Stats "Don't Track" - You Cannot Satisfy Everybody

Blogger recently redesigned the Stats "Don't track ..." option - and removed third party cookies from the picture.

The "Don't track ..." wizard is now accessed from the blog URL. The wizard still produces cookies - but they are ordinary first party cookies, which are much less feared than third party cookies.

But, every silver lining has a cloud.

In making the "Don't track" wizard accessed under the blog URL, Blogger created a new requirement - which is no more understood, by some blog owners, than "third party" cookies.

"Don't track" now runs scripts from the blog URL, instead of the Blogger dashboard.

In order for a blog to observe - and preserve - the "Don't track" setting, any computer that the owner uses has to permit first party cookies - and all scripts - from the blog, instead of from the Blogger dashboard.

Since "Don't track" is designed to be used by the blog owner, this new requirement should not be a problem. Every blog owner should be able to trust herself / himself, to not add dodgy code to his / her own blog.

Owners of blogs published to custom domains will have to tweak the URL used by the "Don't track ..." Stats wizard, to set "Don't track" - since custom domains do not support HTTPS.

Many security products block scripts from personally owned blogs.

Unfortunately, general security practice is to block scripts from "blogspot.com", "blogspot.xx" (for every "xx" for every country local domain"), and preferably for blogs published to custom domains.

You can trust scripts from "blogger.com", and the Blogger dashboard. You cannot trust the individual blogs, since you cannot trust every blog owner. Even if you could trust some people not to intentionally try to hack your computer, you cannot trust everybody to not stupidly install malicious software from a very convincing hacker, providing one more "gotta have this" blog accessory.

And since you cannot trust the individual blogs, you will have filters. And those filters have to be adjusted, to trust your own blogs - if you want to ignore your own pageviews.

Some blog owners add security software, and don't know how to maintain the filters.

There are too many Blogger blog owners who have installed protective software on their personal computers - without knowing how to adjust the filters, in the protective software. And some of those owners think that it is a Blogger responsibility, to provide them instructions, how to adjust the protective software on their own computers - when only they are capable of knowing what they installed.

---

The new version of the Stats "Don't track" option is an improvement, because it no longer requires third party cookies - and involves the associated security risk. Unfortunately, it now requires blog owners to permit scripts, from the blogs themselves.

This is not a security risk, in that only personally owned blogs need to be trusted - but the blog owners do need to know how to adjust the filters involved. And not everybody with a computer knows how to configure their security accessories.

Blogger Blog Readers Unable To Comment, Using OpenID Accounts Hosted By WordPress

We're seeing a scattered collection of reports, mentioning problems publishing comments, using OpenID authentication.

This problem appears to be related to the Blogger rollout of SSL support, for our blogs, which is currently in progress. SSL, or Secure Socket Layer, represents the next step in blog / website security - a step which the Internet community has been taking, for many years.

Blogger has been using SSL (aka "HTTPS" login), in their dashboard, for several years.

https://www.blogger.com

That's a secure Blogger login. The problem with Blogger using SSL in our blogs is that moving to SSL requires care, to avoid confusing our readers. Lack of care will subject our readers to the well known "mixed mode" warnings.

This site has insecure content.

Only secure content is displayed.

Firefox has blocked content that isn't secure.

These are several examples of what were normal, years ago, on many websites. Blogger does not want our readers subject to needless confusion, from these warnings.

Blogger blog owners have been asking, for years, that Blogger support SSL in BlogSpot (and our custom domains).

FaceBook upgraded to SSL, in 2013 - and saw problems with Blogger content.

Last year, FaceBook upgraded to SSL. Blogger blog owners, who were also FaceBook members, watched their Walls, which contained HTTP links to their Blogger blogs, show the "mixed mode" warnings.

The real issues begin to arise, however, when your application must include assets served by servers which also do not support SSL.

...

We’ve all experienced “mixed mode” warnings, with some browsers being much more annoying about them than others. "Mixed mode" means you requested a page over SSL, but some of the resources needed to fully render that page are only available over unencrypted HTTP.

Blogger is offering the option for us to upgrade our blogs, this year.

Now, Blogger is upgrading, so our blogs may (optionally) support the SSL protocol - and not confuse FaceBook members, who post links to our blogs. To avoid the "mixed mode" warnings, which would confuse our readers, they are upgrading all Blogger processes, including OpenID authentication, to support SSL.

The Blogger upgrade has exposed a WordPress inconsistency.

Just as FaceBook upgrading to SSL helped to cause Blogger to upgrade, so is Blogger upgrading to SSL exposing an inconsistency in WordPress use of SSL, for OpenID authentication.

The problem in my case (and maybe in others as well) seems to be that https://yourblog.wordpress.com is send for verification to the OpenId server. This is what I could figure out from the URL. If you than manually replace HTTPS with HTTP, it works.

This comment suggests that WordPress, which in general is using SSL security, has an OpenID server that has not been upgraded.

WordPress needs to check their OpenID servers.

So now, Blogger has to wait for WordPress to fall into step, consistently. Until WordPress upgrades their OpenID server, people who want to use a WordPress OpenID account, to comment on our blogs, will have to select "OpenID", instead of "WordPress" - then enter the WordPress OpenID URL, as

HTTP://whatever.wordpress.com

And wait for WordPress to upgrade their server.

Interstitial Warnings And Cookie Filters

Along with problems with comments and unwanted CAPTCHA forms, we're seeing some reports about problems with persistent and unwanted interstitial displays, in Blogger Help Forum: Get Help with an Issue.

The interstitial display, and its use of cookies, is similar to the new mandatory anonymous comments CAPTCHA form. If your identity can't be determined, or your decision to view a blog can't be remembered, an interstitial warning is displayed - just as the CAPTCHA form is displayed, when your readers are preparing to comment.

Interstitial warnings require cookies, both to identify you, and to remember your decisions.

• In front of a "private" blog, where you have to be identified, to determine your relationship with the blog.
• In front of a blog that contains (or is reputed to contain) objectionable material (naughty pictures or such), to remember your desire to view the blog, and your decision to continue.
• In front of a blog that is (or appears to be) published off site, to remember your desire to view the blog, and your decision to continue.
• In front of a blog that has been blocked, for TOS violation, or maybe for hosting hacking content, where you have to be identified, to determine your relationship with the blog.

If the cookie can't be read, the interstitial code will try again.

If a preference cookie can't be read after being created, the blog display may force you to try again, and re display the interstitial warning. If a session cookie is not accessible to the blog display, the reader gets treated as someone not logged in.

In neither case, does the reader get to go to the next screen, and view the blog.

Both session cookies, and preference cookies, are vulnerable to "third party" cookie filters.

• A preference cookie is created under "blogger.com", where the interstitial runs.
• A session cookie is created under "google.com", where you login.

These are third party cookies, being read under the blog published URL.

Both types of cookies are read under "blogspot.com" - or under whatever custom domain, or whatever country code alias, is being used by the blog, as displayed.

Whether a cookie is needed, but non existent - or needed, but can't be read - the result is the same. The reader is unable to continue, and does not get to view the blog, when necessary.

If the computer has a cookie filter, the cookie won't be read.

If a reader is subject to a filter that blocks "third party" cookies, and a preference or session cookie is needed, the reader will be unable to continue. This is a condition that Blogger Engineers cannot program around, because it is part of the security code, in the browser.

Thanks to the Google "One account" login, as Blogger is made a way of life to more of a reader population who have no interest in maintaining security on their computer, these issues will become more problematic.

Comments And Cookie Filters - October 2014

The new, mandatory CAPTCHA form, for blog readers wishing to comment anonymously, has been in service for just under a week.

We're seeing a variety of problems, reported in Blogger Help Forum: Get Help with an Issue, by blog owners and readers alike.

Long ago, for blogs with readers who were not really comfortable with maintaining security on their computers, we would recommend changing comment form placement.

The full page (or the slightly less preferable popup window) comment form was more usable, with readers who do not know how to properly maintain cookie and script filters. With recent changes in Blogger and Google, all Blogger comment forms are now vulnerable to inappropriate filters.

• Use of the Google "One account" login creates login cookies under "google.com" - not "blogger.com".
• Publishing blogs to custom domains - not "blogspot.com" - makes cookie access "third party".
• Referencing blogs from countries subject to country code aliasing - not as "blogspot.com" - makes cookie access "third party".
• The new, mandatory commenting CAPTCHA form, part of all Blogger comment form placement options, makes cookie access very important.

All of these issues, considered together, makes proper third party cookie filtering even more critical, than it has been, in the past - and makes new Blogger features more problematic.

The Google "One account" login, at "google.com", is now used by many blog owners and readers - instead of the Blogger native login, at "blogger.com". When the "blogger.com" login was used, cookies created under "blogger.com" were not as vulnerable, to cookie filters.

Whether used under "blogspot.com", or whatever country code alias or custom domain is in use (for the embedded comment form) - or under "blogger.com" (for the full page and popup window comment forms) - login cookies created under "google.com" (by the Google "One account" login) are vulnerable to "third party" cookie filters.

Blogs published to custom domains are becoming more and more popular. All blogs published to custom domains, which use the embedded comment form, are vulnerable to "third party" cookie filters.

Blogs referenced under country code aliasing are becoming more normal. All blogs subject to country code alias redirection are vulnerable to "third party" cookie filters.

The new, mandatory commenting CAPTCHA form needs to access the Blogger / Google login cookie - so blog readers, who are logged in to Blogger / Google, will not be subject to the CAPTCHA. The embedded, full page, and popup window forms are equally vulnerable to "third party" cookie filters, given the above discussed issues.

Thanks to the Google "One account" login, as Blogger is made a way of life to more of a reader population who have no interest in maintaining security on their computer, these issues will become more problematic.

>> Top

Two Level Comments, And Required Updates To Our Blogs

The new two level commenting feature has been out for a short 2 days - and already there are at least half a dozen separate problems being attributed to the introduction of that feature. Not every blog owner understands how intrusive this new feature must have been, to install, into Blogger.

The previous two Blogger feature releases - dynamic templates, and the New Blogger GUI, required major changes to the Blogger GUI. Two level commenting, while not requiring major GUI changes, was still challenging to develop. Two level comments required a significant upgrade to the content of our blogs, and were activated without the decision of the blog owners involved.

The two immediately previous major Blogger releases - dynamic templates, and the New Blogger GUI, each required a major amount of coding and testing. The bulk of those features, though, involved Blogger GUI code, which was separate from the code in our blogs. Also, both of those features are optional, with various menu selections which allow us to activate, at our convenience - and to deactivate, when we find that either feature is not to our liking.

Two level commenting, on the other hand, was automatically and instantly activated. Owners of almost all blogs which publish a full post feed, and which use the embedded comment form, suddenly found their blogs offering this exciting feature. Installation of this feature was a no brainer - if your blog publishes full posts feeds, and uses the embedded comment form, your blog now has two level commenting.

The automatic activation of the feature, combined with some content and formatting problems attributed to the feature, left some blog owners feeling powerless. People reporting some problems are being told to deactivate the full blog feed, or to change from the embedded comment form, to work around the problems. Neither change is preferred, by some blog owners.

As an alternative to either recommended change, some blog owners may find relief from various problems, by reloading a standard blog template, and / or resetting the post template. For blog owners who enjoyed installing a custom third party template, and tweaking the decorations and layout of the posts, this alternative is even less acceptable than the suggested feature deactivations. Yet if it's productive when tried, this technique should define the base causes of some of the problems being reported.

For blog owners who are comfortable with tweaking the post template, a manual post template update may provide a solution, for some blogs. This manual update, if done in reverse, may allow people to deactivate two level commenting, without deactivating the full post feed, or changing from the embedded comment form.

As Blogger developed and tested the changes required, to make two level comments work, they had the ability to test using the Blogger development environment, and various Blogger provided templates. They had no ability to test using the many blog template custmisations, and post template tweaks, which many of us have installed in our personal blogs. That being the case, many of the observed problems are not entirely the fault of Blogger - we have to accept some responsibility also.

In short, if anybody with a blog that publishes a full post feed, and uses the embedded comment form, finds changes in their blogs which are not to their liking, they need to return their blog and post templates to Blogger standard, before feeling themselves entitled to complain

What did Blogger do, this time?

>> Top

You Don't Always Get Everything You Want

In the "Western" world, and for the young of heart, there is one very special day of the year, celebrated by (almost) everybody - December 25, aka "Christmas".

While this was once (and still is now, for many) a religious holiday of great importance, for many young people it is important as a secular holiday - you get presents. For celebrants of both the religious and the secular versions of Christmas, this is a time of joy.

But, there's a sadness here too. Not everybody that I know always gets everything that they would like to get, even for Christmas. The lack of unlimited funds makes Christmas a time of anguish and depression, for some people.

Some folks, legendarily described as "bad", might traditionally get a lump of coal instead of presents.

In the Blogger world, Christmas comes irregularly and without notice. In a recent Blogger Christmas, we were given a new version of the post editor, with a greatly improved ability to upload and arrange photos. That improvement was eagerly awaited by many bloggers, for a long time.

The latter "present" arrived without an assumed second present, accompanying it. The new post editor lacks a spell checker - and this has been noted, many times. Unfortunately, many bloggers don't appreciate this, and decide that Blogger is intentionally mistreating them.

Bring back the spell checker!!!

is a cry seen regularly, in Blogger Help Forum: Something Is Broken.

Instead of seeing a glass that's half full (finally, improved photo management), the bloggers see it as half empty (no spell checker). They just fail to accept the fact that Blogger can't provide all required changes at the same time.

What did you get?

I got a lump of coal.

Blogger, like The Real Blogger Status, releases changes, progressively. If you got a lump of coal last Christmas, be good this year - and hope for something better next Christmas.

Christmas 2009 came and went, and some folks are paying the bills this month. Christmas 2010 will be here, in another 9 or 10 months.

Christmas never comes soon enough, for kids. It doesn't come any sooner, when you wait for it, with anxiety, either. Spell checker for the new post editor is coming - though it, too, won't come any sooner if we keep asking about it.