- From: Lorrie Cranor <lorrie@research.att.com>
- Date: Sun, 13 Apr 2003 20:39:20 -0400
- To: public-p3p-spec@w3.org
I have reviewed the IE, Netscape, and PB translations and would like to share my observations. General Observations - Overall I found most of the translations to be accurate representations of the P3P vocabulary. However, there were a small number of elements that have a translations in one or more UA that I would argue are misleading (I will list them below). - I found the translations of some of the elements (especially the IE translations) to be rather verbose and in some cases written in language that I don't think will be all that clear to end users. For the most part I don't find these translations misleading and therefore I wouldn't really object to their continued use. However, I think they can be improved. - I found the grammar used in some of the Netscape translations to be problematic. Many elements listed under the same heading lack parallel structure. Again, this is not misleading, but any guidelines we issue should have proper grammar and consistent structure. Specific Observations - IE: uniqueid - I would strike "by a Web site or service" as this is a restriction not included in the P3P definition. Furthermore this definition does not make it clear that government-issued identifiers are excluded from this category - IE: demographic - I would strike "not tied to an identified person" as this is not a restriction included in the P3P definition. - IE: pseudo-analysis - I found the example in this definition especially confusing. - IE: ours - I found the this definition especially confusing. - IE: retention - I liked most of these definitions - IE: court - This is the only disputes that does not include a short description string... why? - IE: disputes - does not display long description string or remedies - IE: required attribute - not displayed... I would argue that this is fairly important - IE: consequence - not displayed - IE: data - only categories are displayed, not individual data elements... I would argue that it is important to display individual data elements or at the very least the categories they belong to rather than omitting them completely (unless all DATA is omitted) - PB: retention - does not display retention - PB: disputes - does not have translations -- displays short and long description... does not display remedies - NS: access - nonident and none don't fit parallel structure - NS: other-ident - I don't understand this definition at all - NS: disputes:law - I don't understand this definition at all - NS: correct - doesn't fit parallel structure - NS: purpose heading - "that you have supplied" is too limiting -- P3P policies also cover data the user may not have explicitly supplied - NS: pseudo-decision - short version doesn't mention pseudonymity and is indistinguishable from individual-decision - NS: other purpose / other category - I like the fact that NS flags other purposes that are missing the mandatory human-readable explanation -- this is a good alternative to refusing to process the whole P3P policy because of this - NS: ours - I think this definition is confusing - NS: uniqueid - not parallel structure - NS: demographic - I don't think this really captures the full P3P definition Some Questions for the TF to Consider - Should we try to converge on a single set of translations? Should we come up with a long and short translation for each element, perhaps using the click through approach like NS uses? Should our guidelines list all acceptable translations they people submit rather than trying to converge or one or two? - Should we recommend that P3P user agents be capable of displaying complete translations (all elements, including all human-readable elements)? If not, is there a minimum set of elements they should display? Or perhaps some guidelines on completeness that will prevent misleading users? - Should we make any recommendations about displaying human-readable fields? - Should we make any recommendations about displaying data elements and categories? - What other types of guidelines should we consider? - recommendation that UAs have ability to save policies - recommendation that UAs have ability to print policies (if run on devices connected to printers) - recommendation that UAs refuse to process CPs for sites not "properly" P3P-enabled - recommendation for checking cookie policies (strengthen 2.3.2.7 requirements)
Received on Sunday, 13 April 2003 20:38:37 UTC