Mozilla Proposes 'Do Not Track' HTTP Header

MozTrack writes "The emergence of data mining by third party advertisers has caused a national debate from privacy experts, lawmakers and browser supporters. Mozilla's Firefox, a popular browser company, has proposed a new feature that will prevent people's personal information from getting mined and sold for advertising. The feature would allow users to set a browser preference that will broadcast their desire to opt-out of third party, advertising-based tracking. It would do this via a 'Do Not Track' HTTP header with every click or page view in Firefox."

Comments

Great idea but not likely to happen

[InsaneProcessor]

Advertisers and tracking services will fight this to the bitter end.

Re:Great idea but not likely to happen

[Anonymous Coward]

Yea, it's a cool idea, but the other two largest browser makers have a vested interest in this functionality not existing, which makes widespread adoption pretty unlikely.

Re:Great idea but not likely to happen

[ByOhTek]

Or ignore it. I'd think it'd be fairly trivial to ignore that header, especially if there is a least one country that doesn't legally require it to be honored (and even without that, they'll probably still ignore it in countries where it is illegal).

They won't fight it, they laugh at it.

Re:Great idea but not likely to happen

[gstoddart]

Advertisers and tracking services will fight this to the bitter end.

Or, ignore it and use it as one more piece of data about you.

They're more likely to disregard it than to fight it.

Re:Great idea but not likely to happen

[kellyb9]

Along the same lines, this would probably make the issue worse. Based on that tag, people are going to simply assume security and privacy where there is none.

Re:Great idea but not likely to happen

[drunkennewfiemidget]

More likely is they'll just find a way to ignore/work around it.

Re:Great idea but not likely to happen

[CouchP]

I imagine they would actually welcome it. Wouldn't it mark precisely the packets that were most usable by these services?

Re:Great idea but not likely to happen

[anyGould]

Advertisers and tracking services will fight this to the bitter end.

Nah, they'll just ignore it - it's just a header, and has no mechanics for ensuring that the reciever (a) gets it, (b) knows what it means, or (c) does anything in particular with it.

Re:Great idea but not likely to happen

[Ancantus]

But you cannot deny this is a good start. If Firefox can initiate a standard for a Do Not Track. Perhaps Congress can bind it with the No Tracking Bill, and make it so users who wish to opt out wont have to hunt around for a damn check box all over creation. This can't do any harm, and has a possibility of making everyone's life a whole lot easier.

Re:Great idea but not likely to happen

[fredjh]

Agreed... opt out is BS, it should ALWAYS be opt-in, and default browser behavior should be to NOT send such information at all.

Re:Great idea but not likely to happen

[Tisha_AH]

I see where Mozilla is coming from. They are looking at how many folks do not like being tracked and the popularity of programs like Adblock Plus, NoScript, etc...and are trying to add some of that functionality into the browser. Not a bad idea as there are significant numbers of folks who do not put any enhancements into their Firefox install other than some dumb toolbar. As Firefox will appeal to more and more non-technical types there would be some benefit to adding that functionality up front.

You can bet that the IE crowd will say that their browser works better and only compare the base load of Firefox.

The "do not track" header is a fine idea but it will only work for those sites that play by the rules.

Most don't.

Even with the additional "don't track header" capability I will not throw caution to the winds. I will continue to use Adblock Plus, NoScript and a few other tools.

Re:Great idea but not likely to happen

[geminidomino]

But you cannot deny this is a good start

Yes, you can. It'd be stillborn, at best.

If this gets implemented, the marketroids ignore it.
If it gets legislated, the marketroids pay the custom-built law fees to make sure it's completely useless (a la "[You ]CAN SPAM")

End result: Delta = 0

Re:Great idea but not likely to happen

[commodore6502]

I think you're too pessimistic. The "Do Not Call" list was effective in stopping telemarketers, even though they are not required to obey that list if they are outside the US. This "Do Not Track" header could be similarly effective.

>>>Mozilla's Firefox, a popular browser company,

Don't forget Mozilla Netscape, Mozilla Seamonkey (firefox/thunderbird/composer merged), and Mozilla Camino for Macs..... also popular browser "companies". ;-)

Re:Great idea but not likely to happen

[bhcompy]

Not to mention that it can be used to prevent access to sites. I've been on sites that block access if you use Adblock or NoScript. Not sure how they recognize it(because I never tried to look), but they do

Re:Great idea but not likely to happen

[Andy Dodd]

In the event that it is made law that a site must respect the "do not track" header, many sites may simply refuse to serve those who have it enabled.

Re:Great idea but not likely to happen

[jimicus]

Not to send what exactly? Were browsers to not send cookies by default, they'd break an awful lot of websites for the majority of their users. It's fairly fundamental to HTTP that it's not stateful between requests - cookies allow applications to work around that issue.

Re:Great idea but not likely to happen

[TheRealGrogan]

Especially since it will be ignored by "default". You can arbitrarily inject headers into requests, but the web servers and sites people are running won't recognize them until they are taught to.

Also, last time I checked, the Mozilla foundation wasn't in any sort of law making position so the chances of it being "legally required" in any country, let alone all countries, are pretty slim. Especially when the resident evil, Microsoft, will be against it. (For their "partners" and themselves)

No, I'm afraid the current technique of blocking advertising sites will be the only effective solution. Perhaps Mozilla could add that functionality to the main browser for those who choose to enable it. (If they have the balls, that is. It would certainly piss off webmasters)

Re:Great idea but not likely to happen

[on]

Advertisers and tracking services will fight this to the bitter end.

....and if this is ratified as a web standard, governments could simply enforce honoring such headers by law. In Norway, a national register has been in place for years where registered citizens opt-out from fax and voice spam. Norway also have laws which prevents advertisers from filling your (physical) mailbox with junk (you just place a sticker on your mailbox).

Re:Great idea but not likely to happen

[Lazareth]

The very key difference being that telemarketers were calling from within the same country as their targets. Internet advertisement and data mining is completely different to telemarketing.

Re:Great idea but not likely to happen

[Anonymous Psychopath]

Not to mention that it can be used to prevent access to sites. I've been on sites that block access if you use Adblock or NoScript. Not sure how they recognize it(because I never tried to look), but they do

Objectively, if I'm funding my site with advertising and you block it, why should you be allowed to access my content?

Re:Great idea but not likely to happen

[hedwards]

I think you're too pessimistic. The "Do Not Call" list was effective in stopping telemarketers, even though they are not required to obey that list if they are outside the US. This "Do Not Track" header could be similarly effective.

I think that's the problem. It would cut down on the tracking by more or less legitimate firms, but it wouldn't do anything about the ones that are offshore and lacking in scruples.

And the offshore ones are the ones causing the biggest headaches at present with spam.

Re:Great idea but not likely to happen

[SCHecklerX]

Yup. Looks like Mozilla is taking the "Evil Bit" seriously, and creating their own "Good Bit".

Cute.

Re:Great idea but not likely to happen

[hedwards]

CAN SPAM wasn't useless, it's been far more useful than doing nothing. It just turns out that there's a limit to what legislation in America can do with a problem which originates outside our borders.

CAN SPAM has however cut down on people outside of organized crime spamming.

Re:Great idea but not likely to happen

[hedwards]

Doubtful. While it pays better to use ads that are targeted based upon tracking, I doubt that many sites are going to be doing that. Google will doubtless support the change pretty quickly, and with them the rest of the ad industry. Haven't you noticed all that JavaScript that gets loaded from another server for ads?

Re:Great idea but not likely to happen

[idontgno]

Worse yet... they'll treat it as another piece of marketing demographic metadata, tagging the sucker (I mean browser user) as concerned with privacy and security... a perfect mark (I mean potential customer) for antivirus software, network security products, and privacy protection services.

Re:Great idea but not likely to happen

[Anonymous Coward]

That is a valid point, but isn't any more objective than the OP.

Though if they refuse to click on any ads, then why would it matter if you show it to them? Aren't all ads based upon the click, and not just the view these days?

Personally, I don't see the problem with either view as long as it is stated up front (with a page that says you must turn off adblock to see this content, or such). I skip those sites as not worth my time, but I don't begrudge them their choice.

Re:Great idea but not likely to happen

[Nemyst]

It's ironic, though. It's indeed almost certain that header will never catch on, yet by doing so advertisers are just shooting themselves in the foot. They're giving AdBlock and NoScript traction. They're pissing off the geeks, who often have a sizable influence in the realm of technology within their circle of friends. Instead of having a header that would be normally disabled and would get turned on in specific cases (say, through private browsing options), they're getting people to use tools that are turned on by default and never get turned off.

It's their loss in the end.

Re:Great idea but not likely to happen

[icebike]

Objectively, if I'm funding my site with advertising and you block it, why should you be allowed to access my content?

Well its certainly your right to withhold the page until the ads are downloaded (even until they are displayed if you want a high rate of instant exits).

But this isn't a war you can win in the long run. Browsers or plugins will always find a way to defeat your ads, and the harder you try to push them into your reader's faces the less successful you will be.

Whether it the tools simply skip downloading your ads or downloads the ads in the background, people are not going to watch intrusive ads.

The "Skip this welcome page" ad sites have found their bandwidth utilization up, and their customer click-exits growing faster than their content delivery.

Not many people block Google Ads, because they are usually topical and un-intrusive. But any method to insure I read your ads is bound to fail.

Re:Great idea but not likely to happen

[GreatBunzinni]

Or ignore it.

This.

An option is only as good as the power that is bestowed upon a user/program/protocol to enforce that wish. No matter how many flags a browser sticks into a HTTP header, if the people developing and/or running a server simply do not have any intention to follow through that request than that header becomes absolutely meaningless.

This issue is even more problematic once we acknowledge the fact that the user does not nor he can have any clue regarding what goes on in a server and what is being done with the information that is harvested from them by the people running the server. That is, you access a server and you instruct the server to not track your personal information. Then, you either get a reply from the server stating "ok" or you are left without any feedback. Either way, what guarantees do you have that your wish is being acknowledged? None. Absolutely nothing.

This idea is as bad as the one about relying on client-side plugins to stop an image from being shown if it was deemed too old. It simply cannot work. It's nothing more than a waste of resources.

Re:Great idea but not likely to happen

[MarkRose]

No. Often the money is only made by the advertiser when there's a click (unless it's some brand awareness campaign), but most places still charge for the space on a CPM basis. So when you block ads, the publisher loses more than the advertiser.

Re:Great idea but not likely to happen

[xOneca]

Remembers me the Evil bit.

Re:Great idea but not likely to happen

[Anonymous Coward]

Objectively? He/she/they/I shouldn't. Reasonably, if the advertising is acceptable, then nobody should complain, and if the advertising is irritating/obnoxious then people should not go for your content at all, and perhaps tell you why they'll go elsewhere instead. This way you can adjust the advertising to be the most acceptable to most people.

But since people aren't reasonable, your advertising is probably at the whim of the ad provider to determine how irritating it's going to be on any given day, and "most acceptable" is horribly subjective (and - I suspect - developing a wider gap between people who have been trained to take it as it's given, and people who are getting more and more tired of advertising... well, I'm not sure where I was going with that, but obviously there's going to have to be a compromise somewhere..

Re:Great idea but not likely to happen

[Anonymous Coward]

Along the same lines, this would probably make the issue worse.

Just one more point of information for tracking. See: https://panopticlick.eff.org/ for how trackable you are. What they really need is a "whitewash" extension or setting by Mozilla that gives everyone the same settings for user agent, plugins, headers, etc. If everyone appears the same, no one is unique.

Re:Great idea but not likely to happen

[Bergs007]

Along the same lines, this would probably make the issue worse. Based on that tag, people are going to simply assume security and privacy where there is none.

Not only that, but even worse, this tag will give data miners something to latch on to. "Oh they're using the Do Not Track tag? There must be some juicy info here!"

Re:Great idea but not likely to happen

[Rhaban]

What about a "do not track - please" header?

Re:Great idea but not likely to happen

[Crimson Wing]

Some ad services pay based on impressions/views, not clicks. The payout is significantly lower per impression than per click, but the ratio of "people who let them load, whether they click or not" to "people who click" can sometimes make pay-by-impression more valuable.

Re:Great idea but not likely to happen

[Anonymous Coward]

Exactly. It's not like Robots.txt did anything particularly amazing in regards to similar problems.

Re:Great idea but not likely to happen

[Drathos]

The "Do Not Call" list was effective ...

The "Do Not Call" list is not effective. In fact, it made it worse for me because I went from getting two or three calls from telemarketers a week to five or six calls a day from all the loopholes (politicos, "charities," and surveys) which quadruples during election season. The loopholes used the list to farm numbers.

Re:Great idea but not likely to happen

[spazdor]

Or, it speeds their decline from relevance if (big if) this functionality turns out to create a noticeably better browsing experience, and the sandlot browser-makers are able to provide a killer feature which the big two refuse to support.

Re:Great idea but not likely to happen

[Protoslo]

Assuming you keep your plugins updated, you are already sending the X-Do-Not-Track header with all of your requests. Since NoScript 2.0.9.x, it can be configured with noscript.DoNotTrack.{enabled, exceptions, forced}, and the default is enabled.

The maintainer of NoScript says:

As stupid as it may sound (why parties who are interested in tracking you would comply?), a mean to clearly express your will of not being tracked is going to be useful, especially when backed by law or industry self-regulation, as explained here. Therefore it seems in the interest of NoScript users and privacy-concerned netizens in general to participate in this effort.

I'm not sure that I agree with the rationale (legislation about HTTP headers? No thank you!), but at least there is one. He also responded to the Firefox proposal.

Re:Great idea but not likely to happen

[spazdor]

Objectively, if I'm funding my site with advertising and you block it, why should you be allowed to access my content?

The same reason that Safeway doesn't get to forcibly insert the free swiss-cheese sample in your mouth after you accept it from the lady at the kiosk.

If you're giving something away for free, you can deny it on any basis you like (which means, of course, if you've determined by your own methods that someone's dropping your ads you're always fine to decline them service in the first place), but once it's given out, there are actually some strings you can't attach. One of those strings, is whether the person chooses to consume any part of your content or discard it without looking at it. That choice is inalienably up to them, and there's no EULA which can sign it away.

Re:Great idea but not likely to happen

[TaoPhoenix]

"Hi. This is the American Embassy in ____. For every user you track we will impose international trade sanctions on your country for one day. Bye."

Re:Great idea but not likely to happen

[Crudely_Indecent]

Advertisers and tracking services will fight this to the bitter end.

I doubt that.

This would paint a target on the heads (so to speak) of the people they most want to track! Everyone else is already submitting to their intrusive behavior. The people most likely to fall for this scheme are likely using other methods to hide their identities.

Seriously! This is like putting up no trespassing signs. If someone really wants to trespass, they will.

The best bet is to take the advice of Darryl Zero and lie about everything.

Re:Great idea but not likely to happen

[Rob Riggs]

They won't ignore it, necessarily. But they may charge more to people they cannot (read: "choose not to") track. Just look at every major grocery chain in the U.S. and their loyalty cards: this can of Chicken Noodle Soup costs $1.00, or $0.67 for those with a loyalty card.

Re:Great idea but not likely to happen

[marcosdumay]

You are free to block the content, as the GP is free to block your ads. Now you can't show your ads, and the GP can't get the content, you may quite as well negotiate that. For example, he may want to disable his tools for your site if it is valuable enough, or you may want to close a deal with some ad provider that isn't that intrusive if your content is not that valuabe (as most of it isn't).

Re:Great idea but not likely to happen

[simplypeachy]

You haven't seen what happens when you visit a web site - say with a youtube video, a flash advert, four or five social networking widgets or logos, analytics, plain old and flash cookies, even geolocation.

It's breathtaking and disturbing. Give Privoxy a try and see just who's watching :-)

Re:Great idea but not likely to happen

[characterZer0]

Don't send referrers and only allow session cookies by default.

Re:Great idea but not likely to happen

[Anonymous Coward]

Perhaps, for websites that violate the header, they get black or gray listed? Or, require every page submitted to be digitally signed so its sender can be verified and blocked accordingly. No signature - no get through. Period.

Re:Great idea but not likely to happen

[ukyoCE]

OP didn't say to get rid of cookies, he said browsers shouldn't need to opt-out of the cross-site tracking discussed in the summary. A practical implementation would be if all browsers started blocking 3rd party cookies. This has been an option for a while, but as its not the default, it breaks a lot of random non-nefarious websites.

Unfortunately workarounds would be found by advertisers anyway, eg. having the website install the advertiser's cookie for them and traffic the info behind the scenes instead of through your browser.

Re:Great idea but not likely to happen

[jimicus]

No, but I don't doubt it for a minute. It became pretty obvious a year or two back when I searched for something on Google and the next time I logged into Amazon it recommended exactly the sort of thing I'd been searching for (but hadn't searched Amazon).

Re:Great idea but not likely to happen

[hairyfeet]

So why not do it in a way that you can offer the functionality and the other two can piss off? I have been saying for years the problem with NoScript is unlike ABP there is no simple GUI that makes it accessible to the masses. With Mozila throwing their weight in and making it and ABP part of the default functionality that problem can be solved. What NoScript needs is a simple "Play the video" button as dealing with customers having to play "guess which blocked thing is the video" turns them off so bad they end up turning NoScript off. With ABP there is a simple "disable on this page" which makes it easy for a normal non geek user, something similar could be done where NoScript looks for the *.flv, *.mp4, etc and has a "play the video" button.

If Mozilla was to do this along with sandboxing cookies so they ONLY work for the originating site and make this the default behavior then we would finally have a good and easy way to deal with all this tracking crap and it wouldn't depend on anybody else. Then like with ABP a site could say "We're not allowing annoying ads or tracking. Please help us by allowing ads on our site" and we could push the button if we like the site (Similar to what Ars has done) and if they break that pledge we can just push the button and block their asses again.

But as someone who deals with the Average Joe six days a week while ABP and Firefox have become a standard that I always include because it takes me less than 3 minutes to show any user how to use it with NoScript even though that extra functionality would increase their security and help quite a lot the interface is just too geek heavy. Even I have been tempted to kill the thing a time or two when I have to say "allow" three or four times just to get a video to run. If someone were to make a "play content" button that looked for the file extension it would go a long way IMHO in helping not only making the average Joe harder to track, but in cutting down all the driveby malware crap as well. If Mozilla were to throw their weight behind this then they simply wouldn't need anyone else to support it because it would be all browser based.

Re:Great idea but not likely to happen

[AuMatar]

You're an exception. I went from getting 1 or 2 per week to not getting any in the past 2 or 3 years.

Re:Great idea but not likely to happen

[nabsltd]

What NoScript needs is a simple "Play the video" button as dealing with customers having to play "guess which blocked thing is the video"

It's not like the NoScript interface hides the "Temporarily allow all this page" menu item...it's just not a button.

Since "allow all" is the only way to "play the video" (knowing which scripts are required would mean actually loading all the scripts and executing them in a sandbox to see which ones are being called), it's fine by me.

Re:Great idea but not likely to happen

[nabsltd]

They are looking at how many folks do not like being tracked and the popularity of programs like Adblock Plus, NoScript, etc...and are trying to add some of that functionality into the browser.

Except that avoiding tracking really isn't the primary reason people use AdBlock or NoScript...safety and speed are much higher up on the list.

Re:Great idea but not likely to happen

[Anonymous Coward]

Not wanting to be served ads is my reason for using AdBlock.

Re:Great idea but not likely to happen

[izomiac]

Make data session only by default, perhaps even limited to a specific tab and its children. Disallow third party cookies and scripts. Stop sending the referrer, user_agent, and plug-in information.

90 - 95% of websites work absolutely fine with these settings, while it becomes difficult to track a user across webpages or browser sessions, even via PanOptiClick methods. The problem is that 5 - 10% of websites are written by morons who code by the "works for me" method rather than understanding standards.

For example, my bank's website tries to specifically identify visitor browsers by hardcoding a list of every browser known to the developer. If you don't send a user_agent header (optional by spec), then the javascript code assumes you have javascript disabled, opens a javascript alert informing you to enable it, and does a javascript redirection to their FAQ. (Yet, for some reason, I rely on said programmer to defend against cross site scripting attacks.) Wikipedia's search assumes that you're a script, and some websites give a 500 error on any page load (usually a null pointer exception).

Re:Great idea but not likely to happen

[Terrasque]

Forbid cookies? Well, that's exactly what the norwegian government is planning : Google translated article

Fun part (very good translation):

Storage of information in the user's communication equipment or gaining access to such information data is not allowed.

Such storage or access can still happen if the user has been informed by the data controller under the Data Protection Act and has given his consent.

Norwegian politicians really have no clue about the net. Same with norwegian police :) And now they're pushing the norwegian data retention act ("DLD") - which will solve all the problems in the world, if just everyone accept being monitored. It will help against terrorists, drug dealers, child porn, identity theft, scamming, people saying mean things to eachother, and bad breath. How it will help against that? They don't know, but assure us it will be wonderful.

While of course, everyone with just a tad of tech insight knows it will be almost effortless to hide yourself from. Hell, even MSN/Gtalk use SSL encrypted connection going via a central server, which would easily bypass it.

Re:Great idea but not likely to happen

[Lazareth]

Right. So what you're implying is that America would actually put down sanctions to protect the privacy of their citizens?

Re:Great idea but not likely to happen

[Hatta]

Then don't use HTTP. HTTP is for documents, not apps. It's not that abandoning cookies will break sites, it's those sites that have broken the internet by requiring us to use crappy hacks around intentional limitations of these protocols.

Re:Great idea but not likely to happen

[Anonymous Coward]

Perhaps this is an indication that working "applications" into a browser was a bad idea.

Re:Great idea but not likely to happen

[jimicus]

What's the weather like on your planet?

Re:Great idea but not likely to happen

[Anonymous Coward]

Why does a website need to know that I have Creative Zen Media or .NET 3.x.1.2.3.4 on my system? Why does a web browser push this crap data (and similar) to every server? I should have complete control over the headers pushed to servers and be able to manage them "per-server."

Cookies are the least of my concerns. They are only session cookies and wiped during my weekly reboot. I also wipe flash objects daily, run both AdBlock and NoScript. Oh, I only browse from a VM that runs a live CD - also rebooted weekly.

Track that bitch.

Re:Great idea but not likely to happen

[Anonymous Coward]

I threaten spammers with CANSPAM all of the time, and it seems to work. I've never even had to file a report. I even threatened the alumni association of my college once since they insisted I take their exit survey five times after I told them I was not interested. The next day I got an email from the head of the department apologizing for their mistake and personally guaranteeing my email address and name are off that and any other contact list. CANSPAM makes it abundantly clear that it is up to the recipient to determined what is and is not unsolicited email, and that sending unsolicited email must be stopped when recipient asks.

Re:Great idea but not likely to happen

[KiloByte]

Browsers should allow only session cookies by default, with a way to allow setting a particular site's cookies to permanent.

FireFox+Cookie Monster is almost there -- sadly, the cookie's original timeout is lost so permanency goes in only after the next time that cookie is set.

Chrome is a bad joke -- even 9 allows at most a blanket "all cookies permanent/all cookies session" setting, even Netscape 2.0 at the dawn of time had an "ask" option which, while a bit cumbersome, let you control this.

Re:Great idea but not likely to happen

[Anonymous Coward]

And get off your lawn? :)

Seriously, the idea that the whole web will revert to static pages with no user data, sessions, etc. is absurd.

Re:Great idea but not likely to happen

[Anonymous Psychopath]

Bad news, if you need advertising to fund your site then it's clear the content is worthless.

You are referring, of course, to sites like Slashdot, Google, etc? The overwhelming majority of all Internet content is advertising-supported.

Re:Great idea but not likely to happen

[Bert64]

I find the same thing... I don't bother to block unintrusive ads, but anything that irritates me (any ads with sound or excessive animation, anything that comes up infront and obscures the content your trying to view, anything that tries to open a new browser window) will get that ad supplier blocked and usually causes me to not return to the site that foisted it upon me.

Re:Great idea but not likely to happen

[Anonymous Psychopath]

Objectively, if I'm funding my site with advertising and you block it, why should you be allowed to access my content?

Well its certainly your right to withhold the page until the ads are downloaded (even until they are displayed if you want a high rate of instant exits).

But this isn't a war you can win in the long run. Browsers or plugins will always find a way to defeat your ads, and the harder you try to push them into your reader's faces the less successful you will be.

Whether it the tools simply skip downloading your ads or downloads the ads in the background, people are not going to watch intrusive ads.

The "Skip this welcome page" ad sites have found their bandwidth utilization up, and their customer click-exits growing faster than their content delivery.

Not many people block Google Ads, because they are usually topical and un-intrusive. But any method to insure I read your ads is bound to fail.

I get your argument, truly. Personally, I run an ad blocker, I don't host a commercial web site, and I've never earned $1 off Internet advertising.

Point remains, though, something has to pay for all this free content we enjoy. Right now that something is primarily advertising. I suppose micropayments could replace advertising if it came to that.

Slashdot lets me off the hook for ads, probably just because I've been around so long (thanks!).

Re:Great idea but not likely to happen

[internettoughguy]

It's ironic, though. It's indeed almost certain that header will never catch on, yet by doing so advertisers are just shooting themselves in the foot. They're giving AdBlock and NoScript traction. They're pissing off the geeks, who often have a sizable influence in the realm of technology within their circle of friends. Instead of having a header that would be normally disabled and would get turned on in specific cases (say, through private browsing options), they're getting people to use tools that are turned on by default and never get turned off.

It's their loss in the end.

Perhaps NoScript could be configured to detect whether the header is honoured (or just use a dictionary to blacklist sites that don't), and if it is, allow the script to run. If NoScript functionality was bundled with all FF, Opera and Chrome installs, that would give this header more weight also.

Re:Great idea but not likely to happen

[datsa]

"sudo do not track"

Re:Great idea but not likely to happen

[Omestes]

A bit off topic... But...

Objectively, if I'm funding my site with advertising and you block it, why should you be allowed to access my content?

You can go ahead and block your content. But that would probably drive users away, which would hurt your presence, which would pretty much kill your Pagerank, etc... In the mean time, someone will make a way around however you block users, and people will still view your content without you forcing ads down their throats.

Harsh language aside, I understand why ads exist, and why "content producers" are so negative about extensions like ABP. On the other hand the interent has existed before every damn site had to have 200x more ads than content, and where a significant portions of ads are keen on blocking off content, making obnoxious noises, injecting my machine with malware, and, topically, attempts to track my movements without my permission or desire . The internet will survive. A lot of people don't expect to make a living off of their hobby, and they will happily produce content without me having useless, unwanted, products shoved in my face. The hobbyists pretty much invented the modern Web, and still out number people who expect to fund themselves off ads.

I also, on viewing your site, did not sign a contract that allows you to force whatever unwanted content on to my computer.

As it stands, ad blocking isn't as ubiquitous as us Slashdot reading nerds think it is. Most people still use IE, or unmodified installs of Firefox. I had to remove the adblocker I set up on my dad's computer because he couldn't figure it out (for the 1% of valid content it blocks).

Re:Great idea but not likely to happen

[Omestes]

You are referring, of course, to sites like Slashdot, Google, etc? The overwhelming majority of all Internet content is advertising-supported.

Hmm... I haven't had ads on Slashdot for some time. There is a nice little checkbox telling me that I don't need to see them*. Google is an ADVERTISING COMPANY, 90+% of its revenue is from serving ads to other people, not displaying them. Outside of news sites, who haven't figured out how to actually sell their product in the modern age (thanks to ignoring that "internet trend" for the last 10 years), most sites that expect revenue are selling a... you know... product.

  If there were micropayments, I wouldn't simply ignore 90% of sites begging for money, since 90% of everything is crap and thus not worth even a couple real-life cents to me.

I don't understand the brouhaha your raising here. Your site doesn't have any ads, and its product is open source and free (from what I could tell).

*I was feeling generous the other day, and unchecked the box, and turned APB off on Slashdot, but some stupid ad wouldn't load, and caused every damn page to hang indefinitely. APB is on, and the box is once again checked. Google is still the only site/server that isn't blocked.

Re:Great idea but not likely to happen

[Chaonici]

> Hell, even MSN/Gtalk use SSL encrypted connection going via a central server

My understanding of the MSN instant messaging network is that everything is sent unencrypted, in total plaintext, unless you and your contact are using a third-party encryption system. And Windows Live Messenger, by far the most popular client for MSN, has no options for message encryption whatsoever. Additionally, as far as I know, there are no plugins for WLM that enable encryption; you basically have to use Pidgin with OTR or something.

I would dearly love to be proven wrong about this.

Re:Great idea but not likely to happen

[Anonymous Psychopath]

You are referring, of course, to sites like Slashdot, Google, etc? The overwhelming majority of all Internet content is advertising-supported.

Hmm... I haven't had ads on Slashdot for some time. There is a nice little checkbox telling me that I don't need to see them*.

Slashdot provides that feature to a subset of users, presumably because they receive sufficient value from our comments or moderations. The rest of the users see ads in exchange for content. I've no idea how many are exempt or not.

Google is an ADVERTISING COMPANY, 90+% of its revenue is from serving ads to other people, not displaying them.

Google Search, Maps, Apps and Mail are all for-profit advertising-supported web services. Not much point in products that lose money.

Outside of news sites, who haven't figured out how to actually sell their product in the modern age (thanks to ignoring that "internet trend" for the last 10 years), most sites that expect revenue are selling a... you know... product.

Agreed on the traditional news sites. How about Lifehacker, Engadget, Gizmodo, MaximumPC, Youtube, Hulu, etc? I don't know if you think their content is crap or not, but that's how it's paid for.

If there were micropayments, I wouldn't simply ignore 90% of sites begging for money, since 90% of everything is crap and thus not worth even a couple real-life cents to me.

That's your call, of course. Right now the implied agreement is you see ads in exchange for free content. Obviously if the content is crap you won't be visiting that site. So where's the problem?

I don't understand the brouhaha your raising here. Your site doesn't have any ads, and its product is open source and free (from what I could tell).

*I was feeling generous the other day, and unchecked the box, and turned APB off on Slashdot, but some stupid ad wouldn't load, and caused every damn page to hang indefinitely. APB is on, and the box is once again checked. Google is still the only site/server that isn't blocked.

I have no personal stake in this issue. I just think it's important to appreciate the content provider's perspective in all this. No such thing as a free lunch.

Re:Great idea but not likely to happen

[TaoPhoenix]

Not in this political climate. However that is an answer to the "you can't stop them 'cuz they're international". They're quite happy to do it for the **AA, which is structurally the same argument. Or whatever Ballmer was saying about "working with" China about pirating MS Windows. Pick your choice of dimplomatic language.

However, per my sig, we're still stuck at somewhere between Web 2.x and Garden of Eden 3.X with Forbidden Things. This discussion we're having is "Privacy Revolt" at Web4.x which we do not see yet. However, if by some awesome chance you were to time capsule this and remember, I'd like to see what 5 years brings, after the first wave of more oppression.

Re:Great idea but not likely to happen

[dudpixel]

well, if a website can see the header and therefore choose not to track the info they already have...

why not reverse the behaviour and instead introduce a "TRACKING IS OK" header, where a website may only track the user if this header exists. That would be opt-in, and is how it should be.

Companies that want to track user preferences etc should require the users express permission first - and even then that permission should be on a case-by-case basis, not a blanket "I do/dont allow tracking". With this method, it seems that you either trust all websites, or none...although I'd imagine features will be added that make it selective based on the website or base domain.

Re:Great idea but not likely to happen

[lonecrow]

They don't need to be persistent cookies. Most websites use session cookies for provide stateful information while a user is logged in. And even if they offer a cookie for remembering me for my next visit so I don't have to log in again, they don't have to allow other domains the permission to read the cookie.

Re:Great idea but not likely to happen

[flonker]

It is a button. It's just not there by default. I have another person using my computer sometimes, and I've taught her to "push that button when the snake pops instead of whatever you want to see".

Re:Great idea but not likely to happen

[Omestes]

Google Search, Maps, Apps and Mail are all for-profit advertising-supported web services. Not much point in products that lose money.

Actually most of Google's non-adsense/adwords products are operated at a loss. It causes some hub-bub in the financial papers since they are pretty much a one trick pony. Basically all Google has going for it, revenue-wise, is serving ads and increasingly Android.

I have no personal stake in this issue. I just think it's important to appreciate the content provider's perspective in all this. No such thing as a free lunch

I understand this. Content providers should, first, go to pains to understand everyone else's point of view. You don't have the right to profit from your webpage, and I have the right to block content going through my connection. Perhaps content providers and users could come to some compromise someday.

It annoys me when people whine at me for not giving them money.

Ads, all of them, annoy me more. I will never, EVER click on your ad. Even if I'm interested in the product, I will go to the seller myself. Why? Because I'm at war with advertising. I'm sick of it, and would do about anything I can to screw advertisers over. I don't like the fact that I can go a block from my house without being inundated with ads, I don't like the fact that most television shows are 50% ads (wow, a 15 minute show with 15 minutes of ads!), I don't like how ads killed sports (the last straw was at the play-off game leading to the 2001 World Series, where they suspended live play so the television audience could have ads, while playing it in the stadium, where the minimum ticked price was at least $80, not counting $20 beer and $10 hotdogs).

I feel bad for web-content producers who think they should get some money for their work. They are collateral damage. But perhaps they should reevaluate their business, what are they actually producing? Can they make money some other way? Do they NEED to make money to make their hobby enjoyable (hint: it isn't a hobby then).

Sorry for the screed.

 

Re:Great idea but not likely to happen

[Terrasque]

sorry, my bad. It only use SSL / TLS for login, not for the actual data :(

Found a nice overview at http://news.cnet.com/8301-13578_3-9962106-38.html though. Seems like AIM (yikes), Google Talk (via download client or https web client) and Skype have encrypted chats.

Fast forward a year or two : "This guy must be a terrorist!" - "Why?" - "He use the google!"

Re:Great idea but not likely to happen

[ByOhTek]

Yes, because the criminal organizations often behind the worst of this stuff care *so much* about US sanctions against the country they are in.

Re:Great idea but not likely to happen

[ByOhTek]

Of two dozen or so people I've heard from (yeah, small group), you are #3 for whom that has worked.

Re:Great idea but not likely to happen

[ByOhTek]

Actually, you may be on to something

A trick someone I know did, was have a few entries scattered about the robots.txt file, some with nothing linked to them. After going to that link, the server is updated to send anyone from that IP address a 404 response on all requests.

I wonder if something similar could be done. It caught quite a few bots.

Re:Great idea but not likely to happen

[AuMatar]

Of the dozen or so I've hear from, you're the only one I've heard of it hasn't. Literally the only call I've gotten in the last ear (and I do mean literally, I just went through my call log) that wasn't from a known person (friend/family/coworker) are from headhunters when I was job hunting and from discover telling me my payment was late (which isn't a telemarketing call).

Re:Great idea but not likely to happen

[badkarmadayaccount]

How do you unblock Ad servers (namely google) in ABP? I know, I know - geek card and all that - I'm too lazy to screw with regexes.

WAT?

[Anonymous Coward]

"Mozilla's Firefox, a popular browser company"

Why bother

[wiredlogic]

What would be the point. It isn't enforceable and even if laws were passed, you can circumvent it by tracking from an offshore server.

Re:Why bother

[winkydink]

What would be the point. It isn't enforceable and even if laws were passed, you can circumvent it by tracking from an offshore server.

Sure. As long as you don't want to do business in the US.

Re:Why bother

[TheEyes]

What would be the point. It isn't enforceable and even if laws were passed, you can circumvent it by tracking from an offshore server.

Sure. As long as you don't want to do business in the US.

People still do business in the US?

Re:Why bother

[Anonymous Coward]

As long as you don't want to do business in the US.

A prospect that becomes easier and more appealing each day.

Re:Why bother

[Shotgun]

There's still some going on, but Obama is trying hard to finish us off. We may get that "healthcare" bill rolled back to get a little more breathing room, but it is doubtful.

Re:Why bother

[TheEyes]

There's still some going on, but Obama is trying hard to finish us off. We may get that "healthcare" bill rolled back to get a little more breathing room, but it is doubtful.

God I hope not. The last thing we need is a massive healthcare bust less than ten years after our massive banking bust.

That is where we were heading, before the healthcare bill passed, you know. Costs are skyrocketing; more and more people are being priced out of the market; those that haven't gotten out altogether were being forced into ever more exotic (read: complex and failure-prone) plans, etc etc. We just heard this tune with home loans; Obama could hear the opening notes with healthcare, and took steps to stop it in its tracks before its swan song.

Don't get me wrong; it's not exactly a good law. There's no single payer system, very little ability for government to force drug companies to lower their prices to what everyone else in the world has to pay (every other major industrialized nation has single-payer, and can usually dictate to healthcare companies what they will charge), nor is there meaningful tort reform. What they did was provide the minimum amount of reform necessary to prevent a healcare collapse in the next decade or so; hopefully by then enough Republicans will have died to let us get some meaningful reform passed.

At least they kept their paws off of the moronic idea of letting health care companies choose their own regulators; that was one of the big contributors to the banking problem, and is the only real result of letting companies sell across state lines like the Republicans want.

Re:Why bother

[Anonymous Coward]

What would be the point. It isn't enforceable and even if laws were passed, you can circumvent it by tracking from an offshore server.

Sure. As long as you don't want to do business in the US.

People still do business in the US?

Sure, it is still the worlds largest and most important consumer market. Chinas import is not even close. USA don't produce much of value to export (soy beans, rice, wheat, cotton and... yeah, that's pretty much it, unless you count stuff that is only assembled in USA so that it can get a "Made in USA" label), but US (pension funds, companies et.c.) owns a lot of assets that generate money abroad, so the people in USA can continue to consume a lot more then they produce and there is a lot of people living in USA. Aside for neighbour countries, USA is the biggest export market for my country (about 6% of the export and 0.1% of the import (mostly protein rich fodder and entertainment products), the second largest export market outside the neighbour area is China with about 3% of the export and 5% of the import) and most countries in the world is in a similar situation.

Re:Why bother

[Anonymous Coward]

Ah yes the health care bill that is almost exactly a carbon copy of that which was proposed by the Republicans to the Clinton administration in 1996.

But this one was sponsored by "the other lot" so now it's a travesty. I see.

Learn some history.

Re:Why bother

[Shotgun]

proposed by [some] Republicans

Fixed that for you.
I don't need to "Learn some history." I was there. It was just as much a travesty when it was proposed then.

Re:Why bother

[Shotgun]

Another one that thinks playing with insurance will do anything to reduce health care cost. God help us all.

A single payer system will NOT reduce cost. It will only allow the Feds to ration what exists. You decry "complex and failure-prone" plans, and you want to replace that with the hundreds of thousands of pages of legislation that the US Federal government would spew out?

Damn. Just, damn.

Re:Why bother

[TheEyes]

Another one that thinks playing with insurance will do anything to reduce health care cost. God help us all.

A single payer system will NOT reduce cost. It will only allow the Feds to ration what exists. You decry "complex and failure-prone" plans, and you want to replace that with the hundreds of thousands of pages of legislation that the US Federal government would spew out?

Damn. Just, damn.

The US spends one and a half times what the average country does on healthcare, and we have a lower average lifespan. Whatever you may think of certain bad apples like England's famously wasteful (yet still one-third as expensive as ours!) single-payer system, it's clear that we are not well served by our current, poorly-regulated mess.

A lot of the problems in our country stems from this quixotic and simplistic belief, cultivated by fifty years of Republican campaign shilling, that private industry can do no wrong and that nothing the government does can ever be good. This slogan is absurd: government does have a proper role in our nation's success, as the neutral arbiter upon which a free market is built. Removing it from that position as we have in the past several decades, first by favoring particular industries with the construction of public-enforced monopolies like the military-industrial complex, national telcom monopolies, and ever-more powerful copyright and patent laws, and later by removing necessary regulation of industry on the orders of powerful lobbying groups, has largely contributed to most of our recent economic troubles.

Right...

[Pojut]

...because the do not call list totally works.

All kidding aside, I'm sure something like this would work for a little while, but just like the do not call list, advertisers will find some way around it. By the way...advertisers? When you call me or spam me via email, I make sure to AVOID your products...and I'm confidant I'm not the only one.

Re:Right...

[Pojut]

Confident, even!

Re:Right...

[Phrogman]

You are not the only one. When I get saturated with advertising for a product - I remember the product, and avoid buying it afterwards. So they achieve their goal of having me remember their product, but they also piss me off so much I won't ever be a customer.

Advertising is just Capitalist propaganda.

Re:Right...

[Anonymous Coward]

...because the do not call list totally works.

It works pretty well. My junk calls have dropped by 80%+. Now it's charities, politicians, surveys, and the occasional scammer: "Card Services" offering to lower my CC rates, companies wanting lower my mortgage, test my water quality, "free" travel to attend time share presentations (time shares are a scam), etc....

Re:Right...

[Anonymous Coward]

The Do Not Call list worked like a charm for me. I signed up as soon as it went live. I used to get 3 or 4 calls a day from spammers, now I might get one a week.

This Do Not Track would probably work for the major guys which is who I'm really worried about anyway. Google, Microsoft, Amazon, Apple, my ISP, [Insert_Big_Evil_Corporation_here], etc. would probably honor it, they're too big not to and they're the ones I'm most concerned about (especially Google).

Re:Right...

[Riceballsan]

People like you and me may reverse our purchasing decisions based on our view of politics and such. Same reason I will never buy a PS3 or anything from sony (actually my sony boycott began way back at the rootkit CDs incidents). However you do have to keep in mind 99.999999% or so don't care. Hell even the friend of mine who's computer I spent a weekend fixing after the sony rootkit mixed with a virus on his computer, owns a PS2 and a PS3 now, hell he still buys sony music CDs.

Anyway all this ranting is giving me a headache,
I need to go buy some head-on and apply it directly to my forehead.

Re:Right...

[Belial6]

While the 'Do Not Call List' has not been 100% effective, it had turned the tide dramatically. The number of telemarketing calls I get went from 2-3 every day before the list was implemented to 2-3 per month after. That's not bad. Of course, that is not counting the political spam that got a free pass on the 'Do Not Call List'.

As much as people here on Slashdot like to complain that this flag would do no good, and point to the 'evil bit' proposal as a joke, they seem to forget the robots.txt that seems to have been pretty darn effective. Specifically telling sites that you do not agree to be tracked sets a non-legal boundary to start a discussion. Illegal is not the same as evil. It is perfectly acceptable to avoid businesses because of evil behavior. Right now, you can't really get a consensus on tracking being evil. Most people would be able to agree that tracking someone when they explicitly requested not to be tracked is evil. While being directly and demonstrably linked to a specific evil act might not matter to the small website, bigger sites might find it less appealing. If, and this is a big 'if', ad revenue drops more from bad publicity for tracking than it does from using non-tracking advertising, larger sites might choose to use the non-tracking version.

There seems to be a weird myth on the internet that one must track to advertise, even though TV, magazines, billboards, etc, etc... have been advertising for generations without tracking. Somehow, even people that should know better have fallen for the "it's totally different because it's ON A COMPUTER" when it comes to ads.

Re:Right...

[Lazareth]

Unfortunately, while you're not alone, you're still a statistic anomaly. Bad exposure is still exposure. Statistics shows that it is way better to piss off a few who abhor aggressive advertisement anyway in favour of many people remembering your product. So long as you don't do anything distinctly alienating to your target group, you're golden if they first think of your product before any other product when considering bying that kind of product.

Re:Right...

[harks]

I've never gotten a telemarketer call in the years I've been on the list.

Re:Right...

[Fwipp]

99.999999%? I didn't realize there were less than a hundred people that cared. It'd be nice if this vocal minority would calm down, and let the rest of us rest our ears a while.

Re:Right...

[EdIII]

The DNC totally works. The question is why does it work.

Speaking from experience here, the last time I checked a single infraction of the DNC cost $50,000. You have be able to show you checked that number you called against the DNC within the last 30 days, although I think it has recently been squeezed down to 2 weeks.

First thing you may be thinking is.... "Oh but they will just move all of the calls to an offshore call center". They already did this a long time ago. It is much cheaper to operate a call center in the Philippines.

Why the DNC has teeth is that the people that operate it will find out the U.S companies that are profiting from it and nail them instead. Whatever legal liability benefit they get from making the phone call from offshore was gone a long time ago. That's why all those scams got nailed hard and the companies shut down and all of their bank accounts and merchant accounts frozen.

It is working. I get practically no telemarketing calls at all and I have been on the DNC since it started.

You can't compare the DNC to this proposal. Until the organization that operates this can investigate tracking companies, and even small websites, and nail them with thousand dollar plus fines per infraction it would be completely meaningless and ineffective.

The best way to fight tracking is with technology, not politics and regulation. The reason why is that the government never gave two shits about telemarketing companies and their scams. Google on the other hand....... I expect fine examples of government corruption and double standards from that situation. Thinking that a header is going to really stop tracking by all the companies in the U.S is a pipe dream at best, foolish ignorance most likely.

Although, I could be wrong. If the government puts teeth behind this it could work, just like the DNC.

Re:Right...

[maxume]

It isn't a weird myth, advertisers are willing to pay more when they get analysis of who saw their ad.

Re:Right...

[Greyfox]

Works for me. The only calls I ever get are from hispanic auto-dialers demanding a ransom for a family member.

Re:Right...

[Belial6]

Yes, it is a myth. While advertisers are willing to pay more when they get analysis of who saw their ad, if that analysis becomes unavailable, it does not mean that advertsing cannot be done on the internet. No doubt advertisers would pay more for similar analysis of who saw their billboard along the freeway.

Re:Right...

[Mordok-DestroyerOfWo]

Count me in too. My biggest gripe is people who put fliers under windshield wipers. I make it a point, not only to not visit those establishments, but to give negative reviews on Google for the very act.

Good idea

[Anrego]

The problem is that sites would be justified (imo) to then not offer you service based on this.

“We support this site with ad revenue. Tracking is part of that. No Tracking, no service”.

This is fine really. People aren’t entitled to web content. In many cases your privacy is what you are trading for it, and you should be made aware of this and have the option to decline. This kind of header (and possibly others like it) would let you specify in what you are ok with, and let a site then decide whether it’s enough to grant you access.

The problem is that people don’t like this... they want the privacy _and_ the content.. so people would probably just go back to using ad-blockers and cookie deleters as soon as they start getting rejected access messages.

Of course the opposite could happen as well. Web traffic could plummet as everyone enables the feature.. causing a site owner to re-think whether web tracking makes sense for them.

Personally I don’t mind being tracked. Somewhere out there, someone has a very detailed profile of what makes me tick.. and really it’s not doing me much harm that I can see. I read an article about raising my new pet dog and I every other ad I see for the next 2 weeks is about obedience training.. creepy but doesn’t hurt me. This is a personal decision however, and I think people do have the right to be paranoid about their data and should have the option to opt out.

Re:Good idea

[eepok]

This was my initial response. Ad revenue is what makes the interest free (beer and speech). The site producers can pay little/no out of pocket expense to pay for hosting due to ad revenue and since they're not requiring SPECIFIC sponsorship, they do not have to follow the whims of their sponsors with their content.

I want my privacy but fully understand the value of advertising for the internet I love. So, I allow tracking... until I turn off my browser... when all my cookies and temp files are wiped. That's my happy medium. I allow advertisers to know that in the early morning, my browser surfs slashdot, google news, and whatever articles within. However, when I close my browser, that's the end of "string" of consecutive data for them. I'll allow the tracking of sessions, personally, but not me in my entirety.

Re:Good idea

[Americano]

Good points. A lot of the "online tracking" that people seem to get so wound up about is simply allowing advertisers to target interested people with their advertisements more directly. If I spend a lot of time researching and reading about guitars (something I did recently), and I end up seeing lots of ads related to music - lessons, instrument sales, instrument service, sheet music... I really don't see a problem with that.

There are a handful of sites that I would pay a subscription fee of a few bucks a month for an ad-free / no-tracking option (Facebook, Gmail, maybe one or two others), but for most web sites, I don't begrudge them their ad revenue.

Re:Good idea

[Jahava]

The problem is that sites would be justified (imo) to then not offer you service based on this.

“We support this site with ad revenue. Tracking is part of that. No Tracking, no service”.

This is fine really. People aren’t entitled to web content. In many cases your privacy is what you are trading for it, and you should be made aware of this and have the option to decline. This kind of header (and possibly others like it) would let you specify in what you are ok with, and let a site then decide whether it’s enough to grant you access.

The problem is that people don’t like this... they want the privacy _and_ the content.. so people would probably just go back to using ad-blockers and cookie deleters as soon as they start getting rejected access messages.

Not necessarily. By adding support for the header, an opportunity is created to write into law that advertisers (and content providers) must not track requests with this header present. Failure to do so can be penalized similarly to the "do not call" registry, with fines and/or jailtime. However, people who avoid advertisements via ad-blocking software will not be beneficiaries of such a law, and, accordingly, will never have a legally-binding guarantee that they aren't being tracked.

Like you said, advertising-based sites will likely deny service, serve a lesser ("lite") version of their site, and maybe offer an ad-free membership option that can be purchased. I agree with you; this is understandable, since they are ad-revenue sites.

Users will have three choices:

• Omit the header ads and be tracked, but have access to ad-supported sites.
• Include the header, be comfortable knowing you are not being tracked, have a legal avenue to pursue if you are, and be denied access to ad-supported sites.
• Omit the header, use ad-blocking software, and be tracked while avoiding the ugly ads without any legal avenue to pursue the tracking.

This benefits both the consumer, who can now clearly state their intention and have it be legally binding. It also protects the content provider and advertisers; they can read the user's intent and know for sure whether or not their tracking and advertisements are legal, and now they have an option to offer a reasonable path to a paywalled service, as the user has to explicitly acknowledge the ad-supported nature of the site. For now, I feel that this is a great idea, and (for what it's worth) I'd likely choose the omit/ad-block path.

Re:Good idea

[Anonymous Coward]

This would be ideal, but it will never happen. Marketing, it seems, relies on ignorance of the masses. If there's any way for them (in this case: marketeers) to get away with tracking you without letting you know, be sure that they'll find and exploit it. It's not about "rules". It's about gaining a perceived advantage by any means necessary. "Rules" is a word naive people like to use to delude themselves into a sense of false security.

Re:Good idea

[Anonymous Coward]

This is already done with current technology to detect Adblock users and show them either only a portion of the content or lock them completely out. I (and others) provide this service to multiple clients out there.

Re:Good idea

[Anrego]

Oh I'm sure lots of advertisers would just ignore the header.. and probably even use it as a datapoint, but if enough of the really big ones (aka google) implement it, would really take the teeth out of online tracking.

Re:Good idea

[Anonymous Coward]

I don't know about you, but I find that any content that is offered only for the sake of advertising and tracking is completely substandard (i.e. junk). Maybe you prefer silly cartoons or the latest hot (and empty) gossip, but content that is truly worthwhile and valuable usually is presented with no strings attached.

Re:Good idea

[houghi]

They would be justified to do that right now. I use DNS filtering, Blockad and the use of my own CSS files for some sites.
And yes, people want privacy AND the content and that should be possible as well. It used to be that content was what people wanted to show and used adds to pay for bandwith.

Now the content is just something so they can have more income from adds and users are the product they are selling. Tracking has not done anything for the customer. It is, at best, just a means of WHAT commercials you see, not how many.

Not one has said: "Well, this person is only interested in dog training, so let's NOT show him anything but that. In fact let's not show him anything at all."
So if they must force advertising upon me, I am as much interested in female hygiene products as I am in the latest Linux distribution, when it is an add. So no reason to do any tracking whatsoever.

Re:Good idea

[Anonymous Coward]

Half the web will transition to the days of paid-services and not the "cheapo sites" with banners "everywhere".
Oh, wait, that's right, having accounts linked directly to bank accounts is WORSE IN EVERY SENSE OF THE WORD.

Mozilla are idiots, plain and simple. This idea is significantly worse.
At least with the current system, i can just erase my damn cookies. With this? Yeah, good luck getting rid of bank account traces from advertisers!
Perhaps they should learn people how to erase cookies instead of coming up with even more ways to ruin the already-hacked-to-pieces HTTP protocol!

Or, better yet, maybe people should stop being morons who think they actually have privacy when there are more documents per person out there in the real world than there is online.
God forbid these people were to find out the amount of information their head has just by being part of society, said head would implode.

People don't know what they want. I hate people. They can never make their damn minds up.
I almost wish the whole web, or a good chunk of it, would move over to paid service, then the idiots can go there and i don't need to hear about their whining since they are pay-walled in their little gardens of even less privacy.

Re:Good idea

[Anrego]

I somewhat disagree, but it's irrelevant. You could enable this header and happily browse the puritan internet.

I agree.. most sites who's primary purpose is to drag you in so you can see their wall of ads tend to suck, and some of the best source of information have a /~someusername/ in the URL ..

But there are several sites that really do dump the money back into producing content and/or paying the insane bandwidth/hardware costs that come from running a really popular site. There are even a few that I pay a (non-trivial) subscription to.

Re:Good idea

[Captain Hook]

Identifiable tracking and displaying adverts on a web page are different things, I have no problem with ads being displayed on a website so long as they aren't popups/unders, I don't even mind too much the idea of any one site keeping a record of what interests me within the site. For example, I don't have a problem with Slashdot knowing I tend to read stories which have been tagged YRO, Politics and to a lesser degree Gaming and using that information to tailor adverts from the ad networks.

It's the tracking database where they know every click I've made since I started getting ads from any particular advertising network, across every site I've ever visited, consciously or by accident or by malicious redirect that I have a problem with and knowing that that information is never going to go away... ever. Personally, if I knew that the data would be gone after a few years, I would have a lot less problem with the idea of tracking.

Re:Good idea

[Hazelfield]

I don't agree with you. In fact, I think we should have legislation that explicitly forbids arbitrary collecting and tracking of private information.

We're on a dangerous path if we allow anything as long as it's voluntary. Don't like to be tracked? Just don't visit the site! But what happens when more and more sites come with privacy policies that you don't agree with? You might not be able toavoid them all. Chances are you're required to have a Facebook or Google account to keep your job, and suddenly it's not all that voluntary anymore.

Sometimes I don't get how the same people who worry about government snooping and Big Brother happily put their entire life on Facebook for everyone to see. You should be less worried about the FBI and more worried about Facebook who owns your photos, Google who can read your mail and your local supermarket who knows what you buy and when. These aren't trivial issues. You should think about them.

Re:Good idea

[Anrego]

Facebook who owns your photos, Google who can read your mail and your local supermarket who knows what you buy and when.

This is where the whole "personal decision" bit of my post comes in. I actually don't have a problem with any of that (I don't have a facebook account.. but if I did.. they can have my pictures.. even the one of me in a toga at that party), but obviously some people do care about this stuff.

Privacy nuts think that everyone should be paranoid about their data.. they arn't. Social networking has taken off because people love to spout out their whole lives for everyone.

I agree these are things everyone should think about and make a decision on what info they are ok with giving away.. but I think "they can have it" is a valid response for a _lot_ of people. Just because you've come to the decision that your preference in tomato soup is no ones business doesn't mean others are going to share the sentiment.

I'm more for legislating that sites have to be forthcoming, and offer some kind of opt-out (like this header would provide). I honestly think if facebook had a big "look.. we take all your data and sell it to people so they can sell you junk.. and we give you farmville" sign when you signed up, people would read it, nod, click ok, and get on with their life.

I'm also all for legislation that would put limits on how long the data can be stored for.

Chances are you're required to have a Facebook or Google account to keep your job

Nope. Probably happens, but I've never seen that.

Re:Good idea

[Hatta]

A lot of the "online tracking" that people seem to get so wound up about is simply allowing advertisers to target interested people with their advertisements more directly.

Yes, it allows the advertisers to lie more effectively so they can bilk you out of more of your money than they could otherwise.

If I spend a lot of time researching and reading about guitars (something I did recently), and I end up seeing lots of ads related to music - lessons, instrument sales, instrument service, sheet music... I really don't see a problem with that.

If you care about your instrument, wouldn't you want to base your decisions on information from unbiased sources? How does it benefit you to inject biased information into that process?

Re:Good idea

[Americano]

Yes, it allows the advertisers to lie more effectively so they can bilk you out of more of your money than they could otherwise.

How so? How does me knowing that the model of guitar I'm looking for is available from some out-of-state dealer (who's offering free shipping, to boot!) for about 10% less than I can find it near where I live bilk me out of money?

The act of advertising a service, or a product, is not intrinsically evil. And the act of connecting businesses advertising a product or service with customers who are more likely to be looking for that product or service means two things:
1) People not looking for that product or service are less likely to see those ads and have their time wasted by nonsense;
2) Advertisers have to spend less money connecting to the people who are interested in their products or services, which has a long-term effect of lowering prices through competition.

Fraudulent advertising is evil. Basing your purchasing decisions on nothing but advertising decisions is foolish. But using advertisements as a piece of information in the overall research and decision-making process? Whyever would you consider that to be a bad thing?

If you care about your instrument, wouldn't you want to base your decisions on information from unbiased sources? How does it benefit you to inject biased information into that process?

How is it being injected into the process? In the course of doing my research, I decided to buy a particular Yamaha guitar, based on the reviews I found in several and my own experience with them.

So... I know the model I want, and now I want to look and see if I can find a good deal on it, and perhaps find people in my area who offer lessons and supplies... why wouldn't it be helpful to be able to compare prices of vendors who do business both online, and in my area? In some cases, the advertisements I've found are for businesses that I had no idea even existed, because they're miles away in towns I rarely visit - but easily found once I know they exist.

I don't just type in "buy a guitar" and click the first ad that comes up - and frankly, the people who would do that are gullible buffoons who need no help from advertisements to spend foolishly.

Re:Good idea

[lennier]

Somewhere out there, someone has a very detailed profile of what makes me tick.. and really it’s not doing me much harm that I can see.

That's what you think now, but when Google's android doubles start replacing us all with very small wget scripts, don't say you weren't warned...

This idea is dumb

[Anonymous Coward]

Just proposing the idea is damaging to Mozilla's already floundering technical credibility.

Re:This idea is dumb

[Anonymous Coward]

I guess this is what happens when you spend more energy shuffling around your political entities and personal titles than on technical innovation. Mozilla is the KDE of the browser world.

(replying to myself)

RFC 3514

[barko192]

Basic idea seems the same, right? http://www.faqs.org/rfcs/rfc3514.html

Re:RFC 3514

[coolsnowmen]

I don't even have to click the link- That is exactly what I was thinking. In fact it makes trackers jobs easier. Even if the user refused all cookies and flash cookies etc, a browser is almost uniquely identifiable by all the other stuff it sends with each request: plugin versions, browser ID strings, ip, every thing you don't allow to be sent, and now this. Every element you add to this vector increases an intelligent company's ability to track you weather you like it or not.

Re:RFC 3514

[PseudonymousBraveguy]

no no no, it's almost, but not quite, entirely unlike the EVIL-bit. The Do-Not-Track header is set by the client, so it would be more like a PLEASE-DO-NOT-ATTACK-bit in every message to a possible attacker.

Re:RFC 3514

[Rob Riggs]

Hey... all my packets have that bit set.

STOP! Or I'll say STOP again!

[Anonymous Coward]

This tag would be entirely worthless because no one would be forced to anything but discard it.

Rather than this useless addition, why not have the browsers just not send the information in the first place? Or would that make too much sense?

Pointless

[Angst Badger]

All this will do is provide another data point for marketers.

Re:Pointless

[Pojut]

I can hear the board meeting now.

"Well sir, our numbers indicate fourty-six million people out there are using the "do not track" header...we think that's a great base to start our 'Tired of Being Targeted?' ad campaign..."

Re:Pointless

[chichilalescu]

I laughed for at least a full minute.
Anyway, when I realize that some people would actually say that and mean it, I can understand why americans like to have guns. "Second Hand Lions" (good movie by the way) had a pair of loonies who regularly shot at traveling salesmen.
one of the reasons I love slashdot is that it's the place I found out about noscript.

Re:Pointless

[Pojut]

On an unrelated note, the PDF you linked to in your sig is pretty good! I myself have been using short(really short, lol) stories as practice for a larger story arc I'm writing. Each story focuses on a specific writing technique, just so I can tool around with it. I currently have one of them up on Scribd...free to read, free to download (although I still need to add the CC stuff to it.) Check it out, if you like.

It's about a zombie slowly coming back to life. There's zero dialogue throughout all three pages (I needed to practice with descriptions of events and locales, from a god's eye view.)

Re:Pointless

[Jonner]

How could something that creates a point be pointless?

Re:Pointless

[trancemission]

I suggest you check out Bill Hicks marketing dollar routine http://www.youtube.com/watch?v=gDW_Hj2K0wo

a couple more minutes of laughter ;)

Re:Pointless

[Pojut]

That was the inspiration for my post :)

Great idea!

[Locke2005]

This will obviously be just as effective as the IP header evil bit proposed in RFC 3514!

Don't track me bro

[Culture20]

The "don't tase me bro" kid got tased anyway.

"Mozilla's Firefox"

[supersloshy]

Mozilla's Firefox, a popular browser company

...Do I even need to say what is so wrong with this?

Eh, I will anyways:

• Mozilla is a non-profit organization (though they do have a subsidiary named Mozilla Corporation, the profits from that go directly to Mozilla Foundation)
• Firefox is a browser, not a browser company; they're thinking of Mozilla Corp/Foundation

Given how popular Google and Wikipedia are these days, mess-ups like this should have completely vanished by now.

Re:"Mozilla's Firefox"

[Anonymous Coward]

"Mozilla's Firefox, a family of partially related browser products"

FTFY

Re:"Mozilla's Firefox"

[Shotgun]

Unfortunately, for "mess-ups" like this to vanish, the vast majority of people would have to care. They really, REALLY, don't.

fun

[albertowtf]

fun ff addon... dont leave homepage without it https://addons.mozilla.org/7en-US/firefox/addon/refcontrol/

Re:fun

[LeRaldo]

I use this addon, and it works great.

Re:fun

[albertowtf]

you can even change your referer to disney.com/animal-pron to mess up stadistics :D

(or microsoft.com/linux)

Already exists.

[Civil_Disobedient]

They've already developed a "DO NOT TRACK" bit, but you might have missed it because it's labeled different: it's called "DO NOT VISIT."

Why do people get so fundamentally stupid about the web in particular? If, for example, every store you visit tracked your comings & goings and your purchase history, would you still scream bloody murder? NO, because they all already do this and nobody seems to give a rat's ass. But on the Big, Scary Internet the rules are somehow all different.

Re:Already exists.

[Mr. Slippery]

If, for example, every store you visit tracked your comings & goings and your purchase history, would you still scream bloody murder? NO, because they all already do this and nobody seems to give a rat's ass.

Pardon? I would indeed be upset if every store I visited tracked my comings and goings and purchase history, especially of they coordinated with other stores to build a profile in order to figure out how best to manipulate my purchasing preferences. That's why I usually pay cash, and never use one of those "please spy on me" (a.k.a. "customer loyalty") cards at any chain store.

There are a handful of independent businesses that I frequent where I know the owners or employees and they know me and my preferences -- great, that's a symmetric and respectful relationship. Doubleclick sneaking cookies on to my browser so they can sell my habits to the highest bidder, is not.

Re:Already exists.

[Zangief]

Because advertising is annoying.

Believe me, if I could wear magical glasses that adblocked ads in real life, I fucking would.

Re:Already exists.

[Jonner]

If someone at Wal*Mart headquarters knew every time I entered or exited a Wal*Mart anywhere in the world regardless of whether I bought anything and how I paid for it, that would freak me out. They do not have the technology and/or manpower to do that. Even if they have centralized access to all security camera footage from every store in the world (which is extremely unlikely), software cannot easily tell when the same person appears on different cameras.

Though a retail store or chain can certainly track my identity via a credit card number, I can also use cash to pay for things in any physical retail store, which leaves no record of my identity.

Re:Already exists.

[GrumblyStuff]

Are you sure you want to do that? You might not like what you see.... http://www.youtube.com/watch?v=7Lwlx3GnLGs

Already exists?

[mukund]

Using Firefox + Adblock Plus + NoScript:

No. Time Source Destination Protocol Info
          27 3.918190 10.4.12.92 216.34.181.48 HTTP GET /story/11/01/24/1657252/Mozilla-Proposes-Do-Not-Track-HTTP-Header HTTP/1.1

Frame 27 (582 bytes on wire, 582 bytes captured)
Linux cooked capture
Internet Protocol, Src: 10.4.12.92 (10.4.12.92), Dst: 216.34.181.48 (216.34.181.48)
Transmission Control Protocol, Src Port: 34619 (34619), Dst Port: http (80), Seq: 1, Ack: 1, Len: 514
Hypertext Transfer Protocol
        GET /story/11/01/24/1657252/Mozilla-Proposes-Do-Not-Track-HTTP-Header HTTP/1.1\r\n
        Host: tech.slashdot.org\r\n
        User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.12) Gecko/20101027 Fedora Firefox/3.6.12\r\n
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n
        Accept-Language: en-us,en;q=0.5\r\n
        Accept-Encoding: gzip,deflate\r\n
        Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n
        Keep-Alive: 115\r\n
        X-Do-Not-Track: 1\r\n
        Referer: http://slashdot.org/\r\n
        Connection: keep-alive\r\n
        Cache-Control: max-age=0\r\n
        \r\n

Oh and Slashdot, how the heck am I supposed to post on your system when I'm behind my ISP's NAT and someone else has already beat me to it?

Re:Already exists?

[Anonymous Coward]

Oh and Slashdot, how the heck am I supposed to post on your system when I'm behind my ISP's NAT and someone else has already beat me to it?

Probably by not having such a shit ISP.

Re:Already exists?

[kelemvor4]

Sorry, only one voice per ISP at Slashdot today :)

Re:Already exists?

[prichardson]

Oh and Slashdot, how the heck am I supposed to post on your system when I'm behind my ISP's NAT and someone else has already beat me to it?

Look for an ISP that gives you a real IP address?

Re:Already exists?

[Anonymous Coward]

Complain to your ISP, move to another ISP or crusade IPv6. Slashdot isn't the problem and is under no obligation to resolve it for you.

Re:Already exists?

[Anonymous Coward]

Noscript implemented X-Do-Not-Track already, and has it enabled by default. This article is about it being introduced to vanilla Firefox.

Re:Already exists?

[vlueboy]

Oh and Slashdot, how the heck am I supposed to post on your system when I'm behind my ISP's NAT and someone else has already beat me to it?

/. security is very annoying.
Here are the proposed solutions:

1. Web Proxies
2. SSH to a different ISP's PC under your control
3. Nuke your ISP from orbit.
4. Nuke slashdot from orbit. (It's the only way to be sure)

Re:Already exists?

[Anonymous Coward]

Why are you running an out of date version of Firefox?

https://www.mozilla.com/en-US/firefox/3.6.13/releasenotes/

What’s New in Firefox 3.6.13

Firefox 3.6.13 fixes the following issues found in previous versions of Firefox 3.6:

        * Fixed several security issues.
        * Fixed several stability issues.

Oh NO!

[Arancaytar]

Spammer: "How shall we ever continue our illegal data-mining now that people can ask us nicely not to abuse their privacy?

Our evil plan is foiled!"

Seriously?

[mounthood]

This seems like a bad joke - the "Evil bit" but for http headers. It must be a political move, trying to set the boundary for debate.

If this is serious it's a terrible idea: it'll be on by default for everything so it's not a compromise (and could therefore be done with laws banning the tracking); all older software that doesn't send this header would be fair game; sites will simply refuse content unless you turn it off (see AdBlock).

Who? What? When?

[Anonymous Coward]

Not sure if this is a Mozilla originated proposal or not. Could someone familiar with the issue summarize events since Sept. 2010?

http://33bits.org/2010/09/20/do-not-track-explained/

http://donottrack.us/

http://hackademix.net/2010/12/28/x-do-not-track-support-in-noscript/

Re:STOP! Or I'll say STOP again!

[by (1706743)]

Rather than this useless addition, why not have the browsers just not send the information in the first place? Or would that make too much sense?

Well, that would make cookies useless...but then, as you're an AC, perhaps you don't believe in cookies ;)

How long before this is a fee based service?

[realsilly]

If airlines can charge a passenger for luggage to fly with them for your vacation, how long before websites or browsers sell you this as a service or charge it as a fee to use their service.

I detest that everywhere I turn there is some sort of Advertising shoved down my throat. And as a citizen of the US, I would like to see the citizens stand up for our civil rights a bit more and tell the corporations and the government to back the heck off. It reminds me of the movie Wall-E. As you see Wall-E traverse the area he works, there is nothing but advertisments everywhere. Are we really headed there?

Why must every product I purchase now force me to see and ad for something else? /sigh

Re:How long before this is a fee based service?

[Reziac]

I think this huge expansion of the ad industry is inversely proportional to other industry that produces actual goods for sale -- we've lost so much of that to the 3rd world, there's nothing left to sell but *potential future sales*.

Size matters

[Anonymous Coward]

It doesn't have to be 100% effective. The biggest trackers are Google and Facebook. They are large companies that need to comply with the law and with standards.

Obviously something like this is useless if even Facebook ignores it but otherwise it would be quite a handy supplement to my array of NoScript/Adblock+/Ghostery. Sure, many smaller, less reputable companies will ignore it but when it comes to tracking, size matters.

O RLY?

[DragonWriter]

Advertisers and tracking services will fight this to the bitter end.

Google, as well as other major online ad and tracking services, already support "Do Not Track" mechanisms with similar functionality.

Re:O RLY?

[Unequivocal]

Plus an alternative is already being proposed for a federal rule or regulation: http://www.ftc.gov/opa/2010/12/dnttestimony.shtm

I like their way better which would work along the lines of a the central "do not call" registry. I register in one place and advertisers must wash their lists against these users. With an http header, I think the burden is higher to implement b/c you have to integrate it into your webstack. With a registry, you can keep all the data, but must wash it before you use it give it to the marketing dept for analysis. Seems easier to me anyway.

Re:O RLY?

[aix tom]

It would be pretty trivial to built it into your web application. One IF clause at the part that saves the tracking data to check for the header. No duplication of data in washed / unwashed form with loads of replication and permission structure necessary. No "Check against central registry" in real-time every time a page with ads loads, which would be a *mayor* logical and logistical headache.

From the users point of view:
No need to sign up at some central place. No need to send your user id of that central registry to every web site, so that they can track you even more easily when they decide to ignore it anyway.

Re:O RLY?

[Anonymous Coward]

I'd prefer a solution which doesn't only work in countries where certain legislation has been passed.

Re:O RLY?

[Unequivocal]

Tracking data is often saved passively (by layers deeper in the stack - SQL, web server, etc) not actively - so it's not in the business layer near the HTTP headers, where you can put in an "IF" statement, at least in my experience. A lot of it is dumped in various logs that you can't always get a hold of easily while you have the HTTP context available, to prevent them being written. And you could push the HTTP headers or at least that one deeper into the stack for logging too, but that could involve some substantial engineering for some websites.

But I get your point that for stuff that is specifically marketing driven (like write an email to a database) if you see the DO_NOT_TRACK headers in the HTTP, then you just don't write the entry - pretty simple.

Re:O RLY?

[Anonymous Coward]

which would be a *mayor* logical and logistical headache.

Yes, if you're asking the Mayor to get personally involved in every decision, I could see how this could be a headache. :)

Re:O RLY?

[Joe Mucchiello]

So explain to me how this works. You register at the government website and say I don't want to be tracked. So how do the law abiding companies use that information when you are logging into cnn.com to read the news? Do you, perhaps, get a token from the government that you have to send to cnn to prove you are on the list? Is this token unique to you? Hmm, so a unique token is given to all websites that is "not used to track information about you." Ri-i-i-iight!

Re:O RLY?

[Unequivocal]

Not that much different from sending along a do-not-track http header with your IP, is it?

I was also under the impression that you could register at FTC ,if this was implemented, and advertisers would have to "wash" their tracking databases of any users listed there (users defined how, I don't know, maybe email). It doesn't stop the bottom feeders who won't pay attention to this database. At least in the telco space, the do not call registry has made a significant impact on telemarketing calls for folks who bother to register. Some fly-by-night telemarketers ignore it, but most legit ones actually play by the rules. I expect the same here -- legit big companies will wash their databases and remove your info.

Re:O RLY?

[anarxia]

Tracking is usually cookie-based (ie uses information in the HTTP headers) so an HTTP header is the only logical place to specify that you do not want to be tracked. Web server logs are not suitable for tracking. At most they can tell you where the user came from (referrer) an ip and what he requested. Using only that information is very unlikely that any advertiser will be able to track you since the ip might be a company router, an ISP web proxy, an anoymous proxy etc etc. Even if tracking information is batch updated from huge web server logs that contain http headers the advertiser can check for the header and not save the information. Technologically the idea is solid.

Re:O RLY?

[anarxia]

I forgot about user agent :) but you get the point

Much simpler way

[shish]

If you don't want anyone to know your IP address, just stick 0.0.0.0 into the IP "source" field. Just as realistic, and far more effective than spamming your details then politely asking people to forget them.

Re:Much simpler way

[Anonymous Coward]

As the owner of 0.0.0.0/0, I hereby request that you cease and desist in distributing our IP.

Hereby I propose the "Do really not track" header

[Anonymous Coward]

...and

• the "Do REALLY not track this time" header
• the "Do REALLY not track this time, honestly" header
• the "Do REALLY absolutely not track this time, honestly" header
• the "Do REALLY absolutely not track this time, honestly, seriously" header

Quickly: What's wrong with that?

Welcomed!

[hesaigo999ca]

A nice feature that will be welcomed if they can push to have it standardized by everyone, especially M$

Good idea

[countertrolling]

Now all I have to do is track all the "do not track" headers.

UNENFORCEABLE

[Anonymous Coward]

Unenforceable rules are useless!!!

Evil Bit

[The MAZZTer]

With a penalty behind it (a la Do Not Call) it could work, otherwise it's about as effective as the TCP packet evil bit.

Personally I would encourage people to proactively block advertisers using existing tools such as AdBlock and NoScript. That way you don't have to trust the advertisers not to track you.

Re:Evil Bit

[Anonymous Coward]

Blocking is great.. but have you ever...written something that looks for ad cookies and...starts scrambling uuid-looking data in them? Blocking data will just cause people to look for more inventive ways to screw with you. If you corrupt their entire database, you might actually cause some real financial losses once their database query shows 7000 people behind one IP.

Of course, your browser still doesn't actually have to render anything...

Re:Evil Bit

[udoschuermann]

Re: Penalty ... You know they violated the Do Not Call list when you get a spam call.

But when and how are you going to find out that they tracked you anyway? And who is going to check their databases, verify that you actually didn't want to be tracked at the time they received that HTTP header, and then holds them accountable?

Penalty or no penalty, it'll work as well as the spam crawlers honoring the /robots.txt file ... anyone remember that one?

1 of 2

[Dreth]

This could be a huge turn for companies that make a living out of the loopholes of the Internet from yesteryear, which can either stop doing their data-mining or change they way they do their data-mining. Quite possibly a more obtrusive way.

OR

This could just be a placebo, so that us semi-geeks (the ones that read these things and are aware of them but aren't really attracted to ACT upon it) can sit back and look at the rest shut up about it for a little while.

Cat got my tongue.

[Anonymous Coward]

I would track those with the header set even more.

Re:STOP! Or I'll say STOP again!

[Anonymous Coward]

Rather than this useless addition, why not have the browsers just not send the information in the first place? Or would that make too much sense?

Well, that would make cookies useless...but then, as you're an AC, perhaps you don't believe in cookies ;)

A lot of the information in cookies is not necessary for them to serve their function.

Why spend time ideas unlikely to succeed

[oobayly]

You still have to trust the host not to track you.

As an aside, what I *would* like to see is an attribute added to the tag which allows you to specify the IME for mobile devices. It's not to much to ask for is it?

It's a politcial solution, not a technical one

[guanxi]

This is a great idea. Other posters are right that website operators won't be technically forced to respect the Do Not Track request, but this is a political solution, not a technical solution, and politics is how this needs to be resolved.

Currently, users have no voice. They can't tell websites not to track them except by cumbersome means such as sending emails to the operators. Even then, it's only one email from one user. Website operators can assume that there's no desire for privacy -- in fact it's something they publicly argue.

But clicking the DNT checkbox is much easier. Now the websites are confronted with millions of users, maybe hundreds of millions, requesting 'Do Not Track me'. Ignoring their reasonable requests would be bad for business, for reputation, and most importantly, for politics. If the websites don't comply to a reasonable request from a large number of their constituents, legislators will pass laws to force them. If most websites do comply, then the few who don't will be the odd ones out and face even greater risks to their business.

Just as importantly, DNT raises awareness. I know of few typical end users who are aware of tracking or understand its importance and implications. DNT will at least make them aware that tracking is an issue and that it's important enough that somebody with authority someplace thought they should be able to opt out of it.

(I don't think there's a technical solution to tracking. The value of tracking the (1 billion?) people on the web is great enough that any security measure will be overcome.)

Re:It's a politcial solution, not a technical one

[Anonymous Coward]

Where does the internet legislature live?

Re:It's a politcial solution, not a technical one

[guanxi]

Where does the internet legislature live?

A very good point. Major companies that want to do business in a jurisdiction will be pressured to comply. Smaller websites local to the jurisdiction might not want to fall too far afoul of the public or the law (though how can we catch them?). Small websites outside the jurisdiction? I don't know that this solution applies to them. However, it doesn't need to be a perfect solution to be worthwhile.

Re:It's a politcial solution, not a technical one

[noidentity]

Ignoring their reasonable requests would be bad for business, for reputation, and most importantly, for politics. If the websites don't comply to a reasonable request from a large number of their constituents, legislators will pass laws to force them.

And you're going to even know that they're tracking you how? They can do it all server-side, and you'll never be the wiser. In fact, those users with this "do not track" flag will be the ones they pay special attention to.

First, bring back the solutions we had

[MobyDisk]

I would like to restore the privacy options we already had, that have been eroded:
- Stop browsers from accepting 3rd-party cookies by default (I'm looking at YOU Firefox!)
- Clear cookies daily. This used to be a Firefox option, now unavailable. If logging in once a day is too often, you misunderstand the concept of "password"
- Any plug-ins need to follow these same rules. Ex: Flash "cookies"

Re:First, bring back the solutions we had

[Anonymous Coward]

Clear cookies daily. This used to be a Firefox option, now unavailable. If logging in once a day is too often, you misunderstand the concept of "password"

I couldn't care less if any of my "permanently logged in" accounts gets stolen by some skript kids with a packet sniffer and too much time on their hands, and I certainly don't want to be bothered to input login credentials every time for such a mundane reason. Nor do I want to enter a password every time I start my browser.

Re:First, bring back the solutions we had

[BitZtream]

Passwords don't know the difference between a day, a week, one use or 100 million uses.

You're confusing the word password with security.

You also don't understand the concept of security either. It isn't an absolute value, and most people for most things really don't have any reason to log out ever when its a machine in a secure location used only by trusted persons (the owner in their own home).

While it is considered a 'best practice' to keep your console locked, taking context and practicality into account helps you.

One might think that entering your password everytime you take any action would be more secure, however the reality of it is that it would be completely impractical to have to enter your password for each click or scroll of the page ... and frame a security perspective it would be utterly ignorant since you'd just make the number of times someone could look over your shoulder and see your password ridiculously high ... it would almost be impossible for anyone watching you to NOT get your password. While 'the console is always locked' seems more secure, it is only more secure when you apply it properly. Not when you apply it with blanket statements and a sledgehammer.

Don't spew like you know security just cause someone on the internet told you to always lock your console to be secure.

Re:First, bring back the solutions we had

[Greyfox]

Flashblock and noscriot handily address third party plug-ins -- just don't allow sites you don't trust them to run. Now if there were only a plugin like noscript for cookies, so I could whitelist sites I trust and have the browser accept all cookies until the session ends, then purges sites not on the whitelist...

Re:First, bring back the solutions we had

[MobyDisk]

You're confusing the word password with security.

I wasn't talking about passwords or security. The discussion is about tracking.

Clearing your cookies daily reduces how well you can be tracked. The only downside is that you must log in to accounts every day, rather than relying on the cookie to keep you logged-in.

Re:First, bring back the solutions we had

[MobyDisk]

agreed! That is exactly what I want. Have the browser toss cookies that aren't in the whitelist. (pun intended)

Re:First, bring back the solutions we had

[Anonymous Coward]

That's exactly what Firefox does for me in this setup:
x Accept cookies from sites
  x Accept third-party cookies
  Keep until: I close Firefox

and I have various sites in the exceptions list, set to allow. Those are stored until they expire.
The rest are accepted until I close Firefox.

Too Little Too Late

[Anonymous Coward]

The problem, once again, is that the relevant authorities had completely lacked the foresight to outlaw the practice of tracking at the very beginning when it would have been most productive. At the very outset of the new cyber world, Internet connections should have been perceived as sacred with no data collection to be permitted or shared.

But this did not happen. As a result, these third-party tracking companies (with their dubious claims of effectiveness) have grown too large and too widespread to effectively combat. Any attempt to impose anti-tracking methods or legislation will now be met with serious resistance.

We cannot reap what we have failed to sow.

Like X-No-Track

[La Gris]

X-No-Archive despite the X is the admitted standard on Usenet to opt out of post archive. But nowadays, I won't bet two cents on a such "standard" gaining consensus.

They're only doing this to avoid regulation.

[northstarlarry]

Like Microsoft last month, and other browser makers soon to follow, Mozilla is only doing this so that the FTC doesn't force them to. The FTC proposed this and essentially said to everyone "Do this on your own or we'll write a spec for it and you won't like it."

How About a "Please Be Nice To Me" Header?

[Anonymous Coward]

It can read:

Well, golly gosh jeepers, guys. It shore would be nice of you to be nice. C'mon guys, really...

Oh yeah, an HTTP header. That'll do the trick.

[The O Rly Factor]

You had better not track me, OR ELSE!

Missing the point

[empiricistrob]

This move by mozilla is genius. Have you seen the kinds of things lawmakers are talking about, e.g. making it illegal for website to track customers? By proposing a much better mechanism Mozilla will hopefully prevent any sort of crazy no-tracking legislation from becoming law.

Of course these headers wont be universally honored -- that's not the point. If lawmakers find this solution to be inadequate the most likely scenario is they will mandate that website honor this header, which would be WAY better than the alternative of lawmakers unilaterally deciding how this should work.

Three cheers for the effort

[QuincyDurant]

Cheers to Mozilla for trying to start this conversation outside the narrow walls of Slashdot. The proposed solution may be ineffective or even have adverse unintended consequences, but the problem is real. Internet tracking is beyond intrusive; it's dangerous. The same techniques used for arguably legitimate purposes by advertisers can (and are) used by malware authors.

Most web users, simply aren't aware of the potential danger of simply pointing and clicking. Market research and advertising are essential to capitalism; they help buyers and sellers find one another. But there must be limits. If television advertisers could peer back at us in our living rooms and measure the pupils of our eyes, I suspect there would be an outcry loud enough for end-users to hear.

This won't really stop anything

[Dracos]

This is a passive measure which relies on the second party for compliance, much like robots.txt. You can put as many denials as you want in there, but the "bad bots" will ignore it, if they even request it at all. The data miners will do the same, it would be in their interest to ignore this header.

Personally, I'll keep adding lines to my hosts file.

Or rewrite your headers!

[Anonymous Coward]

I still use Proximitron to rewrite all my headers and cookies. I like sending "I am a cookie, eat me!" and other items like "Browser is nunya Bidness". But then again Yahoo Mail doesn't recognize my browser.. :)

They know

[sjames]

The thing is, They Know we don't want to be tracked, tagged, folded, spindled, and mutilated. Just like telemarketers know you don't want their call, junk mailers know you don't want their paper stuffing your box etc etc. They just don't give a rat's ass because they're psychopathic corporations. If they thought they could get away with it they would roast your child on a spit for a nickel and Wall Street would reward them handsomely when they pointed out that the supply of children was nearly inexhaustible.

A better approach is to define a header that says you DO want to be tracked. The 3 people in the world who actively want that can submit a patch to actually implement it if they like. It won't matter much either way.

Re:They know

[smellotron]

The 3 people in the world who actively want [to be tracked] can submit a patch...

Today's mathematical lesson is going to be about disjoint sets, kids!

Insurance?

[phyrexianshaw.ca]

I assume Insurance companies would LOVE a "do not track" header. they just start tracking who uses it, and increase their rates!

Better than cookies

[yuhong]

Google has an opt-out in ad preferences that is based on HTTP cookies. Unfortunately they are easily deletable by accident. This HTTP header don't have this problem.

They should better create a "track_me" header

[Anonymous Coward]

That would assume default settings or non-compiant browser would get "more" privacy from honest advertisers. Persons really interested at being tracked would turn it on.

Time for the checklist!

[Safety Cap]

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) crowd-sourced

approach to preventing users from being tracked. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which will vary from state to state and country to country)

(x) It does not provide an adequate method of enforcement
( ) Nobody will spend eight months sitting in dull planning meetings to do it
( ) No one will be able to find the guy
(x) It is defenseless against rogue websites
(x) It tries to stop a fundamentally broken cookie model
(x) Users of the web will not put up with it
( ) The government will not put up with it
(x) Advertisers will not put up with it
( ) Requires too much cooperation from unwilling sources
(x) Requires immediate total cooperation from everybody at once
( ) Many advertisers cannot afford to lose what little business they have left
( ) Anyone could anonymously destroy anyone else's career or business
( ) Users are too stupid to know they're being tracked anyway

Specifically, your plan fails to account for

(x) Browsers' unwillingness to change to suit something that will be circumvented in days
( ) The existence of programmers for hire
(x) The W3C
( ) Sources' proven unwillingness to "go direct"
( ) The difficulty of changing all those websites
( ) How few people actually care
(x) The vast majority of "programmers" are unable to even code in semantically-correct HTML
( ) Unpopularity of weird new headers
(x) Unstoppable moneyed Kung-Fu
( ) Legal liability of vigilante sites
( ) The training required to be even an craptaculous web monkey
(x) Users hate pop-ups
( ) The necessity of ignoring laws from other countries
(x) Americans' huge distrust of anyone not from their country/state/city/block
( ) Reluctance of governments and corporations to be held to account by two guys with a blog
( ) Inability of random people on the internets to demand anything
( ) How easy it is for corporations to manipulate unemployed sweaty shut-ins
( ) Rupert Murdoch
( ) Pron
( ) Hulu
(x) Technically illiterate politicians
( ) The tragedy of the commons
(x) Craigslist

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to visit Drudge, Slashdot and Democracy Now without seeing those Cash for Gold ads
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatibility with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don’t think it would work.
(x) This is a stupid idea, and you’re a stupid person for suggesting it.
( ) Maybe you should actually visit reality every fortnight or so

Re:Time for the checklist!

[dkleinsc]

Didn't realize the checklist had been updated for non-email issues. In any event, I think you left out some obvious choices in the "philosophical objections" section:

(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
(X) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to visit Drudge, Slashdot and Democracy Now without seeing those Cash for Gold ads
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatibility with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough

Re:Time for the checklist!

[Rhaban]

Did you check the boxes pseudo-randomly?
Because it looks like you did.

already covered by RFC 3514

[Anonymous Coward]

RFC 3514 - The Security Flag in the IPv4 Header - aka the evil bit

Not as stupid as some people claim

[kasperd]

I have heard much more stupid suggestions on how to improve privacy. One suggestion in the past was that websites had to offer users a way to opt out of having cookies stored on their computer. The reason that is much more stupid is that there is no other way to store information about the user opting out than by doing it through a cookie.

You could still implement it, but it wouldn't do the user any good. Once they decide to opt out, the webserver could tell the browser to delete all cookies, and they could track the fact for the duration of the http connection. Once the connection gets closed and the user sends a request on a new connection, there will be no information in the request to let the server know, that this is the user that opted out. The information that the user had opted out was in fact deleted at the users request. Such an implementation would be stupid, but it would essentially be what would have been the outcome if previous suggestions had been implemented as suggested.

This browser header would OTOH be much more feasible to implement. Of course it isn't going to technically enforce anything. But there are enough websites that want to play by the rules, that it would still mean something.

If some browser vendors decide that it should be opt-in rather than opt-out and change the default setting in their browser, they do run the risk of making websites decide not to honer the header from those browsers.

Having the header shouldn't mean the website cannot set cookies at all. It should still be possible to set session cookies when technically required for some use case. It should also be possible to set cookies, when the user explicitly do things that would require cookies. For example if they fill in a registration form or a login dialogue, the site can set a cookie. However such a cookie should be deleted at logout time. The site should also be able to set cookies if the user decide to save preferences. But the cookie shouldn't contain any information beyond the preferences. In other words, if two users decide to set the same preferences, they should get identical cookies. And log entries on the webserver shouldn't contain anymore information from the cookie than what was used to render that request. For example if the preferences contain a language setting that applies to all pages, and a display setting that only applies to a subset of the pages, then all requests could log what language the user was using, but not what the other setting was.

All of this is just for those sites that want to play by the rules. Of course there will always be sites that won't play by the rules. But that shouldn't stop us from agreeing on an improvement for those sites that will respect such a header.

Ghostery

[metrometro]

Regarding all the "WON"T WORK" statements, can someone explain why this isn't already provided by the excellent Ghostery extension? For example: It's running now, set up to run without notifications and block all known bugs. To me, it's mostly invisible. Hovering on a status bar icon tells me that it's blocked Slashdot's use of Google Analytics and Doubleclick scripts.

I appreciate the effort by Mozilla to drumbeat this issue (ahem) but I'm not sure I get it.

Evil Bit

[sls1j]

and in related news. Changes to the IP protocol now include the evil bit. Any packet with evil intent has it's evil bit set to 1 and everything else is set to 0. So to filter out bad communications just drop all packets with the evil bit set to 1.

Yeah that's gonna work

[McTickles]

Too easy to get around

Re:Yeah that's gonna work

[Todd Knarr]

Yes, it's easy to ignore. However, it does add a legal aspect: the web-site operator can't say "Well, the user didn't say they wanted to opt out.". Right now web sites work on the assumption that you're OK with being tracked unless you take some special action to tell them otherwise. This header is an explicit statement on every single HTTP request telling the web site that no, this user is not OK with data collection for tracking purposes. In any legal or enforcement action after that, the web-site operator has to explain why they ignored a direct, explicit statement by the user. It may not in and of itself prevent tracking, but it ups the legal risk and costs for the web-site operator if they ignore it and something happens. They can't say "The user didn't opt out.", which takes away one of the big things they depend on to cover their assets when things go wrong. It's easy to implement, it doesn't cost a lot of bandwidth, it doesn't depend on cookies or anything else stored long-term on the client side, it can be implemented in things that use HTTP but aren't browsers. I see at least some benefit, and little or no cost or downside to it.

Not precisely the same

[goldcd]

But was a bit surprised to see this pop up as an official Google extension.: https://chrome.google.com/webstore/detail/hhnjdplhmcnkiecampfdgfjilccfpfoe

What a waste of bandwidth ...

[Lazy Jones]

I wonder what the people at Mozilla are thinking:

• as proposed, there is no way to enforce it
• it wastes bandwidth for every HTTP request, when there are potentially 100s per page (even with Keepalives on)

A more sensible way would be simply to distribute a cookie blacklist that can be updated e.g. once every day. No new headers and other ad hoc stuff need to be invented, no fuss made about it. Alternatively, requiring tracking cookies to adhere to a particular naming scheme (e.g. "TC:" prefix) would as enforceable as those proposed headers and waste less bandwidth.

Legilslative Solution not Technical

[Roger W Moore]

Effectively this proposal is not more than saying "please don't track me" and then having a law that requires websites obey the user's request. As such I'd argue it is a legislative fix and so you also need one extra item on your check list: (X) Ignores the international nature of the web.

Re:Legilslative Solution not Technical

[datsa]

I see a parallel to sexual consent. Saying "No" does two things - it communicates to the other party that their behavior is undesired and wrong, and with the proper legislative context, creates the legal case that harm was done. At least with this system I have a simple way of saying "No"! It's not sufficient, but it's an important start, at least in terms of educating users.

Re:Legilslative Solution not Technical

[Roger W Moore]

and with the proper legislative context

That's the key phrase. If the company doing the tracking is sitting in $DISTANT_COUNTRY which has no laws against tracking you are completely powerless to stop them. Hence the "Ignores international nature of the web" option.

Ignoring sexual consent is very different because it involves violence and physical harm and it is illegal in practically all countries. This is more like trespass: in is a minor offence and not all countries agree that this is a crime and even if they do the laws vary considerably....and being minor (if a crime at all) you are also exceedingly unlikely to get an extradition case for it.

Send referrers.

[antdude]

I disable this feature in my Mozilla's SeaMonkey web browsers, but I noticed some web sites go nuts without like on CNN's polls. It's annoying! I don't like web sites stalking my browsing histories! :(

Opt-out of advertising

[Peeteriz]

"desire to opt-out of third party, advertising-based tracking" - how about we skip a few words, leaving "desire to opt out of third party advertising." ?

If I'm going to use AdBlock plus cookie/flashcookie/etc skipping in any case, I won't see the ads anyway and the browser may as well broadcast it to the server and skip the downloading of ads entirely. There's also no use for them to track me, as their targeted ads just as hidden as random untargeted ads, so no use to bother with precise targeting.

Advertisers Are Resilient

[phmadore]

So they'll just use this as a way to advertise privacy software.

Are Ads Helpful?

[Mandrel]

Yes, it allows the advertisers to lie more effectively so they can bilk you out of more of your money than they could otherwise.

How so? How does me knowing that the model of guitar I'm looking for is available from some out-of-state dealer (who's offering free shipping, to boot!) for about 10% less than I can find it near where I live bilk me out of money?

Yes, ads are most likely to be helpful in finding the best vendor for a particular item. But how did you choose what model to buy? Ads provide less trustworthy information than editorial.

That ad is only being displayed because that vendor was the one willing to pay the most for that exposure, not because they offer the best price. A perusal of organic search results may turn up something better. There's also price comparison sites where the prominence and presence of a listing is less correlated to payment than pure advertising.

The act of advertising a service, or a product, is not intrinsically evil. And the act of connecting businesses advertising a product or service with customers who are more likely to be looking for that product or service means two things:
1) People not looking for that product or service are less likely to see those ads and have their time wasted by nonsense;
2) Advertisers have to spend less money connecting to the people who are interested in their products or services, which has a long-term effect of lowering prices through competition.

Advertising that is pushed to you is less likely to be helpful than advertising you request through search engines, deal sites, and manufacturer's websites, no matter how well-targeted they are. It's no coincidence that all these are going gangbusters, while display ads are in the doldrums, particularly due to their increasingly intrusive nature (both visually and privacy-wise).

Unfortunately this is bad news for publishers, who have relied on charging for surrounding their material with material they don't control. I think this will change, with greater use of affiliate-like systems that still allow publishers to retain editorial integrity.(Disclosure: I'm involved in one.) Publishers need to better cover the one good point that advertising provides -- discovery/awareness -- through better-compiled "what's new" and "real deal" lists.

How is it being injected into the process? In the course of doing my research, I decided to buy a particular Yamaha guitar, based on the reviews I found in several and my own experience with them.

So... I know the model I want, and now I want to look and see if I can find a good deal on it, and perhaps find people in my area who offer lessons and supplies... why wouldn't it be helpful to be able to compare prices of vendors who do business both online, and in my area? In some cases, the advertisements I've found are for businesses that I had no idea even existed, because they're miles away in towns I rarely visit - but easily found once I know they exist.

Do you think you clicked on enough ads on the review sites in order to properly compensate them for the help they gave you?

increased upload bandwidth for users

[Anonymous Coward]

20 bytes extra added per each request will hit your upload caps faster...

I was thinking the opposite...

[Kaenneth]

Because as a younger-middleage man I really don't need tampon ads on websites, what I think would be much more useful is something like an X-Demographics header.

X-Demographic-Age: 35
X-Demographic-Location: Seattle, WA (for local ads)
X-Demographic-Interests: Programming, Games (Freeform text, for generic tet searches)
X-Demographic-Sex: Male (Optionally 'Yes' if you want porn site ads)

You give out the information you're willing to give out. People can lie, not use the fields or put garbage in; but they would be blocking ads or such anyway, so no real loss.
With the freqent legal requirement to not store info on children, X-Demographic-Age: 10 should block tracking on sites that would obey a do-not-track header as well.

Ideally, with better targetted ads, they would need as many, or be as intrusive to get the same clickthrough rate.

Even More Effective than RFC 3514

[Gary W. Longsine]

Unlike RFC 3514, which would require being able to sniff the wire to get the private data, this new proposal from Mozilla will enable evil to remotely crawl the web, searching selectively for the data marked "private" saving much carbon emissions which otherwise would be consumed parsing irrelevant data, looking for the private data users wish to protect. This might be the stupidest thing to ever be uttered from the Mozilla team, but the competition for that award is pretty stiff. I'd need to check the records to be certain.

mozilla proposes, web server disposes

[Anonymous Coward]

browser proposes, web server disposes