Noodle on third-party cookies

[mnot]

For #1372.

[miketaylr]

This is a nice improvement, thanks.

[jwrosewell]

I'm concerned about the general direction of this PR and the document in general. A reliable method of sharing information between data controllers is needed to enable smaller organisations to band together to offer comparable services to larger organisations that are able to operate their services under a single domain or origin or have sufficient brand presence to nudge users to login across multiple services.

This PR emphasis unspecified concerns in the industry and appears to endorse a direction set by internet gatekeepers without evidence of those concerns and without providing any specifics concerning the equivalent guidance for user agents to support lawful use cases.

[mnot]

@jwrosewell concern isn't actionable. What specific statements are incorrect?

[jwrosewell]

The technical standards environment has been conditioned over a long period to tolerate and advance discrimination against suppliers and smaller operators. The text needs to be balanced to include the position of competition and privacy regulators if it is to properly inform the reader concerning the state of data sharing including third party cookies. As it stands the text perpetuates selective prosecution by internet gatekeepers.

[mnot]

James, this isn't a competition regulator or a courtroom -- it's recording the consensus of the technical community, which has had a long history of balancing privacy concerns against technical capabilities. The proposed text is largely a statement of fact and history, not creating policy. The one exception I see - recommending that UAs adopt restricted third-party cookie policies -- is something that the various iterations of the Cookie spec have done since the very beginning.

Again, if you believe there's an inaccuracy, please point it out.

[sbingler]

This looks good, thanks for your effort!

[jwrosewell]

Completeness

The proposed text is largely a statement of fact and history, not creating policy.

In which case it should reflect all the facts and all the history rather than being selective.

Experiment

The latest PR contains the following text.

…ongoing developments in user agents are best characterised as experiments that can provide input into that eventual consensus.

Checking the meaning of the word experiment with Websters provides the following definition.

• test or trial
• a tentative procedure or policy
• an operation or procedure carried out under controlled conditions in order to discover an unknown effect or law, to test or establish a hypothesis, or to illustrate a known law

All web browser vendors have adopted concrete and widely communicated policies on the subject and many have widely deployed implementations. There is nothing experimental.

Established practice

The IETF considers factors beyond the text of past specifications. RFC 8890 is one such example. The sharing of state between different origins or domains via HTTP and other methods has enabled a great deal of innovation and benefits to end users including free and easy access to services. End users have many service providers to choose from. We have moved on from the days of closed services such as Compuserve, Prodigy and AOL. The guidance in future specifications must show how benefits to end users are preserved and enhanced by mitigating the potential harms.

[Lukasa]

This looks reasonable to me: it seems like a measured reflection of the current consensus and doesn't overstretch to try to declare a specific mitigation at this time. Good stuff.

[johnwilander]

Thanks for this PR. Switching from my co-editor hat to my Apple WebKit hat, I just wanted to express support for this.

[johnwilander]

I think some browsers are well beyond what would be characterized as experiments.

[jwrosewell]

The text should further modified to incorporate the positions of law makers.

Extract from An EU Strategy on Standardisation.

"A particular critical situation relates to internet standardisation to promote a free, open, accessible, inclusive and secure global internet. In recent years, international standardisation on internet protocols has become increasingly politicised, at the risk of limiting the evolution of the global open internet and hampering the digitisation process across the world."