Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do Not Track is not respected on mozilla.org

bugzilla.mozilla.org

Post reply on HN
Print view View original

21–30 of 113 posts

Re: Do Not Track is not respected on mozilla.org

#21

Post by ronaldx »

eli wrote: post #19
ronaldx wrote: post #11

Earlier quoted context omitted.

Yes. If you choose to send an e-mail newsletter to your users, you should (at least) be obliged to provide an unsubscribe option - providing two different experiences. If you choose to track your users, you should (at least) be obliged to assume that DNT users have opted-out of this tracking and be responsible for not tracking them.

That does not seem apples to apples. Should I provide an "opt-out" of all advertising for people who just don't like looking at ads?

In the EU, the two situations I described are both legal obligations (regarding collection of personal data, the legal obligation is probably stronger than I described).

[I have understood that this is not the same in the US and the situation is therefore murky and EU law is not respected on the internet as a whole.]

What you described is not a legal obligation, although I personally think you should provide the option to opt-out of ads - I know of several sites that do and this makes a positive difference to me as a user.

Re: Do Not Track is not respected on mozilla.org

#22

Post by bad_user »

Nursie wrote: post #20
bad_user wrote: post #18

Earlier quoted context omitted.

If you don't like it, don't use it - simple as that. The only thing I find reasonable is for users to be warned that they are tracked, precisely for enabling them to move to alternatives that better respect their wishes. His website is running in your browser by your choice, not his ;-)

>> If you don't like it, don't use it - simple as that. >> His website is running in your browser by your choice, not his ;-) Excellent, now how do I know ahead of time, or without digging through the source, which sites are going to try and run this stuff? --edit-- Also, and here's the rub - again I just requested some data from his server, and it provided it to me. I made no promise to render or run it in the way h…

Well, the "Do Not Track" option is too simplistic and probably needs improvements.

Ideally, the browser would start by making an OPTIONS request in which the server would reply with something like "yes, I'll track this user in spite of their preferences" (even with a link to their privacy policy) and then the browser could block the view with a warning, just like how Chrome and Firefox are giving warnings for insecure connections, giving users the option to add exceptions or to go somewhere else.

This would be fair to both users and publishers.

Re: Do Not Track is not respected on mozilla.org

#23

Post by bloopletech »

bad_user wrote: post #12
Nursie wrote: post #4

Earlier quoted context omitted.

>> I have a right to track how people use my site. But you don't have a right to say what runs on my computer, or make it tell you what I'm doing. This is where our perceived rights collide. >> once you've made that choice you are within my domain, under my roof, living by my rules. No, my computer, my browser, my roof, my rules. >> People get way too offended by analytics tracking when it's there for their benefit.…

> No, my computer, my browser, my roof, my rules His website. Seriously, people should be warned that they are tracked, the purpose for which they are tracked and what exactly is tracked. Google Search for example is giving warnings lately, that you have to manually dismiss (probably because of EU laws) and I view that as being progress. On the other hand demanding of publishers to not track you while you're on their…

Actually, I can use your site and benefit from it, while simultaneously blocking your ability to track me. It's called Ghostery (and similar browser extensions).

I use Ad-Block Plus and Ghostery for all my web browsing, and have both Ad-Block Plus set to block _all_ ads and Ghostery set to block _all_ tracking scripts.

These extensions do not make 'polite requests'; they directly control the browsing experience to my benefit.

I (and my extensions) control my browsing experience, not you.

(You can argue that this is unfair, but in the long run I believe the outcome will be a better business model for sites to make money.)

Re: Do Not Track is not respected on mozilla.org

#24

Post by clarkevans »

Mozilla uses Google Analytics Premium Service ($150k/year) which includes a contractual option to prevent secondary use of the visitor data. Therefore, they see it as legally in the spirit of Do-Not-Track -- Google is a contractor collecting the visitation data solely for the pleasure of Mozilla.

https://bugzilla.mozilla.org/show_bug.cgi?id=858839#c21 https://groups.google.com/forum/?hl=en&fromgroups=#!search/m...

From the latter thread, Stacy Martin at Mozilla represents "Google Analytics will not correlate or report on any customer data with any other data, they will use Mozilla data only to provide and maintain the service for Mozilla, and they will not share or use it for any other purpose."

EDIT: The contractual arrangement is relevant. Section 9.3 item 2 of the IETF do-not-track draft draws has an exception for this very situation, "data obtained by a third party exclusively on behalf of and for the use of a first party".

http://tools.ietf.org/html/draft-mayer-do-not-track-00#secti...

Re: Do Not Track is not respected on mozilla.org

#25

Post by bloopletech »

bad_user wrote: post #18
Nursie wrote: post #15

Earlier quoted context omitted.

>> His website. Running in my browser. >> On the other hand demanding of publishers to not track you while you're on their property is unreasonable. I'm not on their property. I'm fairly happy for them to record what they can see at their end in terms of what pages I go to, but I find it very unreasonable to demand that I run whatever code the website operator asks me to run, to turn my computer into a machine that r…

If you don't like it, don't use it - simple as that. The only thing I find reasonable is for users to be warned that they are tracked, precisely for enabling them to move to alternatives that better respect their wishes. His website is running in your browser by your choice, not his ;-)

You're making a false dichotomy - you imply the only choices are a) allowing tracking, or b) not using sites that track.

As I implied in my other comment, this is a false dichotomy; by using browser extensions, I can and do control my browsing experience to benefit from sites that track while preventing them from tracking.

The very concept that I should subject myself to the whims of web sites is completely counter to the history and culture of the net.

Re: Do Not Track is not respected on mozilla.org

#26

Post by nly »

Instead of the useless EU cookie legislation, we should have had legislation that enshrined explicit privacy preferences in to data protection law.

When I signup to a website I'm expected to agree to their Privacy Policy. Both site owner and visitor expect that policy, provided that it's legal, to be somewhat enforceable in court. When I'm just visiting, why is there no such equivalent?

The problem with DNT isn't that it can be ignored, it's that it can be ignored without penalty. People who think purely technical solutions (including Ghostery, NoScript, Adblock etc.) are the answer are ignoring the reality of how easy it is to fingerprint and track users on the web.

Re: Do Not Track is not respected on mozilla.org

#27

Post by Silhouette »

jeremysmyth wrote: post #9

There's a large effective difference between "do not track" as it is outlined in the bug, and how many people see it (see, for example, comment 16 in the report, and then comment 25) Specifically, it's to do with third party cookies, not any particular site. If I visit someone's website, I'm usually perfectly happy for them to record my visit and my actions. If, on the other hand, I visit their website and some invis…

The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner.

Several web font services now fall into that category as well. The problem from a user's point of view is that you can block Google Analytics or Facebook Like buttons without any loss of functionality you probably wanted, but blocking Typekit or Google Web Fonts will often mess up the rendering of a page.

This changes the rules fundamentally. Before, with free services where you weren't the customer but the product, you could opt out by simply not using the service. Now, even with services where you really are the customer and maybe you really are paying for it, you can't opt out of the potentially intrusive third party service without opting out of or significantly degrading the main service you wanted to use as well.

This is a tricky area. Those third party services are pervasive precisely because they are useful to people who build the web sites that users enjoy, and if they're being given away for free, they have to fund themselves somehow. I also don't have much sympathy for people who don't load up someone's web site as it was presented to them but then complain that it doesn't look right or work properly (see also: not running JS, complaining that you can't want Flash content on your iPad, etc). In some respects, these third party services are almost certainly beneficial to users, too, because they act as CDNs that probably improve performance and lower bandwidth requirements compared to having every site self-host the same common material.

On the other hand, privacy matters. We have drifted into a situation where this kind of ubiquitous monitoring is widely used by site owners, but many of them probably don't even realise the implications for their users' privacy, or just don't care. We have rules about data protection and spamming and the like to deal with similar situations in slightly different contexts, and maybe it's time we had some rules about tracking by services that are incorporated indirectly on other people's web sites and possibly without a visitor's knowledge.

Re: Do Not Track is not respected on mozilla.org

#29

Post by michaelgrafl »

bad_user wrote: post #18
Nursie wrote: post #15

Earlier quoted context omitted.

>> His website. Running in my browser. >> On the other hand demanding of publishers to not track you while you're on their property is unreasonable. I'm not on their property. I'm fairly happy for them to record what they can see at their end in terms of what pages I go to, but I find it very unreasonable to demand that I run whatever code the website operator asks me to run, to turn my computer into a machine that r…

If you don't like it, don't use it - simple as that. The only thing I find reasonable is for users to be warned that they are tracked, precisely for enabling them to move to alternatives that better respect their wishes. His website is running in your browser by your choice, not his ;-)

If you don't like it, don't let him use it - simple as that.

Re: Do Not Track is not respected on mozilla.org

#30

Post by supermatt »

"Do not track" in its present (non-)state is a farce. It should be implemented at the browser level.

My ideas on DNT:

If a user specifies "do not track" in their browser-global or site-specific settings then ALL requests to third party domains should simply be blocked.

This could be backed up by a site-provided manifest (potentially containing a comment for each ones justification, or a flag to say if its required or optional) to 'whitelist' 3rd party domains that they require it. There should be a browser feature to view this whitelist and 'uncheck' any sites you disagree with.

In fact, IMHO, thats the way modern browsers should work anyway - it would certainly solve a huge number of other issues (XSS, etc).

Post reply on HN