Feeds

Apache man disables Internet Explorer 10 privacy setting

Fielding: Windows 8's web window is 'standards abuse'

Internet Security Threat Report 2014

Apache HTTP daddy Roy Fielding has patched his popular server, telling it to ignore user privacy web settings in Internet Explorer 10.

The Fielding patch will mean millions of web servers will ignore the Do Not Track header that's sent to them by users in IE 10, the browser for Windows 8.

Apache is used by nearly 600 million websites – about 60 per cent – according to Netcraft.

Fielding, a member of Apache who is also involved in drafting a World Wide Web Consortium’s (W3C’s) DNT specification here, posted the code to Github with the message: “Apache does not tolerate deliberate abuse of open standards.”

Microsoft is also a member of the working group drafting the specification with Fielding.

Windows 8 turns DNT on in IE10 by default and gives the user the freedom to turn it off using the Express and Customize settings during Win8's set-up. But unless the user actively turns it off – or on – the advertisers can choose to ignore the default setting, Fielding argues.

DNT has became a hot issue among browser makers. Mozilla was the first browser-maker to institute the anti-stalking techniques, with Firefox 4 in 2010, by adding an HTTP header in its browser that alerts websites that the user would like to opt out of online behavourial advertising.

Microsoft made much of its addition of DNT, calling it “our commitment to privacy by design and putting people first.” “We believe consumers should have more control over how data about their online behaviour is tracked, shared, and used,” chief privacy officer Brendon Lynch blogged when Microsoft said DNT by default was coming to IE10.

Mozilla has opposed Microsoft’s approach, saying the decision to go DNT must be the user’s choice.

Fielding seems to objecting to DNT being turned on by default, arguing that Redmond "knows" DNT will be ignored by websites and ads networks that insist on seeing DNT turned on by a human instead – as a matter of preference.

Fielding wrote of his action:

The only reason DNT exists is to express a non-default option. That's all it does. It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.

Microsoft deliberately violates the standard. They made a big deal about announcing that very fact. Microsoft are members of the Tracking Protection working group and are fully informed of these facts. They are fully capable of requesting a change to the standard, but have chosen not to do so. The decision to set DNT by default in IE10 has nothing to do with the user's privacy. Microsoft knows full well that the false signal will be ignored, and thus prevent their own users from having an effective option for DNT even if their users want one. You can figure out why they want that. If you have a problem with it, choose a better browser.

If there’s a problem with Fielding’s stance, however, it's that the W3C DNT draft does not tell browser makers how they should implement DNT. Reg regular Tim Anderson also points out here that the section on user choice was added to a section of the draft after the consumer preview of Windows 8 from Microsoft on 29 February.

The section in question reads: “Key to that notion of expression is that it MUST reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control.”

Also, somewhat controversially, Fielding has updated the code of millions of servers to not accept the privacy settings of the browser in Windows 8 silently, without apparently notifying the world or seeking its approval.

The response, needless to say, has been both explosive and polemical. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Sway: Microsoft's new Office app doesn't have an Undo function
Content aggregation, meet the workplace ... oh
Sign off my IT project or I’ll PHONE your MUM
Honestly, it’s a piece of piss
Return of the Jedi – Apache reclaims web server crown
.london, .hamburg and .公司 - that's .com in Chinese - storm the web server charts
NetWare sales revive in China thanks to that man Snowden
If it ain't Microsoft, it's in fashion behind the Great Firewall
Chrome 38's new HTML tag support makes fatties FIT and SKINNIER
First browser to protect networks' bandwith using official spec
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.