Hacker News Reader

Comment by todd8 | Hacker News Reader

My spouse will sometimes mention in conversation with others that I invented the cookie. This always puts me on the spot, and I have to enter into a long explanation of the what and the why of cookies least they believe that I some sort of evil software hacker. (Now for a short explanation so that HN readers don’t think that I’m an evil hacker: I invented them, with the help of a colleague, while at IBM where we were designing a distributed file system. This was before the advent of the World Wide Web.)

View on HN

Many of us remember when cookies were purely a utility-add for end users and were restricted only to the domain which set them. Thanks for inventing that.

Who can take credit for lifting that restriction.

Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default.

The most fascinating thing IMO about so-called "modern" browsers is that even when their vendors publish source code, "99.9%" of people will not even attempt to make changes, even something as simple as changing a default from "on" to "off". It's like the software is stamped with "Read Only" or "Do Not Touch" and "99.9%" of people dutifully obey. The "0.1%" appear to be very conservative with the changes they make.

For example, if it was possible to disable auto-loading of resources, I might actually use these "modern" graphical browsers for tasks other than commercially-oriented transactions. Cookies are only one problem with these browsers.

Seems a bit overkill to recompile to get "no third party cookies by default" when you can just open the settings and disable it when you first install the browser. The setting is kept between updates (in Firefox at least) and if you are paranoid you can always check with Dev tools or a dumping proxy that 3rd party cookies are still disabled after an update

This undervalues convenience. The convenience of not having to worry about privacy-hostile default settings. Also, this will not work where the user is running applications from read-only media, or using something like "Guest mode" on a Chromebook where changes to settings are either not possible or ephemeral.

This sort of argument in defense of so-called "tech" company "default settings" shenanigans has been called out in recent litigation. Courts are becoming aware of the power and significance of "default settings".

It's this idea of "overkill", or other simialr rationales, that I am referring to in the original comment. Just enough "friction" to stop people from changing things. Not worth the trouble, people may think. And this works year after year. Amazing. Browser vendors were not the first in the computer industry to utilise this type of tactic, but it's a fine example.

Not sure who "you" refers to in the parent comment: me or a hypothetical person. If it's the former, I use a text-only browser that neither auto-load resources nor runs Javascript, along a localhost-bound proxy that strips or adds cookies. This is perfect for me. Both software I can change and quickly re-compile at any time. If it's the later, and "you" refers to a hypothetical person, then I cannot comment on behalf of such persons.

What I do know is that most users do not change default settings.

I think most will agree that we should focus on making browsers by default limit the amount of private and identifying information sent to anywhere that didn't explicitly get authorized for it.

TBH, with today's web the only way I have found to limit the information sent is to either not use a browser to make HTTP requests (e.g., use TCP client instead) or use a browser that (a) does not auto-load resources, e.g., images, Javascript files, etc, and (b) does not run Javascript inside <script> tags. Of course no other silly stuff like automatic "DNS prefetch" either. This way I know that the only information I am sending is the information I the web user actually sent, i.e., the HTTP request. Otherwise, there is no way to know what other HTTP requests will be made to accomplish auto-loading images, fonts, etc. or what other HTTP requests will be made by auto-loaded or inlined JS when the browser automatically runs it.

When the user types or clicks on https://hostx.com/1.htm, the user knows she has sent a request for filepath "/1.htm" at hostx.com. That's straightforward and easy to understand. Her intent is clear. She wants the file named "1.htm" from hostx.com.

However, what if she uses a browser that auto-loads remote files and auto-runs JS, and, e.g., the file 1.htm instricts the browser to auto-load the file "1.js", the browser automatically runs 1.js without any input from the user, and then 1.js makes more HTTP requests. Has the user "authorised" that information to be sent. Imagine she does not know the contents of file 1.js. How can she authorise sending information, i.e., an HTTP request, if she does not know what is the information, i.e., the request, and where it is being sent.

You originally wrote:

> Some popular browsers are supposedly "open source" yet it appears no browser user longing for saner times has ever tried reversed this change and recompiling the browser for their own use. No third party cookies by default.

And my response was simply it's way easier for the vast majority of people to change a setting once, than compiling the source (and remember to stay up to date with new releases)

> What I do know is that most users do not change default settings.

And they don't install alternative privacy respecting browsers either.

(edit for layout)

The "vast majority of people" will neither find nor change settings. Ever.

They are not interested in computers and they certainly do not read and comment on HN.

When I use the term "browser user" in the quoted comment it can be assumed I am referring to browser users who can write/edit and compile source code. If I wanted to address or comment about a larger audience, including people who are not interested in computers, who do not read HN, i.e., "the vast majority of people", then I would not be commenting here.

Firefox rolls out Total Cookie Protection by default to more users worldwide

https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-...

Finally, just last month.

Browsers need a lot of updates. No way I'd want to touch a single line of code in a browser. Somehow, something is going to break and I'll have to screw with it at an inconvenient time no matter how clever my auto update script is.

There's lots of stuff I'd like to change, but I am not wading through the nightmare pile of code to add mdns browsing and SyncThing bookmark sync.

It's too bad most apps are getting rid of true scriptability. Browsers would be way better if you could just drop a python file in a folder and change stuff.

The text-only browser I use does not need updates. I am able to script it via tmux.

Overall I think "browsers" are overextended and overrated. I use them as HTML readers. I prefer separate programs for different tasks instead of one program for every task.

The so-called "modern" web browser, a "nightmare pile of code" indeed.

There are likely dozens of others out there that can lay claim to the same. What specifically do you define as the innovation behind this “invention”?

I'm sure that many can make the same claim. In the 1980's, I was an operating systems architect working at IBM. I thought up many interesting (to me) innovations while working on the first couple of releases of the AIX on the IBM POWER hardware. It was a great job and I learned a lot doing it. I got to work with some really brilliant developers and computer scientists (a number from IBM Research).

One project I was responsible for was the development of a distributed file system for AIX. The goal was a distributed file system that addressed some of the weaknesses found in other distributed file systems at the time. Our chief competitor was Sun's NFS distributed file system. NFS was a really nice design. It was well integrated into the operating system and quite reliable because it utilized a (mostly) stateless server. This had a number of performance and security implications along with some file system semantics over NFS that didn't match local file system semantics. We wanted to introduce state for the server to address these issues and thought of a number of complex protocols to manage it in the presence of unreliable clients. That's when I thought up the idea of making the clients keep their own state to be restored when they reconnected to the server. I protected this state from manipulation by the client by encrypting it. I didn't call them cookies, I called them tokens.

This design was patented by IBM and I was one of the two inventors on the patent. This patent was owned by IBM and years later they gave a special award for this patent because it decided that it was one of IBM's most important patents. (They wouldn't have done this unless the patent had held up to scrutiny or legal challenges). Unfortunately, by that time I had already left IBM to start my own company--I was at the top of my game and had confidence that I could create a software product of some kind that would be successful--so I missed out on the financial award for the patent. By then, I was at my new company and already in competition with IBM.

By now, the patent should be long expired. Interestingly, IBM ended up buying my company around seven years after I and a partner started it.

I was very aware of the academic literature and industrial practice during this time so I do believe that my invention does reflect original work that ended up with a very significant impact.

From a more personal perspective, the invention didn't financially benefit me. The work that I did at my company own was more creative, inventive, technically impactful, and financially important to me. For example, Austin Ventures has indicated that my company was the start of Austin becoming an important high-tech location, but none of that was related to the cookie.

What was your company?

I'm going to put my guess in as Tivoli.

Yes

i did a consulting gig rolling out Tivoli at Dell in the mid-90s, i think pre-IBM merger! loved the software, hated the [flat] network Dell had in Round Rock at the time! thanks for your detailed comment. love reading tech history stories.

Interesting, what kind of cookies? Like I say in the article Lou Montulli from Netscape is generally credited with creating the HTTP cookie, which they named cookie based upon magic cookies in unix, though its obviously quite a bit different.

Yeah, I remember in the mid-late 90's when companies would actually disable cookies altogether. Most non-technical people just don't understand the what/how/why cookies work, or were really needed in the browsers.

In the end, it's definitely been used in excessive and somewhat intrusive ways. I also wish that browsers had better controls over second and third party cookies and tracking (similar for nested iframe) in order to bubble some of it closer to the surface. In the end, pihole, ublock origin and privacy badger goes a long way to limiting this.

That's such a cool story! I'm very glad cookies are a thing that exists, regardless of any bad uses they might have.

You're a master baker

Great, so when time travel becomes a thing, I'll add you to the list of people to have a chat with about needing to envision longer term visions for how nefarious people can be. I love that at one point in a not so distant galaxy, er time, that there was a thing of innocence. Now, that innocence can no longer be tolerated and every new thing must have more time invested on how the new thing can be abused rather than just used as intended.

Really? I didn't invent it for browsers, I invented it for distributed file systems before the "World Wide Web" had even been invented. You might as well have a talk with William Shockley or Vint Cerf.

Somewhat probably, don't take it serious. You did good.

Thanks...I'm think I'm too sensitive about it since this comes up every f'ing time.

Not too sensitive. All of us get annoyed at things we have to constantly reiterate. At least that other user revealed their insanity after they kept talking. Literally explaining why you could never have known, despite claiming you should have "thought harder." Don't feel guilty, you're not the one with the evil idea. We should, of course think long (and sometimes evil), but it's impossible to predict what others will use your tech for.

You did good and there's no problems with what you did.

>Literally explaining why you could never have known,

That's the entire point of coming from the future to the past with information unavailable. It's pretty much Time Travel 101 sci-fi trope. Rather than going back in time with sports scores and stock picks, I was putting it towards nerdy tech dev. Sheesh

"but it's impossible to predict what others will use your tech for."

I mean, it depends. If you build a atomic bomb during a war (with unrestrained city bombing from all sides going on), don't act surprised if cities indeed will be nuked with it and people point the finger also towards you.

But a general purpose lightweight distributed storage technology? Seriously no, then you can also blame hard drive producers for enabling tracking.

We all want some websites to store temporary information on out computers. Otherwise we could not log in to anything for example. And that the default of the browsers is to allow any random website to store literally GBs of data on your computer without asking (https://developer.mozilla.org/en-US/docs/Web/API/Storage_API...) - then this is really the choice of ad financed browser developers - and the choice of the users to just accept that behavior (ignorance can also be a choice).

>> but it's impossible to predict what others will use your tech for.

> I mean, it depends. If you build a atomic bomb during a war , don't act surprised if cities indeed will be nuked with it and people point the finger also towards you.

You forgot the first part of the sentence you quoted.

>> We should, of course, think long (and sometimes evil)

My intention is to say that you can't do an exhaustive search and it shouldn't be expected. What's obvious to some isn't to others. This doesn't mean we can just go along without concern for morals. As scientists/researchers/inventors/developers we must think ahead (and evil). But it is like viewing history from a modern lens. We have knowledge we didn't back then and judgement about intent should come from the view of the time. (This also doesn't mean we can't look back at history and see "normal" things that people did as horrific. These are different things)

Exactly. How could you have known it would be used for what's it's used for now. That's the entire point of the conversation someone from the future could tell you. Why is that unclear? Maybe you're assuming a negative conversation? There are many decisions in my life that if a future me or someone else could show me exactly how things will play out in ways not foreseen by me at the time, I'd be less hostile than you apparently are at the idea.

What? His reply is just a natural reaction to the hostile and reproachful tone of your comment.

This is such a ludicrous comment chain. The tone was clearly negative. You said you said you wanted to have a chat "about needing to envision longer term visions for how nefarious people can be".

right, but it sounds to me as you are reading it as i'm calling the inventor of the cookie as nefarious. i'm suggesting having a conversation with the inventor about how nefarious people will use his invention.

No, I'm not reading it like that. You clearly say that the inventor didn't think of nefarious people, not that he was one.

- I invented cookies. They’re my baby.

- Why didn’t you have the foresight to predict that it could be used for what it is used for now?

- Whoah there. Kind of out of left field. I had nothing to do with WWW cookies.

Seems like you can just tell those friends that you invented the great-grandfather or the fifth cousin once removed on the uncle’s side to the modern cookie and be done with the conversation a lot quicker.

You may as well start by having that conversation with the inventor of the time travel device you're using, because - whew boy the nefarious things people are going to do with it!

Just as amazing are people who are not travelling through time.

The only way to never make things that could be misused by nefarious people is never to make things.

Reply on news.ycombinator.com