MVP: Cookie policy

Cookies can be a wonderful thing, especially chocolate chip :cookie:

But seriously, a site should generally be able to run very well in read-only mode (not logged in) without cookies. If logged in then generally you end up with some sort of cookie to help keep you logged in (I get confused about all the details and end up looking it up every time I work on a new site) and the rest of the details get stored server-side (e.g., this user likes dark theme and newest answer first, etc.).

Third-party/tracking/etc. cookies are definitely out. Plenty of systems block them, plenty of software (e.g., MBAM) removes them. They do no good for the end-user.

Some what related: 3rd-party Javscript on every page - e.g., Google Analytics, various social media buttons/widgets/etc.:

  • Analytics - may be worth it, maybe not, see Discussion: Analytics for a full discussion
  • Social media buttons/widgets and other “more than just a simple link” to elsewhere. We are in, IMHO, the very good situation of not really caring what other people think. Is it nice if someone posts a link to Codidact on Facebook? Sure, it can help get us some traffic. But do we really care? Not in the typical sense of “more traffic will generate more $”, which is the rationale I hear from commercial web sites. We should only include Javascript that notifies another site of any user action (including page load) if there is an actual documented and agreed-upon useful-to-our-own-system reason to do so. And at the moment, I can’t think of any such reason. Links to the outside world are fine. Loading JS or other content from other servers (e.g., CDN for JS libraries, image servers, etc.) is fine. But not anything in the “track/notify” genre.
3 Likes