Hacker News Reader

Comment by patio11 | Hacker News Reader

Given that the Geek2English translation obscured useful detail: Safari blocks third party cookies by default. You can work around this default setting by using an iframe to submit a vestigial form, which will convince Safari that the domain doing the submitting is a first party, not a third party. After you have any cookie on the machine, broadening the scope to include e.g. cookies from your house advertising network is easy. Google says "Whoopsie, we didn't plan on that happening." Cookies are still just cookies and their newfound relevance to the WSJ is still refighting something the Internet largely settled back in 1996.

View on HN

I think there are two different issues here which you eliding by labeling this as "settled back in 1996." What I would say was "settled in 1996" was the fact that cookies are a useful technical measure to enable websites to save state, and users wanted features like login persistence across browser sessions, etc.

I don't think that "unlimited user tracking by advertising networks, regardless of good-faith user efforts to limit data tracking" was at all part of any tacit agreements reached by the internet community. The principle that communication networks should be transparent in how they operate, and allow users of the network to meaningfully control their interactions with them is a meta-principle that is pretty clearly implicit in the design of the internet, and I don't think the current widespread use of tracking technologies and data analysis without informed user consent is consistent with those principles.

Fighting against user tracking strikes me as about as futile as fighting against piracy. Computers are intrinsically designed to store, aggregate, analyze and share vast quantities of information in the hopes of deriving meaning from them. Trying to derive a legislative solution to a technological force of nature works as well as you would expect in both of these circumstances.

You have to pick your battles.

"It's a force of nature" is only a good argument against a policy when it is accompanied by other valid arguments. There are many things which are "only human nature" or "a force of nature" which for the sake of society and/or personal liberty we restrict.

Saying "it's only a force of nature" won't get you far with a judge. And telling people that they can't use the internet if they value their privacy is an unreasonable restriction on personal liberty. Period.

I agree that Google can user track, but only so far, and if they need to go to such extremes, we need rules, guidelines or even laws to draw the line very starkly.

I'm not saying it's good or acceptable, just that I view the war on user tracking to go about as well as the current war on piracy has.

Thanks for the explanation, but it's hardly "settled".

I don't use an iPhone, but I imagine if it's like other browsers, there's some setting that says:

[x] Accept cookies from sites [ ] Accept third party cookies

When I don't check the second box, it doesn't mean "Don't accept cookies, unless condition X is true", e.g. the web site implemented a popular hack. It means really don't accept third party cookies, and I don't give a shit if the +1 button breaks.

It doesn't sound like Safari's behavior on the hidden forms is intentional. It sounds like a bug, but it's irrelevant either way. I hope Apple patches this soon and forces people to opt in to third party cookies.

I'm glad that they actually set the default to reject them (a funny contrast to the address book policy). Firefox allows third party cookies by default because I always have to turn it off when setting up the browser on a new PC.

Google disabled its code after being contacted by The Wall Street Journal.

Not even the most rabid Google apologists can spin this one.

> I hope Apple patches this soon and forces people to opt in to third party cookies.

The WSJ also ran a blog post about this which says (at the very end):

"An update to the software that underlies Safari has closed the loophole that allows cookies to be set after the automatic submission of invisible forms. Future public versions of Safari could incorporate that update. The people who handled the proposed change, according to software documents: two engineers at Google."

"software documents" is linked to http://trac.webkit.org/changeset/92142

So it appears that Google engineers have already closed this loophole.

Wow, that's amazing.

This somehow reminds me of the time when Chrome marketing ended up paying for links to their site, and then the Web search group had to punish them with a demotion.

Well, except that this change was made by Google engineers in August (well before the big deal this has become today).

> Given that the Geek2English translation obscured

special computer code is my favorite

Reply on news.ycombinator.com