6 ms·
> 1. they are crawling potentially sensitive information granted by links with tokens Don't put Facebook tracking on sensitive pages. Actually as a service to
by K0nserv 9y ago
> 1. they are crawling potentially sensitive information granted by links with tokens
Don't put Facebook tracking on sensitive pages. Actually as a service to your users don't put it anywhere where it doesn't add value.
> 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links
They only perform idempotent[0]* requests which should not have any negative effect if performed multiple times
0: http://restcookbook.com/HTTP%20Methods/idempotency/ http://restcookbook.com/HTTP%20Methods/idempotency/
* They probably only actually perform GET in reality
- d33 9y agoGET is only idempotent in theory. Way too many people abuse GET when creating websites.
- eesmith 9y agoAs an example of the problem, see the "Issues and criticism" of the related topic "Link prefetching" in Wikipedia - https://en.wikipedia.org/wiki/Link_prefetching#Issues_and_criticisms https://en.wikipedia.org/wiki/Link_prefetching#Issues_and_cr... .
- icebraining 9y agoAlmost all of those problems only apply to in-browser prefetchers, which reuse the user's session and connection.
- eesmith 9y agoPoint taken. Thanks for the correction.
- mosselman 9y agoI believe that is the point that @K0nserv is making. The 'abuse' part I mean.
- VMG 9y agoThose people should suffer the consequences. I'm not a fan of facebook in the slightest, but they are crawling websites they were essentially invited to.
- CapacitorSet 9y ago>websites they were essentially invited to Using an analytics pixel is _not_ an invitation to crawl a website.
- eli 9y agoNo, merely posting it on a public server was the invitation
- thecatspaw 9y agoIt is not. Leaving your door unlocked is not inviting everybody in to take your stuff. You might make it easier for them to break in, but it still is a break in. Making something available to the public is not the same as going to the google webmaster tools and telling them to index your page.
- eli 9y agoSomeone viewing a webpage you put online is not at all like someone stealing something you own.
- freehunter 9y agoYou can argue it's abuse or illegal or fraud or whatever you want, but here's the thing: how are you going to stop them? Sure, maybe you stop Facebook with a lawsuit... but everyone else is still doing it, even people outside of your legal jurisdiction. They're still going to do it, so it's up to you to stop them with your design. If someone breaks into your website and destroys a user's data or steals their credit card, that user is not going to want to hear "but what they did was against our ToS!" This isn't your house where there are police patrolling and ready to respond at a moment's notice when they're called. This is the Internet, accessible by almost literally everyone on the planet, and they don't give a shit about your policy. That's why best practices and application security was invented. So use it.
- pmlnr 9y agoI fixed it: Don't put tracking on sensitive pages.
- cup-of-tea 9y ago> Actually as a service to your users don't put it anywhere where it doesn't add value. So don't put it anywhere.
- K0nserv 9y agoI believe the tracking stuff comes with Like buttons and other Facebook widgets those are what I am referring to when I say "add value". But it could be argued that the tracking alone never adds value to the user.
- thecatspaw 9y agoIt could also be argued that not even the like buttons add value
- freehunter 9y agoIt could also be argued the exact opposite.
- naiveai 9y agoEven according to that document, idempotent methods still can update resources as long as the representation doesn't change: > Again, this only applies to the result, not the resource itself. This still can be manipulated (like an update-timestamp, provided this information is not shared in the (current) resource representation. This means that tracking is still could potentially affect some stuff, but honestly not by much.