3 ms·

> This referrer is very useful to figure out where traffic is coming from. This is exactly why sending the referrer header is insane[1]. The header betrays the

by pdkl95 7y ago

> This referrer is very useful to figure out where traffic is coming from. This is exactly why sending the referrer header is insane[1]. The header betrays the user's privacy by design. Remove it ASAP. If your app breaks, that's unfortunate but necessary. [1] https://news.ycombinator.com/item?id=20468115 https://news.ycombinator.com/item?id=20468115

noman-land 7y ago
We have an eslint rule at work that forces you to add `rel="noreferrer noopener"`to any outbound link you write precisely because it's a security concern.
- dessant 7y ago
  It's enough to add rel="noreferrer" to links, noopener is implied. https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://html.spec.whatwg.org/multipage/links.html#link-type-...
- deleted 7y ago
  [deleted]
liquidise 7y ago
Necessary for whom? Privacy purists seem to be surprised that website and app owners want/need analytics to meaningfully improve their app's usability. I praise SA's privacy oriented approach as a meaningful alternative to GA. This sort of overly-critical hyperbole doesn't help the privacy conversation. If follow SA loses a feature it likely needs to remain competitive, and customers would have another reason to go back to Google Analytics. Hardly a necessary privacy win a my book.
- pdkl95 7y ago
  > Necessary for whom? Necessary for anyone interested in preserving democracy[1]. Unless we actively fight to preserve privacy, surveillance capitalism will continue to "disrupt" traditional forms of power. > If follow SA loses a feature it likely needs to remain competitive, and customers would have another reason to go back to Google Analytics. Continuing the betrayal of user privacy in the hope of appeasing the surveillance capitalists won't be "[privacy] for our time". Advertisers and other eavesdroppers have consistently demonstrated they will maximally exploit any tool available to them. [1] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and-a-the-age-of-surveillance-capital.html http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...
- TeMPOraL 7y ago
  > Privacy purists seem to be surprised that website and app owners want/need analytics to meaningfully improve their app's usability. Both "privacy purists" and many other people see this as expediency at best, and a lie at worst (i.e. once marketing gets wind of the tracking built for development purposes; see e.g. recent Gitlab fiasco).

by pdkl95 7y ago

noman-land 7y ago

We have an eslint rule at work that forces you to add `rel="noreferrer noopener"`to any outbound link you write precisely because it's a security concern.

dessant 7y ago
It's enough to add rel="noreferrer" to links, noopener is implied. https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://html.spec.whatwg.org/multipage/links.html#link-type-...
deleted 7y ago
[deleted]

liquidise 7y ago

Necessary for whom? Privacy purists seem to be surprised that website and app owners want/need analytics to meaningfully improve their app's usability. I praise SA's privacy oriented approach as a meaningful alternative to GA. This sort of overly-critical hyperbole doesn't help the privacy conversation. If follow SA loses a feature it likely needs to remain competitive, and customers would have another reason to go back to Google Analytics. Hardly a necessary privacy win a my book.

pdkl95 7y ago
> Necessary for whom? Necessary for anyone interested in preserving democracy[1]. Unless we actively fight to preserve privacy, surveillance capitalism will continue to "disrupt" traditional forms of power. > If follow SA loses a feature it likely needs to remain competitive, and customers would have another reason to go back to Google Analytics. Continuing the betrayal of user privacy in the hope of appeasing the surveillance capitalists won't be "[privacy] for our time". Advertisers and other eavesdroppers have consistently demonstrated they will maximally exploit any tool available to them. [1] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and-a-the-age-of-surveillance-capital.html http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...
TeMPOraL 7y ago
> Privacy purists seem to be surprised that website and app owners want/need analytics to meaningfully improve their app's usability. Both "privacy purists" and many other people see this as expediency at best, and a lie at worst (i.e. once marketing gets wind of the tracking built for development purposes; see e.g. recent Gitlab fiasco).