Feeds

Apache man disables Internet Explorer 10 privacy setting

Fielding: Windows 8's web window is 'standards abuse'

Intelligent flash storage arrays

Apache HTTP daddy Roy Fielding has patched his popular server, telling it to ignore user privacy web settings in Internet Explorer 10.

The Fielding patch will mean millions of web servers will ignore the Do Not Track header that's sent to them by users in IE 10, the browser for Windows 8.

Apache is used by nearly 600 million websites – about 60 per cent – according to Netcraft.

Fielding, a member of Apache who is also involved in drafting a World Wide Web Consortium’s (W3C’s) DNT specification here, posted the code to Github with the message: “Apache does not tolerate deliberate abuse of open standards.”

Microsoft is also a member of the working group drafting the specification with Fielding.

Windows 8 turns DNT on in IE10 by default and gives the user the freedom to turn it off using the Express and Customize settings during Win8's set-up. But unless the user actively turns it off – or on – the advertisers can choose to ignore the default setting, Fielding argues.

DNT has became a hot issue among browser makers. Mozilla was the first browser-maker to institute the anti-stalking techniques, with Firefox 4 in 2010, by adding an HTTP header in its browser that alerts websites that the user would like to opt out of online behavourial advertising.

Microsoft made much of its addition of DNT, calling it “our commitment to privacy by design and putting people first.” “We believe consumers should have more control over how data about their online behaviour is tracked, shared, and used,” chief privacy officer Brendon Lynch blogged when Microsoft said DNT by default was coming to IE10.

Mozilla has opposed Microsoft’s approach, saying the decision to go DNT must be the user’s choice.

Fielding seems to objecting to DNT being turned on by default, arguing that Redmond "knows" DNT will be ignored by websites and ads networks that insist on seeing DNT turned on by a human instead – as a matter of preference.

Fielding wrote of his action:

The only reason DNT exists is to express a non-default option. That's all it does. It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.

Microsoft deliberately violates the standard. They made a big deal about announcing that very fact. Microsoft are members of the Tracking Protection working group and are fully informed of these facts. They are fully capable of requesting a change to the standard, but have chosen not to do so. The decision to set DNT by default in IE10 has nothing to do with the user's privacy. Microsoft knows full well that the false signal will be ignored, and thus prevent their own users from having an effective option for DNT even if their users want one. You can figure out why they want that. If you have a problem with it, choose a better browser.

If there’s a problem with Fielding’s stance, however, it's that the W3C DNT draft does not tell browser makers how they should implement DNT. Reg regular Tim Anderson also points out here that the section on user choice was added to a section of the draft after the consumer preview of Windows 8 from Microsoft on 29 February.

The section in question reads: “Key to that notion of expression is that it MUST reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control.”

Also, somewhat controversially, Fielding has updated the code of millions of servers to not accept the privacy settings of the browser in Windows 8 silently, without apparently notifying the world or seeking its approval.

The response, needless to say, has been both explosive and polemical. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.