Slashdot Mirror
Apache Patch To Override IE 10's Do Not Track Setting
hypnosec writes "A new patch for Apache by Roy Fielding, one of the authors of the Do Not Track (DNT) standard, is set to override the DNT option if the browser reaching the server is Internet Explorer 10. Microsoft has by default enabled DNT in Internet Explorer 10 stating that it is to 'better protect user privacy.' This hasn't gone down well with ad networks, users and other browser makers. According to Mozilla, the DNT feature shouldn't be either in an active state or an inactive state until and unless a user specifically sets it. Along the same lines is the stance adopted by Digital Advertising Alliance. The alliance has revealed that it will only honor DNT if and only if it is not switched on by default. This means advertisers will be ignoring the DNT altogether no matter how a particular browser is set up. The DNT project has another member – Apache. It turns out that Microsoft's stance is like a thorn to Apache as well. Fielding has written a patch for the web server titled 'Apache does not tolerate deliberate abuse of open standards.' The patch immediately sparked a debate, which instigated Fielding to elaborate on his work: 'The only reason DNT exists is to express a non-default option. That's all it does. [...] It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.'"
It's obvious that its scumbag advertisers and Google (maybe I'm repeating myself here) behind this. They want a way to track every user and all their behaviors. They want things like these to either not exist or be disabled by default. They live for all the user data they can gather. This also means they are available for law enforcement and any other party with interest to gather that data, now and in the future.
It's already starting to bother me. I'm seeing these advertisements here on Slashdot too. After I've searched for something on Google, the related advertisements start to come up EVERYWHERE on the internet. Seriously, they come after you. If you search for specific flights you start to see ads for that everyone. It'll haunt you and there's nothing you can do.
Google already got into trouble over Safari privacy violations. Did you know that Safari is currently the only browser that blocks third party blocking cookies like those used by advertising networks (Google)? All the other browsers than Safari and IE are in bed with advertisers because both Firefox and Opera get revenue directly from Google. Chrome of course is the worst because it's designed by the advertising network itself.
You know what's the worst thing? I have a developing case of paranoid schizophrenia. The behavioral advertisements are driving me nuts! It's pure hell when you have such case. I have tried to ease me by blocking such things but still Google gets thru something. They literally follow my every step everywhere. Imagine how paranoid you feel when you're already sick. What am I going to do, stop using the internet? That's really nice.
So for the love of god Apache Project, stop taking bribes from Google and doing evil things like this!
This hasn't gone down well with ad networks
To quote Firefly: "Do we care? Is this something we are caring about?"
Palm trees and 8
It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization
By being set, it protects my privacy as long as "recipients" abide by it without question — it only becomes an issue when "recipients" qualify when they will abide by it.
If active choice is not an option, a default in favour of not tracking seems a better position to me but, then again, I am not an ad network executive.
How it seems to me, in a simplified way, is that advertisers feel they have the right to serve you ads. Off the bat, I disagree with this notion, however I do see that without ads many websites would not be around or would be forced to hide behind a paywall.
At the same time, what guarantee do advertisers give users that their ads are not a potential attack vector, or what standard do they follow that their ads are not intrusive and degrade the performance of a users machine or overly distract and irritate the users? How invasive do their ads and data collection get to be?
Overall, I see where they are coming from but at the same time all I hear is a bunch of self-entitled whiners. Is there any good reason to instantly get tracked as soon as you visit your first website, or should you be allowed to later reveal yourself to the world if you so desire the features this advertises and data miners claim to provide? The most obvious being targeted ads and more relevant searches when using Google.
...useless and silly.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
So let's see if I have this straight? The marketroids are saying that, by their default, I want to hear all the crap they are paid to push and unless I explictly say, "get lost', they'll continue to bug me until I collapse under the weight of junk product info?
Did Bill Hicks have a great point?
bang goes my karma... again...
With this patch, even if the user has explicitly chosen to set the DNT flag, the server will ignore it. They claim this patch has to be done because IE 10 ignores part of the spec:
"Key to that notion of expression is that it must reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control."
This patch however also ignores this same element of the spec, in that no matter what the user may or may not of done, there will be a "mechanism outside the user's control" (the Apache server) which decides on what they want the preference to be.
I do agree that the DNT setting should be a user choice, perhaps given when the user first installs the browser as well as having the option to change it at any time, but to me this is not the right response to having a default set - although I'm sure if the default setting was that tracking was allowed, the add people would for some reason not be complaining about having a default...
-1 troll is not supposed to be used simply because you don't agree
When using IE10 for the first time (per user) you get a screen where you can choose "express settings". The screen clearly spells out what that means, *including* what DNT will be set to. Arguably, the user *has* made a decision by selecting express settings. How does Roy Fieldings patch determine how much of that text the user read before continuing?
And how does the patch determine when a user *explicitly* sets the DNT.
Yes, Microsoft probably does this because it will annoy Google and hurt them more than it will hurt Bing. But at the same time it does help protect users' privacy. What a joke if Apache accepts this patch. What a sell-out. Disgusting.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
In case it has faded from people's memory, PRIVACY IS A FUNDAMENTAL HUMAN RIGHT - enshrined in laws across the planet.
That wasn't some arbitrary, weird, one-man-and-his-hobby-horse decision, this was the result of a serious amount of very costly and capable people sitting together and hammering out basic principles. A bit like the US Constitution that US politicians appear so keen to ignore.
So, from that principle, not wanting to be tracked IS the legally correct default, DNT should have never been needed, only a "DT" ("Do track, because I don't care about my rights"). If Mr Roy Fielding is writing a patch to override what should have been a default to start with (the jammering and global breaking of this principle by marketing people across the globe does not define breaking the law as rule), then Mr Roy Fielding is effectively on his way to break the law in practically any part of Europe.
DNT is an excuse to casually ignore the fact that fundamental principles were already broken by companies raking it in on the back of breaking fundamental principles (yes, Google and Facebook, I'm looking at you).
Let me put it this way - if this patch goes live anywhere in Europe, a complaint to the relevant government department in charge of Data Protection WILL be made. No ifs, no buts, no maybes.
It's time we start working on people's rights - because with such idiocy and cow-towing to money nobody is going to do it for you.
The DNT setting applies to everyone, and ironically it appears MS are about the only ones that abide by it. I having DNT by default seems to me to be the intelligent choice, The default should always err on the side of a users privacy. Why the fuck are people suddenly supporting the right to be tracked??? You should require explicit permissions from the person in order to track them.
Article is misleading. DNT is enabled if you setup Windows 8 with express settings, at which point it actively states DNT will be set 'on'. Until that point there is no configured values. This is Apache caving into advertiser pressure, pure & simple IMO.
throw new NoSignatureException();
If you do not want to be tracked, DO NOT SEND REQUESTS. ... did anyone *really* expect that to work?
But sending requests with a "please handle this one but dont use it to track me or put it in logfiles" comment
How much tracking is done via log file analysis alone?
Not Logging requests that the user specifies makes it a standard for script kiddies only.
If it was intended for just not putting a cookie... well fail?
Thats what browser settings are for and what could have been done with more aggressive browser settings alone.
Sorry to say that, but this whole standard seems to not ever made sense at all...
This is not an attack on privacy. This is the only valid option.
If you look at the details of the Do Not Track Header, you'll see that there's not much to it. It's an optional HTTP header that represents the user's request not to be tracked. There is no mechanism to actually enforce this choice; any party can easily just ignore the header and track you regardless. The entire purpose of the header is to express a user's intent, and, therefore, the entire value of the header is derived from that intent.
It's like the "Baby on Board" car signs: If I place one in my car's windowpane, polite drivers should see that sign and grant me additional driving space and courtesies, and I may be able to drive in the carpool lane. Imagine, now, that everyone always puts that sign in their car by default because they want the additional driving space and courtesies. The value of my sign is significantly diluted; not only does standard driving operation make it impossible to honor those requests, but my own actual situation gets lost in the noise. Drivers will surely ignore the little yellow sign altogether, and it becomes worthless.
Unless "Do Not Track" is actually an explicit expression of a user's conscious intent, it will face the same hypothetical fate and become yet another ignored standard. Its only value is derived from its explicit intent, and Apache and Fielding are taking steps to ensure that the value is not compromised.
No, it's very useful. Microsoft Windows is basically a monopoly on the PC desktop now. Microsoft is ALSO an ad company. They have Bing set as default and built into the OS, they dont need that specific kind of tracking to make their money. By setting the flag they kneecap the other agencies for oppressing the users... And get to play "white knight" about it in the press.
This is about Microsoft using the standard to kick other ads out, I'm sure they have exceptions when the ad servers are contacted by the OS itself. Not to mention Microsoft is moving to their "fully owned " platforms. Who can turn off XBox ads, Windows Mobile Ads, Windows Surface Ads?
Try this search engine. It remove the top million sites. Might be what you're looking for.
The soylentnews experiment has been a dismal failure.
Perhaps the use of ie10 is my active choice, knowing that it has this privacy set by default. It's not, but consider the possibility.
The alliance has revealed that it will only honor DNT if and only if it is not switched on by default.
Dear Digital Advertising Alliance - No one* wants you to track them. MSIE enabling DNT by default means nothing more radical than defaulting US releases of Windows to use English.
Since you have decided you know better than we do, I will therefore block all ads and tracking technologies until you make them "opt-in" only.
And then I will opt out.
* Morons who consider Facebook as somehow "better" than the worst of you marketing parasites aside.
Fielding thinks his options should be "use another browser." Well fuck you Mr. Fielding. Thanks for coming up with a standard that you are going to cheerfully ignore while giving users the false impression that you are going to honor their wishes.
Do we need and involuntary standard to get advertisers to behave? Because that's where this sort of shit may be leading.
Or do you want a war with Microsoft? Maybe they'll patch IE to identify and disable Apache servers by default, or send them spoofed and anonymized information by default.
I agree with DNT not being set by default. Make it an option on the default browser home page, then people can set it whenever they like, or just ignore it. Done.
But to Apache: "we do not support breaking open standards" hold no water what so ever when your way to express your love for standards is to patch your product such that it can completely ignore a generally accepted standard by default. That to my mind is a text-book example of hypocrisy.
And to the ad servers saying "if X then we'll just ignore DNT" I say fine: if you won't honour DNT I feel no guilt at all in completely blocking all your content. Thanks for playing. I only block ad networks that get on my nerves (auto playing sounds, overly irritating animations, malware riddled shite, and so forth), but this is on my list of things that get on my nerves.
For what it is worth I don't think DNT will make any difference at all, as it relies on everyone to play ball server-side and I barely trust anyone with a commercial or other interest in tracking people to play ball in anything other than hollow words, but that is no reason to not be irritated when you hear people say "we know and understand your preferences, but fuck you".
There are a few reason why some people object though, including but not limited to:
Why is Apache doing this? Shouldn't it be up to the webmaster and developers whether to ignore IE10's DNT or not?
Why is Apache doing user agent sniffing(a no no usually for even web apps) and overriding web applications by default? The patch doesn't even give a choice to the webmaster to configure Apache to disable this action. So it's being forced on Apache users because of the ego of the DNT spec writer? Lets say IIS turns on DNT for all browsers, how will Mr. Fielding feel then? Apache is being used as a pawn in this power game and this move will help no one. Let the advertisers ignore DNT from IE10 if they want to, why block DNT flag on at the web server level?
This space for rent.
W3C is against DNT being on by default.