I regularly read various IT-related newsletters published by Lockergnome. Normally I’d recommend them as a great place for both newbies and experienced folks alike to keep abreast of technology and trends.

Unfortunately, since they’ve changed their site and the way they generate their content, their editorial ability seems to be lacking. I just read the January 8 issue of the IT Professional newsletter and found an article someone submitted regarding computer and network security (SECURITY: Feasibility Of Standards).

The writer pretty much makes blanket statements about how cookies are bad and JavaScript is bad and Java is bad… and it irritates me that stuff like that gets published in a spot where newbies read it and then get the idea that security means being paranoid and disabling the technology rather than educating themselves.

I tried to write in to the author of the article, but his mail server seems to be down (or he provided a bad email address on his web site). So I wrote in to the content editor (or supposed content editor) of the newsletter.

Below is what I sent him: Just read Howie’s column on security in Lockergnome. For the most part I agree with everything he put forth - very good points on all but two topics: cookies and javascript. (I’d have sent this directly to Howie, but his mail serve seems to be down.)

So we’re on the same page, let me paste in what I read him as saying:

1) Is Your Browser Set To Allow Cookies? Why? Well, gee, if I go to this game site, they automatically plug in my username and password. Very nice. I hope you know better than to believe that cookies only do this! There ARE good cookies, and most of them are time savers. But most are either nothing special or downright miserable!

2) Is Javascript and/or Java enabled on your browser? Do you randomly surf the Web? Would you ever know if a script or java program was executing or implanting garbage on your PC?

Yeah, eventually. When you need to reboot and strange things start to happen!

The web has become a much more accessible platform for application development and delivery than it was even a few years ago. Being a web developer by trade for almost 8 years now (and an application developer for much longer than that), I’ve followed these developments with eagerness and anticipation of the next huge development to come around (and when it does, making use of it).

Unfortunately, what I’ve found is that there seem to be two types of people when it comes to the web being an application platform: the paranoid, who seem to sow fear, uncertainty, and doubt when it comes to the web; and the open-minded, who are probably a bit too liberal when it comes to how they work within the web. I’ll admit I tend toward the liberal side, and normally I let things like this slide by, but when someone makes pretty bold statements like this in a forum like Lockergnome that newbies trust, I have to take issue. Let’s look at each of the statements in turn.

Cookies:

Howie says that most cookies are “nothing special or downright miserable.” He also gives the impression (though it’s not directly said) that all the good cookies do is fill in your name on a form. I know that he, with the experience he claims on his PuterGeek site, is smarter than that, but the newbies out there reading your stuff don’t have a context like the more experienced folks. Cookies, in many cases nowadays, are what make web applications function - period. Due to the stateless nature of the web, many times you can’t write a robust application without assuming there be some sort of state maintenance. Can you get around that? Sometimes, using hidden form fields and so on. What about disconnected or mobile users? Gets more tricky.

He also makes the statement that he “hope [the reader] know[s] better than to believe cookies only” fill in forms. Sure they do. In the context of his statement, though, he makes it sound like they primarily have malicious abilities beyond the filling-in-of-forms. That’s a problem, especially when you start reaching audiences like less-than-educated network admins (like I had at a company I used to work for) who start filtering cookies out at the proxy level because they believe they’re huge security risks.

I guess my thoughts are when talking about security and cookies, it’s necessary to tell people that cookies may potentially be used to TRACK you, but they can’t siphon information out of your computer like your name or email address. They can’t steal anything that you didn’t provide in the first place. I still talk to users who think cookies can magically figure out your credit card information. Reading a statement like his, implying that cookies should probably be disabled entirely, only contributes to that mindset, and I think that’s not such a Good Thing.

Javascript:

This is another of those things where the newbie, I feel, is going to read this as “all Javascript or Java is bad.” There are actually many commercial web-based applications (Microsoft SharePoint Portal Server or Windows SharePoint Services are two I can think of off hand) that simply won’t function unless you have Javascript enabled. For the Windows-based users, that’s why there are “security zones” - so you can define who you trust and who you don’t, and what you trust each person to run on your computer. A blanket statement like you’ll only know if Java or Javascript is running “when you need to reboot and strange things start to happen” is a FUD statement if I’ve ever read one. Are there malicious script kiddies out there? Sure. Are there more constructive ways to warn people about configuring security on their browser? You bet.

I’m sorry if I seem to have run off at the virtual mouth here. I just find that, as I develop applications of my own and support both customers internal and external to my company, I run into people who call me up and complain that applications aren’t as “dynamic” or “functional” as they could be (or USED to be) and it always turns out they read an article like this and decided it was a great idea to disable scripting, cookies, and any other dynamic behaviors. I don’t think disabling the technology entirely is the key - I think it’s knowing who to trust and working accordingly. And that’s the point I feel was missing from the whole thing.

Thanks for your time, -T