Slashdot Mirror
Apache Patch To Override IE 10's Do Not Track Setting
hypnosec writes "A new patch for Apache by Roy Fielding, one of the authors of the Do Not Track (DNT) standard, is set to override the DNT option if the browser reaching the server is Internet Explorer 10. Microsoft has by default enabled DNT in Internet Explorer 10 stating that it is to 'better protect user privacy.' This hasn't gone down well with ad networks, users and other browser makers. According to Mozilla, the DNT feature shouldn't be either in an active state or an inactive state until and unless a user specifically sets it. Along the same lines is the stance adopted by Digital Advertising Alliance. The alliance has revealed that it will only honor DNT if and only if it is not switched on by default. This means advertisers will be ignoring the DNT altogether no matter how a particular browser is set up. The DNT project has another member – Apache. It turns out that Microsoft's stance is like a thorn to Apache as well. Fielding has written a patch for the web server titled 'Apache does not tolerate deliberate abuse of open standards.' The patch immediately sparked a debate, which instigated Fielding to elaborate on his work: 'The only reason DNT exists is to express a non-default option. That's all it does. [...] It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.'"
This hasn't gone down well with ad networks
To quote Firefly: "Do we care? Is this something we are caring about?"
Palm trees and 8
It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization
By being set, it protects my privacy as long as "recipients" abide by it without question — it only becomes an issue when "recipients" qualify when they will abide by it.
If active choice is not an option, a default in favour of not tracking seems a better position to me but, then again, I am not an ad network executive.
How it seems to me, in a simplified way, is that advertisers feel they have the right to serve you ads. Off the bat, I disagree with this notion, however I do see that without ads many websites would not be around or would be forced to hide behind a paywall.
At the same time, what guarantee do advertisers give users that their ads are not a potential attack vector, or what standard do they follow that their ads are not intrusive and degrade the performance of a users machine or overly distract and irritate the users? How invasive do their ads and data collection get to be?
Overall, I see where they are coming from but at the same time all I hear is a bunch of self-entitled whiners. Is there any good reason to instantly get tracked as soon as you visit your first website, or should you be allowed to later reveal yourself to the world if you so desire the features this advertises and data miners claim to provide? The most obvious being targeted ads and more relevant searches when using Google.
Ad-block FTW
Just wait till they start hiding under your bed with chainsaws.
A bullet may have your name on it, but artillery is addressed to " Whom It May concern"
...useless and silly.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
With this patch, even if the user has explicitly chosen to set the DNT flag, the server will ignore it. They claim this patch has to be done because IE 10 ignores part of the spec:
"Key to that notion of expression is that it must reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control."
This patch however also ignores this same element of the spec, in that no matter what the user may or may not of done, there will be a "mechanism outside the user's control" (the Apache server) which decides on what they want the preference to be.
I do agree that the DNT setting should be a user choice, perhaps given when the user first installs the browser as well as having the option to change it at any time, but to me this is not the right response to having a default set - although I'm sure if the default setting was that tracking was allowed, the add people would for some reason not be complaining about having a default...
-1 troll is not supposed to be used simply because you don't agree
It's already starting to bother me. I'm seeing these advertisements here on Slashdot too. After I've searched for something on Google, the related advertisements start to come up EVERYWHERE on the internet. Seriously, they come after you. If you search for specific flights you start to see ads for that everyone. It'll haunt you and there's nothing you can do.
Not true: you can change your Google Ad Preferences or opt-out.
Similarly, you can use the NAI's opt-out page to opt-out of Google and other ad network tracking.
There's plenty of browser plugins that work to block ads entirely (such as AdBlock) and ones that ensure that the "opt-out" cookies stay in existence even if you clear your other cookies.
All the other browsers than Safari and IE are in bed with advertisers because both Firefox and Opera get revenue directly from Google.
The default search box in those browsers comes configured to use Google, yes. They do get income from ad revenue stemming from searches from the box. You're not forced to use that search box, nor are you forced to use the default settings -- you can add other search providers (like DuckDuckGo, ixquick, etc.) -- Firefox, for one, doesn't have ad agreements with anyone other than Google.
So for the love of god Apache Project, stop taking bribes from Google and doing evil things like this!
Is there evidence that the Apache project is "taking bribes from Google"?
My understanding from the article is that an individual contributed a patch to the the Apache httpd.conf source code and does not reflect the official viewpoint of the Apache Foundation, nor that the patch has been approved for inclusion. Naturally, I welcome any corrections.
When using IE10 for the first time (per user) you get a screen where you can choose "express settings". The screen clearly spells out what that means, *including* what DNT will be set to. Arguably, the user *has* made a decision by selecting express settings. How does Roy Fieldings patch determine how much of that text the user read before continuing?
And how does the patch determine when a user *explicitly* sets the DNT.
Yes, Microsoft probably does this because it will annoy Google and hurt them more than it will hurt Bing. But at the same time it does help protect users' privacy. What a joke if Apache accepts this patch. What a sell-out. Disgusting.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Just a FYI.
I went to NAI's opt out page and tried it. I have Adblock-plus. To get all of them, you have to turn off Adblock-Plus, hit the "all of them" button, and then re-enable. Otherwise, you only get 50-some-odd out of 95.
--
BMO
You don't mention this but DNS Crypt is only, officially, supported on Windows and Mac but it can be made to work on GNU/Linux and BSD with a little work. The following site gives the details you would need to do this https://johnfail.wordpress.com/2012/07/24/dnscrypt-for-linux/
Choosing to ignore a standard is not what they should be doing either.
To be honest this is kind of a ridiculous standard anyway. The way I read it, it seems to me the sites I would least want to track me are the exact sites that are most likely to ignore DNT completely. This standard reminds me of the Evil Bit RFC.
Beware of he who would deny you access to information, for in his heart he dreams himself your master.
While I agree with your sentiment I have seen where this patch is referred to as a patch against "source code";in your post and even (from the article page comments) "core source code" and I disagree with that. This is a *configuration file* patch. I don't know of anyone other than a home user trying Apache for the first time who uses the default configuration file; not to mention this patch is not even approved by or included with Apache (yet).
This may be an argument in semantics but it seems to me a true source code patch (ie. one in which once the server is compiled no configuration option will allow a setting one way or the other) is much more worrisome than a simple configuration change.
From what I am reading, unless/until this patch is included with Apache by default, this is really a non-issue. Someone who wants to ignore DNT can do it. Someone who wants to honor it can do so as well. This choice is left up to the company that is using the software (and believe me, even if DNT was hard-coded into the source code, sites that don't want to honor it would simply patch Apache internally). As I mentioned elsewhere in this thread, DNT reminds me of the "Evil Bit" RFC.
Beware of he who would deny you access to information, for in his heart he dreams himself your master.
Article is misleading. DNT is enabled if you setup Windows 8 with express settings, at which point it actively states DNT will be set 'on'. Until that point there is no configured values. This is Apache caving into advertiser pressure, pure & simple IMO.
throw new NoSignatureException();
This is not an attack on privacy. This is the only valid option.
If you look at the details of the Do Not Track Header, you'll see that there's not much to it. It's an optional HTTP header that represents the user's request not to be tracked. There is no mechanism to actually enforce this choice; any party can easily just ignore the header and track you regardless. The entire purpose of the header is to express a user's intent, and, therefore, the entire value of the header is derived from that intent.
It's like the "Baby on Board" car signs: If I place one in my car's windowpane, polite drivers should see that sign and grant me additional driving space and courtesies, and I may be able to drive in the carpool lane. Imagine, now, that everyone always puts that sign in their car by default because they want the additional driving space and courtesies. The value of my sign is significantly diluted; not only does standard driving operation make it impossible to honor those requests, but my own actual situation gets lost in the noise. Drivers will surely ignore the little yellow sign altogether, and it becomes worthless.
Unless "Do Not Track" is actually an explicit expression of a user's conscious intent, it will face the same hypothetical fate and become yet another ignored standard. Its only value is derived from its explicit intent, and Apache and Fielding are taking steps to ensure that the value is not compromised.
Google and every other advertiser know that, when given the choice to opt in on something, you likely won't. I could type a wall of text, but if you have a few minutes you could watch this TED talk about opt-in vs opt-out.
To sum up: you are not really in control of your decisions
http://www.ted.com/talks/dan_ariely_asks_are_we_in_control_of_our_own_decisions.html
Try this search engine. It remove the top million sites. Might be what you're looking for.
The soylentnews experiment has been a dismal failure.
The alliance has revealed that it will only honor DNT if and only if it is not switched on by default.
Dear Digital Advertising Alliance - No one* wants you to track them. MSIE enabling DNT by default means nothing more radical than defaulting US releases of Windows to use English.
Since you have decided you know better than we do, I will therefore block all ads and tracking technologies until you make them "opt-in" only.
And then I will opt out.
* Morons who consider Facebook as somehow "better" than the worst of you marketing parasites aside.
Wow, +5 for a shill account with one paranoid delusional comment.
1) It's not obvious that Google is behind this. Roy Fielding, the man responsible for it, works for Adobe.
2) If Roy Fielding were a sock puppet for Google, and Google would prefer DNT not to exist at all, then he probably wouldn't have made DNT in the first place.
Ad-block FTW
Pretty much, along with cookie blockers. Anyone who doesn't use one on the internet these days is either mad or insane. Perhaps both. I don't care that site users are whining and crying that they're losing revenue, it's stuff like what was mentioned in the article itself(too long to repeat) that ensure that I'm going to keep using them. Plus the long list of abusive ads themselves that like to run with their volume at 11, or inject malware.
I'd be happy with ads, no really. If companies weren't being so stinking abusive over it. I'd call the entire thing an abusive relationship, you even get companies promising "we don't do this, don't worry we've changed." And next time, they're right back to doing it. Sounds familiar doesn't it?
Om, nomnomnom...
Why is Apache doing this? Shouldn't it be up to the webmaster and developers whether to ignore IE10's DNT or not?
Why is Apache doing user agent sniffing(a no no usually for even web apps) and overriding web applications by default? The patch doesn't even give a choice to the webmaster to configure Apache to disable this action. So it's being forced on Apache users because of the ego of the DNT spec writer? Lets say IIS turns on DNT for all browsers, how will Mr. Fielding feel then? Apache is being used as a pawn in this power game and this move will help no one. Let the advertisers ignore DNT from IE10 if they want to, why block DNT flag on at the web server level?
This space for rent.