Hacker News Reader

Comment by mbetter | Hacker News Reader

Someone instructs their browser to not accept third party cookies, full stop. Google then does something, mumbles a bit, and then sets a third party cookie.

How isn't this nefarious?

View on HN

The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.

>The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.

No, if you select that option, it actually blocks all third party cookies.

No, it actually doesn't (or this discussion wouldn't be happening).

So do you work at Google or are you just a fanboy? IE is not being nefarious in this case. IE is following a standard that Google is actively abusing. Not sure why you have such an infatuation with Google, but I dare say: Everything in moderation.

Could you please avoid personal attacks? They add nothing to your argument while making the discussion less pleasant and civil.

I don't mean to single you out, but I've just been seeing too many of them lately.

It's not as if the users set IE to read P3P headers so technically they didn't override any user settings.

P3P is lacking: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou...

So P3P is flawed and IE implements a flawed standard. Granted.

Google is still using this flaw to override the user setting "Do not allow 3rd party cookies" to allow themselves to track users.

There is no "technically" about this, they've misused the standard to override user settings.

Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand."

Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt.

>Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand."

That's exactly what they do.

>Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt.

No, it doesn't.

You sound as if you have researched it, but you seem to be trying to mislead folks by spreading nonsense.

Hmm....you act as if you have looked at it, but you haven't. You simply lie.

Is that really so hard to understand?

Google is intentionally using the loophole. They are intentionally circumventing users’ wishes. That’s nefarious. It’s first and foremost a moral failing. That’s exactly the problem. Just because it’s possible doesn’t mean it’s right.

That the loophole exists is a separate issue that also has to be remedied – but it doesn’t make Google’s behavior any less evil.

If by "mumbles a bit" you mean not supporting an unsupported and defunct proposed "standard" that doesn't work in practice and is only implemented in IE, then yeah.

It's a W3C recommendation. Scare quotes around the word standard are unnecessary, since a vast number of current web standards came out of W3C processes.

Or is it not 'standards-compliant' when WebKit implements features that only WebKit has, even if they're from W3C standards?

It's not really much of a standard if no one references it in the real world.

And the W3C standards are most successful when they document how technology is already being used in the wild. Proscriptive web standards handed down from on high have historically not fared well. Plenty of W3C standards are duds.

Why does everyone always assume quotes are used as scare quotes? I quoted "standard" because it's not a standard. If the standards body no longer exists and no one follows the standard, it's not a standard.

That's the definition of scare quotes.

"Scare quotes are quotation marks placed around a word or phrase to indicate that it does not signify its literal or conventional meaning."

"If scare quotes are enclosing a word or phrase that does not represent a quotation from another source they may simply serve to alert the reader that the word or phrase is used in an unusual, special, or non-standard way or should be understood to include caveats to the conventional meaning."

http://en.wikipedia.org/wiki/Scare_quotes

I would have thought the "proposed" and "defunct" clauses would indicate that "standard" was in name only. The term "scare quotes" indicates to the reader that the writer is intending to mislead or persuade. I don't agree that my usage constitutes what is generally accepted as scare quotes, but even if you disagree, the point still stands. IE is stomping its feet complaining that Google isn't supporting a standard that only IE supports (when even the standards body doesn't support it anymore).

Come up with a better standard, then complain when Google breaks it. Otherwise it's just another example of Google being "evil" (that's scare quotes).

Scare quotes don't have anything to do with your opinion of the author. Scare quotes are quotes that are editorial rather than informational.

http://www.w3.org/P3P/

Particularly

After a successful Last Call, the P3P Working Group decided to publish the P3P 1.1 Specification as a Working Group Note to give P3P 1.1 a provisionally final state. The P3P Specification Working Group took this step as there was insufficient support from current Browser implementers for the implementation of P3P 1.1. The P3P 1.1 Working Group Note contains all changes from the P3P 1.1 Last Call. The Group thinks that P3P 1.1 is now ready for implementation. It is not excluded that W3C will push P3P 1.1 until Recommendation if there is sufficient support for implementation.

This is the last update from the group that was posted in 2006. It's never been pushed by the W3C, and the browser creators never implemented it.

I have absolutely no opinion on the standard, so I'm not sure why you keep telling me extraneous shit. Read what I typed; don't get upset when people accuse you of using scare quotes when you're using scare quotes.

edit: sorry, I was wrestling with a stubborn CPU fan, and you seemed like that CPU fan. Turns out the CPU fan was not stubborn, but well-designed, and I probably wasn't communicating well.

This reply was misposted, it was supposed to be in response to someone else. I've copied and pasted it to the correct person, but cannot delete this one.

I have no idea what your edit means, but I'm going to take is as a compliment and believe we were both mistaken on each others arguments. Because I like to keep things cool, like a CPU fan.

My edit meant that I was swearing at strangers on the internet about definitions. That's a bit overheated. Now we're both just passively cooling.

>when even the standards body doesn't support it anymore

Don't they? I am curious, do you have a reference for that?

http://www.w3.org/P3P/

Particularly

This is the last update from the group that was posted in 2006. It's never been pushed by the W3C, and the browser creators never implemented it.

Reply on news.ycombinator.com