Hacker News Reader

Comment by pak | Hacker News Reader

This is not a reply to your comment! See http://pastebin.com/raw.php?i=qV5bkCjG for more info.

clever :)

Btw, I'm not defending Google, they're clearly not acting perfectly here. I'm simply pointing out that this is a clear case of, "what did you expect to happen?" Any spec that still sets a cookie that is declared as not being used for any purpose seems deeply flawed.

I also found it interesting that Microsoft called out Google and not Facebook, which gives the article a political overtone.

Hindsight is always 20/20 and norms change quickly on the internet; we could say equally critical things about Telnet and FTP.

I agree that P3P clearly needs some rethinking to stay relevant. Especially now that the cat's out of the bag on how to bypass it. (Microsoft's immediate response is to set up yet another blacklist system... some cultures just never change.)

For everyone's entertainment, the OP's comments linked to an amusing satire of P3P called P5P, or the "Pretty Please Platform for Participating Publishers." This is possibly the best collection of protocol tokens I have seen since RFC 2324.

http://pastebin.com/ijjRKvUB

A blacklist seems like a pretty effective strategy and allows them to deal with offenders simply. I'd imagine you're not advocating for them to add proprietary extensions to P3P. What would you suggest they do otherwise, out of curiosity?

The problem is, blacklists need to be maintained, create a single point of failure (in terms of both access and trust), and rapidly grow out of control. See virus scanners, spam filtering, CRL checking for SSL, MSIE Phishing Filter, etc. all of which work either sporadically or at the unrelenting expense and pain of some central party.

I think MS probably needs to acknowledge that P3P is broken, and change the default so it doesn't affect third party cookie acceptance. Administrators for Windows environments that think otherwise can override the default by deploying a group policy.

It is interesting that your response to google seemingly doing something that is, at the least disingeneous, is to criticize microsoft. Also re: culture - were to you think google got all those engineers from? A significant number are ex-MSFT. There is a reason GOOG built a campus in bellevue.

I think he is criticizing Microsoft for pointing their fingers to their arch-enemy while failing to mention their partner.

Reply on news.ycombinator.com