Pandora, A Well Named Website

[mishalak]

This might be subtitled "When Supposedly Good Websites Want You To Something (Moderately) Dumb". A number of people have told me when I complain of my inability to hear music I might like to own that I try pandora.com. They have this great system for users to find music they like based on what they already like. They might, but I'll probably never know because before I can use their system they want me to "allow third party Flash content to store data on your computer" in the global settings for macromedia flash. In the global settings. Think about this for a moment. In other words they want every advertiser on their site and indeed on the internet to be able to set cookies and just about anything else on my computer in such a way that I won't be able to easily see or purge them should I so choose. Let me think about this a moment, NO.

I don't trust flash to not have some hole in it that would allow a clever advertiser to put spyware, adware, or other junk on my computer. And Pandora goes one better by suggesting that instead of limited what a site can store to just 100k that I should make it unlimited. Oh, great. This sounds like something I really want to do given how huge and cruffy just the regular browser files get without regular purging. So, no, I can live without your service since you apparently want to enable anyone on the internet to bend me over without even the courtesy of a reach around.

This is not the worst advice/design I've seen on a website. I seem to remember one that apparently innocently wanted me to install the old gator adware. But that was so far back in the mists of the internet that I cannot remember who they were.
 

Comments

[eiricmacbean.livejournal.com]

Dang, I remember Gator...what a pain to get that off of computers for people. Had a lot of 'em come into the shop.
I think you're in the right on this one, I wouldn't trust that site as far as I could throw an AOL CD. Too scary.

[whumpdotcom.livejournal.com]

Flash's local store is the same model as cookies in web browsers. It's a sandbox.

[mishalak.livejournal.com]

Oh well if you say so that makes me totally confident. It isn't like when I enter the terms 'macromedia sandbox hole' into google that I get a bunch of old articles about how they found a critical hole in their sandbox in the past. Or that replacing macromedia with adobe will get more recent problems.

And even if you are right, I don't need their site. Why should I change settings globally for the sake of just one site? And it isn't as if I have it universally turned off. Just for third parties. I'm fine with the actual website I'm visiting setting things, I just distrust making it so anything else embedded in a website has automatic access.

[whumpdotcom.livejournal.com]

Yes, there can be security holes in a sandbox. Browser cookies and Java face the same problem.

[mishalak.livejournal.com]

I don't allow third party Java or cookies either. Heck, I usually don't allow Java by default. I just allow it for specific sites or sessions.