Feeds

Apache man disables Internet Explorer 10 privacy setting

Fielding: Windows 8's web window is 'standards abuse'

Providing a secure and efficient Helpdesk

Apache HTTP daddy Roy Fielding has patched his popular server, telling it to ignore user privacy web settings in Internet Explorer 10.

The Fielding patch will mean millions of web servers will ignore the Do Not Track header that's sent to them by users in IE 10, the browser for Windows 8.

Apache is used by nearly 600 million websites – about 60 per cent – according to Netcraft.

Fielding, a member of Apache who is also involved in drafting a World Wide Web Consortium’s (W3C’s) DNT specification here, posted the code to Github with the message: “Apache does not tolerate deliberate abuse of open standards.”

Microsoft is also a member of the working group drafting the specification with Fielding.

Windows 8 turns DNT on in IE10 by default and gives the user the freedom to turn it off using the Express and Customize settings during Win8's set-up. But unless the user actively turns it off – or on – the advertisers can choose to ignore the default setting, Fielding argues.

DNT has became a hot issue among browser makers. Mozilla was the first browser-maker to institute the anti-stalking techniques, with Firefox 4 in 2010, by adding an HTTP header in its browser that alerts websites that the user would like to opt out of online behavourial advertising.

Microsoft made much of its addition of DNT, calling it “our commitment to privacy by design and putting people first.” “We believe consumers should have more control over how data about their online behaviour is tracked, shared, and used,” chief privacy officer Brendon Lynch blogged when Microsoft said DNT by default was coming to IE10.

Mozilla has opposed Microsoft’s approach, saying the decision to go DNT must be the user’s choice.

Fielding seems to objecting to DNT being turned on by default, arguing that Redmond "knows" DNT will be ignored by websites and ads networks that insist on seeing DNT turned on by a human instead – as a matter of preference.

Fielding wrote of his action:

The only reason DNT exists is to express a non-default option. That's all it does. It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.

Microsoft deliberately violates the standard. They made a big deal about announcing that very fact. Microsoft are members of the Tracking Protection working group and are fully informed of these facts. They are fully capable of requesting a change to the standard, but have chosen not to do so. The decision to set DNT by default in IE10 has nothing to do with the user's privacy. Microsoft knows full well that the false signal will be ignored, and thus prevent their own users from having an effective option for DNT even if their users want one. You can figure out why they want that. If you have a problem with it, choose a better browser.

If there’s a problem with Fielding’s stance, however, it's that the W3C DNT draft does not tell browser makers how they should implement DNT. Reg regular Tim Anderson also points out here that the section on user choice was added to a section of the draft after the consumer preview of Windows 8 from Microsoft on 29 February.

The section in question reads: “Key to that notion of expression is that it MUST reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control.”

Also, somewhat controversially, Fielding has updated the code of millions of servers to not accept the privacy settings of the browser in Windows 8 silently, without apparently notifying the world or seeking its approval.

The response, needless to say, has been both explosive and polemical. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.