to specifically let users stay in the flow of reading, which is why one of the core instructions is that the text should work in context, as if it were never hidden.

I miss footnotes on the printed page because, in addition to references (where they're probably better as endnotes to be honest) I find they're great to use for parentheticals that bulletproof a point, add some background that's not essential to a point being made, etc. But these latter uses work significantly less well in a blog post or ebook.

It's good to see experiments along these lines. I really like Wikipedia's recent-ish rich tooltips on link mouseover, and the HTML <summary>/<details> elements deserve to be more widely known.

From the demo it look as if Expounder is one-way - once you've expanded something, you can't collapse it again. Is that correct?

Yes and no, see this comment:

https://news.ycombinator.com/item?id=26238717

Oh, wow. The Sidenotes discussion from Gwern that you linked is _phenomenal_. Thank you for sharing these.

What I dislike about footnotes like that is that they pollute the browser history. If you want to leave the page but clicked on a few footnotes and their backlinks, you have to go “back” through all of them.

Thank you so much for posting gwern’s sidenote article! I want to use sidenotes on my site and this was a very valuable resource!

Back button usually come with an unfoldable list of jump points.

I am more ennoyed by how the jump points are turned into a useless feature by so many javascript out there which load new content without impacting the browsing history.

I wonder what this does to SEO, does the hidden text get indexed, and is it not picked up as a dark pattern by crawlers?

Is there support for an expound-all button on a page? I definitely have days where I just want to also read the details and don’t want to click a dozen times while I’m reading.

Not currently, but it shouldn't be hard to add a button with one line of JS to add the required CSS class to all the elements. This might defeat the purpose, though, as it's kind of intended to save you from reading things you already know.

That is FN DOPE. Wikipedia should adopt it in full.

Hi, can you consider adding some accessibility to the library? Currently, I don't have a way to know that a term could be expanded, because the signal seems to be visual only and not detectable via a screen reader. Adding aria-pressed might be the solution, but I'm not an expert, just an user.

Oh, that's a good point! I didn't realize it wouldn't be discoverable, you're right.

Thanks!

I feel like the inserted text should be highlighted with a light yellow background or some indicator. Just appearing like that inline seems a bit funky or unexpected.

But I see there is a css class which is nice.

Just a simple rgba(x,x,x,0.5) where the x’s are the usual yellow height.

I prefer to leave the styling to the user, the library is intentionally minimally invasive there...

I agree with this. It would be helpful.

I know that you didn’t mean to completely throw the conversation from Firefox to Expounder, but you succeeded.

Mozilla who? That’s where we are now.

I like how it unfold the text, but it doesn't give visual hint on what was unfolded, and doesn't provide a way to fold it again, it seems.

Be it topographic emphasize or coloring, there should be an hint. And clicking the text thus emphasized should collapse it.

That's my opinion, otherwise, nice done.

It should animate the text while unfolding, but, other than that, there's no need to know what was unfolded. You just click what you don't know and eventually read the relevant info!

Why use this instead of footnotes? For example in these Feynman lectures below the footnotes and references to formulas and images activate then you hover over it. These footnote can even include graphics and formulas.

https://www.feynmanlectures.caltech.edu/III_21.html

To me, footnotes serve a different purpose, e.g. linking to papers, like the Feynman lectures site does. Expounder is more about indicating that you don't know something, so the text itself can change to accommodate you.

Have you considered that "Total Cookie Protection / Isolation Partition" would be a much better name? :D

> you probably understand that for many blog posts we avoid going into too much technical detail.

Not really... for a highly technical issue like this, at a minimum you should link to the technical details.

There really is no excuse for making every reader of your blog who wants to know the details dig for them independently.

imo, at least.

Both the more technical blog post as well as the MDN page are linked shortly after that paragraph.

This should have always been the only way it worked. Plus it should be easier to create white lists of allowed websites and all other cookies delete with every broswer restart. I know it is possible with Firefox but you need to add websites to whitelist manually in deep settings. At least there are some extensions that make it easier, like CookieAutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

What I wonder/concern is how can one decide for legit use. This also sounds like a possibility for discriminating small players with legit use. (similar to Microsoft's SmartScreen)

Would be great to know how are those concerns handled?

I would like something like, each site by default gets a bucket by name.

If cookies from another bucket should be shared with other sites, or might be seen when requested by a cross-site load from another site, ask the user a four choice question.

"Allow (site) to see cookies from (site)?"

Always Allow, Just this time, Ask later, Always Deny

I agree I wish they had more detail about the exceptions.

I've been a FPI user for years as a best-effort to reign in tracking but there are a common few sites that just break with FPI (50% of the time PayPal checkout doesn't work). Even if "Total Cookie Protection" is only 98% as effective as FPI, I'm making the switch.

EDIT: FPI = first-party isolation

Yes, it’s essentially that, FPI with workarounds for common breakage. You should switch from FPI, this is essentially another take on FPI by some of its original developers, so it should have fewer issues overall, not just site breakage.

FPI?

First-Party Isolation

https://www.ctrl.blog/entry/firefox-fpi.html

It will be interesting to see how many sites break with “Total Cookie Protection”. Currently I use what I consider are bare minimum of anti-tracking, that is what I can make Firefox provide on its own, plus the DuckDuckGo browser extention. Those two things alone break an alarming number of sites. The DDG extention is pretty regularly mistaken for an ad-blocker.

Given Firefoxs low adoption, I fear that website owner will just ignore that their excessive tracking breaks their site in Firefox... “Works in Chrome... good enough”

I have strict tracking enabled in Firefox as well as uBlock Origin and I've yet to see a site broken. The only "broken" ones I've seen are badly coded ones that also fail to work in Chrome. Reputable sites tend to be just fine. YMMV.

FF blocked fingerprinting by visa during a transaction. To my surprise, even that did not break.

So if I happen to run a less popular third-party login provider, my fate is sealed?

No, there’s no allow-list, you get the same heuristics as described on that MDN page.

> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers.

Facebook and Google will be excepted? This makes it a joke, sadly.

This is basically Google (Chrome) paying Mozilla (Firefox) to kill 3rd party cookies because Google has a better way to fingerprint users without 3rd party cookies, because they have SO MUCH data about us.

This move is aimed at killing other AdTech companies which rely on 3rd party cookies to track users.

They painting this as a 'PRIVACY' move, after they have already found other ways of tracking users across websites and devices.

It's still a good thing though. Better to be tracked by one company than a whole industry.

One company is the whole industry, Google

No. There's no whitelist. RTFM.

I did not say whitelisted, I said popular.

I wish there was something better than cookies for these use cases. But then, designing something that can't be abused for tracking, that empowers all the legitimate use cases is also really hard, maybe even impossible.

> Would be great to have some more details about it: in particular, how do I turn it off if I prefer to add any exceptions manually.

(on mac) Firefox > Preferences > Privacy & Security > Custom

The question is how to use "Total Cookie Protection" without any hardcoded or heuristics-based exceptions.

Your answer seems to be about how to turn off "Enhanced Tracking Protection"/"Total Cookie Protection" or parts of it (resulting in weaker protection). I want to keep it enabled and disable the exceptions (for stronger protection), i.e. the opposite.

I haven't installed the new version yet, so can't say for sure, but as far as I know there is no setting for this in that menu. [1]

If I misunderstood what you meant, please elaborate.

1. https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...

Reply on news.ycombinator.com