Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 62 posts

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#51

Post by M2Ys4U »

theon144 wrote: post #26
mperham wrote: post #7

"Won't someone think of the children?" comes to the HTTP standard. Seriously though, this seems totally reasonable although "safe" does seem like an odd word choice. Maybe "modest" instead?

I'm thinking it's in the same category as "Safe For Work" and "Not Safe For Work". But yeah, I expected a HTTP header that would, say, redirect to an encrypted version of the webpage, sort of like HTTPS Everywhere, but on the browser-server level.

Isn't that HSTS? https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#52

Post by dchest »

Loic wrote: post #36

My feeling is that most of the people talking here do not have children yet. As a father, I would be really pleased to have such header accepted by many providers to just filter out content which is clearly not for kids. A small example, I am French living abroad, if I want my kids to read a bit the news, I cannot send them on one of the 3 "major" French newspaper to read a bit. Why? Because at the bottom of the firs…

do not have children yet

"Yet"? You mean, everyone will eventually have children, and only people who have children can discuss such things?

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#53

Post by icebraining »

darklajid wrote: post #44
icebraining wrote: post #42

Earlier quoted context omitted.

I exactly had the same idea... I would also add that this thing is going to be useless anyway because not all the websites are going to implement it. So you will have this header + the traditional blocker... It's not useless, since it allows the site to avoid being blocked by hiding the "bad" content. Ideally blockers would be smart enough to recognize and block only the "bad" DOM elements, but they usually just bloc…

That is absolutely meaningless. What is bad content? The header doesn't tell what the client considers 'bad' or not 'safe', it's a bool. Given that, I see these possible outcomes - the client's admin might not care about this site at all (effort to hide stuff would be wasted?) - the client's admin might consider content 'unsafe' that seems fine/okay to the site operator => Blocklist, failed to archive what you sugges…

Sure, all those outcomes will happen, since servers and filters will have to implicitly agree on what is "safe". But the type of content blocked isn't random; there are a few prevalent concepts and terms which site operators are likely to follow.

That said, I think the implementation should have an admin-controlled site whitelist and even a way to disable the header even if parental controls are enabled, to prevent (3).

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#55

Post by Aissen »

wlv wrote: post #37

Why isn't there a space before "Safe"? New compact http headers saving one character?

I used to think so. Then I read the spec: http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2

The field value MAY be preceded by any amount of LWS, though a single SP is preferred.

For the definition of SP and LWS, see: http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2

For the definition of MAY, see: https://www.ietf.org/rfc/rfc2119.txt

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#56

Post by rurounijones »

indeyets wrote: post #24
rurounijones wrote: post #23

Earlier quoted context omitted.

You cannot try and refute an argument based on something that is not in the spec and is "common sense" since "common sense" is not a defined value for a spec that has global implications.

Spec shouldn't define what's good and what's not for your children. That's something for parent to decide. Spec defines a "tool" which can be used by parent who thinks it makes sense for them

Then you cannot defend things as "It is meant for X year olds, not Y year olds" when someone decries the feature as easily bypassable.

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#57

Post by ClassicFarris »

darklajid wrote: post #44
icebraining wrote: post #42

Earlier quoted context omitted.

I exactly had the same idea... I would also add that this thing is going to be useless anyway because not all the websites are going to implement it. So you will have this header + the traditional blocker... It's not useless, since it allows the site to avoid being blocked by hiding the "bad" content. Ideally blockers would be smart enough to recognize and block only the "bad" DOM elements, but they usually just bloc…

That is absolutely meaningless. What is bad content? The header doesn't tell what the client considers 'bad' or not 'safe', it's a bool. Given that, I see these possible outcomes - the client's admin might not care about this site at all (effort to hide stuff would be wasted?) - the client's admin might consider content 'unsafe' that seems fine/okay to the site operator => Blocklist, failed to archive what you sugges…

Your comment about the bool, got me thinking. This would have been better implemented if it was thought of along the lines of movie rating system.

http://en.wikipedia.org/wiki/Motion_picture_rating_system

However, this got me thinking that across cultural lines there are a lot of shades to what is "safe". So a website based in Austria might want to restrict different content than a website based in Australia, and who knows where the "browser" is based.

Of course your comments about the site actually implementing anything/correctly still apply.

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#58

Post by iancarroll »

comex wrote: post #15
iancarroll wrote: post #9

Earlier quoted context omitted.

It has many other uses, IMO. - Disable signup/require COPPA form to be mailed & signed - Filter out explicit content from user-generated content - Disable vulgar sections from a blog - Prohibit downloading software etc

> - Disable signup/require COPPA form to be mailed & signed Somewhat off topic, but I think 13 is considerably above the age where kids have a reasonable interest in being able to actually use the web. When I was a few years younger than 13 (10 years ago...), I once accidentally put my true birthday into AIM, and was subsequently banned from the service I used to communicate with friends from school. Recently, the sa…

I don't think forms are the answer. I think it should be around 9 or 10, honestly. I'm not too sure what would replace forms though.

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#59

Post by chc »

ClassicFarris wrote: post #57
darklajid wrote: post #44

Earlier quoted context omitted.

That is absolutely meaningless. What is bad content? The header doesn't tell what the client considers 'bad' or not 'safe', it's a bool. Given that, I see these possible outcomes - the client's admin might not care about this site at all (effort to hide stuff would be wasted?) - the client's admin might consider content 'unsafe' that seems fine/okay to the site operator => Blocklist, failed to archive what you sugges…

Your comment about the bool, got me thinking. This would have been better implemented if it was thought of along the lines of movie rating system. http://en.wikipedia.org/wiki/Motion_picture_rating_system However, this got me thinking that across cultural lines there are a lot of shades to what is "safe". So a website based in Austria might want to restrict different content than a website based in Australia, and who…

I vaguely remember in the early days of the web (95-96?) there was a hopeful rating system very much like what you get for movies. I can't remember what the header was, but it was formatted something like "Violence 1; Sex 10; Drugs 5; Gambling 0". For obvious reasons it didn't catch on.

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#60

Post by fafner »

darklajid wrote: post #43
fafner wrote: post #40

Earlier quoted context omitted.

You can't identify minors because this isn't just a feature for minors but, e.g., for companies or public terminals as well. Of course it depends on the websites to deal with it. But, e.g., most popular porn sites actually do care about stuff like this. There is no UI in Firefox because Firefox uses the operating systems parental control features to enable/disable it. And those features should have a UI within the sy…

Your last paragraph is what I can't understand. Ignoring OS X for now (wouldn't know a thing about that): Parental control in Windows just lets me set time limits/limits on what programs/games I can run as far as I know (just double checked microsoft.com and that's what they list as well). Given that and my understanding of the Fx feature means that Fx understands that this is a machine with parental controls enabled…

You are just assuming things here. I don't know the parental control features of Windows. And I don't know when this will be enabled. But I don't see a reason why this should be always enabled as soon as parental features are used. In the end Mozilla is implementing a Microsoft proposal here. I would assume that the parental controls have a setting to enable it. So it kinda seems to me that you are building a strawman to attack.

If you want to block specific websites or specific content then you obviously need to use a different tool as well.

Post reply on HN