Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Sunday, 31-Aug-2025 08:13:41 JST Rich Felker

   • Jeff Atwood

   @codinghorror Moreover there *was* a browser feature to set it globally and all the assholes running websites refused to honor it and instead used your setting as an additional fingerprinting bit to track you.

   • Embed this notice
     :thonk: (p@raru.re)'s status on Sunday, 31-Aug-2025 19:08:59 JST :thonk:

     in reply to

     • Jeff Atwood

     > We value your privacy.

     This is false.

     @dalias @codinghorror

     Blurry Moon likes this.
     Rich Felker repeated this.
   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Sunday, 31-Aug-2025 21:13:01 JST Rich Felker

     in reply to

     • Furosshu
     • Gerard Cunningham ✒️
     • Jeff Atwood

     @faduda @frosch @codinghorror That's why Google and Mozilla removed the setting.

   • Embed this notice
     Gerard Cunningham ✒️ (faduda@mastodon.ie)'s status on Sunday, 31-Aug-2025 21:13:03 JST Gerard Cunningham ✒️

     in reply to

     • Furosshu
     • Jeff Atwood

     @frosch @dalias @codinghorror

     Eventually an EU court will declare DNT legally binding, and there will be wailing and gnashing of teeth.

   • Embed this notice
     Furosshu (frosch@edolas.world)'s status on Sunday, 31-Aug-2025 21:13:07 JST Furosshu

     in reply to

     • Jeff Atwood
     @dalias do you mean the dnt header? I just recently visited geizhals.de and noticed that they honor the Do-not-track header and set the cookie settings accordingly. But it's the only website I came by since this hole cookie banner shit show started which does this.
     @codinghorror
   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Sunday, 31-Aug-2025 21:42:57 JST Rich Felker

     in reply to

     • Furosshu
     • Gerard Cunningham ✒️
     • Jeff Atwood

     @faduda @frosch @codinghorror Yeah but they'll try to argue it's no longer a meaningful part of the protocol. Not saying this should be treated as valid, but that's the strategy here and likely why Google pushed to remove it.

   • Embed this notice
     Gerard Cunningham ✒️ (faduda@mastodon.ie)'s status on Sunday, 31-Aug-2025 21:42:58 JST Gerard Cunningham ✒️

     in reply to

     • Furosshu
     • Jeff Atwood

     @dalias @frosch @codinghorror

     Won't matter. I can add a plugin, and it clearly expressed my preference. That's enough for a Court to make a ruling.

   • Embed this notice
     Jeroen Baert (jbaert@mastodon.social)'s status on Sunday, 31-Aug-2025 22:08:50 JST Jeroen Baert

     in reply to

     • Jeff Atwood

     @dalias @codinghorror This. All those banners tell you is "this website doesn't respect your privacy"

     And there was a "Do Not Track"-flag, but respecting that was voluntary. :/

     Rich Felker repeated this.
   • Embed this notice
     Christian "Schepp" Schaefer (schepp@mastodon.social)'s status on Sunday, 31-Aug-2025 22:08:50 JST Christian "Schepp" Schaefer

     in reply to

     • Jeroen Baert
     • Jeff Atwood

     @jbaert @dalias @codinghorror 💯 this!

     Also here is more about the DNT HTTP header as a refresher: https://en.m.wikipedia.org/wiki/Do_Not_Track

     Ad tech started ignoring it altogether when IE10 was shipping with it enabled by default, instead of having to opt in.

   • Embed this notice
     Panicz Maciej Godek (paniczgodek@functional.cafe)'s status on Sunday, 31-Aug-2025 23:58:01 JST Panicz Maciej Godek

     in reply to

     • :thonk:
     • Jeff Atwood

     @p oh no, that's actually brutally honest. It means: 'your privacy has a measurable value to us, and there is a market where we can sell it' @dalias @codinghorror

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Fabrice Desré (fabrice@fosstodon.org)'s status on Monday, 01-Sep-2025 01:20:40 JST Fabrice Desré

     in reply to

     • Jeff Atwood

     @dalias @codinghorror DNT failed because Microsoft turned it on by default instead of making it a real user choice.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 01-Sep-2025 01:20:40 JST Rich Felker

     in reply to

     • Jeff Atwood
     • Fabrice Desré

     @fabrice @codinghorror As soon as the option exists, the only legitimate default value is "no, do not track". A browser that makes the default "yes, track me" has now made the browser vendor the guilty party violating user consent.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 01-Sep-2025 03:49:49 JST Rich Felker

     in reply to

     • Jeff Atwood
     • Fabrice Desré

     @fabrice @codinghorror Um, no. Unless the meaning defined by the protocol for requests lacking the header is to interpret it as "no consent to track", as an implementor once you know about the header, the choice to omit the header is equivalent to the choice to request tracking on the user's behalf without their consent.

   • Embed this notice
     Fabrice Desré (fabrice@fosstodon.org)'s status on Monday, 01-Sep-2025 03:49:50 JST Fabrice Desré

     in reply to

     • Jeff Atwood

     @dalias @codinghorror No, the correct behavior is to not send the header at all by default, and make sure the user makes an informed choice.

   • Embed this notice
     Fabrice Desré (fabrice@fosstodon.org)'s status on Monday, 01-Sep-2025 04:28:38 JST Fabrice Desré

     in reply to

     • Jeff Atwood

     @dalias @codinghorror You realize all clients won't support it, right? So the server side, anyways, has to deal with 3 states: no header, DNT=yes, DNT=no. The server side is still free to decide what to do when no header is sent. But anyway, DNT is dead...

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 01-Sep-2025 04:28:38 JST Rich Felker

     in reply to

     • Jeff Atwood
     • Fabrice Desré

     @fabrice @codinghorror Yes I realize that. No, in any workable ethical and legal regime, the server side is not "free to decide what to do when no header is sent". But if server side is potentially (illegally) treating lack of information as consent, a client that operates in the user's interests cannot omit the header by default.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 01-Sep-2025 04:30:40 JST Rich Felker

     in reply to

     • Jeff Atwood
     • Fabrice Desré

     @fabrice @codinghorror In any case, yes, DNT is essentially dead due to lack of political will to enforce it and sites abusing it as an extra bit of fingerprinting data in the absence of any consequences for doing that.

     But it's still meaningful to consider what ethical and legal obligations we should expect in any future protocol that aims to automate this.