RE: ACTION-211 Draft text on how user agents must obtain consent to turn on a DNT signal

Rigo,

It is the very fact that the server cannot know whether the setting was enabled by the user or the browser which makes the browser non-compliant.  As such, the server communicates its inability to respond appropriately to the header back to the user to let them know that if they did initiate the intent, it will not be acknowledged unless they use a supported compliant browser to convey the intent.

-kevin


-----Original Message-----
From: Rigo Wenning [mailto:rigo@w3.org] 
Sent: Wednesday, June 13, 2012 10:56 AM
To: public-tracking@w3.org
Cc: Shane Wiley; Peter Cranstone; Justin Brookman
Subject: Re: ACTION-211 Draft text on how user agents must obtain consent to turn on a DNT signal

On Wednesday 13 June 2012 07:58:02 Shane Wiley wrote:
> The Server doesn't need to know - I believe that's the point you're 
> missing.  The user installed a non-compliant UA and the Server will 
> respond as such.  The user then has multiple options to exercise their 
> choice but continued use of that specific UA to communicate DNT is NOT 
> one of them.

Shane, 

the user can't communicate back to the server that she has now looked into the preferences, made a real choice, but wants to continue to use IE10. This is the big bug in the suggestion for the discrimination of a user agent currently suggested by you, Ian and Roy. IE10 is not uncompliant in every situation. And the current suggestion can't change back to "I accept" as the user has no means to communicate back "I really really mean it". You just will reject all DNT traffic from IE10. This means you discriminate against valid traffic without any possibility to rectify.

And this is really something where I start to have some doubts. 
Browser sniffing is evil. Again: Browser sniffing is evil. Why don't we then start saying, we do not like traffic from AVG. We believe it is not compliant etc.. Where does that discrimination end? And again, the user can't revert that as it is hard coded into your servers.

There must be another way. Lets brainstorm about it. But browser sniffing is evil! The solution to ignore a signal based on some (possibly spoofed) vendor string in the HTTP chatter is definitely going the wrong way. 

Rigo

Received on Wednesday, 13 June 2012 22:02:33 UTC