Cookies?

[Byron C. Mayes]

On Fri, 5 Jun 1998, Michael Dargan wrote:

> We're running Netscape Standalone 4.05 on Win95 workstations that are 
> under severe policy restrictions and Fortres 101.  I've disabled cookies 
> but am getting pressure from patrons who desire them.  I'm leery of 
> allowing them on public workstations.  
> 
> Am I being to fussy?  What would be the practical significance of 
> enabling cookies which are sent back to the server?

Many sites that allow some form of interaction between *specific* user and
the server use cookies. This includes lots of travel services, shopping
services, financial services, *and* some information services. Many will
not work at all without them (they should tell the user this up front, as
most do). My experience suggests that this is becoming more common. I can 
check my bank account, for example, via web interface that uses cookies 
to save my log on information until either I log out or 15 minutes is up 
(the timing is also determined by cookie). Some web-based catalogs are 
also using cookiesto track users...this is how one can maintain search 
history and sort preferences with several web catalogs.

Perhaps you should ask your users just what services they are using which
require cookies? Maybe some services your institution offers assume
cookies and just didn't mention it to you. If you find that your patrons'
use is within the legitimate uses of your institution, you probably should
consider allowing them. 

Better still, ask why are you *not* allowing them? Have you determined
that they are a potential security risk? Does disallowing cookies block
hate group/porno sites? Is disk space at a premium? Is it [cookie
technology] not very well understood so they're turned off out of fear? 
Is there a policy tat allowing cookies would break? If your reasons are
within institutional policy and can be supported by said policy, then you
have no reason to allow them, and you can give a more useful and
informative answer than simply, "No," when patrons ask. 

In either case (especially the latter) you should be prepared for a
situation in which the two possibilities conflict. Should a service you
offer, or even a web site to which you specifically link, require cookies
you can't very well disallow cookies withint your institution, and either
the policy or the service will have to be reconsidered. 

Byron

 Prof. Byron C. Mayes
 Systems Librarian/Assistant Professor
 Hunter College of the City University of New York
 695 Park Avenue * New York, New York 10021
 bcmayes at hunter.cuny.edu  * 212-772-4168 * Fax: 212-772-5113