History of the Internet

API Was Still Working. Its Response Said to Start Leaving.

The API Was Still Working. Its Response Said to Start Leaving.

A client asks for a resource, gets a normal answer, and finds a retirement clock in the response header. The service still works. The operator has already told its users to build their next dependency elsewhere. In March 2025, RFC 9745 gave that awkward interval a standard HTTP field: `Deprecation`. The date belongs to the resource owner, while the work of moving belongs largely to everyone who depends on it.

Chrome Hid the Phone Model. It Still Introduced Itself as Mozilla.

The browser's identity string became a costume websites depended on. Chrome later stripped out device detail to make passive tracking harder, while keeping old compatibility tokens that no longer described the product by their ordinary names.

API Error Got an Address. The Operator Got a Promise to Keep.

The API Error Got an Address. The Operator Got a Promise to Keep.

A `403 Forbidden` can tell a browser or proxy that access failed. It cannot tell a purchasing program whether an account ran out of credit, a card was rejected, or a policy refused the sale. In 2016, an HTTP standard gave those failures a common envelope and made a URI the name of the particular problem. The address looked like a detail in a JSON response. It became a promise between an API operator and every client that learned to recognize it.

HSTS Guarded the Return Visit. Chromium Took the First.

A website could tell a browser to use HTTPS every time, but the instruction arrived in a response. On a first visit over HTTP, an attacker could reach the conversation before the rule did. Browser preloading moved that choice into the software shipped to the user.

HTTP Put Links Outside the Page. Two Years Later, the Standard Took Them Away.

In 1997, an HTTP response could carry a `Link` field naming a related resource even when the page body held no such instruction. The next HTTP/1.1 standard left the field out. The 2010 specification that brought it back gave a blunt reason: the earlier version lacked enough implementation experience. By then the web had more than HTML pages to relate. The field's return was a contest over where a link belongs, who can read it, and how much running software a standard needs before keeping a feature on the books.

Do Not Track Put “No” on the Wire. The Server Kept the Switch.

A browser could send a tracking preference with every request. The W3C specified the signal and a way for a site to report its response, but left the rule for changing the site's conduct to separate systems. The little header carried a large argument about who gets to decide.

Internet Put Experiments in an X- Drawer. The Drawer Would Not Empty.

The Internet Put Experiments in an X- Drawer. The Drawer Would Not Empty.

An extra letter once offered protocol designers a bargain: put `X-` on a private field and the official names would stay clean. The bargain worked until a useful experiment needed an official name. By then software already knew the old spelling. A 1997 HTTP standard had to treat `x-gzip` as `gzip`; a 2007 mail standard registered both `X-Archived-At` and its intended successor. In 2012 the IETF withdrew the naming advice. The little marker that was supposed to make migration safe had made migration a second job.

Google's SPDY Got the First Draft. HTTP/2 Took the Job.

The IETF began HTTP/2 with Google's working protocol on the table, then changed enough of it that Chrome planned to retire SPDY itself. The handoff shows what happens when a browser experiment has to become a rule for everyone else's browsers and servers.

Windows XP Came on a Disc. Microsoft Held the 30-Day Unlock.

A retail buyer could install Windows XP from a physical copy, but continued normal use ran through a second transaction: activation with Microsoft by Internet or telephone. The disc was local; the permission check was elsewhere.

Cookie2 Announced a Better Cookie. Eleven Years Later, HTTP Retired the Announcement.

In 2000, a browser could tell a server that it understood a newer cookie scheme by sending `Cookie2: $Version="1"`. A server that understood the signal could answer with `Set-Cookie2`, while an older server ignored it and kept using the familiar path. The upgrade was carefully staged on paper. In 2011, the next cookie standard centered the older `Cookie` and `Set-Cookie` headers and marked both new fields obsolete. The protocols record a tidy negotiation plan running into the untidy authority of deployed software.

Yahoo Sold a Better Spot in Its Directory. Search Had Another Cash Register.

The Yahoo directory promised a route through the Web. By 2002, a commercial site could buy enhanced placement in that route, while keyword search had a separate sponsored-results arrangement. Yahoo's own filings put the navigator and the advertiser on the same page; a federal industry letter asked how plainly readers could tell them apart.

Web Could Link to Row Four. Then Row Four Moved.

The Web Could Link to Row Four. Then Row Four Moved.

A link to a CSV file once pointed only to the file. In 2014, an RFC gave readers a way to point at a particular row, column or cell: put a fragment after the URL and let the client interpret it. That made a data citation look beautifully precise. It also gave the citation a dangerous dependence on the table's order. Insert a row above the cited one and `#row=4` can still work perfectly while pointing at a different record. The server delivers the file and never sees the selector; the reader's software decides what the link meant.

PayPal Bought the Crowd. Business Recipients Paid for the Payments.

In the young PayPal network, money moved before a business had found a reason to pay for the move. The company rewarded qualified newcomers and their referrers, then charged business accounts when payments landed. Its 2001 stock-market filing gives both sides of that bargain unusually sharp numbers.

Browsers Turned 302 into GET. HTTP Kept the Habit and Added 307.

A browser sends a form with POST. The server says the result has temporarily moved. At the new address, should the browser send the form again, or fetch a page with GET? Early HTTP texts tried to keep the method steady and warned against automatic POST redirection. Browsers took another route. By 1999 the standard called their POST-to-GET practice widespread, gave servers a separate code for preserving the method, and left 302 with a split personality. The 2022 HTTP specification still names the habit.

HTTP Gave Servers a Backlink. The Backlink Could Name a Private Page.

A click can arrive with a return address. In 1996, HTTP's `Referer` header let the receiving server learn which page supplied the link. That helped operators repair broken links and see how readers reached a document. The same specification warned that the source could be private. Two decades later, a W3C policy draft turned the size of that return address into an explicit choice: the full page, the site's origin, or silence.

Apple Added Two Computers. It Took Three Playlist Burns Away.

For its first anniversary in 2004, the iTunes Music Store enlarged one permission and tightened another. Purchased songs could now play on five personal computers, including songs bought earlier. The same playlist could be burned to CD seven times instead of ten. The 99-cent price stayed simple; the rights around it had moving parts.

Passport Promised One Login. It Kept a Site-by-Site Sign-In Record.

Microsoft sold a simpler way to enter participating websites. The FTC's 2002 complaint described the less visible product of that convenience: a record of which sites each Passport user signed into, and when.

Amazon Put Books on Other People's Pages. It Kept the Checkout and the Clock.

By the end of 1996, more than 4,800 websites had joined Amazon's Associates program. They recommended books to their readers; Amazon took the order and shipped it. About 430,000 sites had enrolled by February 2000. A later filed operating agreement makes the bargain sharper: the publisher's link needed Amazon's tracking tag, and a sale had to fit Amazon's time and product rules before a commission was due.

Pets.com Shut Its Store. The Puppet Went on the Sale List.

The checkout went dark on 10 November 2000. The company's paperwork kept moving: inventory, warehouse equipment, web addresses and even its famous advertising character became assets in a liquidation.

Google Sold AdWords by the Thousand. Then a Click Could Beat a Bigger Bid.

In 2000, a small advertiser could buy a place beside Google results for a set price per thousand appearances. Two years later the bill arrived only when someone clicked, and the best-paid offer could lose the better slot to an ad people actually used. Google changed the meter and the referee while keeping the auction in its own search page.