4 ms·

All this talk about tracking prevention, but it also seems like safari 12.1 REMOVES link tracking (<a ping>) prevention: https://lapcatsoftware.com/articles/Saf

by 0x0 8y ago

All this talk about tracking prevention, but it also seems like safari 12.1 REMOVES link tracking (<a ping>) prevention: https://lapcatsoftware.com/articles/Safari-link-tracking.html https://lapcatsoftware.com/articles/Safari-link-tracking.htm...

sitharus 8y ago
Interesting, but given it’s a link already controlled by the website I don’t see the difference between ping and simply linking to a tracking URL like google already does. This just allows websites to retain proper semantics. Feel free to educate me though :)
- 0x0 8y ago
  document.cookie is also already controlled by the website, but due to everyone <script src>'ing 3rd party trackers like GA it looks like they felt the need to limit this api. So why remove the possibility for blocking the same scripts from doing foreach('a').attr('ping','3rdpartytracker/uniqueId/'+this.href)?
  - eridius 8y ago
    Nothing's stopping those scripts today from converting all links to bouncing through a redirect domain for tracking, and yet scripts aren't doing that.
    - 0x0 8y ago
      That has UX implications, with the mouseover statusbar link target popup and the right/middle mouse click to copy-url/open-in-new-tab features making it much more obvious.
      - acdha 8y ago
        Okay, so imagine it’s adding click event handlers which use XHR/Beacon to avoid the user-visible rewriting. That’s the same impact but everything is slower and you have edge cases where navigation fails with no user feedback at all.
acdha 8y ago
That’s just the author of that post not having thought through the security model. <a ping> doesn’t do anything which isn’t already commonplace – it just does it without performance and reliability impacts. Without that feature, everyone still gets tracked but they have to wait for often-buggy JavaScript or server redirects to complete before navigating.
stephenr 8y ago
A ping attribute does nothing if you have a content blocker and block the URL it would have tried to contact.

by 0x0 8y ago

sitharus 8y ago

Interesting, but given it’s a link already controlled by the website I don’t see the difference between ping and simply linking to a tracking URL like google already does. This just allows websites to retain proper semantics. Feel free to educate me though :)

0x0 8y ago
document.cookie is also already controlled by the website, but due to everyone <script src>'ing 3rd party trackers like GA it looks like they felt the need to limit this api. So why remove the possibility for blocking the same scripts from doing foreach('a').attr('ping','3rdpartytracker/uniqueId/'+this.href)?
- eridius 8y ago
  Nothing's stopping those scripts today from converting all links to bouncing through a redirect domain for tracking, and yet scripts aren't doing that.
  - 0x0 8y ago
    That has UX implications, with the mouseover statusbar link target popup and the right/middle mouse click to copy-url/open-in-new-tab features making it much more obvious.
    - acdha 8y ago
      Okay, so imagine it’s adding click event handlers which use XHR/Beacon to avoid the user-visible rewriting. That’s the same impact but everything is slower and you have edge cases where navigation fails with no user feedback at all.

acdha 8y ago

That’s just the author of that post not having thought through the security model. <a ping> doesn’t do anything which isn’t already commonplace – it just does it without performance and reliability impacts. Without that feature, everyone still gets tracked but they have to wait for often-buggy JavaScript or server redirects to complete before navigating.

stephenr 8y ago

A ping attribute does nothing if you have a content blocker and block the URL it would have tried to contact.