Re: Last Call: <draft-nottingham-safe-hint-05.txt> (The "safe" HTTP Preference) to Proposed Standard

"John Levine" <johnl@taugh.com> Fri, 24 October 2014 20:28 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A90271A064C for <ietf@ietfa.amsl.com>; Fri, 24 Oct 2014 13:28:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.363
X-Spam-Level:
X-Spam-Status: No, score=0.363 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pn5N1yLH-ait for <ietf@ietfa.amsl.com>; Fri, 24 Oct 2014 13:28:49 -0700 (PDT)
Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E0351A0231 for <ietf@ietf.org>; Fri, 24 Oct 2014 13:28:49 -0700 (PDT)
Received: (qmail 44586 invoked from network); 24 Oct 2014 20:28:47 -0000
Received: from miucha.iecc.com (64.57.183.18) by mail1.iecc.com with QMQP; 24 Oct 2014 20:28:47 -0000
Date: Fri, 24 Oct 2014 20:28:25 -0000
Message-ID: <20141024202825.11783.qmail@ary.lan>
From: John Levine <johnl@taugh.com>
To: ietf@ietf.org
Subject: Re: Last Call: <draft-nottingham-safe-hint-05.txt> (The "safe" HTTP Preference) to Proposed Standard
In-Reply-To: <87A3AD2B-5747-46EB-A165-50D35A29DBA7@gmail.com>
Organization:
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/q6umrakKFneKRbxMoTVQStT3KFg
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Oct 2014 20:28:50 -0000

>... The result is that there’s no way for a content provider to know
>what a user means when their browser emits the “safe” hint, and no way for the user
>to know what kind of content they are going to get.

Mozilla Firefox, Microsoft Internet Explorer, and Google's Bing search
engine have already implemented it.  Could you please clarify why
Bing's implementation doesn't work?  On the Bong homepage at
http://www.bing.com, there's a gear icon at the upper right.  Click
that, and you'll find a discussion of their existing SafeSearch
feature that may be helpful.

At the bottom of Google's search page at https://www.google.com is a
"Settings" button.  If you click that, you'll find that one of the
settings is an option called SafeSearch that you can turn on and off.
It's currently implemented in a cookie, but I hope it's obvious how
they could use the safe hint to turn on the same setting.  Can you
clarify why this feature doesn't work, and why using the safe hint
would make it worse?

>Section 3 mentions YouTube. That is actually a perfect example of what I mean. Sites
>like YouTube, deviantArt, Flickr, and Wattpad, even Wikipedia provide user-generated
>content.How are they to decide what is and isn’t “safe”?

I'm just guessing, but my guess is that they will do it exactly the
way they do right now.  If you look at https://www.youtube.com and
scroll to the bottom of the page, you will see a box where it says
"Safety" Off" or "Safety: On".  If you click it, they show a short
summary of what it means, and you can turn it on and off.  Can you
clarify why this feature doesn't work, and why they couldn't use the
safe hint flag to set the same preference?

R's,
John