Soooo.. This is sending "Hey, this is a kid on a restricted machine" to all servers now?
I mean I fail to understand the original idea, obviously. It makes no sense to me. But I question the value of the above - basically now the server can _just as easily_ do crap with that information. You can now identify minors (using that feature). Beautiful.
The server operators cannot decide what 'parental control' would mean for parents, they cannot decide what is ~okay~ or what isn't. Referencing a random US regulation/law (COPPA?) in a discussion about international traffic, international browser products seems crazy.
If you want to prevent your kids from accessing 'stuff', make sure that 'stuff' is filtered on their machine or better on the edge of your network. Don't believe that random guys on the net will correctly guess what you find questionable content for kids and hide it, because .. your kid's browser sent a friendly "My parents didn't allow me to see unspecified things" header.
Edit: I reread that thing over and over again. Something else that utterly blows my mind is this:
Users won’t find any UI in Firefox to enable or disable Prefer:Safe, which becomes one less thing for kids to try to circumvent to disable this control.
Newsflash: That includes the parents. Unless that is utterly misleading (or my English as a second language parser fails) this means that I, as a parent [1], can NOT
- activate parental control features that are somehow detected by Fx
- opt out of that idiotic header that announces decisions from my private household to each and every server, starting with Google for example
1: Hypothetical example. While I've got two kids, but both are too young to operate a computer yet and I probably won't buy into standard 'parental control' solutions anyway.
I exactly had the same idea...
I would also add that this thing is going to be useless anyway because not all the websites are going to implement it. So you will have this header + the traditional blocker...
It's totally unrelated but something I would really like to have right now would be a header with the average connection bandwidth (or just thresholds). This could be really useful to reduce the amount of data sent if the connection is really bad.
I exactly had the same idea... I would also add that this thing is going to be useless anyway because not all the websites are going to implement it. So you will have this header + the traditional blocker...
It's not useless, since it allows the site to avoid being blocked by hiding the "bad" content. Ideally blockers would be smart enough to recognize and block only the "bad" DOM elements, but they usually just block the whole page, if not the whole site.
That is absolutely meaningless. What is bad content?
The header doesn't tell what the client considers 'bad' or not 'safe', it's a bool.
Given that, I see these possible outcomes
- the client's admin might not care about this site at all (effort to hide stuff would be wasted?)
- the client's admin might consider content 'unsafe' that seems fine/okay to the site operator => Blocklist, failed to archive what you suggest
- the client's admin might consider content 'safe' that the site now refuses to share => Curse site and Mozilla, switch browsers and/or consider that site broken and the operators morons (similar to 'breaks zoom on mobile devices' today, for example)
However, this got me thinking that across cultural lines there are a lot of shades to what is "safe". So a website based in Austria might want to restrict different content than a website based in Australia, and who knows where the "browser" is based.
Of course your comments about the site actually implementing anything/correctly still apply.
I vaguely remember in the early days of the web (95-96?) there was a hopeful rating system very much like what you get for movies. I can't remember what the header was, but it was formatted something like "Violence 1; Sex 10; Drugs 5; Gambling 0". For obvious reasons it didn't catch on.
Sure, all those outcomes will happen, since servers and filters will have to implicitly agree on what is "safe". But the type of content blocked isn't random; there are a few prevalent concepts and terms which site operators are likely to follow.
That said, I think the implementation should have an admin-controlled site whitelist and even a way to disable the header even if parental controls are enabled, to prevent (3).
You can't identify minors because this isn't just a feature for minors but, e.g., for companies or public terminals as well. Of course it depends on the websites to deal with it. But, e.g., most popular porn sites actually do care about stuff like this.
There is no UI in Firefox because Firefox uses the operating systems parental control features to enable/disable it. And those features should have a UI within the system. That's why it is only implemented for OS X and Windows at the moment.
Your last paragraph is what I can't understand. Ignoring OS X for now (wouldn't know a thing about that):
Parental control in Windows just lets me set time limits/limits on what programs/games I can run as far as I know (just double checked microsoft.com and that's what they list as well). Given that and my understanding of the Fx feature means that Fx understands that this is a machine with parental controls enabled and _shares that with the world_.
That is nonsense. It's crap. The world cannot (as I stated before) decide what is okay and what not. Going with your porn example (I .. kinda expected that): I'd be entirely fine with a 16yo kid to look at porn. I might not want that very same kid to use the computer around 2am in the night. For the latter I can use parental control features. You (and Mozilla) force your (weird, from this pov) moral/set of values on me. Enabling parental control does NOT mean that I want the world to know about it. It also doesn't imply that porn isn't okay. On the other hand, maybe I would put the NRA website on the list of things I don't want to see in my household. No one can decide what is okay or not - except for the parent/admin.
"There is no UI in Firefox, because Firefox uses the OS parental control features to enable/disable it" is missing the point. Unless I fail to understand what this does I cannot use the parental controls without Firefox/Mozilla abusing that flag and asking the YouPorn administrators for parental support.
This is a misfeature and at best useless, although I'd lean towards harmful and wrong.
You are just assuming things here. I don't know the parental control features of Windows. And I don't know when this will be enabled. But I don't see a reason why this should be always enabled as soon as parental features are used. In the end Mozilla is implementing a Microsoft proposal here. I would assume that the parental controls have a setting to enable it. So it kinda seems to me that you are building a strawman to attack.
If you want to block specific websites or specific content then you obviously need to use a different tool as well.
Hah. I'm assuming things, you attack my arguments with .. assumptions.
If you look at the code [1], you'll notice that it exists _today_. There is no feature in Windows that says 'I want to restrict this account to a "safe" internet experience' and that wouldn't make a tiny bit of sense as I expressed elsewhere. Again, if you look at the code it seems (Disclaimer: I'm neither familiar with the Fx codebase nor really a C++ guy) easy enough:
While I admit that I argued based on 'assumptions' (more .. based on what I know about these parental controls and what the article states), these are the facts.
If I translate that into prose (correct me..) that reads as "If the OS supports parental controls and ANY restrictions are active, then set this boolean flag to true". Now, before you argue that these still are just assumptions about how this flag is used ... let me present [2]:
// add the "Send Hint" header
if (mSafeHintEnabled || mParentalControlEnabled) {
rv = request->SetHeader(nsHttp::Prefer, NS_LITERAL_CSTRING("safe"));
if (NS_FAILED(rv)) return rv;
}
Ignoring the weird comment: That translates into "If the user _opts in_ to use this header via a setting OR if we detected random parental control restrictions from [1], add the crappy header to the request"
The documentation of the Windows parental control API can be found here [3]. Note that there isn't a feature that says 'add a random useless header' or somesuch nonsense. Glancing over the docs it seems to be possible to register extensions to the parental control environment, and _those_ might offer a 'Get a random different version of the internet, maybe' option in theory. But that doesn't seem to be the case and the check at [1] and [2] seems rather broad.
IF this whole thing would be a configurable (by the responsible admin) feature (and .. ideally opt-in, not a crazy default), THEN I'd just laugh at the people that want that, but wouldn't complain. Based on every fact I can get my hands on that is NOT what they do.
Do you still disagree, at least with the implementation?
Nice work researching this. Yes, I'd say that always enabling it as soon as some parental control features are enabled is a bad decision. Maybe this should be a bug report. But we should also note that Mozilla follows Microsoft's implementation here.
I mean I fail to understand the original idea, obviously. It makes no sense to me. But I question the value of the above - basically now the server can _just as easily_ do crap with that information. You can now identify minors (using that feature). Beautiful.
The server operators cannot decide what 'parental control' would mean for parents, they cannot decide what is ~okay~ or what isn't. Referencing a random US regulation/law (COPPA?) in a discussion about international traffic, international browser products seems crazy.
If you want to prevent your kids from accessing 'stuff', make sure that 'stuff' is filtered on their machine or better on the edge of your network. Don't believe that random guys on the net will correctly guess what you find questionable content for kids and hide it, because .. your kid's browser sent a friendly "My parents didn't allow me to see unspecified things" header.
Edit: I reread that thing over and over again. Something else that utterly blows my mind is this:
Users won’t find any UI in Firefox to enable or disable Prefer:Safe, which becomes one less thing for kids to try to circumvent to disable this control.
Newsflash: That includes the parents. Unless that is utterly misleading (or my English as a second language parser fails) this means that I, as a parent [1], can NOT
- activate parental control features that are somehow detected by Fx
- opt out of that idiotic header that announces decisions from my private household to each and every server, starting with Google for example
1: Hypothetical example. While I've got two kids, but both are too young to operate a computer yet and I probably won't buy into standard 'parental control' solutions anyway.