top | item 42232040

RFC 35140: HTTP Do-Not-Stab (2023)

815 points| zkldi | 1 year ago |5snb.club

211 comments

order

foundry27|1 year ago

It’s great satire, but it really does mirror a larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users. Do-Not-Stab, Do-Not-Track, whatever it might be, any sort of “voluntary compliance” is a non-starter in the face of financial pressures

IMO we need to start normalizing being militant about this stuff again, to aggressively and adversarially defend the freedom to use your computer the way you choose to use it

pims|1 year ago

It's amusing to see this message heavily upvoted on HN when most mentions of Firefox here are welcomed with an avalanche of perfect solution fallacies.

I'm dubious about people becoming militant about this when the software engineering industry gave Chrome a red carpet by using it and installing it on their relatives' computers while knowing very well it's adware and when switching to the alternative is incredibly cheap.

klabb3|1 year ago

> IMO we need to start normalizing being militant about this stuff again, to aggressively and adversarially defend the freedom to use your computer the way you choose to use it

Yes. As a millennial the times of civil disobedience was better. Not only did we get a better internet for consumers, but better companies were rewarded and won. Rose tinted glasses? Possibly, but there’s another reason for disobedience: the other side does it, and they do it just for money.

Concretely, is there something like Adblock that can be done for cookies? I don’t think blocking is as effective as poisoned data though. They ask for data, they should get it. If you don’t get consent, poisoned data is merely malicious compliance.

It could even be standardized as an extension to DNT: “if asking for consent after a DNT header, a UA MAY generate arbitrary synthetic data”.

mpalmer|1 year ago

To be extremely pedantic, it's great satire precisely because it mirrors that shift. Owes a lot to the OG, A Modest Proposal.

photonthug|1 year ago

> aggressively and adversarially defend the freedom to use your computer the way you choose to use it

Sadly even if you’re inclined to do this, it’s always a war of attrition, and corporations seem to realize they can just up the cost of your resistance in terms of time/frustration, and that’s enough for them to win in the long term. The history and trajectory of platforms, from browsers to AppStore’s to SaaS-all-the-things, is just tragic, with the amount of user control on a downward slide at each stage. The big question now is whether / how / to what extent AI is going to be corporate or democratized, but it’s hard to be optimistic.

Or, you know, if Clicking do-not-stab for 60 more years sounds like it sucks, you can try to become a shepherd or something. Works great for ~10 years, and then you can’t use cars, dishwashers or light switches without clicking do-not-stab, at which point they finally win and you say, you know what? I should be grateful they asked before they stabbed me, I practically owe it to them anyway, and I can’t wait to see all the love/cash rolling in after I’m a big shot shepherd influencer. Like and subscribe y’all and as always, hail corporate

aaronbrethorst|1 year ago

Best time to do that would've been 19 days ago, but here we are. Buckle up.

thrtythreeforty|1 year ago

I'm registering my elderly relatives for dmachoice.org, to prevent them from getting junk mail. These clowns create the problem and then have the audacity to charge you to be added to the opt out list. I was really skeptical about the GDPR when it was passed and I am now fully on board for an American version.

IgorPartola|1 year ago

I wonder if there is some way to DoS the tracking services by basically accepting third party cookies but then immediately discarding them so every page load generates a new cookie and presumably state stored on the other end to match it. Or are these tracking cookies typically self-contained so that no state is stored server-side?

shadowgovt|1 year ago

On the internet, it started as the user's responsibility.

For netizens, the idea that the use should be able to opt out of logs about their interaction with the service the operator owns is novel (because they always had the option of not using the service if they found the pattern distasteful).

wkat4242|1 year ago

Yeah and the fuss about it being enabled by default is not really relevant. In the EU tracking must be opt-in anyway. So this is expected behaviour.

However the EU dropped the ball by not making it mandatory to respect this flag. If they had we wouldn't have had the huge cookiewall mess we have now.

tbrownaw|1 year ago

> larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users.

If anything the shift is going the other way, with some of the more busy-body jurisdictions trying to take things that are properly enforced by the user's user-agent and instead making them officially the responsibility of the other party.

jeroenhd|1 year ago

It's important to note that the Do-Not-Stab header has been deprecated because one browser engine switched it on by default and requiring users to opt into stabbing hurt the bottom line of the stabbing industry, so it's no longer respected. Luckily someone came up with General Assault Control, a non-standard alternative, which also only has one value, so you can set Sec-GAC to 1 to request websites not to assault you. By design, this header cannot be extended, so it cannot be used to distinguish brutal stabbings from a comedic pie to the face in the future.

Because of legal requirements, the General Assault Control header may not be enabled by default, as American states like Colorado require explicit opt-out (rather than explicit opt-in). This protects Colorado's thriving stabbing and shooting industry as most users will never want to opt into being stabbed.

Despite the feature being forced to be disabled by default, the organisation behind the spec is pushing hard for customers to download fringe browsers that implement the feature (though you may need about:config to enable it). Because of the small user base, the request not to be assaulted can be used by websites not willing to follow the standard to make their stabbings and shootings more precise. End users can request a JSON file from the web server containing the supposed support for the GAC header, but requesting this URL may be used to kick the user in the teeth by non compliant servers.

boomlinde|1 year ago

It's now customary, in order to comply with European regulations, to present users with a list of possible violent crimes against their person that they can opt out of before using a website. This ensures that non-consent to stabbing is always an active choice, so that users who want to be stabbed or otherwise maimed won't accidentally miss out on the opportunity.

skriticos2|1 year ago

Why is it a binary value? What about masochists, or people who lost a bet and want to be stabbed just a little? Or strangled?

actionfromafar|1 year ago

This is such transparent EU Bureaucracy shilling. No wonder Europe doesn't have any large SaaS companies with their stabbing unfriendly business climate.

phoronixrly|1 year ago

Yeah, why can't the EU just leave the stabtech industry stab in peace?...

nyanpasu64|1 year ago

I downvoted before I read the end of the comment and realized this was satire.

MBCook|1 year ago

Good to know HN will be the same in 100 years. /s

bue7jclotemp|1 year ago

I think you are factually wrong: Skype, Spotify, Revolut, Zendesk, Transferwise... There are quite many European unicorns too (less though than US and Chinese companies) which are operating as SaaS. Some of them got acquired or re-based to other countries though

cuuupid|1 year ago

For the low price of $20/1000 clicks, I will provide you with a stabbing consent banner, fully compliant with upcoming EU and CA regulations on web-based stabbing.

jsheard|1 year ago

I'm sold, the distinctions between "necessary", "targeting", "performance" and "functional" stabbings are such a minefield. Not to mention how I'm supposed to properly disclose the 846 different stabbing brokers I work with. How's a man supposed to make a living stabbing people with all of this red tape in the way?

Macha|1 year ago

By the way, studies show users only opt in to stabbing with our competitors banner 95% of the time, but they opt in with ours 98% of the time, thanks to our banner taking 50% longer to properly opt out of, so you should really go with us.

averageRoyalty|1 year ago

This website appears to be part of a webring (how delightful!) made up of MtF trans people, furries, self-identified robots (some of which exclusively use third person pronouns) and sometimes a mixture of these. All appear to be some form of sysadmin or programmer.

This isn't my tribe, but I'm incredibly pleased to see a beautiful reflection of the old internet within this webring.

andyzei|1 year ago

The Do Not Track header was originally proposed in 2009 by researchers Christopher Soghoian and Sid Stamm.[2] Mozilla Firefox became the first browser to implement the feature.

https://en.wikipedia.org/wiki/Do_Not_Track#:~:text=The%20Do%....

shdon|1 year ago

I wonder how many web developers actually honour Do Not Track. I do, in all the websites I've made for my employer too, but I think I'm only getting away with it because my employer doesn't know. I've even made it so that browsing with Do-Not-Track enabled also skips the cookie consent banner and just assume the user wants no cookies other than the strictly necessary ones (like their session/login cookie), and doesn't include Google Analytics, instead just upping a single view counter on the page, with no PII in there.

killerstorm|1 year ago

There was a much more elaborate standard called P3P recommend by w3c in 2002. It apparently defined a description of how business can use personal data.

But apparently it was considered too complex and "lacking enforcement".

Now maybe if it survived till GDPR it could have it's enforcement, but Mozilla yanked support before that...

dare944|1 year ago

> because every company out there fucking hates you

They don't actually hate you. Rather, they love your money and they have a depraved indifference for you.

dylan604|1 year ago

No, they love the money they can make about you. I don’t know anybody giving their money to these people. It is other shady companies buying the data about for, shady companies that have collected. All of this is offered to you free of charge.

forty|1 year ago

looks like someone just discovered that capitalism is bad for people ^^ who would have thought it...

jaza|1 year ago

Relax, folks, entities have plenty of other options, there still won't be support for Do-Not-Shoot, Do-Not-Rape, Do-Not-Stone, fun for the whole family.

grahamj|1 year ago

Don't forget robots.txt

sillysaurusx|1 year ago

I’ve always wondered, since an RFC is a request for comment, how does one leave a comment? And who?

staplung|1 year ago

A bit of lore that I learned in my networking class in college was that the RFC name was chosen as tongue in cheek in that by the time a proposal gets to the RFC stage, comments are very much not appreciated. You're supposed to comment well before that point.

No idea if that bit of lore is true but it is certainly the case that RFCs are usually the final word on the relevant standard. In fact, once they get their ID, RFCs cannot be modified or rescinded; only superseded by another RFC.

jowea|1 year ago

> The early RFCs were, in fact, requests for comments on ideas and proposals; the goal was to start conversations rather than to create an archival record of a standard or best practice. This goal changed over time, as the formality of the publication process evolved and the community consuming the material grew. Today, over 8500 RFCs have been published, ranging across best practice guidance, experimental protocols, informational material, and, of course, Internet standards.

> https://www.rfc-editor.org/rfc/rfc8700.html

Nowadays you're supposed to comment before it gets to "Internet standard"

vandyswa|1 year ago

RFC's operate under the IETF. RFC's are developed under some specific group, and you can join that group, the business is generally conducted on email. There are (well, were back when I participated) in-person meetings, but attendance there was not mandatory.

riffic|1 year ago

"request for compliance" is the alternative interpretation.

layer8|1 year ago

You can submit errata. Maybe it should be renamed to RFE.

nojs|1 year ago

Wouldn’t this header just be another bit of entropy used by companies that are going to stab you anyway?

wkat4242|1 year ago

Without legal backing, yes. If it had that it would have been a very different story.

sionisrecur|1 year ago

If you make misusing the header illegal then only illegals will stab you.

iddan|1 year ago

Excellent satire. Really drives the point home. I think it's hard sometimes to understand just how much forces of bad use paper trail to push their agenda. This outlines this really well

ipnon|1 year ago

Adtech is kind of like the fungal domain of the web, in that it allows life to technically exist where it shouldn’t, because death is actively in progress. It recycles deathly content back to the top of the food chain to Big N, wherein it is reconstituted into cushy salaries for the people that ultimately create the infrastructure that allows endless slop to permeate the web.

charles_f|1 year ago

Don't care too much about do-not-stab since I deployed a pi-bulldog on my network that catches all the back alley NSRs (network stab requests). I was thinking about using SDoH (self-defense over https) or AoT (AR15 over TLS) to be protected outside my network as well, but honestly the little stabbings here and there cause sufficiently little blood to be drew that its not worth the hassle.

SilasX|1 year ago

I couldn’t tell if it was intended to be a note-for-note parody of an RFC about the do-not-track header, but I couldn’t find one that would qualify. The closest would be this[1], but it doesn’t cleanly match up (in part because [1] is more verbose and its points scattered).

Another satire RFC in the same spirit is the one about the evil bit[2] (designate one bit in packets to indicate whether it’s intended for evil), with the same subtext as the linked post: no, you can’t trust malicious entities to change their behavior to make it easier to stop.

[1] https://www.w3.org/TR/2019/NOTE-tracking-dnt-20190117/

[2] https://datatracker.ietf.org/doc/html/rfc3514

tonetegeatinst|1 year ago

This is going to wipe out the saas market

(Sutures As A Service) which is a additional somewhat often used service once Stabbing As A Service has occurred.

tsujamin|1 year ago

A big shoutout to those reading the comments who are the direct subjects of this satire.

dingosity|1 year ago

   Them: What's your LinkedIn Account?
   Me: Don't have one.
   Them: Twitter?
   Me: Nope.
   Them: InstaGram or TicToc?
   Me: Nope.
   Them: Do you use the web at all?
   Me: Only through Lynx.  I see a lot fewer ads.
   Them: No JavaScript!  How do you use YouTube?
   Me: I don't, really.
   Them: You have no social media?
   Me: Well... I *did* order a pizza from Dominos online once...

   Yeah... I don't use the web much as you would expect for someone
   who's livelihood depends on it.  I just wish USENET was still
   USEFUL.  I have a rant in me about ad-tech and crap-ware on the
   web.  I'm just enjoying my life without the web too much  to 
   write it.  And clearly, HN is my web-tech achilles heel.

thih9|1 year ago

I find it funny that the authors are from Google, of Google Analytics, where the recommended way to opt out of tracking is to install a "do not track" browser plugin (not available on mobile).

> Google has also released a browser plug-in that turns off data about a page visit being sent to Google, however, this browser extension is not available for mobile browsers.

source: https://en.wikipedia.org/wiki/Google_Analytics#Privacy

vrighter|1 year ago

Well, given that we need to tell them what they are not allowed to do, vs what they they are allowed, we need some "Do-Not-X" standard convention for headers.

For example, I have my browser send all of these with each request:

Do-Not-Eat: 1

Do-Not-Insert-Into-Anus: 1

Do-Not-Do-Evil: 1

Do-Not-Chew-Loudly: 1

Do-Not-Forget-To-Bring-A-Towel: 1

Do-Not-Pee-Into-The-Wind: 1

Do-Not-Give-Me-Up: 1

Do-Not-Let-Me-Down: 1

Do-Not-Turn-Around: 1

Do-Not-Desert-Me: 1

Do-Not-Stab: 1

The last one I added just now because this article opened my eyes to this glaring omission.

narrator|1 year ago

This will probably become less funny when everyone has a home robot that can cook for them. A robot that can handle a knife with sufficient dexterity can be a trained assassin if the owner doesn't pay the extortion demand of the malware that has infected their robot.

b0rbb|1 year ago

For some reason, I'm reminded of a particular comic strip from Achewood - https://achewood.com/2007/01/11/title.html.

"Fools! I have invented a usb device which can collect votes from the Internet and drive a knife through your heart!"

yieldcrv|1 year ago

> “We and our 756 partners process personal data[…]” wow big polycule this website is in

This gets more and more unhinged, I love it

zombot|1 year ago

The date in the title is wrong, it should be 2111. Most appropriately, because something as forward-thinking as this proposal cannot be expected to even come up within this century, let alone be accepted.

benreesman|1 year ago

Sounds like handlers of the “UPGRADE” verb SHOULD have taken the “WOCK” to Poland.

scotty79|1 year ago

I'd love for Please-Do-Stab header to exist so I can just set it and with it opt out of any stabbing-anti-stabbing wars and politics.

I fully understand that it's absence wouldn't meant that people won't get stabbed, but it would save time and mental space of all people like me who really don't care about being stabbed or not.

Honestly if anything, I'd like to be stabbed more.

By analogy to current situation about tracking ... Ad companies know too much about me? I think they know too little. For example for half a year they still haven't figured out that I know barely any words in German and are serving me German advertisements all the time just because I happen to be living in Germany currently.

tdeck|1 year ago

For those who only skim things, it might be worth scrolling down to read the "Editor Comments" section which is the actual article.

MathMonkeyMan|1 year ago

I feel like that section ruins the joke.

Timwi|1 year ago

I feel the need to comment on one sentence in it: “companies are god damn children and must be told no explicitly by every person individually.”

While it's true that children will often go out of their ways to test boundaries, I have no trouble giving them the benefit of the doubt and saying that children are innocently experimenting.

Companies, meanwhile, are doing this with fully deliberate malicious intent. They do this because capitalism rewards it. We need to say this, and keep saying it, until everyone gets it. Companies cannot be reared like children. Companies do not “mature” to become well-behaving, ethical citizens. With the profit motive in effect, companies have every incentive to work around every legislation and regulation and screw us at every opportunity they get. The profit motive must go.

grahamj|1 year ago

I bailed before that so thanks for pointing it out. I couldn't agree more, both with the point implied by the RFC and with that directly stated below.

atoav|1 year ago

If Monty Python made an RFC it would look very much like this one, just with more fruit.

On a more serious note: yeah wtf. I hope we in the EU draw the conclusion of companies even being unable (unwilling?) to gain informed consent and just start treating these privacy breaches as an outright crime.

hamdrew|1 year ago

I'm personally more worried about being clamped, but this is a step in the right direction.

m0rissette|1 year ago

Right. This was just too on point. Thank you for making my night!

indus|1 year ago

Why a header?

Do a sidedoor as a /do-not-stab.txt

Do-Not-Stab: 1

zatkin|1 year ago

Well that's one way to take a stab at this problem.

PeeMcGee|1 year ago

> it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more

For Microsoft this also rings true from the opposite direction. Any specification that Microsoft technically abides is implemented in an egregiously dark way (at least for anything consumable at an enterprise level).

They go to great lengths to exercise every bit of leeway permitted by the spec, even when it doesn't make economical sense, because what are you gonna do about it? Vote with your wallet? Against the vendor that runs all your workstations and manages your directories and databases and deployments and authentication and authorization and business intelligence and and and?

No, you're gonna accommodate their absurd counter-requirements because what other choice do you have? The decision then becomes:

1. branch your code to shit with `vendor == microsoft` clauses

2. branch your project/architecture to shit and effectively maintain a Microsoft version alongside the "normal" core version

3. use Microsoft's bespoke library that solves the problem they created

A project that selects option 3 will face the least resistance integrating with Microsoft products, but will also become beholden to arbitrary rules that complicate integration with every other vendor who benevolently implements the standard.

anakaiti|1 year ago

[deleted]

Timwi|1 year ago

The whole website is a treasure trove. There's a page with two C# puzzles and one with an HTML/JavaScript puzzle that I found very interesting. I'm still stuck on the second C# one!

bagels|1 year ago

The authors are [redacted] Google. Are they actually Google? They seem to unironically complain about what Microsoft is doing, but Google is guilty of the same.

teractiveodular|1 year ago

I think the author's entire point is that self-regulation by the big boys is not working very well.

Mathnerd314|1 year ago

The actual author is one person, user '5225225'

bhaney|1 year ago

Dude come on

TacticalCoder|1 year ago

> it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more, because every company out there fucking hates you and would sell you out to make a bit more money if they legally could. and even if they couldn’t, who’s going to stop them?

Certainly not any government. If you think the EU's regulation are of any help to the consumer you are gravely mistaken. The EU is quickly becoming a fucking nightmare to live in. "The more corrupt the state, the more numerous the laws". The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.

That's what the EU is: probably that some politicians or bureaucrats with enough brain cells to recognize a bottle cap on the ground thought "I've got an idea to make the EU better, let's mandate every bottle to have a cap that cannot be separated from the bottle".

As a result you lay horizontally a plastic bottle of sugary drink in your fridge (because you've been used to do that for decades) and now all your fridge is sticky due to the bottle leaking.

It's all that is wrong with the EU bureaucrats in one example.

Also hailing the EU as the savior vs Microsoft when our lives becames miserable with EU consent cookie popups virtually everywhere is a bit thick.

orbat|1 year ago

So the EU is bad because you can't learn to screw on a bottle cap that's different than before?

CRConrad|1 year ago

> The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.

I haven't encountered that meme, but if it exists, it's like most memes seem to be: Wrong. The bottle caps work just fine.

rakoo|1 year ago

> while Elon Musk created Tesla, SpaceX and Starlink the EU [created] some regulation that mandates that bottle caps must hold to the bottle

At least the EU made something useful

WD-42|1 year ago

[deleted]