Do Not Track is not respected on mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=858839

by therealunreal • 13 years ago

140 109 13 years ago

bugzilla.mozilla.org

38254• 13 years ago

This is an interesting topic. Should I deliver different experiences depending on DNT header?

ronaldx5• 13 years ago

Yes.

If you choose to send an e-mail newsletter to your users, you should (at least) be obliged to provide an unsubscribe option - providing two different experiences.

If you choose to track your users, you should (at least) be obliged to assume that DNT users have opted-out of this tracking and be responsible for not tracking them.

eli2• 13 years ago

That does not seem apples to apples. Should I provide an "opt-out" of all advertising for people who just don't like looking at ads?

PommeDeTerre• 13 years ago

If the experience in question involves the tracking of users in some way, then I think it's pretty clear that there should be a different experience for users with the header set, versus those without it. Those who provide that header should, as the name of this functionality very clearly states, not be tracked.

Metatron2• 13 years ago

Do Not Track is silly.

For example: You come on to my site, I want to know how you're using it, I don't want your personal details, I just want to see how you're interacting with the site I've made for you. Why do I want to know? Well it depends on the purpose of the site, but for the most part it is so that I can optimise and improve what my site offers to you and others.

But you've politely requested that I don't track you. For starters this should only ever be a polite request, not a forced rejection of any tracking scripts. I have a right to track how people use my site. You have a right to privacy, but that's got bugger all to do with you coming on to my site, once you've made that choice you are within my domain, under my roof, living by my rules. Until you leave of course.

Some sites may respect that request, but they're the kind of site who have no need to track behaviour anyhow, and are likely not tracking to begin with. kind of makes the request moot.

People get way too offended by analytics tracking when it's there for their benefit. The internet would be one ugly place if webmasters and designers had no clue how people were interacting with it. If you want to go back to the dark ages then feel free to try. But you won't benefit from the advances we've made or are yet to make because of large scale, anonymous tracking across the web.

I've no respect for Do Not Track. It is a silly, backwards, progress-endangering concept that should be burnt on a pyre.

Think of a scenario where a site is maliciously tracking you, where a forced browser level request could to not track be sent, and maybe we'll talk. But then again I'll probably just retort that any malicious tracking will have a way around such a forced request, and so it's pointless.

Do Not Track is snake oil for the conscientious objector.

Nursie13• 13 years ago

> I have a right to track how people use my site.

But you don't have a right to say what runs on my computer, or make it tell you what I'm doing. This is where our perceived rights collide.

> once you've made that choice you are within my domain, under my roof, living by my rules.

No, my computer, my browser, my roof, my rules.

> People get way too offended by analytics tracking when it's there for their benefit.

No, people get offended when you try to turn their computer into a device that spies on them. And we get more offended that this sort of stuff happens without most people even being aware its going on. They may or may not object to it, but right now they don't even know.

And it's so lovely of you to have made the decision for me that it's to my benefit, so I don't have to worry about pesky things like privacy concerns, or having control over my own computing.

> Do Not Track is snake oil for the conscientious objector.

This is about the only thing we agree on. It's pointless and it was never going to achieve anything.

toble• 13 years ago

No, my computer, my browser, my roof, my rules.

I think of websites like private properties. You are given conditional access on the assumption that you can behave (T&C / AUP), otherwise it's like trespassing. So, I don't think that people should expect excessive rights of freedom that they might have on their own property or even in public. It's a balancing act.

bad_user5• 13 years ago

No, my computer, my browser, my roof, my rules

His website.

Seriously, people should be warned that they are tracked, the purpose for which they are tracked and what exactly is tracked. Google Search for example is giving warnings lately, that you have to manually dismiss (probably because of EU laws) and I view that as being progress.

On the other hand demanding of publishers to not track you while you're on their property is unreasonable. Of course, you can complain about it, you can stop using such services or websites and so on. Voting with your wallet (or eyeballs) still works, even on the web.

I also view the "Do Not Track" header as a good thing, because it's an automated way for publishers to respect your wishes, should they choose to do that. But customers must also understand that this header represents a kind request, nothing else and we shouldn't make it something else, as that's a slippery slope.

jasonlotito6• 13 years ago

But you don't have a right to say what runs on my computer, or make it tell you what I'm doing. This is where our perceived rights collide.

You already have control over this. That doesn't contradict someones right to track how people use the site.

No, my computer, my browser, my roof, my rules.

And again, you already have control over this. However, if you give data to a remote server, they have the right to use that data. You are, in fact, giving them that data.

No, people get offended when you try to turn their computer into a device that spies on them. And we get more offended that this sort of stuff happens without most people even being aware its going on.

That's a result of people wanting defaults, and most people change those defaults to be the least annoying as possible, regardless of security/privacy implications, even if it's explained to them.

And it's so lovely of you to have made the decision for me that it's to my benefit, so I don't have to worry about pesky things like privacy concerns, or having control over my own computing.

But you do. You can prevent cookies from being put on your computer. You can prevent 3rd party cookies. You do have this control.

What do you not have control over that you feel you should have control over? You keep talking about control as if you don't have it?

jimktrains22• 13 years ago

> I have a right to track how people use my site.
But you don't have a right to say what runs on my computer, or make it tell you what I'm doing. This is where our perceived rights collide.

Exactly! But you also don't have the right to tell him not to send tracking info either. You do, however, have the right not to execute it. For instance NoScript, Ghostery,and AdBlock+ will prevent the requests for this content from being made and executed.

No, my computer, my browser, my roof, my rules.

I think OP meant that once you make a request to his server, his server is free to do what it wants with that request. I agree with this line of thought because most if not all others are silly.

No, people get offended when you try to turn their computer into a device that spies on them. And we get more offended that this sort of stuff happens without most people even being aware its going on. They may or may not object to it, but right now they don't even know.

Again, you have the ability to not let your computer send these types of requests for special analytics packages &c. You can't possibly believe that his storing access logs is wrong.

This is about the only thing we agree on. It's pointless and it was never going to achieve anything.

Hear! Hear!

mcgwiz2• 13 years ago

Client and server, guys. A web browsing experience is a cooperative endeavor that occurs on property controlled by both the host (web server) and the visitor (user agent).

At a fine-grained level, different aspects of that experience can be said to occur specifically on client or server. Each of those aspects can be constrained or manipulated by the respective property owner.

When it comes to preferences of the visitor for certain server actions (or inactions), one can only make a request. This isn't a grand moral point, or a technical one, but one of basic property rights and personal freedom. And such a request is what the DNT header signifies.

Likewise, when the server has preferences for certain user agent actions (such as running JavaScript or storing cookies) again it can only request that this occur since the user agent can typically disable JavaScript or cookies. This is what certain HTML metadata elements and the Set-Cookie header signify.

If visitors are unhappy with the behavior of a server, they can avoid it. In aggregate, such avoidance can become a significant market force. At the same time, a website that does no analytics for DNT visitors and has a high ratio of DNT visitors may also become less competitive and valuable over time. Both can feedback into respective preference consideration. This is ultimately the meager value of DNT. It (combined with adequate education) provides extra context data that can motivate through market forces an adjustment to web browsing norms.

Along the lines of "adequate education", the option in Firefox should read "Tell websites to restrict their tracking of me. __(Learn more.)__"

Practically, how would you know in advance if a server will respect your DNT preference without first visiting the site? Well, in real life, how do you know whether someone who invites you over for dinner won't serve you poison? One way is through trusted third-parties, but the market hasn't yet demanded such a service (and may never).

ronaldx5• 13 years ago

People get way too offended by analytics tracking when it's there for their benefit.

Strong disagree. Whether a user finds benefit from tracking is the opinion of the user, not the opinion of the site doing the tracking.

It's very arrogant for a site to say "I'm doing this to you for your benefit", especially if it's not made clear what this is. If you find yourself having to tell someone that what you are doing is for their benefit, without explaining exactly what you are doing and why, you can safely assume it's not genuinely for their benefit.

I can agree that malicious tracking cannot be prevented - but this does not mean that benign sites are implicitly permitted to maliciously track people. That is totally unethical.

eksith• 13 years ago

  "once you've made that choice you are within my domain"

Often, I haven't made that decision; an ad/tracking/analytic company has made the decision for me and often not for my benefit.

If I'm visiting a site that talks about rocketry and I'm suddenly being served ads for fishing lures and rods because 10 minutes prior, I was searching for fishing reels, it feels creepy. And it's entirely your opinion that feeling creepy about being served ads for something I'm not currently looking at is wanting "to go back to the dark ages".

Take it in another way. If I'm visiting a flea market on Saturday morning and going by some stalls that sell home made cookies and such, I'm fine getting a flyer for pastries, donuts and cakes. I'm not fine getting a flyer for an 18 pack of socks at the cookie stall because Friday night after work, I went shopping for boxers at a completely different place.

Since many advertisers seem to have the Zuckerberg mindset when it comes to privacy and the mere notion of wanting to remain "un-caterered to" no matter how helpful and in my benefit you think it is, we're forced to take measures into our own hands.

BTW... Mozilla.org not respecting Do Not Track is exactly what I expected since they've decided that my request is needless considering what they produce.

delinka• 13 years ago

Rather than attempt to reply to all the misconceptions below, I figured I'd post here.

I'm not on your server. My browser isn't on your site. It sent a request to your server to send me a copy of some content. Your server sent that content. It's all on my computer.

This, in my opinion, is why Do Not Track is silly: You, nor your server, have any right to the expectation that I'll send tracking information (that your site provided in, say, a cookie) with every request. Meaning that the browser makers should be providing users options in this space- the power lies entirely with the browser makers and their users. Of course, completely omitting cookies and other tracking details leaves you, the site owner, making assumptions about user behavior on your site from a limited number of details like IP address and perhaps user agent strings. The ever popular cookie was the answer to maintaining session data across requests, and Double Click made famous the idea of tracking users across many sites (by embedding their assets [a blank pixel, a JavaScript, etc] and giving the user a doubleclick.net cookie.) Double Click's concept was, in the minds of most Internet users, a perversion of the purpose of cookies.

nfoz• 13 years ago

I have the right to track how people use my site.

lol no you don't. You're choosing to respond to HTTP requests to your site, you put it out in public. I'll make whatever requests I want to your site and do whatever I want with what you give me, which may include rendering some or all parts of a "web page" as I see fit. If I give you some data in turn, sure, do what you want with it.

Do Not Track is silly because it's based on trust. I don't trust you to not track me even if I ask you not to. The only privacy is when I choose not to send you data (and I shouldn't, and browsers are horrible in this regard, they have failed their users).

jackalope• 13 years ago

People get way too offended by analytics tracking when it's there for their benefit.

While I agree with the rest of your comment, isn't it possible that analytics is just snake oil for webmasters? The third party services like GA collect a staggering amount of real-time aggregate data in return for sharing a sliver of it with webmasters in the form of pretty graphs. I'm not saying this information isn't useful, but can webmasters reconcile the results against their own logs? Can they submit sanitized logs for analysis instead of including code in web pages, so they can proactively protect user privacy while sharing only the minimum data necessary for their needs? In any case, analytics services aren't motivated purely by altruism and their business model plausibly extends beyond purely providing a service to webmasters.

Boldewyn• 13 years ago

The discussion is good and also a great example for Mozilla caring (especially that it is discussed in the open for all to see).

jeremysmyth• 13 years ago

There's a large effective difference between "do not track" as it is outlined in the bug, and how many people see it (see, for example, comment 16 in the report, and then comment 25)

Specifically, it's to do with third party cookies, not any particular site.

If I visit someone's website, I'm usually perfectly happy for them to record my visit and my actions. If, on the other hand, I visit their website and some invisible actor (say, an advertiser) also tracks me, then it becomes insidious, especially if that other invisible actor is active on multiple sites.

This gets a bit blurred when you've got large vendors with multiple presences. For example, years ago when you logged into Hotmail, you'd be briefly redirected via passport.com (then live.com), and then directed back to Hotmail. Similarly, going to Microsoft's web page, or MSN's, or Technet, or any other site in the Microsoft stable, would redirect via the same site. This gave them single-sign-on, but also allowed them to "track" your activity across the entire network. That behaviour is used by many other large organisations such as Google.

However, it's also made its way into other large sites like Facebook and Twitter, because sites like that have "social media buttons" appearning on sites that aren't served by those sites but are served by Facebook and Twitter, so becoming third-party objects, and doing the same sort of pervasive insidious tracking across multiple domains and web properties.

The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner.

So, where "do not track" fails is in distinguishing between "tracking" that's acceptable to many people, and "tracking" that's somewhat more invisible and pervasive. Switching it all off is harmful to the internet, but until it's sold correctly, it won't be acceptable otherwise.

Silhouette4• 13 years ago

Several web font services now fall into that category as well. The problem from a user's point of view is that you can block Google Analytics or Facebook Like buttons without any loss of functionality you probably wanted, but blocking Typekit or Google Web Fonts will often mess up the rendering of a page.

This changes the rules fundamentally. Before, with free services where you weren't the customer but the product, you could opt out by simply not using the service. Now, even with services where you really are the customer and maybe you really are paying for it, you can't opt out of the potentially intrusive third party service without opting out of or significantly degrading the main service you wanted to use as well.

This is a tricky area. Those third party services are pervasive precisely because they are useful to people who build the web sites that users enjoy, and if they're being given away for free, they have to fund themselves somehow. I also don't have much sympathy for people who don't load up someone's web site as it was presented to them but then complain that it doesn't look right or work properly (see also: not running JS, complaining that you can't want Flash content on your iPad, etc). In some respects, these third party services are almost certainly beneficial to users, too, because they act as CDNs that probably improve performance and lower bandwidth requirements compared to having every site self-host the same common material.

On the other hand, privacy matters. We have drifted into a situation where this kind of ubiquitous monitoring is widely used by site owners, but many of them probably don't even realise the implications for their users' privacy, or just don't care. We have rules about data protection and spamming and the like to deal with similar situations in slightly different contexts, and maybe it's time we had some rules about tracking by services that are incorporated indirectly on other people's web sites and possibly without a visitor's knowledge.

38254• 13 years ago

Would it satisfy the bug reporter if we show a HTTP 401 unauthorized for anyone who has DNT turned on?

belorn6• 13 years ago

Switching it all off is harmful to the internet.

See comment 28 in the report. No one has argued to turn of all analytics on website. That is a straw man argument. The bug report simply ask that users who explicitly do not want to be tracked, can have their request granted. Turn off analytics for them and the problem is solved. Alternatively, they can use analytics that do not track each individual user.

We used to live in a world where statistics did not include 100% tallied votes. It was simply too expensive to do survey on all customers, all citizens, all users. Trends and data was extracted out of a limited sized sample, commonly from a opt-in basis. With websites however, it as cheaply and easy to track all users as it is to track a limited set of users, so data tend to be 100% rather then a subset. Thus, total tracking has always been about the price, rather than need.

hsuresh• 13 years ago

I usually use an analogy to explain this. Tracking via first party cookies is like walking into a store that uses security cameras. I have even seen boards that inform the visitors that the store is under surveillance. Generally, the security camera is only monitored/used by the folks running the store.

Third party cookies are like as if the security camera is monitored and used by a random third party company who you are not even aware of. This is why it is bad.

Perhaps we should have a standard badge/button to indicate first party and third party tracking - something like https://www.safetysignsupplies.co.uk/images/product_imgs/ful... for first party cookies and a more "evil" version for third party cookies.

clarkevans• 13 years ago

Mozilla uses Google Analytics Premium Service ($150k/year) which includes a contractual option to prevent secondary use of the visitor data. Therefore, they see it as legally in the spirit of Do-Not-Track -- Google is a contractor collecting the visitation data solely for the pleasure of Mozilla.

https://bugzilla.mozilla.org/show_bug.cgi?id=858839#c21 https://groups.google.com/forum/?hl=en&fromgroups=#!search/m...

From the latter thread, Stacy Martin at Mozilla represents "Google Analytics will not correlate or report on any customer data with any other data, they will use Mozilla data only to provide and maintain the service for Mozilla, and they will not share or use it for any other purpose."

EDIT: The contractual arrangement is relevant. Section 9.3 item 2 of the IETF do-not-track draft draws has an exception for this very situation, "data obtained by a third party exclusively on behalf of and for the use of a first party".

http://tools.ietf.org/html/draft-mayer-do-not-track-00#secti...

belorn6• 13 years ago

See comment 16.

The bug report is not about the legal contractual agreement between Google and Mozilla, but rather about user expectation from a "do not track me" option. Some users, maybe faulty or silly, consider a "do not track me" option to simply mean, do not track me.

It doesn't mater if Google sign a service contract that Mozilla pays $150k/year. "Do not track me" means, do not track me. It doesn't matter if Google promise to not be evil. Do not track me still means, do not send tracking data to Google. It doesn't even matter how extremely useful or good intention Mozilla or Google has with the tracking data. "Do not track me" really do mean, do not track me.

jasonlotito6• 13 years ago

Something to consider. In Firefox, the DNT options have a Learn More link that answers the question:

"Do Not Track is a feature in Firefox that allows you to let a website know you would like to opt-out of third-party tracking for purposes including behavioral advertising. It does this by transmitting a Do Not Track HTTP header every time your data is requested from the Web."

While you can debate whether that's the appropriate place for that information, it's not as if Mozilla is hiding this information. It's easily reached, and not at all intentionally hidden away. Nothing devious. Just a question of how to appropriately display the information.

panacea• 13 years ago

Should a distinction be made between "Do not track me" and "Do not track anonymous/aggregate user's paths".

Serious question. I think that's what's being suggested here?

Fice• 13 years ago

These obligations are meaningless unless there is a way to verify compliance.

nullc• 13 years ago

This has shades of a comparison between security by architecture vs security by agreement/trust:

https://groups.google.com/d/msg/mozilla.governance/tMt7-amcK...

hawleyal• 13 years ago

Real people are not reading the RFC.

nly2• 13 years ago

Instead of the useless EU cookie legislation, we should have had legislation that enshrined explicit privacy preferences in to data protection law.

When I signup to a website I'm expected to agree to their Privacy Policy. Both site owner and visitor expect that policy, provided that it's legal, to be somewhat enforceable in court. When I'm just visiting, why is there no such equivalent?

The problem with DNT isn't that it can be ignored, it's that it can be ignored without penalty. People who think purely technical solutions (including Ghostery, NoScript, Adblock etc.) are the answer are ignoring the reality of how easy it is to fingerprint and track users on the web.

meapix• 13 years ago

I don't think they can do this though. They can however disable javascript.

supermatt3• 13 years ago

"Do not track" in its present (non-)state is a farce. It should be implemented at the browser level.

My ideas on DNT:

If a user specifies "do not track" in their browser-global or site-specific settings then ALL requests to third party domains should simply be blocked.

This could be backed up by a site-provided manifest (potentially containing a comment for each ones justification, or a flag to say if its required or optional) to 'whitelist' 3rd party domains that they require it. There should be a browser feature to view this whitelist and 'uncheck' any sites you disagree with.

In fact, IMHO, thats the way modern browsers should work anyway - it would certainly solve a huge number of other issues (XSS, etc).

pornel• 13 years ago

ALL requests to third party domains should simply be blocked.

It's too late to do that. There's lots of websites relying on 3rd party CDNs for non-tracking purposes (CloudFront, Google-hosted jQuery, etc.)

Filtering on domain name alone won't prevent traffic from going through 3rd parties — tracking companies can ask websites to set up DNS CNAME for them or they'll use top-level HTTP redirects (like google.com uses to track SERP clicks).

And "my mom" isn't going to be able to vet list of domains. She'll call me and ask me to "fix" the computer so that "Log in with Facebook" works and there are no scary technical questions.

supermatt3• 13 years ago

It's too late to do that. There's lots of websites relying on 3rd party CDNs for non-tracking purposes (CloudFront, Google-hosted jQuery, etc.)

Undoubtedly - hence the site-defined manifests for third parties.

wtetzner• 13 years ago

Yeah, DNT is kind of silly. It's like someone read the evil bit RFC (http://www.ietf.org/rfc/rfc3514.txt), thought it was a good idea, and implemented it at the level of HTTP.

supermatt3• 13 years ago

I'd like to expand on this idea, by suggesting that in the case of sites being 'whitelisted' in the site-manifest, that they should only have access to an alternate cookie type, such that they are only accessible via that domain.

i.e. instead of them having access to cookies stored under their own domain (e.g. cookies stored under thirdparty.net) they have access to cookies stored under the scope of the domain of the website in the browser address bar (e.g. cookies stored under thirdparty.net@targetdomain.com).

This would allow the use of third party services, but specifically restrict their usage to the target domain.

strictfp• 13 years ago

It's another case of bad naming. The feature should be called something less absolute like "do not track me across websites" or "track me less".

lucb1e• 13 years ago

The very fact that the website must support DNT is its only and fatal flaw. Why should we trust websites to honor DNT when we keep sharing information with them?

jimktrains22• 13 years ago

I agree entirely. IF I send a request, I expect that request to be stored. If I don't want to make the request, I won't make the request (noscript, ghostery, and AdBlock+ go a long way to that).

DNT is a pointless 8 bytes that has no real, enforceable meaning.

generj3• 13 years ago

We can have our cake and eat it too.

Send the DNT header flag, but purposefully edit analytics requests. Thus, providers must honor DNT requests or risk a poisoned well of data.

This is not theoretical, I have a Chrome plugin which does this to Google Analytics requests, and am increasingly tempted to release it to the world.

teamjimmyy4• 13 years ago

I don't get it. Why is this different from inspecting your web logs? Sure you lose the first-party cookie aspect, but I bet you can get awful close just looking at the request IPs. There's "tracking" inherent in how everything works, so why does it matter if collection is contracted to a 3rd Party?

Does the poster expect the web server to not write a log line because he sent a DNT header too?

generj3• 13 years ago

IP logs aren't sufficiently unique: my IP changes as I move my laptop around, it is shared with several other persons at work and home, and my IP at each of these locations changes.

Most DNT is concerned with Javascript, which has the ability to be very intrusive than mere web logs. Analytics services started with web logs, but quickly transitioned to Javascript, because I can track a cookie much better than an IP address, and get more information besides.

It's inherently different when contracted to a 3rd Party.

Third-party vendors are opposed because it would be the equivalent of giving all of the IP logs from a majority of the Internet to a single user (in this case, Google Analytics). The ability to discover trends on particular users than becomes massively possible in a way that simply doesn't exist with 1st Party tracking. The siren's call to monetize this data is ever present, so we seek to not allow the collection in the first place.

teamjimmyy4• 13 years ago

I'll say here what I said in the other reply, but briefly.

There's a difference between a 3rd party doing the analytics and a 3rd party cookie. GA can (and should) use a 1st party cookie for this, which would make it impossible for them to correlate between sites. As a bonus, turning off 3rd party cookies also breaks ad retargeting, which makes everything better.

At that point, it's the same as Mozilla doing it themselves, but your concerns about JS being more potentially intrusive is valid.

note: i may be wrong about GA using 1st party cookies. if so, that's really not cool.

bloopletech6• 13 years ago

One of the big differences between 1st-party and 3rd-party tracking is that Bob at Bob's Cakes can only see what you're doing on Bob's site (1st-party tracking), but if Bob uses Google Analytics, and so does Jane, and Sarah, then Google Analytics (3rd-party) knows about your activity _across_ Bob's, Jane's, and Sarah's sites, which can potentially be used in worse/more invasive ways.

Also, the javascript tracking scripts can capture a lot more information than a simple access log line - they're not directly comparable.

teamjimmyy4• 13 years ago

This isn't strictly true, which is why I made the differentiation above between 1st and 3rd party cookies. With the 1st party cookie you'd get a new GA cookie on each site (e.g. mozilla-GA, ycombinator-GA, etc), making those correlations impossible. In the case of 3rd party cookies, yeah, I totally get that they can be used for some seriously evil things.

It's possible GA could try to correlate IPs or browser fingerprints between 1st party cookies over multiple sites, but proxies and mobile devices would make that difficult. The fact that all the data is together in GA's warehouse doesn't change the fact that the data isn't there to be correlated.

As for JS being able to be more intrusive, sure, I get that. At that point, I suppose you have to trust the site you're on that they wouldn't use a service that was intrusive. Perhaps this is a bridge too far for some, which is reasonable.

I guess I just don't get wanting to ban the tool entirely when it could but is not currently be used nefariously. (working on the assumption that if GA started fingerprinting browsers someone would've seen the traffic by now. it's not easy to hide.)

lnanek2• 13 years ago

So maybe the text in the UI jut needs to be changed to be more accurate. Instead of "Do Not Track", something along the lines of "Request No Tracking Across Sites" or "Request No Cross-Site Tracking". This clarifies that it isn't the browser stopping tracking, it is the browser asking the sites not to, which they may or may not implement. It also clarifies that what is being requested not to happen is using the same identifier across sites and between different parties.

On an unrelated note, I'm really impressed with the Persona login on that site. When I first saw it I thought, oh no, not another username and password. Why can't they just use social login where I already have accounts? But all I had to enter was my gmail address, approve the usage, and I was done. No extra username and password even though I've never used Persona before. No need to confirm an email. It worked out really well.

Radle• 13 years ago

Thanks for the link i just installed a "do not track plugin". Fuck Google

Plugin: (https://addons.mozilla.org/en-us/firefox/addon/donottrackplu...)

diminoten• 13 years ago

I genuinely don't understand all the hatred out there for advert companies tracking user purchase trends. Can someone explain to me why I should care about this?

natch• 13 years ago

I think it's more a hatred of (perceived or real) trickery, deception, and weasel words, in this case. From an organization that should be a model for others to follow.

znowi• 13 years ago

I'm with the bug author on this: "do not track" should mean do not track. And it explicitly mentions analytics on the DNT site.

Do Not Track is a technology and policy proposal that enables users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms

http://donottrack.us/

However, Wikipedia says that the exact definition of what constitutes tracking is not yet clear.

The Do Not Track (DNT) header is the proposed HTTP header field DNT that requests that a web application disable either its tracking or cross-site user tracking (the ambiguity remains unresolved) of an individual user.

https://en.wikipedia.org/wiki/Do_Not_Track

teeja• 13 years ago

That discussion is full of the usual run-arounds.

The man scored a major point, and Mozilla has chosen to run away from it. The DNT flag, so far, looks just like the worthless piece of promotional fluff and 3-card Monte it is. ESPECIALLY if Mozilla chooses to run away from it.

We're going to need laws to protect us from the continual government AND corporate riot of people-tracking. The People don't like it, and once they get done with NSA in Congress, they might as well get busy on making tracking OPT-IN. Including cookies, browser finger-printing, stashing stuff in browser cache (disk AND memory), and the hundreds of other ways these geniuses have evolved to invade the social communication space to promote their bottom line. We badly need to have this discussion as a nation. Because its starting to run over our boot-tops.

Tracking could be limited to dot-coms. Then let the People decide whether to keep dot-coms in their bookmarks, or leave the rats to go down with their ship of fools.

Do Not Track is not respected on mozilla.org

Related Stories