Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

It is an interesting rant about a real problem. Cookies provide a function for their origin web site, every other use is generally not good for the consumer. The challenge implementing something like cookies that can only be consumed by the web server that baked them. Not an easy problem to solve while still supporting proxies and firewalls and things between client and the web server.

That said, would love to hear some ideas.

View on HN

I don't really see the problem with cookies. They make things easier to implement, they enable a ton of new businesses and they make things easier for the consumers.

Sorry to be pedantic, but the problems were enumerated in the article. There are multiple major security problems with cookies, and their costs are in the billions of dollars per year.

Instead of "I don't really see the problem with X" I think you really meant "I think on the whole the benefits of X outweigh its downsides". Neither the article nor the OP has suggested getting rid of cookies. They're merely trying to broach the subject of re-examining the HTTP state mechanism to see if there are better ways to solve the problem.

To suggest that something is sub-optimal is not to necessarily suggest that its net effect is negative.

Ok i wasn't talking about security problems. Just the problem in general of cookies. And so I don't think it is true that "Cookies provide a function for their origin web site, every other use is generally not good for the consumer."

Besides, some people have the illusion that changing the cookies will give them privacy. Well, there are many other ways of following them around although a little less accurate.

That "every other use is generally not good for the consumer" is a broad generalization, I think.

I don't disagree. One way to look at the question is "if we ban all other uses we cripple case X, Y, and Z" vs "if we allow other uses we allow X, Y, and Z but enable P, Q, and R type problems."

Lots of things in the world have similar tradeoffs, to use a silly example "Leave your front door unlocked" makes it easy for anyone to come in, but also makes it easy for crooks to come in, so a common solution is to lock it and give certain folks the key.

Cookies came about as a way for a web service to retain state across sessions, and then that concept got applied to lots and lots and lots of things, some good some bad. Perhaps there are two things here we should have "originHostState" and "GenericUserState". We could then see how many people allowed the latter type of cookie to be set.

yes, "not good" usually. So originOnly flag coould be nice addition

Reply on news.ycombinator.com