Feeds

Apache man disables Internet Explorer 10 privacy setting

Fielding: Windows 8's web window is 'standards abuse'

SANS - Survey on application security programs

Apache HTTP daddy Roy Fielding has patched his popular server, telling it to ignore user privacy web settings in Internet Explorer 10.

The Fielding patch will mean millions of web servers will ignore the Do Not Track header that's sent to them by users in IE 10, the browser for Windows 8.

Apache is used by nearly 600 million websites – about 60 per cent – according to Netcraft.

Fielding, a member of Apache who is also involved in drafting a World Wide Web Consortium’s (W3C’s) DNT specification here, posted the code to Github with the message: “Apache does not tolerate deliberate abuse of open standards.”

Microsoft is also a member of the working group drafting the specification with Fielding.

Windows 8 turns DNT on in IE10 by default and gives the user the freedom to turn it off using the Express and Customize settings during Win8's set-up. But unless the user actively turns it off – or on – the advertisers can choose to ignore the default setting, Fielding argues.

DNT has became a hot issue among browser makers. Mozilla was the first browser-maker to institute the anti-stalking techniques, with Firefox 4 in 2010, by adding an HTTP header in its browser that alerts websites that the user would like to opt out of online behavourial advertising.

Microsoft made much of its addition of DNT, calling it “our commitment to privacy by design and putting people first.” “We believe consumers should have more control over how data about their online behaviour is tracked, shared, and used,” chief privacy officer Brendon Lynch blogged when Microsoft said DNT by default was coming to IE10.

Mozilla has opposed Microsoft’s approach, saying the decision to go DNT must be the user’s choice.

Fielding seems to objecting to DNT being turned on by default, arguing that Redmond "knows" DNT will be ignored by websites and ads networks that insist on seeing DNT turned on by a human instead – as a matter of preference.

Fielding wrote of his action:

The only reason DNT exists is to express a non-default option. That's all it does. It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.

Microsoft deliberately violates the standard. They made a big deal about announcing that very fact. Microsoft are members of the Tracking Protection working group and are fully informed of these facts. They are fully capable of requesting a change to the standard, but have chosen not to do so. The decision to set DNT by default in IE10 has nothing to do with the user's privacy. Microsoft knows full well that the false signal will be ignored, and thus prevent their own users from having an effective option for DNT even if their users want one. You can figure out why they want that. If you have a problem with it, choose a better browser.

If there’s a problem with Fielding’s stance, however, it's that the W3C DNT draft does not tell browser makers how they should implement DNT. Reg regular Tim Anderson also points out here that the section on user choice was added to a section of the draft after the consumer preview of Windows 8 from Microsoft on 29 February.

The section in question reads: “Key to that notion of expression is that it MUST reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control.”

Also, somewhat controversially, Fielding has updated the code of millions of servers to not accept the privacy settings of the browser in Windows 8 silently, without apparently notifying the world or seeking its approval.

The response, needless to say, has been both explosive and polemical. ®

High performance access to file storage

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
IRS boss on XP migration: 'Classic fix the airplane while you're flying it attempt'
Plus: Condoleezza Rice at Dropbox 'maybe she can find ... weapons of mass destruction'
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
New Facebook phone app allows you to stalk your mates
Nearby Friends feature goes live in a few weeks
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.