Slashdot Mirror
Sites Wary of Adopting P3P
technogamy writes: "CNN is reporting on the industry's take on P3P, the W3C's Platform for Privacy Preferences.According to the article, the W3C is expected by April to formally adopt P3P -- of course, as many of you are aware, Microsoft's IE6 already includes an implementation of the client side of P3P. 'Because Microsoft's browser checks for P3P, sites risk getting flagged if they don't adopt it.' P3Pizing (or 'pethripizing') a complex site can evolve into a Herculean task...! (See also EPIC's critique of P3P.)"
I wonder if doing it with a module for Apache would be a good idea.. mod_p3p, then it reads your privacy stuff from a config file. That sure would save a lot of time for a lot of people.
Free Mac Mini
It's a shame that Mozilla doesn't yet support this. Sure, it's not a standard yet, but Microsoft had no problem jumping on it and getting it out and in use (in 90% of the browsers out there, no less). Oh well, you get what you pay for, I guess.
It would be nice to have this customisable to a list of websites, on one website you could have TEXT ONLY, on others the IMAGES ON etc...
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
We love to eat Channa and Potato Pancakes! With Tobasco! Thanks!
Am I the only one who saw the headline and wondered whether P3P was some new file distribution fad? ;-) I can see it now. P3P: Share music with two friends at once!
OK, sue me, it's been a long day...
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
Mozilla also used to have an implementation of P3P in that the cookie section of preferences had an option to accept or reject cookies based on a sites privacy policy which I assume was derived from the P3P standard, but as of 0.9.9 and current nightlies the preference has been removed because "it didn't work anyway". Whether this "not working" refered to the implentation or the fact that no real sites have P3P policies so it is misleading, I don't know.
I guess what the whole internet needs is a /. type moderation system.
I have to say that this is a way of trying to shut out non-commercial sites from the web. For example, my site is a privately run anime fansite with nothing for sale and no adds. Despite this, it gets flagged for not having a compliant privacy policy.
Now, I suppose that I could make a privacy policy for my site, but why should I have to bother when I'm obviously not in any kind of business, let alone selling personal information?
The web should be for *everyone*, not just businesses with large advertising budgets. Shutting out sites who don't have privacy policies posted is FUD tactics against little guys, plain and simple.
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
I'm sure it's members would like to know what they have to say about it. How far up the priority list is this one CmdrTaco? And what does Katz have to say about it?
I'm a writer, a poet, a genius, I know it. I don't buy software, I grow it.
Practically, the system is a nightmare to configure. If this thing ever gets widespread adoption I am sure we will see a surge of privacy consultants and third party privacy management tools.
Pushin' 'n dealin', shovin' 'n stealin'
Hey, I want to steal this FP thunder:
/. and have interesting stories to post just respond to the current FP and post the link?
/. and I want to make reading /. a useful experience again. So do me this favor.
Could people who read
I know that interesting people read
[[Ay fukkand lyke ane furious Fornicatour]]
Many people have started to rely on m o n o l i n u x for all their Linux needs.
Just a thought.
- Blair
I haven't read the full specifications -- so take anything I write with a grain of salt. I've spent years building web applications, authored a popular anti-spam package, and have done some work building an advertising filtering & privacy enhancement proxy server-based package.
It seems to me that a better approach would be something like this (call it Personal Information Widget):
User puts all of their personal information into some form of a "wallet" (yes - I know there are technologies similar to this) -- the information resides on their computer not in a passport on a third party server.
When a user goes to a site and wishes to sign up for registration, to purchase something, etc -- there should be a mechanism where that site is able to formulate a list of the fields that it wants + requires for registration. The site will send this (i.e. XML) to the Personal Information Widget.
The PIW will pop a window on the user's screen showing them what information the site wants + requires. The other can then choose to "deny" "allow all" "allow required" or "custom".
If they deny -- end of transaction.
Allow all -- give the site everything it wants
Allow required - give the site only required fields
Custom - chose to give the site information different than in your profile.
This sort of approach would solve one of the major problems of building registration-based sites -- the pain in the ass factor of getting people to type in their information for the Xth time -- without doing anything sneaky about privacy.
In an ideal world, I would be able to choose to allow cookies that are required for a web application to funciton, but deny cookies used to track my viewing habits (especially across multiple sites). I don't think that a "protocol" can really solve this problem though.
Once a site uses cookies, they inherently have the ability to track you -- whether or not that is there intent -- this protocol doesn't really protect your privacy.
I'm not really opposed to cookies -- as a web developer, it is painful for me to imagine coding without them! That said, I don't like the idea of someone tracking my usage habits across multiple sites and then potentially correlating that back w/ registration information to me.
I tend to disallow third party cookies. I know that this breaks a number of 1x1 pixel tracking tools -- but this same sort of technology could be ran off the web servers of the clients or if it was really necessary to outsource it -- you could use DNS (i.e. tracking.yourcompany.com points to webtrendslive.com ) to limit the tracking cookies to a single domain.
You can disallow third party cookies and protect your privacy that way w/o this extra layer of technology added.
I am a priori (guess I'm being closed minded) opposed to anything that facilitates that automatic transfer of information. I just can't wait to see someone find an exploit....
Evolution: love it or leave it
They make a technology incredibly hard to use, so only people trained by Microsoft can use it.
God spoke to me
P3P has absolutely no Application-Server/Scripting support. It's just a
simple XML-File that tells the User what (personal) data the Website
collects, and is Requested with "hard-coded" relative URL's.
Assume a PHP Website with URL-based Session's. A User Request the Homepage
(/index.phtml) - he's anonymous, collected data is anonymous. The (static)
P3P File tells the User that the collected data is anon. Well, now the User
logs-in via a Form-Submit and reloads the Page (/index.phtml). The
information is set in the PHP-Session, the User is shown other
(personalized) Content, but the P3P-File is still the same, telling the
user, that the collected data is still anonymous - this is (or may be) wrong
now.
P3P has no mechanism to handle this case, in P3P you can only set a
different policy for (sub-)folders (differrent URI's). The problem is, that
the GET Request is absolutely the same, it doesn't matter if the user is
logged-in or anonymous (well, it would be a security hole, if someone is
able to find out, if a user is logged-in when (s)he takes a look at the URL,
hm?).
Sure, it's possible to copy all "templates" to another subfolder and link
logged-in users to this one, but why should I do so? The advantage of using
templates (a I define them) is that they just show any content. They don't
care if this content is personalized or not. The content is "prepared" by
the "business logic" - programmed in PHP - and stored in a database. This
way, I'm able to use the same "templates" for logged-in and anonymous
users - well, half the work to do...
The page looks fine here. Maybe your browser is shitty and/or broken?
I don't know anything about P3P, and reading the website for the standard didn't help me answer this question.
So I'll ask Slashdot people:
What's to keep a site from lying or misrepresenting its usage policies?
And if the answer is nothing, then what the hell use is P3P? It seems that it doesn't affect me at all: I'll still refuse to send cookies to certain site, not keep cookies stored, and encrypt things.
I am using IE, which is by far the superior browser. Unfortunately, it also has a bug with regard to this.
Like the other guy said, you're looking in the wrong place. Everyone knows that all the hot chicks are on k5.
Please talk to me
whether MS's browser monopoly is legal or not, this shows the hidden costs of monopolies in general. A lot of webpage serving is done on *nix boxes running apache -- machines that could surf the websites they're serving, because IE isn't available on that platform -- and because MS's monopoly of browsers (even fucking slashdot shows most readers use IE,) this puts MS in a powerful position to dictate what they consider important and proper. This isn't even about money, although I'm sure it'll cost a lot of money to pay to get various sites to comply, this is about effort and choices. As a webmaster, I don't want someone else dictating when I have to change my site's design, and I certainly don't want someone telling me that I have to do something. This is probably just the contrarian in me, and for all I know, p3p is the wave of the future and The One True Way and I'm a fool for not having done it already, but hey, it's my website and I'd like to fucking make decisions all on my own, thanks anyway, MS.
Support alternate browsers (like opera and mozilla,) if you're a Windows user.
FreeBSD for the impatient.
(It's me again, the girlfriend seeker)
You mean ass raping like in Pulp Fiction, when they played that cool music background? I don't think CmdrTaco would do that. He's not a bad person.. those who ass rape are the trolls, usually, with all their goatse references.
Regards,
Trey Parker
can we be l337 and call this new P3P technology 'Pep'
Photos.
One of the criticisms of this is that it doesn't have any enforcement behind it.
There's nothing to stop the industry, or me, or all of us who run websites, from just saying, "Sure, we respect virtually everything about your privacy!" and then selling the hell out of your information.
So, for those of us for whom it would be a pain - we have two easy choices. We can a) ignore people who bother to use it 'cuz it sucks or b) adopt the most private P3P policies possible, and then don't worry about them.
The real problem this will have on the developer end is having the P3P options mean something. If there's no reason (legislation, for instance) for big business to respect their own P3P policies, why should I pretend that mine have anything to do with reality?
Hi Lunar82,
I'm sure there are some cute geek girls here. They just have to read my message. And anyway, I'm not sure the situation in K5 is better. Although Anne Marie used to write there, I didn't notice any other cute girls in that site.
Maybe you can recommend me on another site? I wish I could find a place with desperate girls, as I'm pretty desperate myself. But what- I don't want girls who are desperate because they are too ugly, fat or psychotic. I want girls who are desperate because of sheer bad luck, so I'll be able to be their savior.
Regards,
Trey Parker.
You said:
"P3P is actually really cool, and it wasn't
all THAT hard to get it implemented."
Yes, implementation may be easy, but would you enlightened us as to the COST of the implementation of P3P ?
The thing is, do you have to SPECIFY a "privacy rule" just to state that your site "respects" the visitors' privacy ?
It's kinda like sholving legalise to the throat to the WEB scene.
I know lawyers are used to the legalise thingy - like "off the record" thing, but for the visitors and those who are operating websites (commercials or otherwise), do we HAVE to state our "privacy rules" before allowing others to surf into our domain ?
What kind of world will we be living in, if we apply the P3P rule into our real lives ? Will we have to tell ALL THE VISITORS to our offices, home, or even recreation events that we respect their privacy, that there will be no hidden cameras or microphone recording their movement / speech, and there will be no PI (private investigator) tracing where they come from and where they will be going to, and so on ?
Think of the consequences, will ya, please ?
Muchas Gracias, Señor Edward Snowden !
You really are dumb, you wont find a girlfriend on slashdot, dont be a fool, if you really want a girfliend go and play Quake3 or CounterStrike!, even better!, i know a girl named Alice who will be intersted on chating with you, find her on http://www.alicebot.org
Sigs are for morons... Wait a minute...
When will Slashdot become P3P complaint?
If you are looking for some smart-but-average-looking girls then I suggest you try the library.
Please talk to me
Sure, it's possible to copy all "templates" to another subfolder and link logged-in users to this one, but why should I do so? ... I'm able to use the same "templates" for logged-in and anonymous
users - well, half the work to do
Then simply have the templates in / and the templates in /members/ include the same PHP code.
Will I retire or break 10K?
and should be punished as such. Does anyone here have FBI connections so this guy can be brought to justice?
I am not dumb!
Can't you see that my sentences are flawless, and my comments are interesting and intelligently written (so what if they're moded down)?
Why did you call me dumb? You know, when you exert evilness on people, some of the evilness stays in you and pollutes you.
PS: Alicebot is not useful at all. The AIML model they invented is simplistic, as all what it can do is give an answer to a single statement. It doesn't remember information from prior answers, so you can't really handle a conversation that way. We're still far away from a real AI psychiatrists.
Regards,
Trey Parker
So, if I trust the web site to correctly implement their privacy policy, why don't I trust them with my data?
If I don't trust them with my data, why do I trust them to correctly implement a privacy policy?
In fact, this is one of the few real uses for a Cue-Cat I can think of- have your credit card numbers et. al. printed out on a barcode chart next to your computer. You see the pretty shiny thing you want on the web site, they want your credit card number, you scan the paper. I DEFY any 1337 haxor to get that by ownxoring my machine - I have to scan it.
www.eFax.com are spammers
Not every fp is offtopic. NOBODY IS USING P3P, SO IT IS DEAD. What part of that did you cum-sucking retards not get through your thick skulls?
Well, it's problematic.
I can't just go and hit on chicks there, since it's not a pub.
Another way I can think of is just to become a regular in the library, know who are the other regular girls there (and also meet my male rivals that do the same thing), get to know them and after a while ask them for their phone number - a very lengthy procedure.
It's hard to be a geek. It's harder to be a geek looking for girlfriend.
- Trey
When will Slashdot become P3P complaint?
You might want to start a P3P Slashdot Initiative. Tell those in charge that you won't subscribe until Slashdot implements P3P, a W3C Proposed Recommendation. You can even call it P3PSI (pronounced PEP-see).
Will I retire or break 10K?
So users get more configuration options - this is going to be a mess.
No, you are using a browser that is both a piece of crap and worthless. Your goddamn fault.
The only reliable cookie solution is already here. No changes are required server-side, and you just need a competent browser like Mozilla client side.
First, disable third-party cookies. Then, weekly, or whenever you're bored, go in to cookie manager, check 'do not reaccept deleted cookies', and delete all the cookies for the sites where you do not need them (login info, valuable preferences, etc). Eventually, you'll end up with a block list that rejects all the bogus cookies of the sites you visit, and you never had to bother with dialogs per cookie, or sites not working because of cookie prefs.
They claimed it was fixed in the latest revision of slash. But that version isn't being used on slashdot yet. Thanks guys, where do I send my $5 ?
Please talk to me
I find it ironic that W3C's website isn't fully compliant:
= ht tp%3A%2F%2Fwww.w3.org
;)
http://validator.w3.org/p3p/20020128/p3p.pl?uri
But, at least they're trying.
I remember having MSIE denying cookies with some security settings unless P3P was setup on my site...
So I copied all the P3P files from some other site and it worked fine!
Of course, it was all completely bogus information... and that's the point. It adds a whole level of complexity and hassle of setting it up, and the user still has no idea if all the info is real or bogus. What a waste of time. Thanks again, Microsoft. You SUCK at setting standards.
At least IE's CSS support works right, which the OSS community seems totally unable to do.
Hello Trey,
;)
;) Even good ole Kevin Mitnick will be on there with me. And yes this is the REAL Anne Marie, not the person who wrote claiming to be me (whose name is Anne Marie as well) who stirred up all that commotion over on K5! ;)
I still read Slashdot quite frequently (and it's still linked on my old site I just don't post much to keep the controversy down and the articles about me to a minimum
My new site though (which is a bit more acceptable to the masses) is ALL about a gorgeous geek. She is a total brainy babe. Sound too good to believe? I know it's been in the works for ages, but it'll finally be up in APRIL! So check often at my new site for the latest
Anne Marie
I'm so sick of being bombarded with third-party persistent cookies. Damn right I want to maintain my privacy. Ok, so if their privacy statement fully notifies me they're going to put a thousand cookies on my machine its alright? Uh, no.
user and/or IP got banned with the corrupted UUEncoded post.
New password is bollocks
Mmmmmmm
Is our privacy important enough to justify further complicating the web?
That's going to be answered by different people, of course, but that's what it boils down to.
occultae nullus est respectus musicae - originally a Greek proverb
You don't need my home address, unless I am asking you to send something to my home address. You have no valid need or purpose for that information.
The real problem here is not the complexity of protocols to match privacy policies with privacy preferences, but instead is the fact that so many businesses are just too fucking nosy!. Now I know that those people in suits in the fancy shmancy corporate offices do tend to be idiots most of the time, but this spying on people has got to be stopped. What is wrong with those people that makes them so fucking sick that they need to be spying on everyone so much?
I find it interesting to note that quite a number of the dot-coms that went into business to spy on people were the ones that failed. But that's only a marginal level of significance. Many others, like doubleclick (which I block at my proxy server), still exist, and need to be taken out by any legal means (I'm doing my part by cutting out their level of hits, even when that means slashdot won't get the ad revenues).
now we need to go OSS in diesel cars
After reading it, I have to admit I have no clue as to why any user would want to use P3P in the first place. OK, I decide I only want to give out my address to have something shipped to me. So all P3P does is tell me when a site is about to ask me for that information--it does not automagically hand that information over to the site. If I don't want the information given out, I won't give it out. I don't need a preconfigured software nanny to remind me that I decided not to provide certain pieces of information.
Am I missing something here? This really seems like a lot of complexity and overhead for no benefit to anyone.
To actually implement P3P, you only need mod_headers when using apache. There is no magic here, it's only a damn header + two XML files, at it's most basic.
At it's most basic P3P just a header being looked at by a http user agent which has a P3P agent built in. I believe to date it's only I.E. 6.0. Though Mozilla, Opera, Galeon, and Konquerer are sure to follow.
Many aspects of P3P are positive, but there are parts of the specification which have yet to be properly determined and implemented, in a real-world environment.
The main parts affected would be any "Third-party" though any "First-party" running a site and issuing cookies of any unacceptable fashion, mainly things which are PII related and cannot be opted out of, will be flagged.
. In short, be sure you have an opt-out mechanism for your shoppers if you're an e-commerce site.
Also, any "Third-party" acting as an "Agent" on behalf of any "First-party" which is issuing cookies or collecting data, regardless if PII is involved. The spec for being a "Third-party Agent" has yet to actually be implemented by anyone, though I know some people who will try this soon. Up to this point, the view of "Third-party Agent" is quite desireable to anyone on the 'net who operates in such a manner. It nearly absolves them of "having" to deal with any consumer related issues regarding their data collection because you can point people back to the "First-party's" P3P policy, rather than having to maintain your own.
The obvious problem here though, is scalability and maintainability. It's tantamount to remote key-managment. You must then manage your "First-party" client's P3P Policies and keep in contact/communication with them to ensure that any changes are propagated to you, should it change, yet you continue to serve an *out of date* P3P Compact Policy in the web server's headers for that client, you very well could be blamed for screwing the data they hired you to collect for them in a very bad way.
Aside from that, P3P is a very positive thing for consumers and business persons in such a way that it opens a channel of communication which did not exist so much in the foreground, as P3P enables, before. Hope this is useful to anyone trying to understand some of what P3P really is.
--SuperBug
Aren't you full of yourself?!
I NEED A BITCH TO DO THE DISHES AND LAUNDRY, NOT USE MY COMP WHEN I WANT TO. YOU AREN'T EVEN *THAT* GOOD LOOKING.
i ansdfijnasjdnfjiansdjfasdjnfjiansjfnasjdfnjsadnfja sndfjnsadjfnasjdnfjiandsfjansdjfnasjdfnajsndfjasnd fjnasdjfinsajfdnjsidanfjiasndfnjasnfjasdnfjiasnfji sndfjinasdjfjiasndfjiasjindjasndjfnjaidsnfjinasdjf idjansfjisdnjfinajsidnfjinasdjfnjiasndfjinasdjfnji asdnfjinjasdfnjdsafnjidsanf".
Lameness filter: off.
Proof: "fsdfnjkasdfansdjfnasjdfnjiasndfjnasjifdnjaisdnfj
Great another impersonating bitch is showing herself. Stop copying me you dumb whore!
At least IE's CSS support works right, which the OSS community seems totally unable to do.
A-fucking-men.
I have a website / community that I built.
It has about 1200 users, sees some decent traffic, is a nice enough place.
There are a bunch of custom options, and I'm rewriting the site to use dynamic stylesheets.
I tend to surf with Opera.
I love it - esp. the no-popup option.
But it can't handle custom classes in stylesheets.
And that pisses me off.
Writers imply. Readers infer.
Dude, like I was on SLashdot, and shit, and there was this guy who kept posting the same lame shit over and over, he claimed to be a troll and shit, but like, he was just a dipshit apparently, and shit, because like, he kept posting the same shit over and over and shit. At least be creative and shit if you like want to be a troll and shit.
Opera for Linux is generally a lot better than Opera for windows, the Opera people have their priorities straight.
What version are you using?
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Having worked recently on adding P3P support to a proxy application, I feel I have a solid understanding about P3P. Some of the higher moderated sites have complained about the little guys getting hurt, and the big commercial sites not getting hurt.
P3P is about ensuring that users can match their preferences to the policies that a web site has. If the web site shares the data without a users explicit permission then a user can indicate with their user-agent that their identifying information shouldn't be allowed. The current protocol is fairly basic, not allowing for negotiation, and so it is trivial to implement.
The next point to make is about lying about the privacy policies. A statement about privacy with out a company following up with a way to ensure the policy is adhered to makes the policy a throw away statement. It is trivial to say to a browser that a site does nothing with the data, and still will. This is where third party verification with remedies becomes appropriate.
As you can see, there is no distinction between a big site or a little site. As long as the policies conflict with what the users want, the sites will be blocked.
Full of myself? Who said the new site was going to be about me? I am sorry you don't have any sense of wit to "get" my site. Besides, there is more than one (ok maybe two) hot gorgeous perfect looking geeks who are totally in the know on this planet who know every supergeek there is. Right?
WRONG! You can do something like:
<link rel="P3Pv1" href="...">See http://www.w3.org/TR/P3P/ section 2.2.3, The HTML link Tag.
Couple of my friends work at this place... maybe this would be a better solution.
Check it out: SWIFTBOARD
-Berj
Look, in 1996 a friend of mine and I sat down and produced a multi-thousand-page hand-coded web site that won basically every web award there was at the time.
We are both self-taught at both web programming and visual design.
At present we're doing a different site. It gets half a million hits a day. We're doing a redesign now, intended to increase traffic by making the site more attractive. It hasn't had a facelift in 6 or 7 years. The site sells nothing and has no paid ads.
There's no reason why a "personal" web site can't be done just as professionally and using just as good technology as any commercial site out there. If a site author can't be bothered to learn how to code a site correctly or design it well, I have no problem with avoiding the site.
Now that it looks like P3P may actually catch on, I'll learn how it works and implement it.
P3Pizing (or 'pethripizing') a complex site can evolve into a Herculean task...!
How is this so difficult?
I converted my companies privacy policy (quite detailed) to the needed p3p files using the tool IBM has available in under 2 hours with no prior experience.
The concept isn't that hard to understand, am I missing something that would make this so hard or time consuming to do?
I live life on the edge
One day I walked in on an engineer who had a user's supposedly encrypted data on his screen. It turns out the engineers have access to all the data "for quality control purposes." He showed me several other people's accounts like it was no big deal. I asked marketing if they were aware that the privacy policy was wrong. A director told me the privacy policy wasn't designed to be followed, it was designed to disarm users so they'd trust us.
They had nearly 2 million unique users when I left. Is your credit card number on an engineer's screen? Was that your bank statement I saw? Did that engineer remember to secure his terminal before going to the bathroom? Were you among the users who thought the "approved by TrustE" logo on our pages meant TrustE verified and enforced our policies?
http://www.cnn.com/2002/TECH/internet/03/16/privac y.labels.ap/index.html
IF you read at the middle of the article Ebay is putting into its privacy policy that :
quote "Online auctioneer eBay, which has yet to commit, is revising its privacy policy to say its written form takes precedent even if P3P or other statements say otherwise. "
Whatever P3P says, privacy policy has still the last word. So in summary : p3p is *USELESS*.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
..we use a P3P header on our site is so that IE6 will accept our 'third party' cookie if our site is opened in frames by clicking on a link to it while reading a message in hotmail (for example).
~mark
--
www.workzoo.com
Since I can live without persistent cookies, I have a simple trick I've been using for a few years, and that is simply to link my Mozilla/Netscape/Whatever cookies file to /dev/null.
(or in the bad ol' days when I ran a Windows box, I used to emulate this by just creating an empty directory of the same name - this didn't work, of course, with IE, as the latter [as far as I remember] had a different way of filing cookies).
OK, you still have to close the browser to completely clear the cookies, but I found an immediate drop in the amount of spam I was getting.
No no! No fp for youu. Prison sex?
PS. OECD = Organization for Economic Co-Operation and Development. According to their site they are "an international organisation helping governments tackle the economic, social and governance challenges of a globalised economy."
-- null
> Microsoft had no problem jumping on it and getting it out and in use
> (in 90% of the browsers out there, no less).
Really? IE6 supports it; are 90% of internet users using IE6? I think not.
Something like (very roughly), 65% use IE (all versions), 20% use AOL (w. embedded IE, various versions), 10% use Netscape/Mozilla (all versions), 5% others.
So 85% use an IE-based browser. What fraction of those are *IE6*-based? Half? My guess would be that less than 30% of current users (total, all browsers) run IE6.
People should remember that the majority of users *don't upgrade* their web browser regularly. Lots of IE's market share is still version 4; and I would guess that 6 is still not as popular as 5.x.
-- Mike Greaves
I've run into the very same problem just yesterday, actually. My solution was the same as yours (to add a P3P header), but somehow I feel that IE's behavior in this case is rather buggy.
I understand why it can be considered a privacy issue when DoubleClick sets a cookie which is sent back to them every time you visit a site which use DoubleClick for banner ads, but instead of completely blocking "third party" cookies which doesn't have P3P headers, wouldn't it be more correct to accept them but rather restrict them to the same site?
For example, if I visit site A, which uses DoubleClick, and DoubleClick sets a cookie, and I then visit site B, which also uses DoubleClick, I do not want the cookie which DoubleClick set when I was viewing site A to be sent to DoubleClick again. However, I do not see a problem with DoubleClick being able to set the cookie when I visit site A if the cookie is only sent to DoubleClick when I view site A.
What I'm trying to say is this: If your site didn't send the P3P header, shouldn't IE6 still accept your cookie when your site is opened in frames, but just restrict it so it will only be sent to your server when your site is being viewed through that frameset, in other words NOT send it if I go directly to your site or view it inside a frameset at some other site? Is this a bug in IE?
You know, Microsoft's street address also says a lot about their mentality.
6.01 on Win2K. I was running it on Linux, but I hate dual-booting, and Linux isn't what I use to get things done. Maybe someday, but I've not got the time to learn a whole new set of tools right now.
Writers imply. Readers infer.
But then man all you .mp3 l33t hacker dudez will be riping my sitty little grunge bands songs man, down with the net I saw.
Hey, it's "Trey Parker" again. I decided to give up on being an AC.
:)
Assuming it's the real Anne Marie, I'm very glad to see you're still around. I have a lot of empathy towards you - and towards other expressive geek girls, like Nitrozac (they are so rare..)
I emailed you some time ago, but I didn't receive a response.. did you get it? Is there any way I can confirm that user #255255 is indeed you?
And if so, will you create the geek dating site you promised?
If you want to answer me, it might be better if you do it in my journals, so I won't be moded down horribly.
- Nave` H. Weiss
Slashdot community, please notice: I am looking for a girlfriend.
Nave H. Weiss
Spend any length of time on the P3P mailing list and you'll notice that most questions revolve around using 3rd party cookies. This is where iE6 spends most of it's time rejecting cookies.
By default IE6 is set to reject cookies from 3rd party sites which includes many ad serving companies. Deciding how to set up your P3P to fit with this can be problematic.
First off, you must decide who does what and how. Is the ad serving company acting as an agent for you? If so, then the should be able to be covered by your own P3P policy. IIRC the relates to the ad company only if they are there to serve banners and that's it.
Not ad company does that. They gather every little morsel they can. Which means they have to serve their own P3P policy as well as you serving your own.
Now doubleclick have got it right. They server a P3P header for their ads s everyone is happy. Where I used to work, the ad serving company wanted to do all sorts of whacky crap which basically involved us having to jump through hoops for them. This was a big outfit and they obviously didn't get it.
IMHO many sites don't need P3P just yet because the functionality offered in the draft just isn't in the user agents yet. When they are then I think people will start to use it but it does depend on the honor system somewhat. Some companies do offer 'auditing' though to get round this.
Work with your ad serving company if their cookies etc are being blocked. Often it's up to them to do the P3P stuff but make sure you do your research as well so they don't snow you.
It's not hard to create one. A good read of the implmentation guide will go a long way, plus the IBM P3P editor is great. You can grab it from here
But I was just getting the hang of P2P, now I need to get a new computer for P3P ?
-Billco, Fnarg.com
This is a joke. If you want P3P you add this to your apache.conf
/> />
<Location
Header append P3P "policyref=\"/w3c/p3p.xml\"
Header append P3P "CP=\"IDC DSP COR CURa ADMa DEVa CUSa PSAa IVAa CONo OUR IND UNI STA\""
</Location
Then create a directory w3c off of your document root, create a file named p3p.xml
and then write something like this
<?xml version="1.0" ?>
<META xmlns="http://www.w3.org/2000/12/P3Pv1">
<POLICY-REFERENCES>
<POLICY-REF about="http://Your URL/policy.xml">
<INCLUDE>/*</INCLUDE>
</POLICY-REF>
</POLICY-REFERENCES>
</META>
So how difficult is that? Oh what's that? you don't use apache? That's your fault.
The correct way to write it is "Pancakes".
:(((
I'm so cool.. I can correct spelling mistakes! Unfortunately, it's not a good way to meet chicks. Oh well..
And where's Anne Marie? I wanted her to answer me.
Slashdot community, please notice: I am looking for a girlfriend.
Nave H. Weiss
You suck, and I rule! I didn't lose karma!
Slashdot community, please notice: I am looking for a girlfriend.
Nave H. Weiss