3 ms·

> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often

> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often already do) detect the various supported mechanisms for hyperlink auditing in each browser and disabling the more user friendly mechanisms will cause them to fall back to the less user friendly ones, without actually disabling the hyperlink auditing functionality itself." Sites that wanted to track have always been tracking clicks on links on their pages using JavaScript or redirection pages that first record the click and then send the browser to the destination that the user wanted to go to. Ping is just a better way for sites to implement tracking, and if more sites move to this, the easier it’ll be to block (like uBlock Origin has already done). In conjunction with other Firefox extensions that thwart “traditional” click tracking, we can cover everything. I find Mozilla’s (and Apple’s) position on enabling this by default tenable, because we certainly don’t want sites to block Firefox for this reason or tell users to use another browser (with euphemisms like) “for a better experience”. On this point, I think Brave has cornered itself as a niche browser that sites may start revolting against when it grows. What is not acceptable from any browser vendor, especially a vendor like Mozilla or Apple that wears privacy on its sleeves, is not having a way to disable this using preferences (visible or something like about:config or defaults). Not everyone may want to trust and install several extensions for things like this. On this, Mozilla has failed (and so has Apple, though I didn’t check that in this context).

pilif 8y ago
By making it possible to disable it, you are adding fingerprintable bits of entropy to your browser. Concerns about this were also the reason why toggling the sending of the DNT header was removed for example.
- jabl 8y ago
  DNT support was removed from Firefox? When did this happen? Probably good for the reasons you mention considering DNT is dead anyway.
stephenr 8y ago
The solution to this is eg a content blocker in safari. The browser still reports “ping” as usable so no blocking of the user or expensive (resource wise) js alternatives, but when you click the link the URL is evaluated as being blocked and safari does nothing relating to the ping. This isn’t theory, I’ve tested it and it works. I don’t know enough about blocking capabilities in Firefox to theorise how it would work there.
- bangonkeyboard 8y ago
  > This isn’t theory, I’ve tested it and it works. That only works when the destination URL of the ping is specified as a content blocker rule. Content blockers are too limited to block the ping mechanism itself, so you would need to statically add every single arbitrary tracker URL pattern to the ruleset and hope they don't match a site or resource you want.
  - stephenr 8y ago
    That is literally my point. You don’t need to “block” the ping functionality (which itself would be come a fingerprinting data point) any more than you need to block xhr/fetch or following 301 redirects (which are also used for the same purposes the ping attribute may be used for) There are literally dozens of content blockers available for both macOS and iOS and all have extensive block lists of trackers, ad networks, etc. Some also allow you to add custom rules. That same content blocker will also block XHR/fetch based link tracking that many will just fallback to if ping support is not detected.
3xblah 8y ago
What if it was a compile-time option? If those capable were compiling and sharing versions of Firefox without some of these "features", perhaps some users might be interested. Bias/ignorance: I like to use smaller software for doing TCP connections and HTTP requests that require more modest resources and shorter time to compile; often these projects provide many compile-time options. There are many, many examples of such software. First example that comes to mind for some reason is socat, if one needs an example of what I mean.

pilif 8y ago

By making it possible to disable it, you are adding fingerprintable bits of entropy to your browser. Concerns about this were also the reason why toggling the sending of the DNT header was removed for example.

jabl 8y ago
DNT support was removed from Firefox? When did this happen? Probably good for the reasons you mention considering DNT is dead anyway.

stephenr 8y ago

The solution to this is eg a content blocker in safari. The browser still reports “ping” as usable so no blocking of the user or expensive (resource wise) js alternatives, but when you click the link the URL is evaluated as being blocked and safari does nothing relating to the ping. This isn’t theory, I’ve tested it and it works. I don’t know enough about blocking capabilities in Firefox to theorise how it would work there.

bangonkeyboard 8y ago
> This isn’t theory, I’ve tested it and it works. That only works when the destination URL of the ping is specified as a content blocker rule. Content blockers are too limited to block the ping mechanism itself, so you would need to statically add every single arbitrary tracker URL pattern to the ruleset and hope they don't match a site or resource you want.
- stephenr 8y ago
  That is literally my point. You don’t need to “block” the ping functionality (which itself would be come a fingerprinting data point) any more than you need to block xhr/fetch or following 301 redirects (which are also used for the same purposes the ping attribute may be used for) There are literally dozens of content blockers available for both macOS and iOS and all have extensive block lists of trackers, ad networks, etc. Some also allow you to add custom rules. That same content blocker will also block XHR/fetch based link tracking that many will just fallback to if ping support is not detected.

3xblah 8y ago

What if it was a compile-time option? If those capable were compiling and sharing versions of Firefox without some of these "features", perhaps some users might be interested. Bias/ignorance: I like to use smaller software for doing TCP connections and HTTP requests that require more modest resources and shorter time to compile; often these projects provide many compile-time options. There are many, many examples of such software. First example that comes to mind for some reason is socat, if one needs an example of what I mean.