Apache man disables Internet Explorer 10 privacy setting
Fielding: Windows 8's web window is 'standards abuse'
Apache HTTP daddy Roy Fielding has patched his popular server, telling it to ignore user privacy web settings in Internet Explorer 10.
The Fielding patch will mean millions of web servers will ignore the Do Not Track header that's sent to them by users in IE 10, the browser for Windows 8.
Apache is used by nearly 600 million websites – about 60 per cent – according to Netcraft.
Fielding, a member of Apache who is also involved in drafting a World Wide Web Consortium’s (W3C’s) DNT specification here, posted the code to Github with the message: “Apache does not tolerate deliberate abuse of open standards.”
Microsoft is also a member of the working group drafting the specification with Fielding.
Windows 8 turns DNT on in IE10 by default and gives the user the freedom to turn it off using the Express and Customize settings during Win8's set-up. But unless the user actively turns it off – or on – the advertisers can choose to ignore the default setting, Fielding argues.
DNT has became a hot issue among browser makers. Mozilla was the first browser-maker to institute the anti-stalking techniques, with Firefox 4 in 2010, by adding an HTTP header in its browser that alerts websites that the user would like to opt out of online behavourial advertising.
Microsoft made much of its addition of DNT, calling it “our commitment to privacy by design and putting people first.” “We believe consumers should have more control over how data about their online behaviour is tracked, shared, and used,” chief privacy officer Brendon Lynch blogged when Microsoft said DNT by default was coming to IE10.
Mozilla has opposed Microsoft’s approach, saying the decision to go DNT must be the user’s choice.
Fielding seems to objecting to DNT being turned on by default, arguing that Redmond "knows" DNT will be ignored by websites and ads networks that insist on seeing DNT turned on by a human instead – as a matter of preference.
Fielding wrote of his action:
The only reason DNT exists is to express a non-default option. That's all it does. It does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.
Microsoft deliberately violates the standard. They made a big deal about announcing that very fact. Microsoft are members of the Tracking Protection working group and are fully informed of these facts. They are fully capable of requesting a change to the standard, but have chosen not to do so. The decision to set DNT by default in IE10 has nothing to do with the user's privacy. Microsoft knows full well that the false signal will be ignored, and thus prevent their own users from having an effective option for DNT even if their users want one. You can figure out why they want that. If you have a problem with it, choose a better browser.
If there’s a problem with Fielding’s stance, however, it's that the W3C DNT draft does not tell browser makers how they should implement DNT. Reg regular Tim Anderson also points out here that the section on user choice was added to a section of the draft after the consumer preview of Windows 8 from Microsoft on 29 February.
The section in question reads: “Key to that notion of expression is that it MUST reflect the user's preference, not the preference of some institutional or network-imposed mechanism outside the user's control.”
Also, somewhat controversially, Fielding has updated the code of millions of servers to not accept the privacy settings of the browser in Windows 8 silently, without apparently notifying the world or seeking its approval.
The response, needless to say, has been both explosive and polemical. ®
Sponsored: Becoming a Pragmatic Security Leader