RE: HTTP Server's jobs for CGI applications

[boldt@xxxxxxxxxx]

Brad wrote:
>Hans,
>Only you disable cookies and Javascript.  ;)
>Paranoia of javascript and cookies is unfounded.

No, you're wrong.  Paranoia regarding these two is quite well
justified.  Use of the two by web sites can result in the
gathering of quite detailed information about your web
surfing habits.  And since privacy legislation in North
America is rather backwards in comparison to more enlightened
jurisdictions (such as Europe), you really don't know what
organizations buy and sell personal information about you.

Let me describe what can happen.  As you probably know, one
particular company has roughly half of all banner ad business.
Web sites that use this company's service don't serve the
banners themselves, but instead, code HTML which goes to the
banner ad company's server.  The banner ad company can set and
read cookies on your machine.  The banner ad company knows
which web page requested the banner ad (using the HTTP_REFERER
variable).  Thus, the banner ad company can build up a good
profile of where you surf.  For the next step, consider those
web sites that require user registration.  When they sell
their customer lists to the banner ad company, they now know
not only where you've been, but who you are.

Even if you only visit sites that promise not to well their
customer lists, you may still have your privacy compromised.
Consider toysmart, a web start-up that went belly-up.
Although they promised not to sell their customer list, it is
one of the things put up for sale by their creditors!

(You can read more about the security holes involved with
cookies at <http://www.cookiecentral.com/>.)

JavaScript is a whole other can of worms.  Personally, I tend
to keep it disabled for my home browsing for several reasons:
1) My browser never crashes with JavaScript disabled.  2) Too
many web sites do nonsense with it.  Just look at the nonsense
foisted on us by Geocities!  3) Some web developers use
Javascript coding that is specific to a particular browser and
you end up with lots of error messages popping up.

The bottom line is this - I know I'm not alone in my
concerns.  If you code a dependency on cookies and JavaScript,
you'll end up pissing off at least a few people.

Heck, it's not like it's that difficult to avoid using these
things.  There are other ways to maintain session state (easy
using Java Servlets in fact).  Also, it's not difficult to
limit JavaScript to things that only affect appearance and
don't affect navigation through your site.

Cheers!  Hans

Hans Boldt, ILE RPG Development, IBM Toronto Lab, boldt@ca.ibm.com


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---