🚀 go-pugleaf

In article <9RI5ydCdF8fGFw8j@mcrosolv.demon.co.uk>, David Gibson
<david@[127.0.0.1]> writes

>The specification for cookies requires browsers to store at least so-
>many per server, etc; but obviously at some point, a browser is going to
>reach its internal limit. What happens then?  Does it continue to accept
>cookies but throws away old ones, or what?
>
>Im just wondering if my scripts can assume (given that they have tested
>to see that cookies are enabled) that they can always store additional
>cookies (up to the specified limit) or whether a "full" browser is going
>to behave "unpredictably".

I trust this is all lawful... there are now (since Dec 2003) legal
restrictions on the use of cookies !

See s6 of The Privacy and Electronic Communications (EC Directive)
Regulations 2003, SI 2426

        http://www.opsi.gov.uk/si/si2003/20032426.htm

-- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

In message <G7uCYMLqJ$fGFA4k@highwayman.com>, Richard Clayton 
<richard@highwayman.com> wrote
[]
>
>I trust this is all lawful... there are now (since Dec 2003) legal
>restrictions on the use of cookies !
>
>See s6 of The Privacy and Electronic Communications (EC Directive)
>Regulations 2003, SI 2426
>
>        http://www.opsi.gov.uk/si/si2003/20032426.htm
>
Para 4 thereof is, I submit, likely to exempt cookies.
-- 
Andy
For Austria & its philately, Lupus, & much else visit
<URL:http://www.kitzbuhel.demon.co.uk/>

In article "Cookies query" in <demon.homepages.authoring>, on Mon, 25
Jun 2007 Richard Clayton <richard@highwayman.com> writes

[DG]
>>Im just wondering if my scripts can assume (given that they have tested
>>to see that cookies are enabled) that they can always store additional
>>cookies (up to the specified limit) or whether a "full" browser is going
>>to behave "unpredictably".
>
>I trust this is all lawful... there are now (since Dec 2003) legal
>restrictions on the use of cookies !

I feel sure that my usage must be entirely legit. and I wonder if,
perhaps, a sub-text of your message is that cookies are considered "bad
programming", in which case, I would probably agree :-)

Im writing a fairly straightforward online shopping site, and it is
tiresome using GET or POST variables to move the data between pages.
(There are also annoying issues to do with the online payment site's
acceptance of GET/POST data, but I wont bore you with the details). Im
doing most of it with a server-side database, but it is "convenient" to
use a few cookies for the odd bit of data that cannot *conveniently* be
sent to the server.

I want my scripts to fail gracefully (like Turnpike :-) and not to fail
unpredictably when a browser's cookie jar happens to be over-full. Hence
my query as to how browsers deal with over-full cookie jars.

On a more general note: Im interested: what uses of cookies are illegal?
Cookie "theft", possibly?  Use of tracking cookies?  

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In article <sf3KDZSv8BgGFw3t@kitzbuhel.demon.co.uk>, Andy
<andy@kitzbuhel.demon.co.uk> writes

>In message <G7uCYMLqJ$fGFA4k@highwayman.com>, Richard Clayton 
><richard@highwayman.com> wrote
>[]
>>
>>I trust this is all lawful... there are now (since Dec 2003) legal
>>restrictions on the use of cookies !
>>
>>See s6 of The Privacy and Electronic Communications (EC Directive)
>>Regulations 2003, SI 2426
>>
>>        http://www.opsi.gov.uk/si/si2003/20032426.htm
>>
>Para 4 thereof is, I submit, likely to exempt cookies.

No, it does not provide a blanket exemption ... it merely provides a way
in which a justification can be provided for their usage. However
"strictly necessary" is quite a high hurdle!

-- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

In article <k5X$IqBdhUgGFwF2@mcrosolv.demon.co.uk>, David Gibson
<david@[127.0.0.1]> writes

>In article "Cookies query" in <demon.homepages.authoring>, on Mon, 25
>Jun 2007 Richard Clayton <richard@highwayman.com> writes
>
>[DG]
>>>Im just wondering if my scripts can assume (given that they have tested
>>>to see that cookies are enabled) that they can always store additional
>>>cookies (up to the specified limit) or whether a "full" browser is going
>>>to behave "unpredictably".
>>
>>I trust this is all lawful... there are now (since Dec 2003) legal
>>restrictions on the use of cookies !
>
>I feel sure that my usage must be entirely legit. 

excellent, I expected no less

>and I wonder if,
>perhaps, a sub-text of your message is that cookies are considered "bad
>programming", in which case, I would probably agree :-)

expecting all browsers to cope with large numbers of cookies is likely
to tickle problems, if not downright fail -- being conservative is
likely to be more robust

>On a more general note: Im interested: what uses of cookies are illegal?

it's illegal to use them unless they are "strictly necessary", otherwise
you are obliged to provide clear and comprehensive information about the
purpose they serve and give users an option to refuse to provide them

note that many people turn them off -- and you'll need to provide
special pages to ensure that you tell people why the site isn't working;
or you'll just leave them puzzled, as many sites seem to :(

-- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

In article "Cookies query" in <demon.homepages.authoring>, on Tue, 26
Jun 2007 Richard Clayton <richard@highwayman.com> writes

[DG]
>>On a more general note: Im interested: what uses of cookies are illegal?
>
>it's illegal to use them unless they are "strictly necessary", otherwise
>you are obliged to provide clear and comprehensive information about the
>purpose they serve and give users an option to refuse to provide them

Ah, I see. s6 of the Act; of course.  Well, I see no problem in putting
some "small print" on the page to comply with this. It's nice to do the
job properly. (Including, on one web site I wrote, a marvellous "get
out" clause to explain why the pages might not be fully accessible to
people with disabilities; which I lifted from a .gov.uk page ! :-)

S6(1) of http://www.opsi.gov.uk/si/si2003/20032426.htm obviously covers
the situation where a web server sends a cookie to a person's browser or
retrieves a cookie from the browser. But can it be said to apply to the
situation where cookies are set and retrieved purely using JavaScript? 

Such activity does not, in itself, involve a communication with the web
server. It is essentially (I assert) no different to setting variables
within JavaScript. OK, so the browser will still send its cookies to the
server when it sends a page request but, if I do not make use of that
information, am I still "gaining access" to it, under the terms of the
Act?

>note that many people turn them off -- and you'll need to provide
>special pages to ensure that you tell people why the site isn't working;
>or you'll just leave them puzzled, as many sites seem to :(

Yes, Im doing that. If the user's browser isnt (for example) going to
store a shopping cart cookie then it would certainly be polite to tell
him so.  (I also test specifically for JavaScript 1.2 and warn the user
if this is not available).
-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

In article "Cookies query" in <demon.homepages.authoring>, on Tue, 26
Jun 2007 Richard Clayton <richard@highwayman.com> writes

>>On a more general note: Im interested: what uses of cookies are illegal?
>
>it's illegal to use them unless they are "strictly necessary", otherwise
>you are obliged to provide clear and comprehensive information about the
>purpose they serve and give users an option to refuse to provide them
>
>note that many people turn them off -- and you'll need to provide
>special pages to ensure that you tell people why the site isn't working;
>or you'll just leave them puzzled, as many sites seem to :(

OK. That info now absorbed and acted upon :-)

My online payments page at http://caves.org.uk/payments/he07 now detects
whether cookies are enabled on the customer's browser and, if they
arent, it warns them to go and read an info page.  That page is also
referenced in the "small print" viz...

SMALL PRINT. (1) Cookies: These pages require the use of 'web cookies'
and so, according to the provisions of the Privacy and Electronic
Communications (EC Directive) Regulations 2003, SI 2426 we are required
to provide you with information about the purposes for which we are
using them, which you can read [ at 
http://caves.org.uk/payments/shr/nocookies.html ]

I came across some similar small-print, declaring the use of cookies, at
http://www.glassesdirect.co.uk/release_000/pacp.php on their "Privacy
and cookie policy" page.


-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.