Pro tip: If you want to download an image or pdf, Drive will still let you print, so you can print it to file as a PDF.
To download from Google Drive, you must enable third party cookies?
141–150 of 166 posts
Re: To download from Google Drive, you must enable third party cookies?
#142This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)
[deleted]
Re: To download from Google Drive, you must enable third party cookies?
#143Earlier quoted context omitted.
> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option use…
> It's a signal that core web technologies need to be created with potential abuses first and foremost. No. This is how absolutely everyone ends up with the shittiest version of everything. We need recourse and a general legal expectation that you DON'T abuse your users. Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its f…
It is possible the US government lacks the reach to do what you've described, given how much organized crime is centered in other nations.
But I agree with you overall... Much of the web's concept of privacy and security is baked in with the assumption that it must be technologically enforced because it can't be legally enforced. Change that math and you change the model.
Re: To download from Google Drive, you must enable third party cookies?
#144Earlier quoted context omitted.
I don't see any problems with a monoculture of rendering engine. Browser (and features, especially privacy ones), absolutely. Renderer, not so much.
Have you ever used a service in life where there is no competition? Straight up lack of competition examples are the easiest: DMV, airport food court, buying beer at a sports stadium etc. If you work in tech then you’ve probably had to use software over whose purchase you had no control: Jira, PeopleHR, Taleo, Concur. There’s no competition there because you, the end user, don’t have the option to choose from a free…
> Without competition, software rots and/or never gets better. [...] systemd since it was locked in as the only properly supported Debian/Ubuntu init
To be fair, systemd was rotten to the core from day one (literally - namely, the core concept of shoving as much crap into pid 1 as possible to abuse the special semantics that are supposed to only allow for reaping of orphan processes), so you can't really blame that on lack of competition.
Your overall point is spot on, though. (And I suppose you could blame lack of sufficiently direct/credible competition for Debian being able to shove systemd down everyone's throats, rather than being forced to support multiple init systems.)
Re: To download from Google Drive, you must enable third party cookies?
#145What happens with curl?
Re: To download from Google Drive, you must enable third party cookies?
#146Earlier quoted context omitted.
It's not about url space or load balancing, but security. You do not want to serve user content from your primary domain: * Even if you serve it with the correct content type and no-sniff headers some browsers can be tricked into running JS, and then you have XSS. * Even in modern browsers it's defense in depth, in case you mess up your configuration or they have a bug. * If malware gets past your scanners then your…
I guess that’s all fair, but to be clear, I’m not proposing to host public-facing content. Only private content that can be viewed by authorized users who have the right first party cookie to allow it. Public facing content could easily be hosted on the other domain for all of the reasons you listed, and third party cookies won’t matter then. I appreciate you outlining the arguments. I know some other sites like Drop…
It’s not security for the end user
It’s security for Google
Back in the day, you could upload, for an example, a specially-crafted HTML file with your own malicious JS code to, for an example, an image hosting service and basically use them to serve your attack upload. You could more or less abuse any website upload form to host any file that that you wanted. It was bad.
Browsers have drastically improved but why risk it? Using a separate domain makes a lot of scary scenarios completely impossible.
Re: To download from Google Drive, you must enable third party cookies?
#147Earlier quoted context omitted.
>I'm not sure why they don't use the new flow for everyone. It's less secure, slower (more round trips), and more server side intense - likely considered a hack. Effectively it does the same what a cookie would. The 3rd party cookies are not a bad thing per se, it's just that they have been abused to hell and back, is what causes their reputation.
I don't think it has to be. They could make the request as an ajax request with an Authorization header. Of course that makes the frontend more complex as it as to do some gymnastics to treat the response as a download.
Tried it, wouldn't recommend it.
The file data would be stored in the browser tab's memory.
It usually ends in crashes.
Re: To download from Google Drive, you must enable third party cookies?
#148Earlier quoted context omitted.
> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option use…
> It's a signal that core web technologies need to be created with potential abuses first and foremost. No. This is how absolutely everyone ends up with the shittiest version of everything. We need recourse and a general legal expectation that you DON'T abuse your users. Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its f…
While I agree that we direly need privacy legislation to stop openly chartered surveillance companies from tracking us through whatever means, your position doesn't work for computer security in general. The only way "accountability" works for computer security is if every node on the network carried an inescapable real world identity that is responsible for its network traffic, which would be much more of a draconian regime than you are arguing against.
Re: To download from Google Drive, you must enable third party cookies?
#149The workaround: Preview, ⋮ > Open in new window, Download
Re: To download from Google Drive, you must enable third party cookies?
#150Earlier quoted context omitted.
I think you're falling into the same trap. Some things are not solved in the appropriate manner through a technological solution. They are misuses (and abuses) of a perfectly acceptable system. Don't undo the system, address the misuse. Take your example: >Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow th…
What is the definition of what is "really" "my" domain? If I put a custom domain on an S3/cloudfront that's part of my system, so it appears as `storage.mysystem.com`, is there something nefarious going on? Who decides what is allowable declaration of a domain to be mine? And who enforces this with fines? Is there currently any way to fine someone on the internet for violating a rule? What would you imagine this look…
> Who decides what is allowable declaration of a domain to be mine?
Basically, there is a list included in all browsers: https://wiki.mozilla.org/Public_Suffix_List. That's why you.github.io can't read other github.io cookies, but if you make your own domain, you can share cookies between a.example.com and b.example.com. (Also why example.com can't read .com cookies.)
> Is there currently any way to fine someone on the internet for violating a rule?
Many governments do this. In the US, the FTC has fined a number of companies for things like supercookies: https://www.ftc.gov/business-guidance/blog/2012/08/milking-c...