Slashdot Mirror
Feds Seek Input On Cookie Policy For Government Web Sites
suraj.sun sends along this quote from Information Week:
"The government wants to use cookies to offer more personalized web sites to citizens and better analytics to Webmasters. ... The federal government has drafted changes to its outdated restrictions on HTTP cookies, and wants the public's input. Under the plan, detailed in a blog post by federal CIO Vivek Kundra and... Michael Fitzpatrick, federal agencies would be able to use cookies as long as their use is lawful, citizens can opt out of being tracked, notice of the use of cookies is posted on the Web site, and Web sites don't limit access to information for those who opt out. ... The Office of Management and Budget is considering three separate tiers of cookie usage that will likely have different restrictions for each, based on privacy risks. The first tier of sites would use single-session technologies, the second multi-session technologies for use in analytics only, and the third for multi-session cookies that are used to remember data or settings 'beyond what is needed for web analytics.'"
For variety of reasons. :-)
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
Just don't use cookies. Or at the very least, allow people to opt *in* rather than out.
What a concept, right?
This is a sig. Deal with it.
I know I'll be modded down for this, but if government was stocked more with intelligent engineers and scientists instead of lawyers we would never have these issues.
Content-transfer-encoding: chocolate-chunked
The World Wide Web is dying. Soon, we shall have only the Internet.
The NSA perfoms illegal wiretaps and then the government consults the public over web cookies? What next, rapists asking their victims if they'd object to being given a hicky?
Go, go "team freedom"!
Cookies are evil in the first place. Tho they do taste good.
---- Booth was a patriot ----
1. Tracking MUST be in aggregate. Any categories of users SHOULD come only from self descriptions fcrom the user. (ie clicking "i run a small business")
a
2. Preferences MUST be stored client-side in cookies, not server-side. Sites MAY use hashing to prevent tampering where appropriate. Preferences SHOULD be stored as plain text so that they can be read and perhaps changed directly by the user.
3. Users SHOULD NOT have unique ids tagged to them, and MUST not have unique id's tagged to them over more than one session without an opt-in.
4. Analytics of users/preferences and locations/IP addresses MUST be done in a way as to minimize the ability to specificly track people who do not opt-in and are unaware of tracking.
This is my general policy:
If you are incapable of developing to these standards, say, because you don't understand how session cookies should work, then please find another line of work.
Cookies are bad for the health of your website, news site, or blog. Cookies are good for the health of your web application.
Is there anything more to say than Don't share them between sites?
If you login then of course you need a cookie. And using them for stats within one site is not much different to using IP addresses. But it's when you start including invisible images from a 3rd party site that shares the stats between multiple domains, that most people think crosses the line into creepy surveillance.
Login cookies = fine. Telling one site that you visited another site = not ok.
(or to phrase that another way: don't exploit loopholes in the security system)
The feds are not really interested in realistic input from the public. If they were, they would not require that commenters 'log in'. The cookies are being sought in order to deny the public the option of logging in...or not, simply by placing persistent 'tracking cookies' and other types of malwaaare. I checked their website cited above in the submission and you will find that indeed it does require 'logging in'. As such, only the converted choir will comment, and all these comments will be 'filtered for content' before being displayed. Such 'filtering' will be such that only sycophantic comments will be given prominent display. Comments opposing the cookies will only be displayed if they are ignorantly worded, ungrammatically constructed, and otherwise show the writers in a bad light. In this way the site can be manipulated as such that other propagandists can claim 'popular support' for internal spying. That the whole website has a flavor of Joseph Goebbels's old 'debates' when Hitler was an agitator in Great Depression Germany is lost on a younger generation that not only has no memory of National Socialism, but also has no education of it either. Modern history courses in high schools leave that out and only teach history after world war two, concentrating on multiculturalism while ignoring the culture that built the nation and the schools in it that now teach only fluff, a whole other subject worthy of its own debates.
These cookies are easily removed now, so it seems silly that the guv would take great pains to foist them on you unless they know something that we do not. Is there something new and horrible in Windows 7? Something that will give us even LESS control of our machines that we paid for with our money and get less and less use, choice, and especially control of?
You know, it's fucking ridiculous that people harp about cookies, which are entirely under the user's control, but ignore the CSS browser-history hack that allows any site to probe whether you've visited another completely unrelated site.
Wake up people! If you want security, worry about the issues that are actually dangerous, not the ones that just sound the scariest.