4 ms·

Wouldn't those requests be unblockable, as you don't know if it'll be a 204 until you get the response?

1vuio0pswjnm7 5y ago
On the first time, I agree. However once a 204 response is discovered in the logs the domain or URL can be blocked going forward. I generally do not use a Javascript-capable browser nor enable Javascript when I am using a popular browser so JS-triggered requests for no content fail on account of no JS engine available. In cases outside the browser, e.g., checks to detect captive portals, I block them with a proxy.
- Minor49er 5y ago
  How is this fooling the user? And why would you block something that's performing a desired action simply because of a certain response? That would be like saying that a server returning a 404 tricked you into thinking that a page existed, so the URL that returned it should be blocked.
  - 1vuio0pswjnm7 5y ago
    It is not performing a desired action. For example, I have no need for making a request to https://www.youtube.com/generate_204 https://www.youtube.com/generate_204 because I search, browse and download from YouTube via the command line, without using youtube_dl. Making that request, repeatedly, for no content does not benefit me in the slightest. Thus I do not make it. Why would I. Other users may operate the computer using popular software running under default settings where, e.g., visiting a website automatically runs a number of Javascripts unseen by the user and the user implicitly trusts that, whatever these scripts are doing, it is necessary and for the user's benefit. We know that is not always true. (This blog post shows us a number of instances where JS is used unncessarily.) There could certainly be legitimate uses for the non-JS 204 no content data sending technique. If I was using a website where this was useful, of course I would not block it. I am not yet aware of any such website among the ones I visit. Every use of requests for no content I have seen has been unnecessary. Usually it is some form of telemetry, sending data about user behaviour to a server without any prior user consent or affirmative action. I suffer no loss of benefits by not making or blocking these requests. For me, this is the most sensible approach. YMMV.
    - Minor49er 5y ago
      It sounds like your main problem is with telemetry, which you may be misidentifying solely based on the response, rather than with that particular response itself
- jvdvegt 5y ago
  The indicated use case is for non-JavaScript pages...

On the first time, I agree. However once a 204 response is discovered in the logs the domain or URL can be blocked going forward. I generally do not use a Javascript-capable browser nor enable Javascript when I am using a popular browser so JS-triggered requests for no content fail on account of no JS engine available. In cases outside the browser, e.g., checks to detect captive portals, I block them with a proxy.

Minor49er 5y ago
How is this fooling the user? And why would you block something that's performing a desired action simply because of a certain response? That would be like saying that a server returning a 404 tricked you into thinking that a page existed, so the URL that returned it should be blocked.
- 1vuio0pswjnm7 5y ago
  It is not performing a desired action. For example, I have no need for making a request to https://www.youtube.com/generate_204 https://www.youtube.com/generate_204 because I search, browse and download from YouTube via the command line, without using youtube_dl. Making that request, repeatedly, for no content does not benefit me in the slightest. Thus I do not make it. Why would I. Other users may operate the computer using popular software running under default settings where, e.g., visiting a website automatically runs a number of Javascripts unseen by the user and the user implicitly trusts that, whatever these scripts are doing, it is necessary and for the user's benefit. We know that is not always true. (This blog post shows us a number of instances where JS is used unncessarily.) There could certainly be legitimate uses for the non-JS 204 no content data sending technique. If I was using a website where this was useful, of course I would not block it. I am not yet aware of any such website among the ones I visit. Every use of requests for no content I have seen has been unnecessary. Usually it is some form of telemetry, sending data about user behaviour to a server without any prior user consent or affirmative action. I suffer no loss of benefits by not making or blocking these requests. For me, this is the most sensible approach. YMMV.
  - Minor49er 5y ago
    It sounds like your main problem is with telemetry, which you may be misidentifying solely based on the response, rather than with that particular response itself
jvdvegt 5y ago
The indicated use case is for non-JavaScript pages...