Slashdot Mirror
Confusion Surrounds UK Cookie Guidelines
pbahra writes "The Information Commissioner's Office has, with just over two weeks to go, given its interpretation on what websites must do to comply with new EU regulations concerning the use of cookies. The law, which will come into force on 26 May 2011, comes from an amendment to the EU's Privacy and Electronic Communications Directive. It requires UK businesses and organizations running websites in the UK to get informed consent from visitors to their websites in order to store and retrieve information on users' computers. The most controversial area, third-party cookies, remains problematic. If a website owner allows another party to set cookies via their site (and it is a very common practice for internet advertisers) then the waters are still muddy. And embarrassingly for the Commission — it's current site would not be compliant with its new guidelines as it simply states what they do and does not seek users' consent."
...a law stopping people from making laws about things they simply do not understand.
Correct way to handle cookies:
http://www.youtube.com/watch?v=OqL7jyrXhLs
http://www.youtube.com/watch?v=rHfEmIXkWfg
http://www.youtube.com/watch?v=Cqz9ZXUoUcE
These posts express my own personal views, not those of my employer
IANAL(imey), so I'm having trouble understanding why the UK law bans the use of biscuits. /girds loins/
Failure to follow this advice may result in non-deterministic behavior.
So if they UK is having Wifi problems with global warming, what is that going to do to their cookies? Will their cookies only work for a certain range, and then turn into scones? I demand an irrational panel of useless government bureaucrats to investigate now! God save all our tea and cucumber finger sandwiches.....
Vote monkeys into Congress. They are cheaper and more trustworthy.
It's just next to impossible to use the law as it is.
To me however it is very simple: A website can trivially obtain permission from the user for the site's own cookies. An advertiser needs to get opt-in consent before sending a cookie as it is unfeasible to obtain permission as you go. Basically this can be done in a simple way: A visitor to a site featuring ads from the advertiser will see nothing to requests to decide whether to accept cookies or not until this decision is made. The result is stored in a cookie which they need permission for as well. Now when sending ads the decision cookie is checked and if the answer is yes, the ads are sent with the tracking cookies, and if no, they are sent with no cookies.
This will obviously result in a lot of people saying no to the tracking cookies but that is as it should be. Tracking someone should only be done with consent.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
Cookies can easily be used for spying that makes it dangerous.
me
Session tracking really need new standard and some merging with the HTML5 client side storage. This with clear client enforceable client policy, server and DOM standard way of reading the access and store policy settings.
The situation now is:
- an obsolete RFC2965 cookies standard with no average user know/can manage safely,
- and a still to be standardized HTML5 incompatible client storage and database.
New cookies should become part and merge with the HTML5 client side storage, with backward compatible but marked obsolete API.
Léa Gris
You could just use the browser "propmpt every time" setting if you want to decide which sites use cookies. (the prompt allows you to say "always for this site).
It's close enough. Cookies are small pieces of text, and they are stored on your computer.
"Petrol is a metal tank attached to your car"
"Ink is the stick you use to write on paper with"
"Music is the big square boxes attached to your amplifier"
Close enough it may be, but to definitively state something as fact which is quite clearly not fact (or, even if it is, only in a limited number of cases) when describing why legislation applies is just wrong.
They could quite simply have said, "Cookies are small pieces of text which your computer may choose to store." - there, simple. It also has the plus that it tells the user it's up to them whether they're stored.
But then we're not very hot on taking responsibility for what our computers do.
Ho hum.
The situation now is:
- an obsolete RFC2965 cookies standard with no average user know/can manage safely,
- and a still to be standardized HTML5 incompatible client storage and database.
New cookies should become part and merge with the HTML5 client side storage, with backward compatible but marked obsolete API.
If you liked storing pointers to data kept on servers you will *LOVE* storing even more data from each site on your computer.
Well I guess right up until the point where all the fine folks on the Intertubes intentionally design sites to consume massive amounts of disk space across an infinite number of attacker domains and or force erasure of legitimate content after the fixed storage pool is exhausted.
You going to explain about cookies to my mother?
I sure as hell don't want to. Somebody probably should though, as she's unwittingly feeding all sorts of info to whoever wants it on the internet, without her knowing.
Saying users have the choice is disingenuous here.
The typical user just clicks on a web site, and has no idea what cookies are, and that they are getting stored on their computer. In most cases, there's no 'choosing' involved, since they are enabled by default. For those cases, saying that the text just gets stored on your computer is accurate enough.
Not True.
Yes we have biscuits, but we also have cookies. Cookies are typically rough circular baked sweet dough with added fruit or chocolate. Most Cookies are also moist in the centre. They are also baked fresh and bought from dedicated cookie or bakers shops (you can get pre-packed cookies but these are horrible and dry).
Biscuits are dry (excluding the filling) and come in defined shapes. To use a common example, Oreos (also available in the UK) qualify as biscuits not cookies.
-Jar
Together, We Can Make Slashdot Better. I Do NOT Mod ACs. - Check Me Out
I hate the way major websites have perverted third-party cookies, because now if u block them, this will result in loss of website navigability... and Flash players not working properly in some cases. I believe those big websites deliberately created such 3rd-parties (ytimg.com, yimg.com?) to turn tracking into stalking.
There shouldn't be any client side storage at all. If the browser makers would just drop this stupid cookie idea that Netscape had around the time of the blink-tag, web developers would be forced to design their sites to store anything they need on the server.
Make the browser send a UUID as a session identifier. When the user types in a new URL, or selects a bookmark, generate a new session identifier, even if it's the same site. That way, you could even be logged in to the same site with two different userids at the same time, something that doesn't work with cookies. When the user navigates from one domain to another, generate a new session id. When loading images or scripts from a different domain than the current page, load them with a new session id.
No tracking possible.
"Remember me" would no longer be a setting on the page, which writes a permanent cookie, but a setting in the browser, which makes the current session id fixed for the current domain.
Remember the CAN-SPAM ACT 2003 in the US? That was another pointless law. Spam is at an all time high. You only stop spam with a spam filter. Governments only gets bigger, never smaller.
Actually I hate that my Facebook, Gmail, Yahoo, Twitter and Youtube data are stored on American servers. Now this data is freely available to scumbags like the FBI which can check it whenever they want and without a warrant. Server location in the financial industry (a.k.a domiciliation) is a very big decision before setting up funds and getting investors. Why shouldn't we do the same for our online data?
From the guidelines (pdf):
So, by my reading of that, you do not need further consent merely for logins/session cookies:
The definition of a computer file, from wiktionary: "An aggregation of data on a storage device, identified by a name."
That definition was what I was taught when I studied CS in the 80's too, it goes back to the 60's.
That definition clashes with the Unix philosophy of "Everything is a file" which allows us to abstract from different peripheral devices and treat them all uniformly.
Is /dev/disk0 a file? I'd say no, because it is the storage device, not just the data on it. (E.g. you can use it to query the SMART status of the storage device which I would not count as the data stored on it.)
Is /dev/kmem a file? It's data, but it's not on storage, but in volatile memory.
Most files below /proc are not even data at all, but state. (I.e. their informational value depends on the time they are queried.)
Also, a database file is usually not a text-file, because it contains data that is not human-readable.
Free Manning, jail Obama.
Too bad you posted as Anonymous because I find you expose a very brilliant simple solution. I would have marked you as friend to more easily follow your next posts.
Léa Gris
There is little conceptual difference between a database and a file system. For the sake of the discussion it doesn't matter if cookies are stored in little individual files on a file system, or if they are combined in a small database implemented as a single file.
That's what all this silly chatter over 'privacy' is.. If you're on the net, you are being tracked. You will always be tracked, whether you want it or not... and whether you know it or not, so kindly STFU over it. You only available option is to fill the system with as much junk info as you can. So make a script that does just that, through sockpuppets and other fake stuff. Raise the noise level high enough to render it useless. But whatever the hell you do, try to stop believing for half a second that you know what goes on deep in the bowels of Google, Apple, MS, *.gov, etc... Little by little they can download everything you have on your computer. They got your number, and that's that.
It is just as lame to think a website can be regulated as it is to believe they can be censored, and it's even dumber when you consider that our various governments now pass laws in secret, demanding 'back doors' and keyloggers built into your hardware and more. They are not really interested in protecting your privacy. They only want to keep you pacified into thinking you have any at all.. Well, you don't have any.. none.. zilch.. To believe otherwise is simply naive.
For justice, we must go to Don Corleone
Firstly, Cookies are generally tied to User-Agents, not to people. UK websites are not required to get consent from spiders, crawlers, or other bots.
What I invite the ICO to do is to demonstrate a technical, non-invasive, means of being able to identify an individual from the information made available over a HTTP1.1 request.
Secondly, regarding Session Cookies, it is trivial to replace a session cookie with a QueryString token - so what is the differentiating feature of these two that requires consent for the former and nothing for the latter.
Thirdly, hasn't anyone yet learned that the Internet doesn't follow state boundaries?
This comment was written with the intention to opt out of advertising.
The definition of a computer file, from wiktionary: "An aggregation of data on a storage device, identified by a name." That definition was what I was taught when I studied CS in the 80's too, it goes back to the 60's.
That definition clashes with the Unix philosophy of "Everything is a file" which allows us to abstract from different peripheral devices and treat them all uniformly.
Is /dev/disk0 a file? I'd say no, because it is the storage device, not just the data on it. (E.g. you can use it to query the SMART status of the storage device which I would not count as the data stored on it.)
Is /dev/kmem a file? It's data, but it's not on storage, but in volatile memory.
Most files below /proc are not even data at all, but state. (I.e. their informational value depends on the time they are queried.)
Also, a database file is usually not a text-file, because it contains data that is not human-readable.
Have you written any code to access those? Guess what, you use a FILE DESCRIPTOR. The goal is that everything in Unix be accessible as a file... If it looks like a turd; Smells, feels and tastes like a turd -- It's a pedant.
I have had to explain the difference between it's and its twice now to an otherwise intelligent, native-born English speaker at work. Some people seem to just not have a head for grammar, distressingly enough.
It's official. Most of you are morons.
Yes, but then why even mention the technical term text-file? Why not conceptionally describe what's going on, so that anybody can understand it?
Cookies are pieces of data that are stored on your computer, usually for preferences such as login information. They can also be used to track your browsing patterns.
Followup with a link to a broader discussion of the pros and cons of cookies. On the technical end, someone else mentioned a adblock-like approach for sites from which cookies should be blocked by default. This should be integrated into every modern browser, at least through a plugin that is advertised properly.
Free Manning, jail Obama.
Switching to a RESTful design usually reduces the need for cookies (and completely eliminates session state cookies). Perhaps more developers will make their sites RESTful in order to comply with this retarded law.
The bits on the bus go on and off... on and off... on and off...
aren't they called "biscuits" ? :)
This may come as a shock to many but cookies are not necessary.
Does anyone have a link to the actual legislation? So we can read and see for ourselves what the law states.
You need a file descriptor to access any kind of file. Except on the shell, where you can use them directly as input or output. The principle that everything is a file is a big reason why shell programming is as powerful as it is. (I'm not saying it's pleasant. But it does get the job done in many instances.)
Free Manning, jail Obama.