Hacker News Reader

Comment by getsat | Hacker News Reader

Yup. Building a third party widget that operates via iframe on a customer's site but need access to get/set cookies on your side? P3P time.

CP="NOI ADM DEV COM NAV OUR STP"

View on HN

You sure that policy is right? I don't understand the spec, nor how to read the P3P policy, but looking at http://www.w3.org/TR/P3P/ seems to indicate these might be problematic:

NOI = Web site does not collect identified data.

OUR = Recipient of the information is your company (only)

STP = The retained information will only ever be used the the currently stated purposes.

This is what I use for the same purpose (and I am sure it works), though I am not sure which item or min combo of items is required. Once I beat back the IE demons, I called it a day.

CP="CAO DSP COR CURa ADMa DEVa TAIo PSAo PSDo IVAo IVDo OUR BUS IND UNI COM NAV INT"

That's exactly my point. Everyone just Googles and puts random stuff in there until it works.

One day someone will get sued over it, because that policy is telling the browser what you say you will do with that data.

Imagine if financial reporting software worked like this: "Oh, we just tried outputting different values in the balance sheets until our stock went up".

> Imagine if financial reporting software worked like this: "Oh, we just tried outputting different values in the balance sheets until our stock went up".

You're making me wonder if they don't do some kind of A/B testing already....

Have you been reading the news the past 15 years? That's precisely what derivatives are used for. Derivatives, and bought-and-paid-for auditors who also provide "consulting services."

I've never invested in derivatives. Can't say that I plan to, either.

Reply on news.ycombinator.com