Re: [whatwg] Feedback on the ping= attribute (ISSUE-1)

2007-11-03 Thread Krzysztof Żelechowski
Dnia 02-11-2007, pią o godzinie 22:05 +, Ian Hickson napisał(a):
 On Sun, 28 Oct 2007, Roy T. Fielding wrote:
 
  Aside from all of the other issues, my vote would be to remove the ping 
  attribute from the specification.  It is not a desirable feature.
[snip]
  It is not sufficient for accurate user tracking (mandatory in the realm 
  of referral payments)
[snip]
  and is completely redundant to the current features provided by HTTP 
  (cookies and referrer)
 
 I don't understand how either cookies or referrers could be used here. 
 Could you elaborate? That's certainly not how tracking is more commonly 
 done today.

A client can simply reward the referrer for referring the user to it.
What is simpler than that?

Cheers,
Chris



Re: [whatwg] Feedback on the ping= attribute (ISSUE-1)

2007-11-03 Thread Dan Connolly

Julian Reschke wrote:
[...]

On Sat, 27 Oct 2007, Julian Reschke wrote:
We're long past that. It's trivial for a page to trigger a POST 
without the user knowing.

I consider that a bug in User Agents.


This is not a widely held opinion.


Well, it's what RFC2616 says. I would argue that if the HTML WG thinks 
there is a problem in what RFC2616 has to say about how to use unsafe 
methods, it should bring this to the attention of the newly formed HTTP WG.


True, whenever our spec conflicts with some other group's spec,
it creates a dependency; we're obliged to get review from that
other group and see whether they think what we're doing is
reasonable.

The chairs are supposed to keep track of all such dependencies;
the current HTML 5 draft seems to have a long of them. I have
some notes at http://www.w3.org/html/wg/il16#coord ; I'm thinking
about how to migrate it to tracker.

While the cost of getting review is a consideration, it's
far from a compelling argument. Sometimes the right answer
involves changing more than just the HTML spec.

Meanwhile, there's also the charter to keep track of; when we go
outside the bounds of what our original call for participation
said, we need to update that call for participation by
having the W3C membership review the charter change.
http://www.w3.org/2005/10/Process-20051014/groups.html#CharterReview

Stay tuned for more on managing the edge of our scope
later this week, in email and/or in the meeting...
  http://www.w3.org/html/wg/nov07


--
Dan Connolly, W3C http://www.w3.org/People/Connolly/



[whatwg] Feedback on the ping= attribute (ISSUE-1)

2007-11-02 Thread Ian Hickson

This e-mail contains replies to a number of e-mails received on the topic
of the proposed ping= attribute since January 2006. Since e-mail on this
topic was sent to both the WHATWG and HTMLWG mailing lists, I have cc'ed
both on this e-mail. Please pick just one when replying. Thanks!


On Thu, 19 Jan 2006, Tyler Close wrote:
 On 1/19/06, Jim Ley [EMAIL PROTECTED] wrote:
  On 1/19/06, Tyler Close [EMAIL PROTECTED] wrote:
  
   I think it would be fair to characterize current techniques for link 
   click tracking as opaque. In contrast, the proposed ping 
   attribute explicitly declares in the HTML what is intended and how 
   it will happen. Perhaps the right way to explain the ping 
   attribute is as providing transparent, or explicit, feedback; 
   shining a light on the dark corners of click tracking. If it is 
   explained that the feature will make link click tracking explicit, 
   controllable and more usable, I think the user base will react more 
   positively.
 
  No, they'll just disable it, as it does them directly no benefit and 
  has a cost, so if you educate them enough to make a decision, they 
  will not decide to be tracked.
 
 Why hasn't this happened to the HTTP Referer header?

Well, to a very small extent, it has. And indeed I would expect the same 
level of response to the ping= attribute as the HTTP Referer header 
received. This is actually a good thing -- we want people who want their 
privacy protected to this degree to be able to do so. Right now, they 
can't, because the existing tracking methods are roadblocks to the content 
they are tracking, and thus can't be bypassed.

The ping= attribute is intended to help users. Right now, user tracking 
happens widely, but suffers from a number of problems, including being:

 * non-transparent (users can't see what's being pinged easily)
 * non-optional (users can't disable it)
 * slow (adding DNS and TCP roundtrip to every tracked request)
 * obfuscated (the final target is usually hard to determine)

ping= solves all of these problems. It also helps the authoring side by 
making the tracking cleaner and making the user experience better, which 
should be enough to get authors to switch (we've already had a number of 
authors say they would use it as soon as it was widely available, some 
even said they'd use it earlier on a per-browser basis!).


  Since the main use of tracking has a direct economic cost to many 
  parties the sites will then return to using the established successful 
  methods for tracking, no-one will gain and browsers would've wasted 
  lots of time that could've been spent on more productive features.
 
 I think an economic analysis of the scenario is a valid approach. Could 
 you spell out your argument in more detail? For example, after I've 
 submitted a search request to Google, what is the economic cost to me of 
 letting Google know which result I selected? What is the economic 
 benefit to me of providing this information to Google?
 
 I can see an argument that there is a net benefit to me to provide this 
 information. I don't see a clear argument that there is a net cost to 
 me. At the start of the exchange, the thing of value that I have are my 
 search terms. Once I've given those up, Google already has most of what 
 it needs to effectively advertise to me. Allowing Google to know which 
 result was most relevant to me might mean I get more value in the future 
 for revealing my search terms, in terms of better query results.
 
 I'm interested to hear your economic analysis.

Jim was presumably referring to the ability to use ping= for tracking 
advertisments, and was suggesting that companies might be so greedy that 
they would refuse to use ping= for fear of not tracking users that had 
disabled the feature. Continuing with your theme above of a Google query, 
the theory might be that Google would value profit over user preferences 
so much that they would not use ping= for tracking conversions. I could 
assure you that this is not the case, I'm sure many people wouldn't be 
convinced. However, there is already a way to bypass the conversion 
tracking for ads: simply copy the URL given in the ad and paste it into 
your location bar. If greed was really beating the user's experience, I 
would presume that this would not be made available.


On Fri, 20 Jan 2006, Thomas Much wrote:
 
 There are browsers out there that let the user disable the HTTP referrer 
 (and enable it only for certain sites that require it for whatever 
 reasons). And our users definitely use this feature.

That's why we need to provide ping=. There's no way to do this at the 
moment. Users aren't able to disable tracking right now. They should be 
able to.


On Thu, 19 Jan 2006, James Graham wrote:
 
 Indeed. I believe that even browsers significantly more popular than 
 iCab allow for this. Yet the vast majority of people leave the feature 
 on.

Indeed. That's why we should not be worried about authors not using the 

Re: [whatwg] Feedback on the ping= attribute (ISSUE-1)

2007-11-02 Thread Boris Zbarsky

Ian Hickson wrote:
I agree that ping= should be made visible to users. Indeed, the spec 
explicitly makes that a SHOULD, going far outside its usual boundary of 
not specifying user interface requirements.


For what it's worth, this thread sparked some discussion at
http://groups.google.com/group/mozilla.dev.apps.firefox/browse_thread/thread/a8469770c8f9fe52/a014d681071eb449#a014d681071eb449.

The current state of things seems to be that creating a UI for this that would 
actually mean something to users without at the same time being completely in 
your face isn't really all that feasible.  For example, most users never look at 
the status bar when hovering over a link.


There will likely end up being an extension or something that will flag pings in 
the status bar for those who truly care, of course.  I would be very surprised 
if no one creates one.


As far as the default behavior goes, the current approach seems likely to be to 
provide no UI indication, and possibly to only allow pings to URIs that are 
same-host with the originating page (note same-host, and not same-origin, though 
that might end up changing too, of course).  And there would be preference UI to 
disable this behavior altogether, naturally.


Actually we did consider UI at the time (I was involved in the 
discussions). I would be interested in hearing details about the idea I 
suggested above, namely of putting the domain names of the hosts to be 
pinged in brackets after the link's own URI in the status bar:


   http://www.example.com/foo/bar (tracked by example.net)


That's one of the possibilities talked about in the thread above.

-Boris